Spyware / Malware / Virus Removal

Superantispyware finds Rogue.agent/GEN - Nullo[dll]

21 min read

Looking for the outcome? Ask AI

Tomk

Post #31August 29, 2011, 2:00 PM UTC

I'm not finding anything in them that looks harmful or is at all helpful to me. I've got some others looking and I'll get back to you as soon as I have something.

sinweiy

Post #32August 29, 2011, 2:48 PM UTC last edited August 30, 2011, 12:54 AM UTC

Ok, Thanks.
while at it, i use Spybot to do a scan and found this:

Win32.Palevo:
[SBI $AD9D6460] User settings
(Registry key, fixed) HKEY_USERS\S-1-5-21-299502267-1788223648-725345543-1004\Software\Microsoft\InternetExplorer\DOMStorage\allslotscasino.com

— Spybot - Search & Destroy version: 1.6.2 (build: 20090126)

seem to have some improvement….will see when i restart….
still the usual 0242842141.dll.
ok, strange…this morning i cannot turn on my firewall!
then i search for solution and i use sharedaccess.reg
http://windowsxp.mvps.org/sharedaccess.htm
when i restart, i recieved a "Do you want to keep blocking this program, Windows Explorer." message.
i think the Windows Explorer is infected.

Tomk

Post #33August 30, 2011, 4:40 AM UTC

Please give this a try:

Download AVPTool from Here to your desktop

Run the programme you have just downloaded to your desktop (it will be randomly named )

First we will run a virus scan

Click the cog in the upper right
[external image: Posted Image]

Select down to and including your main drive, once done select the Automatic scan tab and press Start Scan
[external image: Posted Image]

Allow AVP to delete all infections found
Once it has finished select report tab (last tab)
Select Detected threads report from the left and press Save button
Save it to your desktop and attach to your next post

Now the Analysis

Rerun AVP and select the Manual Disinfection tab and press Start Gathering System Information

[external image: Posted Image]

On completion click the link to locate the zip file to upload and attach to your next post

[external image: Posted Image]

sinweiy

Post #34August 30, 2011, 10:37 PM UTC last edited August 31, 2011, 12:48 AM UTC

i did a SAS scan in safe mode before the AVPtool.
but my SAS expired or something and i am not sure it remove the threats.
i thought my SAS was a Free edition. It keep asking me to register.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/30/2011 at 11:34 AM

Application Version : 5.0.1118

Core Rules Database Version : 7561
Trace Rules Database Version: 5373

Scan type : Complete Scan
Total Scan Time : 02:02:33

Operating System Information
Windows XP Home Edition 32-bit, Service Pack 3 (Build 5.01.2600)
Administrator

Memory items scanned : 261
Memory threats detected : 0
Registry items scanned : 39674
Registry threats detected : 15
File items scanned : 86148
File threats detected : 1

Trojan.Agent/Gen-StartPage
HKCR\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}
HKCR\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\InprocServer32
HKCR\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\InprocServer32#ThreadingModel
HKCR\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\ProgID
HKCR\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\TypeLib
HKCR\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\VersionIndependentProgID
HKLM\Software\Classes\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}
HKCR\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}
HKCR\Safemon.NavigatMon.1
HKCR\Safemon.NavigatMon.1\CLSID
HKCR\Safemon.NavigatMon
HKCR\Safemon.NavigatMon\CLSID
HKCR\Safemon.NavigatMon\CurVer
HKCR\TypeLib\{BB67E9B5-A1A3-4206-A443-DE93D592682C}
HKU\S-1-5-21-299502267-1788223648-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}

Adware.Tracking Cookie
sftrack.searchforce.net [ D:\DOCUMENTS AND SETTINGS\MY PC\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\22RC58YM ]

For the AVPTool, which took 15 over hrs(!), there was nothing on the main drive (D:).
Attached is the zip file.

thanks!

Attachments:

📎avptool_sysinfo.zip

Tomk

Post #35September 1, 2011, 4:31 AM UTC

sinweiy,

I already warned you about the great risks you take when downloading torrents. Let me say that the risks seem to multiply when downloading porn. That said - the ones on your system don't seem to be infected…. this time.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
File::
D:\WINDOWS\system32\DRIVERS\6391975drv.sys
d:\windows\system32\1113134341.dll
```
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

sinweiy

Post #36September 1, 2011, 12:01 PM UTC

Okay, noted.

It's the ComboFix i have an updated copy? i thought i downloaded the lastest, but it prompted me, but i just carried on with the scan.

ComboFix 11-08-27.01 - my pc 1/2011 Thu 19:46:11.5.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.936.86.1033.18.2047.1446 [GMT 8:00]
执行位置: d:\documents and settings\my pc\Desktop\ComboFix.exe
Command switches used :: d:\documents and settings\my pc\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
- 降低功能模式 -
.
FILE ::
"d:\windows\system32\1113134341.dll"
"d:\windows\system32\DRIVERS\6391975drv.sys"
.
.
((((((((((((((((((((((((( 2011-08-01 至 2011-09-01 的新的档案 )))))))))))))))))))))))))))))))
.
.
2011-09-01 11:37 . 2011-09-01 11:37 24983 —-a-w- d:\windows\system32\11372995641.dll
2011-08-30 05:36 . 2011-08-30 05:36 ——– d—–w- d:\documents and settings\All Users\Application Data\!SASCORE
2011-08-30 04:28 . 2011-08-30 04:28 ——– d—–w- d:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-08-30 04:27 . 2011-08-30 05:18 ——– d—–w- d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com
2011-08-30 04:00 . 2011-08-30 04:00 ——– d—–w- d:\documents and settings\All Users\Application Data\SUPERSetup
2011-08-28 13:28 . 2011-08-28 13:28 ——– d—–w- d:\documents and settings\my pc\Local Settings\Application Data\Norman Malware Cleaner
2011-08-27 04:17 . 2011-08-31 18:30 ——– d—–w- D:\Media
2011-08-25 13:59 . 2011-08-25 13:59 ——– d—–w- d:\program files\Microsoft Silverlight
2011-08-24 06:03 . 2011-08-24 06:03 ——– d—a-w- D:\.Trash-999
2011-08-23 15:11 . 2011-07-29 05:54 19840 —-a-w- d:\windows\system32\EuEpmGdi.dll
2011-08-23 15:11 . 2011-08-02 12:48 2469248 —-a-w- d:\windows\system32\BootMan.exe
2011-08-23 15:11 . 2011-07-29 05:54 86408 —-a-w- d:\windows\system32\setupempdrv03.exe
2011-08-23 15:11 . 2011-07-29 05:54 8456 —-a-w- d:\windows\system32\EuGdiDrv.sys
2011-08-23 15:11 . 2011-07-29 05:54 13192 —-a-w- d:\windows\system32\epmntdrv.sys
2011-08-23 15:10 . 2011-08-23 15:10 ——– d—–w- d:\program files\EASEUS
2011-08-23 11:50 . 2010-11-03 18:08 237568 —-a-w- d:\windows\system32\yv12vfw.dll
2011-08-23 11:50 . 2011-06-24 14:44 243200 —-a-w- d:\windows\system32\xvidvfw.dll
2011-08-23 11:50 . 2011-06-24 14:28 650752 —-a-w- d:\windows\system32\xvidcore.dll
2011-08-23 11:50 . 2011-08-08 08:00 74752 —-a-w- d:\windows\system32\ff_vfw.dll
2011-08-20 08:06 . 2011-08-20 08:06 896 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\databasepath.reg
2011-08-20 08:06 . 2011-08-20 08:06 3008 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\bgregfix.reg
2011-08-20 08:06 . 2011-08-20 08:06 2600 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\exefix.reg
2011-08-20 08:06 . 2011-08-20 08:06 951291 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\remregfix.reg
2011-08-20 08:06 . 2011-08-20 08:06 890 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\Remove-itRestorePoint.vbs
2011-08-20 08:06 . 2011-08-20 08:06 5228 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\nfig.reg
2011-08-20 08:06 . 2011-08-20 08:06 4994 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\s.reg
2011-08-20 08:06 . 2011-08-20 08:06 4512 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\hpregfix.reg
2011-08-20 08:06 . 2011-08-20 08:06 18308 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\IEDef.reg
2011-08-20 08:06 . 2011-08-20 08:06 1754 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\regf.reg
2011-08-20 07:06 . 2008-05-02 13:25 465920 -c—-w- d:\windows\system32\dllcache\imapi2fs.dll
2011-08-20 07:06 . 2008-05-02 13:25 465920 ——w- d:\windows\system32\imapi2fs.dll
2011-08-20 07:06 . 2008-05-02 13:25 317952 -c—-w- d:\windows\system32\dllcache\imapi2.dll
2011-08-20 07:06 . 2008-05-02 13:25 317952 ——w- d:\windows\system32\imapi2.dll
2011-08-20 06:55 . 2011-08-20 07:11 ——– d—–w- d:\documents and settings\LocalService\Application Data\360safe
2011-08-20 04:09 . 2011-08-20 04:09 ——– d—–w- d:\program files\Chaos Group
2011-08-20 03:34 . 2009-07-21 12:24 14080 —-a-w- d:\windows\system32\drivers\36040.tmp
2011-08-20 03:34 . 2009-06-03 14:26 27400 —-a-w- d:\windows\system32\drivers\3603F.tmp
2011-08-20 03:33 . 2011-08-20 08:54 ——– d—–w- d:\documents and settings\All Users\Application Data\360safe
2011-08-20 03:27 . 2011-08-20 03:27 ——– d—–w- d:\documents and settings\All Users\Application Data\360SD
2011-08-19 12:51 . 2011-08-19 13:36 ——– d—–w- d:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2011-08-19 12:51 . 2011-08-19 12:59 ——– d—–w- d:\program files\Spybot - Search & Destroy
2011-08-16 15:50 . 2011-08-27 01:41 ——– d—–w- d:\program files\SpywareBlaster
2011-08-16 15:47 . 2011-08-16 15:47 ——– d—–w- d:\program files\ESET
2011-08-16 15:29 . 2011-08-30 04:11 ——– d—–w- d:\program files\Panda Security
2011-08-16 14:20 . 2010-05-25 07:59 96488 —-a-w- d:\windows\system32\drivers\ssadbus.sys
2011-08-16 14:20 . 2010-05-25 07:59 30312 —-a-w- d:\windows\system32\drivers\ssadadb.sys
2011-08-16 14:20 . 2010-05-25 07:59 1416680 —-a-w- d:\windows\system32\WdfCoInstaller01005.dll
2011-08-16 14:20 . 2010-05-25 07:59 12776 —-a-w- d:\windows\system32\drivers\ssadmdfl.sys
2011-08-16 14:20 . 2010-05-25 07:59 121576 —-a-w- d:\windows\system32\drivers\ssadmdm.sys
2011-08-16 14:20 . 2010-05-25 07:59 10344 —-a-w- d:\windows\system32\drivers\ssadcmnt.sys
2011-08-16 14:20 . 2010-05-25 07:59 10216 —-a-w- d:\windows\system32\drivers\ssadwhnt.sys
2011-08-13 05:16 . 2011-08-13 05:16 ——– d—–w- d:\program files\FileHippo.com
2011-08-13 04:46 . 2011-08-30 05:21 ——– d—–w- d:\program files\SUPERAntiSpyware
2011-08-13 03:40 . 2011-08-13 03:40 110080 —-a-r- d:\documents and settings\my pc\Application Data\Microsoft\Installer\{4FC9DA9D-F608-454E-8191-D7EFFDCC5726}\IconF7A21AF7.exe
2011-08-13 03:40 . 2011-08-13 03:40 110080 —-a-r- d:\documents and settings\my pc\Application Data\Microsoft\Installer\{4FC9DA9D-F608-454E-8191-D7EFFDCC5726}\IconD7F16134.exe
2011-08-13 03:40 . 2011-08-18 13:31 ——– d—–w- D:\sh4ldr
2011-08-13 03:40 . 2011-08-13 03:40 ——– d—–w- d:\program files\Enigma Software Group
2011-08-13 03:39 . 2011-08-13 03:40 ——– d—–w- d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2011-08-13 03:39 . 2011-08-30 05:14 ——– d—–w- d:\program files\Common Files\Wise Installation Wizard
2011-08-12 14:16 . 2008-04-13 21:41 81920 -c–a-w- d:\windows\system32\dllcache\ieencode.dll
2011-08-12 14:16 . 2008-04-13 21:41 81920 ——w- d:\windows\system32\ieencode.dll
2011-08-12 14:15 . 2006-12-28 16:31 19569 —-a-w- d:\windows\000001_.tmp
2011-08-11 15:00 . 2001-08-17 06:07 32640 -c–a-w- d:\windows\system32\dllcache\symc8xx.sys
2011-08-11 15:00 . 2001-08-17 06:07 16256 -c–a-w- d:\windows\system32\dllcache\symc810.sys
2011-08-11 15:00 . 2001-08-17 06:07 30688 -c–a-w- d:\windows\system32\dllcache\sym_u3.sys
2011-08-11 15:00 . 2001-08-17 06:07 28384 -c–a-w- d:\windows\system32\dllcache\sym_hi.sys
2011-08-11 15:00 . 2001-08-17 14:36 94293 -c–a-w- d:\windows\system32\dllcache\sxports.dll
2011-08-11 15:00 . 2001-08-17 05:50 103936 -c–a-w- d:\windows\system32\dllcache\sx.sys
2011-08-11 15:00 . 2001-08-17 06:02 3968 -c–a-w- d:\windows\system32\dllcache\swusbflt.sys
2011-08-11 14:58 . 2001-08-17 05:53 9600 -c–a-w- d:\windows\system32\dllcache\sonymc.sys
2011-08-11 14:57 . 2001-08-17 04:50 50432 -c–a-w- d:\windows\system32\dllcache\sisv.sys
2011-08-11 14:56 . 2001-08-17 05:51 16640 -c–a-w- d:\windows\system32\dllcache\scmstcs.sys
2011-08-11 14:55 . 2001-08-17 04:12 19017 -c–a-w- d:\windows\system32\dllcache\rtl8029.sys
2011-08-11 14:54 . 2001-08-17 05:28 112574 -c–a-w- d:\windows\system32\dllcache\ptserlp.sys
2011-08-11 14:53 . 2001-08-17 04:11 35328 -c–a-w- d:\windows\system32\dllcache\pcntpci5.sys
2011-08-11 14:52 . 2001-08-17 04:50 198144 -c–a-w- d:\windows\system32\dllcache\nv3.sys
2011-08-11 14:51 . 2001-08-17 04:11 128000 -c–a-w- d:\windows\system32\dllcache\n100325.sys
2011-08-11 14:50 . 2001-08-17 05:57 16128 -c–a-w- d:\windows\system32\dllcache\modemcsa.sys
2011-08-11 14:49 . 2001-08-17 04:12 20573 -c–a-w- d:\windows\system32\dllcache\lne100.sys
2011-08-11 14:48 . 2001-08-17 14:36 372824 -c–a-w- d:\windows\system32\dllcache\iconf32.dll
2011-08-11 14:47 . 2001-08-17 05:28 44863 -c–a-w- d:\windows\system32\dllcache\hsf_soar.sys
2011-08-11 14:46 . 2001-08-17 06:02 2688 -c–a-w- d:\windows\system32\dllcache\hidswvd.sys
2011-08-11 14:45 . 2001-08-17 04:11 12362 -c–a-w- d:\windows\system32\dllcache\f3ab18xi.sys
2011-08-11 14:44 . 2001-08-17 04:11 69194 -c–a-w- d:\windows\system32\dllcache\el656cd5.sys
2011-08-11 14:43 . 2001-08-17 14:36 24064 -c–a-w- d:\windows\system32\dllcache\devldr32.exe
2011-08-11 14:42 . 2001-08-17 04:13 27164 -c–a-w- d:\windows\system32\dllcache\ce3n5.sys
2011-08-10 13:34 . 2008-04-13 16:06 14208 -c–a-w- d:\windows\system32\dllcache\battc.sys
2011-08-09 10:36 . 2011-08-09 10:36 ——– d—–w- d:\documents and settings\my pc\Local Settings\Application Data\Octoshape
2011-08-09 10:36 . 2011-08-09 10:36 ——– d—–w- d:\documents and settings\my pc\Application Data\Octoshape
2011-08-09 03:12 . 2011-08-09 03:13 ——– d—–w- d:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2011-08-09 03:12 . 2011-08-09 03:12 ——– d—–w- d:\documents and settings\my pc\Application Data\Windows Search
2011-08-09 03:11 . 2011-08-09 03:11 ——– d—–w- d:\windows\system32\winrm
2011-08-09 03:11 . 2011-08-09 03:11 ——– dc-h–w- d:\windows\$968930Uinstall_KB968930$
2011-08-09 03:11 . 2011-08-09 03:11 ——– d—–w- d:\documents and settings\my pc\Application Data\Windows Desktop Search
2011-08-09 03:10 . 2011-08-11 15:10 ——– d—–w- d:\program files\Windows Desktop Search
2011-08-09 03:10 . 2011-08-09 03:10 ——– d—–w- d:\windows\system32\GroupPolicy
2011-08-09 00:52 . 2011-08-09 00:52 ——– d—–w- d:\program files\Microsoft.NET
2011-08-07 02:15 . 2011-08-07 02:15 ——– d—–w- d:\documents and settings\All Users\Application Data\NVIDIA Corporation
2011-08-07 02:14 . 2011-08-09 05:09 ——– d—–w- d:\documents and settings\UpdatusUser
2011-08-07 02:14 . 2011-08-07 02:14 ——– d—–w- d:\documents and settings\All Users\Application Data\NVIDIA
2011-08-07 02:13 . 2011-05-25 06:09 543336 —-a-w- d:\windows\system32\easyupdatusapiu.dll
2011-08-07 02:13 . 2011-08-18 12:55 273344 —-a-w- d:\windows\system32\nvdrsdb1.bin
2011-08-07 02:13 . 2011-08-18 12:55 1 —-a-w- d:\windows\system32\nvdrssel.bin
2011-08-07 02:13 . 2011-08-18 12:55 273344 —-a-w- d:\windows\system32\nvdrsdb0.bin
2011-08-07 02:12 . 2011-05-25 06:09 61440 —-a-w- d:\windows\system32\OpenCL.dll
2011-08-07 02:12 . 2011-05-25 06:09 865896 —-a-w- d:\windows\system32\nvgenco322090.dll
2011-08-07 02:12 . 2011-05-25 06:09 899688 —-a-w- d:\windows\system32\nvdispco3220150.dll
2011-08-07 02:12 . 2011-05-25 06:09 2808936 —-a-w- d:\windows\system32\nvcuvid.dll
2011-08-07 02:12 . 2011-05-25 06:09 2082408 —-a-w- d:\windows\system32\nvcuvenc.dll
2011-08-07 02:12 . 2011-05-25 06:09 5332992 —-a-w- d:\windows\system32\nvcuda.dll
2011-08-07 02:12 . 2011-05-25 06:09 13004800 —-a-w- d:\windows\system32\nvcompiler.dll
2011-08-07 02:12 . 2011-08-18 12:52 ——– d—–w- d:\program files\NVIDIA Corporation
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-30 08:01 . 2011-06-25 00:10 404640 —-a-w- d:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-20 08:06 . 2006-02-28 12:00 4224 —-a-w- d:\windows\system32\drivers\beep.sys
2011-07-15 13:29 . 2008-10-09 22:35 456320 —-a-w- d:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-10-09 22:35 10496 —-a-w- d:\windows\system32\drivers\ndistapi.sys
2011-07-06 11:52 . 2010-10-16 00:47 41272 —-a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 11:52 . 2010-10-16 00:47 22712 —-a-w- d:\windows\system32\drivers\mbam.sys
2011-06-28 13:09 . 2010-10-23 04:52 138192 —-a-w- d:\windows\system32\drivers\avipbb.sys
2011-06-28 13:09 . 2010-10-23 04:52 66616 —-a-w- d:\windows\system32\drivers\avgntflt.sys
2011-06-24 14:10 . 2008-10-09 22:35 139656 —-a-w- d:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2006-02-28 12:00 916480 —-a-w- d:\windows\system32\wininet.dll
2011-06-23 18:36 . 2006-02-28 12:00 43520 —-a-w- d:\windows\system32\licmgr10.dll
2011-06-23 18:36 . 2006-02-28 12:00 1469440 ——w- d:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2006-02-28 12:00 385024 —-a-w- d:\windows\system32\html.iec
2011-06-20 17:44 . 2006-02-28 12:00 293376 —-a-w- d:\windows\system32\winsrv.dll
2011-06-07 03:13 . 2011-06-16 13:43 4659712 —-a-w- d:\windows\system32\Redemption.dll
2011-06-07 03:13 . 2011-06-07 03:13 974848 —-a-w- d:\windows\system32\cis-2.4.dll
2011-06-07 03:13 . 2011-06-07 03:13 90112 —-a-w- d:\windows\MAMCityDownload.ocx
2011-06-07 03:13 . 2011-06-07 03:13 81920 —-a-w- d:\windows\system32\issacapi_bs-2.3.dll
2011-06-07 03:13 . 2011-06-07 03:13 65536 —-a-w- d:\windows\system32\issacapi_pe-2.3.dll
2011-06-07 03:13 . 2011-06-07 03:13 57344 —-a-w- d:\windows\system32\MTXSYNCICON.dll
2011-06-07 03:13 . 2011-06-07 03:13 57344 —-a-w- d:\windows\system32\issacapi_se-2.3.dll
2011-06-07 03:13 . 2011-06-07 03:13 569344 —-a-w- d:\windows\system32\muzdecode.ax
2011-06-07 03:13 . 2011-06-07 03:13 491520 —-a-w- d:\windows\system32\muzapp.dll
2011-06-07 03:13 . 2011-06-07 03:13 49152 —-a-w- d:\windows\system32\MaJGUILib.dll
2011-06-07 03:13 . 2011-06-07 03:13 45056 —-a-w- d:\windows\system32\MaXMLProto.dll
2011-06-07 03:13 . 2011-06-07 03:13 40960 —-a-w- d:\windows\system32\MTTELECHIP.dll
2011-06-07 03:13 . 2011-06-07 03:13 352256 —-a-w- d:\windows\system32\MSLUR71.dll
2011-06-07 03:13 . 2011-06-07 03:13 325552 —-a-w- d:\windows\MASetupCaller.dll
2011-06-07 03:13 . 2011-06-07 03:13 30568 —-a-w- d:\windows\MusiccityDownload.exe
2011-06-07 03:13 . 2011-06-07 03:13 24576 —-a-w- d:\windows\system32\MASetupCleaner.exe
2011-06-07 03:13 . 2011-06-07 03:13 200704 —-a-w- d:\windows\system32\muzwmts.dll
2011-06-07 03:13 . 2011-06-07 03:13 155648 —-a-w- d:\windows\system32\MSFLib.dll
2011-06-07 03:13 . 2011-06-07 03:13 143360 —-a-w- d:\windows\system32\3DAudio.ax
2011-06-07 03:13 . 2011-06-07 03:13 14336 —-a-w- d:\windows\system32\avrt.dll
2011-06-07 03:13 . 2011-06-07 03:13 135168 —-a-w- d:\windows\system32\muzaf1.dll
2011-06-07 03:13 . 2011-06-07 03:13 131072 —-a-w- d:\windows\system32\muzmpgsp.ax
2011-06-07 03:13 . 2011-06-07 03:13 122880 —-a-w- d:\windows\system32\muzeffect.ax
2011-06-07 03:13 . 2011-06-07 03:13 118784 —-a-w- d:\windows\system32\MaDRM.dll
2011-06-07 03:13 . 2011-06-07 03:13 110592 —-a-w- d:\windows\system32\muzmp4sp.ax
2011-06-07 03:13 . 2011-06-16 13:43 821824 —-a-w- d:\windows\system32\dgderapi.dll
2011-06-07 03:13 . 2011-06-16 13:43 319456 —-a-w- d:\windows\system32\DIFxAPI.dll
2011-06-07 03:13 . 2011-06-16 13:43 20032 —-a-w- d:\windows\system32\drivers\dgderdrv.sys
2011-06-07 03:13 . 2011-06-07 03:13 57344 —-a-w- d:\windows\system32\MK_Lyric.dll
2011-06-07 03:13 . 2011-06-07 03:13 45056 —-a-w- d:\windows\system32\MACXMLProto.dll
2011-06-07 03:13 . 2011-06-07 03:13 40960 —-a-w- d:\windows\system32\MAMACExtract.dll
2011-06-07 03:13 . 2011-06-07 03:13 258048 —-a-w- d:\windows\system32\muzoggsp.ax
2011-06-07 03:13 . 2011-06-07 03:13 245760 —-a-w- d:\windows\system32\MSCLib.dll
2011-04-24 04:10 . 2011-04-24 04:10 197632 —-a-w- d:\program files\Common Files\OnlineFilesManager.dll
2011-08-12 05:57 . 2011-08-19 23:55 134104 —-a-w- d:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 09:06 163328 –sha-r- d:\windows\system32\flvDX.dll
2007-02-21 10:47 31232 –sha-r- d:\windows\system32\msfDX.dll
.
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0A0DDBD3-6641-40B9-873F-BBDD26D6C14E}]
2011-01-26 04:04 180696 —-a-w- d:\program files\easyMule\modules\IE2EM.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Online Files]
@="{B82655E9-B81D-4A97-8154-0D84A4C048E4}"
[HKEY_CLASSES_ROOT\CLSID\{B82655E9-B81D-4A97-8154-0D84A4C048E4}]
2011-04-24 04:10 197632 —-a-w- d:\program files\Common Files\OnlineFilesManager.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="d:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"SUPERAntiSpyware"="d:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-06-10 2424192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="d:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]
"nwiz"="d:\program files\NVIDIA Corporation\nView\nwiz.exe" [2011-05-04 1632360]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2011-05-25 13895272]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="d:\windows\system32\ctfmon.exe" [2008-04-13 15360]
.
d:\documents and settings\my pc\Start Menu\Programs\Startup\
BitTorrent (2).lnk - c:\program files\BitTorrent\bittorrent.exe [N/A]
Dropbox.lnk - d:\documents and settings\my pc\Application Data\Dropbox\bin\Dropbox.exe [2011-5-26 24176560]
.
d:\documents and settings\All Users\Start Menu\Programs\Startup\
Wireless Utility.lnk - d:\program files\Wireless\Common\Utility.exe [2010-12-29 602112]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "d:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- d:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-10-10 13:51 10792 —-a-w- d:\program files\Citrix\GoToAssist\480\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=d:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=d:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^JCMATTHEW WLAN.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\JCMATTHEW WLAN.lnk
backup=d:\windows\pss\JCMATTHEW WLAN.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Nokia Nseries PC Suite.lnk]
backup=d:\windows\pss\Nokia Nseries PC Suite.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=d:\windows\pss\Windows Search.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^Adobe Gamma.lnk]
backup=d:\windows\pss\Adobe Gamma.lnkStartup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^Dropbox.lnk]
path=d:\documents and settings\my pc\Start Menu\Programs\Startup\Dropbox.lnk
backup=d:\windows\pss\Dropbox.lnkStartup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^MagicDisc.lnk]
backup=d:\windows\pss\MagicDisc.lnkStartup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^启动迅雷5.lnk]
path=d:\documents and settings\my pc\Start Menu\Programs\Startup\启动迅雷5.lnk
backup=d:\windows\pss\启动迅雷5.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
d:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
2009-09-12 08:31 357384 —-a-w- d:\program files\Common Files\Acronis\Schedule2\schedhlp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-14 17:04 39792 —-a-w- d:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2010-05-10 13:53 611712 —-a-w- d:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
2008-11-20 13:30 2356088 —-a-w- d:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 ——r- d:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-06-01 02:21 153136 —-a-w- d:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
2008-02-19 00:22 1089536 —-a-r- d:\program files\Brother\Brmfcmon\BrMfcWnd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
2007-12-21 09:57 86016 —-a-w- d:\program files\Brother\ControlCenter3\BrCtrCen.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-13 21:42 15360 —-a-w- d:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-03-21 18:56 1230704 —-a-w- d:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eMuleAutoStart]
2011-01-26 12:03 7508440 —-a-w- d:\program files\easyMule\emule.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileHippo.com]
2010-08-09 12:47 248832 —-a-w- d:\program files\FileHippo.com\UpdateChecker.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2006-02-28 12:00 208952 —-a-w- d:\windows\ime\imjp8_1\imjpmig.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2007-10-11 11:01 46368 —-a-w- d:\program files\ScanSoft\PaperPort\IndexSearch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-07-27 08:50 221184 —-a-w- d:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-02-16 08:15 81920 —-a-w- d:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-03-01 13:45 421160 —-a-w- d:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper]
2011-06-09 10:52 940944 —-a-w- d:\program files\Samsung\Kies\KiesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]
2011-06-09 10:52 20880 —-a-w- d:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
2011-06-09 10:52 3373968 —-a-w- d:\program files\Samsung\Kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-07-06 11:52 449584 —-a-w- d:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-13 21:42 1695232 —-a-w- d:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2010-04-16 14:12 3872080 —-a-w- d:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
2006-02-28 12:00 59392 —-a-w- d:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 07:57 153136 —-a-w- d:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2011-05-25 06:09 13895272 —-a-w- d:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2011-05-25 06:09 111208 —-a-w- d:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2011-05-04 16:02 1632360 —-a-w- d:\program files\NVIDIA Corporation\nView\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Octoshape Streaming Services]
2009-01-08 13:44 70936 —-a-w- d:\documents and settings\my pc\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2007-10-11 11:03 29984 —-a-w- d:\program files\ScanSoft\PaperPort\pptd40nt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2006-02-28 12:00 455168 —-a-w- d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2006-02-28 12:00 455168 —-a-w- d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPS Accelerator]
2010-02-24 03:25 214408 —-a-w- d:\progra~1\PPStream\PPSAP.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 09:38 421888 —-a-w- d:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QvodPlayer]
2009-09-13 04:28 558472 —-a-w- d:\program files\QvodPlayer\QvodTerminal.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
2006-08-17 01:00 1116920 —-a-w- c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-06-13 06:49 16377344 ——r- d:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sclauncher]
2007-10-11 11:12 94208 —-a-w- d:\program files\SimpleCenter\bin\win\sclauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyHunter Security Suite]
2010-06-28 10:05 3021720 —-a-w- d:\program files\Enigma Software Group\SpyHunter\SpyHunter4.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 01:03 210472 —-a-w- d:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2011-06-10 16:57 2424192 —-a-w- d:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Thunder]
2011-05-27 10:14 1002672 —-a-w- d:\program files\Thunder Network\Thunder\Program\Thunder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2011-08-13 06:42 273544 —-a-w- d:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
2009-09-12 08:30 5048488 —-a-w- d:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"mi-raysat_3dsmax9_32"=2 (0x2)
"mi-raysat_3dsMax2008_32"=2 (0x2)
"Bonjour Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"aawservice"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
"Autodesk Licensing Service"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"stllssvr"=3 (0x3)
"ServiceLayer"=3 (0x3)
"SeaPort"=2 (0x2)
"ose"=3 (0x3)
"NMIndexingService"=3 (0x3)
"mi-raysat_3dsMax2009_32"=2 (0x2)
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate"=3 (0x3)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"GoToAssist"=3 (0x3)
"fsssvc"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"afcdpsrv"=2 (0x2)
"SpyHunter 4 Service"=2 (0x2)
"YahooAUService"=2 (0x2)
"iPod Service"=3 (0x3)
"AcrSch2Svc"=2 (0x2)
"!SASCORE"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\WINDOWS\\explorer.exe"=
"d:\\Program Files\\QvodPlayer\\QvodTerminal.exe"=
.
R0 tdrpman251;Acronis Try&Decide and Restore Points filter (build 251);d:\windows\system32\drivers\tdrpm251.sys [12/5/2010 7:58 AM 902432]
R1 SASDIFSV;SASDIFSV;d:\program files\SUPERAntiSpyware\sasdifsv.sys [2/18/2010 2:25 AM 12872]
R1 SASKUTIL;SASKUTIL;d:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/11/2010 2:41 AM 67656]
R2 !SASCORE;SAS Core Service;d:\program files\SUPERAntiSpyware\SASCore.exe [5/5/2011 1:54 AM 114048]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\program files\Avira\AntiVir Desktop\sched.exe [10/23/2010 12:52 PM 136360]
R2 BBUpdate;BBUpdate;d:\program files\Microsoft\BingBar\SeaPort.EXE [6/15/2011 5:33 PM 249648]
R2 nvUpdatusService;NVIDIA Update Service Daemon;d:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [8/7/2011 10:14 AM 2214504]
R2 XLDoctor Service;XLDoctor Service;d:\windows\system32\svchost -k DoctorService –> d:\windows\system32\svchost -k DoctorService [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;d:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 gupdate;Google Update Service (gupdate);d:\program files\Google\Update\GoogleUpdate.exe [11/8/2010 7:13 PM 136176]
S3 afcdp;afcdp;d:\windows\system32\drivers\afcdp.sys [12/5/2010 7:59 AM 159168]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;d:\windows\system32\drivers\ssadadb.sys [8/16/2011 10:20 PM 30312]
S3 BBSvc;Bing Bar Update Service;d:\program files\Microsoft\BingBar\BBSvc.EXE [7/7/2011 7:31 PM 195336]
S3 dgderdrv;dgderdrv;d:\windows\system32\drivers\dgderdrv.sys [6/16/2011 9:43 PM 20032]
S3 epmntdrv;epmntdrv;d:\windows\system32\epmntdrv.sys [8/23/2011 11:11 PM 13192]
S3 esgiguard;esgiguard;d:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [1/27/2010 6:10 PM 5248]
S3 EuGdiDrv;EuGdiDrv;d:\windows\system32\EuGdiDrv.sys [8/23/2011 11:11 PM 8456]
S3 FsUsbExDisk;FsUsbExDisk;d:\windows\system32\FsUsbExDisk.Sys [7/12/2010 9:57 PM 36640]
S3 gupdatem;Google Update Service (gupdatem);d:\program files\Google\Update\GoogleUpdate.exe [11/8/2010 7:13 PM 136176]
S3 MBAMProtector;MBAMProtector;d:\windows\system32\drivers\mbam.sys [10/16/2010 8:47 AM 22712]
S3 MBAMSwissArmy;MBAMSwissArmy;d:\windows\system32\drivers\mbamswissarmy.sys [10/16/2010 8:47 AM 41272]
S3 Revoflt;Revoflt;d:\windows\system32\drivers\revoflt.sys [8/14/2010 9:33 AM 27064]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;d:\windows\system32\drivers\usbscan.sys [10/10/2008 6:35 AM 15104]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);d:\windows\system32\drivers\ssadbus.sys [8/16/2011 10:20 PM 96488]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);d:\windows\system32\drivers\ssadmdfl.sys [8/16/2011 10:20 PM 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;d:\windows\system32\drivers\ssadmdm.sys [8/16/2011 10:20 PM 121576]
S3 StumbleUponUpdateService;StumbleUponUpdateService;d:\program files\StumbleUpon\StumbleUponUpdateService.exe [4/14/2011 6:10 AM 103336]
S3 WinRM;Windows Remote Management (WS-Management);d:\windows\system32\svchost.exe -k WINRM [2/28/2006 8:00 PM 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;d:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
S4 afcdpsrv;Acronis Nonstop Backup service;d:\program files\Common Files\Acronis\CDP\afcdpsrv.exe [12/5/2010 7:59 AM 2326920]
S4 MBAMService;MBAMService;"c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe" –> c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [?]
S4 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;c:\program files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [3/10/2008 12:04 AM 65536]
S4 sptd;sptd;d:\windows\system32\drivers\sptd.sys [12/27/2007 6:59 PM 685816]
S4 SpyHunter 4 Service;SpyHunter 4 Service;d:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [5/18/2010 5:06 PM 327064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
DoctorService REG_MULTI_SZ XLDoctor Service
WINRM REG_MULTI_SZ WINRM
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-07 20:32 128512 —-a-w- d:\windows\system32\advpack.dll
.
‘计划任务’ 文件夹里的内容
.
2011-09-01 d:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- d:\program files\Google\Update\GoogleUpdate.exe [2010-11-08 11:13]
.
2011-09-01 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\program files\Google\Update\GoogleUpdate.exe [2010-11-08 11:13]
.
2011-09-01 d:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-299502267-1788223648-725345543-1004.job
- d:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 02:47]
.
2011-08-29 d:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-299502267-1788223648-725345543-1004.job
- d:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 02:47]
.
2011-08-31 d:\windows\Tasks\User_Feed_Synchronization-{BC65CFD2-BBB2-4EA9-8129-77D470F20F96}.job
- d:\windows\system32\msfeedssync.exe [2007-08-13 20:31]
.
.
——- 而外的扫描 ——-
.
uStart Page = hxxp://sg.yahoo.com/?fr=fp-yie8/
uInternet Settings,ProxyOverride = *.local
IE: ?????? - d:\program files\Thunder Network\Thunder\BHO\GetUrl.htm
IE: ?????????? - d:\program files\Thunder Network\Thunder\BHO\GetAllUrl.htm
TCP: DhcpNameServer = 192.168.1.254
DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} - hxxp://cafeimg.daum-img.net/cab9_1/dmcc2.cab?Version=1,0,0,10
FF - ProfilePath - d:\documents and settings\my pc\Application Data\Mozilla\Firefox\Profiles\emub2jur.default\
FF - prefs.js: browser.startup.homepage - hxxp://sg.yahoo.com/?fr=fp-yie8/
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{0EA37B17-6B8B-4085-8257-F3A4AA69C27A} - (no file)
BHO-{B0E2F470-0B07-48f0-B3B1-5749505FAE9B} - (no file)
MSConfigStartUp-Advanced SystemCare 3 - d:\program files\IObit\Advanced SystemCare 3\AWC.exe
MSConfigStartUp-Advanced SystemCare 4 - d:\program files\IObit\Advanced SystemCare 4\ASCTray.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-01 19:49
Windows 5.1.2600 Service Pack 3 NTFS
.
扫描被隐藏的进程。。。
.
扫描被隐藏的启动组。。。
.
扫描被隐藏的文件。。。
.
扫描完成
被隐藏的档案: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\NoExplorer]
@DACL=(02 0000)
@=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\SUPER *]
"DisplayName"="SUPER ?Version 2007.bld.23 (July 4, 2007)"
"UninstallString"="d:\\PROGRA~1\\ERIGHT~1\\SUPER\\Setup.exe /remove /q0"
"InstallDate"="2008-06-15 17:06"
"InstallLocation"="d:\\Program Files\\eRightSoft\\SUPER"
"InstallSource"="f:\\exe"
"DisplayIcon"="d:\\Program Files\\eRightSoft\\SUPER\\SUPER.exe"
"DisplayVersion"="Version 2007.bld.23 (July 4, 2007)"
"VersionMajor"=dword:00000000
"VersionMinor"=dword:00000000
"Publisher"="eRightSoft"
"HelpLink"="http://www.eRightSoft.com"
"URLInfoAbout"="http://www.eRightSoft.com"
"URLUpdateInfo"="http://www.eRightSoft.com"
"Contact"="[removed]"
.
——————— 运行进程下的动态链接库 ———————
.
- - - - - - - > 'winlogon.exe'(792)
d:\program files\SUPERAntiSpyware\SASWINLO.DLL
d:\windows\system32\WININET.dll
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
d:\program files\Citrix\GoToAssist\480\G2AWinLogon.dll
.
- - - - - - - > 'lsass.exe'(848)
d:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
- - - - - - - > 'explorer.exe'(1300)
d:\windows\system32\WININET.dll
d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
d:\program files\Common Files\OnlineFilesManager.dll
d:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
d:\windows\system32\msi.dll
d:\windows\system32\ieframe.dll
d:\windows\system32\webcheck.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
d:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
d:\program files\Common Files\Data\hd16_module.dat
d:\windows\system32\jscript.dll
d:\windows\system32\msxml6.dll
.
完成时间: 2011-09-01 19:55:21
ComboFix-quarantined-files.txt 2011-09-01 11:55
ComboFix2.txt 2011-08-27 01:25
ComboFix3.txt 2011-08-26 12:20
ComboFix4.txt 2011-08-24 14:58
ComboFix5.txt 2011-09-01 11:44
.
Pre-Run: 190,640,205,824 bytes free
Post-Run: 191,069,151,232 bytes free
.
Current=1 Default=1 Failed=0 LastKnownGood=6 Sets=1,2,3,4,5,6
- - End Of File - - 36D92F692406C164B1B8F517511AC465

Thanks!

Tomk

Post #37September 1, 2011, 2:45 PM UTC

sinweiy,

ComboFix is updated every day or so. Let it update this time.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
d:\windows\system32\drivers\36040.tmp
d:\windows\system32\drivers\3603F.tmp
d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
d:\windows\000001_.tmp

rootkit::
d:\windows\system32\11372995641.dll

RegLock::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\NoExplorer]

RegNull::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\SUPER *]

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

sinweiy

Post #38September 2, 2011, 1:49 AM UTC

after the update, the scan is taking very long, about a few hours.! is there a problem with the combofix? can i restart?

Tomk

Post #39September 2, 2011, 3:06 AM UTC

Yes. Restart and try again.

sinweiy

Post #40September 2, 2011, 9:46 AM UTC

log.txt:

ComboFix 11-09-01.03 - my pc 2/2011 Fri 17:17:27.6.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.936.86.1033.18.2047.1314 [GMT 8:00]
执行位置: d:\documents and settings\my pc\Desktop\ComboFix.exe
Command switches used :: d:\documents and settings\my pc\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
FILE ::
"d:\windows\000001_.tmp"
"d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP"
"d:\windows\system32\drivers\3603F.tmp"
"d:\windows\system32\drivers\36040.tmp"
.
.
((((((((((((((((((((((((((((((((((((((( 被删除的档案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
d:\windows\000001_.tmp
d:\windows\system32\017344641.dll
d:\windows\system32\drivers\3603F.tmp
d:\windows\system32\drivers\36040.tmp
d:\windows\system32\nvdispco3220150.dll
.
.
((((((((((((((((((((((((( 2011-08-02 至 2011-09-02 的新的档案 )))))))))))))))))))))))))))))))
.
.
2011-08-30 05:36 . 2011-08-30 05:36 ——– d—–w- d:\documents and settings\All Users\Application Data\!SASCORE
2011-08-30 04:28 . 2011-08-30 04:28 ——– d—–w- d:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-08-30 04:27 . 2011-08-30 05:18 ——– d—–w- d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com
2011-08-30 04:00 . 2011-08-30 04:00 ——– d—–w- d:\documents and settings\All Users\Application Data\SUPERSetup
2011-08-28 13:28 . 2011-08-28 13:28 ——– d—–w- d:\documents and settings\my pc\Local Settings\Application Data\Norman Malware Cleaner
2011-08-27 04:17 . 2011-08-31 18:30 ——– d—–w- D:\Media
2011-08-25 13:59 . 2011-08-25 13:59 ——– d—–w- d:\program files\Microsoft Silverlight
2011-08-24 06:03 . 2011-08-24 06:03 ——– d—a-w- D:\.Trash-999
2011-08-23 15:11 . 2011-07-29 05:54 19840 —-a-w- d:\windows\system32\EuEpmGdi.dll
2011-08-23 15:11 . 2011-08-02 12:48 2469248 —-a-w- d:\windows\system32\BootMan.exe
2011-08-23 15:11 . 2011-07-29 05:54 86408 —-a-w- d:\windows\system32\setupempdrv03.exe
2011-08-23 15:11 . 2011-07-29 05:54 8456 —-a-w- d:\windows\system32\EuGdiDrv.sys
2011-08-23 15:11 . 2011-07-29 05:54 13192 —-a-w- d:\windows\system32\epmntdrv.sys
2011-08-23 15:10 . 2011-08-23 15:10 ——– d—–w- d:\program files\EASEUS
2011-08-23 11:50 . 2010-11-03 18:08 237568 —-a-w- d:\windows\system32\yv12vfw.dll
2011-08-23 11:50 . 2011-06-24 14:44 243200 —-a-w- d:\windows\system32\xvidvfw.dll
2011-08-23 11:50 . 2011-06-24 14:28 650752 —-a-w- d:\windows\system32\xvidcore.dll
2011-08-23 11:50 . 2011-08-08 08:00 74752 —-a-w- d:\windows\system32\ff_vfw.dll
2011-08-20 08:06 . 2011-08-20 08:06 896 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\databasepath.reg
2011-08-20 08:06 . 2011-08-20 08:06 3008 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\bgregfix.reg
2011-08-20 08:06 . 2011-08-20 08:06 2600 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\exefix.reg
2011-08-20 08:06 . 2011-08-20 08:06 951291 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\remregfix.reg
2011-08-20 08:06 . 2011-08-20 08:06 890 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\Remove-itRestorePoint.vbs
2011-08-20 08:06 . 2011-08-20 08:06 5228 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\nfig.reg
2011-08-20 08:06 . 2011-08-20 08:06 4994 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\s.reg
2011-08-20 08:06 . 2011-08-20 08:06 4512 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\hpregfix.reg
2011-08-20 08:06 . 2011-08-20 08:06 18308 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\IEDef.reg
2011-08-20 08:06 . 2011-08-20 08:06 1754 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\regf.reg
2011-08-20 07:06 . 2008-05-02 13:25 465920 -c—-w- d:\windows\system32\dllcache\imapi2fs.dll
2011-08-20 07:06 . 2008-05-02 13:25 465920 ——w- d:\windows\system32\imapi2fs.dll
2011-08-20 07:06 . 2008-05-02 13:25 317952 -c—-w- d:\windows\system32\dllcache\imapi2.dll
2011-08-20 07:06 . 2008-05-02 13:25 317952 ——w- d:\windows\system32\imapi2.dll
2011-08-20 06:55 . 2011-08-20 07:11 ——– d—–w- d:\documents and settings\LocalService\Application Data\360safe
2011-08-20 04:09 . 2011-08-20 04:09 ——– d—–w- d:\program files\Chaos Group
2011-08-20 03:33 . 2011-08-20 08:54 ——– d—–w- d:\documents and settings\All Users\Application Data\360safe
2011-08-20 03:27 . 2011-08-20 03:27 ——– d—–w- d:\documents and settings\All Users\Application Data\360SD
2011-08-19 12:51 . 2011-08-19 13:36 ——– d—–w- d:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2011-08-19 12:51 . 2011-08-19 12:59 ——– d—–w- d:\program files\Spybot - Search & Destroy
2011-08-16 15:50 . 2011-08-27 01:41 ——– d—–w- d:\program files\SpywareBlaster
2011-08-16 15:47 . 2011-08-16 15:47 ——– d—–w- d:\program files\ESET
2011-08-16 15:29 . 2011-08-30 04:11 ——– d—–w- d:\program files\Panda Security
2011-08-16 14:20 . 2010-05-25 07:59 96488 —-a-w- d:\windows\system32\drivers\ssadbus.sys
2011-08-16 14:20 . 2010-05-25 07:59 30312 —-a-w- d:\windows\system32\drivers\ssadadb.sys
2011-08-16 14:20 . 2010-05-25 07:59 1416680 —-a-w- d:\windows\system32\WdfCoInstaller01005.dll
2011-08-16 14:20 . 2010-05-25 07:59 12776 —-a-w- d:\windows\system32\drivers\ssadmdfl.sys
2011-08-16 14:20 . 2010-05-25 07:59 121576 —-a-w- d:\windows\system32\drivers\ssadmdm.sys
2011-08-16 14:20 . 2010-05-25 07:59 10344 —-a-w- d:\windows\system32\drivers\ssadcmnt.sys
2011-08-16 14:20 . 2010-05-25 07:59 10216 —-a-w- d:\windows\system32\drivers\ssadwhnt.sys
2011-08-13 05:16 . 2011-08-13 05:16 ——– d—–w- d:\program files\FileHippo.com
2011-08-13 04:46 . 2011-09-01 12:06 ——– d—–w- d:\program files\SUPERAntiSpyware
2011-08-13 03:40 . 2011-08-13 03:40 110080 —-a-r- d:\documents and settings\my pc\Application Data\Microsoft\Installer\{4FC9DA9D-F608-454E-8191-D7EFFDCC5726}\IconF7A21AF7.exe
2011-08-13 03:40 . 2011-08-13 03:40 110080 —-a-r- d:\documents and settings\my pc\Application Data\Microsoft\Installer\{4FC9DA9D-F608-454E-8191-D7EFFDCC5726}\IconD7F16134.exe
2011-08-13 03:40 . 2011-08-18 13:31 ——– d—–w- D:\sh4ldr
2011-08-13 03:40 . 2011-08-13 03:40 ——– d—–w- d:\program files\Enigma Software Group
2011-08-13 03:39 . 2011-08-13 03:40 ——– d—–w- d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2011-08-13 03:39 . 2011-08-30 05:14 ——– d—–w- d:\program files\Common Files\Wise Installation Wizard
2011-08-12 14:16 . 2008-04-13 21:41 81920 -c–a-w- d:\windows\system32\dllcache\ieencode.dll
2011-08-12 14:16 . 2008-04-13 21:41 81920 ——w- d:\windows\system32\ieencode.dll
2011-08-11 14:49 . 2001-08-17 04:12 45632 -c–a-w- d:\windows\system32\dllcache\ip5515.sys
2011-08-11 14:49 . 2001-08-17 14:36 90200 -c–a-w- d:\windows\system32\dllcache\io8ports.dll
2011-08-11 14:49 . 2001-08-17 05:50 38784 -c–a-w- d:\windows\system32\dllcache\io8.sys
2011-08-11 14:49 . 2008-04-13 16:10 5504 -c–a-w- d:\windows\system32\dllcache\intelide.sys
2011-08-11 14:49 . 2001-08-17 05:47 13056 -c–a-w- d:\windows\system32\dllcache\inport.sys
2011-08-11 14:49 . 2001-08-17 05:52 16000 -c–a-w- d:\windows\system32\dllcache\ini910u.sys
2011-08-11 14:47 . 2001-08-17 05:28 44863 -c–a-w- d:\windows\system32\dllcache\hsf_soar.sys
2011-08-11 14:46 . 2001-08-17 06:02 2688 -c–a-w- d:\windows\system32\dllcache\hidswvd.sys
2011-08-11 14:45 . 2001-08-17 04:11 12362 -c–a-w- d:\windows\system32\dllcache\f3ab18xi.sys
2011-08-11 14:44 . 2001-08-17 04:11 69194 -c–a-w- d:\windows\system32\dllcache\el656cd5.sys
2011-08-11 14:43 . 2001-08-17 14:36 24064 -c–a-w- d:\windows\system32\dllcache\devldr32.exe
2011-08-11 14:42 . 2001-08-17 04:13 27164 -c–a-w- d:\windows\system32\dllcache\ce3n5.sys
2011-08-10 13:34 . 2008-04-13 16:06 14208 -c–a-w- d:\windows\system32\dllcache\battc.sys
2011-08-09 10:36 . 2011-08-09 10:36 ——– d—–w- d:\documents and settings\my pc\Local Settings\Application Data\Octoshape
2011-08-09 10:36 . 2011-08-09 10:36 ——– d—–w- d:\documents and settings\my pc\Application Data\Octoshape
2011-08-09 03:12 . 2011-08-09 03:13 ——– d—–w- d:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2011-08-09 03:12 . 2011-08-09 03:12 ——– d—–w- d:\documents and settings\my pc\Application Data\Windows Search
2011-08-09 03:11 . 2011-08-09 03:11 ——– d—–w- d:\windows\system32\winrm
2011-08-09 03:11 . 2011-08-09 03:11 ——– dc-h–w- d:\windows\$968930Uinstall_KB968930$
2011-08-09 03:11 . 2011-08-09 03:11 ——– d—–w- d:\documents and settings\my pc\Application Data\Windows Desktop Search
2011-08-09 03:10 . 2011-08-11 15:10 ——– d—–w- d:\program files\Windows Desktop Search
2011-08-09 03:10 . 2011-08-09 03:10 ——– d—–w- d:\windows\system32\GroupPolicy
2011-08-09 00:52 . 2011-08-09 00:52 ——– d—–w- d:\program files\Microsoft.NET
2011-08-07 02:15 . 2011-08-07 02:15 ——– d—–w- d:\documents and settings\All Users\Application Data\NVIDIA Corporation
2011-08-07 02:14 . 2011-08-09 05:09 ——– d—–w- d:\documents and settings\UpdatusUser
2011-08-07 02:14 . 2011-08-07 02:14 ——– d—–w- d:\documents and settings\All Users\Application Data\NVIDIA
2011-08-07 02:13 . 2011-05-25 06:09 543336 —-a-w- d:\windows\system32\easyupdatusapiu.dll
2011-08-07 02:13 . 2011-08-18 12:55 273344 —-a-w- d:\windows\system32\nvdrsdb1.bin
2011-08-07 02:13 . 2011-08-18 12:55 1 —-a-w- d:\windows\system32\nvdrssel.bin
2011-08-07 02:13 . 2011-08-18 12:55 273344 —-a-w- d:\windows\system32\nvdrsdb0.bin
2011-08-07 02:12 . 2011-05-25 06:09 61440 —-a-w- d:\windows\system32\OpenCL.dll
2011-08-07 02:12 . 2011-05-25 06:09 865896 —-a-w- d:\windows\system32\nvgenco322090.dll
2011-08-07 02:12 . 2011-05-25 06:09 2808936 —-a-w- d:\windows\system32\nvcuvid.dll
2011-08-07 02:12 . 2011-05-25 06:09 2082408 —-a-w- d:\windows\system32\nvcuvenc.dll
2011-08-07 02:12 . 2011-05-25 06:09 5332992 —-a-w- d:\windows\system32\nvcuda.dll
2011-08-07 02:12 . 2011-05-25 06:09 13004800 —-a-w- d:\windows\system32\nvcompiler.dll
2011-08-07 02:12 . 2011-08-18 12:52 ——– d—–w- d:\program files\NVIDIA Corporation
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-30 08:01 . 2011-06-25 00:10 404640 —-a-w- d:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-20 08:06 . 2006-02-28 12:00 4224 —-a-w- d:\windows\system32\drivers\beep.sys
2011-07-15 13:29 . 2008-10-09 22:35 456320 —-a-w- d:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-10-09 22:35 10496 —-a-w- d:\windows\system32\drivers\ndistapi.sys
2011-07-06 11:52 . 2010-10-16 00:47 41272 —-a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 11:52 . 2010-10-16 00:47 22712 —-a-w- d:\windows\system32\drivers\mbam.sys
2011-06-28 13:09 . 2010-10-23 04:52 138192 —-a-w- d:\windows\system32\drivers\avipbb.sys
2011-06-28 13:09 . 2010-10-23 04:52 66616 —-a-w- d:\windows\system32\drivers\avgntflt.sys
2011-06-24 14:10 . 2008-10-09 22:35 139656 —-a-w- d:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2006-02-28 12:00 916480 —-a-w- d:\windows\system32\wininet.dll
2011-06-23 18:36 . 2006-02-28 12:00 43520 —-a-w- d:\windows\system32\licmgr10.dll
2011-06-23 18:36 . 2006-02-28 12:00 1469440 ——w- d:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2006-02-28 12:00 385024 —-a-w- d:\windows\system32\html.iec
2011-06-20 17:44 . 2006-02-28 12:00 293376 —-a-w- d:\windows\system32\winsrv.dll
2011-06-07 03:13 . 2011-06-16 13:43 4659712 —-a-w- d:\windows\system32\Redemption.dll
2011-06-07 03:13 . 2011-06-07 03:13 974848 —-a-w- d:\windows\system32\cis-2.4.dll
2011-06-07 03:13 . 2011-06-07 03:13 90112 —-a-w- d:\windows\MAMCityDownload.ocx
2011-06-07 03:13 . 2011-06-07 03:13 81920 —-a-w- d:\windows\system32\issacapi_bs-2.3.dll
2011-06-07 03:13 . 2011-06-07 03:13 65536 —-a-w- d:\windows\system32\issacapi_pe-2.3.dll
2011-06-07 03:13 . 2011-06-07 03:13 57344 —-a-w- d:\windows\system32\MTXSYNCICON.dll
2011-06-07 03:13 . 2011-06-07 03:13 57344 —-a-w- d:\windows\system32\issacapi_se-2.3.dll
2011-06-07 03:13 . 2011-06-07 03:13 569344 —-a-w- d:\windows\system32\muzdecode.ax
2011-06-07 03:13 . 2011-06-07 03:13 491520 —-a-w- d:\windows\system32\muzapp.dll
2011-06-07 03:13 . 2011-06-07 03:13 49152 —-a-w- d:\windows\system32\MaJGUILib.dll
2011-06-07 03:13 . 2011-06-07 03:13 45056 —-a-w- d:\windows\system32\MaXMLProto.dll
2011-06-07 03:13 . 2011-06-07 03:13 40960 —-a-w- d:\windows\system32\MTTELECHIP.dll
2011-06-07 03:13 . 2011-06-07 03:13 352256 —-a-w- d:\windows\system32\MSLUR71.dll
2011-06-07 03:13 . 2011-06-07 03:13 325552 —-a-w- d:\windows\MASetupCaller.dll
2011-06-07 03:13 . 2011-06-07 03:13 30568 —-a-w- d:\windows\MusiccityDownload.exe
2011-06-07 03:13 . 2011-06-07 03:13 24576 —-a-w- d:\windows\system32\MASetupCleaner.exe
2011-06-07 03:13 . 2011-06-07 03:13 200704 —-a-w- d:\windows\system32\muzwmts.dll
2011-06-07 03:13 . 2011-06-07 03:13 155648 —-a-w- d:\windows\system32\MSFLib.dll
2011-06-07 03:13 . 2011-06-07 03:13 143360 —-a-w- d:\windows\system32\3DAudio.ax
2011-06-07 03:13 . 2011-06-07 03:13 14336 —-a-w- d:\windows\system32\avrt.dll
2011-06-07 03:13 . 2011-06-07 03:13 135168 —-a-w- d:\windows\system32\muzaf1.dll
2011-06-07 03:13 . 2011-06-07 03:13 131072 —-a-w- d:\windows\system32\muzmpgsp.ax
2011-06-07 03:13 . 2011-06-07 03:13 122880 —-a-w- d:\windows\system32\muzeffect.ax
2011-06-07 03:13 . 2011-06-07 03:13 118784 —-a-w- d:\windows\system32\MaDRM.dll
2011-06-07 03:13 . 2011-06-07 03:13 110592 —-a-w- d:\windows\system32\muzmp4sp.ax
2011-06-07 03:13 . 2011-06-16 13:43 821824 —-a-w- d:\windows\system32\dgderapi.dll
2011-06-07 03:13 . 2011-06-16 13:43 319456 —-a-w- d:\windows\system32\DIFxAPI.dll
2011-06-07 03:13 . 2011-06-16 13:43 20032 —-a-w- d:\windows\system32\drivers\dgderdrv.sys
2011-06-07 03:13 . 2011-06-07 03:13 57344 —-a-w- d:\windows\system32\MK_Lyric.dll
2011-06-07 03:13 . 2011-06-07 03:13 45056 —-a-w- d:\windows\system32\MACXMLProto.dll
2011-06-07 03:13 . 2011-06-07 03:13 40960 —-a-w- d:\windows\system32\MAMACExtract.dll
2011-06-07 03:13 . 2011-06-07 03:13 258048 —-a-w- d:\windows\system32\muzoggsp.ax
2011-06-07 03:13 . 2011-06-07 03:13 245760 —-a-w- d:\windows\system32\MSCLib.dll
2011-04-24 04:10 . 2011-04-24 04:10 197632 —-a-w- d:\program files\Common Files\OnlineFilesManager.dll
2011-08-12 05:57 . 2011-08-19 23:55 134104 —-a-w- d:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 09:06 163328 –sha-r- d:\windows\system32\flvDX.dll
2007-02-21 10:47 31232 –sha-r- d:\windows\system32\msfDX.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-24_12.44.00 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-25 13:59 . 2011-08-25 13:59 38400 d:\windows\Installer\7f9eed.msi
+ 2011-08-25 13:59 . 2011-08-25 13:59 49152 d:\windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIcon.dll
+ 2011-08-30 08:00 . 2011-08-30 08:00 243360 d:\windows\system32\Macromed\Flash\FlashUtil10w_Plugin.exe
+ 2006-02-28 12:00 . 2011-06-20 17:44 293376 d:\windows\system32\dllcache\winsrv.dll
- 2006-02-28 12:00 . 2011-04-26 11:07 293376 d:\windows\system32\dllcache\winsrv.dll
+ 2011-08-30 08:00 . 2011-08-30 08:00 6277280 d:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2011-08-25 13:59 . 2011-08-25 13:59 20333056 d:\windows\Installer\7f9ef6.msp
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0A0DDBD3-6641-40B9-873F-BBDD26D6C14E}]
2011-01-26 04:04 180696 —-a-w- d:\program files\easyMule\modules\IE2EM.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Online Files]
@="{B82655E9-B81D-4A97-8154-0D84A4C048E4}"
[HKEY_CLASSES_ROOT\CLSID\{B82655E9-B81D-4A97-8154-0D84A4C048E4}]
2011-04-24 04:10 197632 —-a-w- d:\program files\Common Files\OnlineFilesManager.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="d:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"SUPERAntiSpyware"="d:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-06-10 2424192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="d:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]
"nwiz"="d:\program files\NVIDIA Corporation\nView\nwiz.exe" [2011-05-04 1632360]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2011-05-25 13895272]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="d:\windows\system32\ctfmon.exe" [2008-04-13 15360]
.
d:\documents and settings\my pc\Start Menu\Programs\Startup\
BitTorrent (2).lnk - c:\program files\BitTorrent\bittorrent.exe [N/A]
Dropbox.lnk - d:\documents and settings\my pc\Application Data\Dropbox\bin\Dropbox.exe [2011-5-26 24176560]
.
d:\documents and settings\All Users\Start Menu\Programs\Startup\
Wireless Utility.lnk - d:\program files\Wireless\Common\Utility.exe [2010-12-29 602112]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "d:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- d:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-10-10 13:51 10792 —-a-w- d:\program files\Citrix\GoToAssist\480\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=d:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=d:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^JCMATTHEW WLAN.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\JCMATTHEW WLAN.lnk
backup=d:\windows\pss\JCMATTHEW WLAN.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Nokia Nseries PC Suite.lnk]
backup=d:\windows\pss\Nokia Nseries PC Suite.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=d:\windows\pss\Windows Search.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^Adobe Gamma.lnk]
backup=d:\windows\pss\Adobe Gamma.lnkStartup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^Dropbox.lnk]
path=d:\documents and settings\my pc\Start Menu\Programs\Startup\Dropbox.lnk
backup=d:\windows\pss\Dropbox.lnkStartup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^MagicDisc.lnk]
backup=d:\windows\pss\MagicDisc.lnkStartup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^启动迅雷5.lnk]
path=d:\documents and settings\my pc\Start Menu\Programs\Startup\启动迅雷5.lnk
backup=d:\windows\pss\启动迅雷5.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
d:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
2009-09-12 08:31 357384 —-a-w- d:\program files\Common Files\Acronis\Schedule2\schedhlp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-14 17:04 39792 —-a-w- d:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2010-05-10 13:53 611712 —-a-w- d:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
2008-11-20 13:30 2356088 —-a-w- d:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 ——r- d:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-06-01 02:21 153136 —-a-w- d:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
2008-02-19 00:22 1089536 —-a-r- d:\program files\Brother\Brmfcmon\BrMfcWnd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
2007-12-21 09:57 86016 —-a-w- d:\program files\Brother\ControlCenter3\BrCtrCen.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-13 21:42 15360 —-a-w- d:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-03-21 18:56 1230704 —-a-w- d:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eMuleAutoStart]
2011-01-26 12:03 7508440 —-a-w- d:\program files\easyMule\emule.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileHippo.com]
2010-08-09 12:47 248832 —-a-w- d:\program files\FileHippo.com\UpdateChecker.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2006-02-28 12:00 208952 —-a-w- d:\windows\ime\imjp8_1\imjpmig.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2007-10-11 11:01 46368 —-a-w- d:\program files\ScanSoft\PaperPort\IndexSearch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-07-27 08:50 221184 —-a-w- d:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-02-16 08:15 81920 —-a-w- d:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-03-01 13:45 421160 —-a-w- d:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper]
2011-06-09 10:52 940944 —-a-w- d:\program files\Samsung\Kies\KiesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]
2011-06-09 10:52 20880 —-a-w- d:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
2011-06-09 10:52 3373968 —-a-w- d:\program files\Samsung\Kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-07-06 11:52 449584 —-a-w- d:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-13 21:42 1695232 —-a-w- d:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2010-04-16 14:12 3872080 —-a-w- d:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
2006-02-28 12:00 59392 —-a-w- d:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 07:57 153136 —-a-w- d:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2011-05-25 06:09 13895272 —-a-w- d:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2011-05-25 06:09 111208 —-a-w- d:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2011-05-04 16:02 1632360 —-a-w- d:\program files\NVIDIA Corporation\nView\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Octoshape Streaming Services]
2009-01-08 13:44 70936 —-a-w- d:\documents and settings\my pc\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2007-10-11 11:03 29984 —-a-w- d:\program files\ScanSoft\PaperPort\pptd40nt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2006-02-28 12:00 455168 —-a-w- d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2006-02-28 12:00 455168 —-a-w- d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPS Accelerator]
2010-02-24 03:25 214408 —-a-w- d:\progra~1\PPStream\PPSAP.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 09:38 421888 —-a-w- d:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QvodPlayer]
2009-09-13 04:28 558472 —-a-w- d:\program files\QvodPlayer\QvodTerminal.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
2006-08-17 01:00 1116920 —-a-w- c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-06-13 06:49 16377344 ——r- d:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sclauncher]
2007-10-11 11:12 94208 —-a-w- d:\program files\SimpleCenter\bin\win\sclauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyHunter Security Suite]
2010-06-28 10:05 3021720 —-a-w- d:\program files\Enigma Software Group\SpyHunter\SpyHunter4.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 01:03 210472 —-a-w- d:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2011-06-10 16:57 2424192 —-a-w- d:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Thunder]
2011-05-27 10:14 1002672 —-a-w- d:\program files\Thunder Network\Thunder\Program\Thunder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2011-08-13 06:42 273544 —-a-w- d:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
2009-09-12 08:30 5048488 —-a-w- d:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"mi-raysat_3dsmax9_32"=2 (0x2)
"mi-raysat_3dsMax2008_32"=2 (0x2)
"Bonjour Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"aawservice"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
"Autodesk Licensing Service"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"stllssvr"=3 (0x3)
"ServiceLayer"=3 (0x3)
"SeaPort"=2 (0x2)
"ose"=3 (0x3)
"NMIndexingService"=3 (0x3)
"mi-raysat_3dsMax2009_32"=2 (0x2)
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate"=3 (0x3)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"GoToAssist"=3 (0x3)
"fsssvc"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"afcdpsrv"=2 (0x2)
"SpyHunter 4 Service"=2 (0x2)
"YahooAUService"=2 (0x2)
"iPod Service"=3 (0x3)
"AcrSch2Svc"=2 (0x2)
"!SASCORE"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\QvodPlayer\\QvodTerminal.exe"=
.
R0 tdrpman251;Acronis Try&Decide and Restore Points filter (build 251);d:\windows\system32\drivers\tdrpm251.sys [12/5/2010 7:58 AM 902432]
R1 SASDIFSV;SASDIFSV;d:\program files\SUPERAntiSpyware\sasdifsv.sys [2/18/2010 2:25 AM 12872]
R1 SASKUTIL;SASKUTIL;d:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/11/2010 2:41 AM 67656]
R2 !SASCORE;SAS Core Service;d:\program files\SUPERAntiSpyware\SASCore.exe [5/5/2011 1:54 AM 114048]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\program files\Avira\AntiVir Desktop\sched.exe [10/23/2010 12:52 PM 136360]
R2 BBUpdate;BBUpdate;d:\program files\Microsoft\BingBar\SeaPort.EXE [6/15/2011 5:33 PM 249648]
R2 nvUpdatusService;NVIDIA Update Service Daemon;d:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [8/7/2011 10:14 AM 2214504]
R2 XLDoctor Service;XLDoctor Service;d:\windows\system32\svchost -k DoctorService –> d:\windows\system32\svchost -k DoctorService [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;d:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 gupdate;Google Update Service (gupdate);d:\program files\Google\Update\GoogleUpdate.exe [11/8/2010 7:13 PM 136176]
S3 afcdp;afcdp;d:\windows\system32\drivers\afcdp.sys [12/5/2010 7:59 AM 159168]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;d:\windows\system32\drivers\ssadadb.sys [8/16/2011 10:20 PM 30312]
S3 BBSvc;Bing Bar Update Service;d:\program files\Microsoft\BingBar\BBSvc.EXE [7/7/2011 7:31 PM 195336]
S3 dgderdrv;dgderdrv;d:\windows\system32\drivers\dgderdrv.sys [6/16/2011 9:43 PM 20032]
S3 epmntdrv;epmntdrv;d:\windows\system32\epmntdrv.sys [8/23/2011 11:11 PM 13192]
S3 esgiguard;esgiguard;d:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [1/27/2010 6:10 PM 5248]
S3 EuGdiDrv;EuGdiDrv;d:\windows\system32\EuGdiDrv.sys [8/23/2011 11:11 PM 8456]
S3 FsUsbExDisk;FsUsbExDisk;d:\windows\system32\FsUsbExDisk.Sys [7/12/2010 9:57 PM 36640]
S3 gupdatem;Google Update Service (gupdatem);d:\program files\Google\Update\GoogleUpdate.exe [11/8/2010 7:13 PM 136176]
S3 MBAMProtector;MBAMProtector;d:\windows\system32\drivers\mbam.sys [10/16/2010 8:47 AM 22712]
S3 MBAMSwissArmy;MBAMSwissArmy;d:\windows\system32\drivers\mbamswissarmy.sys [10/16/2010 8:47 AM 41272]
S3 Revoflt;Revoflt;d:\windows\system32\drivers\revoflt.sys [8/14/2010 9:33 AM 27064]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;d:\windows\system32\drivers\usbscan.sys [10/10/2008 6:35 AM 15104]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);d:\windows\system32\drivers\ssadbus.sys [8/16/2011 10:20 PM 96488]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);d:\windows\system32\drivers\ssadmdfl.sys [8/16/2011 10:20 PM 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;d:\windows\system32\drivers\ssadmdm.sys [8/16/2011 10:20 PM 121576]
S3 StumbleUponUpdateService;StumbleUponUpdateService;d:\program files\StumbleUpon\StumbleUponUpdateService.exe [4/14/2011 6:10 AM 103336]
S3 WinRM;Windows Remote Management (WS-Management);d:\windows\system32\svchost.exe -k WINRM [2/28/2006 8:00 PM 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;d:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
S4 afcdpsrv;Acronis Nonstop Backup service;d:\program files\Common Files\Acronis\CDP\afcdpsrv.exe [12/5/2010 7:59 AM 2326920]
S4 MBAMService;MBAMService;"c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe" –> c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [?]
S4 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;c:\program files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [3/10/2008 12:04 AM 65536]
S4 sptd;sptd;d:\windows\system32\drivers\sptd.sys [12/27/2007 6:59 PM 685816]
S4 SpyHunter 4 Service;SpyHunter 4 Service;d:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [5/18/2010 5:06 PM 327064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
DoctorService REG_MULTI_SZ XLDoctor Service
WINRM REG_MULTI_SZ WINRM
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-07 20:32 128512 —-a-w- d:\windows\system32\advpack.dll
.
‘计划任务’ 文件夹里的内容
.
2011-09-02 d:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- d:\program files\Google\Update\GoogleUpdate.exe [2010-11-08 11:13]
.
2011-09-02 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\program files\Google\Update\GoogleUpdate.exe [2010-11-08 11:13]
.
2011-09-02 d:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-299502267-1788223648-725345543-1004.job
- d:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 02:47]
.
2011-08-29 d:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-299502267-1788223648-725345543-1004.job
- d:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 02:47]
.
2011-09-01 d:\windows\Tasks\User_Feed_Synchronization-{BC65CFD2-BBB2-4EA9-8129-77D470F20F96}.job
- d:\windows\system32\msfeedssync.exe [2007-08-13 20:31]
.
.
——- 而外的扫描 ——-
.
uStart Page = hxxp://sg.yahoo.com/?fr=fp-yie8/
uInternet Settings,ProxyOverride = *.local
IE: ?????? - d:\program files\Thunder Network\Thunder\BHO\GetUrl.htm
IE: ?????????? - d:\program files\Thunder Network\Thunder\BHO\GetAllUrl.htm
TCP: DhcpNameServer = 192.168.1.254
DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} - hxxp://cafeimg.daum-img.net/cab9_1/dmcc2.cab?Version=1,0,0,10
FF - ProfilePath - d:\documents and settings\my pc\Application Data\Mozilla\Firefox\Profiles\emub2jur.default\
FF - prefs.js: browser.startup.homepage - hxxp://sg.yahoo.com/?fr=fp-yie8/
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{0EA37B17-6B8B-4085-8257-F3A4AA69C27A} - (no file)
BHO-{B0E2F470-0B07-48f0-B3B1-5749505FAE9B} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-02 17:35
Windows 5.1.2600 Service Pack 3 NTFS
.
扫描被隐藏的进程。。。
.
扫描被隐藏的启动组。。。
.
扫描被隐藏的文件。。。
.
扫描完成
被隐藏的档案: 0
.
**************************************************************************
.
——————— 运行进程下的动态链接库 ———————
.
- - - - - - - > 'winlogon.exe'(792)
d:\program files\SUPERAntiSpyware\SASWINLO.DLL
d:\windows\system32\WININET.dll
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
d:\program files\Citrix\GoToAssist\480\G2AWinLogon.dll
.
- - - - - - - > 'lsass.exe'(848)
d:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
- - - - - - - > 'explorer.exe'(4032)
d:\windows\system32\WININET.dll
d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
d:\program files\Common Files\OnlineFilesManager.dll
d:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
d:\windows\system32\msi.dll
d:\windows\system32\ieframe.dll
d:\windows\system32\webcheck.dll
d:\windows\system32\WPDShServiceObj.dll
c:\program files\Roxio\Drag-to-Disc\Shellex.dll
d:\windows\system32\DLAAPI_W.DLL
d:\windows\system32\CDRTC.DLL
c:\program files\Roxio\Drag-to-Disc\ShellRes.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
d:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
d:\program files\Common Files\Data\hd16_module.dat
.
———————— 其他运行进程 ————————
.
d:\program files\Avira\AntiVir Desktop\avguard.exe
d:\program files\Avira\AntiVir Desktop\avshadow.exe
d:\windows\system32\nvsvc32.exe
d:\windows\system32\SearchIndexer.exe
d:\windows\system32\conime.exe
d:\windows\system32\wscntfy.exe
.
**************************************************************************
.
完成时间: 2011-09-02 17:43:22 - 电脑已重新启动
ComboFix-quarantined-files.txt 2011-09-02 09:43
ComboFix2.txt 2011-09-01 11:55
ComboFix3.txt 2011-08-27 01:25
ComboFix4.txt 2011-08-26 12:20
ComboFix5.txt 2011-09-02 00:21
.
Pre-Run: 190,949,036,032 bytes free
Post-Run: 190,983,020,544 bytes free
.
Current=1 Default=1 Failed=0 LastKnownGood=6 Sets=1,2,3,4,5,6
- - End Of File - - 045620206BA79F8F652C5D9626A9072A

Thanks!!

sinweiy

Post #41September 2, 2011, 10:18 AM UTC last edited September 2, 2011, 12:14 PM UTC

deleted…

sinweiy

Post #42September 2, 2011, 11:57 AM UTC last edited September 2, 2011, 12:14 PM UTC

hmm, first i thought it's ok, but the 11504228141.dll is back, when i receive the usual message, "Windows Explorer has encounter a problem and needs to close". i am thinking of cloning back my previous harddisk which has a "healthier" OS, and start from there again.

Tomk

Post #43September 2, 2011, 1:27 PM UTC

sinweiy,

I am so sorry that I just don't seem to be able to find the root of the problem.

Let's try a different scanner:

Please download Dr.Web CureIt . Save it to your desktop:

Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in the pop-up window to allow the scan.
This will scan the files currently running in memory and if something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, select Complete scan.
Click the green arrow [external image: Posted Image] at the right, and the scan will start.
Click Yes to all if it asks if you want to cure/move the file.
When the scan has finished, in the menu, click File and choose Save report list
Save the report to your desktop. The report will be called DrWeb.csv
Note:this report may need to be renamed to Dr.Web.txt in order to post it on the forum.
Please post the Dr.Web.txt report in your next reply
Close Dr.Web Cureit.
Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on the X in the upper right corner.

sinweiy

Post #44September 3, 2011, 12:47 AM UTC

while scanning over the night(still got some way to go), and i was going through the other person boffo123 who have the same problem as mine, i was wondering if it's got to do with the same files/reg(in D drive, mainly the first three) i have too?.

File::
c:\program files\Common Files\OnlineFilesManager.dll
C:\Program Files\Common Files\Data\hd39_module.dat
c:\windows\system32\19153993741.dll
c:\windows\SEFC0C0D5.tmp

Registry::
[-HKEY_CLASSES_ROOT\CLSID\{B82655E9-B81D-4A97-8154-0D84A4C048E4}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Online Files]

http://forums.whatthetech.com/index.php?sh…16902&st=45

because after he did the combofix, his system is fine.

sinweiy

Post #45September 3, 2011, 2:00 AM UTC

hi, here's the scan result: Process.exe;C:\SDfix\SDfix\apps;Tool.Killproc.3;; cnet_EasyBCD 2_1_exe.exe;C:\temp;Adware.Zugo.38;; cnet_spywareblastersetup44_exe.exe;C:\temp\Downloaded Installations;Adware.Zugo.38;; dds.scr;C:\temp\Downloaded Installations;Trojan.MulDrop2.44246;Incurable.Moved.; Process.exe;C:\temp\Downloaded Installations\1 smitRem;Tool.Killproc.3;; Process.exe;C:\temp\Downloaded Installations\2 SmitfraudFix;Tool.Killproc.3;; restart.exe;C:\temp\Downloaded Installations\2 SmitfraudFix;Tool.ShutDown.14;; 4e07abd2.qua\data001;D:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4e07abd2.qua;Trojan.Siggen.40351;; 4e07abd2.qua;D:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED;Container contains infected objects;Moved.; 4f9e2fb1.qua\data001;D:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4f9e2fb1.qua;Win32.HLLW.Shadow.based;; 4f9e2fb1.qua;D:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED;Container contains infected objects;Moved.; 4fffc4f8.qua\data001;D:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4fffc4f8.qua;Probably Trojan.Packed.Based;; 4fffc4f8.qua;D:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED;Container contains infected objects;Moved.; RegUBP2b-my pc.reg;D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots2;Trojan.StartPage.1505;Deleted.; Process.exe;D:\Documents and Settings\my pc\Desktop\Applications\SmitfraudFix;Tool.Killproc.3;; restart.exe;D:\Documents and Settings\my pc\Desktop\Applications\SmitfraudFix;Tool.ShutDown.14;; InstallHelper.exe;D:\Program Files\Common Files\Motive;Probably DLOADER.Trojan;; Uninstall.exe;D:\Program Files\Common Files\Thunder Network\APlayer;Trojan.Siggen2.57247;Incurable.Moved.; vd.1.1.0.32.(810).dll;D:\Program Files\Common Files\Thunder Network\KanKan;Probably DLOADER.Trojan;; WRLSetup.exe;D:\Program Files\Wireless\Common;Trojan.Siggen3.1470;Deleted.; WRLSetup.exe;D:\Program Files\Wireless\Wireless LAN USB 2.0 Adapter\Installer\WINXP;Trojan.Siggen3.1470;Deleted.; Process.exe.vir;D:\Qoobox\Quarantine\D\Documents and Settings\my pc\Local Settings\Application Data;Tool.Killproc.3;; A0327755.dll;D:\System Volume Information\_restore{7E9BF471-13B2-41ED-9F07-6185F865CE76}\RP890;Probably DLOADER.Trojan;; A0327853.dll;D:\System Volume Information\_restore{7E9BF471-13B2-41ED-9F07-6185F865CE76}\RP890;Probably DLOADER.Trojan;; A0330170.exe;D:\System Volume Information\_restore{7E9BF471-13B2-41ED-9F07-6185F865CE76}\RP892;Adware.Zugo.38;; A0330172.scr;D:\System Volume Information\_restore{7E9BF471-13B2-41ED-9F07-6185F865CE76}\RP892;Trojan.MulDrop2.44246;Incurable.Moved.; A0330191.exe;D:\System Volume Information\_restore{7E9BF471-13B2-41ED-9F07-6185F865CE76}\RP892;Tool.Killproc.3;; A0330194.exe;D:\System Volume Information\_restore{7E9BF471-13B2-41ED-9F07-6185F865CE76}\RP892;Tool.ShutDown.14;; A0330238.exe;D:\System Volume Information\_restore{7E9BF471-13B2-41ED-9F07-6185F865CE76}\RP892;Tool.Killproc.3;; A0330365.exe;D:\System Volume Information\_restore{7E9BF471-13B2-41ED-9F07-6185F865CE76}\RP892;Tool.Killproc.3;; A0330788.reg;D:\System Volume Information\_restore{7E9BF471-13B2-41ED-9F07-6185F865CE76}\RP894;Trojan.StartPage.1505;Deleted.; A0331956.reg;D:\System Volume Information\_restore{7E9BF471-13B2-41ED-9F07-6185F865CE76}\RP894;Trojan.StartPage.1505;Deleted.; A0336909.reg;D:\System Volume Information\_restore{7E9BF471-13B2-41ED-9F07-6185F865CE76}\RP902;Trojan.StartPage.1505;Deleted.; A0337115.reg;D:\System Volume Information\_restore{7E9BF471-13B2-41ED-9F07-6185F865CE76}\RP902;Trojan.StartPage.1505;Deleted.; A0337412.reg;D:\System Volume Information\_restore{7E9BF471-13B2-41ED-9F07-6185F865CE76}\RP903;Trojan.StartPage.1505;Deleted.; A0337529.reg;D:\System Volume Information\_restore{7E9BF471-13B2-41ED-9F07-6185F865CE76}\RP903;Trojan.StartPage.1505;Deleted.; A0337530.exe;D:\System Volume Information\_restore{7E9BF471-13B2-41ED-9F07-6185F865CE76}\RP903;Trojan.Siggen2.57247;Incurable.Moved.; A0337531.exe;D:\System Volume Information\_restore{7E9BF471-13B2-41ED-9F07-6185F865CE76}\RP903;Trojan.Siggen3.1470;Deleted.; A0337532.exe;D:\System Volume Information\_restore{7E9BF471-13B2-41ED-9F07-6185F865CE76}\RP903;Trojan.Siggen3.1470;Deleted.;

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Superantispyware finds Rogue.agent/GEN - Nullo[dll]

✨ Ask AI

Ask AI