ANDREW1959
Topic Starter
I am a bit of a computer dummy but it seems I have some kind of a virus as my hotmail has sent out a number of e-mails to my address book contacts offering herbal viagra.
I have Zone alarm as my firewall and avast as the anti virus.
Computer uses WINDOWS VISTA its a Cyberpower make with Intel Quad core Q6600 2.4GHZ 4CG RAm 32 Bit Op sys.
I have run HiJAck this and posted the log below as you suggest.
Thank you for your help.
Andrew
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 08:02:01, on 23/08/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spool\drivers\w32x86\3\EKIJ5000MUI.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GZPAJR1Q\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll
O2 - BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O3 - Toolbar: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\Windows\system32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [SPIRunE] Rundll32 SPIRunE.dll,RunDLLEntry
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://ccfiles.creative.com/Web/softwareup…101/CTSUEng.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} (MSN Games – Hearts) - http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab99160.cab
O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…k.cab102118.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shock…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photo…NPUplden-gb.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareup…15112/CTPID.cab
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Media Toolbox 6 Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\MT6Licensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
–
End of file - 10698 bytes
I have Zone alarm as my firewall and avast as the anti virus.
Computer uses WINDOWS VISTA its a Cyberpower make with Intel Quad core Q6600 2.4GHZ 4CG RAm 32 Bit Op sys.
I have run HiJAck this and posted the log below as you suggest.
Thank you for your help.
Andrew
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 08:02:01, on 23/08/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spool\drivers\w32x86\3\EKIJ5000MUI.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GZPAJR1Q\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll
O2 - BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O3 - Toolbar: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\Windows\system32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [SPIRunE] Rundll32 SPIRunE.dll,RunDLLEntry
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://ccfiles.creative.com/Web/softwareup…101/CTSUEng.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} (MSN Games – Hearts) - http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab99160.cab
O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…k.cab102118.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shock…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photo…NPUplden-gb.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareup…15112/CTPID.cab
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Media Toolbox 6 Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\MT6Licensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
–
End of file - 10698 bytes
The web page opening then vanishing has ben going on for a number of weeks the email busines started last weekend.
Here's dds
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 10:01:16.35 on 24/08/2011
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.3070.1610 [GMT 1:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ZoneAlarm Firewall *Enabled* {D17DF357-CFF5-F001-D1C1-FCD21DFE3D5E}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\ZoneLabs\vsmon.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\Explorer.EXE
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\System32\mobsync.exe
C:\Windows\System32\spool\drivers\w32x86\3\EKIJ5000MUI.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Administrator\Pictures\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.co.uk/
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: ZoneAlarm Toolbar: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - c:\program files\zonealarm\tbZone.dll
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
mURLSearchHooks: ZoneAlarm Toolbar: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - c:\program files\zonealarm\tbZone.dll
mURLSearchHooks: H - No File
BHO: &Yahoo;! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: ZoneAlarm Toolbar: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - c:\program files\zonealarm\tbZone.dll
BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
TB: ZoneAlarm Toolbar: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - c:\program files\zonealarm\tbZone.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [Google Update] "c:\users\administrator\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [EKIJ5000StatusMonitor] c:\windows\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe
mRun: [SPIRunE] Rundll32 SPIRunE.dll,RunDLLEntry
mRun: [VolPanel] "c:\program files\creative\sound blaster x-fi\volume panel\VolPanlu.exe" /r
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [ISW] "c:\program files\checkpoint\zaforcefield\ForceField.exe" /icon="hidden"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} - hxxp://zone.msn.com/bingame/zpagames/zpa_hrtz.cab99160.cab
DPF: {A4110378-789B-455F-AE86-3A1BFC402853} - hxxp://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZPAFramework.cab102118.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUplden-gb.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15112/CTPID.cab
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\admini~1\appdata\roaming\mozilla\firefox\profiles\bhwd8ppd.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo!
FF - prefs.js: network.proxy.type - 0
FF - component: c:\program files\checkpoint\zaforcefield\trustchecker\components\TrustCheckerMozillaPlugin.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\checkpoint\zaforcefield\trustchecker\bin\npFFApi.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\nos\bin\np_gp.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\administrator\appdata\local\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: ZoneAlarm Security Engine: {FFB96CC1-7EB3-449D-B827-DB661701C6BB} - c:\program files\checkpoint\zaforcefield\TrustChecker
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: avast! WebRep: [removed] - c:\program files\avast software\avast\webrep\FF
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-4-11 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-4-11 309848]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 64952]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-4-11 19544]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-4-11 54104]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-4-11 42184]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2009-10-14 26352]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2009-10-14 493032]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2011-4-11 1153368]
R3 t3;Sound Blaster X-Fi Xtreme Audio;c:\windows\system32\drivers\t3.sys [2009-5-6 413208]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-12-24 136176]
S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\common files\creative labs shared\service\AL6Licensing.exe [2010-5-3 79360]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\common files\creative labs shared\service\CTAELicensing.exe [2010-5-3 79360]
S3 Creative Media Toolbox 6 Licensing Service;Creative Media Toolbox 6 Licensing Service;c:\program files\common files\creative labs shared\service\MT6Licensing.exe [2010-5-3 79360]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2010-10-26 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2011-5-13 1492840]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-12-24 136176]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2008-1-21 21504]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
.
=============== Created Last 30 ================
.
2011-08-24 06:59:38 7152464 —-a-w- c:\progra~2\microsoft\windows defender\definition updates\{1443838f-6950-4be4-9ac6-e85adb9fe546}\mpengine.dll
2011-08-24 06:39:01 ——– d—–w- c:\users\admini~1\appdata\local\{DEB59504-6432-43AD-89E0-84128C4DCD5B}
2011-08-24 06:38:57 ——– d—–w- c:\users\admini~1\appdata\local\{44072A98-907D-4351-ADC0-7489BAEBEE0C}
2011-08-23 18:38:36 ——– d—–w- c:\users\admini~1\appdata\local\{7CC6A110-122F-4DCB-994A-3930CB28E6AC}
2011-08-23 18:38:32 ——– d—–w- c:\users\admini~1\appdata\local\{157C6070-5CD4-49B1-834C-B8A1DF495379}
2011-08-23 06:38:11 ——– d—–w- c:\users\admini~1\appdata\local\{BB1C604F-80D9-4BEF-8D01-1FBE98F07DC1}
2011-08-23 06:37:31 ——– d—–w- c:\users\admini~1\appdata\local\{BB6634D5-56EE-4E34-AD4E-57819243E4A2}
2011-08-22 18:19:26 ——– d—–w- c:\users\admini~1\appdata\local\{DD577ECC-C74C-4DA0-A50F-B7E775D7A098}
2011-08-22 18:18:44 ——– d—–w- c:\users\admini~1\appdata\local\{BE38B40B-7201-4981-84FA-A142ED643B8D}
2011-08-22 16:04:38 ——– d—–w- c:\users\admini~1\appdata\roaming\My Battle for Middle-earth™ II Files
2011-08-22 15:38:25 51472 —-a-w- c:\program files\microsoft games\age of empires online\rmdll\final\RandomMap.dll
2011-08-22 15:38:25 19216 —-a-w- c:\program files\microsoft games\age of empires online\rmdll\final\CLRBinder.dll
2011-08-22 15:38:25 13584 —-a-w- c:\program files\microsoft games\age of empires online\rmdll\final\RandomMapBinder.dll
2011-08-22 15:27:27 81998 —-a-w- c:\program files\microsoft games\age of empires online\RockallDLL.dll
2011-08-22 15:27:27 746496 —-a-w- c:\program files\microsoft games\age of empires online\granny2.dll
2011-08-22 15:27:25 139536 —-a-w- c:\program files\microsoft games\age of empires online\eulax.dll
2011-08-22 15:27:24 173408 —-a-w- c:\program files\microsoft games\age of empires online\pw32b.dll
2011-08-22 15:17:24 452440 —-a-w- c:\windows\system32\d3dx10_40.dll
2011-08-22 15:17:24 4379984 —-a-w- c:\windows\system32\D3DX9_40.dll
2011-08-22 15:17:24 2036576 —-a-w- c:\windows\system32\D3DCompiler_40.dll
2011-08-22 15:16:47 1892184 —-a-w- c:\windows\system32\D3DX9_42.dll
2011-08-22 15:16:46 81768 —-a-w- c:\windows\system32\xinput1_3.dll
2011-08-22 15:16:04 ——– d—–w- c:\windows\system32\xlive
2011-08-22 15:15:57 ——– d—–w- c:\program files\Microsoft Games for Windows - LIVE
2011-08-22 06:18:11 ——– d—–w- c:\users\admini~1\appdata\local\{7DEFB71C-E2A7-4D11-9123-F4527E95F954}
2011-08-22 06:17:10 ——– d—–w- c:\users\admini~1\appdata\local\{A4A3443F-5177-411C-A090-542205BB2EDC}
2011-08-20 20:19:26 ——– d—–w- c:\users\admini~1\appdata\local\{6E15B582-69C4-4947-A0BA-A887090C0BDB}
2011-08-20 20:19:22 ——– d—–w- c:\users\admini~1\appdata\local\{1A42ADFB-37CE-41B2-BB08-3178967AB59D}
2011-08-20 08:19:01 ——– d—–w- c:\users\admini~1\appdata\local\{EB9B4C8A-4926-4002-84CD-DE3CA9404A7F}
2011-08-20 08:18:22 ——– d—–w- c:\users\admini~1\appdata\local\{0E1D300C-B947-4A4A-98D9-67C884F9FDB6}
2011-08-19 07:13:23 ——– d—–w- c:\users\admini~1\appdata\local\{DBAF15B4-DC32-4547-B37E-44E1AC15478B}
2011-08-19 07:12:48 ——– d—–w- c:\users\admini~1\appdata\local\{84511C73-5352-4661-AB3C-ADBAD56F2326}
2011-08-18 18:43:40 ——– d—–w- c:\users\admini~1\appdata\local\{A0D4AE99-992C-49ED-867D-CA34DF2C280A}
2011-08-18 18:43:07 ——– d—–w- c:\users\admini~1\appdata\local\{F06E26C6-106D-429B-B548-CDA072FE2F8E}
2011-08-18 06:42:47 ——– d—–w- c:\users\admini~1\appdata\local\{9CED5CEF-31FA-4A9C-8D86-91C2EDDAE775}
2011-08-18 06:42:08 ——– d—–w- c:\users\admini~1\appdata\local\{8DE2A289-DC09-436B-8F8A-C1A65C6AF932}
2011-08-17 06:44:58 ——– d—–w- c:\users\admini~1\appdata\local\{59DC2B69-7799-40D5-8029-FC632E06F0DC}
2011-08-17 06:44:23 ——– d—–w- c:\users\admini~1\appdata\local\{A3F5645A-BE09-4EFD-81AC-A60EDA12BA79}
2011-08-16 07:37:38 ——– d—–w- c:\users\admini~1\appdata\local\{AAB23CB2-F8D0-4F11-92F7-0EF5183AD851}
2011-08-16 07:37:33 ——– d—–w- c:\users\admini~1\appdata\local\{A0F48B9A-9AD5-4490-9DF3-5EA7B54853F2}
2011-08-15 22:32:57 ——– d—–w- c:\users\admini~1\appdata\local\{4E355750-C353-4B59-9114-9C44AF6148C3}
2011-08-15 22:32:08 ——– d—–w- c:\users\admini~1\appdata\local\{483749DD-C772-4806-A489-EAE57405F568}
2011-08-15 08:37:58 ——– d—–w- c:\users\admini~1\appdata\local\{57B0045C-418F-4066-8952-8F5D63DC5B51}
2011-08-15 08:37:53 ——– d—–w- c:\users\admini~1\appdata\local\{7B66514C-8BDD-406B-82C4-21F6ACF39DBB}
2011-08-14 20:37:32 ——– d—–w- c:\users\admini~1\appdata\local\{749BE988-E587-44B2-A28E-75FDAB3311E9}
2011-08-14 20:36:51 ——– d—–w- c:\users\admini~1\appdata\local\{8A2A1527-00EC-4D17-9D3A-44F4617AA280}
2011-08-14 07:32:28 ——– d—–w- c:\users\admini~1\appdata\local\{05D69155-DD53-4CD4-B436-42F196C82807}
2011-08-14 07:32:24 ——– d—–w- c:\users\admini~1\appdata\local\{88DC7082-0688-496D-AA5B-777BCC3EA95C}
2011-08-13 12:03:52 ——– d—–w- c:\users\admini~1\appdata\local\{56887BED-7B7B-4AA1-B294-91B76B1819AF}
2011-08-13 12:03:17 ——– d—–w- c:\users\admini~1\appdata\local\{C0317D4A-883E-458F-8D82-FD18CC961BE4}
2011-08-12 22:02:56 ——– d—–w- c:\users\admini~1\appdata\local\{A1375CD1-EF92-44C0-BA70-2059C3DBA914}
2011-08-12 22:02:52 ——– d—–w- c:\users\admini~1\appdata\local\{8BC83B3B-2670-454A-929D-4FDCFB3F586A}
2011-08-12 10:02:47 ——– d—–w- c:\users\admini~1\appdata\local\{D8BDD23A-CAA5-4CF9-8D6B-7AD1E563954F}
2011-08-12 10:02:20 ——– d—–w- c:\users\admini~1\appdata\local\{F0259A1C-815D-4AB0-8EEE-F0DEEA6658C5}
2011-08-11 22:01:59 ——– d—–w- c:\users\admini~1\appdata\local\{957782BA-ECE3-4D21-B17E-D9EDC89B919D}
2011-08-11 22:01:29 ——– d—–w- c:\users\admini~1\appdata\local\{32CE3A8D-2DFE-43E7-BD8C-29CF96E7747F}
2011-08-11 10:01:08 ——– d—–w- c:\users\admini~1\appdata\local\{0EB86DE2-B469-43ED-BC2E-B476BBB2CDCE}
2011-08-11 10:01:03 ——– d—–w- c:\users\admini~1\appdata\local\{FB693ED0-23F5-4DC7-A507-7AC56E93E3D2}
2011-08-10 21:25:41 ——– d—–w- c:\users\admini~1\appdata\local\{0590E4B2-19F2-4B58-873A-4935DF7D63F0}
2011-08-10 21:25:37 ——– d—–w- c:\users\admini~1\appdata\local\{A8DF8092-0A37-44BC-9CA8-4449AC7F86A8}
2011-08-10 09:40:36 375808 —-a-w- c:\windows\system32\winsrv.dll
2011-08-10 09:40:32 214016 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-08-10 09:40:27 2409784 —-a-w- c:\program files\windows mail\OESpamFilter.dat
2011-08-10 09:40:16 3602832 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-08-10 09:40:15 3550096 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-08-10 09:40:13 913296 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-08-10 09:40:13 31232 —-a-w- c:\windows\system32\drivers\tcpipreg.sys
2011-08-10 09:25:11 ——– d—–w- c:\users\admini~1\appdata\local\{7140477B-98A2-4709-A986-ECB14C8118C1}
2011-08-10 09:24:38 ——– d—–w- c:\users\admini~1\appdata\local\{AD4955EC-93FF-4BEA-B2FF-83666209B8BC}
2011-08-09 12:36:54 ——– d—–w- c:\users\admini~1\appdata\local\{50C4B87E-7029-4166-81F0-9D976AD13DEF}
2011-08-09 12:36:49 ——– d—–w- c:\users\admini~1\appdata\local\{9175BBA0-56D8-4457-846E-DAE0B4F3F3AA}
2011-08-09 09:58:08 ——– d—–w- c:\windows\en
2011-08-09 09:52:06 15712 —-a-w- c:\program files\common files\windows live\.cache\ffb8746e1cc567902\MeshBetaRemover.exe
2011-08-09 09:47:53 ——– d—–w- c:\users\admini~1\appdata\local\{679300A6-05CD-4235-8EE9-BBD294623509}
2011-08-09 09:47:49 ——– d—–w- c:\users\admini~1\appdata\local\{FE511940-9798-4DDA-BA03-225AE65164E9}
2011-08-09 08:35:24 ——– d—–w- c:\users\admini~1\appdata\local\{FC528296-6101-4834-8491-A97A2DC8486A}
2011-08-09 08:35:20 ——– d—–w- c:\users\admini~1\appdata\local\{60656F51-2216-4EC5-B0CF-37C8072D5C1B}
2011-08-08 20:04:26 ——– d—–w- c:\users\admini~1\appdata\local\{C0474FA6-56C9-468D-ABFF-203403E25036}
2011-08-08 20:04:18 ——– d—–w- c:\users\admini~1\appdata\local\{C49FC844-48E5-4480-A351-B424486F7EEE}
2011-08-08 08:54:35 ——– d—–w- c:\users\admini~1\appdata\local\{4F070646-E214-491A-9ED3-E0D48F37757E}
2011-08-08 08:54:21 ——– d—–w- c:\users\admini~1\appdata\local\{CAAEC758-835D-4DD4-8E89-B0A5F455971A}
2011-08-07 12:05:05 ——– d—–w- c:\users\admini~1\appdata\local\{6719D84D-6785-4AD6-9592-0635D1773D5A}
2011-08-07 12:05:01 ——– d—–w- c:\users\admini~1\appdata\local\{B36E0131-0F2B-405C-A7E9-AC9E4D6176C0}
2011-08-07 10:00:56 ——– d—–w- c:\users\admini~1\appdata\local\{8B547D1F-DA5E-4387-BFEE-D6EA3D0B795D}
2011-08-07 10:00:48 ——– d—–w- c:\users\admini~1\appdata\local\{113302E7-D0F0-4C3C-BBD0-12D55359211E}
2011-08-07 08:21:40 ——– d—–w- c:\users\admini~1\appdata\local\{1F5A40A8-2B4A-4802-B3CC-1A856A99A522}
2011-08-07 08:21:13 ——– d—–w- c:\users\admini~1\appdata\local\{1CA762B6-97DA-46A5-B715-1A5331B127E1}
2011-08-07 01:37:19 ——– d—–w- c:\users\admini~1\appdata\local\{B050B989-58D3-425F-8271-08805AF03E7E}
2011-08-07 01:37:15 ——– d—–w- c:\users\admini~1\appdata\local\{48C4EF7B-766F-4574-AE94-6F7D842E5061}
2011-08-06 12:20:24 ——– d—–w- c:\users\admini~1\appdata\local\{6C482C72-9737-491A-9ECD-72EA4E6C5742}
2011-08-06 12:19:44 ——– d—–w- c:\users\admini~1\appdata\local\{B47590D5-D425-483D-9444-740A34D111F7}
2011-08-06 11:48:21 ——– d—–w- c:\users\admini~1\appdata\local\{4E958182-98BC-4A8F-9A9D-992AA1B9BBEE}
2011-08-06 11:48:17 ——– d—–w- c:\users\admini~1\appdata\local\{DB5DF2BF-4DE7-4B24-A7A8-BF70C581E504}
2011-08-06 07:25:53 ——– d—–w- c:\users\admini~1\appdata\local\{CB79C22F-EA07-4897-A7C8-26D8CF79D461}
2011-08-06 07:25:31 ——– d—–w- c:\users\admini~1\appdata\local\{3814F61F-9F37-41F0-8F62-25B8F3DBB2F8}
2011-08-05 16:57:56 ——– d—–w- c:\users\admini~1\appdata\local\{310772BC-A328-44BC-808C-E83BC252D84B}
2011-08-05 16:57:44 ——– d—–w- c:\users\admini~1\appdata\local\{8D004E80-3C16-4C90-84BD-7C759C42FA13}
2011-08-05 10:19:27 ——– d—–w- c:\users\admini~1\appdata\local\{21A05121-1C17-4415-88B9-E1A7AB5217E8}
2011-08-05 10:19:23 ——– d—–w- c:\users\admini~1\appdata\local\{F99A76BB-AAD1-48D2-8324-2D75A941ADE0}
2011-08-05 08:38:24 ——– d—–w- c:\users\admini~1\appdata\local\{DAFDEA46-2964-42B8-A582-3A7DF3FD00AA}
2011-08-05 08:37:55 ——– d—–w- c:\users\admini~1\appdata\local\{0898778D-4D58-4656-998F-81F669ACAEAA}
2011-08-05 07:23:05 ——– d—–w- c:\users\admini~1\appdata\local\{BBC8F1B3-CB51-4E2F-B36D-52876BD3C11A}
2011-08-05 07:22:02 ——– d—–w- c:\users\admini~1\appdata\local\{BAFD9873-4212-4111-A721-658964F91D82}
2011-08-04 19:59:01 ——– d—–w- c:\users\admini~1\appdata\local\{DDC77CFB-2257-41B2-ABB7-EDB68CA2EEE1}
2011-08-04 19:58:57 ——– d—–w- c:\users\admini~1\appdata\local\{4DF59B06-2AFD-406D-AA3D-AC1A54C442EE}
2011-08-04 15:22:01 ——– d—–w- c:\users\admini~1\appdata\local\{E0145318-E3BA-451F-BFBF-92129CC7610D}
2011-08-04 15:21:53 ——– d—–w- c:\users\admini~1\appdata\local\{E272FB67-4A50-4C64-BBF2-9F9231933952}
2011-08-04 06:34:58 ——– d—–w- c:\users\admini~1\appdata\local\{4164523A-71A7-45FE-B604-ADC7B11F1D97}
2011-08-04 06:34:17 ——– d—–w- c:\users\admini~1\appdata\local\{BBD597DC-9ECB-42BD-9FD7-0BCB6C19C967}
2011-08-03 20:55:48 ——– d—–w- c:\users\admini~1\appdata\local\{E208CDA0-A5F1-45F3-80CB-FF2465B18ED4}
2011-08-03 20:55:38 ——– d—–w- c:\users\admini~1\appdata\local\{9E2DDBCC-D7EB-4122-B475-54701859B6DE}
2011-08-03 12:10:21 ——– d—–w- c:\users\admini~1\appdata\local\{74112BA2-2B4F-4952-BC9A-0C850C648F23}
2011-08-03 12:10:18 ——– d—–w- c:\users\admini~1\appdata\local\{0DBEE2C4-5BD7-430A-9F4F-7E9C588518B0}
2011-08-03 07:15:20 ——– d—–w- c:\users\admini~1\appdata\local\{F81B03C1-7D25-4C61-B6B8-2EED84A68D01}
2011-08-03 07:15:11 ——– d—–w- c:\users\admini~1\appdata\local\{DF565CF5-4B87-4CD0-B4D7-FD7BB3BA0EFB}
2011-08-02 21:13:15 ——– d—–w- c:\users\admini~1\appdata\local\{0FBEF69E-B0DA-4329-9ED5-60D2553D492E}
2011-08-02 21:13:11 ——– d—–w- c:\users\admini~1\appdata\local\{EA3A99E7-2890-45F7-86B6-A276DD7B23E7}
2011-08-02 09:21:54 ——– d—–w- c:\users\admini~1\appdata\local\{B8C447FF-94D8-40E1-A4ED-95F09F08196B}
2011-08-02 09:21:50 ——– d—–w- c:\users\admini~1\appdata\local\{510C7CE9-895B-4441-A30D-70395836DCDE}
2011-08-02 07:33:49 ——– d—–w- c:\users\admini~1\appdata\local\{DFF5BC7D-7DB3-4C93-8BC2-3357655A383B}
2011-08-02 07:33:06 ——– d—–w- c:\users\admini~1\appdata\local\{A82C4724-318F-4079-9296-187CF45AB506}
2011-08-01 12:11:51 ——– d—–w- c:\users\admini~1\appdata\local\{2B99A4D4-8738-4399-9DD2-CD6947C8AC29}
2011-08-01 12:11:39 ——– d—–w- c:\users\admini~1\appdata\local\{647A8669-8AEA-4781-9711-0E16A2D612FF}
2011-08-01 09:13:18 ——– d—–w- c:\users\admini~1\appdata\local\{F041A92B-311D-45DD-B7E1-4614F29CB707}
2011-08-01 09:12:46 ——– d—–w- c:\users\admini~1\appdata\local\{72F11E4F-EEAA-4CCD-AD78-7F85D47BB1FF}
2011-08-01 02:06:25 ——– d—–w- c:\users\admini~1\appdata\local\{2A38FD2B-2005-494C-97E2-386136E64A76}
2011-08-01 02:06:21 ——– d—–w- c:\users\admini~1\appdata\local\{970BB22B-D22B-40C5-8750-13C7C0CD0A18}
2011-07-31 19:32:23 ——– d—–w- c:\users\admini~1\appdata\local\{04CAF188-60FA-48DD-B1E6-C94D935FFBA2}
2011-07-31 19:31:51 ——– d—–w- c:\users\admini~1\appdata\local\{7F7710C0-53CF-4648-A950-2C75535AC52A}
2011-07-31 16:51:17 ——– d—–w- c:\users\admini~1\appdata\local\{0F16A178-D7F3-4515-AA6D-35B9624683C6}
2011-07-31 16:51:14 ——– d—–w- c:\users\admini~1\appdata\local\{8F587036-9218-4220-ABE4-83BB7E940092}
2011-07-31 12:14:58 ——– d—–w- c:\users\admini~1\appdata\local\{13010380-992C-42E8-BBC7-A8DC20F9F884}
2011-07-31 12:14:53 ——– d—–w- c:\users\admini~1\appdata\local\{29311FAF-2460-498F-8AB9-FF6F16A4085E}
2011-07-31 06:30:42 ——– d—–w- c:\users\admini~1\appdata\local\{A09BDBF0-241B-4FAB-832C-56CDD1969E3E}
2011-07-31 06:30:16 ——– d—–w- c:\users\admini~1\appdata\local\{86B203D3-BFFB-44FC-9BF2-38E41292681B}
2011-07-30 12:50:54 ——– d—–w- c:\users\admini~1\appdata\local\{B928AB7F-D8D7-483D-8A7B-438579F2789A}
2011-07-30 12:50:38 ——– d—–w- c:\users\admini~1\appdata\local\{0511225A-AF81-4644-8874-26E7642797C0}
2011-07-30 11:59:24 ——– d—–w- c:\users\admini~1\appdata\local\{48F49B49-A80D-4565-A5E2-D95373F6727B}
2011-07-30 11:59:16 ——– d—–w- c:\users\admini~1\appdata\local\{772F8713-8E21-40F5-B60E-0E890D2E7ACC}
2011-07-30 07:40:18 ——– d—–w- c:\users\admini~1\appdata\local\{D124507E-25B6-4C61-97EF-E4D74EB3500A}
2011-07-30 07:40:13 ——– d—–w- c:\users\admini~1\appdata\local\{9128B1B3-6456-431C-961B-D7920C2BCDDC}
2011-07-29 20:01:42 ——– d—–w- c:\users\admini~1\appdata\local\{F8A698BF-610F-4284-B8E3-25D77BAFE022}
2011-07-29 20:01:38 ——– d—–w- c:\users\admini~1\appdata\local\{1AFEB63B-42A2-4BEC-ACBD-FE1B7760DBF6}
2011-07-29 19:45:04 ——– d—–w- c:\users\admini~1\appdata\local\{16AE4DA0-1DAC-4E51-87AB-898B927DDE12}
2011-07-29 19:45:00 ——– d—–w- c:\users\admini~1\appdata\local\{4BF8AA40-1DC4-43F6-B6AE-BB754F2CB0A5}
2011-07-29 12:41:01 ——– d—–w- c:\users\admini~1\appdata\local\{5D186CC2-7EEA-4F68-8D1E-6B91C03606E8}
2011-07-29 12:40:48 ——– d—–w- c:\users\admini~1\appdata\local\{A992BF6F-8EA1-47BA-96B9-6FBDE0117ED7}
2011-07-29 10:31:56 ——– d—–w- c:\users\admini~1\appdata\local\{B6108513-FEF8-4193-AA7E-8868D9252507}
2011-07-29 10:31:48 ——– d—–w- c:\users\admini~1\appdata\local\{4F9B5D14-EF0F-4448-95CE-6A0C470E5CB4}
2011-07-29 08:01:00 ——– d—–w- c:\users\admini~1\appdata\local\{5CCB46A9-5A1C-4561-9402-DFD6CBC7AA33}
2011-07-29 07:59:48 ——– d—–w- c:\users\admini~1\appdata\local\{E220DFF0-2B1F-40C4-812D-466D02368F64}
2011-07-28 21:09:50 ——– d—–w- c:\users\admini~1\appdata\local\{D9CF0777-D45E-4725-83E0-1B25780F7905}
2011-07-28 21:09:46 ——– d—–w- c:\users\admini~1\appdata\local\{996583AB-2147-40E0-80A4-3CF9B2D9C808}
2011-07-28 09:22:34 ——– d—–w- c:\users\admini~1\appdata\local\{BDD4FB72-F9A7-4FD7-A6C5-C93154A74076}
2011-07-27 21:22:02 ——– d—–w- c:\users\admini~1\appdata\local\{B0922736-8342-4B2F-AA70-C628F9B742F3}
2011-07-27 17:53:38 2982672 —-a-w- c:\program files\microsoft games\age of empires online\AOEOnline.exe
2011-07-27 17:53:38 152848 —-a-w- c:\program files\microsoft games\age of empires online\AOEOnlineReplace.exe
2011-07-27 17:53:38 10964240 —-a-w- c:\program files\microsoft games\age of empires online\Spartan.exe
2011-07-27 09:03:49 ——– d—–w- c:\users\admini~1\appdata\local\{4660EFE3-D05E-4426-9D31-9804DFA57383}
2011-07-26 21:03:11 ——– d—–w- c:\users\admini~1\appdata\local\{96C3B079-A6DE-4061-9CC2-08F21E7BC37B}
2011-07-26 09:02:31 ——– d—–w- c:\users\admini~1\appdata\local\{B4E065CF-949F-4940-8CDD-362FAF16E2C5}
2011-07-25 13:39:03 2043392 —-a-w- c:\windows\system32\win32k.sys
2011-07-25 13:33:52 49152 —-a-w- c:\windows\system32\csrsrv.dll
2011-07-25 13:13:32 ——– d—–w- c:\users\admini~1\appdata\local\{5B494605-B770-4544-9113-1D56659AE6A1}
.
==================== Find3M ====================
.
2011-08-16 07:38:03 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-22 02:54:43 1797632 —-a-w- c:\windows\system32\jscript9.dll
2011-07-22 02:48:26 1126912 —-a-w- c:\windows\system32\wininet.dll
2011-07-22 02:44:36 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2011-07-04 11:43:53 40112 —-a-w- c:\windows\avastSS.scr
.
============= FINISH: 10:05:23.57 ===============
Here's ESET report……………….
C:\Users\Administrator\Documents\Documents\Downloads\unconfirmed 56347.download Win32/RegistryBooster application