What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Page is loading, please wait. Malware? [Closed]

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I am running Windows XP, while on the internet I had a white page pop up that says "Page is loading, please wait. This may take up to 30 seconds." I cannot leave this screen. I have powered down my computer, tried to start in Safe Mode and Normally once I get past the initial startup screens I have the same screen. I cannot access my desktop, the internet, or any other screen. Please advise.
Post #2
One update after running malwarebytes and stinger I am now able to open in safe mode with networking, I still can not open in normal mode without the white screen and Please wait…appearing.
Post #3
OTL Text:OTL logfile created on: 9/11/2012 11:49:41 AM - Run 2
OTL by OldTimer - Version 3.2.61.3 Folder = E:\
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1014.37 Mb Total Physical Memory | 734.99 Mb Available Physical Memory | 72.46% Memory free
2.39 Gb Paging File | 2.31 Gb Available in Paging File | 96.95% Paging File free
Paging file location(s): c:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 87.96 Gb Total Space | 48.35 Gb Free Space | 54.97% Space Free | Partition Type: NTFS
Drive E: | 3.73 Gb Total Space | 3.66 Gb Free Space | 98.18% Space Free | Partition Type: FAT32

Computer Name: RICK | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - E:\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========


========== Services (SafeList) ==========

SRV - (ZY202_XP) – %systemroot%\system32\vetfddnt.dll File not found
SRV - (zpsc) – %systemroot%\system32\USBDeviceService.dll File not found
SRV - (w800obex) – %systemroot%\system32\nmraapache.dll File not found
SRV - (tpsrv) – %systemroot%\system32\SWUMX20.dll File not found
SRV - (TCtrlIO) – %systemroot%\system32\vc8secs.dll File not found
SRV - (stylexpservice) – %systemroot%\system32\iaimtv0.dll File not found
SRV - (sprtsvc_dellsupportcenter) – File not found
SRV - (SbieDrv) – %systemroot%\system32\mstdc.dll File not found
SRV - (rupsmon) – %systemroot%\system32\inorpc.dll File not found
SRV - (pdlnecfg) – %systemroot%\system32\pvservice.dll File not found
SRV - (midisyn) – %systemroot%\system32\trufos.dll File not found
SRV - (mgactrl) – %systemroot%\system32\dashsvc.dll File not found
SRV - (mfevtp) – C:\WINDOWS\system32\mfevtps.exe File not found
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe /McCoreSvc File not found
SRV - (LwUsbHid) – %systemroot%\system32\sbpci.dll File not found
SRV - (jaguar) – %systemroot%\system32\FETNDIS.dll File not found
SRV - (HidServ) – %SystemRoot%\System32\hidserv.dll File not found
SRV - (enxpsvr) – \.\globalroot\C:\WINDOWS\system32\svchost.exe File not found
SRV - (clr_optimization_v2.0.50215_32) – %systemroot%\system32\wanarp.dll File not found
SRV - (cidaemon) – %systemroot%\system32\bhmonitorservice.dll File not found
SRV - (ASDR) – %systemroot%\system32\uscbs108.dll File not found
SRV - (aalogger) – %systemroot%\system32\rapapp.dll File not found
SRV - (0116951347317188mcinstcleanup) – C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\011695~1.EXE File not found
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (nosGetPlusHelper) – C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (getPlusHelper) – C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (QBCFMonitorService) – C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (Intuit)
SRV - (spupdsvc) – C:\WINDOWS\system32\spupdsvc.exe (Microsoft Corporation)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (Maxtor Sync Service) – C:\Program Files\Maxtor\Sync\SyncServices.exe (Seagate Technology LLC)
SRV - (NkPtpEnumWT3) – C:\Program Files\Nikon\WT-4 Setup Utility\NkPtpEnum.exe (Nikon Corporation)
SRV - (WLANKEEPER) – C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe (Intel Corporation)
SRV - (QBFCService) – C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe (Intuit Inc.)
SRV - (DSBrokerService) – C:\Program Files\DellSupport\brkrsvc.exe ()


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (wanatw) – system32\DRIVERS\wanatw4.sys File not found
DRV - (UIUSys) – system32\DRIVERS\UIUSYS.SYS File not found
DRV - (SMNDIS5) – C:\PROGRA~1\VERIZO~1\VZACCE~1\SMNDIS5.SYS File not found
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys File not found
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS File not found
DRV - (SABProcEnum) – C:\Program Files\Internet Explorer\SABProcEnum.sys File not found
DRV - (rppkjrp) – System32\drivers\pkdixfg.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCTINDIS5) – C:\WINDOWS\system32\PCTINDIS5.SYS File not found
DRV - (PCIDump) – File not found
DRV - (NETw3x32) – system32\DRIVERS\NETw3x32.sys File not found
DRV - (MRESP50a64) – C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS File not found
DRV - (MREMP50a64) – C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS File not found
DRV - (mferkdet) – system32\drivers\mferkdet.sys File not found
DRV - (mfehidk) – system32\drivers\mfehidk.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (Changer) – File not found
DRV - (BVRPMPR5) – D:\INSTAL~E\Core\BVRPMPR5.SYS File not found
DRV - (MBAMProtector) – C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (PCASp50) – C:\WINDOWS\system32\drivers\PCASp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MREMP50) – C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) – C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (swmsflt) – C:\WINDOWS\system32\drivers\swmsflt.sys ()
DRV - (SWUMX80) – C:\WINDOWS\system32\drivers\swumx80.sys (Sierra Wireless Inc.)
DRV - (SWNC8U80) – C:\WINDOWS\system32\drivers\swnc8u80.sys (Sierra Wireless Inc.)
DRV - (VBus) – C:\WINDOWS\system32\drivers\NkVBus.sys (Nikon Corporation)
DRV - (NETw4x32) – C:\WINDOWS\system32\drivers\NETw4x32.sys (Intel Corporation)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (NWADI) – C:\WINDOWS\system32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (PTDMWWAN) – C:\WINDOWS\system32\drivers\PTDMWWAN.sys (DEVGURU Co,LTD.)
DRV - (PTDMVsp) – C:\WINDOWS\system32\drivers\PTDMVsp.sys (DEVGURU Co,LTD.)
DRV - (PTDMMdm) – C:\WINDOWS\system32\drivers\PTDMMdm.sys (DEVGURU Co,LTD.)
DRV - (PTDMBus) – C:\WINDOWS\system32\drivers\PTDMBus.sys (DEVGURU Co,LTD.)
DRV - (MXOPSWD) – C:\WINDOWS\system32\drivers\mxopswd.sys (Maxtor Corp.)
DRV - (dsunidrv) – C:\WINDOWS\system32\drivers\dsunidrv.sys (Gteko Ltd.)
DRV - (DSproct) – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)
DRV - (NWUSBPort) – C:\WINDOWS\system32\drivers\nwusbser.sys (Novatel Wireless Inc.)
DRV - (NWUSBModem) – C:\WINDOWS\system32\drivers\nwusbmdm.sys (Novatel Wireless Inc.)
DRV - (monfilt) – C:\WINDOWS\system32\drivers\monfilt.sys (Creative Technology Ltd.)
DRV - (w39n51) – C:\WINDOWS\system32\drivers\w39n51.sys (Intel® Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (rismxdp) – C:\WINDOWS\system32\drivers\rixdptsk.sys (REDC)
DRV - (rimsptsk) – C:\WINDOWS\system32\drivers\rimsptsk.sys (REDC)
DRV - (rimmptsk) – C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (APPDRV) – C:\WINDOWS\system32\drivers\APPDRV.SYS (Dell Inc)
DRV - (bcm4sbxp) – C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (HSFHWAZL) – C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (CTUSFSYN) – C:\WINDOWS\system32\drivers\ctusfsyn.sys (Creative Technology Ltd.)
DRV - (ctsfm2k) – C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (bvrp_pci) – C:\WINDOWS\system32\drivers\bvrp_pci.sys ()
DRV - (SDDMI2) – C:\WINDOWS\system32\DDMI2.sys (Gteko Ltd.)
DRV - (cdrbsdrv) – C:\WINDOWS\System32\drivers\CDRBSDRV.SYS (B.H.A Corporation)
DRV - (omci) – C:\WINDOWS\system32\drivers\omci.sys (Dell Inc)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = Reg Error: Value error.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = Reg Error: Value error.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MVT: C:\Program Files\McAfee\Supportability\MVT\npmvtplugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2536: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2594: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1698: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@real.com/RhapsodyPlayerEngine,version=1.0: C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{B46EBA59-CE0B-4D4C-9904-6900B03B7FAF}: C:\Documents and Settings\Richard Doremus\Local Settings\Application Data\{B46EBA59-CE0B-4D4C-9904-6900B03B7FAF}\ [2011/06/20 13:20:45 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/09/05 11:26:41 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/08/29 16:30:08 | 000,000,000 | —D | M]

[2012/09/05 11:26:40 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/08/24 22:01:06 | 000,266,720 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/04/14 14:01:38 | 000,024,376 | —- | M] (McAfee, Inc.) – C:\Program Files\mozilla firefox\components\Scriptff.dll
[2010/07/17 05:00:04 | 000,423,656 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/08/24 22:00:22 | 000,002,465 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/08/28 13:39:14 | 000,002,024 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\McSiteAdvisor.xml
[2012/08/24 22:00:22 | 000,002,253 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2004/08/04 08:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll (Yahoo! Inc.)
O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware (cleanup)] C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O9 - Extra Button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - %SystemRoot%\System32\mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - %SystemRoot%\System32\mswsock.dll File not found
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://support.microsoft.com/Dcode/ActiveX/MSDcode.cab (Microsoft Data Collection Control)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} Reg Error: Key error. (Reg Error: Key error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} http://h20264.www2.hp.com/ediags/dd/instal…nosticsxp2k.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F291A000-F207-4435-BA5D-914E5B7A7CCA}: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FC9FF78B-80DA-4599-A756-278175BB592B}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol\Handler\intu-help-qb1 {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2006\HelpAsyncPluggableProtocol.dll (TODO: )
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/11 18:15:00 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2010/11/22 14:08:16 | 000,000,110 | -H– | M] () - E:\autorun.inf – [ FAT32 ]
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/09/11 11:25:24 | 000,159,608 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\mfevtps.exe.8ab7.deleteme
[2012/09/11 09:24:25 | 000,000,000 | —D | C] – C:\Program Files\stinger
[2012/09/10 17:59:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\HitmanPro
[2012/09/10 16:31:52 | 000,000,000 | —D | C] – C:\WINDOWS\Prefetch
[2012/09/10 16:07:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Malwarebytes
[2012/09/10 16:01:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\rkill
[2012/09/10 11:31:53 | 000,156,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winzm.ime
[2012/09/10 11:31:52 | 000,156,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winsp.ime
[2012/09/10 11:31:51 | 000,156,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winpy.ime
[2012/09/10 11:31:50 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wingb.ime
[2012/09/10 11:31:50 | 000,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winime.ime
[2012/09/10 11:31:49 | 000,079,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winar30.ime
[2012/09/10 11:31:47 | 000,041,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\weitekp9.dll
[2012/09/10 11:31:47 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\weitekp9.sys
[2012/09/10 11:31:45 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wam51.dll
[2012/09/10 11:31:45 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wamreg51.dll
[2012/09/10 11:31:45 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wamps51.dll
[2012/09/10 11:31:43 | 000,363,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w3svc.dll
[2012/09/10 11:31:43 | 000,073,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w3ext.dll
[2012/09/10 11:31:43 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w3svapi.dll
[2012/09/10 11:31:43 | 000,004,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w3ctrs51.dll
[2012/09/10 11:31:42 | 000,048,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w32.dll
[2012/09/10 11:31:41 | 000,426,041 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\voicepad.dll
[2012/09/10 11:31:41 | 000,086,073 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\voicesub.dll
[2012/09/10 11:31:35 | 000,076,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\uniime.dll
[2012/09/10 11:31:35 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\unicdime.ime
[2012/09/10 11:31:34 | 000,103,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\uihelper.dll
[2012/09/10 11:31:33 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tsprof.exe
[2012/09/10 11:31:30 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tools.dll
[2012/09/10 11:31:30 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tmigrate.dll
[2012/09/10 11:31:29 | 000,571,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tintlgnt.ime
[2012/09/10 11:31:29 | 000,455,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tintsetp.exe
[2012/09/10 11:31:29 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tintlphr.exe
[2012/09/10 11:31:28 | 000,185,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\thawbrkr.dll
[2012/09/10 11:31:28 | 000,019,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tdspx.sys
[2012/09/10 11:31:27 | 000,021,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tdipx.sys
[2012/09/10 11:31:27 | 000,013,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tdasync.sys
[2012/09/10 11:31:23 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\svcext51.dll
[2012/09/10 11:31:22 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\status.dll
[2012/09/10 11:31:21 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sspifilt.dll
[2012/09/10 11:31:21 | 000,045,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ssinc51.dll
[2012/09/10 11:31:20 | 000,101,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srusbusd.dll
[2012/09/10 11:31:17 | 000,143,422 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\softkey.dll
[2012/09/10 11:31:16 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_snprfdll.dll
[2012/09/10 11:31:15 | 000,188,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpsmir.dll
[2012/09/10 11:31:15 | 000,040,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpthrd.dll
[2012/09/10 11:31:15 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpstup.dll
[2012/09/10 11:31:15 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmptrap.exe
[2012/09/10 11:31:14 | 000,358,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpincl.dll
[2012/09/10 11:31:14 | 000,259,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpcl.dll
[2012/09/10 11:31:14 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmp.exe
[2012/09/10 11:31:14 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpmib.dll
[2012/09/10 11:31:13 | 000,456,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smtpsvc.dll
[2012/09/10 11:31:12 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_smtpctrs.dll
[2012/09/10 11:31:11 | 000,236,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smi2smir.exe
[2012/09/10 11:31:11 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smb6w.dll
[2012/09/10 11:31:11 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smierrsm.dll
[2012/09/10 11:31:11 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smimsgif.dll
[2012/09/10 11:31:11 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smierrsy.dll
[2012/09/10 11:31:10 | 000,038,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm9aw.dll
[2012/09/10 11:31:10 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sma3w.dll
[2012/09/10 11:31:10 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm93w.dll
[2012/09/10 11:31:10 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm92w.dll
[2012/09/10 11:31:10 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm90w.dll
[2012/09/10 11:31:09 | 000,029,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm8cw.dll
[2012/09/10 11:31:09 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm8dw.dll
[2012/09/10 11:31:09 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm8aw.dll
[2012/09/10 11:31:09 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm89w.dll
[2012/09/10 11:31:08 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm87w.dll
[2012/09/10 11:31:08 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm81w.dll
[2012/09/10 11:31:08 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm59w.dll
[2012/09/10 11:31:07 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\simptcp.dll
[2012/09/10 11:31:01 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_seos.dll
[2012/09/10 11:31:00 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_scripto.dll
[2012/09/10 11:30:57 | 000,079,872 | —- | C] (Ricoh Co., Ltd.) – C:\WINDOWS\System32\dllcache\rwia330.dll
[2012/09/10 11:30:57 | 000,079,872 | —- | C] (Ricoh Co., Ltd.) – C:\WINDOWS\System32\dllcache\rwia001.dll
[2012/09/10 11:30:57 | 000,026,624 | —- | C] (Ricoh Co., Ltd.) – C:\WINDOWS\System32\dllcache\rw330ext.dll
[2012/09/10 11:30:56 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rw001ext.dll
[2012/09/10 11:30:54 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rpcref.dll
[2012/09/10 11:30:53 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\romanime.ime
[2012/09/10 11:30:52 | 000,023,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_regtrace.exe
[2012/09/10 11:30:51 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\register.exe
[2012/09/10 11:30:48 | 000,020,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ramdisk.sys
[2012/09/10 11:30:47 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\quick.ime
[2012/09/10 11:30:47 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\quser.exe
[2012/09/10 11:30:47 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\query.exe
[2012/09/10 11:30:45 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pwsdata.dll
[2012/09/10 11:30:42 | 000,131,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pmxviceo.dll
[2012/09/10 11:30:42 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pmxmcro.dll
[2012/09/10 11:30:41 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pmigrate.dll
[2012/09/10 11:30:41 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pmxgl.dll
[2012/09/10 11:30:40 | 000,482,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pintlgnt.ime
[2012/09/10 11:30:40 | 000,070,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pintlphr.exe
[2012/09/10 11:30:40 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pintlcsd.dll
[2012/09/10 11:30:39 | 000,079,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\phon.ime
[2012/09/10 11:30:38 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\permchk.dll
[2012/09/10 11:30:36 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pagecnt.dll
[2012/09/10 11:30:36 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\padrs804.dll
[2012/09/10 11:30:35 | 000,036,927 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\padrs411.dll
[2012/09/10 11:30:35 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\padrs404.dll
[2012/09/10 11:30:35 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\padrs412.dll
[2012/09/10 11:30:28 | 000,038,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_ntfsdrv.dll
[2012/09/10 11:30:27 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nsepm.dll
[2012/09/10 11:30:24 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nextlink.dll
[2012/09/10 11:30:19 | 000,229,439 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\multibox.dll
[2012/09/10 11:30:18 | 000,111,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mtstocom.exe
[2012/09/10 11:30:10 | 001,875,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msir3jp.lex
[2012/09/10 11:30:10 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msir3jp.dll
[2012/09/10 11:29:54 | 000,092,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mga.sys
[2012/09/10 11:29:54 | 000,092,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mga.dll
[2012/09/10 11:29:54 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\migregdb.exe
[2012/09/10 11:29:53 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\metada51.dll
[2012/09/10 11:29:53 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mdsync.dll
[2012/09/10 11:29:52 | 000,037,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\md5filt.dll
[2012/09/10 11:29:51 | 000,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_mailmsg.dll
[2012/09/10 11:29:50 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lprmon.dll
[2012/09/10 11:29:49 | 000,022,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lpdsvc.dll
[2012/09/10 11:29:49 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\logscrpt.dll
[2012/09/10 11:29:49 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lonsint.dll
[2012/09/10 11:29:47 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lmmib2.dll
[2012/09/10 11:29:45 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\korwbrkr.dll
[2012/09/10 11:29:44 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdvntc.dll
[2012/09/10 11:29:43 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdusa.dll
[2012/09/10 11:29:43 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdurdu.dll
[2012/09/10 11:29:42 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth3.dll
[2012/09/10 11:29:42 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth2.dll
[2012/09/10 11:29:42 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth1.dll
[2012/09/10 11:29:42 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth0.dll
[2012/09/10 11:29:42 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsyr2.dll
[2012/09/10 11:29:42 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsyr1.dll
[2012/09/10 11:29:40 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdnecat.dll
[2012/09/10 11:29:40 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdnecnt.dll
[2012/09/10 11:29:40 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdnec95.dll
[2012/09/10 11:29:39 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlk41a.dll
[2012/09/10 11:29:39 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlk41j.dll
[2012/09/10 11:29:38 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinpun.dll
[2012/09/10 11:29:38 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdintel.dll
[2012/09/10 11:29:38 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdintam.dll
[2012/09/10 11:29:38 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinmar.dll
[2012/09/10 11:29:38 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinkan.dll
[2012/09/10 11:29:37 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinhin.dll
[2012/09/10 11:29:37 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinguj.dll
[2012/09/10 11:29:37 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdindev.dll
[2012/09/10 11:29:36 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdibm02.dll
[2012/09/10 11:29:36 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdheb.dll
[2012/09/10 11:29:36 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdgeo.dll
[2012/09/10 11:29:35 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdfa.dll
[2012/09/10 11:29:35 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbddiv2.dll
[2012/09/10 11:29:35 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbddiv1.dll
[2012/09/10 11:29:34 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdax2.dll
[2012/09/10 11:29:34 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbda3.dll
[2012/09/10 11:29:34 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbda2.dll
[2012/09/10 11:29:34 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdarmw.dll
[2012/09/10 11:29:34 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdarme.dll
[2012/09/10 11:29:33 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jupiw.dll
[2012/09/10 11:29:33 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd106n.dll
[2012/09/10 11:29:33 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd101a.dll
[2012/09/10 11:29:33 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd101.dll
[2012/09/10 11:29:33 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbda1.dll
[2012/09/10 11:29:32 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iwrps.dll
[2012/09/10 11:29:31 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iscomlog.dll
[2012/09/10 11:29:31 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\isapips.dll
[2012/09/10 11:29:29 | 000,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iprip.dll
[2012/09/10 11:29:27 | 000,257,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\infocomm.dll
[2012/09/10 11:29:27 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\infoctrs.dll
[2012/09/10 11:29:26 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetin51.exe
[2012/09/10 11:29:25 | 000,471,102 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imskdic.dll
[2012/09/10 11:29:25 | 000,315,452 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imskf.dll
[2012/09/10 11:29:24 | 000,274,489 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjputyc.dll
[2012/09/10 11:29:24 | 000,262,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjputy.exe
[2012/09/10 11:29:24 | 000,102,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imlang.dll
[2012/09/10 11:29:24 | 000,059,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imkrinst.exe
[2012/09/10 11:29:23 | 000,233,527 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjprw.exe
[2012/09/10 11:29:23 | 000,208,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpmig.exe
[2012/09/10 11:29:23 | 000,045,109 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpuex.exe
[2012/09/10 11:29:22 | 000,716,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpcus.dll
[2012/09/10 11:29:22 | 000,307,257 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpdct.exe
[2012/09/10 11:29:22 | 000,155,705 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpdsvr.exe
[2012/09/10 11:29:22 | 000,081,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpdct.dll
[2012/09/10 11:29:22 | 000,057,398 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpdadm.exe
[2012/09/10 11:29:21 | 000,811,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjp81k.dll
[2012/09/10 11:29:21 | 000,368,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpcic.dll
[2012/09/10 11:29:21 | 000,340,023 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjp81.ime
[2012/09/10 11:29:20 | 000,311,359 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imepadsv.exe
[2012/09/10 11:29:20 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imekrcic.dll
[2012/09/10 11:29:20 | 000,102,463 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imepadsm.dll
[2012/09/10 11:29:20 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imekrmbx.dll
[2012/09/10 11:29:20 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imekrmig.exe
[2012/09/10 11:29:19 | 000,094,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imekr61.ime
[2012/09/10 11:29:18 | 000,079,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iislog51.dll
[2012/09/10 11:29:18 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iiscrmap.dll
[2012/09/10 11:29:18 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisfecnv.dll
[2012/09/10 11:29:18 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iissync.exe
[2012/09/10 11:29:18 | 000,003,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iismui.dll
[2012/09/10 11:29:17 | 000,145,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iische51.dll
[2012/09/10 11:29:17 | 000,060,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisclex4.dll
[2012/09/10 11:29:17 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisadmin.dll
[2012/09/10 11:29:07 | 010,129,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hwxkor.dll
[2012/09/10 11:28:54 | 010,096,640 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hwxcht.dll
[2012/09/10 11:28:53 | 000,268,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\httpext.dll
[2012/09/10 11:28:53 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\httpod51.dll
[2012/09/10 11:28:53 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\httpmb51.dll
[2012/09/10 11:28:51 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hostmib.dll
[2012/09/10 11:28:49 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hanjadic.dll
[2012/09/10 11:28:48 | 000,032,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\gzip.dll
[2012/09/10 11:28:44 | 000,125,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ftpsv251.dll
[2012/09/10 11:28:44 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ftpmib.dll
[2012/09/10 11:28:43 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ftpctrs2.dll
[2012/09/10 11:28:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ftlx041e.dll
[2012/09/10 11:28:42 | 000,024,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpadmcgi.exe
[2012/09/10 11:28:42 | 000,020,541 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpadmdll.dll
[2012/09/10 11:28:41 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\flattemp.exe
[2012/09/10 11:28:40 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_fcachdll.dll
[2012/09/10 11:28:39 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\exstrace.dll
[2012/09/10 11:28:39 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\f3ahvoas.dll
[2012/09/10 11:28:38 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\evntagnt.dll
[2012/09/10 11:28:38 | 000,092,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\evntwin.exe
[2012/09/10 11:28:38 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\evntcmd.exe
[2012/09/10 11:28:36 | 000,057,856 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\dllcache\esuimgd.dll
[2012/09/10 11:28:36 | 000,045,056 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\dllcache\esunid.dll
[2012/09/10 11:28:36 | 000,031,744 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\dllcache\esucmd.dll
[2012/09/10 11:28:36 | 000,025,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\et4000.sys
[2012/09/10 11:28:24 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dayi.ime
[2012/09/10 11:28:23 | 000,042,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\davcdata.exe
[2012/09/10 11:28:20 | 000,057,399 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cplexe.exe
[2012/09/10 11:28:20 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\counters.dll
[2012/09/10 11:28:20 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cprofile.exe
[2012/09/10 11:28:19 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\convlog.exe
[2012/09/10 11:28:19 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\controt.dll
[2012/09/10 11:28:17 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\compfilt.dll
[2012/09/10 11:28:14 | 000,480,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cintsetp.exe
[2012/09/10 11:28:14 | 000,198,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cintime.dll
[2012/09/10 11:28:14 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cintlgnt.ime
[2012/09/10 11:28:13 | 000,838,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chtbrkr.dll
[2012/09/10 11:28:13 | 000,097,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chtmbx.dll
[2012/09/10 11:28:13 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chtskdic.dll
[2012/09/10 11:28:12 | 001,677,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chsbrkr.dll
[2012/09/10 11:28:11 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chgport.exe
[2012/09/10 11:28:11 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chgusr.exe
[2012/09/10 11:28:11 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chglogon.exe
[2012/09/10 11:28:11 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\change.exe
[2012/09/10 11:28:10 | 000,078,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chajei.ime
[2012/09/10 11:28:08 | 000,054,528 | —- | C] (Philips Semiconductors GmbH) – C:\WINDOWS\System32\dllcache\cap7146.sys
[2012/09/10 11:28:08 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\c_iscii.dll
[2012/09/10 11:28:08 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\c_is2022.dll
[2012/09/10 11:28:07 | 000,218,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\c_g18030.dll
[2012/09/10 11:27:52 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\browscap.dll
[2012/09/10 11:27:48 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\authfilt.dll
[2012/09/10 11:27:45 | 000,029,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\asptxn.dll
[2012/09/10 11:27:44 | 000,369,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\asp51.dll
[2012/09/10 11:27:44 | 000,331,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aqueue.dll
[2012/09/10 11:27:44 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aspperf.dll
[2012/09/10 11:27:43 | 000,108,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\appconf.dll
[2012/09/10 11:27:43 | 000,045,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_aqadmin.dll
[2012/09/10 11:27:42 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0804.dll
[2012/09/10 11:27:41 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0412.dll
[2012/09/10 11:27:41 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0411.dll
[2012/09/10 11:27:41 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt040d.dll
[2012/09/10 11:27:41 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0404.dll
[2012/09/10 11:27:40 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0401.dll
[2012/09/10 11:27:38 | 000,049,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\adrot.dll
[2012/09/10 11:27:38 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_adsiisex.dll
[2012/09/10 11:27:37 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\admexs.dll
[2012/09/10 11:27:37 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\admxprox.dll
[2012/09/10 11:27:30 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wamregps.dll
[2012/09/10 11:27:29 | 000,032,827 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tcptest.exe
[2012/09/10 11:27:29 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tcptsat.dll
[2012/09/10 11:27:28 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\staxmem.dll
[2012/09/10 11:27:27 | 000,020,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shtml.dll
[2012/09/10 11:27:27 | 000,016,437 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shtml.exe
[2012/09/10 11:27:20 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\logui.ocx
[2012/09/10 11:27:19 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\isatq.dll
[2012/09/10 11:27:19 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetsloc.dll
[2012/09/10 11:27:19 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\infoadmn.dll
[2012/09/10 11:27:18 | 000,829,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetmgr.dll
[2012/09/10 11:27:18 | 000,169,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisui.dll
[2012/09/10 11:27:18 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisrtl.dll
[2012/09/10 11:27:18 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisrstas.exe
[2012/09/10 11:27:18 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetmgr.exe
[2012/09/10 11:27:17 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisext51.dll
[2012/09/10 11:27:17 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iismap.dll
[2012/09/10 11:27:17 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisreset.exe
[2012/09/10 11:27:17 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisrstap.dll
[2012/09/10 11:27:16 | 000,208,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpmmcsat.dll
[2012/09/10 11:27:16 | 000,020,538 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpremadm.exe
[2012/09/10 11:27:16 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ftpsapi2.dll
[2012/09/10 11:27:15 | 000,598,071 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpmmc.dll
[2012/09/10 11:27:15 | 000,188,494 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpcount.exe
[2012/09/10 11:27:15 | 000,109,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp98swin.exe
[2012/09/10 11:27:15 | 000,020,541 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpexedll.dll
[2012/09/10 11:27:14 | 000,876,653 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4awel.dll
[2012/09/10 11:27:14 | 000,049,212 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4awebs.dll
[2012/09/10 11:27:14 | 000,032,826 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4avss.dll
[2012/09/10 11:27:14 | 000,014,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp98sadm.exe
[2012/09/10 11:27:13 | 000,147,513 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4apws.dll
[2012/09/10 11:27:13 | 000,102,509 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4atxt.dll
[2012/09/10 11:27:13 | 000,082,035 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4anscp.dll
[2012/09/10 11:27:13 | 000,049,210 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4areg.dll
[2012/09/10 11:27:13 | 000,041,020 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4avnb.dll
[2012/09/10 11:27:12 | 000,184,435 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4amsft.dll
[2012/09/10 11:27:11 | 000,076,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cnfgprts.ocx
[2012/09/10 11:27:11 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\coadmin.dll
[2012/09/10 11:27:10 | 000,275,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\certwiz.ocx
[2012/09/10 11:27:10 | 000,188,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cfgwiz.exe
[2012/09/10 11:27:10 | 000,094,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\certmap.ocx
[2012/09/10 11:27:10 | 000,016,439 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\author.exe
[2012/09/10 11:27:09 | 000,290,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\adsiis51.dll
[2012/09/10 11:27:09 | 000,020,540 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\author.dll
[2012/09/10 11:27:08 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\admwprox.dll
[2012/09/10 11:27:08 | 000,016,439 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\admin.exe
[2012/09/10 11:27:07 | 000,020,540 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\admin.dll
[2012/09/10 11:19:53 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\isignup.exe
[2012/09/10 11:02:49 | 000,024,661 | —- | C] (Perle Systems Ltd.) – C:\WINDOWS\System32\spxcoins.dll
[2012/09/10 11:02:49 | 000,024,661 | —- | C] (Perle Systems Ltd.) – C:\WINDOWS\System32\dllcache\spxcoins.dll
[2012/09/10 11:02:49 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\irclass.dll
[2012/09/10 11:02:49 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\irclass.dll
[2012/09/10 08:38:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Roaming
[2012/09/10 08:38:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Macromedia
[2012/09/06 17:38:54 | 000,000,000 | -H-D | C] – C:\WINDOWS\PIF
[2012/09/06 09:11:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\036DFF6ACE26766C000103417B07D287
[2012/09/05 11:26:46 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service
[2012/09/05 11:26:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Mozilla
[2012/08/30 09:21:59 | 000,000,000 | —D | C] – C:\Program Files\Eusing Free Registry Cleaner
[2012/08/29 16:35:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SpeedyPC Software
[19 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/09/11 11:25:20 | 000,159,608 | —- | M] (McAfee, Inc.) – C:\WINDOWS\System32\mfevtps.exe.8ab7.deleteme
[2012/09/11 11:20:11 | 000,537,876 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/09/11 11:20:11 | 000,110,756 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/09/11 11:16:16 | 000,002,422 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/09/11 11:15:53 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/09/11 11:14:00 | 000,000,442 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{22DB5D8C-4313-4EBD-9E39-AA4C57584F3F}.job
[2012/09/11 10:06:05 | 000,000,276 | —- | M] () – C:\WirelessDiagLog.csv
[2012/09/11 09:12:28 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2012/09/10 16:38:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/09/10 11:43:22 | 001,579,568 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/09/10 11:36:31 | 000,000,288 | —- | M] () – C:\WINDOWS\System32\$winnt$.inf
[2012/09/10 11:22:18 | 000,316,640 | —- | M] () – C:\WINDOWS\WMSysPr9.prx
[2012/09/10 11:22:17 | 000,023,392 | —- | M] () – C:\WINDOWS\System32\nscompat.tlb
[2012/09/10 11:22:17 | 000,016,832 | —- | M] () – C:\WINDOWS\System32\amcompat.tlb
[2012/09/10 11:22:00 | 000,004,161 | —- | M] () – C:\WINDOWS\ODBCINST.INI
[2012/09/10 11:18:06 | 000,023,396 | —- | M] () – C:\WINDOWS\System32\emptyregdb.dat
[2012/09/10 11:17:33 | 000,000,989 | —- | M] () – C:\WINDOWS\System32\mapisvc.inf
[2012/09/10 11:08:02 | 000,004,128 | —- | M] () – C:\INFCACHE.1
[2012/09/10 10:27:14 | 000,000,000 | -HS- | M] () – C:\WINDOWS\System32\dds_trash_log.cmd
[2012/09/10 10:26:42 | 1063,743,488 | —- | M] () – C:\WINDOWS\MEMORY.DMP
[2012/09/10 08:33:39 | 000,398,336 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\hLqkG6es.exe
[2012/09/07 17:04:46 | 000,022,856 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/09/06 15:55:37 | 004,503,728 | —- | M] () – C:\Documents and Settings\All Users\Application Data\dsgsdgdsgdsgw.pad
[2012/09/05 11:26:50 | 000,000,724 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2012/08/27 16:46:23 | 004,503,728 | —- | M] () – C:\Documents and Settings\All Users\Application Data\ism_0_llatsni.pad
[19 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/09/10 11:30:39 | 000,175,104 | —- | C] () – C:\WINDOWS\System32\dllcache\pintlcsa.dll
[2012/09/10 11:29:45 | 001,158,818 | —- | C] () – C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2012/09/10 11:29:25 | 000,059,392 | —- | C] () – C:\WINDOWS\System32\dllcache\imscinst.exe
[2012/09/10 11:29:23 | 000,196,665 | —- | C] () – C:\WINDOWS\System32\dllcache\imjpinst.exe
[2012/09/10 11:29:19 | 000,134,339 | —- | C] () – C:\WINDOWS\System32\dllcache\imekr.lex
[2012/09/10 11:29:00 | 013,463,552 | —- | C] () – C:\WINDOWS\System32\dllcache\hwxjpn.dll
[2012/09/10 11:28:49 | 000,108,827 | —- | C] () – C:\WINDOWS\System32\dllcache\hanja.lex
[2012/09/10 11:28:43 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\dllcache\fpencode.dll
[2012/09/10 11:28:13 | 000,173,568 | —- | C] () – C:\WINDOWS\System32\dllcache\chtskf.dll
[2012/09/10 11:02:34 | 000,141,702 | —- | C] () – C:\WINDOWS\System32\dllcache\netfx.cat
[2012/09/10 11:02:34 | 000,110,116 | —- | C] () – C:\WINDOWS\System32\dllcache\tabletpc.cat
[2012/09/10 11:02:34 | 000,031,965 | —- | C] () – C:\WINDOWS\System32\dllcache\mediactr.cat
[2012/09/10 11:02:34 | 000,024,209 | —- | C] () – C:\WINDOWS\System32\dllcache\msn7.cat
[2012/09/10 11:02:34 | 000,011,651 | —- | C] () – C:\WINDOWS\System32\dllcache\msn9.cat
[2012/09/10 11:02:34 | 000,007,245 | —- | C] () – C:\WINDOWS\System32\dllcache\MSTSWEB.CAT
[2012/09/10 11:02:33 | 000,031,281 | —- | C] () – C:\WINDOWS\System32\dllcache\FP4.CAT
[2012/09/10 11:02:33 | 000,013,753 | —- | C] () – C:\WINDOWS\System32\dllcache\IMS.CAT
[2012/09/10 11:02:33 | 000,009,581 | —- | C] () – C:\WINDOWS\System32\dllcache\MSMSGS.CAT
[2012/09/10 11:02:32 | 000,502,724 | —- | C] () – C:\WINDOWS\System32\dllcache\NT5INF.CAT
[2012/09/10 09:54:34 | 1063,743,488 | —- | C] () – C:\WINDOWS\MEMORY.DMP
[2012/09/10 08:38:18 | 000,398,336 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\hLqkG6es.exe
[2012/09/06 15:54:25 | 004,503,728 | —- | C] () – C:\Documents and Settings\All Users\Application Data\dsgsdgdsgdsgw.pad
[2012/09/05 11:26:50 | 000,000,724 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2012/09/05 11:26:49 | 000,000,730 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2012/08/27 16:45:33 | 004,503,728 | —- | C] () – C:\Documents and Settings\All Users\Application Data\ism_0_llatsni.pad
[2012/07/15 16:20:47 | 004,503,728 | —- | C] () – C:\Documents and Settings\All Users\Application Data\to_r0tsef.pad
[2012/06/26 15:32:03 | 004,503,728 | —- | C] () – C:\Documents and Settings\All Users\Application Data\l_0_00_re.pad
[2012/02/16 13:15:20 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/06/20 13:20:47 | 000,000,120 | —- | C] () – C:\WINDOWS\Sneziya.dat
[2011/06/20 13:20:47 | 000,000,000 | —- | C] () – C:\WINDOWS\Hxoyuqehisuke.bin
[2011/06/13 12:41:18 | 000,010,212 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\oxe4a8lc08d40015ts4kxy0l2g8y5v86473qqplw73g
[2011/06/06 18:40:23 | 000,010,558 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\4rlords48my6ncc8
[2011/05/03 14:08:24 | 000,013,428 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\4w1twtdbd4me
[2011/04/15 17:13:28 | 000,010,686 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\ifrwimw7i5k53l0y181433k3t5j5
[2009/09/01 19:13:52 | 000,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLeq.DAT
[2009/09/01 19:03:02 | 000,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\business-inkjet
[2009/09/01 19:03:02 | 000,000,012 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\laserjet
[2009/09/01 19:03:02 | 000,000,000 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdw.DAT
[2009/09/01 18:59:21 | 000,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Work - Home
[2009/09/01 18:59:21 | 000,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\filter
[2009/09/01 18:59:21 | 000,000,000 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2006/12/31 19:51:52 | 000,001,759 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/05/10 07:32:17 | 000,000,136 | -H– | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\fusioncache.dat
[2004/08/04 08:00:00 | 000,002,048 | -HS- | C] () – C:\Documents and Settings\Richard Doremus\Local Settings\Application Data\{23f67f8f-0d68-0737-3ff4-171cc73f5a81}\@

========== LOP Check ==========

[2012/09/10 08:38:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Roaming
[2012/09/06 09:13:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\036DFF6ACE26766C000103417B07D287
[2010/12/07 15:56:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Applications
[2009/10/02 09:32:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AT&T
[2007/12/04 11:25:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Citrix
[2009/09/01 19:13:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ColorSync
[2008/04/09 09:28:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\COMMON FILES
[2009/09/01 19:13:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2010/06/15 19:30:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FileCure
[2012/09/10 17:59:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\HitmanPro
[2008/07/23 16:35:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Maxtor
[2010/03/16 20:49:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Micro
[2010/11/30 09:34:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2009/07/27 18:09:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2011/05/31 15:38:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCDr
[2011/09/21 16:40:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SpeedyPC
[2012/08/29 16:51:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SpeedyPC Software
[2007/12/18 20:14:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SupportSoft
[2009/02/04 10:26:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2012/08/29 16:56:05 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\UDA ConstructionSuite 2009
[2009/09/01 19:13:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2006/05/10 07:21:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2006/06/20 15:18:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WildTangent
[2009/06/03 11:40:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2006/10/28 17:59:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Yahoo
[2010/04/20 11:30:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/09/12 08:13:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/21 20:50:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/11/25 15:20:30 | 000,000,314 | —- | M] () – C:\WINDOWS\Tasks\expressripShakeIcon.job
[2011/09/17 05:02:00 | 000,000,254 | —- | M] () – C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
[2010/11/30 11:14:00 | 000,000,298 | —- | M] () – C:\WINDOWS\Tasks\switchShakeIcon.job
[2012/09/11 11:14:00 | 000,000,442 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{22DB5D8C-4313-4EBD-9E39-AA4C57584F3F}.job

========== Purity Check ==========



========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\WINDOWS\$NtUninstallKB147$] -> Error: Cannot create file handle -> Unknown point type

< End of report >
Post #4
Hi rdor, welcome to the forum.

To make cleaning this machine easier
  • Please do not uninstall/install any programs unless asked to
    It is more difficult when files/programs are appearing in/disappearing from the logs.
  • Please do not run any scans other than those requested
  • Please follow all instructions in the order posted
  • All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
  • Do not attach any logs/reports, etc.. unless specifically requested to do so.
  • If you have problems with or do not understand the instructions, Please ask before continuing.
  • Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Please note you will not be able disable your security programs as you will be in safe mode. When combofix reboots he machine boot back to safe mode and let it fishish, Save the log and boot to normal windows and post the log.

Please read through the instructions to familarize youself with what to expect when the tool runs.

It is vitally important that combofix is renamed before it is even started to download


Please download ComboFix from Link 1

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

  • If you are using Firefox, make sure that your download settings are as follows:
    -Tools->Options->Main tab
    -Set to "Always ask me where to Save the files".
  • During the download, before you save it to your desktop, rename Combofix to jgh.exe

  • It is important you rename Combofix during the download, but not after.
  • Please do not rename Combofix to other names, but only to the one indicated.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix

———————————————————–

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

    ———————————————————–

  • Double click on ComboFix.exe (jgh.exe in your case) & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with
  • combofix log
How is the computer?

Thanks
Post #5
Hello and thank you for your assistance. I will follow the instructions. Going forward I will not do anything that is not instructed. I am able to open in safe mode but nothing appears, no icons etc. I can open with command prompt, should I download the combofix to a flash drive and run from command prompt?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI