(((((((((((((((((((((((((((((((((((((((((((((((( Vundo Log )))))))))))))))))))))))))))))))))))))))))))))))))))))
D:\WINDOWS\SYSTEM32\SSTQP.DLL
D:\WINDOWS\SYSTEM32\PQTSS.INI
D:\WINDOWS\SYSTEM32\PQTSS.TMP
* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
4:21:54.37
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2006-07-24 10:26:50 ( .D… ) "D:\Documents and Settings\Kawinma\Application Data\Ahead"
2006-07-24 10:02:02 ( .D… ) "D:\Program Files\Nero"
2006-07-24 10:02:02 ( .D… ) "D:\Program Files\Common Files\Ahead"
2006-07-24 08:11:46 ( .D… ) "D:\Program Files\ACCESS"
2006-07-24 00:03:20 2508 ( A…. ) "D:\Documents and Settings\Kawinma\Application Data\$_hpcst$.hpc"
2006-07-23 23:51:24 ( .D… ) "D:\Program Files\Microsoft ActiveSync"
2006-07-23 09:11:24 ( .D… ) "D:\Program Files\Webroot"
2006-07-23 09:11:24 ( .D… ) "D:\Documents and Settings\Kawinma\Application Data\Webroot"
2006-07-23 08:26:08 ( .D… ) "D:\Documents and Settings\Kawinma\Application Data\MailFrontier"
2006-07-23 07:48:02 ( .D… ) "D:\Program Files\Zone Labs"
2006-07-23 03:54:08 ( .D… ) "D:\Program Files\Windows Defender"
2006-07-22 18:08:52 ( .D… ) "D:\Program Files\Microsoft AntiSpyware"
2006-07-22 10:06:36 ( .D… ) "D:\Documents and Settings\Kawinma\Application Data\Sun"
2006-07-22 10:03:38 ( .D… ) "D:\Program Files\Java"
2006-07-22 10:03:12 ( .D… ) "D:\Program Files\Common Files\Java"
2006-07-22 09:08:38 274432 ( A…. ) "D:\WINDOWS\system32\imon.dll"
2006-07-22 09:08:32 ( .D… ) "D:\Program Files\ESET"
2006-07-21 22:49:30 ( .D… ) "D:\Documents and Settings\Kawinma\Application Data\Help"
2006-07-21 15:46:38 17750 ( A…. ) "D:\WINDOWS\system32\prrwffme.exe"
2006-07-21 03:45:08 17750 ( A…. ) "D:\WINDOWS\system32\rfnwlcux.exe"
2006-07-20 23:04:44 ( .D… ) "D:\Program Files\DU Meter"
2006-07-20 20:44:16 130048 ( A…. ) "D:\WINDOWS\system32\SpoonUninstall.exe"
2006-07-20 20:36:50 ( .D… ) "D:\Program Files\Illustrate"
2006-07-20 19:51:26 ( .D… ) "D:\Program Files\GIMP-2.0"
2006-07-20 19:49:48 ( .D… ) "D:\Program Files\Common Files\GTK"
2006-07-20 19:12:50 ( .D… ) "D:\Documents and Settings\Kawinma\Application Data\Vidalia"
2006-07-20 19:12:44 ( .D… ) "D:\Program Files\Vidalia"
2006-07-20 19:12:44 ( .D… ) "D:\Program Files\Tor"
2006-07-20 19:12:44 ( .D… ) "D:\Documents and Settings\Kawinma\Application Data\Tor"
2006-07-20 19:02:28 ( .D… ) "D:\Program Files\Microsoft IntelliPoint"
2006-07-20 19:01:54 ( .D… ) "D:\Program Files\Microsoft IntelliPoint 5.5"
2006-07-20 14:47:00 ( .D… ) "D:\Program Files\Adobe"
2006-07-20 14:39:04 ( .D… ) "D:\Program Files\AMD"
2006-07-20 14:35:02 ( .D… ) "D:\Program Files\ITE"
2006-07-20 14:32:58 ( .D… ) "D:\Program Files\VIA"
2006-07-20 14:31:34 ( .D… ) "D:\Program Files\Realtek Sound Manager"
2006-07-20 14:31:32 ( .D… ) "D:\Program Files\AvRack"
2006-07-20 14:31:28 ( .D… ) "D:\Program Files\Realtek AC97"
2006-07-20 14:31:24 ( .D.H. ) "D:\Program Files\InstallShield Installation Information"
2006-07-20 14:31:14 ( .D… ) "D:\Program Files\Common Files\InstallShield"
2006-07-20 14:29:40 ( .D… ) "D:\Documents and Settings\Kawinma\Application Data\Identities"
2006-07-20 14:29:38 ( .D.H. ) "D:\Program Files\Uninstall Information"
2006-07-20 14:29:34 ( .DS.. ) "D:\Documents and Settings\Kawinma\Application Data\Microsoft"
2006-07-20 14:24:50 ( .D… ) "D:\Program Files\xerox"
2006-07-20 14:24:50 ( .D… ) "D:\Program Files\microsoft frontpage"
2006-07-20 14:23:00 ( .D.H. ) "D:\Program Files\WindowsUpdate"
2006-07-20 14:22:18 ( .D… ) "D:\Program Files\Common Files\Services"
2006-07-20 14:22:14 ( .D… ) "D:\Program Files\Common Files\MSSoap"
2006-07-20 14:22:04 ( .D… ) "D:\Program Files\Movie Maker"
2006-07-20 14:21:54 ( .D… ) "D:\Program Files\NetMeeting"
2006-07-20 14:21:52 ( .D… ) "D:\Program Files\Outlook Express"
2006-07-20 14:21:48 ( .D… ) "D:\Program Files\Common Files\System"
2006-07-20 14:21:46 ( .D… ) "D:\Program Files\Internet Explorer"
2006-07-20 14:21:16 ( .D… ) "D:\Program Files\ComPlus Applications"
2006-07-20 14:21:04 ( .D… ) "D:\Program Files\Windows Media Player"
2006-07-20 14:21:04 ( .D… ) "D:\Program Files\Online Services"
2006-07-20 14:21:00 ( .D… ) "D:\Program Files\Messenger"
2006-07-20 14:20:56 ( .D… ) "D:\Program Files\MSN Gaming Zone"
2006-07-20 14:20:26 ( .D… ) "D:\Program Files\MSN"
2006-07-20 14:20:24 ( .D… ) "D:\Program Files\Windows NT"
2006-07-20 10:14:16 ( .D… ) "D:\Program Files\Common Files\ODBC"
2006-07-20 10:14:12 ( .D… ) "D:\Program Files\Common Files\SpeechEngines"
2006-07-20 10:14:12 ( .D… ) "D:\Program Files\Common Files\Microsoft Shared"
2006-07-20 10:14:12 ( .D… ) "D:\Program Files\Common Files"
2006-07-20 10:13:52 62 ( A.SH. ) "D:\Documents and Settings\Kawinma\Application Data\desktop.ini"
2006-07-20 07:14:26 ( .D… ) "D:\Program Files\MSN Messenger"
2006-07-20 07:10:08 ( .D… ) "D:\Program Files\PeerGuardian2"
2006-07-20 06:53:58 ( .D… ) "D:\Program Files\Bonjour"
2006-07-20 06:52:56 ( .D… ) "D:\Program Files\Gizmo Project"
2006-07-20 06:47:16 ( .D… ) "D:\Documents and Settings\Kawinma\Application Data\Skype"
2006-07-20 06:47:06 ( .D… ) "D:\Program Files\Skype"
2006-07-20 06:26:56 ( .D… ) "D:\Program Files\Furcadia"
2006-07-20 05:59:46 ( .D… ) "D:\Program Files\Bazooka Scanner"
2006-07-20 05:56:02 22528 ( A…. ) "D:\WINDOWS\system32\ixt0.dll"
2006-07-20 04:33:06 ( .D… ) "D:\Documents and Settings\Kawinma\Application Data\Lavasoft"
2006-07-20 04:32:52 ( .D… ) "D:\Program Files\Lavasoft"
2006-07-20 04:28:02 ( .D… ) "D:\Documents and Settings\Kawinma\Application Data\.BitTornado"
2006-07-20 04:27:38 ( .D… ) "D:\Program Files\BitTornado"
2006-07-20 03:40:00 ( .D… ) "D:\Program Files\Spybot - Search & Destroy"
2006-07-20 03:29:00 ( .D… ) "D:\Program Files\VirusBlast"
2006-07-20 03:22:32 ( .D… ) "D:\Program Files\7-Zip"
2006-07-20 03:17:22 ( .D… ) "D:\Program Files\mIRC"
2006-07-20 03:13:34 499712 ( A…. ) "D:\WINDOWS\system32\msvcp71.dll"
2006-07-20 03:13:34 348160 ( A…. ) "D:\WINDOWS\system32\msvcr71.dll"
2006-07-20 03:13:26 ( .D… ) "D:\Program Files\Grisoft"
2006-07-20 02:58:20 ( .D… ) "D:\Program Files\Winamp"
2006-07-20 02:58:20 ( .D… ) "D:\Documents and Settings\Kawinma\Application Data\Winamp"
2006-07-20 02:56:26 ( .D… ) "D:\Program Files\Creative"
2006-07-20 02:52:34 ( .D… ) "D:\Documents and Settings\Kawinma\Application Data\Talkback"
2006-07-20 02:52:22 ( .D… ) "D:\Program Files\Mozilla Firefox"
2006-07-20 02:52:22 ( .D… ) "D:\Documents and Settings\Kawinma\Application Data\Mozilla"
2006-07-20 02:51:54 ( .D… ) "D:\Documents and Settings\Kawinma\Application Data\Macromedia"
2006-07-20 02:51:02 ( .D… ) "D:\Documents and Settings\Kawinma\Application Data\Leadertech"
2006-07-20 02:48:48 ( .D… ) "D:\Program Files\epson"
2006-06-26 16:13:20 129832 ( A…. ) "D:\WINDOWS\system32\rapi.dll"
2006-06-26 16:12:26 20264 ( A…. ) "D:\WINDOWS\system32\ceutil.dll"
2006-06-18 17:54:58 394872 ( A…. ) "D:\WINDOWS\system32\vsdatant.sys"
2006-06-18 17:54:58 394872 ( A…. ) "D:\WINDOWS\system32\vsdatant.sys"
2006-06-18 17:54:48 75776 ( A…. ) "D:\WINDOWS\zllsputility.exe"
2006-06-18 17:54:26 83960 ( A…. ) "D:\WINDOWS\system32\zlcomm.dll"
2006-06-18 17:54:26 71672 ( A…. ) "D:\WINDOWS\system32\zlcommdb.dll"
2006-06-18 17:54:24 100344 ( A…. ) "D:\WINDOWS\system32\vsxml.dll"
2006-06-18 17:54:24 59384 ( A…. ) "D:\WINDOWS\system32\vswmi.dll"
2006-06-18 17:54:22 440312 ( A…. ) "D:\WINDOWS\system32\vsutil.dll"
2006-06-18 17:54:22 71672 ( A…. ) "D:\WINDOWS\system32\vsregexp.dll"
2006-06-18 17:54:20 268280 ( A…. ) "D:\WINDOWS\system32\vspubapi.dll"
2006-06-18 17:54:20 157688 ( A…. ) "D:\WINDOWS\system32\vsinit.dll"
2006-06-18 17:54:20 104440 ( A…. ) "D:\WINDOWS\system32\vsmonapi.dll"
2006-06-18 17:54:18 83960 ( A…. ) "D:\WINDOWS\system32\vsdata.dll"
2006-06-18 17:54:08 796584 ( A…. ) "D:\WINDOWS\system32\libeay32_0.9.6l.dll"
2006-06-16 14:34:44 48936 ( A…. ) "D:\WINDOWS\system32\sirenacm.dll"
2006-05-19 05:59:42 148480 ( A…. ) "D:\WINDOWS\system32\dnsapi.dll"
2006-05-19 05:59:42 111616 ( A…. ) "D:\WINDOWS\system32\dhcpcsvc.dll"
2006-05-19 05:59:42 94720 ( A…. ) "D:\WINDOWS\system32\iphlpapi.dll"
(((((((((((((((((((((((((((((((((((((( Files Created - Last 30days )))))))))))))))))))))))))))))))))))))))))))
2006-07-24 21:50 266,850,304 D:\hiberfil.sys
2006-07-23 09:51 221,184 D:\WINDOWS\system32\wmpns.dll
2006-07-23 09:12 8,192 D:\WINDOWS\system32\ssiefr.EXE
2006-07-23 09:12 492,544 D:\WINDOWS\system32\WRLogonNtf.dll
2006-07-23 09:12 17,920 D:\WINDOWS\system32\wrlzma.dll
2006-07-23 09:12 102,912 D:\WINDOWS\system32\islzma.dll
2006-07-23 09:11 684,032 D:\WINDOWS\libeay32.dll
2006-07-23 09:11 478,720 D:\WINDOWS\WRUninstall.dll
2006-07-23 09:11 155,648 D:\WINDOWS\ssleay32.dll
2006-07-23 07:50 75,776 D:\WINDOWS\zllsputility.exe
2006-07-23 07:49 83,960 D:\WINDOWS\system32\zlcomm.dll
2006-07-23 07:49 796,584 D:\WINDOWS\system32\libeay32_0.9.6l.dll
2006-07-23 07:49 77,824 D:\WINDOWS\system32\driverif.dll
2006-07-23 07:49 733,236 D:\WINDOWS\system32\vete.dll
2006-07-23 07:49 71,672 D:\WINDOWS\system32\zlcommdb.dll
2006-07-23 07:49 71,672 D:\WINDOWS\system32\vsregexp.dll
2006-07-23 07:49 12,288 D:\WINDOWS\system32\vetntmsg.dll
2006-07-23 07:48 59,384 D:\WINDOWS\system32\vswmi.dll
2006-07-23 07:48 100,344 D:\WINDOWS\system32\vsxml.dll
2006-07-23 07:47 394,872 D:\WINDOWS\system32\vsdatant.sys
2006-07-23 07:47 268,280 D:\WINDOWS\system32\vspubapi.dll
2006-07-23 07:47 104,440 D:\WINDOWS\system32\vsmonapi.dll
2006-07-23 07:46 83,960 D:\WINDOWS\system32\vsdata.dll
2006-07-23 07:46 440,312 D:\WINDOWS\system32\vsutil.dll
2006-07-23 07:46 157,688 D:\WINDOWS\system32\vsinit.dll
2006-07-23 02:55 22,752 D:\WINDOWS\system32\spupdsvc.exe
2006-07-22 10:05 49,250 D:\WINDOWS\system32\javaw.exe
2006-07-22 10:05 49,248 D:\WINDOWS\system32\java.exe
2006-07-22 10:05 127,078 D:\WINDOWS\system32\javaws.exe
2006-07-22 09:13 274,432 D:\WINDOWS\system32\imon.dll
2006-07-21 15:46 17,750 D:\WINDOWS\system32\prrwffme.exe
2006-07-21 03:45 17,750 D:\WINDOWS\system32\rfnwlcux.exe
2006-07-20 20:36 130,048 D:\WINDOWS\system32\SpoonUninstall.exe
2006-07-20 14:35 2,337,488 D:\WINDOWS\system32\d3dx9_25.dll
2006-07-20 14:35 118,784 D:\WINDOWS\system32\Msstdfmt.dll
2006-07-20 14:34 303,616 D:\WINDOWS\IsUninst.exe
2006-07-20 14:32 61,440 D:\WINDOWS\system32\vuins32.dll
2006-07-20 14:32 40,960 D:\WINDOWS\system32\ChCfg.exe
2006-07-20 14:31 90,112 D:\WINDOWS\soundman.exe
2006-07-20 14:31 4,096 D:\WINDOWS\system32\ksuser.dll
2006-07-20 14:31 307,200 D:\WINDOWS\alcupd.exe
2006-07-20 14:31 212,992 D:\WINDOWS\alcrmv.exe
2006-07-20 14:31 156,672 D:\WINDOWS\system32\RtlCPAPI.dll
2006-07-20 14:31 10,458,112 D:\WINDOWS\system32\RTLCPL.exe
2006-07-20 14:24 112,128 D:\WINDOWS\system32\mapi32.dll
2006-07-20 14:22 8,192 D:\WINDOWS\system32\bitsprx2.dll
2006-07-20 14:22 7,168 D:\WINDOWS\system32\bitsprx3.dll
2006-07-20 14:22 64,512 D:\WINDOWS\system32\acctres.dll
2006-07-20 14:22 6,656 D:\WINDOWS\system32\wuauserv.dll
2006-07-20 14:22 465,176 D:\WINDOWS\system32\wuapi.dll
2006-07-20 14:22 45,568 D:\WINDOWS\system32\safrslv.dll
2006-07-20 14:22 43,520 D:\WINDOWS\system32\safrcdlg.dll
2006-07-20 14:22 43,520 D:\WINDOWS\system32\racpldlg.dll
2006-07-20 14:22 41,240 D:\WINDOWS\system32\wups.dll
2006-07-20 14:22 382,464 D:\WINDOWS\system32\qmgr.dll
2006-07-20 14:22 29,696 D:\WINDOWS\system32\safrdm.dll
2006-07-20 14:22 194,328 D:\WINDOWS\system32\wuaueng1.dll
2006-07-20 14:22 18,944 D:\WINDOWS\system32\qmgrprxy.dll
2006-07-20 14:22 173,536 D:\WINDOWS\system32\wuweb.dll
2006-07-20 14:22 172,312 D:\WINDOWS\system32\wuauclt1.exe
2006-07-20 14:22 16,384 D:\WINDOWS\system32\icfgnt5.dll
2006-07-20 14:22 127,256 D:\WINDOWS\system32\wucltui.dll
2006-07-20 14:22 124,184 D:\WINDOWS\system32\wuauclt.exe
2006-07-20 14:22 12,288 D:\WINDOWS\system32\nmevtmsg.dll
2006-07-20 14:22 11,264 D:\WINDOWS\system32\atrace.dll
2006-07-20 14:22 1,343,768 D:\WINDOWS\system32\wuaueng.dll
2006-07-20 14:21 81,920 D:\WINDOWS\system32\isign32.dll
2006-07-20 14:21 81,920 D:\WINDOWS\system32\ils.dll
2006-07-20 14:21 73,728 D:\WINDOWS\system32\icwdial.dll
2006-07-20 14:21 69,632 D:\WINDOWS\system32\msconf.dll
2006-07-20 14:21 679,424 D:\WINDOWS\system32\inetcomm.dll
2006-07-20 14:21 67,584 D:\WINDOWS\system32\srclient.dll
2006-07-20 14:21 65,536 D:\WINDOWS\system32\icwphbk.dll
2006-07-20 14:21 48,128 D:\WINDOWS\system32\inetres.dll
2006-07-20 14:21 34,560 D:\WINDOWS\system32\mnmdd.dll
2006-07-20 14:21 32,768 D:\WINDOWS\system32\mnmsrvc.exe
2006-07-20 14:21 32,768 D:\WINDOWS\system32\isrdbg32.dll
2006-07-20 14:21 28,672 D:\WINDOWS\system32\nmmkcert.dll
2006-07-20 14:21 274,944 D:\WINDOWS\system32\mstask.dll
2006-07-20 14:21 274,432 D:\WINDOWS\system32\inetcfg.dll
2006-07-20 14:21 252,928 D:\WINDOWS\system32\msoeacct.dll
2006-07-20 14:21 239,104 D:\WINDOWS\system32\srrstr.dll
2006-07-20 14:21 22,528 D:\WINDOWS\system32\fltMc.exe
2006-07-20 14:21 190,976 D:\WINDOWS\system32\schedsvc.dll
2006-07-20 14:21 170,496 D:\WINDOWS\system32\srsvc.dll
2006-07-20 14:21 16,896 D:\WINDOWS\system32\fltlib.dll
2006-07-20 14:21 12,288 D:\WINDOWS\system32\mstinit.exe
2006-07-20 14:21 105,984 D:\WINDOWS\system32\msoert2.dll
2006-07-20 14:20 97,792 D:\WINDOWS\system32\comrepl.dll
2006-07-20 14:20 956,416 D:\WINDOWS\system32\msdtctm.dll
2006-07-20 14:20 93,696 D:\WINDOWS\system32\tscfgwmi.dll
2006-07-20 14:20 91,136 D:\WINDOWS\system32\mtxoci.dll
2006-07-20 14:20 9,728 D:\WINDOWS\system32\reset.exe
2006-07-20 14:20 87,176 D:\WINDOWS\system32\rdpwsx.dll
2006-07-20 14:20 85,504 D:\WINDOWS\system32\catsrvps.dll
2006-07-20 14:20 80,384 D:\WINDOWS\system32\charmap.exe
2006-07-20 14:20 73,216 D:\WINDOWS\system32\avwav.dll
2006-07-20 14:20 67,072 D:\WINDOWS\system32\rdshost.exe
2006-07-20 14:20 655,360 D:\WINDOWS\system32\mstscax.dll
2006-07-20 14:20 625,152 D:\WINDOWS\system32\catsrvut.dll
2006-07-20 14:20 62,464 D:\WINDOWS\system32\rdpclip.exe
2006-07-20 14:20 605,696 D:\WINDOWS\system32\getuname.dll
2006-07-20 14:20 60,416 D:\WINDOWS\system32\remotepg.dll
2006-07-20 14:20 60,416 D:\WINDOWS\system32\colbact.dll
2006-07-20 14:20 6,144 D:\WINDOWS\system32\msdtc.exe
2006-07-20 14:20 58,880 D:\WINDOWS\system32\msdtclog.dll
2006-07-20 14:20 58,880 D:\WINDOWS\system32\licwmi.dll
2006-07-20 14:20 56,832 D:\WINDOWS\system32\sol.exe
2006-07-20 14:20 56,320 D:\WINDOWS\system32\servdeps.dll
2006-07-20 14:20 55,296 D:\WINDOWS\system32\freecell.exe
2006-07-20 14:20 540,160 D:\WINDOWS\system32\comuid.dll
2006-07-20 14:20 54,272 D:\WINDOWS\system32\stclient.dll
2006-07-20 14:20 538,624 D:\WINDOWS\system32\spider.exe
2006-07-20 14:20 5,632 D:\WINDOWS\system32\write.exe
2006-07-20 14:20 5,120 D:\WINDOWS\system32\dcomcnfg.exe
2006-07-20 14:20 498,688 D:\WINDOWS\system32\clbcatq.dll
2006-07-20 14:20 44,544 D:\WINDOWS\system32\tscupgrd.exe
2006-07-20 14:20 44,544 D:\WINDOWS\system32\hticons.dll
2006-07-20 14:20 426,496 D:\WINDOWS\system32\msdtcprx.dll
2006-07-20 14:20 407,552 D:\WINDOWS\system32\mstsc.exe
2006-07-20 14:20 4,096 D:\WINDOWS\system32\rdpcfgex.dll
2006-07-20 14:20 4,096 D:\WINDOWS\system32\mtxex.dll
2006-07-20 14:20 38,912 D:\WINDOWS\system32\cfgbkend.dll
2006-07-20 14:20 35,328 D:\WINDOWS\system32\winchat.exe
2006-07-20 14:20 347,136 D:\WINDOWS\system32\hypertrm.dll
2006-07-20 14:20 343,040 D:\WINDOWS\system32\mspaint.exe
2006-07-20 14:20 33,792 D:\WINDOWS\system32\regini.exe
2006-07-20 14:20 295,424 D:\WINDOWS\system32\termsrv.dll
2006-07-20 14:20 25,600 D:\WINDOWS\system32\comaddin.dll
2006-07-20 14:20 25,088 D:\WINDOWS\system32\mtxlegih.dll
2006-07-20 14:20 227,840 D:\WINDOWS\system32\avtapi.dll
2006-07-20 14:20 225,792 D:\WINDOWS\system32\catsrv.dll
2006-07-20 14:20 22,016 D:\WINDOWS\system32\qwinsta.exe
2006-07-20 14:20 20,992 D:\WINDOWS\system32\msg.exe
2006-07-20 14:20 20,480 D:\WINDOWS\system32\qprocess.exe
2006-07-20 14:20 20,480 D:\WINDOWS\system32\mtxdm.dll
2006-07-20 14:20 19,968 D:\WINDOWS\system32\rdpsnd.dll
2006-07-20 14:20 185,344 D:\WINDOWS\system32\cmprops.dll
2006-07-20 14:20 183,808 D:\WINDOWS\system32\accwiz.exe
2006-07-20 14:20 17,408 D:\WINDOWS\system32\mmfutil.dll
2006-07-20 14:20 161,280 D:\WINDOWS\system32\msdtcuiu.dll
2006-07-20 14:20 16,896 D:\WINDOWS\system32\tsshutdn.exe
2006-07-20 14:20 16,896 D:\WINDOWS\system32\qappsrv.exe
2006-07-20 14:20 16,384 D:\WINDOWS\system32\tskill.exe
2006-07-20 14:20 16,384 D:\WINDOWS\system32\avmeter.dll
2006-07-20 14:20 15,872 D:\WINDOWS\system32\rwinsta.exe
2006-07-20 14:20 15,872 D:\WINDOWS\system32\cdmodem.dll
2006-07-20 14:20 15,360 D:\WINDOWS\system32\logoff.exe
2006-07-20 14:20 147,968 D:\WINDOWS\system32\rdchost.dll
2006-07-20 14:20 147,456 D:\WINDOWS\system32\comsnap.dll
2006-07-20 14:20 140,800 D:\WINDOWS\system32\sessmgr.exe
2006-07-20 14:20 14,848 D:\WINDOWS\system32\tsdiscon.exe
2006-07-20 14:20 14,848 D:\WINDOWS\system32\tscon.exe
2006-07-20 14:20 14,848 D:\WINDOWS\system32\shadow.exe
2006-07-20 14:20 138,752 D:\WINDOWS\system32\sndvol32.exe
2006-07-20 14:20 131,584 D:\WINDOWS\system32\sndrec32.exe
2006-07-20 14:20 13,824 D:\WINDOWS\system32\rdsaddin.exe
2006-07-20 14:20 126,976 D:\WINDOWS\system32\mshearts.exe
2006-07-20 14:20 123,392 D:\WINDOWS\system32\mplay32.exe
2006-07-20 14:20 119,808 D:\WINDOWS\system32\winmine.exe
2006-07-20 14:20 114,688 D:\WINDOWS\system32\calc.exe
2006-07-20 14:20 110,080 D:\WINDOWS\system32\clbcatex.dll
2006-07-20 14:20 11,776 D:\WINDOWS\system32\xolehlp.dll
2006-07-20 14:20 11,264 D:\WINDOWS\system32\icaapi.dll
2006-07-20 14:20 102,912 D:\WINDOWS\system32\clipbrd.exe
2006-07-20 14:20 1,267,200 D:\WINDOWS\system32\comsvcs.dll
2006-07-20 14:20 1,161 D:\WINDOWS\system32\usrlogon.cmd
2006-07-20 10:16 21,504 D:\WINDOWS\system32\hidserv.dll
2006-07-20 10:15 74,240 D:\WINDOWS\system32\usbui.dll
2006-07-20 10:15 4,274,816 D:\WINDOWS\system32\nv4_disp.dll
2006-07-20 10:14 85,020 D:\WINDOWS\system32\dgsetup.dll
2006-07-20 10:14 8,192 D:\WINDOWS\system32\kbdhept.dll
2006-07-20 10:14 7,168 D:\WINDOWS\system32\kbdcz.dll
2006-07-20 10:14 6,656 D:\WINDOWS\system32\kbdycl.dll
2006-07-20 10:14 6,656 D:\WINDOWS\system32\kbdsl1.dll
2006-07-20 10:14 6,656 D:\WINDOWS\system32\kbdsl.dll
2006-07-20 10:14 6,656 D:\WINDOWS\system32\kbdpl.dll
2006-07-20 10:14 6,656 D:\WINDOWS\system32\kbdhu.dll
2006-07-20 10:14 6,656 D:\WINDOWS\system32\kbdhela3.dll
2006-07-20 10:14 6,656 D:\WINDOWS\system32\kbdcz2.dll
2006-07-20 10:14 6,656 D:\WINDOWS\system32\kbdcz1.dll
2006-07-20 10:14 6,656 D:\WINDOWS\system32\kbdcr.dll
2006-07-20 10:14 6,656 D:\WINDOWS\system32\KBDAL.DLL
2006-07-20 10:14 6,144 D:\WINDOWS\system32\kbdtuq.dll
2006-07-20 10:14 6,144 D:\WINDOWS\system32\kbdtuf.dll
2006-07-20 10:14 6,144 D:\WINDOWS\system32\kbdlv1.dll
2006-07-20 10:14 6,144 D:\WINDOWS\system32\kbdlv.dll
2006-07-20 10:14 6,144 D:\WINDOWS\system32\kbdhela2.dll
2006-07-20 10:14 6,144 D:\WINDOWS\system32\kbdgkl.dll
2006-07-20 10:14 6,144 D:\WINDOWS\system32\kbdest.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdycc.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbduzb.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdur.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdtat.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdru1.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdru.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdro.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdpl1.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdmon.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdlt1.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdlt.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdkyr.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdkaz.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdhu1.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdhe319.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdhe220.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdhe.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdbu.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdblr.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdazel.dll
2006-07-20 10:14 5,632 D:\WINDOWS\system32\kbdaze.dll
2006-07-20 10:14 24,661 D:\WINDOWS\system32\spxcoins.dll
2006-07-20 10:14 176,157 D:\WINDOWS\system32\dgrpsetu.dll
2006-07-20 10:14 13,312 D:\WINDOWS\system32\irclass.dll
2006-07-20 10:14 103,424 D:\WINDOWS\system32\EqnClass.Dll
2006-07-20 10:13 8,704 D:\WINDOWS\system32\batt.dll
2006-07-20 10:13 74,752 D:\WINDOWS\system32\storprop.dll
2006-07-20 10:13 69,120 D:\WINDOWS\NOTEPAD.EXE
2006-07-20 10:13 15,360 D:\WINDOWS\TASKMAN.EXE
2006-07-20 10:06 402,653,184 D:\pagefile.sys
2006-07-20 03:23 22,528 D:\WINDOWS\system32\ixt0.dll
2006-07-20 03:13 499,712 D:\WINDOWS\system32\msvcp71.dll
2006-07-20 03:13 348,160 D:\WINDOWS\system32\msvcr71.dll
2006-07-20 02:56 11,264 D:\WINDOWS\INRES.DLL
2006-07-20 02:50 483,328 D:\WINDOWS\system32\PICSDK.dll
2006-07-20 02:50 45,056 D:\WINDOWS\system32\EpPicPrt.dll
2006-07-20 02:50 45,056 D:\WINDOWS\system32\EpPicMgr.dll
2006-07-20 02:48 79,679 D:\WINDOWS\system32\E_FLMACA.DLL
2006-07-20 02:48 64,000 D:\WINDOWS\system32\E_FBCBACA.DLL
2006-07-20 02:48 46,080 D:\WINDOWS\system32\escimgd.dll
2006-07-20 02:48 34,304 D:\WINDOWS\system32\E_FBCHACA.DLL
2006-07-20 02:48 29,696 D:\WINDOWS\system32\escwiad.dll
2006-07-20 02:48 22,016 D:\WINDOWS\system32\esccmd.dll
2006-06-26 16:13 129,832 D:\WINDOWS\system32\rapi.dll
2006-06-26 16:12 20,264 D:\WINDOWS\system32\ceutil.dll
2006-06-16 14:34 48,936 D:\WINDOWS\system32\sirenacm.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SoundMan"="SOUNDMAN.EXE"
"RaidTool"="D:\\Program Files\\VIA\\RAID\\raid_tool.exe"
"EPSON Stylus CX3800 Series"="D:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIACA.EXE /P26 \"EPSON Stylus CX3800 Series\" /O6 \"USB001\" /M \"Stylus CX3800\""
"WinampAgent"="D:\\Program Files\\Winamp\\winampa.exe"
"IntelliPoint"="\"D:\\Program Files\\Microsoft IntelliPoint\\ipoint.exe\""
"DU Meter"="D:\\Program Files\\DU Meter\\DUMeter.exe"
"nod32kui"="\"D:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE"
"SunJavaUpdateSched"="D:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"Windows Defender"="\"D:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"Zone Labs Client"="\"D:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"SpySweeper"="\"D:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeper.exe\" /startintray"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\AutorunsDisabled]
"Gizmo Project"="D:\\Program Files\\Gizmo Project\\Gizmo.exe"
"NeroFilterCheck"="D:\\WINDOWS\\system32\\NeroCheck.exe"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Skype"="\"D:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"MsnMsgr"="\"D:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"H/PC Connection Agent"="\"D:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe\""
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\AutorunsDisabled]
"Vidalia"="\"D:\\Program Files\\Vidalia\\vidalia.exe\""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
"flags"=dword:00000008
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex\000]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run\AutorunsDisabled]
"ishost.exe"="ishost.exe"
"issearch.exe"="issearch.exe"
"kernel32.dll"="D:\\WINDOWS\\system32\\isnotify.exe"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run\AutorunsDisabled]
"{9CD577EE-07D0-1033-0314-060322040001}"="\"D:\\Program Files\\Common Files\\{9CD577EE-07D0-1033-0314-060322040001}\\Update.exe\" mc-110-12-0000272"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e4,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Rundll32 P17"
"hkey"="HKLM"
"command"="Rundll32 P17.dll,P17Helper"
"inimapping"="0"
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\svcWRSSSDK
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WinDefend
Contents of the 'Scheduled Tasks' folder
D:\WINDOWS\tasks\MP Scheduled Scan.job
Completion time: Tue 07/25/2006 4:24:05.40
ComboFix ver 06.07.15 - This logfile is located at D:\ComboFix.txt
–
Logfile of HijackThis v1.99.1
Scan saved at 4:32:54 AM, on 7/25/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Windows Defender\MsMpEng.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Eset\nod32krn.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\VIA\RAID\raid_tool.exe
D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE
D:\Program Files\Winamp\winampa.exe
D:\Program Files\Microsoft IntelliPoint\ipoint.exe
D:\Program Files\DU Meter\DUMeter.exe
D:\Program Files\Eset\nod32kui.exe
D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
D:\Program Files\Windows Defender\MSASCui.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
D:\Program Files\Skype\Phone\Skype.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Program Files\Microsoft ActiveSync\wcescomm.exe
D:\PROGRA~1\MICROS~4\rapimgr.exe
D:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Winamp\winamp.exe
D:\PROGRA~1\MOZILL~1\FIREFOX.EXE
D:\Program Files\Furcadia\Furcadia.exe
D:\Documents and Settings\Kawinma\Desktop\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {873eb32d-ae1a-4183-89bd-45a77f761be4} - D:\WINDOWS\system32\ixt0.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {C2BA8820-E14E-4695-9A5C-595DD63AB17D} - D:\WINDOWS\system32\sstqp.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RaidTool] D:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [EPSON Stylus CX3800 Series] D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE /P26 "EPSON Stylus CX3800 Series" /O6 "USB001" /M "Stylus CX3800"
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [IntelliPoint] "D:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [DU Meter] D:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Windows Defender] "D:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Zone Labs Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SpySweeper] "D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - D:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: d:\program files\bonjour\mdnsnsp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: sstqp - D:\WINDOWS\system32\sstqp.dll (file missing)
O20 - Winlogon Notify: wingga32 - wingga32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - D:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Bonjour Service - Apple Computer, Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe
