What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Superantispyware finds Rogue.agent/GEN - Nullo[dll]

21 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46
OnlineFilesManager.dll is a legitimate Microsoft file… and your is the right size.
hd39_module.dat doesn't appear in your logs.

But… let's check them both out.

Please scan the following files

  • Please go to VirusTotal
  • On the page you'll find a "Browse" button.
  • Click on the Browse button.
  • In the Choose File to Upload window which opens, copy and paste this into the File Name box.
d:\program files\Common Files\OnlineFilesManager.dll
  • Next, click the Open button.
  • Then click the "Send File" button just below.
  • This will scan the file. Please be patient.
  • If you get a message saying File has already been analyzed: click Reanalyze file now.
  • Once scanned, copy and paste the link to the results page in your next reply.

Do the same with d:\Program Files\Common Files\Data\hd39_module.dat
Post #48
sinweiy,

I don't know what that .dat file is. Let's nuke it and we can restore it if something breaks.

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    File::
d:\Program Files\Common Files\Data\hd16_module.dat
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #49 last edited
yea, let's nuke it. :)
i didn't see the number.DLL file coming back, which is good, but the system seems to be still laggy. copying a 600 over MB file from one drive to another or burning dvd is taking quite a long time than before. hmm…

anyway i got myself a new system, Window 7. this Win xp system is quite old, and the system have too many unwanted programs, and i feel the system got too many things in the windows registry, and it's messy? maybe i'll just take out what i want and format the whole thing as a secondary harddisk for the new system. what do you suggest i can install as antispyware, or ie setting to protect the new window 7 system? i read about noscript. i'm installing free Avira and Spybot. something not so taxing on the system.


ComboFix 11-09-01.03 - my pc 4/2011 Sun 9:55.7.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.936.86.1033.18.2047.1379 [GMT 8:00]
执行位置: d:\documents and settings\my pc\Desktop\ComboFix.exe
Command switches used :: d:\documents and settings\my pc\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
FILE ::
"d:\program files\Common Files\Data\hd16_module.dat"
.
.
((((((((((((((((((((((((((((((((((((((( 被删除的档案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
d:\program files\Common Files\Data\hd16_module.dat
d:\windows\system32\1475035941.dll
.
.
((((((((((((((((((((((((( 2011-08-04 至 2011-09-04 的新的档案 )))))))))))))))))))))))))))))))
.
.
2011-09-04 01:41 . 2008-04-13 16:09 14592 -c–a-w- d:\windows\system32\dllcache\kbdhid.sys
2011-09-04 01:41 . 2008-04-13 16:09 14592 —-a-w- d:\windows\system32\drivers\kbdhid.sys
2011-09-02 14:21 . 2011-09-02 19:01 ——– d—–w- d:\documents and settings\my pc\DoctorWeb
2011-08-30 05:36 . 2011-08-30 05:36 ——– d—–w- d:\documents and settings\All Users\Application Data\!SASCORE
2011-08-30 04:28 . 2011-08-30 04:28 ——– d—–w- d:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-08-30 04:27 . 2011-08-30 05:18 ——– d—–w- d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com
2011-08-30 04:00 . 2011-08-30 04:00 ——– d—–w- d:\documents and settings\All Users\Application Data\SUPERSetup
2011-08-28 13:28 . 2011-08-28 13:28 ——– d—–w- d:\documents and settings\my pc\Local Settings\Application Data\Norman Malware Cleaner
2011-08-27 04:17 . 2011-09-02 14:08 ——– d—–w- D:\Media
2011-08-25 13:59 . 2011-08-25 13:59 ——– d—–w- d:\program files\Microsoft Silverlight
2011-08-24 06:03 . 2011-08-24 06:03 ——– d—a-w- D:\.Trash-999
2011-08-23 15:11 . 2011-07-29 05:54 19840 —-a-w- d:\windows\system32\EuEpmGdi.dll
2011-08-23 15:11 . 2011-08-02 12:48 2469248 —-a-w- d:\windows\system32\BootMan.exe
2011-08-23 15:11 . 2011-07-29 05:54 86408 —-a-w- d:\windows\system32\setupempdrv03.exe
2011-08-23 15:11 . 2011-07-29 05:54 8456 —-a-w- d:\windows\system32\EuGdiDrv.sys
2011-08-23 15:11 . 2011-07-29 05:54 13192 —-a-w- d:\windows\system32\epmntdrv.sys
2011-08-23 15:10 . 2011-08-23 15:10 ——– d—–w- d:\program files\EASEUS
2011-08-23 11:50 . 2010-11-03 18:08 237568 —-a-w- d:\windows\system32\yv12vfw.dll
2011-08-23 11:50 . 2011-06-24 14:44 243200 —-a-w- d:\windows\system32\xvidvfw.dll
2011-08-23 11:50 . 2011-06-24 14:28 650752 —-a-w- d:\windows\system32\xvidcore.dll
2011-08-23 11:50 . 2011-08-08 08:00 74752 —-a-w- d:\windows\system32\ff_vfw.dll
2011-08-20 08:06 . 2011-08-20 08:06 896 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\databasepath.reg
2011-08-20 08:06 . 2011-08-20 08:06 3008 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\bgregfix.reg
2011-08-20 08:06 . 2011-08-20 08:06 2600 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\exefix.reg
2011-08-20 08:06 . 2011-08-20 08:06 951291 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\remregfix.reg
2011-08-20 08:06 . 2011-08-20 08:06 890 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\Remove-itRestorePoint.vbs
2011-08-20 08:06 . 2011-08-20 08:06 5228 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\nfig.reg
2011-08-20 08:06 . 2011-08-20 08:06 4994 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\s.reg
2011-08-20 08:06 . 2011-08-20 08:06 4512 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\hpregfix.reg
2011-08-20 08:06 . 2011-08-20 08:06 18308 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\IEDef.reg
2011-08-20 08:06 . 2011-08-20 08:06 1754 —-a-w- d:\documents and settings\my pc\Local Settings\Application Data\regf.reg
2011-08-20 07:06 . 2008-05-02 13:25 465920 -c—-w- d:\windows\system32\dllcache\imapi2fs.dll
2011-08-20 07:06 . 2008-05-02 13:25 465920 ——w- d:\windows\system32\imapi2fs.dll
2011-08-20 07:06 . 2008-05-02 13:25 317952 -c—-w- d:\windows\system32\dllcache\imapi2.dll
2011-08-20 07:06 . 2008-05-02 13:25 317952 ——w- d:\windows\system32\imapi2.dll
2011-08-20 06:55 . 2011-08-20 07:11 ——– d—–w- d:\documents and settings\LocalService\Application Data\360safe
2011-08-20 04:09 . 2011-08-20 04:09 ——– d—–w- d:\program files\Chaos Group
2011-08-20 03:33 . 2011-08-20 08:54 ——– d—–w- d:\documents and settings\All Users\Application Data\360safe
2011-08-20 03:27 . 2011-08-20 03:27 ——– d—–w- d:\documents and settings\All Users\Application Data\360SD
2011-08-19 12:51 . 2011-08-19 13:36 ——– d—–w- d:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2011-08-19 12:51 . 2011-08-19 12:59 ——– d—–w- d:\program files\Spybot - Search & Destroy
2011-08-16 15:50 . 2011-08-27 01:41 ——– d—–w- d:\program files\SpywareBlaster
2011-08-16 15:47 . 2011-08-16 15:47 ——– d—–w- d:\program files\ESET
2011-08-16 15:29 . 2011-08-30 04:11 ——– d—–w- d:\program files\Panda Security
2011-08-16 14:20 . 2010-05-25 07:59 96488 —-a-w- d:\windows\system32\drivers\ssadbus.sys
2011-08-16 14:20 . 2010-05-25 07:59 30312 —-a-w- d:\windows\system32\drivers\ssadadb.sys
2011-08-16 14:20 . 2010-05-25 07:59 1416680 —-a-w- d:\windows\system32\WdfCoInstaller01005.dll
2011-08-16 14:20 . 2010-05-25 07:59 12776 —-a-w- d:\windows\system32\drivers\ssadmdfl.sys
2011-08-16 14:20 . 2010-05-25 07:59 121576 —-a-w- d:\windows\system32\drivers\ssadmdm.sys
2011-08-16 14:20 . 2010-05-25 07:59 10344 —-a-w- d:\windows\system32\drivers\ssadcmnt.sys
2011-08-16 14:20 . 2010-05-25 07:59 10216 —-a-w- d:\windows\system32\drivers\ssadwhnt.sys
2011-08-13 05:16 . 2011-08-13 05:16 ——– d—–w- d:\program files\FileHippo.com
2011-08-13 04:46 . 2011-09-01 12:06 ——– d—–w- d:\program files\SUPERAntiSpyware
2011-08-13 03:40 . 2011-08-13 03:40 110080 —-a-r- d:\documents and settings\my pc\Application Data\Microsoft\Installer\{4FC9DA9D-F608-454E-8191-D7EFFDCC5726}\IconF7A21AF7.exe
2011-08-13 03:40 . 2011-08-13 03:40 110080 —-a-r- d:\documents and settings\my pc\Application Data\Microsoft\Installer\{4FC9DA9D-F608-454E-8191-D7EFFDCC5726}\IconD7F16134.exe
2011-08-13 03:40 . 2011-08-18 13:31 ——– d—–w- D:\sh4ldr
2011-08-13 03:40 . 2011-08-13 03:40 ——– d—–w- d:\program files\Enigma Software Group
2011-08-13 03:39 . 2011-08-13 03:40 ——– d—–w- d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2011-08-13 03:39 . 2011-08-30 05:14 ——– d—–w- d:\program files\Common Files\Wise Installation Wizard
2011-08-12 14:16 . 2008-04-13 21:41 81920 -c–a-w- d:\windows\system32\dllcache\ieencode.dll
2011-08-12 14:16 . 2008-04-13 21:41 81920 ——w- d:\windows\system32\ieencode.dll
2011-08-11 15:03 . 2001-08-17 14:36 53760 -c–a-w- d:\windows\system32\dllcache\wiamsmud.dll
2011-08-11 15:02 . 2001-08-17 05:28 687999 -c–a-w- d:\windows\system32\dllcache\usrwdxjs.sys
2011-08-11 15:01 . 2001-08-17 14:36 216064 -c–a-w- d:\windows\system32\dllcache\um34scan.dll
2011-08-11 15:00 . 2001-08-17 04:14 123995 -c–a-w- d:\windows\system32\dllcache\tjisdn.sys
2011-08-11 14:59 . 2001-08-17 14:36 10240 -c–a-w- d:\windows\system32\dllcache\swpidflt.dll
2011-08-11 14:58 . 2001-08-17 05:53 9600 -c–a-w- d:\windows\system32\dllcache\sonymc.sys
2011-08-11 14:57 . 2001-08-17 04:50 50432 -c–a-w- d:\windows\system32\dllcache\sisv.sys
2011-08-11 14:56 . 2001-08-17 05:51 16640 -c–a-w- d:\windows\system32\dllcache\scmstcs.sys
2011-08-11 14:55 . 2001-08-17 04:12 19017 -c–a-w- d:\windows\system32\dllcache\rtl8029.sys
2011-08-11 14:54 . 2001-08-17 05:28 112574 -c–a-w- d:\windows\system32\dllcache\ptserlp.sys
2011-08-11 14:53 . 2001-08-17 04:11 35328 -c–a-w- d:\windows\system32\dllcache\pcntpci5.sys
2011-08-11 14:52 . 2001-08-17 04:50 198144 -c–a-w- d:\windows\system32\dllcache\nv3.sys
2011-08-11 14:51 . 2001-08-17 04:11 128000 -c–a-w- d:\windows\system32\dllcache\n100325.sys
2011-08-11 14:50 . 2001-08-17 05:57 16128 -c–a-w- d:\windows\system32\dllcache\modemcsa.sys
2011-08-11 14:49 . 2001-08-17 04:12 20573 -c–a-w- d:\windows\system32\dllcache\lne100.sys
2011-08-11 14:48 . 2001-08-17 14:36 372824 -c–a-w- d:\windows\system32\dllcache\iconf32.dll
2011-08-11 14:47 . 2001-08-17 05:28 44863 -c–a-w- d:\windows\system32\dllcache\hsf_soar.sys
2011-08-11 14:46 . 2001-08-17 06:02 2688 -c–a-w- d:\windows\system32\dllcache\hidswvd.sys
2011-08-11 14:45 . 2001-08-17 04:11 12362 -c–a-w- d:\windows\system32\dllcache\f3ab18xi.sys
2011-08-11 14:44 . 2001-08-17 04:11 69194 -c–a-w- d:\windows\system32\dllcache\el656cd5.sys
2011-08-11 14:43 . 2001-08-17 14:36 24064 -c–a-w- d:\windows\system32\dllcache\devldr32.exe
2011-08-11 14:42 . 2001-08-17 04:13 27164 -c–a-w- d:\windows\system32\dllcache\ce3n5.sys
2011-08-10 13:34 . 2008-04-13 16:06 14208 -c–a-w- d:\windows\system32\dllcache\battc.sys
2011-08-09 10:36 . 2011-08-09 10:36 ——– d—–w- d:\documents and settings\my pc\Local Settings\Application Data\Octoshape
2011-08-09 10:36 . 2011-08-09 10:36 ——– d—–w- d:\documents and settings\my pc\Application Data\Octoshape
2011-08-09 03:12 . 2011-08-09 03:13 ——– d—–w- d:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2011-08-09 03:12 . 2011-08-09 03:12 ——– d—–w- d:\documents and settings\my pc\Application Data\Windows Search
2011-08-09 03:11 . 2011-08-09 03:11 ——– d—–w- d:\windows\system32\winrm
2011-08-09 03:11 . 2011-08-09 03:11 ——– dc-h–w- d:\windows\$968930Uinstall_KB968930$
2011-08-09 03:11 . 2011-08-09 03:11 ——– d—–w- d:\documents and settings\my pc\Application Data\Windows Desktop Search
2011-08-09 03:10 . 2011-08-11 15:10 ——– d—–w- d:\program files\Windows Desktop Search
2011-08-09 03:10 . 2011-08-09 03:10 ——– d—–w- d:\windows\system32\GroupPolicy
2011-08-09 00:52 . 2011-08-09 00:52 ——– d—–w- d:\program files\Microsoft.NET
2011-08-07 02:15 . 2011-08-07 02:15 ——– d—–w- d:\documents and settings\All Users\Application Data\NVIDIA Corporation
2011-08-07 02:14 . 2011-08-09 05:09 ——– d—–w- d:\documents and settings\UpdatusUser
2011-08-07 02:14 . 2011-08-07 02:14 ——– d—–w- d:\documents and settings\All Users\Application Data\NVIDIA
2011-08-07 02:13 . 2011-05-25 06:09 543336 —-a-w- d:\windows\system32\easyupdatusapiu.dll
2011-08-07 02:13 . 2011-09-02 12:02 273344 —-a-w- d:\windows\system32\nvdrsdb0.bin
2011-08-07 02:13 . 2011-09-02 12:02 1 —-a-w- d:\windows\system32\nvdrssel.bin
2011-08-07 02:13 . 2011-08-18 12:55 273344 —-a-w- d:\windows\system32\nvdrsdb1.bin
2011-08-07 02:12 . 2011-05-25 06:09 61440 —-a-w- d:\windows\system32\OpenCL.dll
2011-08-07 02:12 . 2011-05-25 06:09 865896 —-a-w- d:\windows\system32\nvgenco322090.dll
2011-08-07 02:12 . 2011-05-25 06:09 2808936 —-a-w- d:\windows\system32\nvcuvid.dll
2011-08-07 02:12 . 2011-05-25 06:09 2082408 —-a-w- d:\windows\system32\nvcuvenc.dll
2011-08-07 02:12 . 2011-05-25 06:09 5332992 —-a-w- d:\windows\system32\nvcuda.dll
2011-08-07 02:12 . 2011-05-25 06:09 13004800 —-a-w- d:\windows\system32\nvcompiler.dll
2011-08-07 02:12 . 2011-08-18 12:52 ——– d—–w- d:\program files\NVIDIA Corporation
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-30 08:01 . 2011-06-25 00:10 404640 —-a-w- d:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-20 08:06 . 2006-02-28 12:00 4224 —-a-w- d:\windows\system32\drivers\beep.sys
2011-07-15 13:29 . 2008-10-09 22:35 456320 —-a-w- d:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-10-09 22:35 10496 —-a-w- d:\windows\system32\drivers\ndistapi.sys
2011-07-06 11:52 . 2010-10-16 00:47 41272 —-a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 11:52 . 2010-10-16 00:47 22712 —-a-w- d:\windows\system32\drivers\mbam.sys
2011-06-28 13:09 . 2010-10-23 04:52 138192 —-a-w- d:\windows\system32\drivers\avipbb.sys
2011-06-28 13:09 . 2010-10-23 04:52 66616 —-a-w- d:\windows\system32\drivers\avgntflt.sys
2011-06-24 14:10 . 2008-10-09 22:35 139656 —-a-w- d:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2006-02-28 12:00 916480 —-a-w- d:\windows\system32\wininet.dll
2011-06-23 18:36 . 2006-02-28 12:00 43520 —-a-w- d:\windows\system32\licmgr10.dll
2011-06-23 18:36 . 2006-02-28 12:00 1469440 ——w- d:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2006-02-28 12:00 385024 —-a-w- d:\windows\system32\html.iec
2011-06-20 17:44 . 2006-02-28 12:00 293376 —-a-w- d:\windows\system32\winsrv.dll
2011-06-07 03:13 . 2011-06-16 13:43 4659712 —-a-w- d:\windows\system32\Redemption.dll
2011-06-07 03:13 . 2011-06-07 03:13 974848 —-a-w- d:\windows\system32\cis-2.4.dll
2011-06-07 03:13 . 2011-06-07 03:13 90112 —-a-w- d:\windows\MAMCityDownload.ocx
2011-06-07 03:13 . 2011-06-07 03:13 81920 —-a-w- d:\windows\system32\issacapi_bs-2.3.dll
2011-06-07 03:13 . 2011-06-07 03:13 65536 —-a-w- d:\windows\system32\issacapi_pe-2.3.dll
2011-06-07 03:13 . 2011-06-07 03:13 57344 —-a-w- d:\windows\system32\MTXSYNCICON.dll
2011-06-07 03:13 . 2011-06-07 03:13 57344 —-a-w- d:\windows\system32\issacapi_se-2.3.dll
2011-06-07 03:13 . 2011-06-07 03:13 569344 —-a-w- d:\windows\system32\muzdecode.ax
2011-06-07 03:13 . 2011-06-07 03:13 491520 —-a-w- d:\windows\system32\muzapp.dll
2011-06-07 03:13 . 2011-06-07 03:13 49152 —-a-w- d:\windows\system32\MaJGUILib.dll
2011-06-07 03:13 . 2011-06-07 03:13 45056 —-a-w- d:\windows\system32\MaXMLProto.dll
2011-06-07 03:13 . 2011-06-07 03:13 40960 —-a-w- d:\windows\system32\MTTELECHIP.dll
2011-06-07 03:13 . 2011-06-07 03:13 352256 —-a-w- d:\windows\system32\MSLUR71.dll
2011-06-07 03:13 . 2011-06-07 03:13 325552 —-a-w- d:\windows\MASetupCaller.dll
2011-06-07 03:13 . 2011-06-07 03:13 30568 —-a-w- d:\windows\MusiccityDownload.exe
2011-06-07 03:13 . 2011-06-07 03:13 24576 —-a-w- d:\windows\system32\MASetupCleaner.exe
2011-06-07 03:13 . 2011-06-07 03:13 200704 —-a-w- d:\windows\system32\muzwmts.dll
2011-06-07 03:13 . 2011-06-07 03:13 155648 —-a-w- d:\windows\system32\MSFLib.dll
2011-06-07 03:13 . 2011-06-07 03:13 143360 —-a-w- d:\windows\system32\3DAudio.ax
2011-06-07 03:13 . 2011-06-07 03:13 14336 —-a-w- d:\windows\system32\avrt.dll
2011-06-07 03:13 . 2011-06-07 03:13 135168 —-a-w- d:\windows\system32\muzaf1.dll
2011-06-07 03:13 . 2011-06-07 03:13 131072 —-a-w- d:\windows\system32\muzmpgsp.ax
2011-06-07 03:13 . 2011-06-07 03:13 122880 —-a-w- d:\windows\system32\muzeffect.ax
2011-06-07 03:13 . 2011-06-07 03:13 118784 —-a-w- d:\windows\system32\MaDRM.dll
2011-06-07 03:13 . 2011-06-07 03:13 110592 —-a-w- d:\windows\system32\muzmp4sp.ax
2011-06-07 03:13 . 2011-06-16 13:43 821824 —-a-w- d:\windows\system32\dgderapi.dll
2011-06-07 03:13 . 2011-06-16 13:43 319456 —-a-w- d:\windows\system32\DIFxAPI.dll
2011-06-07 03:13 . 2011-06-16 13:43 20032 —-a-w- d:\windows\system32\drivers\dgderdrv.sys
2011-06-07 03:13 . 2011-06-07 03:13 57344 —-a-w- d:\windows\system32\MK_Lyric.dll
2011-06-07 03:13 . 2011-06-07 03:13 45056 —-a-w- d:\windows\system32\MACXMLProto.dll
2011-06-07 03:13 . 2011-06-07 03:13 40960 —-a-w- d:\windows\system32\MAMACExtract.dll
2011-06-07 03:13 . 2011-06-07 03:13 258048 —-a-w- d:\windows\system32\muzoggsp.ax
2011-06-07 03:13 . 2011-06-07 03:13 245760 —-a-w- d:\windows\system32\MSCLib.dll
2011-04-24 04:10 . 2011-04-24 04:10 197632 —-a-w- d:\program files\Common Files\OnlineFilesManager.dll
2011-08-12 05:57 . 2011-08-19 23:55 134104 —-a-w- d:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 09:06 163328 –sha-r- d:\windows\system32\flvDX.dll
2007-02-21 10:47 31232 –sha-r- d:\windows\system32\msfDX.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-24_12.44.00 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-25 13:59 . 2011-08-25 13:59 38400 d:\windows\Installer\7f9eed.msi
+ 2011-08-25 13:59 . 2011-08-25 13:59 49152 d:\windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIcon.dll
+ 2011-08-30 08:00 . 2011-08-30 08:00 243360 d:\windows\system32\Macromed\Flash\FlashUtil10w_Plugin.exe
+ 2006-02-28 12:00 . 2011-06-20 17:44 293376 d:\windows\system32\dllcache\winsrv.dll
- 2006-02-28 12:00 . 2011-04-26 11:07 293376 d:\windows\system32\dllcache\winsrv.dll
+ 2011-08-30 08:00 . 2011-08-30 08:00 6277280 d:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2011-08-25 13:59 . 2011-08-25 13:59 20333056 d:\windows\Installer\7f9ef6.msp
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0A0DDBD3-6641-40B9-873F-BBDD26D6C14E}]
2011-01-26 04:04 180696 —-a-w- d:\program files\easyMule\modules\IE2EM.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\my pc\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Online Files]
@="{B82655E9-B81D-4A97-8154-0D84A4C048E4}"
[HKEY_CLASSES_ROOT\CLSID\{B82655E9-B81D-4A97-8154-0D84A4C048E4}]
2011-04-24 04:10 197632 —-a-w- d:\program files\Common Files\OnlineFilesManager.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="d:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"SUPERAntiSpyware"="d:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-06-10 2424192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="d:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]
"nwiz"="d:\program files\NVIDIA Corporation\nView\nwiz.exe" [2011-05-04 1632360]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2011-05-25 13895272]
"QuickTime Task"="d:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="d:\windows\system32\ctfmon.exe" [2008-04-13 15360]
.
d:\documents and settings\my pc\Start Menu\Programs\Startup\
BitTorrent (2).lnk - c:\program files\BitTorrent\bittorrent.exe [N/A]
Dropbox.lnk - d:\documents and settings\my pc\Application Data\Dropbox\bin\Dropbox.exe [2011-5-26 24176560]
.
d:\documents and settings\All Users\Start Menu\Programs\Startup\
Wireless Utility.lnk - d:\program files\Wireless\Common\Utility.exe [2010-12-29 602112]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "d:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- d:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-10-10 13:51 10792 —-a-w- d:\program files\Citrix\GoToAssist\480\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=d:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=d:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^JCMATTHEW WLAN.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\JCMATTHEW WLAN.lnk
backup=d:\windows\pss\JCMATTHEW WLAN.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Nokia Nseries PC Suite.lnk]
backup=d:\windows\pss\Nokia Nseries PC Suite.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=d:\windows\pss\Windows Search.lnkCommon Startup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^Adobe Gamma.lnk]
backup=d:\windows\pss\Adobe Gamma.lnkStartup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^Dropbox.lnk]
path=d:\documents and settings\my pc\Start Menu\Programs\Startup\Dropbox.lnk
backup=d:\windows\pss\Dropbox.lnkStartup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^MagicDisc.lnk]
backup=d:\windows\pss\MagicDisc.lnkStartup
.
[HKLM\~\startupfolder\D:^Documents and Settings^my pc^Start Menu^Programs^Startup^启动迅雷5.lnk]
path=d:\documents and settings\my pc\Start Menu\Programs\Startup\启动迅雷5.lnk
backup=d:\windows\pss\启动迅雷5.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
d:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
2009-09-12 08:31 357384 —-a-w- d:\program files\Common Files\Acronis\Schedule2\schedhlp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-14 17:04 39792 —-a-w- d:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2010-05-10 13:53 611712 —-a-w- d:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
2008-11-20 13:30 2356088 —-a-w- d:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 ——r- d:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-06-01 02:21 153136 —-a-w- d:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
2008-02-19 00:22 1089536 —-a-r- d:\program files\Brother\Brmfcmon\BrMfcWnd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
2007-12-21 09:57 86016 —-a-w- d:\program files\Brother\ControlCenter3\BrCtrCen.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-13 21:42 15360 —-a-w- d:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-03-21 18:56 1230704 —-a-w- d:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eMuleAutoStart]
2011-01-26 12:03 7508440 —-a-w- d:\program files\easyMule\emule.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileHippo.com]
2010-08-09 12:47 248832 —-a-w- d:\program files\FileHippo.com\UpdateChecker.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2006-02-28 12:00 208952 —-a-w- d:\windows\ime\imjp8_1\imjpmig.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2007-10-11 11:01 46368 —-a-w- d:\program files\ScanSoft\PaperPort\IndexSearch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-07-27 08:50 221184 —-a-w- d:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-02-16 08:15 81920 —-a-w- d:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-03-01 13:45 421160 —-a-w- d:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper]
2011-06-09 10:52 940944 —-a-w- d:\program files\Samsung\Kies\KiesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]
2011-06-09 10:52 20880 —-a-w- d:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
2011-06-09 10:52 3373968 —-a-w- d:\program files\Samsung\Kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-07-06 11:52 449584 —-a-w- d:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-13 21:42 1695232 —-a-w- d:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2010-04-16 14:12 3872080 —-a-w- d:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
2006-02-28 12:00 59392 —-a-w- d:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 07:57 153136 —-a-w- d:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2011-05-25 06:09 13895272 —-a-w- d:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2011-05-25 06:09 111208 —-a-w- d:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2011-05-04 16:02 1632360 —-a-w- d:\program files\NVIDIA Corporation\nView\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Octoshape Streaming Services]
2009-01-08 13:44 70936 —-a-w- d:\documents and settings\my pc\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2007-10-11 11:03 29984 —-a-w- d:\program files\ScanSoft\PaperPort\pptd40nt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2006-02-28 12:00 455168 —-a-w- d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2006-02-28 12:00 455168 —-a-w- d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPS Accelerator]
2010-02-24 03:25 214408 —-a-w- d:\progra~1\PPStream\PPSAP.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 09:38 421888 —-a-w- d:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QvodPlayer]
2009-09-13 04:28 558472 —-a-w- d:\program files\QvodPlayer\QvodTerminal.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
2006-08-17 01:00 1116920 —-a-w- c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-06-13 06:49 16377344 ——r- d:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sclauncher]
2007-10-11 11:12 94208 —-a-w- d:\program files\SimpleCenter\bin\win\sclauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyHunter Security Suite]
2010-06-28 10:05 3021720 —-a-w- d:\program files\Enigma Software Group\SpyHunter\SpyHunter4.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 01:03 210472 —-a-w- d:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2011-06-10 16:57 2424192 —-a-w- d:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Thunder]
2011-05-27 10:14 1002672 —-a-w- d:\program files\Thunder Network\Thunder\Program\Thunder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2011-08-13 06:42 273544 —-a-w- d:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
2009-09-12 08:30 5048488 —-a-w- d:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"mi-raysat_3dsmax9_32"=2 (0x2)
"mi-raysat_3dsMax2008_32"=2 (0x2)
"Bonjour Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"aawservice"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
"Autodesk Licensing Service"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"stllssvr"=3 (0x3)
"ServiceLayer"=3 (0x3)
"SeaPort"=2 (0x2)
"ose"=3 (0x3)
"NMIndexingService"=3 (0x3)
"mi-raysat_3dsMax2009_32"=2 (0x2)
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate"=3 (0x3)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"GoToAssist"=3 (0x3)
"fsssvc"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"afcdpsrv"=2 (0x2)
"SpyHunter 4 Service"=2 (0x2)
"YahooAUService"=2 (0x2)
"iPod Service"=3 (0x3)
"AcrSch2Svc"=2 (0x2)
"!SASCORE"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\QvodPlayer\\QvodTerminal.exe"=
.
R0 tdrpman251;Acronis Try&Decide and Restore Points filter (build 251);d:\windows\system32\drivers\tdrpm251.sys [12/5/2010 7:58 AM 902432]
R1 SASDIFSV;SASDIFSV;d:\program files\SUPERAntiSpyware\sasdifsv.sys [2/18/2010 2:25 AM 12872]
R1 SASKUTIL;SASKUTIL;d:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/11/2010 2:41 AM 67656]
R2 !SASCORE;SAS Core Service;d:\program files\SUPERAntiSpyware\SASCore.exe [5/5/2011 1:54 AM 114048]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\program files\Avira\AntiVir Desktop\sched.exe [10/23/2010 12:52 PM 136360]
R2 BBUpdate;BBUpdate;d:\program files\Microsoft\BingBar\SeaPort.EXE [6/15/2011 5:33 PM 249648]
R2 nvUpdatusService;NVIDIA Update Service Daemon;d:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [8/7/2011 10:14 AM 2214504]
R2 XLDoctor Service;XLDoctor Service;d:\windows\system32\svchost -k DoctorService –> d:\windows\system32\svchost -k DoctorService [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;d:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 gupdate;Google Update Service (gupdate);d:\program files\Google\Update\GoogleUpdate.exe [11/8/2010 7:13 PM 136176]
S3 afcdp;afcdp;d:\windows\system32\drivers\afcdp.sys [12/5/2010 7:59 AM 159168]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;d:\windows\system32\drivers\ssadadb.sys [8/16/2011 10:20 PM 30312]
S3 BBSvc;Bing Bar Update Service;d:\program files\Microsoft\BingBar\BBSvc.EXE [7/7/2011 7:31 PM 195336]
S3 dgderdrv;dgderdrv;d:\windows\system32\drivers\dgderdrv.sys [6/16/2011 9:43 PM 20032]
S3 epmntdrv;epmntdrv;d:\windows\system32\epmntdrv.sys [8/23/2011 11:11 PM 13192]
S3 esgiguard;esgiguard;d:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [1/27/2010 6:10 PM 5248]
S3 EuGdiDrv;EuGdiDrv;d:\windows\system32\EuGdiDrv.sys [8/23/2011 11:11 PM 8456]
S3 FsUsbExDisk;FsUsbExDisk;d:\windows\system32\FsUsbExDisk.Sys [7/12/2010 9:57 PM 36640]
S3 gupdatem;Google Update Service (gupdatem);d:\program files\Google\Update\GoogleUpdate.exe [11/8/2010 7:13 PM 136176]
S3 MBAMProtector;MBAMProtector;d:\windows\system32\drivers\mbam.sys [10/16/2010 8:47 AM 22712]
S3 Revoflt;Revoflt;d:\windows\system32\drivers\revoflt.sys [8/14/2010 9:33 AM 27064]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;d:\windows\system32\drivers\usbscan.sys [10/10/2008 6:35 AM 15104]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);d:\windows\system32\drivers\ssadbus.sys [8/16/2011 10:20 PM 96488]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);d:\windows\system32\drivers\ssadmdfl.sys [8/16/2011 10:20 PM 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;d:\windows\system32\drivers\ssadmdm.sys [8/16/2011 10:20 PM 121576]
S3 StumbleUponUpdateService;StumbleUponUpdateService;d:\program files\StumbleUpon\StumbleUponUpdateService.exe [4/14/2011 6:10 AM 103336]
S3 WinRM;Windows Remote Management (WS-Management);d:\windows\system32\svchost.exe -k WINRM [2/28/2006 8:00 PM 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;d:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
S4 afcdpsrv;Acronis Nonstop Backup service;d:\program files\Common Files\Acronis\CDP\afcdpsrv.exe [12/5/2010 7:59 AM 2326920]
S4 MBAMService;MBAMService;"c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe" –> c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [?]
S4 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;c:\program files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [3/10/2008 12:04 AM 65536]
S4 sptd;sptd;d:\windows\system32\drivers\sptd.sys [12/27/2007 6:59 PM 685816]
S4 SpyHunter 4 Service;SpyHunter 4 Service;d:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [5/18/2010 5:06 PM 327064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
DoctorService REG_MULTI_SZ XLDoctor Service
WINRM REG_MULTI_SZ WINRM
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-07 20:32 128512 —-a-w- d:\windows\system32\advpack.dll
.
‘计划任务’ 文件夹 里的内容
.
2011-09-04 d:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- d:\program files\Google\Update\GoogleUpdate.exe [2010-11-08 11:13]
.
2011-09-03 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\program files\Google\Update\GoogleUpdate.exe [2010-11-08 11:13]
.
2011-09-04 d:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-299502267-1788223648-725345543-1004.job
- d:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 02:47]
.
2011-08-29 d:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-299502267-1788223648-725345543-1004.job
- d:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 02:47]
.
2011-09-04 d:\windows\Tasks\User_Feed_Synchronization-{BC65CFD2-BBB2-4EA9-8129-77D470F20F96}.job
- d:\windows\system32\msfeedssync.exe [2007-08-13 20:31]
.
.
——- 而外的扫描 ——-
.
uStart Page = hxxp://sg.yahoo.com/?fr=fp-yie8/
uInternet Settings,ProxyOverride = *.local
IE: ?????? - d:\program files\Thunder Network\Thunder\BHO\GetUrl.htm
IE: ?????????? - d:\program files\Thunder Network\Thunder\BHO\GetAllUrl.htm
DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} - hxxp://cafeimg.daum-img.net/cab9_1/dmcc2.cab?Version=1,0,0,10
FF - ProfilePath - d:\documents and settings\my pc\Application Data\Mozilla\Firefox\Profiles\emub2jur.default\
FF - prefs.js: browser.startup.homepage - hxxp://sg.yahoo.com/?fr=fp-yie8/
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{0EA37B17-6B8B-4085-8257-F3A4AA69C27A} - (no file)
BHO-{B0E2F470-0B07-48f0-B3B1-5749505FAE9B} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-04 10:06
Windows 5.1.2600 Service Pack 3 NTFS
.
扫描被隐藏的进程 。。。
.
扫描被隐藏的启动组 。。。
.
扫描被隐藏的文件 。。。
.
扫描完成
被隐藏的档案: 0
.
**************************************************************************
.
——————— 运行进程下的动态链接库 ———————
.
- - - - - - - > 'winlogon.exe'(628)
d:\program files\SUPERAntiSpyware\SASWINLO.DLL
d:\windows\system32\WININET.dll
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
d:\documents and settings\my pc\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
d:\program files\Citrix\GoToAssist\480\G2AWinLogon.dll
.
- - - - - - - > 'lsass.exe'(684)
d:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
完成时间: 2011-09-04 10:11:02
ComboFix-quarantined-files.txt 2011-09-04 02:11
ComboFix2.txt 2011-09-02 09:43
ComboFix3.txt 2011-09-01 11:55
ComboFix4.txt 2011-08-27 01:25
ComboFix5.txt 2011-09-04 01:52
.
Pre-Run: 190,682,206,208 bytes free
Post-Run: 190,708,559,872 bytes free
.
Current=1 Default=1 Failed=0 LastKnownGood=6 Sets=1,2,3,4,5,6
- - End Of File - - FF679B2130F6FEF76EA82A3FF97FD7A6
Post #50
Starting with a clean install of a new operating system is pretty much the only way to insure that you are malware free. The problem comes when you start installing infected files from your backups.
Post #51 last edited
Yeah, i won't be installing infected programs from the infected computer. i have yet to format the older computer, thinking i might still need something from it. but it seem to be alright and Not so laggy after i try to get rid of the OnlineFilesManager.dll too. I simply renamed the OnlineFilesManager.dll to OnlineFilesManager.dl_. it's okay now. the number.dll never came back. So thanks for the help.
Post #52
Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /Uninstall in the runbox and click OK
  • Note the space between the X and the U, it needs to be there.
The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.

Now to remove most of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.
Please re-enable any security that was disabled.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI