What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

A Little Help Please. Computer Doesnt Compute!

33 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
If anyone could help me out with this, it would be very much apreaceated… I had a number of compuer courses in collage, but this was three or four yeas ago and i cant remember things very well… I tried everything i know, but to no avail…

thanks


Logfile of HijackThis v1.99.1
Scan saved at 5:10:58 PM, on 11/11/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\CTSvcCDA.exe
C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\System32\tcpip.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\Explorer.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\System32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\SPYWAR~2\swdoctor.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
\Simpleshare\NetFolder\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe
F3 - REG:win.ini: run=,
F2 - REG:system.ini: UserInit=C:\WINNT\System32\Userinit.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SoftwareStation] "C:\Program Files\eAcceleration\Station\station.exe" /b Startup
O4 - HKLM\..\Run: [SDR6_Check] "C:\Program Files\Common Files\DriveCleaner 2006 Free\udcsdr.exe"
O4 - HKLM\..\Run: [PAS_Check] "C:\Program Files\Common Files\DriveCleaner 2006 Free\udcpas.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://www.rawflow.com/passion/Rawflow.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1124499090416
O16 - DPF: {89242969-422B-46BF-B0D5-6A7B7DC4D0E0} (Nafi Class) - file://C:\Documents and Settings\Tessa\Local Settings\Temp\Rar$EX08.375\NASFinder-050809\html\nafcom.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…886/mcfscan.cab
O20 - AppInit_DLLs: c:\winnt\system32\ldcore.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTSvcCDA.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Dantz - C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
Post #3
Hello and welcome to the TC forums

You need to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection. Click here: http://www.microsoft.com/windowsxp/downloa…p1/default.mspx
Apply the update, reboot, and post a fresh Hijack This log.
(DO NOT INSTALL SP2 at this time)



After the above:

Please go HERE and do a online scan.
Let me know what is found.

After scan, reboot and post a new HijackThis log

Also let me know how the computer is running now.
Post #4
I'm not sure what was installed and what not because my computer is really screwed. It went to the blue screen of death but is currently running, although slowly.



Logfile of HijackThis v1.99.1
Scan saved at 10:33:40 PM, on 11/14/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\CTSvcCDA.exe
C:\WINNT\System32\msasvc.exe
C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\System32\tcpip.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\atiptaxx.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\{5C280981-0367-1033-0510-020003270001}\Update.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
F:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=C:\WINNT\System32\Userinit.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://www.rawflow.com/passion/Rawflow.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1124499090416
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1163551812568
O16 - DPF: {89242969-422B-46BF-B0D5-6A7B7DC4D0E0} (Nafi Class) - file://C:\Documents and Settings\Tessa\Local Settings\Temp\Rar$EX08.375\NASFinder-050809\html\nafcom.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…886/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E99E132C-52F1-4ABE-8A04-D6583D60C55F}: NameServer = 24.196.64.53,68.115.71.53
O20 - AppInit_DLLs: C:\WINNT\System32\tmp_7r.dll
O20 - Winlogon Notify: rpcc - C:\WINNT\System32\rpcc.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTSvcCDA.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINNT\System32\msasvc.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Dantz - C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
Post #5
Hello and Welcome to the forum.

This is part of the infection you have.
http://research.sunbelt-software.com/threa…;threatid=70540

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


Run HiJackThis then:

1. Click "Config…"
2. Click "Misc Tools"
3. Click "Open Process manager"


Next, while holding down the CTRL key, locate (if present) and click on (highlight) each of the following:

C:\WINNT\System32\tmp_7r.dll
C:\WINNT\System32\rpcc.dll
C:\WINNT\System32\msasvc.exe

Now double-check and make sure that only those item(s) above are highlighted, then click "Kill process". Now, click "Refresh", check again, and repeat this step if any remain.



Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=C:\WINNT\System32\Userinit.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O16 - DPF: {89242969-422B-46BF-B0D5-6A7B7DC4D0E0} (Nafi Class) - file://C:\Documents and Settings\Tessa\Local Settings\Temp\Rar$EX08.375\NASFinder-050809\html\nafcom.cab
O20 - AppInit_DLLs: C:\WINNT\System32\tmp_7r.dll
O20 - Winlogon Notify: rpcc - C:\WINNT\System32\rpcc.dll
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINNT\System32\msasvc.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"



Delete these Files if listed:
C:\WINNT\System32\tmp_7r.dll
C:\WINNT\System32\rpcc.dll
C:\WINNT\System32\msasvc.exe


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #6
Hi,

I followed all the instructions… However when I clicked "Fix This" in Hijack This this message came up:
"An unexpected error has occurred at procedure: modBackup_MakeBackup(sitem=20-Applnit_DLLS:C:\WINNT\System32\tmp_7r.dll" and it instructed me to e-mail this to [removed].

And I think I can't delete file rpcc.dll because it everytime I try it says it is being used by another program even there are no other programs open.

Here is a copy of my new HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 10:57:21 PM, on 11/16/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\CTSvcCDA.exe
C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\System32\tcpip.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\atiptaxx.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\{5C280981-0367-1033-0510-020003270001}\Update.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINNT\System32\wuauclt.exe
C:\WINNT\System32\wbem\wmiprvse.exe
C:\WINNT\System32\wuauclt.exe
F:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://www.rawflow.com/passion/Rawflow.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1124499090416
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1163551812568
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…886/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E99E132C-52F1-4ABE-8A04-D6583D60C55F}: NameServer = 24.196.64.53,68.115.71.53
O20 - Winlogon Notify: rpcc - C:\WINNT\System32\rpcc.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTSvcCDA.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINNT\System32\msasvc.exe (file missing)
O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Dantz - C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe


My computer seems to be running slightly better (but not much) than before this procedure. There are still pop-ups which causes everthing to slow down a lot and I have to wait like 5 minutes before anything will respond. My computer will also restart on its own (I haven't had enough time see if this still occurs after this procedure).

Thank you :D
Post #7
Next, launch Notepad (Start>All Programs>Accessories), and copy/paste all the BOLD REGEDIT below to it. Don't forget to include REGEDIT4.
Save in: Desktop
File Name: fixme.reg
Save as Type: All files
Click: Save

REGEDIT4

[-HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon\Notify\frpcc.dll]

On the desktop, doubleclick fix.reg and allow it to run. Let it merge.

Next:

Click Start > Run > and type in:

services.msc

Click OK.

In the services window find Microsoft authenticate service (MsaSvc)
Right click and choose "Properties". On the "General" tab under "Service
Status" click the "Stop" button to stop the service. Beside "Startup Type"
in the dropdown menu select "Disabled". Click Apply then OK. Exit the
Services utility.


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O20 - Winlogon Notify: rpcc - C:\WINNT\System32\rpcc.dll
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINNT\System32\msasvc.exe (file missing)

Close ALL windows and browsers except HijackThis and click "Fix checked"


Delete these Files if listed:
C:\WINNT\System32\msasvc.exe
C:\WINNT\System32\rpcc.dll



Empty Recycle Bin

Restart your computer.

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #8
Hello again,

Here is a copy of my latest log file.
Logfile of HijackThis v1.99.1
Scan saved at 12:46:41 AM, on 11/18/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\CTSvcCDA.exe
C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\atiptaxx.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\System32\tcpip.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\{5C280981-0367-1033-0510-020003270001}\Update.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINNT\System32\svchost.exe
F:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://www.rawflow.com/passion/Rawflow.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1124499090416
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1163551812568
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…886/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E99E132C-52F1-4ABE-8A04-D6583D60C55F}: NameServer = 24.196.64.53,68.115.71.53
O20 - AppInit_DLLs: C:\WINNT\System32\syste.dll
O20 - Winlogon Notify: rpcc - C:\WINNT\System32\rpcc.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTSvcCDA.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Dantz - C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe


After the first system scan there was no "023 - Service:Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINNT|System32\msasvc.exe (file missing) so I could not check the box for it.

Also, I still couldn't delete the file C:\WINNT\System32\rpcc.ll because it still said it was being used by another program, so I found in HijackThis how to windows could delete a file on reboot so I selected that. So think it is actually gone.

As of now my computer seems to be running pretty good. I don't think there have been any popups yet.

Thank you
Post #9
Oh, nevermind, I still do have lots of pop-ups. Drivecleaner is the worst one. A window pops up that says there are tracks of adult sites on my computer and anybody can see it and then prompts me to download Drive Cleaner and even when I click cancel or the x close button, the downloading window pops up. Other than that my computer hasn't shut down or restarted on its own recently. Once Again, Thank you!
Post #10
* Download Combofix to your desktop.
Doubleclick combo.exe
Follow the prompts.
Don't click on the window while the fix is running, because that will cause your system to hang.

When finished, it should produce a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.
Post #11
Okay here they are:

Tessa - 06-11-18 12:00:49.72 Service Pack 1
ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Tessa\Desktop"

((((((((((((((((((((((((((((((((((((((((((( E-Give / Ssk's Log )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Documents and Settings\Tessa\Application Data\Dxccwrd.dll
C:\Documents and Settings\Tessa\Application Data\Dxcdmns.dll
C:\Documents and Settings\Tessa\Application Data\Dxcknwrd.dll
C:\Documents and Settings\Tessa\Application Data\Dxcuknwrd.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINNT\offun.exe
C:\WINNT\system32\aaa00000.sys
C:\WINNT\system32\winlog.exe
C:\Program Files\Common Files\mehe.html
C:\Program Files\outlook
C:\Program Files\Common Files\{5C280981-0367-1033-0510-020003270001}


((((((((((((((((((((((((((((((( Files Created from 2006-10-18 to 2006-11-18 ))))))))))))))))))))))))))))))))))


2006-11-18 00:16 29,696 –a—— C:\WINNT\system32\167982ld.exe
2006-11-17 21:53 29,696 –a—— C:\WINNT\system32\53432732ld.exe
2006-11-17 21:32 29,696 –a—— C:\WINNT\system32\32547982ld.exe
2006-11-17 21:12 29,696 –a—— C:\WINNT\system32\12298362ld.exe
2006-11-17 19:28 29,696 –a—— C:\WINNT\system32\28306052ld.exe
2006-11-17 19:08 29,696 –a—— C:\WINNT\system32\886072ld.exe
2006-11-17 18:41 4,096 -rah—– C:\WINNT\system32\syste.dll
2006-11-17 18:41 29,696 –a—— C:\WINNT\system32\41219972ld.exe
2006-11-17 18:41 10,609 -r-h—– C:\WINNT\system32\tmp_2k4.exe
2006-11-17 18:41 10,609 –a—— C:\WINNT\system32\412192ld.exe
2006-11-17 18:03 29,696 –a—— C:\WINNT\system32\3102792ld.exe
2006-11-17 10:24 29,696 –a—— C:\WINNT\system32\24545722ld.exe
2006-11-17 10:03 29,696 –a—— C:\WINNT\system32\3555922ld.exe
2006-11-17 09:43 29,696 –a—— C:\WINNT\system32\43131452ld.exe
2006-11-17 09:22 29,696 –a—— C:\WINNT\system32\2212222ld.exe
2006-11-17 07:21 29,696 –a—— C:\WINNT\system32\21201142ld.exe
2006-11-17 07:00 29,696 –a—— C:\WINNT\system32\0224152ld.exe
2006-11-17 06:39 29,696 –a—— C:\WINNT\system32\39361832ld.exe
2006-11-17 06:19 29,696 –a—— C:\WINNT\system32\1984282ld.exe
2006-11-17 05:58 29,696 –a—— C:\WINNT\system32\5841132ld.exe
2006-11-17 05:38 29,696 –a—— C:\WINNT\system32\38196372ld.exe
2006-11-17 05:17 29,696 –a—— C:\WINNT\system32\17448212ld.exe
2006-11-17 04:57 29,696 –a—— C:\WINNT\system32\5713132ld.exe
2006-11-17 01:01 29,696 –a—— C:\WINNT\system32\1107362ld.exe
2006-11-17 00:40 29,696 –a—— C:\WINNT\system32\40468662ld.exe
2006-11-17 00:19 29,696 –a—— C:\WINNT\system32\19482062ld.exe
2006-11-16 23:59 29,696 –a—— C:\WINNT\system32\59286322ld.exe
2006-11-16 23:38 29,696 –a—— C:\WINNT\system32\38348792ld.exe
2006-11-16 23:17 29,696 –a—— C:\WINNT\system32\17385532ld.exe
2006-11-16 22:56 29,696 –a—— C:\WINNT\system32\56492772ld.exe
2006-11-16 22:37 29,696 –a—— C:\WINNT\system32\37114812ld.exe
2006-11-16 22:17 29,696 –a—— C:\WINNT\system32\1715712ld.exe
2006-11-16 22:11 47,104 –a—— C:\ATF-Cleaner.exe
2006-11-16 22:05 29,696 –a—— C:\WINNT\system32\5494852ld.exe
2006-11-16 21:45 29,696 –a—— C:\WINNT\system32\4541852ld.exe
2006-11-16 21:22 29,696 –a—— C:\WINNT\system32\22231992ld.exe
2006-11-16 10:36 29,696 –a—— C:\WINNT\system32\36423522ld.exe
2006-11-16 10:15 29,696 –a—— C:\WINNT\system32\15458552ld.exe
2006-11-16 09:55 29,696 –a—— C:\WINNT\system32\54599532ld.exe
2006-11-16 03:46 29,696 –a—— C:\WINNT\system32\46505802ld.exe
2006-11-16 02:58 29,696 –a—— C:\WINNT\system32\58144492ld.exe
2006-11-16 02:43 98,008 –a—— C:\WINNT\system32\ipv6monl.dll
2006-11-16 02:37 29,696 –a—— C:\WINNT\system32\37133662ld.exe
2006-11-16 02:27 1,573 –a—— C:\x.exe
2006-11-15 23:43 29,696 –a—— C:\WINNT\system32\43524502ld.exe
2006-11-15 23:22 29,696 –a—— C:\WINNT\system32\22528182ld.exe
2006-11-15 23:01 29,696 –a—— C:\WINNT\system32\1493122ld.exe
2006-11-15 22:40 29,696 –a—— C:\WINNT\system32\4045242ld.exe
2006-11-15 22:18 29,696 –a—— C:\WINNT\system32\18337092ld.exe
2006-11-15 21:56 29,696 –a—— C:\WINNT\system32\56385582ld.exe
2006-11-15 21:53 29,696 –a—— C:\WINNT\system32\53532512ld.exe
2006-11-15 21:31 29,696 –a—— C:\WINNT\system32\31547052ld.exe
2006-11-15 21:26 991,232 –a—— C:\WINNT\system32\esent.dll
2006-11-15 17:19 29,696 –a—— C:\WINNT\system32\19346342ld.exe
2006-11-15 16:59 29,696 –a—— C:\WINNT\system32\5925132ld.exe
2006-11-15 14:31 29,696 –a—— C:\WINNT\system32\31252662ld.exe
2006-11-15 14:09 29,696 –a—— C:\WINNT\system32\922052ld.exe
2006-11-15 14:06 29,696 –a—— C:\WINNT\system32\6222652ld.exe
2006-11-15 14:03 29,696 –a—— C:\WINNT\system32\3577872ld.exe
2006-11-15 14:01 29,696 –a—— C:\WINNT\system32\1354432ld.exe
2006-11-15 13:59 29,696 –a—— C:\WINNT\system32\59306032ld.exe
2006-11-15 13:57 29,696 –a—— C:\WINNT\system32\57282472ld.exe
2006-11-15 13:54 29,696 –a—— C:\WINNT\system32\54536052ld.exe
2006-11-15 13:33 29,696 –a—— C:\WINNT\system32\33523612ld.exe
2006-11-14 21:38 98,304 –a—— C:\WINNT\system32\oleprn.dll
2006-11-14 21:38 94,208 –a—— C:\WINNT\system32\odbccp32.dll
2006-11-14 21:38 91,136 –a—— C:\WINNT\system32\rastls.dll
2006-11-14 21:38 9,216 –a—— C:\WINNT\system32\wuauserv.dll
2006-11-14 21:38 891,711 ——— C:\WINNT\system32\drivers\nv4_mini.sys
2006-11-14 21:38 88,064 –a—— C:\WINNT\system32\tscfgwmi.dll
2006-11-14 21:38 87,304 –a—— C:\WINNT\system32\rdpdd.dll
2006-11-14 21:38 86,528 –a—— C:\WINNT\system32\wlnotify.dll
2006-11-14 21:38 86,016 –a—— C:\WINNT\system32\xactsrv.dll
2006-11-14 21:38 82,944 –a—— C:\WINNT\system32\smlogsvc.exe
2006-11-14 21:38 82,944 –a—— C:\WINNT\system32\psbase.dll
2006-11-14 21:38 81,920 –a—— C:\WINNT\system32\trkwks.dll
2006-11-14 21:38 8,192 –a—— C:\WINNT\system32\scrnsave.scr
2006-11-14 21:38 77,824 –a—— C:\WINNT\system32\wmpstub.exe
2006-11-14 21:38 77,824 –a—— C:\WINNT\system32\wmpshell.dll
2006-11-14 21:38 75,912 –a—— C:\WINNT\system32\rdpwsx.dll
2006-11-14 21:38 74,240 –a—— C:\WINNT\system32\rtcshare.exe
2006-11-14 21:38 72,192 –a—— C:\WINNT\system32\telnet.exe
2006-11-14 21:38 71,168 –a—— C:\WINNT\system32\storprop.dll
2006-11-14 21:38 71,168 –a—— C:\WINNT\system32\sdbinst.exe
2006-11-14 21:38 686,080 –a—— C:\WINNT\system32\opengl32.dll
2006-11-14 21:38 667,648 –a—— C:\WINNT\system32\ss3dfo.scr
2006-11-14 21:38 66,560 –a—— C:\WINNT\system32\spoolss.dll
2006-11-14 21:38 66,048 –a—— C:\WINNT\system32\sigverif.exe
2006-11-14 21:38 638,976 –a—— C:\WINNT\system32\sstext3d.scr
2006-11-14 21:38 63,488 –a—— C:\WINNT\system32\srclient.dll
2006-11-14 21:38 62,976 –a—— C:\WINNT\system32\shgina.dll
2006-11-14 21:38 61,952 –a—— C:\WINNT\system32\sti.dll
2006-11-14 21:38 61,440 –a—— C:\WINNT\system32\odbccu32.dll
2006-11-14 21:38 61,440 –a—— C:\WINNT\system32\odbccr32.dll
2006-11-14 21:38 60,416 –a—— C:\WINNT\system32\wextract.exe
2006-11-14 21:38 60,416 –a—— C:\WINNT\system32\shimeng.dll
2006-11-14 21:38 6,144 –a—— C:\WINNT\system32\sensapi.dll
2006-11-14 21:38 58,880 –a—— C:\WINNT\system32\pautoenr.dll
2006-11-14 21:38 57,856 –a—— C:\WINNT\system32\raschap.dll
2006-11-14 21:38 569,344 –a—— C:\WINNT\system32\sspipes.scr
2006-11-14 21:38 56,832 –a—— C:\WINNT\system32\wzcdlg.dll
2006-11-14 21:38 56,320 –a—— C:\WINNT\system32\remotepg.dll
2006-11-14 21:38 548,864 –a—— C:\WINNT\system32\rtcdll.dll
2006-11-14 21:38 534,016 –a—— C:\WINNT\system32\spider.exe
2006-11-14 21:38 53,248 –a—— C:\WINNT\system32\packager.exe
2006-11-14 21:38 53,248 –a—— C:\WINNT\system32\odbcconf.exe
2006-11-14 21:38 52,224 –a—— C:\WINNT\system32\secur32.dll
2006-11-14 21:38 511,488 –a—— C:\WINNT\system32\qedit.dll
2006-11-14 21:38 51,200 –a—— C:\WINNT\system32\wmerrenu.dll
2006-11-14 21:38 5,504 ——— C:\WINNT\system32\drivers\smbali.sys
2006-11-14 21:38 48,640 –a—— C:\WINNT\system32\vdmredir.dll
2006-11-14 21:38 48,128 –a—— C:\WINNT\system32\winsta.dll
2006-11-14 21:38 48,128 –a—— C:\WINNT\system32\reg.exe
2006-11-14 21:38 479,261 –a—— C:\WINNT\system32\vbscript.dll
2006-11-14 21:38 47,616 –a—— C:\WINNT\system32\utilman.exe
2006-11-14 21:38 446,464 –a—— C:\WINNT\system32\wmvdmoe.dll
2006-11-14 21:38 442,398 –a—— C:\WINNT\system32\wmadmoe.dll
2006-11-14 21:38 44,032 –a—— C:\WINNT\system32\regapi.dll
2006-11-14 21:38 44,032 –a—— C:\WINNT\system32\rdpclip.exe
2006-11-14 21:38 43,008 –a—— C:\WINNT\system32\ssdpsrv.dll
2006-11-14 21:38 423,424 –a—— C:\WINNT\system32\riched20.dll
2006-11-14 21:38 420,864 –a—— C:\WINNT\system32\shimgvw.dll
2006-11-14 21:38 409,088 –a—— C:\WINNT\system32\vssapi.dll
2006-11-14 21:38 40,960 –a—— C:\WINNT\system32\tscupgrd.exe
2006-11-14 21:38 392,704 –a—— C:\WINNT\system32\ntmssvc.dll
2006-11-14 21:38 385,024 –a—— C:\WINNT\system32\sqlsrv32.dll
2006-11-14 21:38 384,000 –a—— C:\WINNT\system32\themeui.dll
2006-11-14 21:38 38,912 –a—— C:\WINNT\system32\wsnmp32.dll
2006-11-14 21:38 38,400 –a—— C:\WINNT\system32\ntmsapi.dll
2006-11-14 21:38 38,400 –a—— C:\WINNT\system32\ntlanman.dll
2006-11-14 21:38 364,544 –a—— C:\WINNT\system32\ssflwbox.scr
2006-11-14 21:38 36,352 –a—— C:\WINNT\system32\sens.dll
2006-11-14 21:38 357,376 –a—— C:\WINNT\system32\qdvd.dll
2006-11-14 21:38 34,304 –a—— C:\WINNT\system32\rcimlby.exe
2006-11-14 21:38 339,456 –a—— C:\WINNT\system32\usp10.dll
2006-11-14 21:38 334,848 –a—— C:\WINNT\system32\smlogcfg.dll
2006-11-14 21:38 33,280 –a—— C:\WINNT\system32\shmgrate.exe
2006-11-14 21:38 32,768 –a—— C:\WINNT\system32\odbcad32.exe
2006-11-14 21:38 32,256 –a—— C:\WINNT\system32\umandlg.dll
2006-11-14 21:38 316,416 –a—— C:\WINNT\system32\zipfldr.dll
2006-11-14 21:38 316,416 –a—— C:\WINNT\system32\wiaservc.dll
2006-11-14 21:38 311,327 –a—— C:\WINNT\system32\wmv8dmod.dll
2006-11-14 21:38 31,744 –a—— C:\WINNT\system32\pid.dll
2006-11-14 21:38 3,494,303 ——— C:\WINNT\system32\nv4_disp.dll
2006-11-14 21:38 3,338 –a—— C:\WINNT\system32\redir.exe
2006-11-14 21:38 297,984 –a—— C:\WINNT\system32\scesrv.dll
2006-11-14 21:38 296,448 –a—— C:\WINNT\system32\wmstream.dll
2006-11-14 21:38 294,912 –a—— C:\WINNT\system32\wmvdmod.dll
2006-11-14 21:38 274,432 –a—— C:\WINNT\system32\wmasf.dll
2006-11-14 21:38 27,136 –a—— C:\WINNT\system32\ssdpapi.dll
2006-11-14 21:38 266,752 –a—— C:\WINNT\winhlp32.exe
2006-11-14 21:38 264,704 –a—— C:\WINNT\system32\wzcsvc.dll
2006-11-14 21:38 258,048 –a—— C:\WINNT\system32\webcheck.dll
2006-11-14 21:38 254,976 –a—— C:\WINNT\system32\pdh.dll
2006-11-14 21:38 253,952 –a—— C:\WINNT\system32\wmpcd.dll
2006-11-14 21:38 253,952 –a—— C:\WINNT\system32\wmnetmgr.dll
2006-11-14 21:38 251,904 –a—— C:\WINNT\system32\strmdll.dll
2006-11-14 21:38 247,808 –a—— C:\WINNT\system32\wow32.dll
2006-11-14 21:38 24,576 –a—— C:\WINNT\system32\odbcbcp.dll
2006-11-14 21:38 24,064 –a—— C:\WINNT\system32\skeys.exe
2006-11-14 21:38 231,424 –a—— C:\WINNT\system32\upnpui.dll
2006-11-14 21:38 23,552 –a—— C:\WINNT\system32\wzcsapi.dll
2006-11-14 21:38 226,816 –a—— C:\WINNT\system32\srrstr.dll
2006-11-14 21:38 22,528 –a—— C:\WINNT\system32\slayerxp.dll
2006-11-14 21:38 22,528 –a—— C:\WINNT\system32\shfolder.dll
2006-11-14 21:38 22,016 –a—— C:\WINNT\system32\udhisapi.dll
2006-11-14 21:38 212,480 –a—— C:\WINNT\system32\osk.exe
2006-11-14 21:38 203,264 –a—— C:\WINNT\system32\uxtheme.dll
2006-11-14 21:38 200,704 –a—— C:\WINNT\system32\odbc32.dll
2006-11-14 21:38 200,192 –a—— C:\WINNT\system32\termsrv.dll
2006-11-14 21:38 20,992 –a—— C:\WINNT\system32\setup.exe
2006-11-14 21:38 193,536 –a—— C:\WINNT\system32\rasppp.dll
2006-11-14 21:38 19,456 –a—— C:\WINNT\system32\ssmarque.scr
2006-11-14 21:38 184,832 –a—— C:\WINNT\system32\qcap.dll
2006-11-14 21:38 184,320 –a—— C:\WINNT\system32\wmadmod.dll
2006-11-14 21:38 18,944 –a—— C:\WINNT\system32\ssbezier.scr
2006-11-14 21:38 174,592 –a—— C:\WINNT\system32\scecli.dll
2006-11-14 21:38 172,664 –a—— C:\WINNT\system32\xenroll.dll
2006-11-14 21:38 171,520 –a—— C:\WINNT\system32\winmm.dll
2006-11-14 21:38 171,008 –a—— C:\WINNT\system32\sccsccp.dll
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\wtsapi32.dll
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\ssmyst.scr
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\psapi.dll
2006-11-14 21:38 169,984 –a—— C:\WINNT\system32\sccbase.dll
2006-11-14 21:38 168,448 –a—— C:\WINNT\system32\wldap32.dll
2006-11-14 21:38 165,888 –a—— C:\WINNT\system32\ntmsdba.dll
2006-11-14 21:38 165,376 –a—— C:\WINNT\system32\w32time.dll
2006-11-14 21:38 165,376 –a—— C:\WINNT\system32\tapi32.dll
2006-11-14 21:38 164,864 –a—— C:\WINNT\system32\upnphost.dll
2006-11-14 21:38 16,896 –a—— C:\WINNT\system32\snmpapi.dll
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\watchdog.sys
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\ups.exe
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\ping.exe
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\odbc32gt.dll
2006-11-14 21:38 159,232 –a—— C:\WINNT\system32\schedsvc.dll
2006-11-14 21:38 158,720 –a—— C:\WINNT\system32\srsvc.dll
2006-11-14 21:38 147,456 –a—— C:\WINNT\system32\odbctrac.dll
2006-11-14 21:38 14,848 –a—— C:\WINNT\system32\rdpsnd.dll
2006-11-14 21:38 137,216 –a—— C:\WINNT\system32\ntshrui.dll
2006-11-14 21:38 135,680 –a—— C:\WINNT\system32\rdchost.dll
2006-11-14 21:38 134,144 –a—— C:\WINNT\regedit.exe
2006-11-14 21:38 133,632 –a—— C:\WINNT\system32\rsaenh.dll
2006-11-14 21:38 133,120 –a—— C:\WINNT\system32\sfc_os.dll
2006-11-14 21:38 130,560 –a—— C:\WINNT\system32\sti_ci.dll
2006-11-14 21:38 13,824 –a—— C:\WINNT\system32\rassapi.dll
2006-11-14 21:38 13,312 –a—— C:\WINNT\system32\ssstars.scr
2006-11-14 21:38 128,512 –a—— C:\WINNT\system32\taskmgr.exe
2006-11-14 21:38 124,928 –a—— C:\WINNT\system32\webvw.dll
2006-11-14 21:38 122,880 –a—— C:\WINNT\system32\odbcconf.dll
2006-11-14 21:38 120,320 –a—— C:\WINNT\system32\upnp.dll
2006-11-14 21:38 12,800 –a—— C:\WINNT\system32\runonce.exe
2006-11-14 21:38 12,288 –a—— C:\WINNT\system32\rdsaddin.exe
2006-11-14 21:38 12,288 –a—— C:\WINNT\system32\odbcp32r.dll
2006-11-14 21:38 119,808 –a—— C:\WINNT\system32\wiadss.dll
2006-11-14 21:38 118,784 –a—— C:\WINNT\system32\wmsdmoe.dll
2006-11-14 21:38 117,760 –a—— C:\WINNT\system32\stobject.dll
2006-11-14 21:38 112,128 –a—— C:\WINNT\system32\ntmarta.dll
2006-11-14 21:38 110,592 –a—— C:\WINNT\system32\wmsdmod.dll
2006-11-14 21:38 11,776 –a—— C:\WINNT\system32\sigtab.dll
2006-11-14 21:38 109,568 –a—— C:\WINNT\system32\offfilt.dll
2006-11-14 21:38 106,496 –a—— C:\WINNT\system32\url.dll
2006-11-14 21:38 10,752 –a—— C:\WINNT\system32\tracert.exe
2006-11-14 21:38 10,752 –a—— C:\WINNT\hh.exe
2006-11-14 21:38 1,998,848 –a—— C:\WINNT\system32\wmploc.dll
2006-11-14 21:38 1,350,144 –a—— C:\WINNT\system32\query.dll
2006-11-14 21:38 1,298,432 –a—— C:\WINNT\system32\wmpcore.dll
2006-11-14 21:38 1,220,608 –a—— C:\WINNT\system32\wmvcore.dll
2006-11-14 21:38 1,157,632 –a—— C:\WINNT\system32\sfcfiles.dll
2006-11-14 21:37 95,744 –a—— C:\WINNT\system32\nlhtml.dll
2006-11-14 21:37 921,475 ——— C:\WINNT\system32\ati3d2ag.dll
2006-11-14 21:37 91,136 –a—— C:\WINNT\system32\MSOERT2.DLL
2006-11-14 21:37 9,728 –a—— C:\WINNT\system32\mstinit.exe
2006-11-14 21:37 857,600 –a—— C:\WINNT\system32\netplwiz.dll
2006-11-14 21:37 844,675 ——— C:\WINNT\system32\ati3d1ag.dll
2006-11-14 21:37 699,392 –a—— C:\WINNT\system32\msxml2.dll
2006-11-14 21:37 68,608 –a—— C:\WINNT\system32\mscms.dll
2006-11-14 21:37 67,584 –a—— C:\WINNT\system32\msctfp.dll
2006-11-14 21:37 65,536 –a—— C:\WINNT\system32\msconf.dll
2006-11-14 21:37 63,663 –a—— C:\WINNT\system32\drivers\atinrvxx.sys
2006-11-14 21:37 6,912 ——— C:\WINNT\system32\drivers\hidir.sys
2006-11-14 21:37 6,656 –a—— C:\WINNT\system32\laprxy.dll
2006-11-14 21:37 598,016 –a—— C:\WINNT\system32\mstscax.dll
2006-11-14 21:37 584,192 –a—— C:\WINNT\system32\netcfgx.dll
2006-11-14 21:37 57,856 –a—— C:\WINNT\system32\licwmi.dll
2006-11-14 21:37 56,591 –a—— C:\WINNT\system32\drivers\atinbtxx.sys
2006-11-14 21:37 56,320 –a—— C:\WINNT\system32\mshtmler.dll
2006-11-14 21:37 552,991 –a—— C:\WINNT\system32\msrepl40.dll
2006-11-14 21:37 512,031 –a—— C:\WINNT\system32\msexch40.dll
2006-11-14 21:37 504,832 ——— C:\WINNT\system32\msftedit.dll
2006-11-14 21:37 504,320 –a—— C:\WINNT\system32\logonui.exe
2006-11-14 21:37 5,120 ——— C:\WINNT\system32\hccoin.dll
2006-11-14 21:37 49,152 –a—— C:\WINNT\system32\npptools.dll
2006-11-14 21:37 450,176 ——— C:\WINNT\system32\drivers\ati2mtag.sys
2006-11-14 21:37 421,919 –a—— C:\WINNT\system32\msrd2x40.dll
2006-11-14 21:37 42,496 –a—— C:\WINNT\system32\ncobjapi.dll
2006-11-14 21:37 403,456 ——— C:\WINNT\system32\winbrand.dll
2006-11-14 21:37 401,462 –a—— C:\WINNT\system32\msvcp60.dll
2006-11-14 21:37 4,608 –a—— C:\WINNT\system32\msimg32.dll
2006-11-14 21:37 4,126 –a—— C:\WINNT\system32\msdxmlc.dll
2006-11-14 21:37 399,360 –a—— C:\WINNT\system32\netlogon.dll
2006-11-14 21:37 39,424 –a—— C:\WINNT\system32\net.exe
2006-11-14 21:37 388,608 –a—— C:\WINNT\system32\mstsc.exe
2006-11-14 21:37 381,440 –a—— C:\WINNT\system32\lmrt.dll
2006-11-14 21:37 377,984 –a—— C:\WINNT\system32\ati2dvaa.dll
2006-11-14 21:37 368,710 –a—— C:\WINNT\system32\msisam11.dll
2006-11-14 21:37 36,463 –a—— C:\WINNT\system32\drivers\atintuxx.sys
2006-11-14 21:37 348,195 –a—— C:\WINNT\system32\msjetoledb40.dll
2006-11-14 21:37 348,191 –a—— C:\WINNT\system32\mspbde40.dll
2006-11-14 21:37 344,095 –a—— C:\WINNT\system32\msxbde40.dll
2006-11-14 21:37 34,735 –a—— C:\WINNT\system32\drivers\atinxsxx.sys
2006-11-14 21:37 339,968 –a—— C:\WINNT\system32\mspaint.exe
2006-11-14 21:37 33,808 –a—— C:\WINNT\system32\ntio.sys
2006-11-14 21:37 327,040 –a—— C:\WINNT\system32\drivers\ati2mtaa.sys
2006-11-14 21:37 326,656 –a—— C:\WINNT\system32\netsetup.exe
2006-11-14 21:37 323,072 –a—— C:\WINNT\system32\msvcrt.dll
2006-11-14 21:37 32,256 –a—— C:\WINNT\system32\mnmdd.dll
2006-11-14 21:37 319,760 –a—— C:\WINNT\system32\msnsspc.dll
2006-11-14 21:37 319,519 –a—— C:\WINNT\system32\msexcl40.dll
2006-11-14 21:37 30,671 –a—— C:\WINNT\system32\drivers\atinraxx.sys
2006-11-14 21:37 3,584 ——— C:\WINNT\system32\dsprpres.dll
2006-11-14 21:37 29,455 –a—— C:\WINNT\system32\drivers\atinxbxx.sys
2006-11-14 21:37 266,752 –a—— C:\WINNT\system32\msctf.dll
2006-11-14 21:37 26,367 –a—— C:\WINNT\system32\drivers\atinsnxx.sys
2006-11-14 21:37 253,983 –a—— C:\WINNT\system32\mstext40.dll
2006-11-14 21:37 250,368 –a—— C:\WINNT\system32\mstask.dll
2006-11-14 21:37 241,725 –a—— C:\WINNT\system32\msuni11.dll
2006-11-14 21:37 241,695 –a—— C:\WINNT\system32\msjtes40.dll
2006-11-14 21:37 24,576 –a—— C:\WINNT\system32\nmmkcert.dll
2006-11-14 21:37 24,576 –a—— C:\WINNT\system32\logagent.exe
2006-11-14 21:37 238,080 –a—— C:\WINNT\system32\newdev.dll
2006-11-14 21:37 233,472 –a—— C:\WINNT\system32\mpg4dmod.dll
2006-11-14 21:37 230,400 –a—— C:\WINNT\system32\msieftp.dll
2006-11-14 21:37 229,376 –a—— C:\WINNT\system32\MSOEACCT.DLL
2006-11-14 21:37 22,528 –a—— C:\WINNT\system32\mslbui.dll
2006-11-14 21:37 219,648 –a—— C:\WINNT\system32\logon.scr
2006-11-14 21:37 218,112 ——— C:\WINNT\system32\sbe.dll
2006-11-14 21:37 213,023 –a—— C:\WINNT\system32\msltus40.dll
2006-11-14 21:37 210,944 –a—— C:\WINNT\system32\moricons.dll
2006-11-14 21:37 21,343 ——— C:\WINNT\system32\drivers\atinttxx.sys
2006-11-14 21:37 202,496 ——— C:\WINNT\system32\ati2dvag.dll
2006-11-14 21:37 196,096 –a—— C:\WINNT\system32\mobsync.dll
2006-11-14 21:37 192,512 –a—— C:\WINNT\system32\mswebdvd.dll
2006-11-14 21:37 19,456 –a—— C:\WINNT\system32\licmgr10.dll
2006-11-14 21:37 19,328 ——— C:\WINNT\system32\drivers\usbehci.sys
2006-11-14 21:37 187,904 ——— C:\WINNT\system32\xpsp1res.dll
2006-11-14 21:37 182,784 –a—— C:\WINNT\system32\msutb.dll
2006-11-14 21:37 18,944 ——— C:\WINNT\system32\faxpatch.exe
2006-11-14 21:37 174,592 –a—— C:\WINNT\system32\msnetobj.dll
2006-11-14 21:37 172,032 ——— C:\WINNT\system32\mssap.dll
2006-11-14 21:37 163,840 –a—— C:\WINNT\system32\mindex.dll
2006-11-14 21:37 16,384 –a—— C:\WINNT\system32\nddenb32.dll
2006-11-14 21:37 155,648 ——— C:\WINNT\system32\encdec.dll
2006-11-14 21:37 143,872 –a—— C:\WINNT\system32\msimtf.dll
2006-11-14 21:37 131,072 –a—— C:\WINNT\system32\msorcl32.dll
2006-11-14 21:37 13,056 ——— C:\WINNT\system32\drivers\wacompen.sys
2006-11-14 21:37 126,976 –a—— C:\WINNT\system32\msdart.dll
2006-11-14 21:37 12,288 –a—— C:\WINNT\system32\mscpx32r.dll
2006-11-14 21:37 12,288 ——— C:\WINNT\system32\encapi.dll
2006-11-14 21:37 12,047 ——— C:\WINNT\system32\drivers\atinpdxx.sys
2006-11-14 21:37 116,736 –a—— C:\WINNT\system32\mplay32.exe
2006-11-14 21:37 115,200 –a—— C:\WINNT\system32\net1.exe
2006-11-14 21:37 113,664 –a—— C:\WINNT\system32\msvfw32.dll
2006-11-14 21:37 110,080 ——— C:\WINNT\system32\sbeio.dll
2006-11-14 21:37 11,904 ——— C:\WINNT\system32\drivers\mutohpen.sys
2006-11-14 21:37 11,615 –a—— C:\WINNT\system32\drivers\atinmdxx.sys
2006-11-14 21:37 105,984 –a—— C:\WINNT\system32\netdde.exe
2006-11-14 21:37 10,240 –a—— C:\WINNT\system32\msrle32.dll
2006-11-14 21:37 10,240 –a—— C:\WINNT\system32\localui.dll
2006-11-14 21:37 1,677,312 ——— C:\WINNT\system32\wmvcore2.dll
2006-11-14 21:37 1,622,528 –a—— C:\WINNT\system32\netshell.dll
2006-11-14 21:37 1,503,262 –a—— C:\WINNT\system32\msjet40.dll
2006-11-14 21:37 1,220,608 –a—— C:\WINNT\system32\msvidctl.dll
2006-11-14 21:37 1,128,960 –a—— C:\WINNT\system32\mmcndmgr.dll
2006-11-14 21:36 98,816 –a—— C:\WINNT\system32\clipbrd.exe
2006-11-14 21:36 94,720 –a—— C:\WINNT\system32\dmusic.dll
2006-11-14 21:36 91,648 –a—— C:\WINNT\system32\iuctl.dll
2006-11-14 21:36 9,216 –a—— C:\WINNT\system32\icaapi.dll
2006-11-14 21:36 9,216 –a—— C:\WINNT\system32\dumprep.exe
2006-11-14 21:36 88,576 –a—— C:\WINNT\system32\mqsec.dll
2006-11-14 21:36 802,304 –a—— C:\WINNT\system32\dxmrtp.dll
2006-11-14 21:36 8,832 –a—— C:\WINNT\system32\framebuf.dll
2006-11-14 21:36 786,432 –a—— C:\WINNT\system32\dxdiag.exe
2006-11-14 21:36 77,312 –a—— C:\WINNT\system32\dmscript.dll
2006-11-14 21:36 76,830 –a—— C:\WINNT\system32\drmstor.dll
2006-11-14 21:36 76,288 –a—— C:\WINNT\system32\dfrgfat.exe
2006-11-14 21:36 73,728 –a—— C:\WINNT\system32\tlntsess.exe
2006-11-14 21:36 73,728 –a—— C:\WINNT\system32\ils.dll
2006-11-14 21:36 70,656 –a—— C:\WINNT\system32\defrag.exe
2006-11-14 21:36 70,144 –a—— C:\WINNT\system32\cryptdlg.dll
2006-11-14 21:36 7,168 –a—— C:\WINNT\system32\tlntsvrp.dll
2006-11-14 21:36 7,168 –a—— C:\WINNT\system32\fxsperf.dll
2006-11-14 21:36 7,040 –a—— C:\WINNT\system32\kd1394.dll
2006-11-14 21:36 67,584 –a—— C:\WINNT\system32\tlntsvr.exe
2006-11-14 21:36 67,584 –a—— C:\WINNT\system32\fdeploy.dll
2006-11-14 21:36 67,456 –a—— C:\WINNT\system32\drivers\mqac.sys
2006-11-14 21:36 66,560 –a—— C:\WINNT\system32\faultrep.dll
2006-11-14 21:36 61,440 –a—— C:\WINNT\system32\dbnetlib.dll
2006-11-14 21:36 608,768 –a—— C:\WINNT\system32\mqqm.dll
2006-11-14 21:36 602,112 –a—— C:\WINNT\system32\drmv2clt.dll
2006-11-14 21:36 6,656 –a—— C:\WINNT\system32\fxsres.dll
2006-11-14 21:36 596,480 –a—— C:\WINNT\system32\INETCOMM.DLL
2006-11-14 21:36 59,392 –a—— C:\WINNT\system32\iesetup.dll
2006-11-14 21:36 58,368 –a—— C:\WINNT\system32\dpvsetup.exe
2006-11-14 21:36 57,856 –a—— C:\WINNT\system32\tlntadmn.exe
2006-11-14 21:36 57,856 –a—— C:\WINNT\system32\nwwks.dll
2006-11-14 21:36 57,344 –a—— C:\WINNT\system32\dmcompos.dll
2006-11-14 21:36 56,320 –a—— C:\WINNT\system32\dpnhupnp.dll
2006-11-14 21:36 559,616 –a—— C:\WINNT\system32\fxsst.dll
2006-11-14 21:36 55,296 –a—— C:\WINNT\system32\digest.dll
2006-11-14 21:36 545,792 –a—— C:\WINNT\system32\wsecedit.dll
2006-11-14 21:36 54,272 –a—— C:\WINNT\system32\clusapi.dll
2006-11-14 21:36 53,248 –a—— C:\WINNT\system32\cryptsvc.dll
2006-11-14 21:36 51,712 –a—— C:\WINNT\system32\ipconfig.exe
2006-11-14 21:36 498,205 –a—— C:\WINNT\system32\dxmasf.dll
2006-11-14 21:36 49,664 –a—— C:\WINNT\system32\ixsso.dll
2006-11-14 21:36 49,664 –a—— C:\WINNT\system32\dpwsockx.dll
2006-11-14 21:36 49,152 –a—— C:\WINNT\system32\eventlog.dll
2006-11-14 21:36 489,984 –a—— C:\WINNT\system32\dbghelp.dll
2006-11-14 21:36 478,720 –a—— C:\WINNT\system32\mqsnap.dll
2006-11-14 21:36 471,040 –a—— C:\WINNT\system32\cryptui.dll
2006-11-14 21:36 467,456 –a—— C:\WINNT\system32\mqutil.dll
2006-11-14 21:36 45,568 –a—— C:\WINNT\system32\docprop2.dll
2006-11-14 21:36 443,392 –a—— C:\WINNT\system32\fxsapi.dll
2006-11-14 21:36 435,200 –a—— C:\WINNT\system32\ipnathlp.dll
2006-11-14 21:36 42,537 –a—— C:\WINNT\system32\keyboard.sys
2006-11-14 21:36 41,472 –a—— C:\WINNT\system32\cmdl32.exe
2006-11-14 21:36 395,264 –a—— C:\WINNT\system32\fxsxp32.dll
2006-11-14 21:36 391,168 –a—— C:\WINNT\system32\fxstiff.dll
2006-11-14 21:36 380,445 –a—— C:\WINNT\system32\expsrv.dll
2006-11-14 21:36 38,912 –a—— C:\WINNT\system32\hhsetup.dll
2006-11-14 21:36 36,922 –a—— C:\WINNT\system32\imeshare.dll
2006-11-14 21:36 35,328 –a—— C:\WINNT\system32\dfrgsnap.dll
2006-11-14 21:36 324,608 –a—— C:\WINNT\system32\cmdial32.dll
2006-11-14 21:36 318,464 –a—— C:\WINNT\system32\ippromon.dll
2006-11-14 21:36 31,744 –a—— C:\WINNT\system32\dmloader.dll
2006-11-14 21:36 307,712 –a—— C:\WINNT\system32\cscui.dll
2006-11-14 21:36 30,208 –a—— C:\WINNT\system32\imgutil.dll
2006-11-14 21:36 294,912 –a—— C:\WINNT\system32\iedkcs32.dll
2006-11-14 21:36 29,696 –a—— C:\WINNT\system32\dpnhpast.dll
2006-11-14 21:36 29,696 ——— C:\WINNT\system32\asr_pfu.exe
2006-11-14 21:36 28,672 –a—— C:\WINNT\system32\ie4uinit.exe
2006-11-14 21:36 28,672 –a—— C:\WINNT\system32\dbnmpntw.dll
2006-11-14 21:36 28,160 –a—— C:\WINNT\system32\pidgen.dll
2006-11-14 21:36 277,504 –a—— C:\WINNT\system32\appmgr.dll
2006-11-14 21:36 271,360 –a—— C:\WINNT\system32\fxscomex.dll
2006-11-14 21:36 266,240 –a—— C:\WINNT\system32\drmclien.dll
2006-11-14 21:36 263,680 –a—— C:\WINNT\system32\duser.dll
2006-11-14 21:36 263,168 –a—— C:\WINNT\system32\devmgr.dll
2006-11-14 21:36 26,112 –a—— C:\WINNT\system32\dmband.dll
2006-11-14 21:36 253,440 –a—— C:\WINNT\system32\ddraw.dll
2006-11-14 21:36 250,368 –a—— C:\WINNT\system32\fxssvc.exe
2006-11-14 21:36 25,600 –a—— C:\WINNT\system32\dfsshlex.dll
2006-11-14 21:36 249,856 –a—— C:\WINNT\system32\adsiis.dll
2006-11-14 21:36 240,640 –a—— C:\WINNT\system32\hnetcfg.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\dbmsvinn.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\dbmsrpcn.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\conime.exe
2006-11-14 21:36 24,064 –a—— C:\WINNT\system32\fxsdrv.dll
2006-11-14 21:36 238,592 –a—— C:\WINNT\system32\compatui.dll
2006-11-14 21:36 237,056 –a—— C:\WINNT\system32\icm32.dll
2006-11-14 21:36 236,032 –a—— C:\WINNT\system32\fxst30.dll
2006-11-14 21:36 231,936 –a—— C:\WINNT\system32\tracerpt.exe
2006-11-14 21:36 227,840 –a—— C:\WINNT\system32\dsquery.dll
2006-11-14 21:36 216,064 –a—— C:\WINNT\system32\fxscover.exe
2006-11-14 21:36 206,336 –a—— C:\WINNT\system32\dpvoice.dll
2006-11-14 21:36 204,288 –a—— C:\WINNT\system32\ieaksie.dll
2006-11-14 21:36 20,992 –a—— C:\WINNT\system32\fxsext32.dll
2006-11-14 21:36 20,480 –a—— C:\WINNT\system32\dbmsadsn.dll
2006-11-14 21:36 19,456 –a—— C:\WINNT\system32\fontview.exe
2006-11-14 21:36 19,456 –a—— C:\WINNT\system32\ersvc.dll
2006-11-14 21:36 185,856 –a—— C:\WINNT\system32\fxswzrd.dll
2006-11-14 21:36 183,808 –a—— C:\WINNT\system32\gptext.dll
2006-11-14 21:36 180,224 –a—— C:\WINNT\system32\dwwin.exe
2006-11-14 21:36 178,688 –a—— C:\WINNT\system32\eudcedit.exe
2006-11-14 21:36 172,544 –a—— C:\WINNT\system32\dmime.dll
2006-11-14 21:36 17,792 ——— C:\WINNT\system32\drivers\irbus.sys
2006-11-14 21:36 168,960 –a—— C:\WINNT\system32\dinput8.dll
2006-11-14 21:36 165,888 –a—— C:\WINNT\system32\mqrt.dll
2006-11-14 21:36 165,376 –a—— C:\WINNT\system32\els.dll
2006-11-14 21:36 164,352 –a—— C:\WINNT\system32\mqtrig.dll
2006-11-14 21:36 16,384 –a—— C:\WINNT\system32\ds32gt.dll
2006-11-14 21:36 158,720 –a—— C:\WINNT\system32\credui.dll
2006-11-14 21:36 156,672 –a—— C:\WINNT\system32\dpnet.dll
2006-11-14 21:36 156,672 –a—— C:\WINNT\system32\appmgmts.dll
2006-11-14 21:36 156,544 –a—— C:\WINNT\system32\drivers\nwrdr.sys
2006-11-14 21:36 151,552 –a—— C:\WINNT\system32\dinput.dll
2006-11-14 21:36 149,504 –a—— C:\WINNT\system32\fxsui.dll
2006-11-14 21:36 143,872 –a—— C:\WINNT\system32\itircl.dll
2006-11-14 21:36 14,848 –a—— C:\WINNT\system32\mqise.dll
2006-11-14 21:36 135,680 –a—— C:\WINNT\system32\dsprop.dll
2006-11-14 21:36 130,048 –a—— C:\WINNT\system32\mqad.dll
2006-11-14 21:36 130,048 –a—— C:\WINNT\system32\fxsclnt.exe
2006-11-14 21:36 13,312 –a—— C:\WINNT\system32\ctfmon.exe
2006-11-14 21:36 128,000 –a—— C:\WINNT\system32\itss.dll
2006-11-14 21:36 126,976 –a—— C:\WINNT\system32\ieakeng.dll
2006-11-14 21:36 124,928 –a—— C:\WINNT\system32\dssenh.dll
2006-11-14 21:36 123,904 –a—— C:\WINNT\system32\imapi.exe
2006-11-14 21:36 115,200 –a—— C:\WINNT\system32\dpcdll.dll
2006-11-14 21:36 114,176 –a—— C:\WINNT\system32\input.dll
2006-11-14 21:36 113,664 –a—— C:\WINNT\system32\schtasks.exe
2006-11-14 21:36 113,152 –a—— C:\WINNT\system32\idq.dll
2006-11-14 21:36 113,152 –a—— C:\WINNT\system32\gpresult.exe
2006-11-14 21:36 113,152 –a—— C:\WINNT\system32\dfrgui.dll
2006-11-14 21:36 110,080 –a—— C:\WINNT\system32\dmstyle.dll
2006-11-14 21:36 103,936 –a—— C:\WINNT\system32\rsnotify.exe
2006-11-14 21:36 103,936 –a—— C:\WINNT\system32\imm32.dll
2006-11-14 21:36 103,424 –a—— C:\WINNT\system32\dgnet.dll
2006-11-14 21:36 10,752 ——— C:\WINNT\system32\spiisupd.exe
2006-11-14 21:36 1,180,672 –a—— C:\WINNT\system32\d3d8.dll
2006-11-14 21:36 1,004,032 –a—— C:\WINNT\explorer.exe
2006-11-14 21:35 91,648 –a—— C:\WINNT\system32\ahui.exe
2006-11-14 21:35 91,136 –a—— C:\WINNT\system32\advpack.dll
2006-11-14 21:35 8,192 –a—— C:\WINNT\system32\autolfn.exe
2006-11-14 21:35 76,288 –a—— C:\WINNT\system32\avifil32.dll
2006-11-14 21:35 74,810 –a—— C:\WINNT\system32\atl.dll
2006-11-14 21:35 71,680 –a—— C:\WINNT\system32\browsewm.dll
2006-11-14 21:35 64,512 –a—— C:\WINNT\system32\ciodm.dll
2006-11-14 21:35 62,976 –a—— C:\WINNT\system32\browselc.dll
2006-11-14 21:35 62,464 –a—— C:\WINNT\system32\adsmsext.dll
2006-11-14 21:35 6,656 –a—— C:\WINNT\system32\batt.dll
2006-11-14 21:35 59,904 –a—— C:\WINNT\system32\cabinet.dll
2006-11-14 21:35 5,120 –a—— C:\WINNT\system32\asferror.dll
2006-11-14 21:35 49,152 –a—— C:\WINNT\system32\browser.dll
2006-11-14 21:35 41,984 –a—— C:\WINNT\system32\alg.exe
2006-11-14 21:35 38,912 –a—— C:\WINNT\system32\audiosrv.dll
2006-11-14 21:35 32,768 –a—— C:\WINNT\system32\cfgbkend.dll
2006-11-14 21:35 32,512 ——— C:\WINNT\system32\drivers\amdk7.sys
2006-11-14 21:35 239,616 –a—— C:\WINNT\system32\adsnt.dll
2006-11-14 21:35 22,528 –a—— C:\WINNT\system32\at.exe
2006-11-14 21:35 186,880 –a—— C:\WINNT\system32\certcli.dll
2006-11-14 21:35 162,816 –a—— C:\WINNT\system32\adsldp.dll
2006-11-14 21:35 14,366 –a—— C:\WINNT\system32\asfsipc.dll
2006-11-14 21:35 139,776 –a—— C:\WINNT\system32\adsldpc.dll
2006-11-14 21:35 115,712 –a—— C:\WINNT\system32\apphelp.dll
2006-11-14 21:20 10,509 -r-h—– C:\WINNT\system32\svchpm5.exe
2006-11-14 20:57 29,696 –a—— C:\WINNT\system32\57484702ld.exe
2006-11-14 20:36 29,696 –a—— C:\WINNT\system32\36532452ld.exe
2006-11-14 20:30 29,696 –a—— C:\WINNT\system32\30377002ld.exe
2006-11-14 20:19 593,408 –a—— C:\WINNT\system32\h323msp.dll
2006-11-14 20:15 97,280 –a—— C:\WINNT\system32\txflog.dll
2006-11-14 20:10 29,696 –a—— C:\WINNT\system32\10107562ld.exe
2006-11-14 19:49 29,696 –a—— C:\WINNT\system32\49432912ld.exe
2006-11-14 19:29 29,696 –a—— C:\WINNT\system32\2985352ld.exe
2006-11-14 19:08 29,696 –a—— C:\WINNT\system32\8135512ld.exe
2006-11-14 18:57 29,696 –a—— C:\WINNT\system32\57185702ld.exe
2006-11-14 18:51 127,208 –a—— C:\WINNT\system32\mucltui.dll
2006-11-14 18:36 29,696 –a—— C:\WINNT\system32\3652772ld.exe
2006-11-14 00:46 29,184 –a—— C:\WINNT\system32\46155532ld.exe
2006-11-14 00:26 29,184 –a—— C:\WINNT\system32\26121122ld.exe
2006-11-13 23:39 29,184 –a—— C:\WINNT\system32\3913322ld.exe
2006-11-13 23:19 29,184 –a—— C:\WINNT\system32\1979192ld.exe
2006-11-13 22:59 29,184 –a—— C:\WINNT\system32\5925362ld.exe
2006-11-13 22:38 29,184 –a—— C:\WINNT\system32\38589652ld.exe
2006-11-13 22:18 29,184 –a—— C:\WINNT\system32\18547532ld.exe
2006-11-13 21:37 29,184 –a—— C:\WINNT\system32\37469462ld.exe
2006-11-13 21:17 29,184 –a—— C:\WINNT\system32\17427042ld.exe
2006-11-13 20:57 29,184 –a—— C:\WINNT\system32\57379322ld.exe
2006-11-13 20:37 29,184 –a—— C:\WINNT\system32\3733802ld.exe
2006-11-13 20:17 29,184 –a—— C:\WINNT\system32\17205362ld.exe
2006-11-13 17:46 29,184 –a—— C:\WINNT\system32\4608942ld.exe
2006-11-13 17:29 29,184 –a—— C:\WINNT\system32\293082ld.exe
2006-11-13 17:09 29,184 –a—— C:\WINNT\system32\9255262ld.exe
2006-11-13 16:49 29,184 –a—— C:\WINNT\system32\49224962ld.exe
2006-11-13 12:52 29,184 –a—— C:\WINNT\system32\52105722ld.exe
2006-11-13 12:32 29,184 –a—— C:\WINNT\system32\3272312ld.exe
2006-11-13 12:12 29,184 –a—— C:\WINNT\system32\1235402ld.exe
2006-11-13 09:34 29,184 –a—— C:\WINNT\system32\3434132ld.exe
2006-11-12 01:43 1,465 –a—— C:\dacmi.exe
2006-11-12 01:42 29,184 –a—— C:\rttdkor.exe
2006-11-12 00:58 2,585,872 –a—— C:\WindowsInstaller-KB893803-v2-x86.exe
2006-11-12 00:54 9,692,736 –a—— C:\nmsetup.exe
2006-11-09 02:27 51,072 –a—— C:\WINNT\system32\drivers\ikhlayer.sys
2006-11-09 02:27 30,592 –a—— C:\WINNT\system32\drivers\ikhfile.sys
2006-11-09 02:24 8,598,632 –a—— C:\WINNT\sdsetup.exe
2006-11-09 02:19 217,346 –a—— C:\WINNT\srvpkqyzuv.exe
2006-11-09 02:18 217,346 –a—— C:\WINNT\srvfqlngwz.exe
2006-11-09 01:45 217,346 –a—— C:\WINNT\srvuujgzkc.exe
2006-11-09 01:45 217,346 –a—— C:\WINNT\srvkawvgnf.exe
2006-11-09 01:45 217,346 –a—— C:\WINNT\srveoorsiy.exe
2006-11-09 01:44 217,346 –a—— C:\WINNT\srvdrlpgpt.exe
2006-11-09 01:43 217,346 –a—— C:\WINNT\srvmkmfnjh.exe
2006-11-08 22:22 23,400,303 —hs—- C:\WINNT\scvhost.exe
2006-11-08 21:42 7,168 –a—— C:\WINNT\system32\wamregps.dll
2006-11-08 21:42 60,416 –a—— C:\WINNT\system32\iismap.dll
2006-11-08 21:42 59,392 –a—— C:\WINNT\system32\iisext.dll
2006-11-08 21:42 34,816 –a—— C:\WINNT\system32\admwprox.dll
2006-11-08 21:42 3,584 –a—— C:\WINNT\system32\iismui.dll
2006-11-08 21:42 19,968 –a—— C:\WINNT\system32\inetsloc.dll
2006-11-08 21:42 13,312 –a—— C:\WINNT\system32\exstrace.dll
2006-11-08 21:42 120,832 –a—— C:\WINNT\system32\iisRtl.dll
2006-11-08 21:42 11,776 –a—— C:\WINNT\system32\infoadmn.dll
2006-11-08 21:22 24,661 –a—— C:\WINNT\system32\spxcoins.dll
2006-11-08 21:22 13,312 –a—— C:\WINNT\system32\irclass.dll
2006-11-08 20:33 124,184 –a—— C:\WINNT\system32\wuauclt.exe
2006-11-08 20:33 1,343,768 –a—— C:\WINNT\system32\wuaueng.dll
2006-11-06 01:45 53,120 –a—— C:\WINNT\srvokpdwtb.exe
2006-11-06 01:45 183,476 –a—— C:\WINNT\srvsujihlu.exe
2006-11-06 01:31 217,346 –a—— C:\WINNT\srvcnuvupj.exe
2006-11-03 04:18 1,685 –a—— C:\WINNT\28312045.exe
2006-11-03 03:19 499,200 –a—— C:\WINNT\system32\comuid.dll
2006-11-03 03:19 150,528 –a—— C:\WINNT\system32\msdtcuiu.dll
2006-11-03 03:18 974,336 –a—— C:\WINNT\system32\msdtctm.dll
2006-11-03 03:18 368,640 –a—— C:\WINNT\system32\msdtcprx.dll
2006-11-03 03:18 110,080 –a—— C:\WINNT\system32\clbcatex.dll
2006-11-02 23:35 8,464 –a—— C:\WINNT\system32\sporder.dll
2006-11-02 23:35 6,687 –a—— C:\WINNT\system32\ldcore.dll
2006-11-02 23:35 217,346 –a—— C:\WINNT\srvjhmodwy.exe
2006-11-02 01:51 7,680 ——— C:\WINNT\system32\bitsprx2.dll
2006-11-02 01:51 7,168 ——— C:\WINNT\system32\bitsprx3.dll
2006-11-02 01:51 17,408 –a—— C:\WINNT\system32\qmgrprxy.dll
2006-11-02 01:50 331,776 –a—— C:\WINNT\system32\winhttp.dll
2006-11-02 01:37 d——– C:\WINNT\McAfee.com
2006-11-01 13:37 277,505 –a—— C:\WINNT\system32\durvil1.exe
2006-11-01 13:37 17,920 –a—— C:\WINNT\system32\tcpip.exe
2006-11-01 13:37 151,040 –a—— C:\WINNT\system32\durvil1.dll
2006-11-01 13:37 1,259 –a—— C:\WINNT\system32\yum96b4e.sys
2006-11-01 13:36 2,560 –a—— C:\WINNT\ac3_0008.exe
2006-11-01 13:35 28,672 –a—— C:\WINNT\system32\pgbr3p.exe


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

Rootkit driver pe386 is present. A rootkit scan is required

2006-11-18 12:14 ——– d-a—— C:\Program Files\Common Files
2006-11-18 12:12 ——– d——– C:\Documents and Settings\Tessa\Application Data\Azureus
2006-11-17 20:50 9898 –a—— C:\Program Files\BBToolBar2.INI
2006-11-17 20:50 96 –a—— C:\Program Files\Default7BBC
2006-11-17 20:50 768 –a—— C:\Program Files\MySetup.DK
2006-11-17 20:50 46823 –a—— C:\Program Files\intrface.bbw
2006-11-17 20:50 3200 –a—— C:\Program Files\DEFAULT.ALI
2006-11-17 09:05 ——– d——– C:\Program Files\Messenger
2006-11-16 04:45 ——– d——– C:\Program Files\TrojanHunter 4.2
2006-11-16 04:07 ——– d-a—— C:\Program Files\Windows Media Player
2006-11-16 03:24 ——– d-a—— C:\Program Files\Outlook Express
2006-11-16 03:24 ——– d-a—— C:\Program Files\Common Files\System
2006-11-14 21:58 ——– d-a—— C:\Program Files\Internet Explorer
2006-11-14 21:48 ——– d-a—— C:\Program Files\NetMeeting
2006-11-14 21:48 ——– d——– C:\Program Files\Movie Maker
2006-11-14 18:50 ——– d-ah—– C:\Program Files\WindowsUpdate
2006-11-13 22:17 ——– d——– C:\Program Files\Google
2006-11-13 09:26 ——– d——– C:\Program Files\DriveCleaner 2006 Free
2006-11-11 22:48 ——– d——– C:\Documents and Settings\Tessa\Application Data\DriveCleaner 2006 Free
2006-11-11 22:30 ——– d——– C:\Program Files\Common Files\DriveCleaner 2006 Free
2006-11-09 04:31 ——– d—s—- C:\Documents and Settings\Tessa\Application Data\Microsoft
2006-11-09 04:28 ——– d——– C:\Program Files\SpywareBlaster
2006-11-09 04:19 ——– d——– C:\Program Files\Spyware Doctor
2006-11-09 02:43 ——– d——– C:\Documents and Settings\Tessa\Application Data\Google
2006-11-09 02:27 ——– d——– C:\Documents and Settings\Tessa\Application Data\PC Tools
2006-11-09 02:09 ——– d-a—— C:\Program Files\Common Files\Services
2006-11-09 01:43 ——– d–h—– C:\Program Files\BHO Plugin
2006-11-07 20:24 ——– d——– C:\Program Files\Dantz
2006-11-07 20:21 ——– d-a—— C:\Program Files\Common Files\InstallShield
2006-11-06 01:45 ——– d——– C:\Program Files\PSDream
2006-11-06 01:15 ——– d——– C:\Documents and Settings\Tessa\Application Data\MSN6
2006-11-06 01:13 48128 –ahs—- C:\Program Files\Thumbs.db
2006-11-05 23:43 ——– d——– C:\Program Files\WinRAR
2006-11-04 19:49 40 –a—— C:\Program Files\Tuner.cfg
2006-11-03 00:21 ——– d——– C:\Program Files\Creative
2006-11-02 23:12 ——– d——– C:\Program Files\Azureus
2006-11-02 01:16 ——– d——– C:\Program Files\Lavasoft
2006-11-02 01:16 ——– d——– C:\Documents and Settings\Tessa\Application Data\Lavasoft
2006-11-02 00:50 ——– d——– C:\Program Files\Common Files\iS3
2006-11-01 23:20 ——– d-a—— C:\Program Files\Accessories
2006-11-01 21:52 ——– d-a—— C:\Program Files\Common Files\Symantec Shared
2006-11-01 21:41 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-10-29 19:00 ——– d——– C:\Program Files\Sonic Foundry ACID Music
2006-10-28 15:37 ——– d——– C:\Program Files\QuickTime
2006-10-26 23:52 ——– d——– C:\Documents and Settings\Tessa\Application Data\Apple Computer
2006-10-13 23:07 ——– d——– C:\Documents and Settings\Tessa\Application Data\eFax Messenger
2006-10-11 08:18 ——– d——– C:\Program Files\Yahoo!
2006-10-07 15:20 192 –a—— C:\Program Files\$MIDIMON.cfg
2006-10-03 23:35 ——– d——– C:\Program Files\Citrix
2006-10-03 23:35 ——– d——– C:\Documents and Settings\Tessa\Application Data\ICAClient
2006-09-27 15:53 ——– d——– C:\Documents and Settings\Tessa\Application Data\Yahoo!
2006-09-27 07:36 ——– d——– C:\Documents and Settings\Tessa\Application Data\Image Zone Express
2006-09-27 07:35 ——– d——– C:\Program Files\DebugMode
2006-09-27 07:24 ——– d-a—— C:\Program Files\Adobe
2006-09-27 07:24 ——– d——– C:\Program Files\Sonic Foundry
2006-09-27 07:24 ——– d——– C:\Program Files\Pure Motion
2006-09-12 23:09 1110528 –a—— C:\WINNT\system32\msxml3.dll
2006-08-26 16:48 91098 –ah-c— C:\Program Files\bbw.GID
2006-08-26 13:31 16784 —–c— C:\Documents and Settings\Tessa\Application Data\GDIPFONTCACHEV1.DAT
2006-08-25 09:53 561664 –a—— C:\WINNT\system32\comctl32.dll
2006-08-25 03:14 595968 –a—— C:\WINNT\system32\xpsp2res.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
"MSMSGS"="\"C:\\Program Files\\Messenger\\MSMSGS.EXE\" /background"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Synchronization Manager"="mobsync.exe /logon"
"AtiPTA"="atiptaxx.exe"
"POINTER"="point32.exe"
"NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe"
"Zone Labs Client"="C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"THGuard"="\"C:\\Program Files\\TrojanHunter 4.2\\THGuard.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
"Windows Update"="C:\\WINNT\\scvhost.exe"
"msconfig"="C:\\WINNT\\scvhost.exe"
"icq lite"="C:\\WINNT\\scvhost.exe"
"Update Checker"="C:\\WINNT\\scvhost.exe"
"AntiVir"="C:\\WINNT\\scvhost.exe"
@="C:\\WINNT\\scvhost.exe"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00000000
"Position"=hex:2c,00,00,00,00,00,00,00,01,00,00,00,dc,00,00,00,d0,00,00,00,e8,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=dword:00000001
"OriginalStateInfo"=hex:18,00,00,00,00,00,00,00,00,00,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,01,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,01,00,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
"Source"="C:\\Program Files\\Common Files\\mehe.html"
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00002000
"Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState"=dword:40000001
"OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
00,00,01,00,00,00
"RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Htal"="\"C:\\WINNT\\system32\\config\\SYSTEM~1\\MYDOCU~1\\ASKS~1\\msiexec.exe\" -vt yazb"
"PSDream"="\"C:\\Program Files\\PSDream\\PSDream.exe\""
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"Htal"="\"C:\\WINNT\\system32\\config\\SYSTEM~1\\MYDOCU~1\\ASKS~1\\msiexec.exe\" -vt yazb"
"PSDream"="\"C:\\Program Files\\PSDream\\PSDream.exe\""
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000000

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000000

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rpcc

[HKEY_LOCAL_MACHINE\system�
Post #12

Rootkit driver pe386 is present. A rootkit scan is required

You have a very serious infection. I can not promise to be able to totally clean your PC. Do Not use this PC for any financial use. If you have used the PC for financial use since you were infected I suggest you contact the financial institutations and let them know your accounts might have been compromised.
You may wish to reformat and start over. I can try to clean it if you wish to go that route. Let me know.
Post #13
The only thing that I did that might be considered financial is order something from Amazon.com, but my credit card number was already in the system so I didn't need to type it or anything. Is that okay? What will reformatting entail? What do you suggest? Would it be better to take it in somewhere, or is this something that we can take care of? Thank you
Post #14
If you reformat, everything will be gone. You'll need to reinstall Windows and all programs. We can give it a go if you have the time. This will take awhile to clean over the next couple days.
Post #15
I guess if there is nothing else I can do, we will reformat. May God help any spyware-makers I meet in the future. So I suppose the next step would be to back-up my computer?? How do I save everything without also saving the spyware? I do have an external hard-drive where I can save my stuff, I really have no other way to store all that information. Unless you know of something that would be easier. Let me know what I need to do next. THank you

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI