What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Backdoor.trojan Per Norton

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Keep getting Norton Virus Alerts - Backdoor.trojan virus. Object Name: c:\windows\system32\wdmipbc.dll. Access denied.

The messages just keeps growing. I have update Norton and ran a scan at least 8 times. In safe Mode, Restore off and any other way I can find. I have ran virus scans with several other AV programs, ran all the Spyware programs that I have seen on your site and nothing is found. I just keep getting the NAV alerts. It started out with about 4, my last count was 45.

I am copying HJT log, do you see anything? I have tried hard not to have to come back to your forum as it appears that you have so many requests. Sorry…..

Logfile of HijackThis v1.98.0
Scan saved at 9:21:02 PM, on 7/20/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Documents and Settings\All Users\Documents\Aladdin Systems\Internet Cleanup\NetBlockadeMonitor.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Documents and Settings\All Users\Documents\Aladdin Systems\Internet Cleanup\ONICTASK.exe
C:\Documents and Settings\Shotsie\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://jacksonville.usonline.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://jacksonville.usonline.com
F0 - system.ini: Shell=
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: ICHlprObj Class - {1f0c8547-2639-4c91-b8aa-c7eca24c3163} - C:\DOCUME~1\ALLUSE~1\DOCUME~1\ALADDI~1\INTERN~1\ic3hlpr.dll
O2 - BHO: PopupFilter Class - {1F2E844B-8211-46ff-8262-772F03295CF4} - C:\PROGRA~1\ALADDI~1\INTERN~1\PopFiltr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\DOCUME~1\ALLUSE~1\DOCUME~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [WinFSG] "C:\Program Files\Aladdin Systems\Internet Cleanup\MSFG.exe"
O4 - HKLM\..\Run: [NBMonitor] C:\Documents and Settings\All Users\Documents\Aladdin Systems\Internet Cleanup\NetBlockadeMonitor.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - Startup: IC Task Manager.lnk = C:\Documents and Settings\All Users\Documents\Aladdin Systems\Internet Cleanup\ONICTASK.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra button: Microsoft® JavaScript® Console - {642C0086-7195-4F07-9A4C-2C6E62D8932A} - (no file)
O9 - Extra 'Tools' menuitem: JavaScript Console - {642C0086-7195-4F07-9A4C-2C6E62D8932A} - (no file)
O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - (no file)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - DefaultPrefix:
O13 - WWW Prefix:
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{617AF767-2CDE-438C-9E66-04FEEB5C1D7A}: NameServer = 69.57.96.4 69.57.96.5
O20 - AppInit_DLLs: C:\WINDOWS\System32\wdmipbc.dll
Post #2
Does Norton give you a name for this virus? If so, please post the name Norton calls it. I believe we can get your machine back to normal. :)
Post #3
Below is a copy of the virus alert log from Norton. All it says is backdoor.trojan Object name: C:\Wndows\System32\wdmipbc.dll. That's all of the information Norton has given me which flashes on my desktop. The virus scans shows nothing. This log just keeps growing and growing and doesn't say anything. Thanks for your response. Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\Documents and Settings\Shotsie\Local Settings\Temporary Internet Files\Content.IE5\67E3YHCV\exploit[1].htm Source: C:\Documents and Settings\Shotsie\Local Settings\Temporary Internet Files\Content.IE5\67E3YHCV\exploit[1].htm Source: C:\Documents and Settings\Shotsie\Local Settings\Temporary Internet Files\Content.IE5\A7MTGBQ3\s3[2].js Source: C:\Documents and Settings\Shotsie\Local Settings\Temporary Internet Files\Content.IE5\WFWRQFCN\shellscript[1].js Source: C:\Documents and Settings\Shotsie\Local Settings\Temporary Internet Files\Content.IE5\WFWRQFCN\shellscript[1].js Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\Documents and Settings\Shotsie\Local Settings\Temporary Internet Files\Content.IE5\8BYDAN41\test[1].htm Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\windows\system32\wdmipbc.dll Source: C:\windows\system32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\System32\wdmipbc.dll Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C:\WINDOWS\SYSTEM32\WDMIPBC.DLL Source: C
Post #5
I ran the TrendMicro scan. It came up with three viruses.

Troj Agent. BK c:\windows\system32\corelsys.dll
Troj Strtpage.EA c:\windows\system32\jsconsole.dll
Troj Agent.BK c:\windows\corelsys.dll

All were Not Cleanable.

I tried to look these up, but couldn't find anything. I did download the Fix Tool for Troj_Agent.AC and ran it. One other thing, my system was running extremely slow and I am not very patient person. When I clicked on Alt, Ctrl & Delete, it came up with a huge amount of files that were running. I did not recognize any of them. Once I got rid of them, the Norton Virus Alert message disappeared and it hasn't shown up again. SO FAR! This same thing happened to someone my husband works with.

I am attaching a new HJT log for you to review. I didn't see the files shown above, but I don't know what I am looking for.

Question? Once this machine is clean again, if ever, would you suggest installing a firewall. I know XP is supposed to come with one, but it doesn't appear to work well. I believe I saw somewhere on your site where you suggested one in particular, but I can't find it now.

sorry this is so long. God bless you and your volunteers.

Logfile of HijackThis v1.98.0
Scan saved at 6:08:08 PM, on 7/22/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\mHotkey.exe
C:\Documents and Settings\All Users\Documents\Aladdin Systems\Internet Cleanup\NetBlockadeMonitor.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Documents and Settings\All Users\Documents\Aladdin Systems\Internet Cleanup\ONICTASK.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Documents and Settings\All Users\Documents\Aladdin Systems\Internet Cleanup\icadclse.exe
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\System32\MsiExec.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Shotsie\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://jacksonville.usonline.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://jacksonville.usonline.com
F0 - system.ini: Shell=
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: PopupFilter Class - {1F2E844B-8211-46ff-8262-772F03295CF4} - C:\PROGRA~1\ALADDI~1\INTERN~1\PopFiltr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\DOCUME~1\ALLUSE~1\DOCUME~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [WinFSG] "C:\Program Files\Aladdin Systems\Internet Cleanup\MSFG.exe"
O4 - HKLM\..\Run: [NBMonitor] C:\Documents and Settings\All Users\Documents\Aladdin Systems\Internet Cleanup\NetBlockadeMonitor.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - Startup: IC Task Manager.lnk = C:\Documents and Settings\All Users\Documents\Aladdin Systems\Internet Cleanup\ONICTASK.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra button: Microsoft® JavaScript® Console - {642C0086-7195-4F07-9A4C-2C6E62D8932A} - (no file)
O9 - Extra 'Tools' menuitem: JavaScript Console - {642C0086-7195-4F07-9A4C-2C6E62D8932A} - (no file)
O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - (no file)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - DefaultPrefix:
O13 - WWW Prefix:
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O20 - AppInit_DLLs: C:\WINDOWS\System32\wdmipbc.dll
Post #6 last edited
Okie dokie.. The log isn't looking too far out of whack. ;)

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Fix these items with Hijack This!:

F0 - system.ini: Shell=

O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)

O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)

O9 - Extra button: Microsoft® JavaScript® Console - {642C0086-7195-4F07-9A4C-2C6E62D8932A} - (no file)

O9 - Extra 'Tools' menuitem: JavaScript Console - {642C0086-7195-4F07-9A4C-2C6E62D8932A} - (no file)

O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - (no file)

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - (no file)

O13 - DefaultPrefix:

O13 - WWW Prefix:

O20 - AppInit_DLLs: C:\WINDOWS\System32\wdmipbc.dll

Reboot in "safe" mode. Use the link in my signature to tell you how if necessary.

Find and delete:

C:\WINDOWS\System32\wdmipbc.dll <— file

Then boot in normal mode and post a new log file.

I am a little concerned about that DLL file you (hopefully) just deleted. I thought the tool from Trend-Micro would nuke that critter.

If it returns, we have a few more tricks up our sleeve waiting to be put into action.

I am also a little concerned about the "non cleanable" files found. Does that mean they are still around?

If a file is "non cleanable", that generally means you should delete it.

Virii have two ways of infecting your machine. They can attach themselves to other files (and be "cleaned off"), or the whole file can be a virus (thus "non cleanable").

As far as "firewalls" go, I suppose Zone Alarm is the best free one around (so I have heard - I have Norton Internet Security myself).

But a "firewall" won't protect you from the DLL infection you just had. It is dropped into your machine by a malicious web site, probably because of faulty IE settings.

Here's my list of things to do to help prevent future infections. Other things recommended that are not on this list would be Spywareguard, and Spyware Blaster (I don't have the links for those)

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?" here:

http://boards.cexx.org/viewtopic.php?t=957

Download IE-Spyad here:

https://netfiles.uiuc.edu/ehowes/www/resource.htm

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings here:

http://browsercheck.qualys.com/index.php

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.


P.S. It's not a good idea to start ending tasks with the Task manager unless you are positive they are "malicious". You might be stopping something worthwhile and necessary. :)
Post #7
Thank you for all of your help. After following your instructions, I ran Norton again and House call fix tool and was able to find and delete two additional viruses. One of the viruses files was C:\Windows\windows32\hoihh.dll. Norton let me delete it, but I see it in the registry, I think. I never could find C:\Windows\System3wdmipbc.dll file but I noticed that it disappeared from the log.

It seems that we just go from one bad file to another. I am assuming that it would be okay to try and fix with HJT.

Shotsie


Logfile of HijackThis v1.98.0
Scan saved at 9:07:49 PM, on 7/24/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Documents and Settings\All Users\Documents\Aladdin Systems\Internet Cleanup\NetBlockadeMonitor.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Documents and Settings\All Users\Documents\Aladdin Systems\Internet Cleanup\ONICTASK.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\Documents and Settings\Shotsie\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Shotsie\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Shotsie\LOCALS~1\Temp\sp.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://jacksonville.usonline.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://jacksonville.usonline.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Shotsie\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
F0 - system.ini: Shell=
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: ICHlprObj Class - {1f0c8547-2639-4c91-b8aa-c7eca24c3163} - C:\PROGRA~1\ALADDI~1\INTERN~1\IC3hlpr.dll
O2 - BHO: PopupFilter Class - {1F2E844B-8211-46ff-8262-772F03295CF4} - C:\PROGRA~1\ALADDI~1\INTERN~1\PopFiltr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\DOCUME~1\ALLUSE~1\DOCUME~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {D34EA49F-3F5B-4A24-8439-3E56967F4FB6} - C:\WINDOWS\System32\hoihh.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [WinFSG] "C:\Program Files\Aladdin Systems\Internet Cleanup\MSFG.exe"
O4 - HKLM\..\Run: [NBMonitor] C:\Documents and Settings\All Users\Documents\Aladdin Systems\Internet Cleanup\NetBlockadeMonitor.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - Startup: IC Task Manager.lnk = C:\Documents and Settings\All Users\Documents\Aladdin Systems\Internet Cleanup\ONICTASK.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{617AF767-2CDE-438C-9E66-04FEEB5C1D7A}: NameServer = 69.57.96.4 69.57.96.5
Post #8
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!

Fix these items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Shotsie\LOCALS~1\Temp\sp.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Shotsie\LOCALS~1\Temp\sp.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Shotsie\LOCALS~1\Temp\sp.html

F0 - system.ini: Shell=

O2 - BHO: (no name) - {D34EA49F-3F5B-4A24-8439-3E56967F4FB6} - C:\WINDOWS\System32\hoihh.dll (file missing)

Reboot and post a new log file.

If any entries return that have "LOCALS~1\Temp\sp.html" in them, I'll get someone more experienced with the proper removal tools to help you. :)
Post #9
I have some new info from an advanced member on how to be sure if your infection is defeated or not.

Here is what he suggested:

Go here:

http://www.resplendence.com/reglite

to download and install Registrar Lite. Install, run, copy and paste this line to reglite's address bar:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

and hit the "go" tab. Find: "Appinit_Dlls" value on the right side panel, DoubleClick, copy and post here the information in the 'Value' field.


We are extremely interested in your results as we may have just discovered a simpler fix for a "hard to kill" browser hijack.

Thanks for you help. :)
Post #10
Below is the new HJT log. I followed your instructions and downloaded Registrar Lite and went thru all of the steps. The 'Value' field was empty. I did the same procedure three times and nothing showed in the field. I hope this is a good thing.

Thanks again for all of your help. :)

Logfile of HijackThis v1.98.0
Scan saved at 1:07:49 PM, on 7/25/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Documents and Settings\All Users\Documents\Aladdin Systems\Internet Cleanup\NetBlockadeMonitor.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Documents and Settings\All Users\Documents\Aladdin Systems\Internet Cleanup\ONICTASK.exe
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\Documents and Settings\Shotsie\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://jacksonville.usonline.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://jacksonville.usonline.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
F0 - system.ini: Shell=
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: ICHlprObj Class - {1f0c8547-2639-4c91-b8aa-c7eca24c3163} - C:\PROGRA~1\ALADDI~1\INTERN~1\IC3hlpr.dll
O2 - BHO: PopupFilter Class - {1F2E844B-8211-46ff-8262-772F03295CF4} - C:\PROGRA~1\ALADDI~1\INTERN~1\PopFiltr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\DOCUME~1\ALLUSE~1\DOCUME~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [WinFSG] "C:\Program Files\Aladdin Systems\Internet Cleanup\MSFG.exe"
O4 - HKLM\..\Run: [NBMonitor] C:\Documents and Settings\All Users\Documents\Aladdin Systems\Internet Cleanup\NetBlockadeMonitor.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - Startup: IC Task Manager.lnk = C:\Documents and Settings\All Users\Documents\Aladdin Systems\Internet Cleanup\ONICTASK.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{617AF767-2CDE-438C-9E66-04FEEB5C1D7A}: NameServer = 69.57.96.4 69.57.96.5
Post #11
Yes, a blank field is good.. That means the "bug" is gone. The log looks good to go!!! :thumbup: Be sure to read my post in this thread about hardening your defenses. As far as I know, the problem was dropped onto your machine from a malicious web site. Unless you do something to prevent it, you could go through this again real soon. GOD bless!!! M68 :)
Post #12
Glad we could help :D


As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI