What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Massive infection! Browser redirects, slow computer, error message

21 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #17
ComboFix 11-09-10.03 - Anna 09/13/2011 19:00:08.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.958.525 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Anna.YOUR-D0F670B45A\Desktop\CFscript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
.
((((((((((((((((((((((((( Files Created from 2011-08-13 to 2011-09-13 )))))))))))))))))))))))))))))))
.
.
2011-09-11 20:16 . 2011-09-06 20:37 320856 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-09-11 20:16 . 2011-09-06 20:36 20568 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-09-11 20:16 . 2011-09-06 20:36 34392 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-09-11 20:16 . 2011-09-06 20:38 442200 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-09-11 20:16 . 2011-09-06 20:36 52568 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-09-11 20:16 . 2011-09-06 20:36 110552 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2011-09-11 20:16 . 2011-09-06 20:36 104536 —-a-w- c:\windows\system32\drivers\aswmon.sys
2011-09-11 20:16 . 2011-09-06 20:33 30808 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2011-09-11 20:15 . 2011-09-06 20:45 41184 —-a-w- c:\windows\avastSS.scr
2011-09-11 20:15 . 2011-09-06 20:45 199304 —-a-w- c:\windows\system32\aswBoot.exe
2011-09-11 20:15 . 2011-09-11 20:15 ——– d—–w- c:\program files\AVAST Software
2011-09-11 20:15 . 2011-09-11 20:15 ——– d—–w- c:\documents and settings\All Users\Application Data\AVAST Software
2011-09-09 21:44 . 2011-09-09 21:44 388096 —-a-r- c:\documents and settings\Anna.YOUR-D0F670B45A\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-09-09 21:27 . 2011-07-06 23:52 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-09-09 21:26 . 2011-09-09 22:04 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-09-09 21:26 . 2011-07-06 23:52 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-11 00:51 . 2004-08-04 11:00 96512 —-a-w- c:\windows\system32\drivers\atapi.sys
2009-11-02 15:57 . 2009-11-02 15:57 8080728 —-a-w- c:\program files\Firefox Setup 3.5.4.exe
2008-10-27 00:05 . 2008-10-27 00:05 10076 —-a-w- c:\program files\Common Files\moti.reg
.
c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp .exe
c:\program files\HP\HP Software Update\HPwuSchd2 .exe
c:\program files\QuickTime\qttask   .exe
c:\program files\QuickTime\qttask .exe
c:\program files\Windows Live\Messenger\MsnMsgr .exe
c:\program files\Zone Labs\ZoneAlarm\zlclient .exe
.
((((((((((((((((((((((((((((( SnapShot@2011-09-11_01.33.47 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-12 05:02 . 2009-07-12 05:02 51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 61760 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 61760 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 53568 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 53568 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 63296 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 63296 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 35648 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 35648 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
- 2009-07-12 05:05 . 2009-07-12 05:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
+ 2009-07-12 04:05 . 2009-07-12 04:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
- 2009-07-12 05:05 . 2009-07-12 05:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
+ 2009-07-12 04:05 . 2009-07-12 04:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
+ 2011-09-13 22:47 . 2011-09-13 22:47 16384 c:\windows\Temp\Perflib_Perfdata_360.dat
+ 2009-07-12 04:02 . 2009-07-12 04:02 653120 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 653120 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 569664 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 569664 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
+ 2009-07-12 04:05 . 2009-07-12 04:05 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
- 2009-07-12 05:05 . 2009-07-12 05:05 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
+ 2006-06-19 16:15 . 2005-07-23 05:14 237568 c:\windows\SMINST\RECGUARD.exe
+ 2009-07-12 04:02 . 2009-07-12 04:02 3780424 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 3780424 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 3765048 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 3765048 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 20:45 122512 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [N/A]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask .exe -atboottime" [X]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [N/A]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 1983816]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-03 18085888]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-05-10 86016]
"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 49152]
"D-Link AirPlus G"="c:\program files\D-Link\AirPlus G\AirGCFG.exe" [2005-03-18 1228800]
"PCDrProfiler"="" [N/A]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568]
"nwiz"="nwiz.exe" [2006-05-10 1519616]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-10 7311360]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-06-19 180269]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2010-05-07 165208]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 18:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1039:TCP"= 1039:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [9/11/2011 4:16 PM 442200]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [9/11/2011 4:16 PM 320856]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 10:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/17/2010 10:15 AM 66632]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [9/11/2011 4:16 PM 20568]
R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\system32\nlssrv32.exe [3/25/2010 11:49 AM 57344]
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [3/22/2005 8:17 PM 547744]
S2 0248541315702947mcinstcleanup;McAfee Application Installer Cleanup (0248541315702947);c:\docume~1\ANNA~1.YOU\LOCALS~1\Temp\024854~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service –> c:\docume~1\ANNA~1.YOU\LOCALS~1\Temp\024854~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys –> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/17/2010 10:15 AM 12872]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=EN_US&c;=63&bd;=PRESARIO&pf;=desktop
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=63&bd;=PRESARIO&pf;=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=63&bd;=PRESARIO&pf;=desktop
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = [removed] [removed]
FF - ProfilePath - c:\documents and settings\Anna.YOUR-D0F670B45A\Application Data\Mozilla\Firefox\Profiles\oiz81fj2.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Ext: WOT: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} - %profile%\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Ext: OptimizeGoogle: [removed] - %profile%\extensions\[removed]
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: avast! WebRep: [removed] - c:\program files\AVAST Software\Avast\WebRep\FF
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-13 19:15
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3e,61,a2,24,54,72,0f,48,a5,91,f3,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3e,61,a2,24,54,72,0f,48,a5,91,f3,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(536)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(3184)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2011-09-13 19:20:52
ComboFix-quarantined-files.txt 2011-09-13 23:20
ComboFix2.txt 2011-09-13 14:19
ComboFix3.txt 2011-09-11 20:35
ComboFix4.txt 2011-09-11 01:40
ComboFix5.txt 2011-09-13 22:55
.
Pre-Run: 98,488,623,104 bytes free
Post-Run: 98,454,409,216 bytes free
.
- - End Of File - - 2FABF62C0D2CB6FFCB211108068F1781
Post #18
Hi AgentFrog,

I apologize but I need you to download the attached script to your desktop, and just drag it into combofix, don't even open it just drag it into ComboFix.

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Attachments:

Post #19
Sorry I wasn't available yesterday. Hope I did things right this time with the scan. I saved it to my desktop and just dragged it onto combofix.




ComboFix 11-09-10.03 - Anna 09/15/2011 20:25:41.5.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.958.417 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Anna.YOUR-D0F670B45A\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Created a new restore point
.
- REDUCED FUNCTIONALITY MODE -
.
.
((((((((((((((((((((((((( Files Created from 2011-08-16 to 2011-09-16 )))))))))))))))))))))))))))))))
.
.
2011-09-13 23:27 . 2011-09-13 23:27 ——– d—–w- c:\windows\SxsCaPendDel
2011-09-13 13:53 . 2011-06-23 18:36 743424 ——w- c:\windows\system32\dllcache\iedvtool.dll
2011-09-13 13:53 . 2010-09-18 06:53 953856 ——w- c:\windows\system32\dllcache\mfc40u.dll
2011-09-13 13:52 . 2010-08-23 16:12 617472 ——w- c:\windows\system32\dllcache\comctl32.dll
2011-09-13 13:52 . 2010-06-14 14:31 744448 ——w- c:\windows\system32\dllcache\helpsvc.exe
2011-09-13 13:51 . 2010-11-02 15:17 40960 ——w- c:\windows\system32\dllcache\ndproxy.sys
2011-09-13 13:50 . 2011-06-24 14:10 139656 ——w- c:\windows\system32\dllcache\rdpwd.sys
2011-09-13 13:50 . 2011-04-21 13:37 105472 ——w- c:\windows\system32\dllcache\mup.sys
2011-09-13 13:46 . 2011-07-08 14:02 10496 ——w- c:\windows\system32\dllcache\ndistapi.sys
2011-09-13 13:46 . 2010-10-11 14:59 45568 ——w- c:\windows\system32\dllcache\wab.exe
2011-09-11 20:16 . 2011-09-06 20:37 320856 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-09-11 20:16 . 2011-09-06 20:36 20568 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-09-11 20:16 . 2011-09-06 20:36 34392 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-09-11 20:16 . 2011-09-06 20:38 442200 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-09-11 20:16 . 2011-09-06 20:36 52568 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-09-11 20:16 . 2011-09-06 20:36 110552 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2011-09-11 20:16 . 2011-09-06 20:36 104536 —-a-w- c:\windows\system32\drivers\aswmon.sys
2011-09-11 20:16 . 2011-09-06 20:33 30808 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2011-09-11 20:15 . 2011-09-06 20:45 41184 —-a-w- c:\windows\avastSS.scr
2011-09-11 20:15 . 2011-09-06 20:45 199304 —-a-w- c:\windows\system32\aswBoot.exe
2011-09-11 20:15 . 2011-09-11 20:15 ——– d—–w- c:\program files\AVAST Software
2011-09-11 20:15 . 2011-09-11 20:15 ——– d—–w- c:\documents and settings\All Users\Application Data\AVAST Software
2011-09-09 21:44 . 2011-09-09 21:44 388096 —-a-r- c:\documents and settings\Anna.YOUR-D0F670B45A\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-09-09 21:27 . 2011-07-06 23:52 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-09-09 21:26 . 2011-09-09 22:04 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-09-09 21:26 . 2011-07-06 23:52 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-11 00:51 . 2004-08-04 11:00 96512 —-a-w- c:\windows\system32\drivers\atapi.sys
2011-07-15 13:29 . 2004-08-04 11:00 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2004-08-04 11:00 10496 —-a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2004-08-04 11:00 139656 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2004-08-04 11:00 916480 —-a-w- c:\windows\system32\wininet.dll
2011-06-23 18:36 . 2004-08-04 11:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-06-23 18:36 . 2004-08-04 11:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2004-08-04 11:00 385024 —-a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2004-08-04 11:00 293376 —-a-w- c:\windows\system32\winsrv.dll
2009-11-02 15:57 . 2009-11-02 15:57 8080728 —-a-w- c:\program files\Firefox Setup 3.5.4.exe
2008-10-27 00:05 . 2008-10-27 00:05 10076 —-a-w- c:\program files\Common Files\moti.reg
.
.
((((((((((((((((((((((((((((( SnapShot@2011-09-11_01.33.47 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-04-19 02:51 . 2011-04-19 02:51 51024 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_4ddc769f\vcomp90.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_730c3508\mfc90rus.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_730c3508\mfc90kor.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_730c3508\mfc90jpn.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_730c3508\mfc90ita.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_730c3508\mfc90fra.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_730c3508\mfc90esp.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_730c3508\mfc90esn.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 53584 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_730c3508\mfc90enu.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 63312 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_730c3508\mfc90deu.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_730c3508\mfc90cht.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 35664 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_730c3508\mfc90chs.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 61760 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 61760 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 53568 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 53568 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 63296 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 63296 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 35648 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 35648 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_028bc148\mfcm90u.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_028bc148\mfcm90.dll
+ 2009-07-12 04:05 . 2009-07-12 04:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
- 2009-07-12 05:05 . 2009-07-12 05:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
+ 2009-07-12 04:05 . 2009-07-12 04:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
- 2009-07-12 05:05 . 2009-07-12 05:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
+ 2011-05-14 00:17 . 2011-05-14 00:17 65536 c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920\vcomp.dll
+ 2011-05-13 23:45 . 2011-05-13 23:45 49152 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80KOR.dll
+ 2011-05-13 23:45 . 2011-05-13 23:45 49152 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80JPN.dll
+ 2011-05-13 23:45 . 2011-05-13 23:45 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80ITA.dll
+ 2011-05-13 23:45 . 2011-05-13 23:45 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80FRA.dll
+ 2011-05-13 23:45 . 2011-05-13 23:45 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80ESP.dll
+ 2011-05-13 23:45 . 2011-05-13 23:45 57344 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80ENU.dll
+ 2011-05-13 23:45 . 2011-05-13 23:45 65536 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80DEU.dll
+ 2011-05-13 23:45 . 2011-05-13 23:45 45056 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80CHT.dll
+ 2011-05-13 23:45 . 2011-05-13 23:45 40960 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789\mfc80CHS.dll
+ 2011-05-14 05:06 . 2011-05-14 05:06 57856 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b\mfcm80u.dll
+ 2011-05-14 05:23 . 2011-05-14 05:23 69632 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b\mfcm80.dll
+ 2011-05-13 22:37 . 2011-05-13 22:37 97280 c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa\ATL80.dll
+ 2011-09-16 00:29 . 2011-09-16 00:29 16384 c:\windows\Temp\Perflib_Perfdata_714.dat
- 2009-11-01 19:24 . 2010-01-23 08:11 46080 c:\windows\system32\tzchange.exe
+ 2009-11-01 19:24 . 2011-07-08 13:49 46080 c:\windows\system32\tzchange.exe
+ 2004-08-04 11:00 . 2010-08-27 05:57 99840 c:\windows\system32\srvsvc.dll
+ 2004-08-04 11:00 . 2010-08-17 13:17 58880 c:\windows\system32\spoolsv.exe
+ 2009-11-06 02:17 . 2009-11-06 02:17 11600 c:\windows\system32\mui\0409\mscorees.dll
+ 2004-08-04 11:00 . 2011-06-23 18:36 66560 c:\windows\system32\mshtmled.dll
- 2004-08-04 11:00 . 2009-03-08 09:31 66560 c:\windows\system32\mshtmled.dll
- 2009-03-08 09:31 . 2010-02-25 06:24 55296 c:\windows\system32\msfeedsbs.dll
+ 2009-03-08 09:31 . 2011-06-23 18:36 55296 c:\windows\system32\msfeedsbs.dll
- 2004-08-04 11:00 . 2010-02-25 06:24 25600 c:\windows\system32\jsproxy.dll
+ 2004-08-04 11:00 . 2011-06-23 18:36 25600 c:\windows\system32\jsproxy.dll
+ 2004-08-04 11:00 . 2010-11-18 18:12 81920 c:\windows\system32\isign32.dll
- 2004-08-04 11:00 . 2008-04-14 00:11 81920 c:\windows\system32\isign32.dll
- 2004-08-04 11:00 . 2008-04-14 00:11 80384 c:\windows\system32\iccvid.dll
+ 2004-08-04 11:00 . 2010-06-17 14:03 80384 c:\windows\system32\iccvid.dll
+ 2004-08-04 11:00 . 2010-11-02 15:17 40960 c:\windows\system32\drivers\ndproxy.sys
- 2004-08-04 11:00 . 2008-04-14 00:11 45568 c:\windows\system32\dnsrslvr.dll
+ 2004-08-04 11:00 . 2009-04-20 17:17 45568 c:\windows\system32\dnsrslvr.dll
- 2009-11-01 21:28 . 2010-02-25 06:24 12800 c:\windows\system32\dllcache\xpshims.dll
+ 2009-11-01 21:28 . 2011-06-23 18:36 12800 c:\windows\system32\dllcache\xpshims.dll
+ 2010-08-27 05:57 . 2010-08-27 05:57 99840 c:\windows\system32\dllcache\srvsvc.dll
+ 2010-08-17 13:17 . 2010-08-17 13:17 58880 c:\windows\system32\dllcache\spoolsv.exe
- 2004-08-04 11:00 . 2009-03-08 09:31 66560 c:\windows\system32\dllcache\mshtmled.dll
+ 2004-08-04 11:00 . 2011-06-23 18:36 66560 c:\windows\system32\dllcache\mshtmled.dll
+ 2009-11-01 21:28 . 2011-06-23 18:36 55296 c:\windows\system32\dllcache\msfeedsbs.dll
- 2009-11-01 21:28 . 2010-02-25 06:24 55296 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2004-08-04 11:00 . 2011-06-23 18:36 43520 c:\windows\system32\dllcache\licmgr10.dll
+ 2004-08-04 11:00 . 2011-06-23 18:36 25600 c:\windows\system32\dllcache\jsproxy.dll
- 2004-08-04 11:00 . 2010-02-25 06:24 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2010-11-18 18:12 . 2010-11-18 18:12 81920 c:\windows\system32\dllcache\isign32.dll
+ 2009-04-20 17:17 . 2009-04-20 17:17 45568 c:\windows\system32\dllcache\dnsrslvr.dll
+ 2010-01-13 14:01 . 2010-01-13 14:01 86016 c:\windows\system32\dllcache\cabview.dll
+ 2010-03-05 14:37 . 2010-03-05 14:37 65536 c:\windows\system32\dllcache\asycfilt.dll
+ 2004-08-04 11:00 . 2010-01-13 14:01 86016 c:\windows\system32\cabview.dll
+ 2004-08-04 11:00 . 2010-03-05 14:37 65536 c:\windows\system32\asycfilt.dll
+ 2010-09-23 19:55 . 2010-09-23 19:55 81920 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Security.dll
- 2008-05-28 05:49 . 2008-05-28 05:49 77824 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
+ 2010-09-23 06:26 . 2010-09-23 06:26 77824 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
- 2008-05-28 05:49 . 2008-05-28 05:49 86016 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
+ 2010-09-23 06:26 . 2010-09-23 06:26 86016 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
- 2008-05-28 05:49 . 2008-05-28 05:49 81920 c:\windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
+ 2010-09-23 06:26 . 2010-09-23 06:26 81920 c:\windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
+ 2010-09-23 07:17 . 2010-09-23 07:17 32768 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
- 2008-05-28 06:30 . 2008-05-28 06:30 32768 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
+ 2010-09-23 07:17 . 2010-09-23 07:17 24576 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_filter.dll
- 2003-02-21 09:19 . 2003-02-21 09:19 24576 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_filter.dll
- 2006-06-19 16:15 . 2010-04-04 08:37 23040 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2006-06-19 16:15 . 2011-09-13 23:44 23040 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2006-06-19 16:15 . 2011-09-13 23:44 27136 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2006-06-19 16:15 . 2010-04-04 08:37 27136 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2006-06-19 16:15 . 2010-04-04 08:37 11264 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2006-06-19 16:15 . 2011-09-13 23:44 11264 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2006-06-19 16:15 . 2011-09-13 23:44 12288 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2006-06-19 16:15 . 2010-04-04 08:37 12288 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2011-02-16 21:32 . 2011-06-02 18:12 29926 c:\windows\Installer\{33F8EAD4-B6EC-498B-B487-696B973D1C0C}\MsblIco.Exe
+ 2011-09-16 00:31 . 2011-09-16 00:31 29926 c:\windows\Installer\{33F8EAD4-B6EC-498B-B487-696B973D1C0C}\MsblIco.Exe
+ 2007-03-22 23:07 . 2007-03-22 23:07 78168 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\RM.DLL
+ 2007-03-22 23:07 . 2007-03-22 23:07 41824 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\RECALL.DLL
+ 2007-03-22 23:05 . 2007-03-22 23:05 97632 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\PP7X32.DLL
+ 2007-04-19 17:53 . 2007-04-19 17:53 69984 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\OUTLRPC.DLL
+ 2007-03-22 23:07 . 2007-03-22 23:07 80224 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\DLGSETP.DLL
+ 2007-03-22 23:07 . 2007-03-22 23:07 91488 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\ADDRPARS.DLL
+ 2011-09-13 23:24 . 2010-02-25 06:24 12800 c:\windows\ie8updates\KB2559049-IE8\xpshims.dll
+ 2011-09-13 23:24 . 2009-03-08 09:31 66560 c:\windows\ie8updates\KB2559049-IE8\mshtmled.dll
+ 2011-09-13 23:24 . 2010-02-25 06:24 55296 c:\windows\ie8updates\KB2559049-IE8\msfeedsbs.dll
+ 2011-09-13 23:24 . 2009-03-08 09:34 43008 c:\windows\ie8updates\KB2559049-IE8\licmgr10.dll
+ 2011-09-13 23:24 . 2010-02-25 06:24 25600 c:\windows\ie8updates\KB2559049-IE8\jsproxy.dll
+ 2011-09-13 23:29 . 2011-09-13 23:29 90112 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_7a9038ad\System.Drawing.Design.dll
+ 2011-09-13 23:29 . 2011-09-13 23:29 61440 c:\windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_d5d29722\CustomMarshalers.dll
+ 2011-09-13 23:29 . 2011-09-13 23:29 81920 c:\windows\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll
+ 2009-11-01 19:21 . 2011-02-17 12:32 5120 c:\windows\system32\xpsp4res.dll
- 2006-06-19 16:15 . 2010-04-04 08:37 4096 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2006-06-19 16:15 . 2011-09-13 23:44 4096 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2011-04-19 02:51 . 2011-04-19 02:51 653136 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_31a54e43\msvcr90.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 569680 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_31a54e43\msvcp90.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_31a54e43\msvcm90.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 653120 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 653120 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 569664 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 569664 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
- 2009-07-12 05:05 . 2009-07-12 05:05 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
+ 2009-07-12 04:05 . 2009-07-12 04:05 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 159048 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_92453bb7\atl90.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
+ 2011-05-14 05:17 . 2011-05-14 05:17 632656 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\msvcr80.dll
+ 2011-05-14 05:12 . 2011-05-14 05:12 554832 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\msvcp80.dll
+ 2011-05-14 05:11 . 2011-05-14 05:11 479232 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\msvcm80.dll
+ 2004-08-04 11:00 . 2009-12-24 06:59 177664 c:\windows\system32\wintrust.dll
+ 2004-08-04 11:00 . 2011-03-04 06:37 420864 c:\windows\system32\vbscript.dll
+ 2004-08-04 11:00 . 2010-04-16 15:36 406016 c:\windows\system32\usp10.dll
- 2004-08-04 11:00 . 2008-04-14 00:12 406016 c:\windows\system32\usp10.dll
+ 2004-08-04 11:00 . 2011-06-23 18:36 105984 c:\windows\system32\url.dll
- 2004-08-04 11:00 . 2009-03-08 09:34 105984 c:\windows\system32\url.dll
- 2004-08-04 11:00 . 2009-10-15 16:28 119808 c:\windows\system32\t2embed.dll
+ 2004-08-04 11:00 . 2010-08-27 08:02 119808 c:\windows\system32\t2embed.dll
+ 2004-08-04 11:00 . 2009-07-27 23:17 135168 c:\windows\system32\shsvcs.dll
- 2004-08-04 11:00 . 2008-04-14 00:12 135168 c:\windows\system32\shsvcs.dll
+ 2004-08-04 11:00 . 2011-01-21 14:44 439296 c:\windows\system32\shimgvw.dll
+ 2004-08-04 11:00 . 2011-04-29 17:25 151552 c:\windows\system32\schannel.dll
+ 2004-08-04 11:00 . 2011-02-09 13:53 270848 c:\windows\system32\sbe.dll
- 2004-08-04 11:00 . 2008-04-14 00:12 270848 c:\windows\system32\sbe.dll
+ 2004-08-04 11:00 . 2010-08-16 08:45 590848 c:\windows\system32\rpcrt4.dll
+ 2004-08-04 11:00 . 2010-12-20 17:32 551936 c:\windows\system32\oleaut32.dll
- 2004-08-04 11:00 . 2008-04-14 00:12 551936 c:\windows\system32\oleaut32.dll
- 2004-08-04 11:00 . 2008-04-14 00:12 249856 c:\windows\system32\odbc32.dll
+ 2004-08-04 11:00 . 2010-11-09 14:52 249856 c:\windows\system32\odbc32.dll
- 2004-08-04 11:00 . 2010-02-25 06:24 206848 c:\windows\system32\occache.dll
+ 2004-08-04 11:00 . 2011-06-23 18:36 206848 c:\windows\system32\occache.dll
+ 2004-08-04 11:00 . 2010-12-09 15:15 718336 c:\windows\system32\ntdll.dll
+ 2004-08-04 11:00 . 2008-06-20 16:02 245248 c:\windows\system32\mswsock.dll
- 2004-08-04 11:00 . 2008-06-20 17:46 245248 c:\windows\system32\mswsock.dll
- 2004-08-04 11:00 . 2008-04-14 00:12 677888 c:\windows\system32\mstsc.exe
+ 2004-08-04 11:00 . 2011-01-27 11:57 677888 c:\windows\system32\mstsc.exe
+ 2004-08-04 11:00 . 2011-06-23 18:36 611840 c:\windows\system32\mstime.dll
- 2004-08-04 11:00 . 2010-02-25 06:24 611840 c:\windows\system32\mstime.dll
+ 2009-03-08 09:32 . 2011-06-23 18:36 602112 c:\windows\system32\msfeeds.dll
+ 2009-11-06 02:17 . 2009-11-06 02:17 297808 c:\windows\system32\mscoree.dll
- 2004-08-04 11:00 . 2004-08-04 11:00 384512 c:\windows\system32\mp4sdmod.dll
+ 2004-08-04 11:00 . 2010-04-05 15:54 384512 c:\windows\system32\mp4sdmod.dll
+ 2004-08-04 11:00 . 2011-02-08 13:33 974848 c:\windows\system32\mfc42u.dll
+ 2004-08-04 11:00 . 2011-02-08 13:33 978944 c:\windows\system32\mfc42.dll
+ 2004-08-04 11:00 . 2010-09-18 06:53 953856 c:\windows\system32\mfc40u.dll
+ 2004-08-04 11:00 . 2010-09-18 06:53 954368 c:\windows\system32\mfc40.dll
- 2004-08-04 11:00 . 2009-06-25 08:25 730112 c:\windows\system32\lsasrv.dll
+ 2004-08-04 11:00 . 2010-12-20 17:26 730112 c:\windows\system32\lsasrv.dll
- 2004-08-04 11:00 . 2009-06-25 08:25 301568 c:\windows\system32\kerberos.dll
+ 2004-08-04 11:00 . 2010-12-22 12:34 301568 c:\windows\system32\kerberos.dll
+ 2004-08-04 11:00 . 2011-03-04 06:37 726528 c:\windows\system32\jscript.dll
- 2004-08-04 11:00 . 2009-12-09 05:53 726528 c:\windows\system32\jscript.dll
+ 2004-08-04 11:00 . 2011-05-02 15:31 692736 c:\windows\system32\inetcomm.dll
- 2004-08-04 11:00 . 2010-02-25 06:24 184320 c:\windows\system32\iepeers.dll
+ 2004-08-04 11:00 . 2011-06-23 18:36 184320 c:\windows\system32\iepeers.dll
+ 2004-08-04 11:00 . 2011-06-23 18:36 387584 c:\windows\system32\iedkcs32.dll
- 2004-08-04 11:00 . 2010-02-25 06:24 387584 c:\windows\system32\iedkcs32.dll
+ 2004-08-04 11:00 . 2011-06-23 12:05 173568 c:\windows\system32\ie4uinit.exe
+ 2006-06-19 15:57 . 2011-02-11 13:25 229888 c:\windows\system32\fxscover.exe
+ 2005-12-05 06:53 . 2011-09-16 00:15 204120 c:\windows\system32\FNTCACHE.DAT
- 2005-12-05 06:53 . 2010-07-05 05:47 204120 c:\windows\system32\FNTCACHE.DAT
+ 2004-08-04 11:00 . 2011-02-09 13:53 186880 c:\windows\system32\encdec.dll
- 2004-08-04 11:00 . 2008-04-14 00:11 186880 c:\windows\system32\encdec.dll
+ 2004-08-04 11:00 . 2010-02-11 12:02 226880 c:\windows\system32\drivers\tcpip6.sys
+ 2004-08-04 11:00 . 2011-02-17 13:18 357888 c:\windows\system32\drivers\srv.sys
+ 2004-08-04 11:00 . 2011-04-21 13:37 105472 c:\windows\system32\drivers\mup.sys
- 2004-08-04 11:00 . 2008-08-14 10:04 138496 c:\windows\system32\drivers\afd.sys
+ 2004-08-04 11:00 . 2011-02-16 13:22 138496 c:\windows\system32\drivers\afd.sys
+ 2004-08-04 11:00 . 2011-03-03 06:55 149504 c:\windows\system32\dnsapi.dll
+ 2009-11-01 19:21 . 2010-07-12 12:55 218112 c:\windows\system32\dllcache\wordpad.exe
+ 2009-12-24 06:59 . 2009-12-24 06:59 177664 c:\windows\system32\dllcache\wintrust.dll
+ 2011-06-20 17:44 . 2011-06-20 17:44 293376 c:\windows\system32\dllcache\winsrv.dll
- 2004-08-04 11:00 . 2010-02-25 06:24 916480 c:\windows\system32\dllcache\wininet.dll
+ 2004-08-04 11:00 . 2011-06-23 18:36 916480 c:\windows\system32\dllcache\wininet.dll
+ 2004-08-04 11:00 . 2011-04-30 03:01 758784 c:\windows\system32\dllcache\vgx.dll
+ 2004-08-04 11:00 . 2011-03-04 06:37 420864 c:\windows\system32\dllcache\vbscript.dll
+ 2010-04-16 15:36 . 2010-04-16 15:36 406016 c:\windows\system32\dllcache\usp10.dll
+ 2004-08-04 11:00 . 2011-06-23 18:36 105984 c:\windows\system32\dllcache\url.dll
- 2004-08-04 11:00 . 2009-03-08 09:34 105984 c:\windows\system32\dllcache\url.dll
+ 2008-06-20 11:08 . 2010-02-11 12:02 226880 c:\windows\system32\dllcache\tcpip6.sys
- 2009-07-29 04:37 . 2009-10-15 16:28 119808 c:\windows\system32\dllcache\t2embed.dll
+ 2009-07-29 04:37 . 2010-08-27 08:02 119808 c:\windows\system32\dllcache\t2embed.dll
+ 2009-11-01 19:21 . 2011-02-17 13:18 357888 c:\windows\system32\dllcache\srv.sys
+ 2009-07-27 23:17 . 2009-07-27 23:17 135168 c:\windows\system32\dllcache\shsvcs.dll
+ 2011-01-21 14:44 . 2011-01-21 14:44 439296 c:\windows\system32\dllcache\shimgvw.dll
+ 2008-12-05 06:54 . 2011-04-29 17:25 151552 c:\windows\system32\dllcache\schannel.dll
+ 2011-02-09 13:53 . 2011-02-09 13:53 270848 c:\windows\system32\dllcache\sbe.dll
+ 2009-04-15 14:51 . 2010-08-16 08:45 590848 c:\windows\system32\dllcache\rpcrt4.dll
+ 2010-12-20 17:32 . 2010-12-20 17:32 551936 c:\windows\system32\dllcache\oleaut32.dll
+ 2010-11-09 14:52 . 2010-11-09 14:52 249856 c:\windows\system32\dllcache\odbc32.dll
+ 2004-08-04 11:00 . 2011-06-23 18:36 206848 c:\windows\system32\dllcache\occache.dll
- 2004-08-04 11:00 . 2010-02-25 06:24 206848 c:\windows\system32\dllcache\occache.dll
+ 2009-11-01 19:21 . 2010-12-09 15:15 718336 c:\windows\system32\dllcache\ntdll.dll
+ 2008-06-20 17:46 . 2008-06-20 16:02 245248 c:\windows\system32\dllcache\mswsock.dll
- 2008-06-20 17:46 . 2008-06-20 17:46 245248 c:\windows\system32\dllcache\mswsock.dll
+ 2004-08-04 11:00 . 2011-06-23 18:36 611840 c:\windows\system32\dllcache\mstime.dll
- 2004-08-04 11:00 . 2010-02-25 06:24 611840 c:\windows\system32\dllcache\mstime.dll
+ 2010-11-09 14:52 . 2010-11-09 14:52 102400 c:\windows\system32\dllcache\msjro.dll
+ 2009-11-01 21:28 . 2011-06-23 18:36 602112 c:\windows\system32\dllcache\msfeeds.dll
+ 2010-11-09 14:52 . 2010-11-09 14:52 200704 c:\windows\system32\dllcache\msadox.dll
+ 2010-11-09 14:52 . 2010-11-09 14:52 180224 c:\windows\system32\dllcache\msadomd.dll
+ 2010-11-09 14:52 . 2010-11-09 14:52 536576 c:\windows\system32\dllcache\msado15.dll
+ 2010-11-09 14:52 . 2010-11-09 14:52 143360 c:\windows\system32\dllcache\msadco.dll
+ 2009-11-01 19:20 . 2011-07-15 13:29 456320 c:\windows\system32\dllcache\mrxsmb.sys
- 2004-08-04 11:00 . 2004-08-04 11:00 384512 c:\windows\system32\dllcache\mp4sdmod.dll
+ 2004-08-04 11:00 . 2010-04-05 15:54 384512 c:\windows\system32\dllcache\mp4sdmod.dll
+ 2004-08-04 11:00 . 2011-02-08 13:33 974848 c:\windows\system32\dllcache\mfc42u.dll
+ 2011-02-08 13:33 . 2011-02-08 13:33 978944 c:\windows\system32\dllcache\mfc42.dll
+ 2004-08-04 11:00 . 2010-09-18 06:53 954368 c:\windows\system32\dllcache\mfc40.dll
- 2009-11-01 19:21 . 2009-06-25 08:25 730112 c:\windows\system32\dllcache\lsasrv.dll
+ 2009-11-01 19:21 . 2010-12-20 17:26 730112 c:\windows\system32\dllcache\lsasrv.dll
+ 2011-01-27 11:57 . 2011-01-27 11:57 677888 c:\windows\system32\dllcache\lhmstsc.exe
- 2009-06-25 08:25 . 2009-06-25 08:25 301568 c:\windows\system32\dllcache\kerberos.dll
+ 2009-06-25 08:25 . 2010-12-22 12:34 301568 c:\windows\system32\dllcache\kerberos.dll
+ 2004-08-04 11:00 . 2011-03-04 06:37 726528 c:\windows\system32\dllcache\jscript.dll
- 2004-08-04 11:00 . 2009-12-09 05:53 726528 c:\windows\system32\dllcache\jscript.dll
+ 2009-11-01 19:19 . 2011-05-02 15:31 692736 c:\windows\system32\dllcache\inetcomm.dll
- 2009-11-01 21:28 . 2010-02-25 06:24 247808 c:\windows\system32\dllcache\ieproxy.dll
+ 2009-11-01 21:28 . 2011-06-23 18:36 247808 c:\windows\system32\dllcache\ieproxy.dll
+ 2004-08-04 11:00 . 2011-06-23 18:36 184320 c:\windows\system32\dllcache\iepeers.dll
- 2004-08-04 11:00 . 2010-02-25 06:24 184320 c:\windows\system32\dllcache\iepeers.dll
+ 2004-08-04 11:00 . 2011-06-23 18:36 387584 c:\windows\system32\dllcache\iedkcs32.dll
- 2004-08-04 11:00 . 2010-02-25 06:24 387584 c:\windows\system32\dllcache\iedkcs32.dll
+ 2004-08-04 11:00 . 2011-06-23 12:05 173568 c:\windows\system32\dllcache\ie4uinit.exe
+ 2011-02-11 13:25 . 2011-02-11 13:25 229888 c:\windows\system32\dllcache\fxscover.exe
+ 2011-02-09 13:53 . 2011-02-09 13:53 186880 c:\windows\system32\dllcache\encdec.dll
+ 2008-06-20 17:46 . 2011-03-03 06:55 149504 c:\windows\system32\dllcache\dnsapi.dll
+ 2011-02-15 12:56 . 2011-02-15 12:56 290432 c:\windows\system32\dllcache\atmfd.dll
+ 2009-11-01 19:21 . 2011-02-16 13:22 138496 c:\windows\system32\dllcache\afd.sys
- 2009-11-01 19:21 . 2008-08-14 10:04 138496 c:\windows\system32\dllcache\afd.sys
+ 2010-02-12 04:33 . 2010-02-12 04:33 100864 c:\windows\system32\dllcache\6to4svc.dll
- 2004-08-04 11:00 . 2008-04-14 00:11 617472 c:\windows\system32\comctl32.dll
+ 2004-08-04 11:00 . 2010-08-23 16:12 617472 c:\windows\system32\comctl32.dll
+ 2004-08-04 11:00 . 2011-02-15 12:56 290432 c:\windows\system32\atmfd.dll
+ 2004-08-04 11:00 . 2010-02-12 04:33 100864 c:\windows\system32\6to4svc.dll
+ 2006-06-19 16:15 . 2005-07-23 05:14 237568 c:\windows\SMINST\RECGUARD.exe
+ 2011-02-11 13:25 . 2011-02-11 13:25 229888 c:\windows\ServicePackFiles\ServicePackCache\i386\fxscover.exe
- 2004-08-04 11:00 . 2008-04-14 00:12 744448 c:\windows\pchealth\helpctr\binaries\helpsvc.exe
+ 2004-08-04 11:00 . 2010-06-14 14:31 744448 c:\windows\pchealth\helpctr\binaries\helpsvc.exe
- 2008-05-28 05:49 . 2008-05-28 05:49 102400 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
+ 2010-09-23 06:26 . 2010-09-23 06:26 102400 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
- 2008-05-28 05:48 . 2008-05-28 05:48 315392 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
+ 2010-09-23 06:25 . 2010-09-23 06:25 315392 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
+ 2010-09-23 07:17 . 2010-09-23 07:17 258048 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
- 2008-05-28 06:30 . 2008-05-28 06:30 258048 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
+ 2011-09-13 23:41 . 2011-09-13 23:41 223744 c:\windows\Installer\24c67d.msi
+ 2009-09-09 19:40 . 2009-09-09 19:40 632320 c:\windows\Installer\24c675.msp
+ 2010-11-12 15:08 . 2010-11-12 15:08 889344 c:\windows\Installer\24c578.msp
+ 2011-09-13 23:27 . 2011-09-13 23:27 467456 c:\windows\Installer\24c533.msi
- 2006-06-19 16:15 . 2010-04-04 08:37 409600 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2006-06-19 16:15 . 2011-09-13 23:44 409600 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2006-06-19 16:15 . 2010-04-04 08:37 286720 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2006-06-19 16:15 . 2011-09-13 23:44 286720 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2006-06-19 16:15 . 2010-04-04 08:37 249856 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2006-06-19 16:15 . 2011-09-13 23:44 249856 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2006-06-19 16:15 . 2010-04-04 08:37 794624 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2006-06-19 16:15 . 2011-09-13 23:44 794624 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2006-06-19 16:15 . 2011-09-13 23:44 135168 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2006-06-19 16:15 . 2010-04-04 08:37 135168 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2007-03-22 23:22 . 2007-03-22 23:22 103264 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\TRANSMGR.DLL
+ 2010-04-04 07:47 . 2010-04-04 07:47 464272 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\OWC11PIA.DLL
+ 2007-04-19 17:53 . 2007-04-19 17:53 149856 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\OUTLPH.DLL
+ 2007-05-31 17:42 . 2007-05-31 17:42 200032 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\OUTLOOK.EXE
+ 2007-04-19 17:53 . 2007-04-19 17:53 106336 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\OUTLMIME.DLL
+ 2007-04-19 17:53 . 2007-04-19 17:53 109408 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\OUTLCTL.DLL
+ 2007-04-19 17:54 . 2007-04-19 17:54 183136 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\MIMEDIR.DLL
+ 2007-04-19 17:53 . 2007-04-19 17:53 127328 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\IMPMAIL.DLL
+ 2007-04-19 18:09 . 2007-04-19 18:09 167256 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\IETAG.DLL
+ 2007-04-19 17:53 . 2007-04-19 17:53 137568 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\ENVELOPE.DLL
+ 2011-09-13 23:24 . 2010-02-25 06:24 916480 c:\windows\ie8updates\KB2559049-IE8\wininet.dll
+ 2011-09-13 23:24 . 2009-03-08 09:34 105984 c:\windows\ie8updates\KB2559049-IE8\url.dll
+ 2011-09-13 23:24 . 2010-07-05 13:16 382840 c:\windows\ie8updates\KB2559049-IE8\spuninst\updspapi.dll
+ 2011-09-13 23:24 . 2010-07-05 13:15 231288 c:\windows\ie8updates\KB2559049-IE8\spuninst\spuninst.exe
+ 2011-09-13 23:24 . 2010-02-25 06:24 206848 c:\windows\ie8updates\KB2559049-IE8\occache.dll
+ 2011-09-13 23:24 . 2010-02-25 06:24 611840 c:\windows\ie8updates\KB2559049-IE8\mstime.dll
+ 2011-09-13 23:24 . 2010-02-25 06:24 594432 c:\windows\ie8updates\KB2559049-IE8\msfeeds.dll
+ 2011-09-13 23:24 . 2010-02-25 06:24 247808 c:\windows\ie8updates\KB2559049-IE8\ieproxy.dll
+ 2011-09-13 23:24 . 2010-02-25 06:24 184320 c:\windows\ie8updates\KB2559049-IE8\iepeers.dll
+ 2011-09-13 23:24 . 2009-03-08 09:35 742912 c:\windows\ie8updates\KB2559049-IE8\iedvtool.dll
+ 2011-09-13 23:24 . 2010-02-25 06:24 387584 c:\windows\ie8updates\KB2559049-IE8\iedkcs32.dll
+ 2011-09-13 23:24 . 2010-02-24 09:54 173056 c:\windows\ie8updates\KB2559049-IE8\ie4uinit.exe
+ 2011-09-13 23:25 . 2009-03-08 09:33 759296 c:\windows\ie8updates\KB2544521-IE8\vgx.dll
+ 2011-09-13 23:25 . 2010-07-05 13:16 382840 c:\windows\ie8updates\KB2544521-IE8\spuninst\updspapi.dll
+ 2011-09-13 23:25 . 2010-07-05 13:15 231288 c:\windows\ie8updates\KB2544521-IE8\spuninst\spuninst.exe
+ 2011-09-13 23:26 . 2009-03-08 09:33 420352 c:\windows\ie8updates\KB2510531-IE8\vbscript.dll
+ 2011-09-13 23:26 . 2010-07-05 13:16 382840 c:\windows\ie8updates\KB2510531-IE8\spuninst\updspapi.dll
+ 2011-09-13 23:26 . 2010-07-05 13:15 231288 c:\windows\ie8updates\KB2510531-IE8\spuninst\spuninst.exe
+ 2011-09-13 23:26 . 2009-12-09 05:53 726528 c:\windows\ie8updates\KB2510531-IE8\jscript.dll
+ 2009-11-01 19:20 . 2011-07-15 13:29 456320 c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2011-09-13 23:30 . 2011-09-13 23:30 835584 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_a171f5a0\System.Drawing.dll
+ 2011-09-13 23:31 . 2011-09-13 23:31 192512 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_beb40934\System.Drawing.Design.dll
+ 2011-09-13 23:31 . 2011-09-13 23:31 118784 c:\windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_7b457c85\CustomMarshalers.dll
+ 2011-09-13 23:40 . 2011-09-13 23:40 477056 c:\windows\assembly\GAC\Microsoft.Office.Interop.Owc11\11.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Owc11.dll
+ 2011-09-13 13:50 . 2010-10-23 00:51 1748992 c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6002.22509_x-ww_c7dad023\GdiPlus.dll
+ 2011-09-13 13:52 . 2010-08-23 16:12 1054208 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 3781960 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_028bc148\mfc90u.dll
+ 2011-04-19 02:51 . 2011-04-19 02:51 3766600 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_028bc148\mfc90.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 3780424 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 3780424 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
- 2009-07-12 05:02 . 2009-07-12 05:02 3765048 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
+ 2009-07-12 04:02 . 2009-07-12 04:02 3765048 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
+ 2011-05-14 00:04 . 2011-05-14 00:04 1093120 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b\mfc80u.dll
+ 2011-05-14 00:04 . 2011-05-14 00:04 1101824 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b\mfc80.dll
+ 2004-08-04 11:00 . 2010-04-03 07:33 2365288 c:\windows\system32\WMVCore.dll
+ 2004-08-04 11:00 . 2010-08-25 11:23 5541888 c:\windows\system32\wmp.dll
+ 2004-08-04 11:00 . 2011-06-02 14:02 1858944 c:\windows\system32\win32k.sys
+ 2004-08-04 11:00 . 2011-06-23 18:36 1212416 c:\windows\system32\urlmon.dll
+ 2004-08-04 11:00 . 2011-01-21 14:44 8462336 c:\windows\system32\shell32.dll
- 2004-08-04 11:00 . 2009-11-27 17:11 1291776 c:\windows\system32\quartz.dll
+ 2004-08-04 11:00 . 2010-02-05 18:27 1291776 c:\windows\system32\quartz.dll
+ 2004-08-04 11:00 . 2010-07-16 12:05 1288192 c:\windows\system32\ole32.dll
+ 2004-08-04 11:00 . 2010-12-09 13:38 2192768 c:\windows\system32\ntoskrnl.exe
+ 2004-08-04 11:00 . 2010-12-09 13:07 2069376 c:\windows\system32\ntkrnlpa.exe
+ 2004-08-04 11:00 . 2010-06-14 07:41 1172480 c:\windows\system32\msxml3.dll
- 2004-08-04 11:00 . 2009-07-31 04:35 1172480 c:\windows\system32\msxml3.dll
+ 2004-08-04 11:00 . 2011-02-02 07:58 2067456 c:\windows\system32\mstscax.dll
+ 2004-08-04 11:00 . 2011-07-25 15:17 5969920 c:\windows\system32\mshtml.dll
+ 2009-03-08 09:32 . 2011-06-23 18:36 1991680 c:\windows\system32\iertutil.dll
+ 2009-08-04 23:52 . 2009-08-04 23:52 1193832 c:\windows\system32\FM20.DLL
+ 2004-08-04 11:00 . 2010-04-03 07:33 2365288 c:\windows\system32\dllcache\WMVCore.dll
+ 2004-08-04 11:00 . 2010-08-25 11:23 5541888 c:\windows\system32\dllcache\wmp.dll
+ 2009-04-17 12:26 . 2011-06-02 14:02 1858944 c:\windows\system32\dllcache\win32k.sys
+ 2004-08-04 11:00 . 2011-06-23 18:36 1212416 c:\windows\system32\dllcache\urlmon.dll
+ 2008-06-17 19:02 . 2011-01-21 14:44 8462336 c:\windows\system32\dllcache\shell32.dll
- 2009-06-03 19:09 . 2009-11-27 17:11 1291776 c:\windows\system32\dllcache\quartz.dll
+ 2009-06-03 19:09 . 2010-02-05 18:27 1291776 c:\windows\system32\dllcache\quartz.dll
+ 2010-07-16 12:05 . 2010-07-16 12:05 1288192 c:\windows\system32\dllcache\ole32.dll
+ 2009-11-01 19:21 . 2010-12-09 13:38 2192768 c:\windows\system32\dllcache\ntoskrnl.exe
+ 2009-11-01 19:21 . 2010-12-09 13:07 2027008 c:\windows\system32\dllcache\ntkrpamp.exe
+ 2009-02-08 00:02 . 2010-12-09 13:07 2069376 c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2009-11-01 19:21 . 2010-12-09 13:42 2148864 c:\windows\system32\dllcache\ntkrnlmp.exe
- 2004-08-04 11:00 . 2009-07-31 04:35 1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2004-08-04 11:00 . 2010-06-14 07:41 1172480 c:\windows\system32\dllcache\msxml3.dll
- 2009-11-01 19:24 . 2009-07-10 13:27 1315328 c:\windows\system32\dllcache\msoe.dll
+ 2009-11-01 19:24 . 2010-01-29 15:01 1315328 c:\windows\system32\dllcache\msoe.dll
+ 2004-08-04 11:00 . 2011-07-25 15:17 5969920 c:\windows\system32\dllcache\mshtml.dll
+ 2010-03-29 14:26 . 2010-06-18 13:36 3558912 c:\windows\system32\dllcache\moviemk.exe
- 2010-03-29 14:26 . 2009-10-23 15:28 3558912 c:\windows\system32\dllcache\moviemk.exe
+ 2011-02-02 07:58 . 2011-02-02 07:58 2067456 c:\windows\system32\dllcache\lhmstscx.dll
+ 2009-11-01 21:28 . 2011-06-23 18:36 1991680 c:\windows\system32\dllcache\iertutil.dll
- 2008-05-28 06:35 . 2008-05-28 06:35 1265664 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
+ 2010-09-23 19:55 . 2010-09-23 19:55 1265664 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
- 2008-05-28 06:35 . 2008-05-28 06:35 1232896 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.dll
+ 2010-09-23 19:55 . 2010-09-23 19:55 1232896 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.dll
- 2008-05-28 05:48 . 2008-05-28 05:48 2514944 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2010-09-23 06:26 . 2010-09-23 06:26 2514944 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2010-09-23 06:25 . 2010-09-23 06:25 2523136 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
- 2008-05-28 05:48 . 2008-05-28 05:48 2523136 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
- 2008-05-28 05:43 . 2008-05-28 05:43 2142208 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
+ 2010-09-23 19:55 . 2010-09-23 19:55 2142208 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
+ 2010-08-05 14:57 . 2010-08-05 14:57 4066304 c:\windows\Installer\24c6cf.msp
+ 2009-10-16 22:07 . 2009-10-16 22:07 6115328 c:\windows\Installer\24c6ac.msp
+ 2010-10-22 19:45 . 2010-10-22 19:45 8444928 c:\windows\Installer\24c699.msp
+ 2009-08-20 09:02 . 2009-08-20 09:02 5204992 c:\windows\Installer\24c663.msp
+ 2009-07-01 17:21 . 2009-07-01 17:21 8891904 c:\windows\Installer\24c64f.msp
+ 2010-08-23 21:09 . 2010-08-23 21:09 7673344 c:\windows\Installer\24c627.msp
+ 2011-04-27 23:51 . 2011-04-27 23:51 6825472 c:\windows\Installer\24c614.msp
+ 2008-01-14 20:53 . 2008-01-14 20:53 5213696 c:\windows\Installer\24c601.msp
+ 2011-05-17 22:28 . 2011-05-17 22:28 6862848 c:\windows\Installer\24c5ef.msp
+ 2011-04-29 17:04 . 2011-04-29 17:04 5053440 c:\windows\Installer\24c5dc.msp
+ 2009-12-17 02:58 . 2009-12-17 02:58 5382144 c:\windows\Installer\24c5c7.msp
+ 2008-10-25 13:15 . 2008-10-25 13:15 6227456 c:\windows\Installer\24c5b1.msp
+ 2009-09-29 13:08 . 2009-09-29 13:08 6747648 c:\windows\Installer\24c59e.msp
+ 2011-05-23 18:15 . 2011-05-23 18:15 3617792 c:\windows\Installer\24c58b.msp
+ 2010-08-25 21:06 . 2010-08-25 21:06 6479360 c:\windows\Installer\24c55f.msp
+ 2011-07-26 17:50 . 2011-07-26 17:50 5522432 c:\windows\Installer\24c527.msp
+ 2007-05-09 21:19 . 2007-05-09 21:19 2585936 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\VBE6.DLL
+ 2007-04-19 17:49 . 2007-04-19 17:49 1661280 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\PPTVIEW.EXE
+ 2007-05-31 17:35 . 2007-05-31 17:35 6420320 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\POWERPNT.EXE
+ 2007-05-10 17:45 . 2007-05-10 17:45 8069464 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\OWC11.DLL
+ 2007-05-31 17:43 . 2007-05-31 17:43 7613280 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\OUTLLIB.DLL
+ 2007-04-19 18:09 . 2007-04-19 18:09 1061720 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\OMFC.DLL
+ 2007-06-06 14:53 . 2007-06-06 14:53 1195888 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\FM20.DLL
+ 2011-09-13 23:24 . 2010-02-25 06:24 1209344 c:\windows\ie8updates\KB2559049-IE8\urlmon.dll
+ 2011-09-13 23:24 . 2010-02-25 06:24 5944832 c:\windows\ie8updates\KB2559049-IE8\mshtml.dll
+ 2011-09-13 23:24 . 2010-02-25 06:24 1985536 c:\windows\ie8updates\KB2559049-IE8\iertutil.dll
+ 2008-10-21 11:45 . 2010-12-09 13:38 2192768 c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2008-10-21 11:45 . 2010-12-09 13:07 2027008 c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2008-10-21 11:45 . 2010-12-09 13:07 2069376 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2008-10-21 11:45 . 2010-12-09 13:42 2148864 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2011-09-13 23:31 . 2011-09-13 23:31 4792320 c:\windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_fbf457ab\System.dll
+ 2011-09-13 23:29 . 2011-09-13 23:29 1966080 c:\windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_b327122f\System.dll
+ 2011-09-13 23:31 . 2011-09-13 23:31 5513216 c:\windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_ae52b74b\System.Xml.dll
+ 2011-09-13 23:30 . 2011-09-13 23:30 2088960 c:\windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_2ddff170\System.Xml.dll
+ 2011-09-13 23:30 . 2011-09-13 23:30 3018752 c:\windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_c5c37a54\System.Windows.Forms.dll
+ 2011-09-13 23:31 . 2011-09-13 23:31 7884800 c:\windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_38c6a18d\System.Windows.Forms.dll
+ 2011-09-13 23:31 . 2011-09-13 23:31 2244608 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_fb5dd32a\System.Drawing.dll
+ 2011-09-13 23:31 . 2011-09-13 23:31 3395584 c:\windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_69f6c67f\System.Design.dll
+ 2011-09-13 23:30 . 2011-09-13 23:30 1470464 c:\windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_27687774\System.Design.dll
+ 2011-09-13 23:32 . 2011-09-13 23:32 8908800 c:\windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_9bec9dea\mscorlib.dll
+ 2011-09-13 23:30 . 2011-09-13 23:30 3391488 c:\windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_7bd409c4\mscorlib.dll
+ 2011-09-13 23:29 . 2011-09-13 23:29 1232896 c:\windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
- 2009-11-01 22:49 . 2009-11-01 22:49 1232896 c:\windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
+ 2011-09-13 23:29 . 2011-09-13 23:29 1265664 c:\windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
- 2009-11-01 22:49 . 2009-11-01 22:49 1265664 c:\windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
+ 2009-03-08 09:39 . 2011-06-23 18:36 11081728 c:\windows\system32\ieframe.dll
+ 2009-11-01 21:27 . 2011-06-23 18:36 11081728 c:\windows\system32\dllcache\ieframe.dll
+ 2010-09-24 18:08 . 2010-09-24 18:08 11430400 c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\M2416447\M2416447Uninstall.msp
+ 2009-07-01 17:19 . 2009-07-01 17:19 10607104 c:\windows\Installer\24c650.msp
+ 2011-02-24 13:38 . 2011-02-24 13:38 10984448 c:\windows\Installer\24c63a.msp
+ 2010-09-24 11:08 . 2010-09-24 11:08 17518080 c:\windows\Installer\24c54d.msp
+ 2007-05-31 17:37 . 2007-05-31 17:37 12310368 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\WINWORD.EXE
+ 2007-06-18 21:16 . 2007-06-18 21:16 12259160 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\MSO.DLL
+ 2007-05-31 17:41 . 2007-05-31 17:41 10352472 c:\windows\Installer\$PatchCache$\Managed\9040211900063D11C8EF10054038389C\11.0.8173\EXCEL.EXE
+ 2011-09-13 23:24 . 2010-02-25 15:54 11070976 c:\windows\ie8updates\KB2559049-IE8\ieframe.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 20:45 122512 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-05-17 5729136]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask .exe -atboottime" [X]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 1983816]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-03 18085888]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-05-10 86016]
"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 49152]
"D-Link AirPlus G"="c:\program files\D-Link\AirPlus G\AirGCFG.exe" [2005-03-18 1228800]
"PCDrProfiler"="" [BU]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568]
"nwiz"="nwiz.exe" [2006-05-10 1519616]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-10 7311360]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-06-19 180269]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2010-05-07 165208]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-6-19 27136]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 18:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\MsnMsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1039:TCP"= 1039:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [9/11/2011 4:16 PM 442200]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [9/11/2011 4:16 PM 320856]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 10:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/17/2010 10:15 AM 66632]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [9/11/2011 4:16 PM 20568]
R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\system32\nlssrv32.exe [3/25/2010 11:49 AM 57344]
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [3/22/2005 8:17 PM 547744]
S2 0248541315702947mcinstcleanup;McAfee Application Installer Cleanup (0248541315702947);c:\docume~1\ANNA~1.YOU\LOCALS~1\Temp\024854~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service –> c:\docume~1\ANNA~1.YOU\LOCALS~1\Temp\024854~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys –> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/17/2010 10:15 AM 12872]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=EN_US&c;=63&bd;=PRESARIO&pf;=desktop
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=63&bd;=PRESARIO&pf;=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=63&bd;=PRESARIO&pf;=desktop
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = [removed] [removed]
FF - ProfilePath - c:\documents and settings\Anna.YOUR-D0F670B45A\Application Data\Mozilla\Firefox\Profiles\oiz81fj2.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Ext: WOT: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} - %profile%\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Ext: OptimizeGoogle: [removed] - %profile%\extensions\[removed]
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: avast! WebRep: [removed] - c:\program files\AVAST Software\Avast\WebRep\FF
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-ZoneAlarm Client - c:\program files\Zone Labs\ZoneAlarm\zlclient.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-15 20:29
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
.
C:\## aswSnx private storage
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3e,61,a2,24,54,72,0f,48,a5,91,f3,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3e,61,a2,24,54,72,0f,48,a5,91,f3,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(556)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(3108)
c:\windows\system32\WININET.dll
c:\windows\system32\logishrd\LVPrcInj01.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PSIService.exe
c:\windows\system32\wdfmgr.exe
c:\windows\RTHDCPL.EXE
c:\program files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
c:\windows\system32\msiexec.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-09-15 20:37:23 - machine was rebooted
ComboFix-quarantined-files.txt 2011-09-16 00:37
ComboFix2.txt 2011-09-13 23:20
ComboFix3.txt 2011-09-13 14:19
ComboFix4.txt 2011-09-11 20:35
ComboFix5.txt 2011-09-16 00:21
.
Pre-Run: 97,434,157,056 bytes free
Post-Run: 97,383,657,472 bytes free
.
- - End Of File - - D228800ED3B7C2021E25B9136703FE28
Post #20
Hi AgentFrog,

You did great, :thumbup: thanks for the log, After you run these scans please tell me how the computer is running.

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please post back with he mbam log. Any remaining issues?
==============
NEXT

As a Vista or Windows 7 user you will need to right click your browser icon and select "Run as Administrator" in order to run this scan.
  • Do not use this instance of your browser for anything besides doing this scan
  • When the scan is complete and the results saved, close that instance of your browser
  • Open a new one the usual way and post the results in this topic.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
  • Click Start
  • Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
  • Click Scan.
  • Wait for the scan to finish.
  • Re-enable your Antivirus software.
  • A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. or C:\Program Files\ESET\log.txtWe will need this later.
Please post back with the ESET log.

=================
Please include in your next reply:
1. Any problem executing the instructions?
2. MBAM log
3. ESET log
4. How is the computer behaving?
Post #21 last edited
reset SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\Options\15\RegLocation old REG_MULTI_SZ = SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\?\DhcpDomain SYSTEM\CurrentControlSet\Services\TcpIp\Parameters\DhcpDomain added SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{8B1C7605-C904-438F-A6B8-6B1B422E3F41}\NetbiosOptions added SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{C08644BD-AE99-4B6C-9E85-4F4066F624DD}\NetbiosOptions deleted SYSTEM\CurrentControlSet\Services\Netbt\Parameters\EnableLmhosts added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{23342DB9-01C6-4AC8-A87B-AA5D5C25C7EB}\AddressType added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{23342DB9-01C6-4AC8-A87B-AA5D5C25C7EB}\DisableDynamicUpdate reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{23342DB9-01C6-4AC8-A87B-AA5D5C25C7EB}\RawIpAllowedProtocols old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{23342DB9-01C6-4AC8-A87B-AA5D5C25C7EB}\TcpAllowedPorts old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{23342DB9-01C6-4AC8-A87B-AA5D5C25C7EB}\UdpAllowedPorts old REG_MULTI_SZ = 0 added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{49A645FF-74BE-40EB-8312-682B35E51D1D}\DisableDynamicUpdate deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{49A645FF-74BE-40EB-8312-682B35E51D1D}\IpAutoconfigurationAddress deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{49A645FF-74BE-40EB-8312-682B35E51D1D}\IpAutoconfigurationMask deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{49A645FF-74BE-40EB-8312-682B35E51D1D}\IpAutoconfigurationSeed reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{49A645FF-74BE-40EB-8312-682B35E51D1D}\RawIpAllowedProtocols old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{49A645FF-74BE-40EB-8312-682B35E51D1D}\TcpAllowedPorts old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{49A645FF-74BE-40EB-8312-682B35E51D1D}\UdpAllowedPorts old REG_MULTI_SZ = 0 added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{80443072-5384-4D29-A197-604ECE8884D8}\DisableDynamicUpdate deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{80443072-5384-4D29-A197-604ECE8884D8}\IpAutoconfigurationAddress deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{80443072-5384-4D29-A197-604ECE8884D8}\IpAutoconfigurationMask deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{80443072-5384-4D29-A197-604ECE8884D8}\IpAutoconfigurationSeed reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{80443072-5384-4D29-A197-604ECE8884D8}\RawIpAllowedProtocols old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{80443072-5384-4D29-A197-604ECE8884D8}\TcpAllowedPorts old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{80443072-5384-4D29-A197-604ECE8884D8}\UdpAllowedPorts old REG_MULTI_SZ = 0 added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{951EB126-1645-49A3-ADDD-78C4310747D7}\AddressType added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{951EB126-1645-49A3-ADDD-78C4310747D7}\DisableDynamicUpdate reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{951EB126-1645-49A3-ADDD-78C4310747D7}\RawIpAllowedProtocols old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{951EB126-1645-49A3-ADDD-78C4310747D7}\TcpAllowedPorts old REG_MULTI_SZ = 0 reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{951EB126-1645-49A3-ADDD-78C4310747D7}\UdpAllowedPorts old REG_MULTI_SZ = 0 deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DontAddDefaultGatewayDefault added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\SearchList deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\UseDomainNameDevolution reset Linkage\UpperBind for PCI\VEN_168C&DEV_001A&SUBSYS_3A161186&REV_01\4&DC268A3&0&4080. bad value was: REG_MULTI_SZ = PSched reset Linkage\UpperBind for {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV0269\4&180DF4C5&0&01. bad value was: REG_MULTI_SZ = PSched reset Linkage\UpperBind for ROOT\MS_NDISWANIP\0000. bad value was: REG_MULTI_SZ = PSched reset Linkage\UpperBind for PCI\VEN_1113&DEV_1211&SUBSYS_9207103C&REV_10\4&1AF1648C&0&18F0. bad value was: REG_MULTI_SZ = PSched Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Database version: 7734 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 9/17/2011 12:20:35 PM mbam-log-2011-09-17 (12-20-35).txt Scan type: Quick scan Objects scanned: 275689 Time elapsed: 6 minute(s), 32 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #22
Hi AgentFrog,

I'm not familiar with the log you posted can you tell me what it is. You got Malwarebytes to run that's great :thumbup: thanks for the log. Could you post the ESET log too in your next reply.
Post #23
Oh when the ESET scan was done it didn't produce a log since I unchecked "remove selected items" as per instruction, so I did a folder search and that was the result under "ESET log". It picked up 21 threats, should I run it again and ask it to remove?
Post #24
Hi AgentFrog, Please don't remove anything, just post the log which you can find here. C:\Program Files\EsetOnlineScanner\log.txt. or C:\Program Files\ESET\log.txt. please post the log.
Post #25
ESETSmartInstaller@High as downloader log: Can not open internetESETSmartInstaller@High as downloader log: Can not open internetCan not open internetESETSmartInstaller@High as downloader log: Can not open internetCan not open internetESETSmartInstaller@High as downloader log: Can not open internetCan not open internetESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=a4003f67c1266c4c8c736ce7a6dd89eb # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-09-17 06:04:53 # local_time=2011-09-17 02:04:53 (-0500, Eastern Daylight Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 65915782 65915782 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # compatibility_mode=9217 16777214 75 70 0 83622500 0 0 # scanned=141591 # found=21 # cleaned=0 # scan_time=5137 C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinMuollo2.zip Win32/Bagle.gen.zip worm (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Anna.YOUR-D0F670B45A\Application Data\Sun\Java\Deployment\cache\6.0\49\73190831-77cb2d45 a variant of Java/Exploit.CVE-2010-4452.A trojan (unable to clean) 00000000000000000000000000000000 I C:\hp\bin\wbug\CompaqPresario_Spring06.exe a variant of Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I C:\Program Files\QuickTime\qttask.exe a variant of Win32/Kryptik.QLX trojan (unable to clean) 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir a variant of Win32/Kryptik.QLX trojan (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP5\A0015420.exe a variant of Win32/Kryptik.QLX trojan (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP5\A0015758.exe a variant of Win32/Adware.CiDHelp application (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP5\A0015991.exe Win32/Adware.MalwareRemoval application (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP6\A0018189.rbf a variant of Win32/Kryptik.QLX trojan (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP7\A0018261.exe a variant of Win32/Kryptik.QLX trojan (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP7\A0018262.exe a variant of Win32/Kryptik.QLX trojan (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP7\A0018263.exe a variant of Win32/Kryptik.QLX trojan (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP7\A0018264.exe a variant of Win32/Kryptik.QLX trojan (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP7\A0018265.exe a variant of Win32/Kryptik.QLX trojan (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP7\A0018266.EXE a variant of Win32/Kryptik.QLX trojan (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP7\A0018274.exe a variant of Win32/Kryptik.QLX trojan (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP7\A0018343.exe a variant of Win32/Kryptik.QLX trojan (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP7\A0018344.exe a variant of Win32/Kryptik.QLX trojan (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP7\A0018345.Exe a variant of Win32/Kryptik.QLX trojan (unable to clean) 00000000000000000000000000000000 I D:\I386\APPS\APP32022\src\CompaqPresario_Spring06.exe a variant of Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I D:\I386\APPS\APP32022\src\HPPavillion_Spring06.exe a variant of Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I
Post #26
Hi AgentFrog,

Some of the files ESET found is in System Restore and Quarantine and we will remove them when we cleanup the tools that you used.

Looks like we still have issues with QuickTime I need you to uninstall the program and then you can reinstall it.

Download Revo Uninstaller
  • Double click the installation file on the desktop to run the installer.
  • Let it install to the default location.
  • Double click the new Revo Uninstaller Icon on the desktop to start the program.
You will now see a list of installed programs that Revo Uninstaller can remove.
  • Locate the program you are uninstalling QuickTime
  • Right Click the Icon then choose Uninstall.
  • Click yes to the warning and choose the Uninstall Mode
  • Choose the Advanced option and then click Next.
  • This will launch the programs built in uninstaller. Be patient it can take several seconds.
  • Once the uninstaller is done click Next.
  • Revo Uninstaller will now scan for leftover information. Be patient it can take several seconds.
  • Once this scan is done click Next.
  • You will then be presented of the leftover entries found by Revo Uninstaller
  • Look at ALL of the entries to ensure they relate to the program you are uninstalling.
  • Next click Select All > Delete to remove the entries.
  • Click Next.
  • If there are any program file folders left over you will be presented with a list to be removed.
  • Again look at ALL of the entries to ensure they are related to the program you are uninstalling.
  • Click Select All > Delete to remove the entries.
  • Click Finish to go back to the uninstall list.
  • Close the program

After this has finished, reboot and then you can reinstall the latest version of QuickTime onto the machine.
=============================
NEXT

Please download JavaRa to your desktop and unzip it to its own
folder
  • Run JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista), pick the language of your choice and click Select. Then
    click Remove Older Versions.
  • Accept any prompts.
  • Open JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista) again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest
    Java Runtime Environment (JRE) version for your computer.
    =============================
    NEXT

    Click Start > Control Panel.
    Double-click the Java icon in the control panel.
    The Java Control Panel appears.
    Click Settings under Temporary Internet Files.
    The Temporary Files Settings dialog box appears.

    There are three options on this window to clear the cache.

  • Delete Files
  • View Applications
  • View Applets


Click OK on Delete Temporary Files window.
Note: This deletes all the Downloaded Applications and Applets from the cache.
Click OK on Temporary Files Settings window.
================
In your next Reply let me know how everything went, If you have anymore problems, if everything
is working good we will finish up with the cleanup.
Post #27
I uninstalled quick time from the program list earlier and revo can't locate in in the search bar, so is there no use for it? I uninstalled java but the option to select where to download from is by default with internet explorer, and I only use firefox. Is there a way to download sun java without using IE?
Post #28
Hi AgentFrog,

I uninstalled quick time from the program list earlier and revo can't locate in in the search bar, so is there no use for it?

If you use ITunes then you would need Quicktime, if not then no you don't need it.

I uninstalled java but the option to select where to download from is by default with internet explorer, and I only use Firefox. Is there a way to download sun java without using IE?



You can use this link to download Java for Firefox.
http://www.java.com/en/download/help/firef…ine_install.xml

Even though you use Firefox… you still have Internet explorer. It's part of windows. Even though you don't use Internet Explorer it needs to be updated too.

Please let me know if you have any problems downloading Java in your next reply.
=====================
Time for some house cleaning

Follow these steps to uninstall Combofix


* Click START Search
* Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.
(Note: There is a space between the ..X and the /U that needs to be there.)

[external image: Posted Image]
============================
Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.


    If you notice any remaining tools or files you can delete them by right clicking and choosing delete.
    Any other tools we used can be deleted safely if they remain after these steps.
    ============================

    Now that you appear clean, :thumbup: please follow these simple steps in order to keep your computer clean and secure:

    Here are some tips to reduce the potential for spyware infection in the future:

    1. Make your Internet Explorer More Secure
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab.
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt.
  • Change the Download unsigned ActiveX controls to Disable.
  • Change the Initialise and script ActiveX controls not marked as safe to Disable.
  • Change the Installation of desktop items to Prompt.
  • Change the Launching programs and files in an IFRAME to Prompt.
  • Change the Navigate sub-frames across different domains to Prompt.
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
2. Update your Anti-Virus Software - I can not overemphasize the need for you to update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

3. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

4. SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here

5. MVPS HOSTS FILE replaces
  • your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
  • Download Host.zip and Save it to your Desktop.
  • Right-click hosts.zip and select 'Extract all files' or 'Extract files…'.
  • Follow the prompts and click 'Finish'.
  • This will open the newly created hosts folder on your Desktop.
  • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
  • Once updated you should see another prompt that the task was completed.

Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Good luck, happy computing and stay clean! :)
Post #29
A couple issues if you don't mind clearing up: -I can't install the new java, I get "Internal error 2753. regutils. dll -What's OTL.exe and where do I download it?
Post #30
Hi AgentFrog,

Let's try to get Java uninstalled completely and install the newest version.
  • If you are able, uninstall all previous versions of Java in Add/Remove Programs in your Control Panel.
  • Next, you may download the current version of Java here: http://java.com/en/download/manual.jsp
  • (I recommend that you use the offline installer version.)
  • Please download and run this automated tool to fix the Java MSI problem on all versions of windows: JavaMSIFix
  • Now you may install the version of Java that you had downloaded in the previous steps.
Let me know how that worked.

What's OTL.exe and where do I download it?

Please disregard the OTL instructions.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI