What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Can't get into anything

55 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hello Nick23

Good job with TDSSK :)

Backdoor.Win32.Sinowal.knf(\Device\Harddisk0\DR0) - User select action: Cure


  • Important!!!


    • It is very likely that the malware we are dealing with has password stealing capabilities. For this reason you are Strongly Advised to disconnect the infected computer from the internet and from any networked computers until it can be cleaned. If you have networked compters, these must be checked, as they may also be infected.
    • If you use your computer for online banking, call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft. It may also be prudent to ask your banks to freeze/disable online access to your accounts until you are certain that your computer is free of the infecting malware.


    • It is Essential that you use a Clean (uninfected) computer to change ALL of your passwords for the online services (banking etc) that you use. Do not use the infected computer to change your passwords or to perform any financial transactions, as doing so will give the attacker access to the new password that you create.


    Lets continue with the following (If Combofix asks you to connect to the Internet to install the Recovery Console please allow it to do so):

  • Combofix


    • Download ComboFix from one of the following locations:

      Link 1
      Link 2

    • VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

    • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here .
    • Double click on ComboFix.exe & follow the prompts.

    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    • Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

    [external image: Posted Image]

    • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    [external image: Posted Image]

    • Click on Yes, to continue scanning for malware.
    • When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
    • Notes: Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    • Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
    • Should there be issues with internet afterward:

      In IE: Tools Menu -> Internet Options -> Connections Tab -> Lan Settings -> uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

      In Firefox: Tools Menu -> Options… -> Advanced Tab -> Network Tab -> "Settings" under Connection and uncheck the proxyserver, set it to No Proxy.

    Please post the ComboFix log in your next reply.
Post #17
Sorry it took so long to get back to you I've been real busy the past couple days but i ran the combo fix and will post it in this reply i was also able to get into my add/remove programs and delete most of the stuff you said to delete but i t still wont let me remove whitesmoke every time i try it cant find the program and a browse window comes up, i tried looking for it but could not find it either but anyways here is the log from the combo fix scan thanks again for helping me everything seems to be getting back to normal so far. I also had a question for you i only use firefox but i also have internet explorer can i delete internet explorer or should i just leave it alone?

ComboFix 11-09-08.03 - Nick 09/08/2011 23:01:22.1.1 - x86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\Toolbar4
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\basis.xml
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\bg.bmp
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\bing_logo.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\celebrity.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\drop_images.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\drop_maps.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\drop_news.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\drop_videos.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\drop_web.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\facebook.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\favicon.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\games.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\hotmail.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\icon.ico
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\images.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\include.xml
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\info.txt
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\lifestyle.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\maps.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\messenger.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\msn.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\news.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\SearchToolbarUninstall.exe
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\twitter.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\uninstall.exe
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\update.exe
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\version.txt
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\video.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\videos.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\weather.png
c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\web.png
c:\documents and settings\Nick\Application Data\Local
c:\program files\Search Toolbar
c:\program files\Search Toolbar\icon.ico
c:\program files\Search Toolbar\SearchToolbarUninstall.exe
c:\program files\Search Toolbar\SearchToolbarUpdater.exe
c:\program files\Search Toolbar\tbcore3.dll
c:\windows\system32\_000005_.tmp.dll
.
c:\windows\system32\midimap.dll . . . is infected!!
.
.
((((((((((((((((((((((((( Files Created from 2011-08-09 to 2011-09-09 )))))))))))))))))))))))))))))))
.
.
2011-09-07 18:56 . 2011-09-07 18:56 ——– d—–w- c:\program files\Crawler
2011-09-06 08:04 . 2011-09-06 08:04 ——– d—–w- C:\found.000
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-06 23:52 . 2010-12-03 22:02 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 23:52 . 2010-12-03 22:02 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-08-03 07:19 . 2011-04-01 06:05 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
——- Sigcheck ——-
Note: Unsigned files aren't necessarily malware.
.
[-] 2011-04-27 . 163096F2D0D3FAB77CB577BCFBEE59CE . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2011-04-27 . 163096F2D0D3FAB77CB577BCFBEE59CE . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\tcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
.
[-] 2008-04-28 09:18 . CB75214525D36F923D3948DA3CD1562D . 1390080 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll
.
[-] 2008-04-28 . A55B8899D2EA2E800061BCFD456E34DC . 547328 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
.
[7] 2008-04-13 . D7075E95AA599EE77B7A89D39296BD3D . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll
[-] 2008-03-20 . 1CA39C7E1423FF8821664E0E06FEA55E . 343040 . . [7.0.2600.5508] . . c:\windows\system32\msvcrt.dll
[7] 2004-08-04 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll
.
[-] 2008-03-20 . F92D8964B5286DE225BD2B6BF89764BE . 578560 . . [5.1.2600.5508] . . c:\windows\system32\user32.dll
.
[-] 2008-08-18 . 4A90F51B778FA0157F60D206E8B37D2A . 1616384 . . [6.00.2900.5512] . . c:\windows\explorer.exe
.
[-] 2008-04-13 . 18B0915F58A5342AB0F3D01D57261E32 . 267264 . . [5.1.2600.5512] . . c:\windows\regedit.exe
.
[-] 2008-04-26 . BC298B78B311397B421D4D52B44B49EC . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
[-] 2008-04-28 . B5E8782D4AF1B3756F38E11E7C157BBE . 25088 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
.
[-] 2008-04-28 . A913E1FF4C0BDA15FC542430182EB7B6 . 368640 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll
.
[-] 2008-04-28 . 66620EE56B0FFB1B267BD24ECF942A9B . 42496 . . [5.1.2600.5512] . . c:\windows\system32\midimap.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-05-30 2495816]
.
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2011-05-30 15:33 2495816 —-a-w- c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-05-30 2495816]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-05-30 2495816]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AnalogClock"="c:\program files\Windows7\Analog Clock\AnalogClock.exe" [2005-11-05 480256]
"TransBar"="c:\program files\Windows7\TransBar\TransBar.exe" [2005-06-01 65536]
"SpeedBitVideoAccelerator"="c:\program files\SpeedBit Video Accelerator\VideoAccelerator.exe" [2009-09-30 1435240]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-20 39408]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"OnlineVault"="c:\documents and settings\Nick\My Documents\Online Vault\OnlineVault.exe" [2010-05-28 2459136]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KRun"="c:\program files\Windows7\RunMe\RunMe.exe" [2007-04-06 518656]
"Viena Explorer"="c:\program files\Windows7\Vienna Explorer\Vienna Explorer.exe" [2006-11-18 581632]
"Visual Task Tips"="c:\program files\Windows7\VisualTaskTips\VisualTaskTips.exe" [2007-09-05 36352]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 88363]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-11-03 98304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-11-03 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-11-03 118784]
"RTHDCPL"="RTHDCPL.EXE" [2009-12-04 18789408]
"lxctmon.exe"="c:\program files\Lexmark 5400 Series\lxctmon.exe" [2007-03-19 291760]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2011-04-18 2334560]
"LXCTCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll" [2006-11-21 106496]
"Conime"="c:\windows\system32\conime.exe" [2008-04-28 52224]
"EKAIO2StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKAiO2MUI.exe" [2011-05-27 2729472]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2010-03-11 124928]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Launch Whitesmoke Translator.lnk - c:\documents and settings\Nick\My Documents\Programs\WSTrayDictMode.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgmfapx.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\AiOHomeCenter.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\Kodak.Statistics.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\NetworkPrinterDiscovery.exe"=
"c:\\Program Files\\Kodak\\AiO\\Firmware\\KodakAiOUpdater.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kodak\\Installer\\Setup.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgnsx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"6492:TCP"= 6492:TCP:Services
"6493:TCP"= 6493:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"9586:TCP"= 9586:TCP:Services
"9587:TCP"= 9587:TCP:Services
"7164:TCP"= 7164:TCP:Services
"7165:TCP"= 7165:TCP:Services
"1680:TCP"= 1680:TCP:Services
"1860:TCP"= 1860:TCP:Services
"8567:TCP"= 8567:TCP:*:Disabled:BitComet 8567 TCP
"8567:UDP"= 8567:UDP:*:Disabled:BitComet 8567 UDP
"6554:TCP"= 6554:TCP:Services
"6555:TCP"= 6555:TCP:Services
"4430:TCP"= 4430:TCP:Services
"7360:TCP"= 7360:TCP:Services
"9679:TCP"= 9679:TCP:Services
"9680:TCP"= 9680:TCP:Services
"7820:TCP"= 7820:TCP:Services
"7821:TCP"= 7821:TCP:Services
"3430:TCP"= 3430:TCP:Services
"5360:TCP"= 5360:TCP:Services
"3727:TCP"= 3727:TCP:Services
"5954:TCP"= 5954:TCP:Services
"9414:TCP"= 9414:TCP:Services
"9415:TCP"= 9415:TCP:Services
"7414:TCP"= 7414:TCP:Services
"7415:TCP"= 7415:TCP:Services
"6289:TCP"= 6289:TCP:Services
"6290:TCP"= 6290:TCP:Services
"5023:TCP"= 5023:TCP:Services
"8546:TCP"= 8546:TCP:Services
"9195:TCP"= 9195:TCP:Services
"9196:TCP"= 9196:TCP:Services
"8148:TCP"= 8148:TCP:Services
"8149:TCP"= 8149:TCP:Services
"8429:TCP"= 8429:TCP:Services
"8430:TCP"= 8430:TCP:Services
"8408:TCP"= 8408:TCP:Services
"8409:TCP"= 8409:TCP:Services
"6804:TCP"= 6804:TCP:Services
"6805:TCP"= 6805:TCP:Services
"8523:TCP"= 8523:TCP:Services
"8524:TCP"= 8524:TCP:Services
"7867:TCP"= 7867:TCP:Services
"7868:TCP"= 7868:TCP:Services
"2009:TCP"= 2009:TCP:Services
"2518:TCP"= 2518:TCP:Services
"6711:TCP"= 6711:TCP:Services
"6712:TCP"= 6712:TCP:Services
"9976:TCP"= 9976:TCP:Services
"9977:TCP"= 9977:TCP:Services
"8492:TCP"= 8492:TCP:Services
"8493:TCP"= 8493:TCP:Services
"1775:TCP"= 1775:TCP:Services
"2050:TCP"= 2050:TCP:Services
"8242:TCP"= 8242:TCP:Services
"8243:TCP"= 8243:TCP:Services
"6883:TCP"= 6883:TCP:Services
"6884:TCP"= 6884:TCP:Services
"5055:TCP"= 5055:TCP:Services
"8610:TCP"= 8610:TCP:Services
"4368:TCP"= 4368:TCP:Services
"7236:TCP"= 7236:TCP:Services
"8885:TCP"= 8885:TCP:Services
"8886:TCP"= 8886:TCP:Services
"9338:TCP"= 9338:TCP:Services
"9337:TCP"= 9337:TCP:Services
"7587:TCP"= 7587:TCP:Services
"7588:TCP"= 7588:TCP:Services
"2018:TCP"= 2018:TCP:Services
"1759:TCP"= 1759:TCP:Services
"7274:TCP"= 7274:TCP:Services
"7275:TCP"= 7275:TCP:Services
"9633:TCP"= 9633:TCP:Services
"9632:TCP"= 9632:TCP:Services
"8897:TCP"= 8897:TCP:*:Disabled:BitComet 8897 TCP
"8897:UDP"= 8897:UDP:*:Disabled:BitComet 8897 UDP
"8977:TCP"= 8977:TCP:Services
"8978:TCP"= 8978:TCP:Services
"9664:TCP"= 9664:TCP:Services
"9665:TCP"= 9665:TCP:Services
"3320:TCP"= 3320:TCP:Services
"5140:TCP"= 5140:TCP:Services
"3602:TCP"= 3602:TCP:Services
"5704:TCP"= 5704:TCP:Services
"9945:TCP"= 9945:TCP:Services
"9946:TCP"= 9946:TCP:Services
"4760:TCP"= 4760:TCP:Services
"8020:TCP"= 8020:TCP:Services
"6838:TCP"= 6838:TCP:Services
"6837:TCP"= 6837:TCP:Services
"3290:TCP"= 3290:TCP:Services
"5080:TCP"= 5080:TCP:Services
"1647:TCP"= 1647:TCP:Services
"1794:TCP"= 1794:TCP:Services
"2725:TCP"= 2725:TCP:Services
"3950:TCP"= 3950:TCP:Services
"1617:TCP"= 1617:TCP:Services
"1820:TCP"= 1820:TCP:Services
"2226:TCP"= 2226:TCP:Services
"6515:TCP"= 6515:TCP:Services
"7742:TCP"= 7742:TCP:Services
"9866:TCP"= 9866:TCP:Services
"3133:TCP"= 3133:TCP:Services
"4766:TCP"= 4766:TCP:Services
"2273:TCP"= 2273:TCP:Services
"1523:TCP"= 1523:TCP:Services
"12029:TCP"= 12029:TCP:*:Disabled:BitComet 12029 TCP
"12029:UDP"= 12029:UDP:*:Disabled:BitComet 12029 UDP
"9322:TCP"= 9322:TCP:EKDiscovery
"5353:UDP"= 5353:UDP:*:Disabled:Bonjour Port 5353
"5353:TCP"= 5353:TCP:printer
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2/22/2011 8:13 AM 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [3/16/2011 4:03 PM 32592]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/26/2009 1:55 PM 691696]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [1/7/2011 6:41 AM 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [4/5/2011 12:59 AM 297168]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [4/18/2011 5:39 PM 7398752]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [2/8/2011 5:33 AM 269520]
R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\EKAiOHostService.exe [4/11/2011 4:59 PM 375296]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [4/14/2011 9:28 PM 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2/10/2011 7:53 AM 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2/10/2011 7:53 AM 27216]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [5/17/2011 12:31 AM 1025352]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [12/3/2010 6:02 PM 41272]
S3 xcpip;TCP/IP Protocol Driver;c:\windows\system32\drivers\xcpip.sys –> c:\windows\system32\drivers\xcpip.sys [?]
S3 xpsec;IPSEC driver;c:\windows\system32\drivers\xpsec.sys –> c:\windows\system32\drivers\xpsec.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://google.atcomet.com/b/
uInternet Settings,ProxyOverride =
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
TCP: DhcpNameServer = 192.168.1.1 [removed]
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll
FF - ProfilePath - c:\documents and settings\Nick\Application Data\Mozilla\Firefox\Profiles\4zniteye.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4e02abbf&v;=7.005.030.004&i;=23&tp;=ab&iy;=&ychte;=us&lng;=en-US&q;=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 5555
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{7c5c0f58-e061-457d-9033-77307f5ed00c} - (no file)
Toolbar-{7c5c0f58-e061-457d-9033-77307f5ed00c} - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
Toolbar-Locked - (no file)
Toolbar-{0C8413C1-FAD1-446C-8584-BE50576F863E} - (no file)
WebBrowser-{7C5C0F58-E061-457D-9033-77307F5ED00C} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{0C8413C1-FAD1-446C-8584-BE50576F863E} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-08 23:41
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCTCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-343818398-796845957-1177238915-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(648)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\COMRes.dll
c:\windows\system32\cscui.dll
.
- - - - - - - > 'lsass.exe'(716)
c:\windows\system32\setupapi.dll
.
Completion time: 2011-09-08 23:47:54
ComboFix-quarantined-files.txt 2011-09-09 03:47
.
Pre-Run: 134,272,843,776 bytes free
Post-Run: 134,505,099,264 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - EEA8B29444FD981639BDF4A2DA0FF721
Post #18
Hello Nick23

Thank you for the logs, and no problem about the delay :)

Leave Internet Explorer where it is, and we will deal with Whitesmoke in due course - right now we have bigger fish to fry (there are several things that need our attention).

Lets proceed as follows:

We need to run ComboFix again, but this time will be running it in a slightly different way.

  • Please work through the following steps


    • Open Notepad (Click on "Start", then on "Run" and type "notepad" (without quotations) in the Open field, then click on "OK").
    • NOTE: Do not Use Wordpad or any other text editor except Notepad or the script will fail.
    • Copy and Paste the text in the quotebox below into the open Notepad window:

      DDS::
      uInternet Settings,ProxyOverride =

      Firefox::
      FF - ProfilePath - c:\documents and settings\Nick\Application Data\Mozilla\Firefox\Profiles\4zniteye.default\
      FF - prefs.js: network.proxy.http_port - 5555

    • Save this as "CFScript.txt" (including the quotation marks), change the "Save as type" to "All Files" and save it to your desktop.
    • Close any open browsers.
    • Disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Refering to the picture below, drag CFScript.txt into ComboFix.exe

      [external image: Posted Image]
    • When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
    • Once the log is produced, re-engage your resident anti virus.

  • HAMeb_check



    Please post the ComboFix log and the HAMeb_check log in your next reply :)
Post #19
Here are the combofix and HAMeb logs that you asked for while running the combofix scan some kind of error message came up i forget what it said something lie the scan was going to take longer because it had to run again or do some different kind of combofix scan. Again i am not sure if that is correct but it was something like that here are the logs combofix first then hameb thanks again for helping me out.

ComboFix 11-09-08.03 - Nick 09/12/2011 23:57:21.2.1 - x86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Nick\Desktop\CFScript.txt
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\midimap.dll . . . is infected!!
.
.
((((((((((((((((((((((((( Files Created from 2011-08-13 to 2011-09-13 )))))))))))))))))))))))))))))))
.
.
2011-09-09 05:54 . 2011-09-12 20:31 ——– d—–w- c:\program files\WinClamAVShield
2011-09-09 05:49 . 2011-09-09 05:49 142592 —-a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-09-09 05:49 . 2011-09-13 03:44 ——– d—–w- c:\documents and settings\Nick\Application Data\Spyware Terminator
2011-09-09 05:48 . 2011-09-12 20:31 ——– d—–w- c:\documents and settings\All Users\Application Data\Spyware Terminator
2011-09-09 05:48 . 2011-09-09 05:57 ——– d—–w- c:\program files\Spyware Terminator
2011-09-06 08:04 . 2011-09-06 08:04 ——– d—–w- C:\found.000
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-03 10:17 . 2008-04-13 22:41 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-07-15 13:29 . 2008-04-13 17:47 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-04-13 17:27 10496 —-a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-06 23:52 . 2010-12-03 22:02 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 23:52 . 2010-12-03 22:02 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-06-24 14:10 . 2009-08-11 14:38 139656 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-20 17:44 . 2008-04-28 09:22 293376 —-a-w- c:\windows\system32\winsrv.dll
2011-08-03 07:19 . 2011-04-01 06:05 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
——- Sigcheck ——-
Note: Unsigned files aren't necessarily malware.
.
[-] 2011-04-27 . 163096F2D0D3FAB77CB577BCFBEE59CE . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2011-04-27 . 163096F2D0D3FAB77CB577BCFBEE59CE . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\tcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
.
[-] 2008-04-28 09:18 . CB75214525D36F923D3948DA3CD1562D . 1390080 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll
.
[-] 2008-04-28 . A55B8899D2EA2E800061BCFD456E34DC . 547328 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
.
[7] 2008-04-13 . D7075E95AA599EE77B7A89D39296BD3D . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll
[-] 2008-03-20 . 1CA39C7E1423FF8821664E0E06FEA55E . 343040 . . [7.0.2600.5508] . . c:\windows\system32\msvcrt.dll
[7] 2004-08-04 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll
.
[-] 2008-03-20 . F92D8964B5286DE225BD2B6BF89764BE . 578560 . . [5.1.2600.5508] . . c:\windows\system32\user32.dll
.
[-] 2008-08-18 . 4A90F51B778FA0157F60D206E8B37D2A . 1616384 . . [6.00.2900.5512] . . c:\windows\explorer.exe
.
[-] 2008-04-13 . 18B0915F58A5342AB0F3D01D57261E32 . 267264 . . [5.1.2600.5512] . . c:\windows\regedit.exe
.
[-] 2008-04-26 . BC298B78B311397B421D4D52B44B49EC . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
[-] 2008-04-28 . B5E8782D4AF1B3756F38E11E7C157BBE . 25088 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
.
[-] 2008-04-28 . A913E1FF4C0BDA15FC542430182EB7B6 . 368640 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll
.
[-] 2008-04-28 . 66620EE56B0FFB1B267BD24ECF942A9B . 42496 . . [5.1.2600.5512] . . c:\windows\system32\midimap.dll
.
((((((((((((((((((((((((((((( SnapShot@2011-09-09_03.41.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-09-13 01:51 . 2011-09-13 01:51 16384 c:\windows\Temp\Perflib_Perfdata_578.dat
+ 2008-04-13 22:42 . 2011-07-08 13:49 46080 c:\windows\system32\tzchange.exe
- 2008-04-13 22:42 . 2010-11-03 13:12 46080 c:\windows\system32\tzchange.exe
- 2004-08-04 12:00 . 2011-09-06 09:37 84072 c:\windows\system32\perfc009.dat
+ 2004-08-04 12:00 . 2011-09-09 07:30 84072 c:\windows\system32\perfc009.dat
+ 2008-04-13 17:27 . 2011-07-08 14:02 10496 c:\windows\system32\dllcache\ndistapi.sys
+ 2011-09-10 19:09 . 2011-09-10 19:09 37888 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\343c52b741531ce9ae874ea7508831a7\System.Windows.Presentation.ni.dll
+ 2011-09-10 19:04 . 2011-09-10 19:04 36864 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\246110974e3c48733458819b07464b23\System.Web.DynamicData.Design.ni.dll
+ 2011-09-10 18:42 . 2011-09-10 18:42 94208 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\ace861fe8dbf146c3e449abaa7691e9f\System.ComponentModel.DataAnnotations.ni.dll
+ 2011-09-10 15:21 . 2011-09-10 15:21 47104 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\40ee65aacd9d7472cd6f8dddbfca604b\PresentationFontCache.ni.exe
+ 2011-09-09 07:32 . 2011-09-09 07:32 39424 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\12c424eed7ee0e9c017bf72ff09eb78c\PresentationCFFRasterizer.ni.dll
+ 2011-09-10 17:49 . 2011-09-10 17:49 55296 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\f9c514544c8e23220493cd42a0e20678\Microsoft.Vsa.ni.dll
+ 2011-09-10 18:37 . 2011-09-10 18:37 74752 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\6a384fe8782104c69a36b39c923ff80b\Microsoft.SqlServer.CustomControls.ni.dll
+ 2011-09-10 18:10 . 2011-09-10 18:10 77824 c:\windows\assembly\NativeImages_v2.0.50727_32\Kodak.Statistics\a9b9e97a82c042250c42002c35217ad2\Kodak.Statistics.ni.exe
+ 2011-09-10 17:56 . 2011-09-10 17:56 98304 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.DeviceSettin#\1345ebede6722760ce419665bf573b44\Inkjet.DeviceSettings.ni.dll
+ 2011-09-10 17:49 . 2011-09-10 17:49 80384 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Configuration\7ebacc8846fbb627e2f30d9d80504a12\Inkjet.Configuration.ni.dll
+ 2011-09-10 17:59 . 2011-09-10 17:59 52736 c:\windows\assembly\NativeImages_v2.0.50727_32\HRIntp.Interop\61780292610aba3342df9ea90b960389\HRIntp.Interop.ni.dll
+ 2011-09-10 17:59 . 2011-09-10 17:59 61440 c:\windows\assembly\NativeImages_v2.0.50727_32\Helper\d09c1871f9fb474516e7df4bc5dd93f8\Helper.ni.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2011-06-29 06:28 . 2011-06-29 06:28 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2011-06-29 06:30 . 2011-06-29 06:30 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2011-06-29 06:29 . 2011-06-29 06:29 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2011-06-29 06:29 . 2011-06-29 06:29 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
- 2004-08-04 12:00 . 2011-09-06 09:37 476434 c:\windows\system32\perfh009.dat
+ 2004-08-04 12:00 . 2011-09-09 07:30 476434 c:\windows\system32\perfh009.dat
+ 2010-06-18 17:45 . 2011-06-20 17:44 293376 c:\windows\system32\dllcache\winsrv.dll
- 2010-06-18 17:45 . 2011-04-26 11:07 293376 c:\windows\system32\dllcache\winsrv.dll
- 2009-08-11 14:38 . 2008-04-13 22:43 139656 c:\windows\system32\dllcache\rdpwd.sys
+ 2009-08-11 14:38 . 2011-06-24 14:10 139656 c:\windows\system32\dllcache\rdpwd.sys
- 2009-08-11 15:57 . 2011-04-29 16:19 456320 c:\windows\system32\dllcache\mrxsmb.sys
+ 2009-08-11 15:57 . 2011-07-15 13:29 456320 c:\windows\system32\dllcache\mrxsmb.sys
+ 2008-04-13 22:41 . 2011-09-03 10:17 599040 c:\windows\system32\dllcache\crypt32.dll
- 2008-04-13 22:41 . 2008-04-13 22:41 599040 c:\windows\system32\dllcache\crypt32.dll
- 2009-08-11 15:57 . 2011-04-29 16:19 456320 c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2009-08-11 15:57 . 2011-07-15 13:29 456320 c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2011-09-10 18:33 . 2011-09-10 18:33 321536 c:\windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\cc14c69205b984edba1db26fd5e421ac\WsatConfig.ni.exe
+ 2011-09-10 16:04 . 2011-09-10 16:04 240128 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\39ce0c9c9cc294c0ee26c4ff01522961\WindowsFormsIntegration.ni.dll
+ 2011-09-10 17:58 . 2011-09-10 17:58 308736 c:\windows\assembly\NativeImages_v2.0.50727_32\Windows7.DesktopInt#\d1ce2041b706f7cbcd03a7b04dc9f314\Windows7.DesktopIntegration.ni.dll
+ 2011-09-10 17:58 . 2011-09-10 17:58 643584 c:\windows\assembly\NativeImages_v2.0.50727_32\VistaBridgeLibrary\43e719bdf6dbf938d7ad308b6357ce1d\VistaBridgeLibrary.ni.dll
+ 2011-09-10 16:04 . 2011-09-10 16:04 447488 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\431e918aee8da919f5b9e3a5195ccf93\UIAutomationClient.ni.dll
+ 2011-09-10 19:11 . 2011-09-10 19:11 400896 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\946eefb99bc116ee68e0e7c69a5a8a5c\System.Xml.Linq.ni.dll
+ 2011-09-10 19:03 . 2011-09-10 19:03 129536 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\a82eef3128b9527dc05b3c8667e713bc\System.Web.Routing.ni.dll
+ 2011-09-10 17:55 . 2011-09-10 17:55 202240 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\203c148c913357bfc2ae9d209101f2b3\System.Web.RegularExpressions.ni.dll
+ 2011-09-10 19:08 . 2011-09-10 19:08 859648 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\f89fe39468ea6faf71c4257c89cf3c54\System.Web.Extensions.Design.ni.dll
+ 2011-09-10 19:05 . 2011-09-10 19:05 328704 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\2314ff800782dc85224e69e802a073f7\System.Web.Entity.ni.dll
+ 2011-09-10 19:05 . 2011-09-10 19:05 301056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\f690a8f5d784a5bb20f2cbaa7277eb6c\System.Web.Entity.Design.ni.dll
+ 2011-09-10 19:04 . 2011-09-10 19:04 547328 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\c5c96400424b85536443623f96f64581\System.Web.DynamicData.ni.dll
+ 2011-09-10 19:01 . 2011-09-10 19:01 141312 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\5f8e87b47465a038403e73012c6d102a\System.Web.Abstractions.ni.dll
+ 2011-09-10 17:51 . 2011-09-10 17:51 627200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\846dd505f97805f00999ee26aec9bf75\System.Transactions.ni.dll
+ 2011-09-10 17:50 . 2011-09-10 17:50 212992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\70a1400affdc775d7c7398e036359286\System.ServiceProcess.ni.dll
+ 2011-09-10 17:48 . 2011-09-10 17:48 679936 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\de9cd25ccb24bcf8a0316756e766721f\System.Security.ni.dll
+ 2011-09-10 17:48 . 2011-09-10 17:48 311296 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\21248037960cf6dfa2ce401d355bd6c9\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2011-09-10 17:51 . 2011-09-10 17:51 771584 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b7e0214a811f81e09041864081139641\System.Runtime.Remoting.ni.dll
+ 2011-09-10 18:59 . 2011-09-10 18:59 621056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Net\480ea914e13fe41cdd8fb542bb1f7e81\System.Net.ni.dll
+ 2011-09-10 18:21 . 2011-09-10 18:21 593408 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\18a7efd299665b8bfa0d0dc6701343c6\System.Messaging.ni.dll
+ 2011-09-10 17:49 . 2011-09-10 17:49 998400 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\6e563a58e6fc0117070d5b8fd59e4e1b\System.Management.ni.dll
+ 2011-09-10 18:59 . 2011-09-10 18:59 330752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\dc72c7581f1b3794c0ea595ba02ff7ad\System.Management.Instrumentation.ni.dll
+ 2011-09-10 18:24 . 2011-09-10 18:24 381440 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\fcf8612a210d1f76e0b37dc8467b4696\System.IO.Log.ni.dll
+ 2011-09-10 18:23 . 2011-09-10 18:23 212992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\ec017b5a95d02fccaefd835490ef1e14\System.IdentityModel.Selectors.ni.dll
+ 2011-09-10 17:51 . 2011-09-10 17:51 280064 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\75f452279422a7898e840ee5768c9d2e\System.EnterpriseServices.Wrapper.dll
+ 2011-09-10 17:51 . 2011-09-10 17:51 627712 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\75f452279422a7898e840ee5768c9d2e\System.EnterpriseServices.ni.dll
+ 2011-09-10 15:32 . 2011-09-10 15:32 208384 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\f7cd3d07c15366b76fe4c38d24455d6b\System.Drawing.Design.ni.dll
+ 2011-09-10 18:58 . 2011-09-10 18:58 881152 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\822c996e6ad4901219b7de399a6f78bf\System.DirectoryServices.AccountManagement.ni.dll
+ 2011-09-10 17:56 . 2011-09-10 17:56 455680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\1ffe911e62f482e42be2c4428bd08c10\System.DirectoryServices.Protocols.ni.dll
+ 2011-09-10 18:57 . 2011-09-10 18:57 354816 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\e1c009b2c9becdb732a2ea45f32a46b8\System.Data.Services.Design.ni.dll
+ 2011-09-10 18:57 . 2011-09-10 18:57 939008 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\1defd94e1662a4478ccf2cd0b1b4e6a6\System.Data.Services.Client.ni.dll
+ 2011-09-10 18:55 . 2011-09-10 18:55 756736 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\04267c1dbdcdd8ec37e1518126767ead\System.Data.Entity.Design.ni.dll
+ 2011-09-10 18:43 . 2011-09-10 18:43 135680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\f2a6d41b3f6e26eea6dcac9298aa637b\System.Data.DataSetExtensions.ni.dll
+ 2011-09-10 17:46 . 2011-09-10 17:46 971264 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\77df2cd21a5b85a1605b335aa9ad9d44\System.Configuration.ni.dll
+ 2011-09-10 17:49 . 2011-09-10 17:49 141312 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\585e68739b2a8aff61ee6b2786513245\System.Configuration.Install.ni.dll
+ 2011-09-10 18:42 . 2011-09-10 18:42 633856 c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\fbf6ef12d1456058acde29f2640092fb\System.AddIn.ni.dll
+ 2011-09-10 18:33 . 2011-09-10 18:33 366080 c:\windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\896e42071939e038008b0bbbfed1213c\SMSvcHost.ni.exe
+ 2011-09-10 18:32 . 2011-09-10 18:32 256000 c:\windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\ca07e9cf488af1290d2340d682574a24\SMDiagnostics.ni.dll
+ 2011-09-10 18:32 . 2011-09-10 18:32 320512 c:\windows\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\a5aa977dd575a6beb3a416bd480b98a7\ServiceModelReg.ni.exe
+ 2011-09-10 15:25 . 2011-09-10 15:25 224768 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\f52e48f55258d0a04fbab3a1f93752e9\PresentationFramework.Classic.ni.dll
+ 2011-09-10 15:25 . 2011-09-10 15:25 368128 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\cf812b99f587ab514afb36fa9d4c1567\PresentationFramework.Aero.ni.dll
+ 2011-09-10 15:26 . 2011-09-10 15:26 539648 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\b7795999cc67f3a6cec40f5b24005e00\PresentationFramework.Luna.ni.dll
+ 2011-09-10 15:26 . 2011-09-10 15:26 258048 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\09f5af61ea2af04eb32c04b3091ffc86\PresentationFramework.Royale.ni.dll
+ 2011-09-10 18:08 . 2011-09-10 18:08 170496 c:\windows\assembly\NativeImages_v2.0.50727_32\PhotobucketNet\614441eef70eb43704a959c3aecf34a2\PhotobucketNet.ni.dll
+ 2011-09-10 18:34 . 2011-09-10 18:34 133632 c:\windows\assembly\NativeImages_v2.0.50727_32\MSBuild\2d89c7b72bc8e527b26d5b6f3b931012\MSBuild.ni.exe
+ 2011-09-10 18:16 . 2011-09-10 18:16 863744 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Web.Autho#\f32c73a074d6f0dc66ed5fc983ea9e6b\Microsoft.Web.Authoring.ni.dll
+ 2011-09-10 18:31 . 2011-09-10 18:31 386560 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\39e9d172f0cf5eec30b1b67212cc032b\Microsoft.Transactions.Bridge.Dtc.ni.dll
+ 2011-09-10 18:37 . 2011-09-10 18:37 355840 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\c8459ec99c6f9fabc0a866e0caef61cb\Microsoft.SqlServer.Setup.ni.dll
+ 2011-09-10 18:37 . 2011-09-10 18:37 529920 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\677510247bf04ee4e3ae07c03996d916\Microsoft.SqlServer.GridControl.ni.dll
+ 2011-09-10 18:38 . 2011-09-10 18:38 989184 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\410cb6e0526d199b0d4eb9d0958c8fa7\Microsoft.SqlServer.WizardFrameworkLite.ni.dll
+ 2011-09-10 18:36 . 2011-09-10 18:36 231936 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.NetEnterp#\4dc94957b8ee72c430bdc3042ff15bc2\Microsoft.NetEnterpriseServers.ExceptionMessageBox.ni.dll
+ 2011-09-10 18:19 . 2011-09-10 18:19 144384 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\f1b0ec3ccde9142e67ac681fb521ac66\Microsoft.Build.Utilities.ni.dll
+ 2011-09-10 18:36 . 2011-09-10 18:36 175104 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\9250f038410f0d6432e3ccb0b046862b\Microsoft.Build.Utilities.v3.5.ni.dll
+ 2011-09-10 18:35 . 2011-09-10 18:35 839680 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\a4672179aba638cd78bdfe268391b47b\Microsoft.Build.Engine.ni.dll
+ 2011-09-10 18:34 . 2011-09-10 18:34 222720 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\37db660a84ee52b61a7ca55812581bbd\Microsoft.Build.Conversion.v3.5.ni.dll
+ 2011-09-10 18:03 . 2011-09-10 18:03 155648 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Windows\c938353ccc8c52a1b504eee4ffd3f7ce\Inkjet.Windows.ni.dll
+ 2011-09-10 17:50 . 2011-09-10 17:50 278016 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Utilities\a8faea1a6d8599ca18ec5f9535133989\Inkjet.Utilities.ni.dll
+ 2011-09-10 18:13 . 2011-09-10 18:13 276992 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Utilities\932b642b90432c10b6065d428e0804fe\Inkjet.Utilities.ni.dll
+ 2011-09-10 18:10 . 2011-09-10 18:10 136192 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Tray\f30058992be216e70447beeb220194de\Inkjet.Tray.ni.dll
+ 2011-09-10 17:58 . 2011-09-10 17:58 977920 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Tools\41e6e85edb79e222c9d0f2c0ad32e77e\Inkjet.Tools.ni.dll
+ 2011-09-10 17:48 . 2011-09-10 17:48 176640 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Statistics\601d61c335c9ca8eada4eec9111ac0d8\Inkjet.Statistics.ni.dll
+ 2011-09-10 17:56 . 2011-09-10 17:56 378368 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Scanning\8e8b5086b99436154ef0123678b3e944\Inkjet.Scanning.ni.dll
+ 2011-09-10 17:57 . 2011-09-10 17:57 565760 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Scan\71f1bc6bcf1344ddff315b0dd0a5a31f\Inkjet.Scan.ni.dll
+ 2011-09-10 17:56 . 2011-09-10 17:56 335872 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Printing\2b7ed2431b62e44fbd663232a1423e89\Inkjet.Printing.ni.dll
+ 2011-09-10 18:09 . 2011-09-10 18:09 297984 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Picasa\6154e2c4d240eae07e4ffb122a4916b0\Inkjet.Picasa.ni.dll
+ 2011-09-10 18:08 . 2011-09-10 18:08 210944 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.PhotoBucket\bc5be5aab4e4dda2d4cdd8fabde9f8c1\Inkjet.PhotoBucket.ni.dll
+ 2011-09-10 17:50 . 2011-09-10 17:50 236544 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Localization\9ecdea86ce9211013718331320540867\Inkjet.Localization.ni.dll
+ 2011-09-10 18:08 . 2011-09-10 18:08 522240 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.KodakGallery\548e0ec3d1c84a2bc2f3ce6f6cc73e26\Inkjet.KodakGallery.ni.dll
+ 2011-09-10 17:58 . 2011-09-10 17:58 195584 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.IO\289c638a72c0ac6bb169d807e4ba16ca\Inkjet.IO.ni.dll
+ 2011-09-10 17:49 . 2011-09-10 17:49 815104 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Hardware\dda5dc6d1c8c12b2cc6fde981b57a7e9\Inkjet.Hardware.ni.dll
+ 2011-09-10 18:07 . 2011-09-10 18:07 163328 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Flickr\bf51ea5f8150c2213dad314c1fd9b935\Inkjet.Flickr.ni.dll
+ 2011-09-10 18:06 . 2011-09-10 18:06 162816 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Facebook\4bb5d18542be147f5db437502d59f418\Inkjet.Facebook.ni.dll
+ 2011-09-10 17:59 . 2011-09-10 17:59 167424 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.EasyShare\1ca06efb68b88d7ae2a180b417238d6f\Inkjet.EasyShare.ni.dll
+ 2011-09-10 17:50 . 2011-09-10 17:50 105472 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Diagnostics\78e81728708aaa4ff1d8e4d640c6bde3\Inkjet.Diagnostics.ni.dll
+ 2011-09-10 18:03 . 2011-09-10 18:03 274432 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Browse\f7c7a63385f1c7341ac789fc7f897292\Inkjet.Browse.ni.dll
+ 2011-09-10 17:56 . 2011-09-10 17:56 167424 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Automation\1a22fab9f36cc5d07f3054a53ae639db\Inkjet.Automation.ni.dll
+ 2011-09-10 18:09 . 2011-09-10 18:09 102912 c:\windows\assembly\NativeImages_v2.0.50727_32\Google.GData.Photos\88530278947f36363870b7208dc0f26d\Google.GData.Photos.ni.dll
+ 2011-09-10 18:09 . 2011-09-10 18:09 216064 c:\windows\assembly\NativeImages_v2.0.50727_32\Google.GData.Extens#\e9c24ad797090d71be88fd671e462a41\Google.GData.Extensions.ni.dll
+ 2011-09-10 18:09 . 2011-09-10 18:09 551936 c:\windows\assembly\NativeImages_v2.0.50727_32\Google.GData.Client\7d710e17f65da1538eae2db89090f733\Google.GData.Client.ni.dll
+ 2011-09-10 18:07 . 2011-09-10 18:07 372736 c:\windows\assembly\NativeImages_v2.0.50727_32\FlickrNet\2f0bce36deda7ae5bb58fdbd4a0a1b1a\FlickrNet.ni.dll
+ 2011-09-10 18:06 . 2011-09-10 18:06 238592 c:\windows\assembly\NativeImages_v2.0.50727_32\Facebook\eac8ddb32d783b93c71bf15c113de183\Facebook.ni.dll
+ 2011-09-10 17:59 . 2011-09-10 17:59 435200 c:\windows\assembly\NativeImages_v2.0.50727_32\EastmanKodakCompany#\2ac459143a5b7e505a13cca283560ca4\EastmanKodakCompany.EasyShare.ni.dll
+ 2011-09-10 18:31 . 2011-09-10 18:31 410112 c:\windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\fe9a21b94803f74697bb42b9d1fdea5b\ComSvcConfig.ni.exe
+ 2011-09-10 17:42 . 2011-09-10 17:42 842240 c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\f160c8e40b60edd47ae74b0b911fece1\AspNetMMCExt.ni.dll
+ 2011-09-10 18:03 . 2011-09-10 18:03 868864 c:\windows\assembly\NativeImages_v2.0.50727_32\AiOPrinterTools\cbeec4102702fb6645c0318863255df2\AiOPrinterTools.ni.exe
- 2011-06-29 06:28 . 2011-06-29 06:28 839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2011-06-29 06:28 . 2011-06-29 06:28 835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 303104 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 303104 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 626688 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 626688 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
- 2011-06-29 06:30 . 2011-06-29 06:30 970752 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 970752 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2011-06-29 06:30 . 2011-06-29 06:30 745472 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 745472 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2011-06-29 06:30 . 2011-06-29 06:30 425984 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 425984 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 659456 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 659456 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2011-06-29 06:28 . 2011-06-29 06:28 507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 261632 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 261632 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 113664 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 113664 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 258048 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 258048 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 486400 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
- 2011-06-29 06:30 . 2011-06-29 06:30 486400 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
- 2011-01-18 08:39 . 2011-01-18 08:39 3182592 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.dll
+ 2011-04-29 01:50 . 2011-04-29 01:50 3182592 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.dll
+ 2011-05-02 04:06 . 2011-05-02 04:06 2705920 c:\windows\Installer\6efc9e.msp
+ 2011-09-10 21:35 . 2011-09-10 21:35 1611776 c:\windows\Installer\132d40c.msi
+ 2011-09-10 15:19 . 2011-09-10 15:19 3325440 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\fd6e0cd6f124a6d041ef1b4c9a5f080b\WindowsBase.ni.dll
+ 2011-09-10 16:04 . 2011-09-10 16:04 1049600 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\162600dde59fbaa0c048a949158ecba3\UIAutomationClientsideProviders.ni.dll
+ 2011-09-09 07:32 . 2011-09-09 07:32 7950848 c:\windows\assembly\NativeImages_v2.0.50727_32\System\e6c79e1d71b0c9000afd7e5e439b5c54\System.ni.dll
+ 2011-09-10 16:04 . 2011-09-10 16:04 5450752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\10154dcad2d62f226af2fd4211460a4b\System.Xml.ni.dll
+ 2011-09-10 19:11 . 2011-09-10 19:11 1356288 c:\windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\22229a30650a9afbac984e1093898b13\System.WorkflowServices.ni.dll
+ 2011-09-10 18:21 . 2011-09-10 18:21 1908224 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\4d6b3cc1fc7a4788612241af7966715a\System.Workflow.Runtime.ni.dll
+ 2011-09-10 18:18 . 2011-09-10 18:18 4514304 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\e4c9853af945c9cfede19f3faf18af6e\System.Workflow.ComponentModel.ni.dll
+ 2011-09-10 18:20 . 2011-09-10 18:20 2992640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\ab4b50c7c789e46a485903365765fde8\System.Workflow.Activities.ni.dll
+ 2011-09-10 17:55 . 2011-09-10 17:55 1840640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\a2392c995b1bb6b63079091259222357\System.Web.Services.ni.dll
+ 2011-09-10 18:17 . 2011-09-10 18:17 2209280 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\3da92a0b9b8ac97e11ca8bf4df671a78\System.Web.Mobile.ni.dll
+ 2011-09-10 19:03 . 2011-09-10 19:03 2405376 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\01f4d6aa3299a41b8578b7e96afdcfb1\System.Web.Extensions.ni.dll
+ 2011-09-10 15:36 . 2011-09-10 15:36 1917952 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Speech\e1208f0d981c420fc59f806bfbaa713b\System.Speech.ni.dll
+ 2011-09-10 19:00 . 2011-09-10 19:00 1706496 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\27e1b8dfd5e1ccf2c5b9efc51f674c69\System.ServiceModel.Web.ni.dll
+ 2011-09-10 18:25 . 2011-09-10 18:25 2345472 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\dece01bd9e9c32e47630fdfc78d3bd32\System.Runtime.Serialization.ni.dll
+ 2011-09-10 15:34 . 2011-09-10 15:34 1035776 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Printing\90b444d02047ef27921153d46967ef0e\System.Printing.ni.dll
+ 2011-09-10 18:23 . 2011-09-10 18:23 1070080 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\a50e2fc92db32751857fb8d297f9d7bc\System.IdentityModel.ni.dll
+ 2011-09-10 15:32 . 2011-09-10 15:32 1587200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\7ed09623172a292eaee51e2e3bcaf784\System.Drawing.ni.dll
+ 2011-09-10 17:51 . 2011-09-10 17:51 1116672 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\259ecf480769f4e60514b7ae2abaa6f1\System.DirectoryServices.ni.dll
+ 2011-09-10 17:48 . 2011-09-10 17:48 1801216 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\71cf3eb40fc38e6ac8fba09e872d2878\System.Deployment.ni.dll
+ 2011-09-10 15:28 . 2011-09-10 15:28 6616576 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\db2d84e279807592a680ef4135e9fe9a\System.Data.ni.dll
+ 2011-09-10 17:47 . 2011-09-10 17:47 2510336 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\0b16305773369cf740c6a2b1f1d785b2\System.Data.SqlXml.ni.dll
+ 2011-09-10 18:57 . 2011-09-10 18:57 1328128 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\c1b9b8ce390548dcca661a5e6a908408\System.Data.Services.ni.dll
+ 2011-09-10 17:55 . 2011-09-10 17:55 1115136 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\c729750d54f6e7427230622bcccd4709\System.Data.OracleClient.ni.dll
+ 2011-09-10 15:28 . 2011-09-10 15:28 2516480 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\571af34939797a7c1cd05b0b925a45bf\System.Data.Linq.ni.dll
+ 2011-09-10 18:53 . 2011-09-10 18:53 9924096 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\2b58cc071d6bf0c741e91f86c09de5d7\System.Data.Entity.ni.dll
+ 2011-09-10 15:27 . 2011-09-10 15:27 2295296 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\e54e013315849f5e34d8f2a8e7fdb450\System.Core.ni.dll
+ 2011-09-10 15:27 . 2011-09-10 15:27 2128896 c:\windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\24ab0cacc77e8696ceff3157942a2de4\ReachFramework.ni.dll
+ 2011-09-10 15:27 . 2011-09-10 15:27 1657856 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\fac1ca86f4fea17de40d7fdaba38563e\PresentationUI.ni.dll
+ 2011-09-09 07:32 . 2011-09-09 07:32 1451008 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\b187becbc388c4ce7f33ede4da76e7b1\PresentationBuildTasks.ni.dll
+ 2011-09-10 18:07 . 2011-09-10 18:07 1761792 c:\windows\assembly\NativeImages_v2.0.50727_32\Newtonsoft.Json.Net#\25acc69b700242b325eba804d58549c0\Newtonsoft.Json.Net20.ni.dll
+ 2011-09-10 18:11 . 2011-09-10 18:11 2428416 c:\windows\assembly\NativeImages_v2.0.50727_32\NetworkPrinterDisco#\031109af70c6e5670bdde70404741e82\NetworkPrinterDiscovery.ni.exe
+ 2011-09-10 18:16 . 2011-09-10 18:17 1602048 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Web.Desig#\0f70c9162aeff327fd33ca7ace68b58e\Microsoft.Web.Design.Client.ni.dll
+ 2011-09-10 18:41 . 2011-09-10 18:41 1712128 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\c6b19db2534042d435ede580f92bc75c\Microsoft.VisualBasic.ni.dll
+ 2011-09-10 18:31 . 2011-09-10 18:31 1093120 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\08594c4ba9ea0253a836fe1d8d341984\Microsoft.Transactions.Bridge.ni.dll
+ 2011-09-10 17:49 . 2011-09-10 17:49 2332160 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\345abd035c9378667b1cac54c1f21c97\Microsoft.JScript.ni.dll
+ 2011-09-10 18:36 . 2011-09-10 18:36 1966080 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\906cd5555b79e4e0486dc8ef2a748b13\Microsoft.Build.Tasks.v3.5.ni.dll
+ 2011-09-10 18:19 . 2011-09-10 18:19 1620992 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\7baff7d694394aaba490082c88d48fd2\Microsoft.Build.Tasks.ni.dll
+ 2011-09-10 18:34 . 2011-09-10 18:34 1888768 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\235a22e1ae9742bb724d411629dd99d5\Microsoft.Build.Engine.ni.dll
+ 2011-09-10 18:11 . 2011-09-10 18:11 1247232 c:\windows\assembly\NativeImages_v2.0.50727_32\KodakAiOUpdater\3e288a4158498e887f60ec8e4442f957\KodakAiOUpdater.ni.exe
+ 2011-09-10 18:12 . 2011-09-10 18:12 1218048 c:\windows\assembly\NativeImages_v2.0.50727_32\InkjetCore\e8b5791fbdf715ced4ce19cc12ffaedf\InkjetCore.ni.dll
+ 2011-09-10 17:46 . 2011-09-10 17:46 1229312 c:\windows\assembly\NativeImages_v2.0.50727_32\InkjetCore\117626557193ba7b03c93595702abd9b\InkjetCore.ni.dll
+ 2011-09-10 18:06 . 2011-09-10 18:06 1531904 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Editing\97f8135190b5906c64b5e9f1d6d2ed22\Inkjet.Editing.ni.dll
+ 2011-09-10 18:05 . 2011-09-10 18:05 1216000 c:\windows\assembly\NativeImages_v2.0.50727_32\Inkjet.Destination\d79e1c13f94c7a328faa423d3f9e7ef7\Inkjet.Destination.ni.dll
+ 2011-09-10 17:50 . 2011-09-10 17:50 1177600 c:\windows\assembly\NativeImages_v2.0.50727_32\idrskrn_net14\72a3fa115b6aadaf9eef521ddd529d0e\idrskrn_net14.ni.dll
+ 2011-09-10 18:14 . 2011-09-10 18:14 3753472 c:\windows\assembly\NativeImages_v2.0.50727_32\CommonControls\fc38cdd633cdf8a201e49e9505c62b14\CommonControls.ni.dll
+ 2011-09-10 17:57 . 2011-09-10 17:57 3756032 c:\windows\assembly\NativeImages_v2.0.50727_32\CommonControls\18316ba6d01de49f84c2cea01f87d21e\CommonControls.ni.dll
+ 2011-09-10 18:02 . 2011-09-10 18:02 1058816 c:\windows\assembly\NativeImages_v2.0.50727_32\AiOHostDirector\786aef60b00281858206824f7f011a83\AiOHostDirector.ni.exe
+ 2011-09-10 17:46 . 2011-09-10 17:46 1869312 c:\windows\assembly\NativeImages_v2.0.50727_32\AiOHomeCenter\8d09bf7300da33da31dcf95b951bc2f9\AiOHomeCenter.ni.exe
- 2011-06-29 06:30 . 2011-06-29 06:30 3182592 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 3182592 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 5025792 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2011-06-29 06:28 . 2011-06-29 06:28 5025792 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2011-06-29 06:28 . 2011-06-29 06:28 5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
- 2011-06-29 06:28 . 2011-06-29 06:28 5242880 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2011-09-09 07:28 . 2011-09-09 07:28 5242880 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2011-09-09 07:29 . 2011-09-09 07:29 2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- 2011-06-29 06:30 . 2011-06-29 06:30 2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2011-06-29 06:29 . 2011-09-09 07:29 4550656 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
- 2011-06-29 06:29 . 2011-06-29 06:29 4550656 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2009-08-13 20:56 . 2011-09-09 07:14 52390856 c:\windows\system32\MRT.exe
+ 2011-09-10 15:44 . 2011-09-10 15:44 12430848 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d00cc387e462e4c3cdcd112b137cac87\System.Windows.Forms.ni.dll
+ 2011-09-10 17:53 . 2011-09-10 17:53 11800576 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\40893760431f8f0dcce3e18630e45b23\System.Web.ni.dll
+ 2011-09-10 18:29 . 2011-09-10 18:29 17403904 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\e3a0205acab2215fbad7927d9d483aeb\System.ServiceModel.ni.dll
+ 2011-09-10 15:31 . 2011-09-10 15:31 10683392 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\63ad0cd9b5e038c8e2e41415657db8fc\System.Design.ni.dll
+ 2011-09-10 15:22 . 2011-09-10 15:22 14328320 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\704556e34128441ea9f1a81cc89f8a79\PresentationFramework.ni.dll
+ 2011-09-10 15:20 . 2011-09-10 15:20 12215808 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\5f332c48d03eca57419c4f0e884092ee\PresentationCore.ni.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-05-30 2495816]
.
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2011-05-30 15:33 2495816 —-a-w- c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-05-30 2495816]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-05-30 2495816]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AnalogClock"="c:\program files\Windows7\Analog Clock\AnalogClock.exe" [2005-11-05 480256]
"TransBar"="c:\program files\Windows7\TransBar\TransBar.exe" [2005-06-01 65536]
"SpeedBitVideoAccelerator"="c:\program files\SpeedBit Video Accelerator\VideoAccelerator.exe" [2009-09-30 1435240]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-20 39408]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"OnlineVault"="c:\documents and settings\Nick\My Documents\Online Vault\OnlineVault.exe" [2010-05-28 2459136]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KRun"="c:\program files\Windows7\RunMe\RunMe.exe" [2007-04-06 518656]
"Viena Explorer"="c:\program files\Windows7\Vienna Explorer\Vienna Explorer.exe" [2006-11-18 581632]
"Visual Task Tips"="c:\program files\Windows7\VisualTaskTips\VisualTaskTips.exe" [2007-09-05 36352]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 88363]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-11-03 98304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-11-03 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-11-03 118784]
"RTHDCPL"="RTHDCPL.EXE" [2009-12-04 18789408]
"lxctmon.exe"="c:\program files\Lexmark 5400 Series\lxctmon.exe" [2007-03-19 291760]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2011-04-18 2334560]
"LXCTCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll" [2006-11-21 106496]
"Conime"="c:\windows\system32\conime.exe" [2008-04-28 52224]
"EKAIO2StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKAiO2MUI.exe" [2011-05-27 2729472]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2011-09-09 2216960]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2010-03-11 124928]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Launch Whitesmoke Translator.lnk - c:\documents and settings\Nick\My Documents\Programs\WSTrayDictMode.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgmfapx.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\AiOHomeCenter.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\Kodak.Statistics.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\NetworkPrinterDiscovery.exe"=
"c:\\Program Files\\Kodak\\AiO\\Firmware\\KodakAiOUpdater.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kodak\\Installer\\Setup.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgnsx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"6492:TCP"= 6492:TCP:Services
"6493:TCP"= 6493:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"9586:TCP"= 9586:TCP:Services
"9587:TCP"= 9587:TCP:Services
"7164:TCP"= 7164:TCP:Services
"7165:TCP"= 7165:TCP:Services
"1680:TCP"= 1680:TCP:Services
"1860:TCP"= 1860:TCP:Services
"8567:TCP"= 8567:TCP:*:Disabled:BitComet 8567 TCP
"8567:UDP"= 8567:UDP:*:Disabled:BitComet 8567 UDP
"6554:TCP"= 6554:TCP:Services
"6555:TCP"= 6555:TCP:Services
"4430:TCP"= 4430:TCP:Services
"7360:TCP"= 7360:TCP:Services
"9679:TCP"= 9679:TCP:Services
"9680:TCP"= 9680:TCP:Services
"7820:TCP"= 7820:TCP:Services
"7821:TCP"= 7821:TCP:Services
"3430:TCP"= 3430:TCP:Services
"5360:TCP"= 5360:TCP:Services
"3727:TCP"= 3727:TCP:Services
"5954:TCP"= 5954:TCP:Services
"9414:TCP"= 9414:TCP:Services
"9415:TCP"= 9415:TCP:Services
"7414:TCP"= 7414:TCP:Services
"7415:TCP"= 7415:TCP:Services
"6289:TCP"= 6289:TCP:Services
"6290:TCP"= 6290:TCP:Services
"5023:TCP"= 5023:TCP:Services
"8546:TCP"= 8546:TCP:Services
"9195:TCP"= 9195:TCP:Services
"9196:TCP"= 9196:TCP:Services
"8148:TCP"= 8148:TCP:Services
"8149:TCP"= 8149:TCP:Services
"8429:TCP"= 8429:TCP:Services
"8430:TCP"= 8430:TCP:Services
"8408:TCP"= 8408:TCP:Services
"8409:TCP"= 8409:TCP:Services
"6804:TCP"= 6804:TCP:Services
"6805:TCP"= 6805:TCP:Services
"8523:TCP"= 8523:TCP:Services
"8524:TCP"= 8524:TCP:Services
"7867:TCP"= 7867:TCP:Services
"7868:TCP"= 7868:TCP:Services
"2009:TCP"= 2009:TCP:Services
"2518:TCP"= 2518:TCP:Services
"6711:TCP"= 6711:TCP:Services
"6712:TCP"= 6712:TCP:Services
"9976:TCP"= 9976:TCP:Services
"9977:TCP"= 9977:TCP:Services
"8492:TCP"= 8492:TCP:Services
"8493:TCP"= 8493:TCP:Services
"1775:TCP"= 1775:TCP:Services
"2050:TCP"= 2050:TCP:Services
"8242:TCP"= 8242:TCP:Services
"8243:TCP"= 8243:TCP:Services
"6883:TCP"= 6883:TCP:Services
"6884:TCP"= 6884:TCP:Services
"5055:TCP"= 5055:TCP:Services
"8610:TCP"= 8610:TCP:Services
"4368:TCP"= 4368:TCP:Services
"7236:TCP"= 7236:TCP:Services
"8885:TCP"= 8885:TCP:Services
"8886:TCP"= 8886:TCP:Services
"9338:TCP"= 9338:TCP:Services
"9337:TCP"= 9337:TCP:Services
"7587:TCP"= 7587:TCP:Services
"7588:TCP"= 7588:TCP:Services
"2018:TCP"= 2018:TCP:Services
"1759:TCP"= 1759:TCP:Services
"7274:TCP"= 7274:TCP:Services
"7275:TCP"= 7275:TCP:Services
"9633:TCP"= 9633:TCP:Services
"9632:TCP"= 9632:TCP:Services
"8897:TCP"= 8897:TCP:*:Disabled:BitComet 8897 TCP
"8897:UDP"= 8897:UDP:*:Disabled:BitComet 8897 UDP
"8977:TCP"= 8977:TCP:Services
"8978:TCP"= 8978:TCP:Services
"9664:TCP"= 9664:TCP:Services
"9665:TCP"= 9665:TCP:Services
"3320:TCP"= 3320:TCP:Services
"5140:TCP"= 5140:TCP:Services
"3602:TCP"= 3602:TCP:Services
"5704:TCP"= 5704:TCP:Services
"9945:TCP"= 9945:TCP:Services
"9946:TCP"= 9946:TCP:Services
"4760:TCP"= 4760:TCP:Services
"8020:TCP"= 8020:TCP:Services
"6838:TCP"= 6838:TCP:Services
"6837:TCP"= 6837:TCP:Services
"3290:TCP"= 3290:TCP:Services
"5080:TCP"= 5080:TCP:Services
"1647:TCP"= 1647:TCP:Services
"1794:TCP"= 1794:TCP:Services
"2725:TCP"= 2725:TCP:Services
"3950:TCP"= 3950:TCP:Services
"1617:TCP"= 1617:TCP:Services
"1820:TCP"= 1820:TCP:Services
"2226:TCP"= 2226:TCP:Services
"6515:TCP"= 6515:TCP:Services
"7742:TCP"= 7742:TCP:Services
"9866:TCP"= 9866:TCP:Services
"3133:TCP"= 3133:TCP:Services
"4766:TCP"= 4766:TCP:Services
"2273:TCP"= 2273:TCP:Services
"1523:TCP"= 1523:TCP:Services
"12029:TCP"= 12029:TCP:*:Disabled:BitComet 12029 TCP
"12029:UDP"= 12029:UDP:*:Disabled:BitComet 12029 UDP
"9322:TCP"= 9322:TCP:EKDiscovery
"5353:UDP"= 5353:UDP:*:Disabled:Bonjour Port 5353
"5353:TCP"= 5353:TCP:printer
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2/22/2011 8:13 AM 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [3/16/2011 4:03 PM 32592]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/26/2009 1:55 PM 691696]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [1/7/2011 6:41 AM 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [4/5/2011 12:59 AM 297168]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [9/9/2011 1:49 AM 142592]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [2/8/2011 5:33 AM 269520]
R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\EKAiOHostService.exe [4/11/2011 4:59 PM 375296]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [4/14/2011 9:28 PM 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2/10/2011 7:53 AM 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2/10/2011 7:53 AM 27216]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [4/18/2011 5:39 PM 7398752]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [5/17/2011 12:31 AM 1025352]
S3 xcpip;TCP/IP Protocol Driver;c:\windows\system32\drivers\xcpip.sys –> c:\windows\system32\drivers\xcpip.sys [?]
S3 xpsec;IPSEC driver;c:\windows\system32\drivers\xpsec.sys –> c:\windows\system32\drivers\xpsec.sys [?]
.
.
——- Supplementary Scan ——-
.
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
TCP: DhcpNameServer = 192.168.1.1 [removed]
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll
FF - ProfilePath - c:\documents and settings\Nick\Application Data\Mozilla\Firefox\Profiles\4zniteye.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4e02abbf&v;=7.007.026.001&i;=23&tp;=ab&iy;=&ychte;=us&lng;=en-US&q;=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-13 00:21
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCTCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-343818398-796845957-1177238915-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(464)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\COMRes.dll
c:\windows\system32\cscui.dll
.
- - - - - - - > 'lsass.exe'(520)
c:\windows\system32\SETUPAPI.dll
.
- - - - - - - > 'explorer.exe'(1464)
c:\windows\system32\WININET.dll
c:\program files\Windows7\VisualTaskTips\VttHooks.dll
c:\windows\system32\msctfime.ime
c:\windows\system32\COMRes.dll
c:\windows\System32\cscui.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\MSVCP60.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
Completion time: 2011-09-13 00:27:43
ComboFix-quarantined-files.txt 2011-09-13 04:27
ComboFix2.txt 2011-09-09 03:47
.
Pre-Run: 133,631,287,296 bytes free
Post-Run: 133,631,930,368 bytes free
.
Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 1CAFF5FF464C9271C84D2179EBB9FBA9



And here is the HAMeb log.

C:\Documents and Settings\Nick\My Documents\Downloads\HAMeb_check.exe
Tue 09/13/2011 at 0:50:39.06

Account active Yes
Local Group Memberships *Administrators

~~ Checking profile list ~~

S-1-5-21-343818398-796845957-1177238915-1000
%SystemDrive%\Documents and Settings\HelpAssistant

~~ Checking for HelpAssistant directories ~~

HelpAssistant

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys atapi.sys spyl.sys hal.dll >>UNKNOWN [0x831CC938]<<
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x017499F00
malicious code @ sector 0x017499F03 !
PE file found in sector at 0x017499F19 !

~~ Checking for termsrv32.dll ~~

termsrv32.dll present!


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %SystemRoot%\System32\termsrv.dll

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\GloballyOpenPorts\List]
"65533:TCP"=65533:TCP:*:Enabled:Services
"52344:TCP"=52344:TCP:*:Enabled:Services
"6492:TCP"=6492:TCP:*:Enabled:Services
"6493:TCP"=6493:TCP:*:Enabled:Services
"3389:TCP"=3389:TCP:*:Enabled:Remote Desktop
"9586:TCP"=9586:TCP:*:Enabled:Services
"9587:TCP"=9587:TCP:*:Enabled:Services
"7164:TCP"=7164:TCP:*:Enabled:Services
"7165:TCP"=7165:TCP:*:Enabled:Services
"1680:TCP"=1680:TCP:*:Enabled:Services
"1860:TCP"=1860:TCP:*:Enabled:Services
"6554:TCP"=6554:TCP:*:Enabled:Services
"6555:TCP"=6555:TCP:*:Enabled:Services
"4430:TCP"=4430:TCP:*:Enabled:Services
"7360:TCP"=7360:TCP:*:Enabled:Services
"9680:TCP"=9680:TCP:*:Enabled:Services
"9679:TCP"=9679:TCP:*:Enabled:Services
"7820:TCP"=7820:TCP:*:Enabled:Services
"7821:TCP"=7821:TCP:*:Enabled:Services
"3430:TCP"=3430:TCP:*:Enabled:Services
"5360:TCP"=5360:TCP:*:Enabled:Services
"3727:TCP"=3727:TCP:*:Enabled:Services
"5954:TCP"=5954:TCP:*:Enabled:Services
"9414:TCP"=9414:TCP:*:Enabled:Services
"9415:TCP"=9415:TCP:*:Enabled:Services
"7414:TCP"=7414:TCP:*:Enabled:Services
"7415:TCP"=7415:TCP:*:Enabled:Services
"6289:TCP"=6289:TCP:*:Enabled:Services
"6290:TCP"=6290:TCP:*:Enabled:Services
"5023:TCP"=5023:TCP:*:Enabled:Services
"8546:TCP"=8546:TCP:*:Enabled:Services
"9195:TCP"=9195:TCP:*:Enabled:Services
"9196:TCP"=9196:TCP:*:Enabled:Services
"8148:TCP"=8148:TCP:*:Enabled:Services
"8149:TCP"=8149:TCP:*:Enabled:Services
"8429:TCP"=8429:TCP:*:Enabled:Services
"8430:TCP"=8430:TCP:*:Enabled:Services
"8409:TCP"=8409:TCP:*:Enabled:Services
"8408:TCP"=8408:TCP:*:Enabled:Services
"6804:TCP"=6804:TCP:*:Enabled:Services
"6805:TCP"=6805:TCP:*:Enabled:Services
"8523:TCP"=8523:TCP:*:Enabled:Services
"8524:TCP"=8524:TCP:*:Enabled:Services
"7867:TCP"=7867:TCP:*:Enabled:Services
"7868:TCP"=7868:TCP:*:Enabled:Services
"2009:TCP"=2009:TCP:*:Enabled:Services
"2518:TCP"=2518:TCP:*:Enabled:Services
"6711:TCP"=6711:TCP:*:Enabled:Services
"6712:TCP"=6712:TCP:*:Enabled:Services
"9976:TCP"=9976:TCP:*:Enabled:Services
"9977:TCP"=9977:TCP:*:Enabled:Services
"8492:TCP"=8492:TCP:*:Enabled:Services
"8493:TCP"=8493:TCP:*:Enabled:Services
"1775:TCP"=1775:TCP:*:Enabled:Services
"2050:TCP"=2050:TCP:*:Enabled:Services
"8242:TCP"=8242:TCP:*:Enabled:Services
"8243:TCP"=8243:TCP:*:Enabled:Services
"6883:TCP"=6883:TCP:*:Enabled:Services
"6884:TCP"=6884:TCP:*:Enabled:Services
"5055:TCP"=5055:TCP:*:Enabled:Services
"8610:TCP"=8610:TCP:*:Enabled:Services
"4368:TCP"=4368:TCP:*:Enabled:Services
"7236:TCP"=7236:TCP:*:Enabled:Services
"8885:TCP"=8885:TCP:*:Enabled:Services
"8886:TCP"=8886:TCP:*:Enabled:Services
"9337:TCP"=9337:TCP:*:Enabled:Services
"9338:TCP"=9338:TCP:*:Enabled:Services
"7587:TCP"=7587:TCP:*:Enabled:Services
"7588:TCP"=7588:TCP:*:Enabled:Services
"2018:TCP"=2018:TCP:*:Enabled:Services
"1759:TCP"=1759:TCP:*:Enabled:Services
"7274:TCP"=7274:TCP:*:Enabled:Services
"7275:TCP"=7275:TCP:*:Enabled:Services
"9633:TCP"=9633:TCP:*:Enabled:Services
"9632:TCP"=9632:TCP:*:Enabled:Services
"8978:TCP"=8978:TCP:*:Enabled:Services
"8977:TCP"=8977:TCP:*:Enabled:Services
"9664:TCP"=9664:TCP:*:Enabled:Services
"9665:TCP"=9665:TCP:*:Enabled:Services
"3320:TCP"=3320:TCP:*:Enabled:Services
"5140:TCP"=5140:TCP:*:Enabled:Services
"3602:TCP"=3602:TCP:*:Enabled:Services
"5704:TCP"=5704:TCP:*:Enabled:Services
"9946:TCP"=9946:TCP:*:Enabled:Services
"9945:TCP"=9945:TCP:*:Enabled:Services
"4760:TCP"=4760:TCP:*:Enabled:Services
"8020:TCP"=8020:TCP:*:Enabled:Services
"6838:TCP"=6838:TCP:*:Enabled:Services
"6837:TCP"=6837:TCP:*:Enabled:Services
"3290:TCP"=3290:TCP:*:Enabled:Services
"5080:TCP"=5080:TCP:*:Enabled:Services
"1647:TCP"=1647:TCP:*:Enabled:Services
"1794:TCP"=1794:TCP:*:Enabled:Services
"2725:TCP"=2725:TCP:*:Enabled:Services
"3950:TCP"=3950:TCP:*:Enabled:Services
"1617:TCP"=1617:TCP:*:Enabled:Services
"1820:TCP"=1820:TCP:*:Enabled:Services
"2226:TCP"=2226:TCP:*:Enabled:Services
"6515:TCP"=6515:TCP:*:Enabled:Services
"7742:TCP"=7742:TCP:*:Enabled:Services
"9866:TCP"=9866:TCP:*:Enabled:Services
"3133:TCP"=3133:TCP:*:Enabled:Services
"4766:TCP"=4766:TCP:*:Enabled:Services
"2273:TCP"=2273:TCP:*:Enabled:Services
"1523:TCP"=1523:TCP:*:Enabled:Services

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"=65533:TCP:*:Enabled:Services
"52344:TCP"=52344:TCP:*:Enabled:Services
"6492:TCP"=6492:TCP:*:Enabled:Services
"6493:TCP"=6493:TCP:*:Enabled:Services
"3389:TCP"=3389:TCP:*:Enabled:Remote Desktop
"9586:TCP"=9586:TCP:*:Enabled:Services
"9587:TCP"=9587:TCP:*:Enabled:Services
"7164:TCP"=7164:TCP:*:Enabled:Services
"7165:TCP"=7165:TCP:*:Enabled:Services
"1680:TCP"=1680:TCP:*:Enabled:Services
"1860:TCP"=1860:TCP:*:Enabled:Services
"6554:TCP"=6554:TCP:*:Enabled:Services
"6555:TCP"=6555:TCP:*:Enabled:Services
"4430:TCP"=4430:TCP:*:Enabled:Services
"7360:TCP"=7360:TCP:*:Enabled:Services
"9679:TCP"=9679:TCP:*:Enabled:Services
"9680:TCP"=9680:TCP:*:Enabled:Services
"7820:TCP"=7820:TCP:*:Enabled:Services
"7821:TCP"=7821:TCP:*:Enabled:Services
"3430:TCP"=3430:TCP:*:Enabled:Services
"5360:TCP"=5360:TCP:*:Enabled:Services
"3727:TCP"=3727:TCP:*:Enabled:Services
"5954:TCP"=5954:TCP:*:Enabled:Services
"9414:TCP"=9414:TCP:*:Enabled:Services
"9415:TCP"=9415:TCP:*:Enabled:Services
"7414:TCP"=7414:TCP:*:Enabled:Services
"7415:TCP"=7415:TCP:*:Enabled:Services
"6289:TCP"=6289:TCP:*:Enabled:Services
"6290:TCP"=6290:TCP:*:Enabled:Services
"5023:TCP"=5023:TCP:*:Enabled:Services
"8546:TCP"=8546:TCP:*:Enabled:Services
"9195:TCP"=9195:TCP:*:Enabled:Services
"9196:TCP"=9196:TCP:*:Enabled:Services
"8148:TCP"=8148:TCP:*:Enabled:Services
"8149:TCP"=8149:TCP:*:Enabled:Services
"8429:TCP"=8429:TCP:*:Enabled:Services
"8430:TCP"=8430:TCP:*:Enabled:Services
"8408:TCP"=8408:TCP:*:Enabled:Services
"8409:TCP"=8409:TCP:*:Enabled:Services
"6804:TCP"=6804:TCP:*:Enabled:Services
"6805:TCP"=6805:TCP:*:Enabled:Services
"8523:TCP"=8523:TCP:*:Enabled:Services
"8524:TCP"=8524:TCP:*:Enabled:Services
"7867:TCP"=7867:TCP:*:Enabled:Services
"7868:TCP"=7868:TCP:*:Enabled:Services
"2009:TCP"=2009:TCP:*:Enabled:Services
"2518:TCP"=2518:TCP:*:Enabled:Services
"6711:TCP"=6711:TCP:*:Enabled:Services
"6712:TCP"=6712:TCP:*:Enabled:Services
"9976:TCP"=9976:TCP:*:Enabled:Services
"9977:TCP"=9977:TCP:*:Enabled:Services
"8492:TCP"=8492:TCP:*:Enabled:Services
"8493:TCP"=8493:TCP:*:Enabled:Services
"1775:TCP"=1775:TCP:*:Enabled:Services
"2050:TCP"=2050:TCP:*:Enabled:Services
"8242:TCP"=8242:TCP:*:Enabled:Services
"8243:TCP"=8243:TCP:*:Enabled:Services
"6883:TCP"=6883:TCP:*:Enabled:Services
"6884:TCP"=6884:TCP:*:Enabled:Services
"5055:TCP"=5055:TCP:*:Enabled:Services
"8610:TCP"=8610:TCP:*:Enabled:Services
"4368:TCP"=4368:TCP:*:Enabled:Services
"7236:TCP"=7236:TCP:*:Enabled:Services
"8885:TCP"=8885:TCP:*:Enabled:Services
"8886:TCP"=8886:TCP:*:Enabled:Services
"9338:TCP"=9338:TCP:*:Enabled:Services
"9337:TCP"=9337:TCP:*:Enabled:Services
"7587:TCP"=7587:TCP:*:Enabled:Services
"7588:TCP"=7588:TCP:*:Enabled:Services
"2018:TCP"=2018:TCP:*:Enabled:Services
"1759:TCP"=1759:TCP:*:Enabled:Services
"7274:TCP"=7274:TCP:*:Enabled:Services
"7275:TCP"=7275:TCP:*:Enabled:Services
"9633:TCP"=9633:TCP:*:Enabled:Services
"9632:TCP"=9632:TCP:*:Enabled:Services
"8977:TCP"=8977:TCP:*:Enabled:Services
"8978:TCP"=8978:TCP:*:Enabled:Services
"9664:TCP"=9664:TCP:*:Enabled:Services
"9665:TCP"=9665:TCP:*:Enabled:Services
"3320:TCP"=3320:TCP:*:Enabled:Services
"5140:TCP"=5140:TCP:*:Enabled:Services
"3602:TCP"=3602:TCP:*:Enabled:Services
"5704:TCP"=5704:TCP:*:Enabled:Services
"9945:TCP"=9945:TCP:*:Enabled:Services
"9946:TCP"=9946:TCP:*:Enabled:Services
"4760:TCP"=4760:TCP:*:Enabled:Services
"8020:TCP"=8020:TCP:*:Enabled:Services
"6838:TCP"=6838:TCP:*:Enabled:Services
"6837:TCP"=6837:TCP:*:Enabled:Services
"3290:TCP"=3290:TCP:*:Enabled:Services
"5080:TCP"=5080:TCP:*:Enabled:Services
"1647:TCP"=1647:TCP:*:Enabled:Services
"1794:TCP"=1794:TCP:*:Enabled:Services
"2725:TCP"=2725:TCP:*:Enabled:Services
"3950:TCP"=3950:TCP:*:Enabled:Services
"1617:TCP"=1617:TCP:*:Enabled:Services
"1820:TCP"=1820:TCP:*:Enabled:Services
"2226:TCP"=2226:TCP:*:Enabled:Services
"6515:TCP"=6515:TCP:*:Enabled:Services
"7742:TCP"=7742:TCP:*:Enabled:Services
"9866:TCP"=9866:TCP:*:Enabled:Services
"3133:TCP"=3133:TCP:*:Enabled:Services
"4766:TCP"=4766:TCP:*:Enabled:Services
"2273:TCP"=2273:TCP:*:Enabled:Services
"1523:TCP"=1523:TCP:*:Enabled:Services


~~ EOF ~~
Post #20
Hello Nick23

Thank you for letting me know about Combofix.


Please read through all of these instruction before beginning (you may also find it helpful to print them out).

  • Please download HelpAsst_mebroot_fix by clicking here and save the file to your desktop.
  • Next, please make sure that you Close all other open programs and windows.
  • Double click on the file to run it and follow any prompts.
  • If the tool detects an mbr infection, please allow it to run mbr -f and shutdown your computer.
  • Upon restarting, please wait about 5 minutes, click Start > Run and type the following bolded command into the run box, then hit Enter:

helpasst -mbrt

  • NOTE: Please make sure you leave a space between helpasst and -mbrt
  • When the tool completes its run, a log will open.
  • Please post the contents of the log in your next reply.


*In the event the tool does not detect an mbr infection and completes, click Start > Run and type the following bolded command, then hit Enter:

mbr -f

  • Now, please do the Start > Run > mbr -f command a second time.
  • Now shut down the computer (do not restart, but shut it down), wait a few minutes then start it back up.
  • Give it about 5 minutes, then click Start > Run and type the following bolded command, then hit Enter.

helpasst -mbrt

  • NOTE: Please make sure you leave a space between helpasst and -mbrt
  • When the tool completes its run, a log will open.
  • Please post the contents of the log in your next reply.

**Important note to Dell Users - fixing the mbr may prevent access the the Dell Restore Utility, which allows you to press a key on startup and revert your computer to a factory delivered state. There are a couple of known fixes for said condition, though the methods are somewhat advanced. If you are unwilling to take such a risk, you should not allow the tool to execute mbr -f nor execute the command manually, and you will either need to restore your computer to a factory state or allow your computer to remain having an infected mbr (the latter not recommended).
Post #21
i Tried to do the scan the first way a couple of times but nothing happened so i had to do it the second way and i finally got a log for you i hope i did it right.

C:\Documents and Settings\Nick\Desktop\HelpAsst_mebroot_fix.exe
Thu 09/15/2011 at 19:44:25.07

HelpAssistant account Inactive

~~ Checking for termsrv32.dll ~~

termsrv32.dll not found

~~ Checking firewall ports ~~

HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\globallyopenports\list

HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list

~~ Checking profile list ~~

No HelpAssistant profile in registry

~~ Checking mbr ~~

user & kernel MBR OK

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Status check on Thu 09/15/2011 at 20:51:09.20

Account active No
Local Group Memberships

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys spvp.sys hal.dll >>UNKNOWN [0x831CC938]<<
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x017499F00
malicious code @ sector 0x017499F03 !
PE file found in sector at 0x017499F19 !

~~ Checking for termsrv32.dll ~~

termsrv32.dll not found


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %systemroot%\System32\termsrv.dll

~~ Checking profile list ~~

No HelpAssistant profile in registry

~~ Checking for HelpAssistant directories ~~

HelpAssistant

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]


~~ EOF ~~
Post #22
Hello Nick23

We are making progress.

Please do the following:

  • Click on Start > Run and type helpasst -folder then hit Enter.
  • The tool will run and prompt for confirmation to remove any HelpAssistant folders found.
  • If prompted, restart your computer.
  • When complete, click on Start > Run and type helpasst -mbrt then hit Enter.
  • Post the new log that opens when it finishes.
Post #24
Due to inactivity, this topic has been closed. If you are the topic starter and need this topic reopened, please PM a staff member (include the address of this thread in your request). Everyone else please start a new topic.
Post #26
Sorry about the delay im still not feeling to well but hear is the next log that you ased me to do, hope it helps. Thanks again for helping me I really appreciate it.

C:\Documents and Settings\Nick\Desktop\HelpAsst_mebroot_fix.exe
Thu 09/15/2011 at 19:44:25.07

HelpAssistant account Inactive

~~ Checking for termsrv32.dll ~~

termsrv32.dll not found

~~ Checking firewall ports ~~

HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\globallyopenports\list

HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list

~~ Checking profile list ~~

No HelpAssistant profile in registry

~~ Checking mbr ~~

user & kernel MBR OK

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Status check on Thu 09/15/2011 at 20:51:09.20

Account active No
Local Group Memberships

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys spvp.sys hal.dll >>UNKNOWN [0x831CC938]<<
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x017499F00
malicious code @ sector 0x017499F03 !
PE file found in sector at 0x017499F19 !

~~ Checking for termsrv32.dll ~~

termsrv32.dll not found


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %systemroot%\System32\termsrv.dll

~~ Checking profile list ~~

No HelpAssistant profile in registry

~~ Checking for HelpAssistant directories ~~

HelpAssistant

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]


~~ EOF ~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Folder removal routine ~ Sat 09/24/2011 at 2:48:57.42

~~ Checking for termsrv32.dll ~~

termsrv32.dll not found

~~ Checking for HelpAssistant directories ~~

C:\DOCUME~1\HelpAssistant found
backing up C:\DOCUME~1\HelpAssistant

C:\DOCUME~1\HelpAssistant removed

~~ EOF ~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Status check on Sat 09/24/2011 at 6:43:32.77

Account active No
Local Group Memberships

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys spmp.sys hal.dll >>UNKNOWN [0x831CC938]<<
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x017499F00
malicious code @ sector 0x017499F03 !
PE file found in sector at 0x017499F19 !

~~ Checking for termsrv32.dll ~~

termsrv32.dll not found


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %systemroot%\System32\termsrv.dll

~~ Checking profile list ~~

No HelpAssistant profile in registry

~~ Checking for HelpAssistant directories ~~

none found

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]


~~ EOF ~~
Post #27
Hello Nick23

Sorry about the delay im still not feeling to well

Sorry to hear that you are still feeling ill. I usually close threads after 5 days with no reply, but if you think you may need more time just let me know and I will leave your thread open for an extended period :)

That seems to have taken care of one part of the infection, but we still have a fair bit of work to do.

I would like to see another ComboFix log.

Please run ComboFix again according to the instructions I provided in post number 16.

If ComboFix informs you that an update is available, please allow the update to be installed.

Please post the ComboFix log in your next reply :)
Post #28
Yea i had to update it but hear is the new combofix log for you thanks again for putting up with all this i have the worst luc with computers.

ComboFix 11-09-26.02 - Nick 09/26/2011 22:04:30.3.1 - x86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\midimap.dll . . . is infected!!
.
.
((((((((((((((((((((((((( Files Created from 2011-08-27 to 2011-09-27 )))))))))))))))))))))))))))))))
.
.
2011-09-14 00:32 . 2011-09-14 00:32 ——– d—–w- C:\HelpAsst_backup
2011-09-09 05:54 . 2011-09-27 01:02 ——– d—–w- c:\program files\WinClamAVShield
2011-09-09 05:49 . 2011-09-09 05:49 142592 —-a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-09-09 05:49 . 2011-09-27 00:51 ——– d—–w- c:\documents and settings\Nick\Application Data\Spyware Terminator
2011-09-09 05:48 . 2011-09-27 01:02 ——– d—–w- c:\documents and settings\All Users\Application Data\Spyware Terminator
2011-09-09 05:48 . 2011-09-09 05:57 ——– d—–w- c:\program files\Spyware Terminator
2011-09-06 08:04 . 2011-09-06 08:04 ——– d—–w- C:\found.000
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-09 09:12 . 2008-04-13 22:41 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-07-15 13:29 . 2008-04-13 17:47 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-04-13 17:27 10496 —-a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-06 23:52 . 2010-12-03 22:02 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 23:52 . 2010-12-03 22:02 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-08-03 07:19 . 2011-04-01 06:05 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
——- Sigcheck ——-
Note: Unsigned files aren't necessarily malware.
.
[-] 2011-04-27 . 163096F2D0D3FAB77CB577BCFBEE59CE . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2011-04-27 . 163096F2D0D3FAB77CB577BCFBEE59CE . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\tcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
.
[-] 2008-04-28 09:18 . CB75214525D36F923D3948DA3CD1562D . 1390080 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll
.
[-] 2008-04-28 . A55B8899D2EA2E800061BCFD456E34DC . 547328 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
.
[7] 2008-04-13 . D7075E95AA599EE77B7A89D39296BD3D . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll
[-] 2008-03-20 . 1CA39C7E1423FF8821664E0E06FEA55E . 343040 . . [7.0.2600.5508] . . c:\windows\system32\msvcrt.dll
[7] 2004-08-04 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll
.
[-] 2008-03-20 . F92D8964B5286DE225BD2B6BF89764BE . 578560 . . [5.1.2600.5508] . . c:\windows\system32\user32.dll
.
[-] 2008-08-18 . 4A90F51B778FA0157F60D206E8B37D2A . 1616384 . . [6.00.2900.5512] . . c:\windows\explorer.exe
.
[-] 2008-04-13 . 18B0915F58A5342AB0F3D01D57261E32 . 267264 . . [5.1.2600.5512] . . c:\windows\regedit.exe
.
[-] 2008-04-26 . BC298B78B311397B421D4D52B44B49EC . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
[-] 2008-04-28 . B5E8782D4AF1B3756F38E11E7C157BBE . 25088 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
.
[-] 2008-04-28 . A913E1FF4C0BDA15FC542430182EB7B6 . 368640 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll
.
[-] 2008-04-28 . 66620EE56B0FFB1B267BD24ECF942A9B . 42496 . . [5.1.2600.5512] . . c:\windows\system32\midimap.dll
.
((((((((((((((((((((((((((((( SnapShot_2011-09-13_04.21.07 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-09-27 00:40 . 2011-09-27 00:40 16384 c:\windows\Temp\Perflib_Perfdata_560.dat
+ 2008-04-13 22:41 . 2011-09-09 09:12 599040 c:\windows\system32\dllcache\crypt32.dll
- 2008-04-13 22:41 . 2011-09-03 10:17 599040 c:\windows\system32\dllcache\crypt32.dll
+ 2009-08-13 20:56 . 2011-09-14 00:08 46249416 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-05-30 2495816]
.
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2011-05-30 15:33 2495816 —-a-w- c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-05-30 2495816]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-05-30 2495816]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AnalogClock"="c:\program files\Windows7\Analog Clock\AnalogClock.exe" [2005-11-05 480256]
"TransBar"="c:\program files\Windows7\TransBar\TransBar.exe" [2005-06-01 65536]
"SpeedBitVideoAccelerator"="c:\program files\SpeedBit Video Accelerator\VideoAccelerator.exe" [2009-09-30 1435240]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-20 39408]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"OnlineVault"="c:\documents and settings\Nick\My Documents\Online Vault\OnlineVault.exe" [2010-05-28 2459136]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KRun"="c:\program files\Windows7\RunMe\RunMe.exe" [2007-04-06 518656]
"Viena Explorer"="c:\program files\Windows7\Vienna Explorer\Vienna Explorer.exe" [2006-11-18 581632]
"Visual Task Tips"="c:\program files\Windows7\VisualTaskTips\VisualTaskTips.exe" [2007-09-05 36352]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 88363]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-11-03 98304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-11-03 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-11-03 118784]
"RTHDCPL"="RTHDCPL.EXE" [2009-12-04 18789408]
"lxctmon.exe"="c:\program files\Lexmark 5400 Series\lxctmon.exe" [2007-03-19 291760]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2011-04-18 2334560]
"LXCTCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll" [2006-11-21 106496]
"Conime"="c:\windows\system32\conime.exe" [2008-04-28 52224]
"EKAIO2StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKAiO2MUI.exe" [2011-05-27 2729472]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2011-09-09 2216960]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2010-03-11 124928]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Launch Whitesmoke Translator.lnk - c:\documents and settings\Nick\My Documents\Programs\WSTrayDictMode.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgmfapx.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\AiOHomeCenter.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\Kodak.Statistics.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\NetworkPrinterDiscovery.exe"=
"c:\\Program Files\\Kodak\\AiO\\Firmware\\KodakAiOUpdater.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kodak\\Installer\\Setup.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgnsx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8567:TCP"= 8567:TCP:*:Disabled:BitComet 8567 TCP
"8567:UDP"= 8567:UDP:*:Disabled:BitComet 8567 UDP
"8897:TCP"= 8897:TCP:*:Disabled:BitComet 8897 TCP
"8897:UDP"= 8897:UDP:*:Disabled:BitComet 8897 UDP
"12029:TCP"= 12029:TCP:*:Disabled:BitComet 12029 TCP
"12029:UDP"= 12029:UDP:*:Disabled:BitComet 12029 UDP
"9322:TCP"= 9322:TCP:EKDiscovery
"5353:UDP"= 5353:UDP:*:Disabled:Bonjour Port 5353
"5353:TCP"= 5353:TCP:printer
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2/22/2011 8:13 AM 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [3/16/2011 4:03 PM 32592]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/26/2009 1:55 PM 691696]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [1/7/2011 6:41 AM 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [4/5/2011 12:59 AM 297168]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [9/9/2011 1:49 AM 142592]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [2/8/2011 5:33 AM 269520]
R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\EKAiOHostService.exe [4/11/2011 4:59 PM 375296]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [4/14/2011 9:28 PM 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2/10/2011 7:53 AM 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2/10/2011 7:53 AM 27216]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [4/18/2011 5:39 PM 7398752]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [5/17/2011 12:31 AM 1025352]
S3 xcpip;TCP/IP Protocol Driver;c:\windows\system32\drivers\xcpip.sys –> c:\windows\system32\drivers\xcpip.sys [?]
S3 xpsec;IPSEC driver;c:\windows\system32\drivers\xpsec.sys –> c:\windows\system32\drivers\xpsec.sys [?]
.
.
——- Supplementary Scan ——-
.
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
TCP: DhcpNameServer = 192.168.1.1
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll
FF - ProfilePath - c:\documents and settings\Nick\Application Data\Mozilla\Firefox\Profiles\4zniteye.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4e02abbf&v;=7.008.031.001&i;=23&tp;=ab&iy;=&ychte;=us&lng;=en-US&q;=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-26 22:29
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCTCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-343818398-796845957-1177238915-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(464)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\COMRes.dll
c:\windows\system32\cscui.dll
.
- - - - - - - > 'lsass.exe'(520)
c:\windows\system32\SETUPAPI.dll
.
- - - - - - - > 'explorer.exe'(240)
c:\windows\system32\WININET.dll
c:\program files\Windows7\VisualTaskTips\VttHooks.dll
c:\windows\system32\msctfime.ime
c:\windows\system32\COMRes.dll
c:\windows\System32\cscui.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\MSVCP60.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
Completion time: 2011-09-26 22:34:51
ComboFix-quarantined-files.txt 2011-09-27 02:34
ComboFix2.txt 2011-09-13 04:27
ComboFix3.txt 2011-09-09 03:47
.
Pre-Run: 133,454,278,656 bytes free
Post-Run: 133,459,591,168 bytes free
.
Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 37E5B9E270B535A46F3744871C7207B4
Post #29
Hello Nick23

Can you confirm that you uninstalled Bitcomet?

  • MGADiag


    • Please download MGADiag by clicking here and save it to your desktop.
    • Double click the [external image: Posted Image] icon on your desktop.
    • Push [external image: Posted Image]
    • Push [external image: Posted Image]
    • Go to Start -> Run and type in "Notepad"
    • Go to Edit -> Paste in notepad.
    • "x" out all of the numbers and letters in the line beginning with "Windows Product Key:"
    • Copy and paste that log here.


    I would like to take a closer look at some of the files on your machine:

  • Please scan the following files


    • Please go to VirusTotal


    • On the page you'll find a "Browse" button.
    • Click on the Browse button.
    • In the Choose File to Upload window which opens, copy and paste this into the File Name box.


    c:\windows\system32\midimap.dll


    • Next, click the Open button.
    • Then click the "Send File" button just below.
    • This will scan the file. Please be patient.
    • If you get a message saying File has already been analyzed: click Reanalyze file now.
    • Once scanned, copy and paste the link to the results page in your next reply.
    • Please repeat this procedure for the following files:

    c:\windows\system32\winlogon.exe
    c:\windows\system32\ctfmon.exe

    Please let me know about BitComet and post the MGADiag log and the VirusTotal scan links in your next reply :)
Post #30
i thought that i removed bitcomet i went into add/remove programs and removed it. I'll try what you said to do next and let you now what happens thanks again.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI