What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Trojans

41 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Also herewith latest Ewido log :- ——————————————————– ewido anti-spyware - Scan Report ——————————————————— + Created at: 22:23:33 24/07/2006 + Scan result: C:\WINDOWS\system32\khhig.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\WINDOWS\system32\ssqrrom.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). ::Report end
Post #17 last edited
Hi brown1950,

Download this file - combofix.exe
Get it here:
http://download.bleepingcomputer.com/sUBs/combofix.exe

and save it to your desktop.

go to start –> run and type in the following:

"%userprofile%"\desktop\combofix.exe" /v khhig >>notice space between exe /v mllll

When finished, it shall produce a log for you. Post that log in your next reply
along with another HJT log.

Note:
Read
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
good luck mschroe919
Post #18
Downloaded file as you suggested to my desktop but then when i insert "%userprofile%"\ etc etc widows advises file cannot be found. ?
Post #19 last edited
Hi brown1950,

Sorry about that:

The line:
"%userprofile%"\desktop\combofix.exe"/v khhig >>notice space between exe /v mllll

The line should read:
"%userprofile%\desktop\combofix.exe" /v khhig

One less "

Download this file - combofix.exe
Get it here:
http://download.bleepingcomputer.com/sUBs/combofix.exe

and save it to your desktop.

go to start –> run and type in the following:

"%userprofile%\desktop\combofix.exe" /v khhig



When finished, it shall produce a log for you. Post that log in your next reply
along with another HJT log.

Note:
Read
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
good luck mschroe919
Post #20
Herewith log as requested :- (((((((((((((((((((((((((((((((((((((((((((((((( Vundo Log ))))))))))))))))))))))))))))))))))))))))))))))))))))) No infected files found (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-07-25 20:41:06 77312 ( A…. ) "C:\WINDOWS\system32\VundoFix.exe" 2006-07-25 19:25:26 77312 ( A…. ) "C:\WINDOWS\system32\setup_61070.exe" 2006-07-25 19:21:38 167115 ( A…. ) "C:\files.exe" 2006-07-25 18:51:12 77312 ( A…. ) "C:\WINDOWS\system32\setup_54182.exe" 2006-07-25 00:16:10 77312 ( A…. ) "C:\WINDOWS\system32\setup_58074.exe" 2006-07-24 21:06:06 77312 ( A…. ) "C:\WINDOWS\system32\setup_74452.exe" 2006-07-22 22:54:40 32768 ( A…. ) "C:\nwnmed_7.exe" 2006-07-21 11:30:18 28672 ( A…. ) "C:\kybrded_7.exe" 2006-07-20 15:36:06 32768 ( A…. ) "C:\nwnmdd_6.exe" 2006-07-20 15:03:44 47580 ( A…. ) "C:\ntdetect.com" 2006-07-20 13:48:38 142336 ( A…. ) "C:\pic4312.com" 2006-07-20 13:46:40 142336 ( ..SHR ) "C:\WINDOWS\imapi.exe" 2006-07-19 13:22:22 1063 ( A…. ) "C:\WINDOWS\system32\aaa00000.sys" 2006-07-19 13:22:22 1063 ( A…. ) "C:\WINDOWS\system32\aaa00000.sys" 2006-07-18 12:53:08 ( .D… ) "C:\Documents and Settings\Chris Brownhill\Application Data\AVG7" 2006-07-18 12:52:16 ( .D… ) "C:\Program Files\Grisoft" 2006-07-16 23:16:34 ( .D… ) "C:\Program Files\CCleaner" 2006-07-16 00:13:24 ( .D… ) "C:\Program Files\Trend Micro" 2006-07-13 21:48:16 ( .D… ) "C:\Program Files\Spybot - Search & Destroy" 2006-07-11 22:57:22 1034 ( A…. ) "C:\WINDOWS\system32\D1D10E27-4CC6-4B83-A719-9AF80CA9CCB5.reg" 2006-07-11 22:57:22 1004 ( A…. ) "C:\WINDOWS\system32\0A609CAA-D53B-4268-ACB5-8A8C09C2692C.reg" 2006-07-11 22:57:20 1028 ( A…. ) "C:\WINDOWS\system32\132EDC98-E1DE-4B72-B513-C74E121F7D87.reg" 2006-07-11 22:57:16 1422 ( A…. ) "C:\WINDOWS\system32\clear.reg" 2006-07-08 11:43:26 ( .D… ) "C:\Documents and Settings\Chris Brownhill\Application Data\Prevx" 2006-07-07 22:43:06 ( .D… ) "C:\Program Files\Webroot" 2006-07-07 22:43:06 ( .D… ) "C:\Documents and Settings\Chris Brownhill\Application Data\Webroot" 2006-07-07 22:13:20 1063 ( A…. ) "C:\WINDOWS\system32\usba0591.sys" 2006-07-07 22:13:20 1063 ( A…. ) "C:\WINDOWS\system32\usba0591.sys" 2006-07-07 21:40:14 ( .D… ) "C:\Program Files\ewido anti-spyware 4.0" 2006-07-07 21:13:56 ( .D… ) "C:\Program Files\Adobe" 2006-07-07 21:10:06 ( .D… ) "C:\Documents and Settings\Chris Brownhill\Application Data\Adobe" 2006-07-07 21:10:02 ( .D… ) "C:\Program Files\Common Files\Adobe" 2006-07-07 19:46:32 ( .D… ) "C:\Program Files\Sunbelt Software" 2006-07-07 19:44:22 0 ( A…. ) "C:\AUTOEXEC.BAT" 2006-07-07 18:25:44 ( .D… ) "C:\Program Files\YIntai" 2006-07-06 21:21:44 ( .D… ) "C:\Documents and Settings\Chris Brownhill\Application Data\Macromedia" 2006-07-06 18:46:36 ( .D… ) "C:\Program Files\Common Files\{C866B80B-06A4-1033-0928-010314010001}" 2006-07-05 23:01:50 ( .D… ) "C:\Program Files\MSN Messenger" 2006-07-05 00:37:36 ( .D… ) "C:\Documents and Settings\Chris Brownhill\Application Data\Yahoo!" 2006-07-05 00:27:18 ( .D… ) "C:\Documents and Settings\Chris Brownhill\Application Data\Lavasoft" 2006-07-05 00:26:54 ( .D… ) "C:\Program Files\Lavasoft" 2006-07-05 00:16:24 499712 ( A…. ) "C:\WINDOWS\system32\msvcp71.dll" 2006-07-05 00:16:24 348160 ( A…. ) "C:\WINDOWS\system32\msvcr71.dll" 2006-07-05 00:05:54 ( .D… ) "C:\Program Files\Common Files\ODBC" 2006-07-05 00:05:50 ( .D… ) "C:\Program Files\Common Files\SpeechEngines" 2006-07-05 00:05:50 ( .D… ) "C:\Program Files\Common Files\Microsoft Shared" 2006-07-05 00:05:50 ( .D… ) "C:\Program Files\Common Files" 2006-07-05 00:05:16 62 ( A.SH. ) "C:\Documents and Settings\Chris Brownhill\Application Data\desktop.ini" 2006-07-04 23:49:10 ( .D… ) "C:\Program Files\Yahoo!" 2006-07-04 23:34:38 ( .D… ) "C:\Documents and Settings\Chris Brownhill\Application Data\MSN6" 2006-07-04 23:27:56 ( .D… ) "C:\Program Files\SpeedTouch" 2006-07-04 23:27:20 ( .D… ) "C:\Program Files\Thomson" 2006-07-04 23:27:18 ( .D.H. ) "C:\Program Files\InstallShield Installation Information" 2006-07-04 23:27:06 ( .D… ) "C:\Program Files\Common Files\InstallShield" 2006-07-04 23:24:54 ( .D… ) "C:\Documents and Settings\Chris Brownhill\Application Data\Identities" 2006-07-04 23:24:48 ( .D.H. ) "C:\Program Files\Uninstall Information" 2006-07-04 23:24:42 ( .DS.. ) "C:\Documents and Settings\Chris Brownhill\Application Data\Microsoft" 2006-07-04 23:19:04 ( .D… ) "C:\Program Files\xerox" 2006-07-04 23:19:04 ( .D… ) "C:\Program Files\microsoft frontpage" 2006-07-04 23:15:56 ( .D… ) "C:\Program Files\Movie Maker" 2006-07-04 23:15:18 ( .D… ) "C:\Program Files\Windows Media Player" 2006-07-04 23:15:12 ( .D… ) "C:\Program Files\NetMeeting" 2006-07-04 23:15:12 ( .D… ) "C:\Program Files\Common Files\Services" 2006-07-04 23:15:04 ( .D… ) "C:\Program Files\Outlook Express" 2006-07-04 23:15:00 ( .D… ) "C:\Program Files\Common Files\MSSoap" 2006-07-04 23:14:54 ( .D… ) "C:\Program Files\Common Files\System" 2006-07-04 23:14:52 ( .D… ) "C:\Program Files\Internet Explorer" 2006-07-04 23:13:38 ( .D.H. ) "C:\Program Files\WindowsUpdate" 2006-07-04 23:13:38 ( .D… ) "C:\Program Files\Online Services" 2006-07-04 23:13:30 ( .D… ) "C:\Program Files\Messenger" 2006-07-04 23:13:22 ( .D… ) "C:\Program Files\MSN" 2006-07-04 23:13:18 ( .D… ) "C:\Program Files\MSN Gaming Zone" 2006-07-04 23:13:02 ( .D… ) "C:\Program Files\Windows NT" 2006-06-16 14:34:44 48936 ( A…. ) "C:\WINDOWS\system32\sirenacm.dll" 2006-05-19 13:15:34 140288 ( A…. ) "C:\WINDOWS\system32\dnsapi.dll" 2006-05-19 13:15:34 83456 ( A…. ) "C:\WINDOWS\system32\iphlpapi.dll" 2006-05-19 13:15:34 70656 ( A…. ) "C:\WINDOWS\system32\ws2_32.dll" 2006-05-19 13:15:34 54272 ( A…. ) "C:\WINDOWS\system32\ipv6mon.dll" 2006-05-19 13:15:34 31232 ( A…. ) "C:\WINDOWS\system32\inetmib1.dll" 2006-05-19 13:15:34 13312 ( A…. ) "C:\WINDOWS\system32\wship6.dll" 2006-05-19 13:15:32 103936 ( A…. ) "C:\WINDOWS\system32\dhcpcsvc.dll" 2006-05-19 13:15:32 95232 ( A…. ) "C:\WINDOWS\system32\6to4svc.dll" 2006-05-19 09:51:02 159232 ( A…. ) "C:\WINDOWS\system32\xpob2res.dll" 2006-05-19 09:46:02 48640 ( A…. ) "C:\WINDOWS\system32\ipv6.exe" 2006-05-19 09:44:56 83456 ( A…. ) "C:\WINDOWS\system32\netsh.exe" 2006-05-14 10:13:42 364544 ( A…. ) "C:\WINDOWS\system32\ipsmsnap.dll" 2006-05-14 10:13:42 334848 ( A…. ) "C:\WINDOWS\system32\ipsecsnp.dll" 2006-05-14 10:13:42 257536 ( A…. ) "C:\WINDOWS\system32\oakley.dll" 2006-05-14 10:13:42 159744 ( A…. ) "C:\WINDOWS\system32\ipsecsvc.dll" 2006-05-14 10:13:42 98304 ( A…. ) "C:\WINDOWS\system32\polstore.dll" 2006-05-14 10:13:42 29184 ( A…. ) "C:\WINDOWS\system32\winipsec.dll" 2006-05-12 20:26:34 8039 ( A…. ) "C:\WINDOWS\system32\second.bat" (((((((((((((((((((((((((((((((((((((( Files Created - Last 30days ))))))))))))))))))))))))))))))))))))))))))) 2006-07-25 20:41 77,312 C:\WINDOWS\system32\VundoFix.exe 2006-07-25 20:38 267,964,416 C:\hiberfil.sys 2006-07-25 19:25 77,312 C:\WINDOWS\system32\setup_61070.exe 2006-07-25 18:51 77,312 C:\WINDOWS\system32\setup_54182.exe 2006-07-25 13:12 167,115 C:\files.exe 2006-07-25 00:16 77,312 C:\WINDOWS\system32\setup_58074.exe 2006-07-24 21:06 77,312 C:\WINDOWS\system32\setup_74452.exe 2006-07-24 13:15 5,607 C:\WINDOWS\system32\stci.dll 2006-07-22 22:54 32,768 C:\nwnmed_7.exe 2006-07-21 11:30 28,672 C:\kybrded_7.exe 2006-07-20 15:36 32,768 C:\nwnmdd_6.exe 2006-07-20 13:48 142,336 C:\pic4312.com 2006-07-20 13:46 142,336 C:\WINDOWS\imapi.exe 2006-07-20 12:28 844,675 C:\WINDOWS\system32\ati3d1ag.dll 2006-07-20 12:28 755,200 C:\WINDOWS\system32\ir50_32.dll 2006-07-20 12:28 504,832 C:\WINDOWS\system32\msftedit.dll 2006-07-20 12:28 5,120 C:\WINDOWS\system32\hccoin.dll 2006-07-20 12:28 403,456 C:\WINDOWS\system32\winbrand.dll 2006-07-20 12:28 377,984 C:\WINDOWS\system32\ati2dvaa.dll 2006-07-20 12:28 338,432 C:\WINDOWS\system32\ir41_qcx.dll 2006-07-20 12:28 331,776 C:\WINDOWS\system32\winhttp.dll 2006-07-20 12:28 3,584 C:\WINDOWS\system32\dsprpres.dll 2006-07-20 12:28 3,494,303 C:\WINDOWS\system32\nv4_disp.dll 2006-07-20 12:28 218,112 C:\WINDOWS\system32\sbe.dll 2006-07-20 12:28 202,496 C:\WINDOWS\system32\ati2dvag.dll 2006-07-20 12:28 200,192 C:\WINDOWS\system32\ir50_qc.dll 2006-07-20 12:28 187,904 C:\WINDOWS\system32\xpsp1res.dll 2006-07-20 12:28 183,808 C:\WINDOWS\system32\ir50_qcx.dll 2006-07-20 12:28 18,944 C:\WINDOWS\system32\faxpatch.exe 2006-07-20 12:28 172,032 C:\WINDOWS\system32\mssap.dll 2006-07-20 12:28 159,232 C:\WINDOWS\system32\xpob2res.dll 2006-07-20 12:28 155,648 C:\WINDOWS\system32\encdec.dll 2006-07-20 12:28 120,320 C:\WINDOWS\system32\ir41_qc.dll 2006-07-20 12:28 110,080 C:\WINDOWS\system32\sbeio.dll 2006-07-20 12:27 9,216 C:\WINDOWS\system32\wuauserv.dll 2006-07-20 12:27 7,680 C:\WINDOWS\system32\bitsprx2.dll 2006-07-20 12:27 7,168 C:\WINDOWS\system32\bitsprx3.dll 2006-07-20 12:27 594,944 C:\WINDOWS\system32\xpsp2res.dll 2006-07-20 12:27 361,984 C:\WINDOWS\system32\qmgr.dll 2006-07-20 12:27 27,648 C:\WINDOWS\system32\pidgen.dll 2006-07-20 12:27 12,288 C:\WINDOWS\system32\encapi.dll 2006-07-20 12:27 115,200 C:\WINDOWS\system32\dpcdll.dll 2006-07-20 12:26 995,384 C:\WINDOWS\system32\mfc42u.dll 2006-07-20 12:26 995,383 C:\WINDOWS\system32\mfc42.dll 2006-07-20 12:26 991,232 C:\WINDOWS\system32\esent.dll 2006-07-20 12:26 99,840 C:\WINDOWS\system32\iexpress.exe 2006-07-20 12:26 99,840 C:\WINDOWS\system32\dmsynth.dll 2006-07-20 12:26 99,328 C:\WINDOWS\system32\dfrgntfs.exe 2006-07-20 12:26 98,816 C:\WINDOWS\system32\clipbrd.exe 2006-07-20 12:26 98,304 C:\WINDOWS\system32\actxprxy.dll 2006-07-20 12:26 95,232 C:\WINDOWS\system32\6to4svc.dll 2006-07-20 12:26 94,720 C:\WINDOWS\system32\dmusic.dll 2006-07-20 12:26 921,475 C:\WINDOWS\system32\ati3d2ag.dll 2006-07-20 12:26 92,160 C:\WINDOWS\system32\krnl386.exe 2006-07-20 12:26 92,160 C:\WINDOWS\system32\cscdll.dll 2006-07-20 12:26 91,648 C:\WINDOWS\system32\loadperf.dll 2006-07-20 12:26 91,648 C:\WINDOWS\system32\ahui.exe 2006-07-20 12:26 91,136 C:\WINDOWS\system32\advpack.dll 2006-07-20 12:26 9,728 C:\WINDOWS\system32\gpkrsrc.dll 2006-07-20 12:26 9,216 C:\WINDOWS\system32\icaapi.dll 2006-07-20 12:26 9,216 C:\WINDOWS\system32\dumprep.exe 2006-07-20 12:26 85,504 C:\WINDOWS\system32\catsrvps.dll 2006-07-20 12:26 84,992 C:\WINDOWS\system32\dskquota.dll 2006-07-20 12:26 83,456 C:\WINDOWS\system32\iphlpapi.dll 2006-07-20 12:26 82,432 C:\WINDOWS\system32\fldrclnr.dll 2006-07-20 12:26 80,384 C:\WINDOWS\system32\mciavi32.dll 2006-07-20 12:26 80,384 C:\WINDOWS\system32\cabview.dll 2006-07-20 12:26 8,832 C:\WINDOWS\system32\framebuf.dll 2006-07-20 12:26 8,704 C:\WINDOWS\system32\lprhelp.dll 2006-07-20 12:26 8,192 C:\WINDOWS\system32\igmpagnt.dll 2006-07-20 12:26 8,192 C:\WINDOWS\system32\d3d8thk.dll 2006-07-20 12:26 8,192 C:\WINDOWS\system32\autolfn.exe 2006-07-20 12:26 792,064 C:\WINDOWS\system32\comres.dll 2006-07-20 12:26 791,040 C:\WINDOWS\system32\d3dim700.dll 2006-07-20 12:26 79,360 C:\WINDOWS\system32\mprapi.dll 2006-07-20 12:26 79,360 C:\WINDOWS\system32\makecab.exe 2006-07-20 12:26 79,360 C:\WINDOWS\system32\diantz.exe 2006-07-20 12:26 786,432 C:\WINDOWS\system32\dxdiag.exe 2006-07-20 12:26 774,144 C:\WINDOWS\system32\mmc.exe 2006-07-20 12:26 77,824 C:\WINDOWS\system32\isign32.dll 2006-07-20 12:26 77,824 C:\WINDOWS\system32\asycfilt.dll 2006-07-20 12:26 77,312 C:\WINDOWS\system32\dmscript.dll 2006-07-20 12:26 76,830 C:\WINDOWS\system32\drmstor.dll 2006-07-20 12:26 76,288 C:\WINDOWS\system32\dfrgfat.exe 2006-07-20 12:26 76,288 C:\WINDOWS\system32\avifil32.dll 2006-07-20 12:26 74,810 C:\WINDOWS\system32\atl.dll 2006-07-20 12:26 73,728 C:\WINDOWS\system32\ils.dll 2006-07-20 12:26 71,680 C:\WINDOWS\system32\browsewm.dll 2006-07-20 12:26 70,656 C:\WINDOWS\system32\defrag.exe 2006-07-20 12:26 70,144 C:\WINDOWS\system32\cryptdlg.dll 2006-07-20 12:26 7,680 C:\WINDOWS\system32\dciman32.dll 2006-07-20 12:26 7,040 C:\WINDOWS\system32\kd1394.dll 2006-07-20 12:26 69,632 C:\WINDOWS\system32\icwdial.dll 2006-07-20 12:26 68,928 C:\WINDOWS\system32\mmsystem.dll 2006-07-20 12:26 68,096 C:\WINDOWS\system32\inetpp.dll 2006-07-20 12:26 67,584 C:\WINDOWS\system32\magnify.exe 2006-07-20 12:26 67,072 C:\WINDOWS\system32\msacm32.dll 2006-07-20 12:26 66,560 C:\WINDOWS\system32\mmcbase.dll 2006-07-20 12:26 66,560 C:\WINDOWS\system32\faultrep.dll 2006-07-20 12:26 66,560 C:\WINDOWS\system32\dsdmoprp.dll 2006-07-20 12:26 64,512 C:\WINDOWS\system32\ciodm.dll 2006-07-20 12:26 63,488 C:\WINDOWS\system32\amstream.dll 2006-07-20 12:26 62,976 C:\WINDOWS\system32\browselc.dll 2006-07-20 12:26 62,464 C:\WINDOWS\system32\colbact.dll 2006-07-20 12:26 62,464 C:\WINDOWS\system32\adsmsext.dll 2006-07-20 12:26 61,440 C:\WINDOWS\system32\icwphbk.dll 2006-07-20 12:26 61,440 C:\WINDOWS\system32\dbnetlib.dll 2006-07-20 12:26 61,440 C:\WINDOWS\system32\cleanmgr.exe 2006-07-20 12:26 602,112 C:\WINDOWS\system32\drmv2clt.dll 2006-07-20 12:26 6,656 C:\WINDOWS\system32\laprxy.dll 2006-07-20 12:26 6,656 C:\WINDOWS\system32\batt.dll 2006-07-20 12:26 596,480 C:\WINDOWS\system32\inetcomm.dll 2006-07-20 12:26 595,456 C:\WINDOWS\system32\dx7vb.dll 2006-07-20 12:26 593,408 C:\WINDOWS\system32\h323msp.dll 2006-07-20 12:26 59,904 C:\WINDOWS\system32\cabinet.dll 2006-07-20 12:26 59,392 C:\WINDOWS\system32\iesetup.dll 2006-07-20 12:26 581,632 C:\WINDOWS\system32\catsrvut.dll 2006-07-20 12:26 58,368 C:\WINDOWS\system32\dpvsetup.exe 2006-07-20 12:26 577,024 C:\WINDOWS\system32\mlang.dll 2006-07-20 12:26 57,856 C:\WINDOWS\system32\licwmi.dll 2006-07-20 12:26 57,344 C:\WINDOWS\system32\dmcompos.dll 2006-07-20 12:26 57,344 C:\WINDOWS\system32\admparse.dll 2006-07-20 12:26 56,320 C:\WINDOWS\system32\miglibnt.dll 2006-07-20 12:26 56,320 C:\WINDOWS\system32\dpnhupnp.dll 2006-07-20 12:26 558,592 C:\WINDOWS\system32\autofmt.exe 2006-07-20 12:26 557,568 C:\WINDOWS\system32\crypt32.dll 2006-07-20 12:26 55,808 C:\WINDOWS\system32\mpr.dll 2006-07-20 12:26 55,296 C:\WINDOWS\system32\digest.dll 2006-07-20 12:26 54,784 C:\WINDOWS\system32\cmstp.exe 2006-07-20 12:26 54,272 C:\WINDOWS\system32\ipv6mon.dll 2006-07-20 12:26 54,272 C:\WINDOWS\system32\clusapi.dll 2006-07-20 12:26 53,840 C:\WINDOWS\system32\dosx.exe 2006-07-20 12:26 53,760 C:\WINDOWS\system32\authz.dll 2006-07-20 12:26 53,248 C:\WINDOWS\system32\cryptsvc.dll 2006-07-20 12:26 53,248 C:\WINDOWS\system32\cryptnet.dll 2006-07-20 12:26 51,712 C:\WINDOWS\system32\ipconfig.exe 2006-07-20 12:26 51,712 C:\WINDOWS\system32\devenum.dll 2006-07-20 12:26 51,712 C:\WINDOWS\system32\dataclen.dll 2006-07-20 12:26 504,320 C:\WINDOWS\system32\logonui.exe 2006-07-20 12:26 50,688 C:\WINDOWS\system32\dmutil.dll 2006-07-20 12:26 5,120 C:\WINDOWS\system32\cisvc.exe 2006-07-20 12:26 5,120 C:\WINDOWS\system32\asferror.dll 2006-07-20 12:26 499,200 C:\WINDOWS\system32\comuid.dll 2006-07-20 12:26 498,205 C:\WINDOWS\system32\dxmasf.dll 2006-07-20 12:26 497,152 C:\WINDOWS\system32\clbcatq.dll 2006-07-20 12:26 49,664 C:\WINDOWS\system32\ixsso.dll 2006-07-20 12:26 49,664 C:\WINDOWS\system32\dpwsockx.dll 2006-07-20 12:26 49,152 C:\WINDOWS\system32\eventlog.dll 2006-07-20 12:26 49,152 C:\WINDOWS\system32\browser.dll 2006-07-20 12:26 489,984 C:\WINDOWS\system32\dbghelp.dll 2006-07-20 12:26 48,640 C:\WINDOWS\system32\ipv6.exe 2006-07-20 12:26 48,640 C:\WINDOWS\system32\cryptext.dll 2006-07-20 12:26 471,040 C:\WINDOWS\system32\cryptui.dll 2006-07-20 12:26 47,616 C:\WINDOWS\system32\inetres.dll 2006-07-20 12:26 47,104 C:\WINDOWS\system32\dssec.dll 2006-07-20 12:26 46,592 C:\WINDOWS\twain_32.dll 2006-07-20 12:26 46,592 C:\WINDOWS\system32\mmcshext.dll 2006-07-20 12:26 45,632 C:\WINDOWS\system32\cliconfg.exe 2006-07-20 12:26 45,568 C:\WINDOWS\system32\iyuv_32.dll 2006-07-20 12:26 45,568 C:\WINDOWS\system32\docprop2.dll 2006-07-20 12:26 45,568 C:\WINDOWS\system32\cnbjmon.dll 2006-07-20 12:26 45,056 C:\WINDOWS\system32\camocx.dll 2006-07-20 12:26 44,032 C:\WINDOWS\system32\dnsrslvr.dll 2006-07-20 12:26 44,032 C:\WINDOWS\system32\basesrv.dll 2006-07-20 12:26 439,808 C:\WINDOWS\system32\ipnathlp.dll 2006-07-20 12:26 436,736 C:\WINDOWS\system32\certmgr.dll 2006-07-20 12:26 41,984 C:\WINDOWS\system32\alg.exe 2006-07-20 12:26 41,472 C:\WINDOWS\system32\cmdl32.exe 2006-07-20 12:26 40,960 C:\WINDOWS\system32\extrac32.exe 2006-07-20 12:26 4,608 C:\WINDOWS\system32\dllhost.exe 2006-07-20 12:26 4,096 C:\WINDOWS\system32\ksuser.dll 2006-07-20 12:26 4,096 C:\WINDOWS\system32\csrss.exe 2006-07-20 12:26 4,096 C:\WINDOWS\system32\actmovie.exe 2006-07-20 12:26 39,936 C:\WINDOWS\system32\htui.dll 2006-07-20 12:26 381,440 C:\WINDOWS\system32\lmrt.dll 2006-07-20 12:26 380,445 C:\WINDOWS\system32\expsrv.dll 2006-07-20 12:26 38,912 C:\WINDOWS\system32\hhsetup.dll 2006-07-20 12:26 38,912 C:\WINDOWS\system32\audiosrv.dll 2006-07-20 12:26 38,400 C:\WINDOWS\system32\dpnlobby.dll 2006-07-20 12:26 37,888 C:\WINDOWS\system32\grpconv.exe 2006-07-20 12:26 367,616 C:\WINDOWS\system32\licdll.dll 2006-07-20 12:26 364,544 C:\WINDOWS\system32\ipsmsnap.dll 2006-07-20 12:26 361,472 C:\WINDOWS\system32\fontext.dll 2006-07-20 12:26 36,922 C:\WINDOWS\system32\imeshare.dll 2006-07-20 12:26 36,864 C:\WINDOWS\system32\mf3216.dll 2006-07-20 12:26 36,352 C:\WINDOWS\system32\cmutil.dll 2006-07-20 12:26 35,840 C:\WINDOWS\system32\cmmon32.exe 2006-07-20 12:26 35,328 C:\WINDOWS\system32\dfrgsnap.dll 2006-07-20 12:26 338,944 C:\WINDOWS\system32\dsound.dll 2006-07-20 12:26 334,848 C:\WINDOWS\system32\ipsecsnp.dll 2006-07-20 12:26 33,280 C:\WINDOWS\system32\mciqtz32.dll 2006-07-20 12:26 324,608 C:\WINDOWS\system32\cmdial32.dll 2006-07-20 12:26 323,072 C:\WINDOWS\system32\filemgmt.dll 2006-07-20 12:26 32,768 C:\WINDOWS\system32\mnmsrvc.exe 2006-07-20 12:26 32,768 C:\WINDOWS\system32\cfgbkend.dll 2006-07-20 12:26 32,256 C:\WINDOWS\system32\mnmdd.dll 2006-07-20 12:26 318,464 C:\WINDOWS\system32\ippromon.dll 2006-07-20 12:26 315,904 C:\WINDOWS\system32\hnetwiz.dll 2006-07-20 12:26 31,744 C:\WINDOWS\system32\dmloader.dll 2006-07-20 12:26 31,232 C:\WINDOWS\system32\inetmib1.dll 2006-07-20 12:26 307,712 C:\WINDOWS\system32\cscui.dll 2006-07-20 12:26 30,720 C:\WINDOWS\system32\clipsrv.exe 2006-07-20 12:26 30,208 C:\WINDOWS\system32\imgutil.dll 2006-07-20 12:26 3,072 C:\WINDOWS\system32\icmp.dll 2006-07-20 12:26 294,912 C:\WINDOWS\system32\iedkcs32.dll 2006-07-20 12:26 29,696 C:\WINDOWS\system32\dpnhpast.dll 2006-07-20 12:26 29,184 C:\WINDOWS\system32\cryptdll.dll 2006-07-20 12:26 285,184 C:\WINDOWS\system32\kerberos.dll 2006-07-20 12:26 28,672 C:\WINDOWS\system32\isrdbg32.dll 2006-07-20 12:26 28,672 C:\WINDOWS\system32\ie4uinit.exe 2006-07-20 12:26 28,672 C:\WINDOWS\system32\dbnmpntw.dll 2006-07-20 12:26 272,768 C:\WINDOWS\system32\atmfd.dll 2006-07-20 12:26 27,136 C:\WINDOWS\system32\ddeshare.exe 2006-07-20 12:26 27,136 C:\WINDOWS\system32\batmeter.dll 2006-07-20 12:26 27,136 C:\WINDOWS\system32\atmlib.dll 2006-07-20 12:26 266,752 C:\WINDOWS\winhlp32.exe 2006-07-20 12:26 266,240 C:\WINDOWS\system32\inetcfg.dll 2006-07-20 12:26 266,240 C:\WINDOWS\system32\drmclien.dll 2006-07-20 12:26 263,680 C:\WINDOWS\system32\duser.dll 2006-07-20 12:26 263,168 C:\WINDOWS\system32\devmgr.dll 2006-07-20 12:26 260,608 C:\WINDOWS\system32\gdi32.dll 2006-07-20 12:26 26,112 C:\WINDOWS\system32\dpnaddr.dll 2006-07-20 12:26 26,112 C:\WINDOWS\system32\dplaysvr.exe 2006-07-20 12:26 26,112 C:\WINDOWS\system32\dmband.dll 2006-07-20 12:26 253,440 C:\WINDOWS\system32\ddraw.dll 2006-07-20 12:26 25,600 C:\WINDOWS\system32\dfsshlex.dll 2006-07-20 12:26 25,088 C:\WINDOWS\system32\findstr.exe 2006-07-20 12:26 240,640 C:\WINDOWS\system32\hnetcfg.dll 2006-07-20 12:26 24,576 C:\WINDOWS\system32\logagent.exe 2006-07-20 12:26 24,576 C:\WINDOWS\system32\dbmsrpcn.dll 2006-07-20 12:26 24,576 C:\WINDOWS\system32\conime.exe 2006-07-20 12:26 24,064 C:\WINDOWS\system32\dpvacm.dll 2006-07-20 12:26 24,064 C:\WINDOWS\system32\ddrawex.dll 2006-07-20 12:26 239,616 C:\WINDOWS\system32\adsnt.dll 2006-07-20 12:26 238,592 C:\WINDOWS\system32\compatui.dll 2006-07-20 12:26 237,056 C:\WINDOWS\system32\icm32.dll 2006-07-20 12:26 233,472 C:\WINDOWS\system32\mpg4dmod.dll 2006-07-20 12:26 23,040 C:\WINDOWS\system32\iernonce.dll 2006-07-20 12:26 227,840 C:\WINDOWS\system32\dsquery.dll 2006-07-20 12:26 227,328 C:\WINDOWS\system32\es.dll 2006-07-20 12:26 222,208 C:\WINDOWS\system32\compstui.dll 2006-07-20 12:26 220,672 C:\WINDOWS\system32\catsrv.dll 2006-07-20 12:26 22,528 C:\WINDOWS\system32\hid.dll 2006-07-20 12:26 22,528 C:\WINDOWS\system32\at.exe 2006-07-20 12:26 22,016 C:\WINDOWS\system32\mciwave.dll 2006-07-20 12:26 22,016 C:\WINDOWS\system32\ipxroute.exe 2006-07-20 12:26 22,016 C:\WINDOWS\system32\davclnt.dll 2006-07-20 12:26 219,648 C:\WINDOWS\system32\logon.scr 2006-07-20 12:26 212,992 C:\WINDOWS\system32\dplayx.dll 2006-07-20 12:26 210,944 C:\WINDOWS\system32\moricons.dll 2006-07-20 12:26 21,504 C:\WINDOWS\system32\dmserver.dll 2006-07-20 12:26 206,336 C:\WINDOWS\system32\dpvoice.dll 2006-07-20 12:26 204,800 C:\WINDOWS\system32\dmadmin.exe 2006-07-20 12:26 204,800 C:\WINDOWS\system32\blackbox.dll 2006-07-20 12:26 204,288 C:\WINDOWS\system32\ieaksie.dll 2006-07-20 12:26 202,752 C:\WINDOWS\system32\localsec.dll 2006-07-20 12:26 20,992 C:\WINDOWS\system32\mfcsubs.dll 2006-07-20 12:26 20,992 C:\WINDOWS\system32\mciseq.dll 2006-07-20 12:26 20,992 C:\WINDOWS\system32\dpmodemx.dll 2006-07-20 12:26 2,025,984 C:\WINDOWS\system32\cdosys.dll 2006-07-20 12:26 196,096 C:\WINDOWS\system32\mobsync.dll 2006-07-20 12:26 19,456 C:\WINDOWS\system32\licmgr10.dll 2006-07-20 12:26 19,456 C:\WINDOWS\system32\fontview.exe 2006-07-20 12:26 19,456 C:\WINDOWS\system32\ersvc.dll 2006-07-20 12:26 186,880 C:\WINDOWS\system32\certcli.dll 2006-07-20 12:26 184,320 C:\WINDOWS\system32\dmdskmgr.dll 2006-07-20 12:26 181,760 C:\WINDOWS\system32\activeds.dll 2006-07-20 12:26 180,224 C:\WINDOWS\system32\dwwin.exe 2006-07-20 12:26 18,944 C:\WINDOWS\system32\lpk.dll 2006-07-20 12:26 18,944 C:\WINDOWS\system32\dpnsvr.exe 2006-07-20 12:26 18,432 C:\WINDOWS\system32\feclient.dll 2006-07-20 12:26 179,712 C:\WINDOWS\system32\cewmdm.dll 2006-07-20 12:26 179,200 C:\WINDOWS\system32\accwiz.exe 2006-07-20 12:26 178,688 C:\WINDOWS\system32\eudcedit.exe 2006-07-20 12:26 174,592 C:\WINDOWS\system32\cmprops.dll 2006-07-20 12:26 172,544 C:\WINDOWS\system32\dmime.dll 2006-07-20 12:26 17,920 C:\WINDOWS\system32\midimap.dll 2006-07-20 12:26 168,960 C:\WINDOWS\system32\dinput8.dll 2006-07-20 12:26 165,888 C:\WINDOWS\system32\dsdmo.dll 2006-07-20 12:26 165,376 C:\WINDOWS\system32\els.dll 2006-07-20 12:26 162,816 C:\WINDOWS\system32\adsldp.dll 2006-07-20 12:26 16,896 C:\WINDOWS\system32\dswave.dll 2006-07-20 12:26 16,896 C:\WINDOWS\system32\cfgmgr32.dll 2006-07-20 12:26 16,384 C:\WINDOWS\system32\mmfutil.dll 2006-07-20 12:26 16,384 C:\WINDOWS\system32\linkinfo.dll 2006-07-20 12:26 16,384 C:\WINDOWS\system32\ds32gt.dll 2006-07-20 12:26 159,744 C:\WINDOWS\system32\ipsecsvc.dll 2006-07-20 12:26 158,720 C:\WINDOWS\system32\credui.dll 2006-07-20 12:26 156,672 C:\WINDOWS\system32\dpnet.dll 2006-07-20 12:26 151,552 C:\WINDOWS\system32\dinput.dll 2006-07-20 12:26 15,872 C:\WINDOWS\system32\dvdupgrd.exe 2006-07-20 12:26 15,872 C:\WINDOWS\system32\alrsvc.dll 2006-07-20 12:26 146,432 C:\WINDOWS\system32\keymgr.dll 2006-07-20 12:26 145,920 C:\WINDOWS\system32\diskpart.exe 2006-07-20 12:26 145,408 C:\WINDOWS\system32\modemui.dll 2006-07-20 12:26 144,896 C:\WINDOWS\system32\initpki.dll 2006-07-20 12:26 143,872 C:\WINDOWS\system32\itircl.dll 2006-07-20 12:26 140,288 C:\WINDOWS\system32\dnsapi.dll 2006-07-20 12:26 14,877 C:\WINDOWS\system32\corpol.dll 2006-07-20 12:26 14,848 C:\WINDOWS\system32\bidispl.dll 2006-07-20 12:26 14,336 C:\WINDOWS\system32\inetppui.dll 2006-07-20 12:26 14,336 C:\WINDOWS\system32\dmremote.exe 2006-07-20 12:26 139,776 C:\WINDOWS\system32\adsldpc.dll 2006-07-20 12:26 137,216 C:\WINDOWS\system32\hotplug.dll 2006-07-20 12:26 135,680 C:\WINDOWS\system32\mobsync.exe 2006-07-20 12:26 135,680 C:\WINDOWS\system32\dsprop.dll 2006-07-20 12:26 134,144 C:\WINDOWS\regedit.exe 2006-07-20 12:26 13,312 C:\WINDOWS\system32\ctfmon.exe 2006-07-20 12:26 128,000 C:\WINDOWS\system32\itss.dll 2006-07-20 12:26 127,552 C:\WINDOWS\system32\cliconfg.dll 2006-07-20 12:26 126,976 C:\WINDOWS\system32\ieakeng.dll 2006-07-20 12:26 125,952 C:\WINDOWS\system32\ifmon.dll 2006-07-20 12:26 124,928 C:\WINDOWS\system32\dssenh.dll 2006-07-20 12:26 123,904 C:\WINDOWS\system32\imapi.exe 2006-07-20 12:26 12,800 C:\WINDOWS\system32\mcastmib.dll 2006-07-20 12:26 12,288 C:\WINDOWS\system32\cmcfg32.dll 2006-07-20 12:26 116,736 C:\WINDOWS\system32\mplay32.exe 2006-07-20 12:26 116,736 C:\WINDOWS\system32\glu32.dll 2006-07-20 12:26 116,224 C:\WINDOWS\system32\iasrad.dll 2006-07-20 12:26 115,712 C:\WINDOWS\system32\apphelp.dll 2006-07-20 12:26 114,176 C:\WINDOWS\system32\input.dll 2006-07-20 12:26 113,152 C:\WINDOWS\system32\idq.dll 2006-07-20 12:26 113,152 C:\WINDOWS\system32\dpvvox.dll 2006-07-20 12:26 113,152 C:\WINDOWS\system32\dfrgui.dll 2006-07-20 12:26 110,592 C:\WINDOWS\system32\iccvid.dll 2006-07-20 12:26 110,080 C:\WINDOWS\system32\dmstyle.dll 2006-07-20 12:26 110,080 C:\WINDOWS\system32\clbcatex.dll 2006-07-20 12:26 11,776 C:\WINDOWS\system32\lsass.exe 2006-07-20 12:26 11,776 C:\WINDOWS\system32\drprov.dll 2006-07-20 12:26 108,544 C:\WINDOWS\system32\mdminst.dll 2006-07-20 12:26 107,008 C:\WINDOWS\system32\aclui.dll 2006-07-20 12:26 106,496 C:\WINDOWS\system32\dsuiext.dll 2006-07-20 12:26 103,936 C:\WINDOWS\system32\imm32.dll 2006-07-20 12:26 103,424 C:\WINDOWS\system32\dgnet.dll 2006-07-20 12:26 102,450 C:\WINDOWS\system32\cscript.exe 2006-07-20 12:26 10,752 C:\WINDOWS\hh.exe 2006-07-20 12:26 10,240 C:\WINDOWS\system32\localui.dll 2006-07-20 12:26 10,240 C:\WINDOWS\system32\atmadm.exe 2006-07-20 12:26 1,293,824 C:\WINDOWS\system32\dsound3d.dll 2006-07-20 12:26 1,185,792 C:\WINDOWS\system32\dx8vb.dll 2006-07-20 12:26 1,180,672 C:\WINDOWS\system32\d3d8.dll 2006-07-20 12:26 1,179,136 C:\WINDOWS\system32\comsvcs.dll 2006-07-20 12:26 1,128,960 C:\WINDOWS\system32\mmcndmgr.dll 2006-07-20 12:26 1,004,032 C:\WINDOWS\explorer.exe 2006-07-20 12:25 98,304 C:\WINDOWS\system32\polstore.dll 2006-07-20 12:25 98,304 C:\WINDOWS\system32\oleprn.dll 2006-07-20 12:25 974,336 C:\WINDOWS\system32\msdtctm.dll 2006-07-20 12:25 971,264 C:\WINDOWS\system32\msgina.dll 2006-07-20 12:25 97,280 C:\WINDOWS\system32\txflog.dll 2006-07-20 12:25 96,256 C:\WINDOWS\system32\rcbdyctl.dll 2006-07-20 12:25 95,744 C:\WINDOWS\system32\nlhtml.dll 2006-07-20 12:25 94,208 C:\WINDOWS\system32\odbccp32.dll 2006-07-20 12:25 91,136 C:\WINDOWS\system32\rastls.dll 2006-07-20 12:25 91,136 C:\WINDOWS\system32\msoert2.dll 2006-07-20 12:25 90,112 C:\WINDOWS\system32\odbcint.dll 2006-07-20 12:25 9,728 C:\WINDOWS\system32\regsvr32.exe 2006-07-20 12:25 9,728 C:\WINDOWS\system32\mstinit.exe 2006-07-20 12:25 89,600 C:\WINDOWS\system32\slbiop.dll 2006-07-20 12:25 88,064 C:\WINDOWS\system32\tscfgwmi.dll 2006-07-20 12:25 88,064 C:\WINDOWS\system32\mydocs.dll 2006-07-20 12:25 87,552 C:\WINDOWS\system32\occache.dll 2006-07-20 12:25 87,304 C:\WINDOWS\system32\rdpdd.dll 2006-07-20 12:25 857,600 C:\WINDOWS\system32\netplwiz.dll 2006-07-20 12:25 831,562 C:\WINDOWS\system32\mswdat10.dll 2006-07-20 12:25 83,456 C:\WINDOWS\system32\netsh.exe 2006-07-20 12:25 83,456 C:\WINDOWS\system32\mtxoci.dll 2006-07-20 12:25 829,952 C:\WINDOWS\system32\tapi3.dll 2006-07-20 12:25 82,944 C:\WINDOWS\system32\smlogsvc.exe 2006-07-20 12:25 82,944 C:\WINDOWS\system32\psbase.dll 2006-07-20 12:25 81,920 C:\WINDOWS\system32\trkwks.dll 2006-07-20 12:25 80,128 C:\WINDOWS\system32\msapsspc.dll 2006-07-20 12:25 8,456 C:\WINDOWS\system32\tsddd.dll 2006-07-20 12:25 8,351,232 C:\WINDOWS\system32\shell32.dll 2006-07-20 12:25 8,192 C:\WINDOWS\system32\scrnsave.scr 2006-07-20 12:25 75,912 C:\WINDOWS\system32\rdpwsx.dll 2006-07-20 12:25 74,752 C:\WINDOWS\system32\netui0.dll 2006-07-20 12:25 74,240 C:\WINDOWS\system32\rtcshare.exe 2006-07-20 12:25 734,208 C:\WINDOWS\system32\qedwipes.dll 2006-07-20 12:25 72,192 C:\WINDOWS\system32\telnet.exe 2006-07-20 12:25 71,168 C:\WINDOWS\system32\storprop.dll 2006-07-20 12:25 71,168 C:\WINDOWS\system32\sdbinst.exe 2006-07-20 12:25 700,928 C:\WINDOWS\system32\sxs.dll 2006-07-20 12:25 699,392 C:\WINDOWS\system32\msxml2.dll 2006-07-20 12:25 69,632 C:\WINDOWS\system32\shrpubw.exe 2006-07-20 12:25 69,120 C:\WINDOWS\system32\unimdmat.dll 2006-07-20 12:25 686,080 C:\WINDOWS\system32\opengl32.dll 2006-07-20 12:25 68,608 C:\WINDOWS\system32\mscms.dll 2006-07-20 12:25 67,584 C:\WINDOWS\system32\msctfp.dll 2006-07-20 12:25 67,072 C:\WINDOWS\system32\usbui.dll 2006-07-20 12:25 667,648 C:\WINDOWS\system32\ss3dfo.scr 2006-07-20 12:25 66,560 C:\WINDOWS\system32\spoolss.dll 2006-07-20 12:25 66,560 C:\WINDOWS\system32\scarddlg.dll 2006-07-20 12:25 66,048 C:\WINDOWS\system32\sigverif.exe 2006-07-20 12:25 66,048 C:\WINDOWS\system32\notepad.exe 2006-07-20 12:25 66,048 C:\WINDOWS\system32\msw3prt.dll 2006-07-20 12:25 66,048 C:\WINDOWS\notepad.exe 2006-07-20 12:25 65,536 C:\WINDOWS\system32\msconf.dll 2006-07-20 12:25 65,024 C:\WINDOWS\system32\msvcrt40.dll 2006-07-20 12:25 64,512 C:\WINDOWS\system32\ntdsapi.dll 2006-07-20 12:25 64,512 C:\WINDOWS\system32\mtxclu.dll 2006-07-20 12:25 638,976 C:\WINDOWS\system32\sstext3d.scr 2006-07-20 12:25 63,488 C:\WINDOWS\system32\srclient.dll 2006-07-20 12:25 62,976 C:\WINDOWS\system32\shgina.dll 2006-07-20 12:25 614,474 C:\WINDOWS\system32\mswstr10.dll 2006-07-20 12:25 61,952 C:\WINDOWS\system32\sti.dll 2006-07-20 12:25 61,952 C:\WINDOWS\system32\rdshost.exe 2006-07-20 12:25 61,952 C:\WINDOWS\system32\osuninst.dll 2006-07-20 12:25 61,440 C:\WINDOWS\system32\odbccu32.dll 2006-07-20 12:25 61,440 C:\WINDOWS\system32\odbccr32.dll 2006-07-20 12:25 60,416 C:\WINDOWS\system32\shimeng.dll 2006-07-20 12:25 6,144 C:\WINDOWS\system32\sensapi.dll 2006-07-20 12:25 6,144 C:\WINDOWS\system32\rasadhlp.dll 2006-07-20 12:25 6,144 C:\WINDOWS\system32\msdtc.exe 2006-07-20 12:25 598,016 C:\WINDOWS\system32\mstscax.dll 2006-07-20 12:25 584,192 C:\WINDOWS\system32\netcfgx.dll 2006-07-20 12:25 58,880 C:\WINDOWS\system32\pautoenr.dll 2006-07-20 12:25 57,856 C:\WINDOWS\system32\raschap.dll 2006-07-20 12:25 569,344 C:\WINDOWS\system32\sspipes.scr 2006-07-20 12:25 561,152 C:\WINDOWS\system32\user32.dll 2006-07-20 12:25 56,320 C:\WINDOWS\system32\remotepg.dll 2006-07-20 12:25 56,320 C:\WINDOWS\system32\mshtmler.dll 2006-07-20 12:25 552,991 C:\WINDOWS\system32\msrepl40.dll 2006-07-20 12:25 548,864 C:\WINDOWS\system32\shdoclc.dll 2006-07-20 12:25 54,784 C:\WINDOWS\system32\resutils.dll 2006-07-20 12:25 54,784 C:\WINDOWS\system32\msdtclog.dll 2006-07-20 12:25 54,272 C:\WINDOWS\system32\rasphone.exe 2006-07-20 12:25 535,552 C:\WINDOWS\system32\rpcrt4.dll 2006-07-20 12:25 534,016 C:\WINDOWS\system32\spider.exe 2006-07-20 12:25 53,322 C:\WINDOWS\system32\msjter40.dll 2006-07-20 12:25 53,279 C:\WINDOWS\system32\odbcji32.dll 2006-07-20 12:25 53,248 C:\WINDOWS\system32\spoolsv.exe 2006-07-20 12:25 53,248 C:\WINDOWS\system32\servdeps.dll 2006-07-20 12:25 53,248 C:\WINDOWS\system32\sendmail.dll 2006-07-20 12:25 53,248 C:\WINDOWS\system32\packager.exe 2006-07-20 12:25 53,248 C:\WINDOWS\system32\odbcconf.exe 2006-07-20 12:25 52,224 C:\WINDOWS\system32\secur32.dll 2006-07-20 12:25 512,031 C:\WINDOWS\system32\msexch40.dll 2006-07-20 12:25 511,488 C:\WINDOWS\system32\qedit.dll 2006-07-20 12:25 51,712 C:\WINDOWS\system32\synceng.dll 2006-07-20 12:25 51,712 C:\WINDOWS\system32\regsvc.dll 2006-07-20 12:25 51,712 C:\WINDOWS\system32\msasn1.dll 2006-07-20 12:25 51,200 C:\WINDOWS\system32\narrator.exe 2006-07-20 12:25 50,688 C:\WINDOWS\system32\msvcirt.dll 2006-07-20 12:25 5,632 C:\WINDOWS\system32\security.dll 2006-07-20 12:25 5,120 C:\WINDOWS\system32\msidle.dll 2006-07-20 12:25 495,376 C:\WINDOWS\system32\msxml.dll 2006-07-20 12:25 49,152 C:\WINDOWS\system32\npptools.dll 2006-07-20 12:25 48,128 C:\WINDOWS\system32\reg.exe 2006-07-20 12:25 460,288 C:\WINDOWS\system32\ntmsmgr.dll 2006-07-20 12:25 45,056 C:\WINDOWS\system32\proquota.exe 2006-07-20 12:25 45,056 C:\WINDOWS\system32\msprivs.dll 2006-07-20 12:25 44,032 C:\WINDOWS\system32\regapi.dll 2006-07-20 12:25 44,032 C:\WINDOWS\system32\rdpclip.exe 2006-07-20 12:25 44,032 C:\WINDOWS\system32\msident.dll 2006-07-20 12:25 43,008 C:\WINDOWS\system32\ssmypics.scr 2006-07-20 12:25 43,008 C:\WINDOWS\system32\ssdpsrv.dll 2006-07-20 12:25 423,424 C:\WINDOWS\system32\riched20.dll 2006-07-20 12:25 421,919 C:\WINDOWS\system32\msrd2x40.dll 2006-07-20 12:25 420,864 C:\WINDOWS\system32\shimgvw.dll 2006-07-20 12:25 42,496 C:\WINDOWS\system32\ncobjapi.dll 2006-07-20 12:25 401,462 C:\WINDOWS\system32\msvcp60.dll 2006-07-20 12:25 40,960 C:\WINDOWS\system32\tscupgrd.exe 2006-07-20 12:25 40,960 C:\WINDOWS\system32\safrslv.dll 2006-07-20 12:25 40,448 C:\WINDOWS\system32\tcpmon.dll 2006-07-20 12:25 4,608 C:\WINDOWS\system32\msimg32.dll 2006-07-20 12:25 4,126 C:\WINDOWS\system32\msdxmlc.dll 2006-07-20 12:25 4,096 C:\WINDOWS\system32\sfc.dll 2006-07-20 12:25 4,096 C:\WINDOWS\system32\nddeapir.exe 2006-07-20 12:25 399,360 C:\WINDOWS\system32\netlogon.dll 2006-07-20 12:25 392,704 C:\WINDOWS\system32\ntmssvc.dll 2006-07-20 12:25 39,936 C:\WINDOWS\system32\rtutils.dll 2006-07-20 12:25 39,424 C:\WINDOWS\system32\safrcdlg.dll 2006-07-20 12:25 39,424 C:\WINDOWS\system32\net.exe 2006-07-20 12:25 388,608 C:\WINDOWS\system32\mstsc.exe 2006-07-20 12:25 387,584 C:\WINDOWS\system32\regwizc.dll 2006-07-20 12:25 385,024 C:\WINDOWS\system32\sqlsrv32.dll 2006-07-20 12:25 384,000 C:\WINDOWS\system32\themeui.dll 2006-07-20 12:25 38,400 C:\WINDOWS\system32\ntmsapi.dll 2006-07-20 12:25 38,400 C:\WINDOWS\system32\ntlanman.dll 2006-07-20 12:25 37,888 C:\WINDOWS\system32\pstorec.dll 2006-07-20 12:25 368,640 C:\WINDOWS\system32\msdtcprx.dll 2006-07-20 12:25 364,544 C:\WINDOWS\system32\ssflwbox.scr 2006-07-20 12:25 36,864 C:\WINDOWS\system32\mscpxl32.dll 2006-07-20 12:25 36,352 C:\WINDOWS\system32\sens.dll 2006-07-20 12:25 357,376 C:\WINDOWS\system32\qdvd.dll 2006-07-20 12:25 35,632 C:\WINDOWS\system32\ntio411.sys 2006-07-20 12:25 35,392 C:\WINDOWS\system32\ntio412.sys 2006-07-20 12:25 348,195 C:\WINDOWS\system32\msjetoledb40.dll 2006-07-20 12:25 348,191 C:\WINDOWS\system32\mspbde40.dll 2006-07-20 12:25 346,624 C:\WINDOWS\system32\tourstart.exe 2006-07-20 12:25 344,095 C:\WINDOWS\system32\msxbde40.dll 2006-07-20 12:25 343,552 C:\WINDOWS\system32\termmgr.dll 2006-07-20 12:25 34,528 C:\WINDOWS\system32\ntio804.sys 2006-07-20 12:25 34,528 C:\WINDOWS\system32\ntio404.sys 2006-07-20 12:25 34,304 C:\WINDOWS\system32\rcimlby.exe 2006-07-20 12:25 339,968 C:\WINDOWS\system32\mspaint.exe 2006-07-20 12:25 334,848 C:\WINDOWS\system32\smlogcfg.dll 2006-07-20 12:25 33,808 C:\WINDOWS\system32\ntio.sys 2006-07-20 12:25 33,280 C:\WINDOWS\system32\shmgrate.exe 2006-07-20 12:25 33,280 C:\WINDOWS\system32\racpldlg.dll 2006-07-20 12:25 326,656 C:\WINDOWS\system32\netsetup.exe 2006-07-20 12:25 323,072 C:\WINDOWS\system32\msvcrt.dll 2006-07-20 12:25 32,768 C:\WINDOWS\system32\odbcad32.exe 2006-07-20 12:25 32,256 C:\WINDOWS\system32\umandlg.dll 2006-07-20 12:25 32,256 C:\WINDOWS\system32\perfproc.dll 2006-07-20 12:25 319,760 C:\WINDOWS\system32\msnsspc.dll 2006-07-20 12:25 319,519 C:\WINDOWS\system32\msexcl40.dll 2006-07-20 12:25 315,466 C:\WINDOWS\system32\msrd3x40.dll 2006-07-20 12:25 31,744 C:\WINDOWS\system32\rundll32.exe 2006-07-20 12:25 31,744 C:\WINDOWS\system32\pid.dll 2006-07-20 12:25 306,176 C:\WINDOWS\system32\netapi32.dll 2006-07-20 12:25 30,720 C:\WINDOWS\system32\netstat.exe 2006-07-20 12:25 3,584 C:\WINDOWS\system32\msafd.dll 2006-07-20 12:25 3,338 C:\WINDOWS\system32\redir.exe 2006-07-20 12:25 297,984 C:\WINDOWS\system32\scesrv.dll 2006-07-20 12:25 29,696 C:\WINDOWS\system32\rtipxmib.dll 2006-07-20 12:25 28,672 C:\WINDOWS\system32\sethc.exe 2006-07-20 12:25 28,672 C:\WINDOWS\system32\profmap.dll 2006-07-20 12:25 276,992 C:\WINDOWS\system32\rpcss.dll 2006-07-20 12:25 276,480 C:\WINDOWS\system32\slbcsp.dll 2006-07-20 12:25 271,360 C:\WINDOWS\system32\objsel.dll 2006-07-20 12:25 270,365 C:\WINDOWS\system32\odbcjt32.dll 2006-07-20 12:25 27,136 C:\WINDOWS\system32\ssdpapi.dll 2006-07-20 12:25 27,136 C:\WINDOWS\system32\sendcmsg.dll 2006-07-20 12:25 27,136 C:\WINDOWS\system32\mspatcha.dll 2006-07-20 12:25 266,752 C:\WINDOWS\system32\qdv.dll 2006-07-20 12:25 266,752 C:\WINDOWS\system32\msctf.dll 2006-07-20 12:25 26,624 C:\WINDOWS\system32\safrdm.dll 2006-07-20 12:25 257,536 C:\WINDOWS\system32\oakley.dll 2006-07-20 12:25 254,976 C:\WINDOWS\system32\pdh.dll 2006-07-20 12:25 253,983 C:\WINDOWS\system32\mstext40.dll 2006-07-20 12:25 251,904 C:\WINDOWS\system32\strmdll.dll 2006-07-20 12:25 250,368 C:\WINDOWS\system32\mstask.dll 2006-07-20 12:25 25,600 C:\WINDOWS\system32\pstorsvc.dll 2006-07-20 12:25 245,760 C:\WINDOWS\system32\msscp.dll 2006-07-20 12:25 241,695 C:\WINDOWS\system32\msjtes40.dll 2006-07-20 12:25 24,576 C:\WINDOWS\system32\odbcbcp.dll 2006-07-20 12:25 24,576 C:\WINDOWS\system32\nmmkcert.dll 2006-07-20 12:25 24,064 C:\WINDOWS\system32\skeys.exe 2006-07-20 12:25 24,064 C:\WINDOWS\system32\mshta.exe 2006-07-20 12:25 238,592 C:\WINDOWS\system32\tapisrv.dll 2006-07-20 12:25 238,080 C:\WINDOWS\system32\newdev.dll 2006-07-20 12:25 231,424 C:\WINDOWS\system32\upnpui.dll 2006-07-20 12:25 230,400 C:\WINDOWS\system32\netui1.dll 2006-07-20 12:25 230,400 C:\WINDOWS\system32\msieftp.dll 2006-07-20 12:25 23,552 C:\WINDOWS\system32\perfdisk.dll 2006-07-20 12:25 23,040 C:\WINDOWS\system32\shscrap.dll 2006-07-20 12:25 23,040 C:\WINDOWS\system32\perfos.dll 2006-07-20 12:25 229,376 C:\WINDOWS\system32\msoeacct.dll 2006-07-20 12:25 228,352 C:\WINDOWS\system32\mswsock.dll 2006-07-20 12:25 226,816 C:\WINDOWS\system32\srrstr.dll 2006-07-20 12:25 22,528 C:\WINDOWS\system32\slayerxp.dll 2006-07-20 12:25 22,528 C:\WINDOWS\system32\shfolder.dll 2006-07-20 12:25 22,528 C:\WINDOWS\system32\mslbui.dll 2006-07-20 12:25 22,016 C:\WINDOWS\system32\udhisapi.dll 2006-07-20 12:25 213,023 C:\WINDOWS\system32\msltus40.dll 2006-07-20 12:25 212,480 C:\WINDOWS\system32\osk.exe 2006-07-20 12:25 205,824 C:\WINDOWS\system32\progman.exe 2006-07-20 12:25 200,704 C:\WINDOWS\system32\odbc32.dll 2006-07-20 12:25 200,192 C:\WINDOWS\system32\termsrv.dll 2006-07-20 12:25 20,992 C:\WINDOWS\system32\setup.exe 2006-07-20 12:25 20,992 C:\WINDOWS\system32\seclogon.dll 2006-07-20 12:25 20,554 C:\WINDOWS\system32\odtext32.dll 2006-07-20 12:25 20,554 C:\WINDOWS\system32\oddbse32.dll 2006-07-20 12:25 20,553 C:\WINDOWS\system32\odpdx32.dll 2006-07-20 12:25 20,553 C:\WINDOWS\system32\odfox32.dll 2006-07-20 12:25 20,553 C:\WINDOWS\system32\odexl32.dll 2006-07-20 12:25 20,480 C:\WINDOWS\system32\stimon.exe 2006-07-20 12:25 20,480 C:\WINDOWS\system32\msorc32r.dll 2006-07-20 12:25 193,536 C:\WINDOWS\system32\rasppp.dll 2006-07-20 12:25 192,512 C:\WINDOWS\system32\mswebdvd.dll 2006-07-20 12:25 19,968 C:\WINDOWS\system32\rcp.exe 2006-07-20 12:25 19,456 C:\WINDOWS\system32\ssmarque.scr 2006-07-20 12:25 184,832 C:\WINDOWS\system32\qcap.dll 2006-07-20 12:25 183,296 C:\WINDOWS\system32\syncui.dll 2006-07-20 12:25 182,784 C:\WINDOWS\system32\msutb.dll 2006-07-20 12:25 180,800 C:\WINDOWS\system32\sqlunirl.dll 2006-07-20 12:25 18,944 C:\WINDOWS\system32\ssbezier.scr 2006-07-20 12:25 18,432 C:\WINDOWS\system32\sclgntfy.dll 2006-07-20 12:25 18,432 C:\WINDOWS\system32\rsmps.dll 2006-07-20 12:25 18,432 C:\WINDOWS\system32\qprocess.exe 2006-07-20 12:25 175,104 C:\WINDOWS\system32\mspmsp.dll 2006-07-20 12:25 174,592 C:\WINDOWS\system32\scecli.dll 2006-07-20 12:25 174,592 C:\WINDOWS\system32\msnetobj.dll 2006-07-20 12:25 172,032 C:\WINDOWS\system32\snmpsnap.dll 2006-07-20 12:25 171,008 C:\WINDOWS\system32\sccsccp.dll 2006-07-20 12:25 17,920 C:\WINDOWS\system32\shutdown.exe 2006-07-20 12:25 17,408 C:\WINDOWS\system32\ssmyst.scr 2006-07-20 12:25 17,408 C:\WINDOWS\system32\qmgrprxy.dll 2006-07-20 12:25 17,408 C:\WINDOWS\system32\psapi.dll 2006-07-20 12:25 166,912 C:\WINDOWS\system32\photowiz.dll 2006-07-20 12:25 165,888 C:\WINDOWS\system32\ntmsdba.dll 2006-07-20 12:25 165,376 C:\WINDOWS\system32\tapi32.dll 2006-07-20 12:25 164,864 C:\WINDOWS\system32\upnphost.dll 2006-07-20 12:25 16,896 C:\WINDOWS\system32\snmpapi.dll 2006-07-20 12:25 16,384 C:\WINDOWS\system32\ups.exe 2006-07-20 12:25 16,384 C:\WINDOWS\system32\ping.exe 2006-07-20 12:25 16,384 C:\WINDOWS\system32\odbc32gt.dll 2006-07-20 12:25 16,384 C:\WINDOWS\system32\nddenb32.dll 2006-07-20 12:25 16,384 C:\WINDOWS\system32\msyuv.dll 2006-07-20 12:25 159,232 C:\WINDOWS\system32\schedsvc.dll 2006-07-20 12:25 158,720 C:\WINDOWS\system32\srsvc.dll 2006-07-20 12:25 155,675 C:\WINDOWS\system32\scrobj.dll 2006-07-20 12:25 155,648 C:\WINDOWS\system32\mswmdm.dll 2006-07-20 12:25 154,624 C:\WINDOWS\system32\netman.dll 2006-07-20 12:25 152,576 C:\WINDOWS\system32\qasf.dll 2006-07-20 12:25 151,626 C:\WINDOWS\system32\msjint40.dll 2006-07-20 12:25 150,528 C:\WINDOWS\system32\msdtcuiu.dll 2006-07-20 12:25 15,360 C:\WINDOWS\system32\nddeapi.dll 2006-07-20 12:25 147,483 C:\WINDOWS\system32\scrrun.dll 2006-07-20 12:25 147,456 C:\WINDOWS\system32\odbctrac.dll 2006-07-20 12:25 143,872 C:\WINDOWS\system32\msimtf.dll 2006-07-20 12:25 14,848 C:\WINDOWS\system32\usbmon.dll 2006-07-20 12:25 14,848 C:\WINDOWS\system32\upnpcont.exe 2006-07-20 12:25 14,848 C:\WINDOWS\system32\rdpsnd.dll 2006-07-20 12:25 14,848 C:\WINDOWS\system32\powrprof.dll 2006-07-20 12:25 14,336 C:\WINDOWS\system32\perfmon.exe 2006-07-20 12:25 137,216 C:\WINDOWS\system32\ntshrui.dll 2006-07-20 12:25 135,680 C:\WINDOWS\system32\rdchost.dll 2006-07-20 12:25 134,656 C:\WINDOWS\system32\netid.dll 2006-07-20 12:25 133,632 C:\WINDOWS\system32\rsaenh.dll 2006-07-20 12:25 133,120 C:\WINDOWS\system32\sfc_os.dll 2006-07-20 12:25 131,072 C:\WINDOWS\system32\msorcl32.dll 2006-07-20 12:25 130,560 C:\WINDOWS\system32\sti_ci.dll 2006-07-20 12:25 13,824 C:\WINDOWS\system32\uniplat.dll 2006-07-20 12:25 13,824 C:\WINDOWS\system32\rassapi.dll 2006-07-20 12:25 13,312 C:\WINDOWS\system32\tcpmib.dll 2006-07-20 12:25 13,312 C:\WINDOWS\system32\ssstars.scr 2006-07-20 12:25 13,312 C:\WINDOWS\system32\rsh.exe 2006-07-20 12:25 128,512 C:\WINDOWS\system32\taskmgr.exe 2006-07-20 12:25 126,976 C:\WINDOWS\system32\msdart.dll 2006-07-20 12:25 126,464 C:\WINDOWS\system32\shmedia.dll 2006-07-20 12:25 124,416 C:\WINDOWS\system32\sndrec32.exe 2006-07-20 12:25 122,880 C:\WINDOWS\system32\odbcconf.dll 2006-07-20 12:25 120,320 C:\WINDOWS\system32\upnp.dll 2006-07-20 12:25 12,800 C:\WINDOWS\system32\svchost.exe 2006-07-20 12:25 12,800 C:\WINDOWS\system32\runonce.exe 2006-07-20 12:25 12,800 C:\WINDOWS\system32\pjlmon.dll 2006-07-20 12:25 12,288 C:\WINDOWS\system32\rdsaddin.exe 2006-07-20 12:25 12,288 C:\WINDOWS\system32\odbcp32r.dll 2006-07-20 12:25 12,288 C:\WINDOWS\system32\mscpx32r.dll 2006-07-20 12:25 117,760 C:\WINDOWS\system32\stobject.dll 2006-07-20 12:25 116,736 C:\WINDOWS\system32\shsvcs.dll 2006-07-20 12:25 115,200 C:\WINDOWS\system32\net1.exe 2006-07-20 12:25 113,664 C:\WINDOWS\system32\msvfw32.dll 2006-07-20 12:25 112,128 C:\WINDOWS\system32\ntmarta.dll 2006-07-20 12:25 111,104 C:\WINDOWS\system32\umpnpmgr.dll 2006-07-20 12:25 11,776 C:\WINDOWS\system32\sigtab.dll 2006-07-20 12:25 11,776 C:\WINDOWS\system32\rexec.exe 2006-07-20 12:25 11,264 C:\WINDOWS\system32\msdmo.dll 2006-07-20 12:25 109,568 C:\WINDOWS\system32\offfilt.dll 2006-07-20 12:25 106,496 C:\WINDOWS\system32\url.dll 2006-07-20 12:25 106,496 C:\WINDOWS\system32\olepro32.dll 2006-07-20 12:25 105,984 C:\WINDOWS\system32\netdde.exe 2006-07-20 12:25 103,936 C:\WINDOWS\system32\sysocmgr.exe 2006-07-20 12:25 103,936 C:\WINDOWS\system32\mstlsapi.dll 2006-07-20 12:25 10,752 C:\WINDOWS\system32\tracert.exe 2006-07-20 12:25 10,752 C:\WINDOWS\system32\netrap.dll 2006-07-20 12:25 10,240 C:\WINDOWS\system32\msrle32.dll 2006-07-20 12:25 1,622,528 C:\WINDOWS\system32\netshell.dll 2006-07-20 12:25 1,503,262 C:\WINDOWS\system32\msjet40.dll 2006-07-20 12:25 1,388,544 C:\WINDOWS\system32\msvbvm60.dll 2006-07-20 12:25 1,349,120 C:\WINDOWS\system32\query.dll 2006-07-20 12:25 1,220,608 C:\WINDOWS\system32\msvidctl.dll 2006-07-20 12:25 1,190,400 C:\WINDOWS\system32\ole32.dll 2006-07-20 12:25 1,158,656 C:\WINDOWS\system32\quartz.dll 2006-07-20 12:25 1,157,632 C:\WINDOWS\system32\sfcfiles.dll 2006-07-20 12:25 1,122,304 C:\WINDOWS\system32\msxml3.dll 2006-07-20 12:24 938,496 C:\WINDOWS\system32\syssetup.dll 2006-07-20 12:24 932,864 C:\WINDOWS\system32\setupapi.dll 2006-07-20 12:24 930,304 C:\WINDOWS\system32\kernel32.dll 2006-07-20 12:24 93,184 C:\WINDOWS\system32\winscard.dll 2006-07-20 12:24 93,184 C:\WINDOWS\system32\scardsvr.exe 2006-07-20 12:24 91,648 C:\WINDOWS\system32\iuctl.dll 2006-07-20 12:24 86,528 C:\WINDOWS\system32\wlnotify.dll 2006-07-20 12:24 86,016 C:\WINDOWS\system32\xactsrv.dll 2006-07-20 12:24 82,944 C:\WINDOWS\system32\rasauto.dll 2006-07-20 12:24 802,304 C:\WINDOWS\system32\dxmrtp.dll 2006-07-20 12:24 80,896 C:\WINDOWS\system32\ntprint.dll 2006-07-20 12:24 79,872 C:\WINDOWS\system32\srvsvc.dll 2006-07-20 12:24 77,824 C:\WINDOWS\system32\wmpshell.dll 2006-07-20 12:24 77,440 C:\WINDOWS\system32\hal.dll 2006-07-20 12:24 762,368 C:\WINDOWS\system32\winntbbu.dll 2006-07-20 12:24 71,680 C:\WINDOWS\system32\nslookup.exe 2006-07-20 12:24 70,656 C:\WINDOWS\system32\ws2_32.dll 2006-07-20 12:24 70,656 C:\WINDOWS\system32\wiascr.dll 2006-07-20 12:24 681,984 C:\WINDOWS\system32\lsasrv.dll 2006-07-20 12:24 68,096 C:\WINDOWS\system32\locator.exe 2006-07-20 12:24 668,672 C:\WINDOWS\system32\ntdll.dll 2006-07-20 12:24 667,136 C:\WINDOWS\system32\userenv.dll 2006-07-20 12:24 65,585 C:\WINDOWS\system32\wshext.dll 2006-07-20 12:24 64,000 C:\WINDOWS\system32\webclnt.dll 2006-07-20 12:24 631,808 C:\WINDOWS\system32\rasdlg.dll 2006-07-20 12:24 60,416 C:\WINDOWS\system32\wextract.exe 2006-07-20 12:24 6,656 C:\WINDOWS\system32\ntlsapi.dll 2006-07-20 12:24 578,560 C:\WINDOWS\system32\autoconv.exe 2006-07-20 12:24 569,344 C:\WINDOWS\system32\oleaut32.dll 2006-07-20 12:24 568,832 C:\WINDOWS\system32\wiashext.dll 2006-07-20 12:24 565,760 C:&#
Post #21
Also herewith latest HJT log :-

Logfile of HijackThis v1.99.1
Scan saved at 21:39:34, on 25/07/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\imapi.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Chris Brownhill\My Documents\My Received Files\New Folder\crusty.exe
C:\Documents and Settings\Chris Brownhill\My Documents\My Received Files\New Folder\crusty.exe
C:\WINDOWS\System32\wuauclt.exe

O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Windows Process Viewer (The Windows Process Viewer) - Unknown owner - C:\WINDOWS\winlogon.exe (file missing)
O23 - Service: Windows DVD Burning Software (Windows CDR n DVD Burning Software) - Unknown owner - C:\WINDOWS\imapi.exe
O23 - Service: Microsoft Windows Protection (Windows Protection Service) - Unknown owner - C:\WINDOWS\winlogon.exe (file missing)
Post #22
Hi brown1950

Getting better.

Please go to these free online file checkers:

Kaspersky Online File Scanner

Jotti Online File Scanner

VirusTotal Online File Scanner

And submit this file for a virus scan:

c:\windows\imapi.exe

Let me know the results.

Good luck mschroe919
Post #23
As requested herewith results :- Virustotal _ Antivir = TR/Packed Cryped.exe Fortinet = Suspicious Kaspersky = Packed.Win32Crypt.exe VBA32 = Suspected of Malware Agent 70 Kaspersky = clean Viruscan = It is very likely a firewall or a piece of Malware is prohibiting you from uploading this file
Post #24
Herewith results of Jotti's scan :- Status : Infected/Malware Antivir = Trojan/Packed Crypt.exe Fortnet = W32/Crypt.exe Kaspersky = Packed Win32. Crypt.exe (probable variant) VBA 32 = Malware Agent 70 (probable variant)
Post #25
Hello again, Brown1950 :wavey:

mschroe919 has been called to work on other projects, and I've been asked to assist while he's being occupied elsewhere.

I hope you don't mind.
:)

Copy the text in the following quote box into Notepad:

attrib -r -s -h C:\WINDOWS\imapi.exe
del C:\WINDOWS\imapi.exe
attrib -r -s -h C:\WINDOWS\winlogon.exe
del C:\WINDOWS\winlogon.exe
attrib -r -s -h C:\nwnmed_7.exe
del C:\nwnmed_7.exe
attrib -r -s -h C:\kybrded_7.exe
del C:\kybrded_7.exe
attrib -r -s -h C:\nwnmdd_6.exe
del C:\nwnmdd_6.exe


Save it to (where you can find it) as killfile.bat

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O23 - Service: Windows Process Viewer (The Windows Process Viewer) - Unknown owner - C:\WINDOWS\winlogon.exe (file missing)

O23 - Service: Windows DVD Burning Software (Windows CDR n DVD Burning Software) - Unknown owner - C:\WINDOWS\imapi.exe

O23 - Service: Microsoft Windows Protection (Windows Protection Service) - Unknown owner - C:\WINDOWS\winlogon.exe (file missing)

Then click "Fix checked" and close Hijack This!.

Now, please go to:

Start –> Run

In the box type in services.msc then hit < Enter > (or click OK)

In the Name column look for:

Windows Process Viewer

< Double-click > it.

In the dialogue box that pops up, check in the Path to executable box.

It should say: C:\WINDOWS\winlogon.exe

That's how to be sure you have the right one.

Now, click Stop to stop that rogue process.

In the Startup type box, change it to Disabled.

Click Apply then OK

In the Name column look for:

Windows DVD Burning Software

< Double-click > it.

In the dialogue box that pops up, check in the Path to executable box.

It should say: C:\WINDOWS\imapi.exe

That's how to be sure you have the right one.

Now, click Stop to stop that rogue process.

In the Startup type box, change it to Disabled.

Click Apply then OK

In the Name column look for:

Microsoft Windows Protection

< Double-click > it.

In the dialogue box that pops up, check in the Path to executable box.

It should say: C:\WINDOWS\winlogon.exe

That's how to be sure you have the right one.

Now, click Stop to stop that rogue process.

In the Startup type box, change it to Disabled.

Click Apply then OK

Close the services.msc window.

Reboot in "safe" mode.

Find and the killfile.bat you saved earlier.

A DOS window will briefly open/close.

This will remove some of the unwanted files appearing in some of the logs you've posted.

Reboot in normal mode and "copy/paste" a new HijackThis! log file into this thread.

There are some other files I'd like submitted to the virus scans mschroe919 gave you links to.

The list to submit follows:

C:\pic4312.com
C:\files.exe
C:\WINDOWS\system32\setup_61070.exe
C:\WINDOWS\system32\setup_54182.exe
C:\WINDOWS\system32\setup_58074.exe
C:\WINDOWS\system32\setup_74452.exe
C:\WINDOWS\system32\aaa00000.sys
C:\WINDOWS\system32\D1D10E27-4CC6-4B83-A719-9AF80CA9CCB5.reg
C:\WINDOWS\system32\0A609CAA-D53B-4268-ACB5-8A8C09C2692C.reg
C:\WINDOWS\system32\132EDC98-E1DE-4B72-B513-C74E121F7D87.reg
C:\WINDOWS\system32\clear.reg

You don't have to try all three scans for each file.

If it comes back "infected", record the info (for posting into your next reply) and move on to the next file on the list.

Let me know the scan results.

:)
Post #26
Many thanks for your help greatly appreciated. I have scanned the files as you suggested and only one file came up with a virus :-

pic4312.com = details

Antivir = TR Packed Cryped.exe
Fortnet = W32-Crypt.exe
Kaspersky = Packed Win32.cryped.exe


Herewith latest HJT log :-


Logfile of HijackThis v1.99.1
Scan saved at 20:08:01, on 28/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MSN\MSNCoreFiles\msn6.exe
C:\PROGRA~1\MSNMES~1\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Chris Brownhill\My Documents\My Received Files\New Folder\crusty.exe

O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion…canner37940.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BA9F3AB8-475A-4491-B150-E54B554A4247}: NameServer = 80.225.254.178 80.225.254.186
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #27
Find and delete C:\pic4312.com

This folder was in a previous log:

C:\Program Files\YIntai

Do you know what it is/was for?

And, let me know if this folder is still present:

C:\Program Files\Common Files\{C866B80B-06A4-1033-0928-010314010001}

I see you've upgraded the OS to SP2 since the last post. :thumbup:

The log is currently free of malware.

How's the machine running at this point?
:unsure:
Post #28
Deleted file C:\pic4312.com as suggested. File C:\Program Files\Common Files\C866B80B-06A4-1033-0928-010314010001 is no longer on my computer. Y'Intai is a software programme for locating and opening webcams ! My computer is now running better with the following exceptions :- It takes a long time to boot up Also receiving messages reading found new hardware in particular on start up The new hardware wizard always opens up regarding installation of Network controller. Your further observations would be appreciated.
Post #29
Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
This program is for XP and Windows 2000 only
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Please run this online virus scan:

Trend-Micro Housecall
Put on 'Autoclean' and delete what it can't clean.

Reboot afterwards.

Let me know if it finds anything it can "clean" or "delete".
:)
Post #30
Due to lack of feedback:

This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI