What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] A veritable cocktail of problems

23 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Good morning sir

The restore points are normal. We leave those to the end, as it is better to have an infected restore point than none at all should the worst happen.

As you have found out, in the Virtual World, you rarely get something for nothing, especially from those sites. We rarely help those who a regulars there, as they just keep coming back.

I would need to see the log the Kaspersky scan produced, so I can identify files that need to go.

As new files are being created, I want a deeper look.

BLACKLIGHT
  • Please download F-Secure Blacklight (fsbl.exe) from here
  • Save into C:\ with a name of fsbl.exe
  • Go to Start > Run
  • Copy and paste the contents of the below codebox into the run box 
    C:\fsbl.exe /expert
  • Click OK
  • This will launch BlackLight
  • Select I accept the agreement
  • Click Next
  • Click Scan
  • Wait for the scan to finish
  • Click on Next>
  • Click Exit
  • A logfile will have been created in the C:\ drive
  • It will be named fsbl-xxxxxxxxxxxxxx.log where xxxxxxxxxxxxxx is the date and time of the scan
  • Use notepad to open that log
  • Post the contents of that log as a reply to this topic together with a new HijackThis log.
Post #17
G'day Scotty, I'm now scanning with Blacklight. Do you really want me to try to paste 5500 lines of text into this thread (the Kapersky results)?
Post #18
09/26/07 18:47:55 [Info]: BlackLight Engine 1.0.64 initialized
09/26/07 18:47:55 [Info]: OS: 5.1 build 2600 (Service Pack 2)
09/26/07 18:47:56 [Note]: 7019 4
09/26/07 18:47:56 [Note]: 7005 0
09/26/07 18:47:58 [Note]: 7006 0
09/26/07 18:47:58 [Note]: 7022 0
09/26/07 18:47:58 [Note]: 7011 648
09/26/07 18:47:58 [Note]: 7026 0
09/26/07 18:47:58 [Note]: 7026 0
09/26/07 18:48:01 [Note]: FSRAW library version 1.7.1022
09/26/07 19:06:23 [Note]: 2000 1012
09/26/07 19:06:23 [Note]: 2000 1012
09/26/07 19:15:37 [Note]: 7007 0


Logfile of HijackThis v1.99.1
Scan saved at 7:18:09 PM, on 9/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\PowerDVD\DVDLauncher.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ICQ6\ICQ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\SNDVOL32.EXE
C:\WINDOWS\system32\imapi.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
O2 - BHO: Editor plugin - {DC1CCBD3-F6B7-458f-8412-3687E06FB393} - netmonit.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpeedswitchXP] C:\Program Files\SpeedswitchXP\SpeedswitchXP.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: 1.exe
O4 - Global Startup: 2.exe~
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Tristan\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Tristan\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Program Files\PartyGaming\PartyGammon\RunBackGammon.exe
O9 - Extra 'Tools' menuitem: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Program Files\PartyGaming\PartyGammon\RunBackGammon.exe
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A16BB4EC-0357-4A91-83F7-3418EE3A6D2F}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB1046F5-2CFC-498B-8E58-9C657F86AA1A}: NameServer = 192.168.1.254
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleDesktopManager - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc32.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe (file missing)
Post #19
Hello

Hmm, maybe not. Let's clean it up a bit first.

Open Notepad and Copy/Paste the text in the codebox below into it: 

File::
C:\nawf.exe
C:\uhded.exe
C:\WINDOWS\system32\netmonit.dll
C:\pqukg.exe
C:\rvdc.exe
C:\WINDOWS\1.exe
C:\WINDOWS\2.exe

Folder::
C:\WINDOWS\system32\okqipwgf
C:\Documents and Settings\Incomplete\COMHH4HAAZTWLOBUDSRG57NPCL4SXX2S

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DC1CCBD3-F6B7-458f-8412-3687E06FB393}]

Save this as "CFScript"

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - Global Startup: 1.exe
O4 - Global Startup: 2.exe


WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit HijackThis.

Reboot the computer.

SAS Free

Install it and double-click the icon on your desktop to run it.
· It will ask if you want to update the program definitions, click Yes.
· Under Configuration and Preferences, click the Preferences button.
· Click the Scanning Control tab.
· Under Scanner Options make sure the following are checked:
  • Close browsers before scanning
  • Scan for tracking cookies
  • Terminate memory threats before quarantining.
  • Please leave the others unchecked.
  • Click the Close button to leave the control center screen.
· On the main screen, under Scan for Harmful Software click Scan your computer.
· On the left check C:\Fixed Drive.
· On the right, under Complete Scan, choose Perform Complete Scan.
· Click Next to start the scan. Please be patient while it scans your computer.
· After the scan is complete a summary box will appear. Click OK.
· Make sure everything in the white box has a check next to it, then click Next.
· It will quarantine what it found and if it asks if you want to reboot, click Yes.
· To retrieve the removal information for me please do the following:
  • After reboot, double-click the SUPERAntispyware icon on your desktop.
  • Click Preferences. Click the Statistics/Logs tab.
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
  • It will open in your default text editor (such as Notepad/Wordpad).
  • Please highlight everything in the notepad, then right-click and choose copy.
· Click close and close again to exit the program.
· Please paste that information here for me with a new HijackThis log and the new Combofix log.
Post #20
Hi Scotty, should I have had only 3 things ticked for my SAS scan? I couldn't work out whether I was supposed to leave pre-ticked things ticked or not.

ComboFix 07-09-26 - Tristan 2007-09-26 20:35:04.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.462 [GMT 10:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Tristan\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\nawf.exe
C:\uhded.exe
C:\WINDOWS\system32\netmonit.dll
C:\pqukg.exe
C:\rvdc.exe
C:\WINDOWS\1.exe
C:\WINDOWS\2.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Incomplete\COMHH4HAAZTWLOBUDSRG57NPCL4SXX2S
C:\Documents and Settings\Incomplete\COMHH4HAAZTWLOBUDSRG57NPCL4SXX2S\.datFallout.Movie
C:\Documents and Settings\Incomplete\COMHH4HAAZTWLOBUDSRG57NPCL4SXX2S\Fallout.Movie\More e3 Downloads!.url
C:\Documents and Settings\Incomplete\COMHH4HAAZTWLOBUDSRG57NPCL4SXX2S\Fallout.Movie\Fallout.Movie.wmv
C:\nawf.exe
C:\pqukg.exe
C:\rvdc.exe
C:\uhded.exe
C:\WINDOWS\system32\netmonit.dll
C:\WINDOWS\system32\okqipwgf
C:\WINDOWS\system32\okqipwgf\bg1.gif
C:\WINDOWS\system32\okqipwgf\bgtop.gif
C:\WINDOWS\system32\okqipwgf\bottom1.gif
C:\WINDOWS\system32\okqipwgf\essentials.gif
C:\WINDOWS\system32\okqipwgf\icon1.ico
C:\WINDOWS\system32\okqipwgf\install1.gif
C:\WINDOWS\system32\okqipwgf\left1.gif
C:\WINDOWS\system32\okqipwgf\li.gif
C:\WINDOWS\system32\okqipwgf\logo.gif
C:\WINDOWS\system32\okqipwgf\main.htm
C:\WINDOWS\system32\okqipwgf\mainframe.htm
C:\WINDOWS\system32\okqipwgf\reinstall1.gif
C:\WINDOWS\system32\okqipwgf\right1.gif
C:\WINDOWS\system32\okqipwgf\s1.htm
C:\WINDOWS\system32\okqipwgf\s2.htm
C:\WINDOWS\system32\okqipwgf\s3.htm
C:\WINDOWS\system32\okqipwgf\SMTop1.gif
C:\WINDOWS\system32\okqipwgf\SMTop2.gif
C:\WINDOWS\system32\okqipwgf\SMTop3.gif
C:\WINDOWS\system32\okqipwgf\SMTop4.gif
C:\WINDOWS\system32\okqipwgf\soft1_off.gif
C:\WINDOWS\system32\okqipwgf\soft1_off_ext.gif
C:\WINDOWS\system32\okqipwgf\soft1_on.gif
C:\WINDOWS\system32\okqipwgf\soft1_on_ext.gif
C:\WINDOWS\system32\okqipwgf\soft2_off.gif
C:\WINDOWS\system32\okqipwgf\soft2_off_ext.gif
C:\WINDOWS\system32\okqipwgf\soft2_on.gif
C:\WINDOWS\system32\okqipwgf\soft2_on_ext.gif
C:\WINDOWS\system32\okqipwgf\soft3_off.gif
C:\WINDOWS\system32\okqipwgf\soft3_off_ext.gif
C:\WINDOWS\system32\okqipwgf\soft3_on.gif
C:\WINDOWS\system32\okqipwgf\soft3_on_ext.gif
C:\WINDOWS\system32\okqipwgf\softbottom_off.gif
C:\WINDOWS\system32\okqipwgf\softbottom_on.gif
C:\WINDOWS\system32\okqipwgf\softleft_off.gif
C:\WINDOWS\system32\okqipwgf\softleft_on.gif
C:\WINDOWS\system32\okqipwgf\top1.gif
C:\WINDOWS\system32\okqipwgf\top2.gif
C:\WINDOWS\system32\okqipwgf\turnoff1.gif
C:\WINDOWS\system32\okqipwgf\turnon1.gif

.
((((((((((((((((((((((((( Files Created from 2007-08-26 to 2007-09-26 )))))))))))))))))))))))))))))))
.

2007-09-26 20:43 94 –a—— C:\WINDOWS\system32\conf.dat
2007-09-26 20:43 53,248 –a—— C:\nawf.exe
2007-09-26 20:43 5,632 –a—— C:\pqukg.exe
2007-09-26 20:43 45,016 –a—— C:\WINDOWS\system32\btaskv.dll
2007-09-26 20:43 28,160 –a—— C:\uhded.exe
2007-09-26 19:06 76,288 –a—— C:\WINDOWS\system32\RLDDI.DLL
2007-09-26 19:06 76,288 –a—— C:\WINDOWS\system32\RLDDF.DLL
2007-09-26 19:06 d——– C:\WINDOWS\system32\RL
2007-09-26 18:44 904,048 –a—— C:\fsbl.exe
2007-09-26 18:32 d——– C:\games
2007-09-26 18:19 92,208 –a—— C:\WINDOWS\system32\WING.DLL
2007-09-26 09:43 92,208 –a—— C:\WINDOWS\system\WING.DLL
2007-09-26 09:43 76,288 –a—— C:\WINDOWS\system\RLDDI.DLL
2007-09-26 09:43 76,288 –a—— C:\WINDOWS\system\RLDDF.DLL
2007-09-26 09:43 253,952 –a—— C:\WINDOWS\system\MSVCRT20.DLL
2007-09-26 09:43 188,960 –a—— C:\WINDOWS\system\WINGDE.DLL
2007-09-26 09:43 12,800 –a—— C:\WINDOWS\system\WING32.DLL
2007-09-26 09:43 d——– C:\WINDOWS\system\RL
2007-09-26 09:43 d——– C:\Program Files\OG
2007-09-26 09:42 310,784 –a—— C:\WINDOWS\uninst.exe
2007-09-26 09:41 d——– C:\Warhummer
2007-09-26 09:35 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-09-26 09:35 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-09-25 19:12 d——– C:\WINDOWS\ERUNT
2007-09-25 03:58 62,464 –a—— C:\WINDOWS\NirCmd.exe
2007-09-19 17:44 d——– C:\Program Files\NoAdware5.0
2007-09-18 18:26 d–h—– C:\WINDOWS\system32\GroupPolicy
2007-09-18 18:04 77,824 –a—— C:\WINDOWS\system32\rundll32.exe
2007-09-18 07:00 2,829 –a—— C:\WINDOWS\W2BNEUnin.pif
2007-09-18 07:00 19,840 –a—— C:\WINDOWS\W2BNEUnin.dat
2007-09-18 06:58 d——– C:\Program Files\Warcraft II BNE
2007-09-18 06:43 d——– C:\Warcraft II BNE
2007-09-18 01:17 d——– C:\WARCRAFT
2007-09-14 21:28 d——– C:\Program Files\Black Isle
2007-09-06 15:39 d——– C:\Program Files\AIM6
2007-09-04 15:58 d——– C:\WIZWORX
2007-09-04 15:58 d——– C:\POOLRAD
2007-09-03 01:46 d——– C:\EYE3
2007-09-03 01:46 d——– C:\EYE2
2007-09-03 01:46 d——– C:\EYE1
2007-08-31 01:45 d——– C:\Documents and Settings\Tristan\.housecall6.6

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-26 20:47 ——— d——– C:\Documents and Settings\Tristan\Application Data\Skype
2007-09-26 20:23 ——— d——– C:\Program Files\OCTGN
2007-09-26 16:11 ——— d——– C:\Program Files\ICQ6
2007-09-25 06:43 ——— d——– C:\Program Files\SPSSEval
2007-09-23 05:24 ——— d——– C:\Documents and Settings\Tristan\Application Data\Azureus
2007-09-23 02:22 ——— d——– C:\Program Files\Azureus
2007-09-19 07:32 ——— d——– C:\Program Files\YahELite
2007-09-19 07:31 ——— d——– C:\Program Files\SpeedswitchXP
2007-09-19 07:31 ——— d——– C:\Program Files\QuickTime
2007-09-19 07:31 ——— d——– C:\Program Files\PowerISO
2007-09-19 07:31 ——— d——– C:\Program Files\D-Tools
2007-09-19 07:31 ——— d——– C:\Program Files\Bonjour
2007-09-19 05:28 ——— d——– C:\Program Files\WoWed
2007-09-18 22:46 ——— d——– C:\Program Files\eMule
2007-09-17 01:34 ——— d——– C:\Program Files\Apple Software Update
2007-09-15 01:02 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-09-06 16:07 ——— d——– C:\Documents and Settings\All Users\Application Data\AOL
2007-09-06 16:06 ——— d——– C:\Program Files\Common Files\AOL
2007-09-06 15:32 ——— d——– C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-08-29 01:31 ——— d——– C:\Program Files\LimeWire
2007-08-21 15:27 ——— d——– C:\Program Files\MSN Messenger
2007-08-18 18:36 ——— d——– C:\Program Files\Fallout2
2007-08-16 12:12 ——— d——– C:\Program Files\MSXML 6.0
2007-08-14 16:07 ——— d——– C:\Documents and Settings\Tristan\Application Data\vlc
2007-08-14 16:06 ——— d——– C:\Program Files\VideoLAN
2007-08-13 18:47 ——— d——– C:\Program Files\Microsoft Device Emulator
2007-08-13 18:46 ——— d——– C:\Program Files\Microsoft SQL Server 2005 Mobile Edition
2007-08-13 18:42 ——— d——– C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-08-13 18:40 ——— d——– C:\Program Files\Microsoft Visual Studio 8
2007-08-13 18:40 ——— d——– C:\Program Files\CE Remote Tools
2007-08-10 21:25 ——— d——– C:\Program Files\iTunes
2007-08-10 21:25 ——— d——– C:\Program Files\iPod
2007-08-05 21:45 ——— d——– C:\Documents and Settings\Tristan\Application Data\Media Center Programs
2007-08-05 21:19 ——— d——– C:\Documents and Settings\Tristan\Application Data\InstallShield Installation Information
2007-08-02 20:39 ——— d——– C:\Program Files\Command & Conquer The First Decade
2007-07-29 13:21 ——— d——– C:\Documents and Settings\All Users\Application Data\FLEXnet
2007-04-29 00:14 26 –a—— C:\Documents and Settings\Tristan\p.bat
.

((((((((((((((((((((((((((((( snapshot_2007-09-26_ 60030.32 )))))))))))))))))))))))))))))))))))))))))
.
—-a-w 123,392 2007-07-19 14:47:22 C:\WINDOWS\catchme.exe
—-a-w 214,016 2004-10-14 00:36:18 C:\WINDOWS\$hf_mig$\KB873339\spuninst.exe
—-a-w 698,880 2004-10-14 00:34:54 C:\WINDOWS\$hf_mig$\KB873339\update\update.exe
—-a-w 214,016 2004-11-30 10:22:42 C:\WINDOWS\$hf_mig$\KB885250\spuninst.exe
—-a-w 698,880 2004-11-30 04:46:40 C:\WINDOWS\$hf_mig$\KB885250\update\update.exe
—-a-w 214,016 2004-10-14 01:36:18 C:\WINDOWS\$hf_mig$\KB885835\spuninst.exe
—-a-w 666,112 2004-10-14 01:34:54 C:\WINDOWS\$hf_mig$\KB885835\update\update.exe
—-a-w 214,016 2004-10-14 01:36:18 C:\WINDOWS\$hf_mig$\KB885836\spuninst.exe
—-a-w 698,880 2004-10-14 01:34:54 C:\WINDOWS\$hf_mig$\KB885836\update\update.exe
—-a-w 214,016 2004-10-14 18:36:16 C:\WINDOWS\$hf_mig$\KB886185\spuninst.exe
—-a-w 666,112 2004-10-14 18:34:52 C:\WINDOWS\$hf_mig$\KB886185\update\update.exe
—-a-w 214,016 2004-10-14 01:36:18 C:\WINDOWS\$hf_mig$\KB887472\spuninst.exe
—-a-w 1,705,472 2004-10-13 16:21:24 C:\WINDOWS\$hf_mig$\KB887472\SP2QFE\msmsgs.exe
—-a-w 666,112 2004-10-14 01:34:54 C:\WINDOWS\$hf_mig$\KB887472\update\update.exe
—-a-w 181,248 2004-10-14 00:36:18 C:\WINDOWS\$hf_mig$\KB887742\spuninst.exe
—-a-w 698,880 2004-10-14 00:34:54 C:\WINDOWS\$hf_mig$\KB887742\update\update.exe
—-a-w 214,016 2004-10-14 00:36:18 C:\WINDOWS\$hf_mig$\KB888113\spuninst.exe
—-a-w 698,880 2004-10-14 00:34:54 C:\WINDOWS\$hf_mig$\KB888113\update\update.exe
—-a-w 181,248 2004-11-30 10:22:42 C:\WINDOWS\$hf_mig$\KB888302\spuninst.exe
—-a-w 698,880 2004-11-30 04:46:40 C:\WINDOWS\$hf_mig$\KB888302\update\update.exe
—-a-w 214,016 2004-11-30 10:22:42 C:\WINDOWS\$hf_mig$\KB891781\spuninst.exe
—-a-w 698,880 2004-11-30 04:46:40 C:\WINDOWS\$hf_mig$\KB891781\update\update.exe
—-a-w 74,752 2005-07-07 09:27:08 C:\WINDOWS\$hf_mig$\KB893756\update\arpidfix.exe
—-a-w 22,016 2005-05-26 23:26:50 C:\WINDOWS\$hf_mig$\KB896358\SP2QFE\hh.exe
—-a-w 101,888 2005-06-11 00:17:13 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
—-a-w 75,264 2005-06-29 06:54:32 C:\WINDOWS\$hf_mig$\KB896423\update\arpidfix.exe
—-a-w 75,264 2005-10-05 06:39:46 C:\WINDOWS\$hf_mig$\KB896424\update\arpidfix.exe
—-a-w 87,040 2005-05-10 23:51:10 C:\WINDOWS\$hf_mig$\KB896428\SP2QFE\telnet.exe
—-a-w 74,752 2005-06-29 06:54:32 C:\WINDOWS\$hf_mig$\KB899587\update\arpidfix.exe
—-a-w 74,752 2005-08-17 06:38:14 C:\WINDOWS\$hf_mig$\KB899589\update\arpidfix.exe
—-a-w 41,984 2005-06-29 06:54:32 C:\WINDOWS\$hf_mig$\KB899591\update\arpidfix.exe
—-a-w 74,752 2005-09-26 07:36:24 C:\WINDOWS\$hf_mig$\KB900725\update\arpidfix.exe
—-a-w 41,984 2005-09-09 06:26:26 C:\WINDOWS\$hf_mig$\KB901017\update\arpidfix.exe
—-a-w 52,736 2005-07-25 23:42:35 C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\migregdb.exe
—-a-w 74,752 2005-07-25 09:21:18 C:\WINDOWS\$hf_mig$\KB902400\update\arpidfix.exe
—-a-w 41,984 2005-08-19 23:50:31 C:\WINDOWS\$hf_mig$\KB905414\update\arpidfix.exe
—-a-w 74,752 2005-08-22 08:01:30 C:\WINDOWS\$hf_mig$\KB905749\update\arpidfix.exe
—-a-w 39,936 2006-03-17 01:05:35 C:\WINDOWS\$hf_mig$\KB908531\SP2QFE\verclsid.exe
—-a-w 29,696 2006-03-04 01:34:41 C:\WINDOWS\$hf_mig$\KB912812\SP2QFE\iedw.exe
—-a-w 62,464 2006-05-09 11:41:31 C:\WINDOWS\$hf_mig$\KB916281\SP2QFE\iedw.exe
—-a-w 62,464 2006-06-23 08:48:30 C:\WINDOWS\$hf_mig$\KB918899\SP2QFE\iedw.exe
—-a-w 300,544 2006-10-12 11:54:07 C:\WINDOWS\$hf_mig$\KB920213\SP2QFE\agentsvr.exe
—-a-w 67,072 2006-08-21 09:43:32 C:\WINDOWS\$hf_mig$\KB922582\SP2QFE\fltmc.exe
—-a-w 29,696 2006-09-13 09:10:27 C:\WINDOWS\$hf_mig$\KB922760\SP2QFE\iedw.exe
—-a-w 29,696 2006-10-23 11:02:37 C:\WINDOWS\$hf_mig$\KB925454\SP2QFE\iedw.exe
—-a-w 29,696 2007-01-04 11:03:40 C:\WINDOWS\$hf_mig$\KB928090\SP2QFE\iedw.exe
—-a-w 104,960 2006-11-27 10:25:22 C:\WINDOWS\$hf_mig$\KB929120\SP2QFE\tzchange.exe
—-a-w 62,976 2007-02-19 10:10:50 C:\WINDOWS\$hf_mig$\KB931768\SP2QFE\iedw.exe
—-a-w 104,960 2007-01-29 09:25:04 C:\WINDOWS\$hf_mig$\KB931836\SP2QFE\tzchange.exe
—-a-w 104,960 2007-07-18 10:33:06 C:\WINDOWS\$hf_mig$\KB933360\SP2QFE\tzchange.exe
—-a-w 62,464 2007-04-18 10:42:17 C:\WINDOWS\$hf_mig$\KB933566\SP2QFE\iedw.exe
—-a-w 29,696 2007-06-14 10:32:36 C:\WINDOWS\$hf_mig$\KB937143\SP2QFE\iedw.exe
—-a-w 107,520 2007-06-27 09:16:27 C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\ie4uinit.exe
—-a-w 57,856 2007-06-27 09:16:27 C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\ieudinit.exe
—-a-w 636,416 2007-06-27 09:16:52 C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\iexplore.exe
—-a-w 1,077,248 2007-06-13 11:26:03 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
-c–a-w 121,344 2004-08-04 10:00:00 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msiexec.exe
-c–a-w 208,384 2004-03-17 04:36:50 C:\WINDOWS\$NtUninstallKB835221WXP$\spuninst\spuninst.exe
-c–a-w 214,016 2004-10-14 00:36:18 C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
-c–a-w 214,016 2004-11-30 10:22:42 C:\WINDOWS\$NtUninstallKB885250$\spuninst\spuninst.exe
-c–a-w 214,016 2004-10-14 01:36:18 C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
-c–a-w 214,016 2004-10-14 01:36:18 C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
-c–a-w 214,016 2004-09-19 20:21:24 C:\WINDOWS\$NtUninstallKB885884$\spuninst\spuninst.exe
-c–a-w 181,248 2004-10-14 18:36:16 C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
-c–a-w 1,678,848 2004-08-03 15:06:34 C:\WINDOWS\$NtUninstallKB887472$\msmsgs.exe
-c–a-w 181,248 2004-10-14 01:36:18 C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe
-c–a-w 214,016 2004-10-14 00:36:18 C:\WINDOWS\$NtUninstallKB887742$\spuninst\spuninst.exe
-c–a-w 181,248 2004-10-14 00:36:18 C:\WINDOWS\$NtUninstallKB888113$\spuninst\spuninst.exe
-c–a-w 214,016 2004-11-30 10:22:42 C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
-c–a-w 181,248 2004-11-30 10:22:42 C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
-c–a-w 54,784 2004-08-04 10:00:00 C:\WINDOWS\$NtUninstallKB896358$\hh.exe
-c–a-w 69,120 2004-08-04 10:00:00 C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe
-c–a-w 119,296 2004-08-04 10:00:00 C:\WINDOWS\$NtUninstallKB896428$\telnet.exe
-c–a-w 18,944 2004-08-04 10:00:00 C:\WINDOWS\$NtUninstallKB902400$\migregdb.exe
-c–a-w 29,696 2006-03-04 00:39:06 C:\WINDOWS\$NtUninstallKB916281$\iedw.exe
-c–a-w 62,464 2006-05-09 11:00:37 C:\WINDOWS\$NtUninstallKB918899$\iedw.exe
-c–a-w 300,544 2004-08-04 10:00:00 C:\WINDOWS\$NtUninstallKB920213$\agentsvr.exe
-c–a-w 33,792 2004-08-04 10:00:00 C:\WINDOWS\$NtUninstallKB922582$\fltmc.exe
-c–a-w 62,464 2006-06-23 08:35:52 C:\WINDOWS\$NtUninstallKB922760$\iedw.exe
-c–a-w 62,464 2006-09-13 08:52:55 C:\WINDOWS\$NtUninstallKB925454$\iedw.exe
-c–a-w 62,464 2006-10-23 11:00:41 C:\WINDOWS\$NtUninstallKB928090$\iedw.exe
-c–a-w 62,464 2007-01-04 10:36:30 C:\WINDOWS\$NtUninstallKB931768$\iedw.exe
-c–a-w 71,680 2006-11-27 08:45:40 C:\WINDOWS\$NtUninstallKB931836$\tzchange.exe
-c–a-w 71,680 2007-01-29 08:58:06 C:\WINDOWS\$NtUninstallKB933360$\tzchange.exe
-c–a-w 29,696 2007-02-19 09:01:28 C:\WINDOWS\$NtUninstallKB933566$\iedw.exe
-c–a-w 29,696 2007-06-14 14:07:24 C:\WINDOWS\$NtUninstallKB937143$\iedw.exe
-c–a-w 29,696 2007-04-18 10:22:13 C:\WINDOWS\$NtUninstallKB937143_0$\iedw.exe
-c–a-w 1,043,456 2004-08-04 10:00:00 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
-c–a-w 359,936 2006-11-01 07:31:34 C:\WINDOWS\$NtUninstallKB939683$\unregmp2.exe
-c–a-w 108,032 2004-09-22 08:45:44 C:\WINDOWS\$NtUninstallWMFDist11$\logagent.exe
-c–a-w 91,136 2004-09-22 08:46:10 C:\WINDOWS\$NtUninstallWMFDist11$\uwdf.exe
-c–a-w 83,456 2004-09-22 08:46:10 C:\WINDOWS\$NtUninstallWMFDist11$\wdfmgr.exe
-c–a-w 864,256 2004-09-22 08:46:28 C:\WINDOWS\$NtUninstallWMFDist11$\wmsetsdk.exe
-c–a-w 864,256 2004-09-22 08:46:04 C:\WINDOWS\$NtUninstallwmp11$\setup_wm.exe
-c–a-w 204,800 2004-09-22 08:46:10 C:\WINDOWS\$NtUninstallwmp11$\unregmp2.exe
-c–a-w 167,936 2004-09-22 08:46:14 C:\WINDOWS\$NtUninstallwmp11$\wmlaunch.exe
-c–a-w 40,960 2004-09-22 08:46:20 C:\WINDOWS\$NtUninstallwmp11$\wmpenc.exe
-c–a-w 86,016 2004-08-04 10:00:00 C:\WINDOWS\$NtUninstallwmp11$\wmplayer.exe
—-a-w 286,721 2005-10-18 02:59:43 C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\iTunesSetup.exe
—-a-w 178,176 2007-09-24 21:10:08 C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
—-a-w 178,176 2007-09-24 21:10:08 C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
-c–a-w 78,848 2004-08-04 10:00:00 C:\WINDOWS\ie7\ie4uinit.exe
-c–a-w 29,696 2007-06-14 10:32:36 C:\WINDOWS\ie7\iedw.exe
-c–a-w 137,216 2004-08-04 10:00:00 C:\WINDOWS\ie7\iexplore.exe
-c–a-w 40,448 2004-08-04 10:00:00 C:\WINDOWS\ie7\mshta.exe
-c–a-w 77,312 2006-11-07 11:01:06 C:\WINDOWS\ie7\spuninst\ieResetIcons.exe
-c–a-w 66,048 2006-11-06 17:26:28 C:\WINDOWS\ie7updates\KB937143-IE7\ie4uinit.exe
-c–a-w 57,344 2006-11-06 17:26:32 C:\WINDOWS\ie7updates\KB937143-IE7\ieudinit.exe
-c–a-w 633,344 2006-10-17 02:04:40 C:\WINDOWS\ie7updates\KB937143-IE7\iexplore.exe
—-a-w 598,016 2005-12-28 03:21:06 C:\WINDOWS\Installer\iProInst.exe
—-a-w 341,950 2005-12-28 02:11:30 C:\WINDOWS\Installer\iProData\iconvrtr.exe
—-a-r 86,016 2007-08-03 02:46:49 C:\WINDOWS\Installer\{2763FD5A-57E9-442B-AFDF-6DCCC23883B0}\NewShortcut2_0AE19D8917A9404D932AFAAF43F3C77E.exe
—-a-r 178,176 2006-06-06 07:53:09 C:\WINDOWS\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\places.exe
—-a-r 77,824 2006-11-15 16:01:30 C:\WINDOWS\Installer\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}\icon.exe
—-a-r 110,592 2006-08-08 07:26:12 C:\WINDOWS\Installer\{43DCF766-6838-4F9A-8C91-D92DA586DFA8}\_C68C351F090F4EF39AFB6B7B54014C9E.exe
—-a-r 176,128 2006-06-10 16:14:02 C:\WINDOWS\Installer\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\NewShortcut4_8C3BCD70236347B8A53EEE8A82FD5C78.exe
—-a-r 245,760 2006-08-29 10:19:05 C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\accicons.exe
—-a-r 159,744 2006-08-29 10:19:05 C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\outicon.exe
—-a-r 74,752 2006-08-29 10:19:05 C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\pptico.exe
—-a-r 110,592 2007-06-19 05:12:29 C:\WINDOWS\Installer\{A654A805-41D9-40C7-AA46-4AF04F044D61}\ARPPRODUCTICON.exe
—-a-r 77,824 2007-06-19 05:12:29 C:\WINDOWS\Installer\{A654A805-41D9-40C7-AA46-4AF04F044D61}\NewShortcut2_4BDFD2CE632942E498019B3D1F10D79B.exe
—-a-r 77,824 2007-05-10 15:57:50 C:\WINDOWS\Installer\{B74D4E10-6884-0000-0000-000000000103}\BridgeCommonShortcut_B74D4E101033000000000001_1.exe
—-a-r 77,824 2007-08-16 02:10:30 C:\WINDOWS\Installer\{C04E32E0-0416-434D-AFB9-6969D703A9EF}\icon.exe
—-a-w 117,248 2005-09-22 21:28:52 C:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe
—-a-w 49,152 2005-09-22 21:28:32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
—-a-w 25,088 2005-09-22 21:28:32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
—-a-w 151,552 2005-09-22 21:28:32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
—-a-w 118,784 2005-09-22 21:28:56 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
—-a-w 49,152 2007-04-12 17:20:58 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
—-a-w 20,992 2007-04-12 17:21:16 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
—-a-w 73,728 2007-04-12 17:21:16 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
—-a-w 53,248 2005-09-22 21:28:48 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe
—-a-w 81,920 2005-09-22 21:28:48 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
—-a-w 98,304 2005-09-22 21:28:56 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
—-a-w 77,824 2005-09-22 21:28:56 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
—-a-w 163,840 2005-09-22 20:56:16 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\WebDev.WebServer.EXE
—-a-w 134,656 2004-08-04 10:00:00 C:\WINDOWS\mui\muisetup.exe
—-a-w 601,600 2006-10-10 12:44:50 C:\WINDOWS\network diagnostic\xpnetdiag.exe
—-a-w 813,056 2004-08-04 10:00:00 C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
—-a-w 111,104 2004-08-04 10:00:00 C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.exe
—-a-w 30,208 2004-08-04 10:00:00 C:\WINDOWS\pchealth\helpctr\binaries\HscUpd.exe
—-a-w 169,472 2004-08-04 10:00:00 C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe
—-a-w 46,592 2004-08-04 10:00:00 C:\WINDOWS\pchealth\helpctr\binaries\notiflag.exe
—-a-w 161,792 2004-08-04 10:00:00 C:\WINDOWS\pchealth\UploadLB\Binaries\UploadM.exe
—-a-w 864,256 2004-09-22 08:46:04 C:\WINDOWS\RegisteredPackages\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}\setup_wm.exe
—-a-w 786,432 2004-08-04 10:00:00 C:\WINDOWS\RegisteredPackages\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}$BACKUP$\System\setup_wm.exe
—-a-w 91,136 2004-09-22 08:46:10 C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\uwdf.exe
—-a-w 83,456 2004-09-22 08:46:10 C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wdfmgr.exe
—-a-w 140,800 2004-09-22 08:45:44 C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\logagent.exe
—-a-w 147,968 2004-08-04 10:00:00 C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\logagent.exe
—-a-w 1,036,288 2004-09-22 08:45:46 C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\migrate.exe
—-a-w 204,800 2004-09-22 08:46:10 C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\unregmp2.exe
—-a-w 135,168 2004-09-22 08:46:14 C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\wmlaunch.exe
—-a-w 40,960 2004-09-22 08:46:20 C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\wmpenc.exe
—-a-w 86,016 2004-09-22 08:46:22 C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\wmplayer.exe
—-a-w 831,488 2004-08-04 10:00:00 C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\migrate.exe
—-a-w 221,184 2004-08-04 10:00:00 C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\unregmp2.exe
—-a-w 86,016 2004-08-04 10:00:00 C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\wmplayer.exe
—-a-w 601,600 2006-10-10 12:44:50 C:\WINDOWS\SoftwareDistribution\Downloadfacce6115ab861022eae3087e064a2a\SP2QFE\xpnetdg.exe
—-a-w 72,704 2006-03-17 00:38:01 C:\WINDOWS\SoftwareDistribution\Download\cb2769f3b1daf367a31ed046299a3790\sp2gdr\verclsid.exe
—-a-w 41,472 1995-11-25 01:36:58 C:\WINDOWS\system\RL\SOFTF.DLL
—-a-w 40,448 1995-11-25 01:36:58 C:\WINDOWS\system\RL\SOFTI.DLL
—-a-w 584,704 1995-11-25 01:36:48 C:\WINDOWS\system\RL\SOFT\RLFRG16M.DLL
—-a-w 583,168 1995-11-25 01:36:50 C:\WINDOWS\system\RL\SOFT\RLFRG256.DLL
—-a-w 587,264 1995-11-25 01:36:50 C:\WINDOWS\system\RL\SOFT\RLFRG64K.DLL
—-a-w 381,952 1995-11-25 01:36:52 C:\WINDOWS\system\RL\SOFT\RLFRM16M.DLL
—-a-w 412,672 1995-11-25 01:36:52 C:\WINDOWS\system\RL\SOFT\RLFRM256.DLL
—-a-w 411,648 1995-11-25 01:36:54 C:\WINDOWS\system\RL\SOFT\RLFRM64K.DLL
—-a-w 491,008 1995-11-25 01:36:54 C:\WINDOWS\system\RL\SOFT\RLIRG16M.DLL
—-a-w 489,472 1995-11-25 01:36:54 C:\WINDOWS\system\RL\SOFT\RLIRG256.DLL
—-a-w 494,080 1995-11-25 01:36:56 C:\WINDOWS\system\RL\SOFT\RLIRG64K.DLL
—-a-w 315,904 1995-11-25 01:36:56 C:\WINDOWS\system\RL\SOFT\RLIRM16M.DLL
—-a-w 359,936 1995-11-25 01:36:58 C:\WINDOWS\system\RL\SOFT\RLIRM256.DLL
—-a-w 365,056 1995-11-25 01:36:58 C:\WINDOWS\system\RL\SOFT\RLIRM64K.DLL
—-a-w 231,936 2004-08-04 10:00:00 C:\WINDOWS\system32\logon.scr
—-a-w 485,376 2004-08-04 10:00:00 C:\WINDOWS\system32\mspaint.exe
—-a-w 716,800 2004-08-04 10:00:00 C:\WINDOWS\system32\ss3dfo.scr
—-a-w 503,808 2004-08-04 10:00:00 C:\WINDOWS\system32\ssflwbox.scr
—-a-w 91,136 2004-08-04 10:00:00 C:\WINDOWS\system32\ssmypics.scr
—-a-w 622,592 2004-08-04 10:00:00 C:\WINDOWS\system32\sspipes.scr
—-a-w 25,600 2004-08-04 10:00:00 C:\WINDOWS\system32\ssstars.scr
—-a-w 724,992 2004-08-04 10:00:00 C:\WINDOWS\system32\sstext3d.scr
—-a-w 25,600 2004-08-04 10:00:00 C:\WINDOWS\system32\svchost.exe
—-a-w 922,112 2007-07-22 08:39:27 C:\WINDOWS\system32\swreg.exe
—-a-w 972,306 2006-05-12 09:09:38 C:\WINDOWS\system32\C2MP\x264.exe
—-a-w 16,384 2007-09-26 10:42:50 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
—-a-w 32,768 2007-09-26 10:42:50 C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
—-a-w 32,768 2007-09-26 10:42:50 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
—-a-w 8,192 2007-09-26 10:43:04 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE51234567\adv735[2].exe
—-a-w 3,584 2007-09-26 09:57:22 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE51234567\dl[1].exe
—-a-w 8,192 2007-09-26 09:57:20 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\89ABCDEF\adv735[1].exe
—-a-w 3,584 2007-09-26 10:43:10 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\GHIJKLMN\dl[1].exe
-c–a-w 159,799 2003-03-24 06:52:04 C:\WINDOWS\system32\dllcache\admin.exe
-c–a-w 398,848 2006-10-12 11:09:53 C:\WINDOWS\system32\dllcache\agentsvr.exe
-c–a-w 154,112 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\alg.exe
-c–a-w 139,776 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\asr_fmt.exe
-c–a-w 109,056 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\asr_ldm.exe
-c–a-w 88,064 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\attrib.exe
-c–a-w 152,145 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\bckgzm.exe
-c–a-w 86,528 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\change.exe
-c–a-w 92,672 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\chgport.exe
-c–a-w 88,064 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\chkntfs.exe
-c–a-w 152,143 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\chkrzm.exe
-c–a-w 110,080 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\clipsrv.exe
-c–a-w 116,736 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\cmmon32.exe
-c–a-w 140,288 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\cmstp.exe
-c–a-w 104,448 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\conime.exe
-c–a-w 649,216 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\dialer.exe
-c–a-w 114,688 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\dllhost.exe
-c–a-w 95,232 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\dvdupgrd.exe
-c–a-w 86,016 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\eventvwr.exe
-c–a-w 103,936 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\findstr.exe
-c–a-w 845,312 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\helpctr.exe
-c–a-w 102,400 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\icwrmind.exe
-c–a-w 184,320 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\icwtutor.exe
-c–a-w 179,200 2006-10-17 02:04:50 C:\WINDOWS\system32\dllcache\iedw.exe
-c–a-w 25,088 2007-06-27 08:27:05 C:\WINDOWS\system32\dllcache\ieudinit.exe
-c–a-w 735,232 2007-06-27 08:27:30 C:\WINDOWS\system32\dllcache\iexplore.exe
-c–a-w 123,904 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\iisreset.exe
-c–a-w 226,816 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\imapi.exe
-c–a-w 417,849 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\imjpdct.exe
-c–a-w 315,781 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\imjpinst.exe
-c–a-w 136,704 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\imkrinst.exe
-c–a-w 231,936 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\logon.scr
-c–a-w 84,992 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\lpr.exe
-c–a-w 150,016 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\magnify.exe
-c–a-w 195,072 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\makecab.exe
-c–a-w 96,768 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\mqbkup.exe
-c–a-w 122,368 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\mrinfo.exe
-c–a-w 115,712 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\msdtc.exe
-c–a-w 204,288 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\mshearts.exe
-c–a-w 122,880 2006-10-17 01:56:10 C:\WINDOWS\system32\dllcache\mshta.exe
-c–a-w 117,248 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\msinfo32.exe
-c–a-w 105,472 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\msoobe.exe
-c–a-w 83,968 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\msswchx.exe
-c–a-w 81,408 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\nddeapir.exe
-c–a-w 144,896 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\notiflag.exe
-c–a-w 1,277,440 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ntbackup.exe
-c–a-w 236,032 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\nwscript.exe
-c–a-w 161,280 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\oobebaln.exe
-c–a-w 131,584 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\pathping.exe
-c–a-w 125,440 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\perfmon.exe
-c–a-w 95,232 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ping.exe
-c–a-w 146,944 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\pintlphr.exe
-c–a-w 87,040 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\query.exe
-c–a-w 121,344 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\rasautou.exe
-c–a-w 120,832 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\rasdial.exe
-c–a-w 131,584 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\rcp.exe
-c–a-w 80,384 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\regedt32.exe
-c–a-w 109,568 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\relog.exe
-c–a-w 123,392 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\rexec.exe
-c–a-w 101,888 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\rsmsink.exe
-c–a-w 110,080 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\rundll32.exe
-c–a-w 53,760 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\scrnsave.scr
-c–a-w 154,112 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\sdbinst.exe
-c–a-w 182,784 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\setup50.exe
-c–a-w 241,152 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\sndrec32.exe
-c–a-w 749,568 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ss3dfo.scr
-c–a-w 31,232 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ssbezier.scr
-c–a-w 405,504 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ssflwbox.scr
-c–a-w 65,024 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ssmarque.scr
-c–a-w 58,368 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ssmypics.scr
-c–a-w 62,976 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ssmyst.scr
-c–a-w 655,360 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\sspipes.scr
-c–a-w 58,368 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ssstars.scr
-c–a-w 724,992 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\sstext3d.scr
-c–a-w 124,928 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\stimon.exe
-c–a-w 86,016 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\subst.exe
-c–a-w 216,064 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\sysocmgr.exe
-c–a-w 148,992 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\tasklist.exe
-c–a-w 92,160 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\taskman.exe
-c–a-w 245,760 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\taskmgr.exe
-c–a-w 171,520 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\tlntadmn.exe
-c–a-w 141,312 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\tracert6.exe
-c–a-w 91,648 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\tsdiscon.exe
-c–a-w 94,208 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\tsshutdn.exe
-c–a-w 394,240 2007-06-26 12:10:26 C:\WINDOWS\system32\dllcache\unregmp2.exe
-c–a-w 101,376 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\userinit.exe
-c–a-w 84,992 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\winhstb.exe
-c–a-w 197,120 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\winmine.exe
-c–a-w 273,408 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\wmiadap.exe
-c–a-w 291,328 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\wordpad.exe
-c–a-w 109,056 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\wpabaln.exe
-c–a-w 107,520 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\xcopy.exe
—-a-w 213,048 2005-05-24 01:27:16 C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
—-a-w 172,032 2007-09-07 01:29:00 C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
—-a-w 946,176 2007-09-07 01:29:00 C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
—-a-w 184,320 2006-07-27 22:32:38 C:\WINDOWS\system32\Macromed\Shockwave 10\SwInit.exe
—-a-w 226,304 1999-06-25 00:55:30 C:\WINDOWS\system32\Macromed\Shockwave 10\UNWISE.EXE
—-a-w 41,472 1995-11-25 11:36:58 C:\WINDOWS\system32\RL\SOFTF.DLL
—-a-w 40,448 1995-11-25 11:36:58 C:\WINDOWS\system32\RL\SOFTI.DLL
—-a-w 584,704 1995-11-25 11:36:48 C:\WINDOWS\system32\RL\SOFT\RLFRG16M.DLL
—-a-w 583,168 1995-11-25 11:36:50 C:\WINDOWS\system32\RL\SOFT\RLFRG256.DLL
—-a-w 587,264 1995-11-25 11:36:50 C:\WINDOWS\system32\RL\SOFT\RLFRG64K.DLL
—-a-w 381,952 1995-11-25 11:36:52 C:\WINDOWS\system32\RL\SOFT\RLFRM16M.DLL
—-a-w 412,672 1995-11-25 11:36:52 C:\WINDOWS\system32\RL\SOFT\RLFRM256.DLL
—-a-w 411,648 1995-11-25 11:36:54 C:\WINDOWS\system32\RL\SOFT\RLFRM64K.DLL
—-a-w 491,008 1995-11-25 11:36:54 C:\WINDOWS\system32\RL\SOFT\RLIRG16M.DLL
—-a-w 489,472 1995-11-25 11:36:54 C:\WINDOWS\system32\RL\SOFT\RLIRG256.DLL
—-a-w 494,080 1995-11-25 11:36:56 C:\WINDOWS\system32\RL\SOFT\RLIRG64K.DLL
—-a-w 315,904 1995-11-25 11:36:56 C:\WINDOWS\system32\RL\SOFT\RLIRM16M.DLL
—-a-w 359,936 1995-11-25 11:36:58 C:\WINDOWS\system32\RL\SOFT\RLIRM256.DLL
—-a-w 365,056 1995-11-25 11:36:58 C:\WINDOWS\system32\RL\SOFT\RLIRM64K.DLL
—-a-w 93,696 2004-08-04 10:00:00 C:\WINDOWS\system32\wbem\unsecapp.exe
—-a-w 193,024 2004-08-04 10:00:00 C:\WINDOWS\system32\wbem\wbemtest.exe
—-a-w 468,480 2004-08-04 10:00:00 C:\WINDOWS\system32\wbem\wmic.exe
.
—-a-w 109,056 2007-07-19 14:47:22 C:\WINDOWS\catchme.exe
—-a-w 169,984 2004-10-14 00:36:18 C:\WINDOWS\$hf_mig$\KB873339\spuninst.exe
—-a-w 654,848 2004-10-14 00:34:54 C:\WINDOWS\$hf_mig$\KB873339\update\update.exe
—-a-w 169,984 2004-11-30 10:22:42 C:\WINDOWS\$hf_mig$\KB885250\spuninst.exe
—-a-w 654,848 2004-11-30 04:46:40 C:\WINDOWS\$hf_mig$\KB885250\update\update.exe
—-a-w 169,984 2004-10-14 01:36:18 C:\WINDOWS\$hf_mig$\KB885835\spuninst.exe
—-a-w 654,848 2004-10-14 01:34:54 C:\WINDOWS\$hf_mig$\KB885835\update\update.exe
—-a-w 169,984 2004-10-14 01:36:18 C:\WINDOWS\$hf_mig$\KB885836\spuninst.exe
—-a-w 654,848 2004-10-14 01:34:54 C:\WINDOWS\$hf_mig$\KB885836\update\update.exe
—-a-w 169,984 2004-10-14 18:36:16 C:\WINDOWS\$hf_mig$\KB886185\spuninst.exe
—-a-w 654,848 2004-10-14 18:34:52 C:\WINDOWS\$hf_mig$\KB886185\update\update.exe
—-a-w 169,984 2004-10-14 01:36:18 C:\WINDOWS\$hf_mig$\KB887472\spuninst.exe
—-a-w 1,694,208 2004-10-13 16:21:24 C:\WINDOWS\$hf_mig$\KB887472\SP2QFE\msmsgs.exe
—-a-w 654,848 2004-10-14 01:34:54 C:\WINDOWS\$hf_mig$\KB887472\update\update.exe
—-a-w 169,984 2004-10-14 00:36:18 C:\WINDOWS\$hf_mig$\KB887742\spuninst.exe
—-a-w 654,848 2004-10-14 00:34:54 C:\WINDOWS\$hf_mig$\KB887742\update\update.exe
—-a-w 169,984 2004-10-14 00:36:18 C:\WINDOWS\$hf_mig$\KB888113\spuninst.exe
—-a-w 654,848 2004-10-14 00:34:54 C:\WINDOWS\$hf_mig$\KB888113\update\update.exe
—-a-w 169,984 2004-11-30 10:22:42 C:\WINDOWS\$hf_mig$\KB888302\spuninst.exe
—-a-w 654,848 2004-11-30 04:46:40 C:\WINDOWS\$hf_mig$\KB888302\update\update.exe
—-a-w 169,984 2004-11-30 10:22:42 C:\WINDOWS\$hf_mig$\KB891781\spuninst.exe
—-a-w 654,848 2004-11-30 04:46:40 C:\WINDOWS\$hf_mig$\KB891781\update\update.exe
—-a-w 30,720 2005-07-07 09:27:08 C:\WINDOWS\$hf_mig$\KB893756\update\arpidfix.exe
—-a-w 10,752 2005-05-26 23:26:50 C:\WINDOWS\$hf_mig$\KB896358\SP2QFE\hh.exe
—-a-w 57,856 2005-06-11 00:17:13 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
—-a-w 30,720 2005-06-29 06:54:32 C:\WINDOWS\$hf_mig$\KB896423\update\arpidfix.exe
—-a-w 30,720 2005-10-05 06:39:46 C:\WINDOWS\$hf_mig$\KB896424\update\arpidfix.exe
—-a-w 75,776 2005-05-10 23:51:10 C:\WINDOWS\$hf_mig$\KB896428\SP2QFE\telnet.exe
—-a-w 30,720 2005-06-29 06:54:32 C:\WINDOWS\$hf_mig$\KB899587\update\arpidfix.exe
—-a-w 30,720 2005-08-17 06:38:14 C:\WINDOWS\$hf_mig$\KB899589\update\arpidfix.exe
—-a-w 30,720 2005-06-29 06:54:32 C:\WINDOWS\$hf_mig$\KB899591\update\arpidfix.exe
—-a-w 30,720 2005-09-26 07:36:24 C:\WINDOWS\$hf_mig$\KB900725\update\arpidfix.exe
—-a-w 30,720 2005-09-09 06:26:26 C:\WINDOWS\$hf_mig$\KB901017\update\arpidfix.exe
—-a-w 8,704 2005-07-25 23:42:35 C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\migregdb.exe
—-a-w 30,720 2005-07-25 09:21:18 C:\WINDOWS\$hf_mig$\KB902400\update\arpidfix.exe
—-a-w 30,720 2005-08-19 23:50:31 C:\WINDOWS\$hf_mig$\KB905414\update\arpidfix.exe
—-a-w 30,720 2005-08-22 08:01:30 C:\WINDOWS\$hf_mig$\KB905749\update\arpidfix.exe
—-a-w 28,672 2006-03-17 01:05:35 C:\WINDOWS\$hf_mig$\KB908531\SP2QFE\verclsid.exe
—-a-w 18,432 2006-03-04 01:34:41 C:\WINDOWS\$hf_mig$\KB912812\SP2QFE\iedw.exe
—-a-w 18,432 2006-05-09 11:41:31 C:\WINDOWS\$hf_mig$\KB916281\SP2QFE\iedw.exe
—-a-w 18,432 2006-06-23 08:48:30 C:\WINDOWS\$hf_mig$\KB918899\SP2QFE\iedw.exe
—-a-w 256,512 2006-10-12 11:54:07 C:\WINDOWS\$hf_mig$\KB920213\SP2QFE\agentsvr.exe
—-a-w 23,040 2006-08-21 09:43:32 C:\WINDOWS\$hf_mig$\KB922582\SP2QFE\fltmc.exe
—-a-w 18,432 2006-09-13 09:10:27 C:\WINDOWS\$hf_mig$\KB922760\SP2QFE\iedw.exe
—-a-w 18,432 2006-10-23 11:02:37 C:\WINDOWS\$hf_mig$\KB925454\SP2QFE\iedw.exe
—-a-w 18,432 2007-01-04 11:03:40 C:\WINDOWS\$hf_mig$\KB928090\SP2QFE\iedw.exe
—-a-w 60,416 2006-11-27 10:25:22 C:\WINDOWS\$hf_mig$\KB929120\SP2QFE\tzchange.exe
—-a-w 18,432 2007-02-19 10:10:50 C:\WINDOWS\$hf_mig$\KB931768\SP2QFE\iedw.exe
—-a-w 60,416 2007-01-29 09:25:04 C:\WINDOWS\$hf_mig$\KB931836\SP2QFE\tzchange.exe
—-a-w 60,416 2007-07-18 10:33:06 C:\WINDOWS\$hf_mig$\KB933360\SP2QFE\tzchange.exe
—-a-w 18,432 2007-04-18 10:42:17 C:\WINDOWS\$hf_mig$\KB933566\SP2QFE\iedw.exe
—-a-w 18,432 2007-06-14 10:32:36 C:\WINDOWS\$hf_mig$\KB937143\SP2QFE\iedw.exe
—-a-w 63,488 2007-06-27 09:16:27 C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\ie4uinit.exe
—-a-w 13,824 2007-06-27 09:16:27 C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\ieudinit.exe
—-a-w 625,152 2007-06-27 09:16:52 C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\iexplore.exe
—-a-w 1,033,216 2007-06-13 11:26:03 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
-c—-w 77,312 2004-08-04 10:00:00 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msiexec.exe
-c—-w 164,352 2004-03-17 04:36:50 C:\WINDOWS\$NtUninstallKB835221WXP$\spuninst\spuninst.exe
-c—-w 169,984 2004-10-14 00:36:18 C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
-c—-w 169,984 2004-11-30 10:22:42 C:\WINDOWS\$NtUninstallKB885250$\spuninst\spuninst.exe
-c—-w 169,984 2004-10-14 01:36:18 C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
-c—-w 169,984 2004-10-14 01:36:18 C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
-c—-w 169,984 2004-09-19 20:21:24 C:\WINDOWS\$NtUninstallKB885884$\spuninst\spuninst.exe
-c—-w 169,984 2004-10-14 18:36:16 C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
-c—-w 1,667,584 2004-08-03 15:06:34 C:\WINDOWS\$NtUninstallKB887472$\msmsgs.exe
-c—-w 169,984 2004-10-14 01:36:18 C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe
-c—-w 169,984 2004-10-14 00:36:18 C:\WINDOWS\$NtUninstallKB887742$\spuninst\spuninst.exe
-c—-w 169,984 2004-10-14 00:36:18 C:\WINDOWS\$NtUninstallKB888113$\spuninst\spuninst.exe
-c—-w 169,984 2004-11-30 10:22:42 C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
-c—-w 169,984 2004-11-30 10:22:42 C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
-c—-w 10,752 2004-08-04 10:00:00 C:\WINDOWS\$NtUninstallKB896358$\hh.exe
-c—-w 57,856 2004-08-04 10:00:00 C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe
-c—-w 75,264 2004-08-04 10:00:00 C:\WINDOWS\$NtUninstallKB896428$\telnet.exe
-c—-w 7,680 2004-08-04 10:00:00 C:\WINDOWS\$NtUninstallKB902400$\migregdb.exe
-c—-w 18,432 2006-03-04 00:39:06 C:\WINDOWS\$NtUninstallKB916281$\iedw.exe
-c—-w 18,432 2006-05-09 11:00:37 C:\WINDOWS\$NtUninstallKB918899$\iedw.exe
-c—-w 256,512 2004-08-04 10:00:00 C:\WINDOWS\$NtUninstallKB920213$\agentsvr.exe
-c—-w 22,528 2004-08-04 10:00:00 C:\WINDOWS\$NtUninstallKB922582$\fltmc.exe
-c—-w 18,432 2006-06-23 08:35:52 C:\WINDOWS\$NtUninstallKB922760$\iedw.exe
-c—-w 18,432 2006-09-13 08:52:55 C:\WINDOWS\$NtUninstallKB925454$\iedw.exe
-c—-w 18,432 2006-10-23 11:00:41 C:\WINDOWS\$NtUninstallKB928090$\iedw.exe
-c—-w 18,432 2007-01-04 10:36:30 C:\WINDOWS\$NtUninstallKB931768$\iedw.exe
-c—-w 60,416 2006-11-27 08:45:40 C:\WINDOWS\$NtUninstallKB931836$\tzchange.exe
-c—-w 60,416 2007-01-29 08:58:06 C:\WINDOWS\$NtUninstallKB933360$\tzchange.exe
-c—-w 18,432 2007-02-19 09:01:28 C:\WINDOWS\$NtUninstallKB933566$\iedw.exe
-c—-w 18,432 2007-06-14 14:07:24 C:\WINDOWS\$NtUninstallKB937143$\iedw.exe
-c—-w 18,432 2007-04-18 10:22:13 C:\WINDOWS\$NtUninstallKB937143_0$\iedw.exe
-c—-w 1,032,192 2004-08-04 10:00:00 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
-c—-w 315,904 2006-11-01 07:31:34 C:\WINDOWS\$NtUninstallKB939683$\unregmp2.exe
-c—-w 96,768 2004-09-22 08:45:44 C:\WINDOWS\$NtUninstallWMFDist11$\logagent.exe
-c—-w 47,104 2004-09-22 08:46:10 C:\WINDOWS\$NtUninstallWMFDist11$\uwdf.exe
-c—-w 38,912 2004-09-22 08:46:10 C:\WINDOWS\$NtUninstallWMFDist11$\wdfmgr.exe
-c—-w 819,200 2004-09-22 08:46:28 C:\WINDOWS\$NtUninstallWMFDist11$\wmsetsdk.exe
-c—-w 819,200 2004-09-22 08:46:04 C:\WINDOWS\$NtUninstallwmp11$\setup_wm.exe
-c—-w 192,512 2004-09-22 08:46:10 C:\WINDOWS\$NtUninstallwmp11$\unregmp2.exe
-c—-w 122,880 2004-09-22 08:46:14 C:\WINDOWS\$NtUninstallwmp11$\wmlaunch.exe
-c—-w 28,672 2004-09-22 08:46:20 C:\WINDOWS\$NtUninstallwmp11$\wmpenc.exe
-c—-w 73,728 2004-08-04 10:00:00 C:\WINDOWS\$NtUninstallwmp11$\wmplayer.exe
—-a-w 274,433 2005-10-18 02:59:43 C:\WINDOWS\Downloaded Installations\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\iTunesSetup.exe
—-a-w 163,328 2007-09-24 21:10:08 C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
—-a-w 163,328 2007-09-24 21:10:08 C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
-c–a-w 34,304 2004-08-04 10:00:00 C:\WINDOWS\ie7\ie4uinit.exe
-c–a-w 18,432 2007-06-14 10:32:36 C:\WINDOWS\ie7\iedw.exe
-c–a-w 93,184 2004-08-04 10:00:00 C:\WINDOWS\ie7\iexplore.exe
-c–a-w 29,184 2004-08-04 10:00:00 C:\WINDOWS\ie7\mshta.exe
-c–a-w 66,048 2006-11-07 11:01:06 C:\WINDOWS\ie7\spuninst\ieResetIcons.exe
-c—-w 54,784 2006-11-06 17:26:28 C:\WINDOWS\ie7updates\KB937143-IE7\ie4uinit.exe
-c—-w 13,312 2006-11-06 17:26:32 C:\WINDOWS\ie7updates\KB937143-IE7\ieudinit.exe
-c—-w 622,080 2006-10-17 02:04:40 C:\WINDOWS\ie7updates\KB937143-IE7\iexplore.exe
—-a-w 565,248 2005-12-28 03:21:06 C:\WINDOWS\Installer\iProInst.exe
—-a-w 319,488 2005-12-28 02:11:30 C:\WINDOWS\Installer\iProData\iconvrtr.exe
—-a-r 40,960 2007-08-03 02:46:49 C:\WINDOWS\Installer\{2763FD5A-57E9-442B-AFDF-6DCCC23883B0}\NewShortcut2_0AE19D8917A9404D932AFAAF43F3C77E.exe
—-a-r 166,912 2006-06-06 07:53:09 C:\WINDOWS\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\places.exe
—-a-r 32,768 2006-11-15 16:01:30 C:\WINDOWS\Installer\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}\icon.exe
—-a-r 65,536 2006-08-08 07:26:12 C:\WINDOWS\Installer\{43DCF766-6838-4F9A-8C91-D92DA586DFA8}\_C68C351F090F4EF39AFB6B7B54014C9E.exe
—-a-r 131,072 2006-06-10 16:14:02 C:\WINDOWS\Installer\{872653C6-5DDC-488B-B7C2-CF9E4D9335E5}\NewShortcut4_8C3BCD70236347B8A53EEE8A82FD5C78.exe
—-a-r 167,936 2006-08-29 10:19:05 C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\accicons.exe
—-a-r 114,688 2006-08-29 10:19:05 C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\outicon.exe
—-a-r 30,720 2006-08-29 10:19:05 C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\pptico.exe
—-a-r 65,536 2007-06-19 05:12:29 C:\WINDOWS\Installer\{A654A805-41D9-40C7-AA46-4AF04F044D61}\ARPPRODUCTICON.exe
—-a-r 65,536 2007-06-19 05:12:29 C:\WINDOWS\Installer\{A654A805-41D9-40C7-AA46-4AF04F044D61}\NewShortcut2_4BDFD2CE632942E498019B3D1F10D79B.exe
—-a-r 65,536 2007-05-10 15:57:50 C:\WINDOWS\Installer\{B74D4E10-6884-0000-0000-000000000103}\BridgeCommonShortcut_B74D4E101033000000000001_1.exe
—-a-r 32,768 2007-08-16 02:10:30 C:\WINDOWS\Installer\{C04E32E0-0416-434D-AFB9-6969D703A9EF}\icon.exe
—-a-w 72,704 2005-09-22 21:28:52 C:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe
—-a-w 36,864 2005-09-22 21:28:32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
—-a-w 13,824 2005-09-22 21:28:32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
—-a-w 106,496 2005-09-22 21:28:32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
—-a-w 106,496 2005-09-22 21:28:56 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
—-a-w 5,120 2007-04-12 17:20:58 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
—-a-w 9,728 2007-04-12 17:21:16 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
—-a-w 28,672 2007-04-12 17:21:16 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
—-a-w 40,960 2005-09-22 21:28:48 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe
—-a-w 69,632 2005-09-22 21:28:48 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
—-a-w 53,248 2005-09-22 21:28:56 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
—-a-w 32,768 2005-09-22 21:28:56 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
—-a-w 118,784 2005-09-22 20:56:16 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\WebDev.WebServer.EXE
—-a-w 90,624 2004-08-04 10:00:00 C:\WINDOWS\mui\muisetup.exe
——w 568,832 2006-10-10 12:44:50 C:\WINDOWS\network diagnostic\xpnetdiag.exe
—-a-w 768,512 2004-08-04 10:00:00 C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
—-a-w 99,840 2004-08-04 10:00:00 C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.exe
—-a-w 18,944 2004-08-04 10:00:00 C:\WINDOWS\pchealth\helpctr\binaries\HscUpd.exe
—-a-w 158,208 2004-08-04 10:00:00 C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe
—-a-w 35,328 2004-08-04 10:00:00 C:\WINDOWS\pchealth\helpctr\binaries\notiflag.exe
—-a-w 150,528 2004-08-04 10:00:00 C:\WINDOWS\pchealth\UploadLB\Binaries\UploadM.exe
—-a-w 819,200 2004-09-22 08:46:04 C:\WINDOWS\RegisteredPackages\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}\setup_wm.exe
—-a-w 774,144 2004-08-04 10:00:00 C:\WINDOWS\RegisteredPackages\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}$BACKUP$\System\setup_wm.exe
—-a-w 47,104 2004-09-22 08:46:10 C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\uwdf.exe
—-a-w 38,912 2004-09-22 08:46:10 C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wdfmgr.exe
—-a-w 96,768 2004-09-22 08:45:44 C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\logagent.exe
—-a-w 103,936 2004-08-04 10:00:00 C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\logagent.exe
—-a-w 991,232 2004-09-22 08:45:46 C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\migrate.exe
—-a-w 192,512 2004-09-22 08:46:10 C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\unregmp2.exe
—-a-w 122,880 2004-09-22 08:46:14 C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\wmlaunch.exe
—-a-w 28,672 2004-09-22 08:46:20 C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\wmpenc.exe
—-a-w 73,728 2004-09-22 08:46:22 C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\wmplayer.exe
—-a-w 786,432 2004-08-04 10:00:00 C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\migrate.exe
—-a-w 208,896 2004-08-04 10:00:00 C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\unregmp2.exe
—-a-w 73,728 2004-08-04 10:00:00 C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\wmplayer.exe
—-a-w 557,568 2006-10-10 12:44:50 C:\WINDOWS\SoftwareDistribution\Downloadfacce6115ab861022eae3087e064a2a\SP2QFE\xpnetdg.exe
—-a-w 28,672 2006-03-17 00:38:01 C:\WINDOWS\SoftwareDistribution\Download\cb2769f3b1daf367a31ed046299a3790\sp2gdr\verclsid.exe
—-a-w 220,672 2004-08-04 10:00:00 C:\WINDOWS\system32\logon.scr
——w 485,376 2004-08-04 10:00:00 C:\WINDOWS\system32\mspaint.exe
—-a-w 704,512 2004-08-04 10:00:00 C:\WINDOWS\system32\ss3dfo.scr
—-a-w 393,216 2004-08-04 10:00:00 C:\WINDOWS\system32\ssflwbox.scr
—-a-w 47,104 2004-08-04 10:00:00 C:\WINDOWS\system32\ssmypics.scr
—-a-w 610,304 2004-08-04 10:00:00 C:\WINDOWS\system32\sspipes.scr
—-a-w 14,336 2004-08-04 10:00:00 C:\WINDOWS\system32\ssstars.scr
—-a-w 679,936 2004-08-04 10:00:00 C:\WINDOWS\system32\sstext3d.scr
—-a-w 14,336 2004-08-04 10:00:00 C:\WINDOWS\system32\svchost.exe
—-a-w 844,800 2007-07-22 08:39:27 C:\WINDOWS\system32\swreg.exe
—-a-w 939,538 2006-05-12 09:09:38 C:\WINDOWS\system32\C2MP\x264.exe
—-a-w 16,384 2007-09-25 16:43:53 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
—-a-w 32,768 2007-09-25 16:43:53 C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
—-a-w 32,768 2007-09-25 16:43:53 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
—-a-w 59,392 2007-09-21 01:29:00 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE51234567\adv735[2].exe
-c–a-w 61,495 2003-03-24 06:52:04 C:\WINDOWS\system32\dllcache\admin.exe
-c–a-w 300,544 2006-10-12 11:09:53 C:\WINDOWS\system32\dllcache\agentsvr.exe
-c–a-w 88,576 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\alg.exe
-c–a-w 74,240 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\asr_fmt.exe
-c–a-w 76,288 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\asr_ldm.exe
-c–a-w 55,296 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\attrib.exe
-c–a-w 86,609 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\bckgzm.exe
-c–a-w 53,760 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\change.exe
-c–a-w 59,904 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\chgport.exe
-c–a-w 55,296 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\chkntfs.exe
-c–a-w 86,607 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\chkrzm.exe
-c–a-w 77,312 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\clipsrv.exe
-c–a-w 83,968 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\cmmon32.exe
-c–a-w 107,520 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\cmstp.exe
-c–a-w 71,680 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\conime.exe
-c–a-w 583,680 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\dialer.exe
-c–a-w 49,152 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\dllhost.exe
-c–a-w 62,464 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\dvdupgrd.exe
-c–a-w 53,248 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\eventvwr.exe
-c–a-w 71,168 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\findstr.exe
-c–a-w 812,544 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\helpctr.exe
-c–a-w 69,632 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\icwrmind.exe
-c–a-w 118,784 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\icwtutor.exe
-c–a-w 113,152 2006-10-17 02:04:50 C:\WINDOWS\system32\dllcache\iedw.exe
-c—-w 25,088 2007-06-27 08:27:05 C:\WINDOWS\system32\dllcache\ieudinit.exe
-c–a-w 669,184 2007-06-27 08:27:30 C:\WINDOWS\system32\dllcache\iexplore.exe
-c–a-w 58,368 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\iisreset.exe
-c–a-w 194,048 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\imapi.exe
-c–a-w 352,313 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\imjpdct.exe
-c–a-w 250,245 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\imjpinst.exe
-c–a-w 103,936 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\imkrinst.exe
-c–a-w 220,672 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\logon.scr
-c–a-w 52,224 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\lpr.exe
-c–a-w 117,248 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\magnify.exe
-c–a-w 129,536 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\makecab.exe
-c–a-w 64,000 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\mqbkup.exe
-c–a-w 56,832 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\mrinfo.exe
-c–a-w 50,176 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\msdtc.exe
-c–a-w 171,520 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\mshearts.exe
-c–a-w 89,600 2006-10-17 01:56:10 C:\WINDOWS\system32\dllcache\mshta.exe
-c–a-w 83,968 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\msinfo32.exe
-c–a-w 72,192 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\msoobe.exe
-c–a-w 51,200 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\msswchx.exe
-c–a-w 48,128 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\nddeapir.exe
-c–a-w 79,360 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\notiflag.exe
-c–a-w 1,244,160 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ntbackup.exe
-c–a-w 170,496 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\nwscript.exe
-c–a-w 95,232 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\oobebaln.exe
-c–a-w 65,536 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\pathping.exe
-c–a-w 59,904 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\perfmon.exe
-c–a-w 61,952 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ping.exe
-c–a-w 114,176 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\pintlphr.exe
-c–a-w 54,272 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\query.exe
-c–a-w 55,808 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\rasautou.exe
-c–a-w 55,296 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\rasdial.exe
-c–a-w 66,048 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\rcp.exe
-c–a-w 47,616 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\regedt32.exe
-c–a-w 76,800 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\relog.exe
-c–a-w 57,856 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\rexec.exe
-c–a-w 68,608 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\rsmsink.exe
-c–a-w 77,312 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\rundll32.exe
-c–a-w 9,216 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\scrnsave.scr
-c–a-w 121,344 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\sdbinst.exe
-c–a-w 117,248 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\setup50.exe
-c–a-w 175,616 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\sndrec32.exe
-c–a-w 704,512 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ss3dfo.scr
-c–a-w 19,968 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ssbezier.scr
-c–a-w 393,216 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ssflwbox.scr
-c–a-w 20,992 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ssmarque.scr
-c–a-w 47,104 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ssmypics.scr
-c–a-w 18,944 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ssmyst.scr
-c–a-w 610,304 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\sspipes.scr
-c–a-w 14,336 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\ssstars.scr
-c–a-w 679,936 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\sstext3d.scr
-c–a-w 59,392 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\stimon.exe
-c–a-w 53,248 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\subst.exe
-c–a-w 150,528 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\sysocmgr.exe
-c–a-w 116,224 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\tasklist.exe
-c–a-w 59,392 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\taskman.exe
-c–a-w 180,224 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\taskmgr.exe
-c–a-w 105,984 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\tlntadmn.exe
-c–a-w 75,776 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\tracert6.exe
-c–a-w 58,880 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\tsdiscon.exe
-c–a-w 61,440 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\tsshutdn.exe
-c–a-w 361,472 2007-06-26 12:10:26 C:\WINDOWS\system32\dllcache\unregmp2.exe
-c–a-w 68,608 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\userinit.exe
-c–a-w 52,224 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\winhstb.exe
-c–a-w 164,352 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\winmine.exe
-c–a-w 240,640 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\wmiadap.exe
-c–a-w 258,560 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\wordpad.exe
-c–a-w 76,288 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\wpabaln.exe
-c–a-w 74,752 2004-08-04 10:00:00 C:\WINDOWS\system32\dllcache\xcopy.exe
—-a-w 118,784 2006-07-27 22:32:38 C:\WINDOWS\system32\Macromed\Shockwave 10\SwInit.exe
—-a-w 193,536 1999-06-25 00:55:30 C:\WINDOWS\system32\Macromed\Shockwave 10\UNWISE.EXE
—-a-w 60,928 2004-08-04 10:00:00 C:\WINDOWS\system32\wbem\unsecapp.exe
—-a-w 160,256 2004-08-04 10:00:00 C:\WINDOWS\system32\wbem\wbemtest.exe
—-a-w 402,944 2004-08-04 10:00:00 C:\WINDOWS\system32\wbem\wmic.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" []
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" []
"NVHotkey"="nvHotkey.dll" [2006-03-21 20:03 C:\WINDOWS\system32\nvhotkey.dll]
"DVDLauncher"="C:\Program Files\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-08-30 22:11]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" []
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" []
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-25 11:28]
"nwiz"="nwiz.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" []
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-18 19:41]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-02 07:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-02 07:22]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2006-11-30 20:49]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-06-12 17:33]
"SpeedswitchXP"="C:\Program Files\SpeedswitchXP\SpeedswitchXP.exe" []
"ICQ"="C:\Program Files\ICQ6\ICQ.exe" [2007-09-26 02:46]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-28 07:17]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
1.exe [2007-09-26 06:03:18]
2.exe~ [2007-09-26 06:03:24]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

C:\Documents and Settings\Tristan\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [2006-06-07 00:54:52]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
1.exe [2007-09-26 06:03:18]
2.exe~ [2007-09-26 06:03:24]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

R3 ICAM5USB;Intel® PC Camera CS110;C:\WINDOWS\system32\Drivers\ICAM5D2.sys
R3 portio;winThrottle PortIO Service;C:\WINDOWS\system32\DRIVERS\throttle.sys
S3 NTGUARD;NTGUARD;\??\C:\Program Files\Ikarus\virus utilities\bin\NTGUARD.SYS
S4 msvsmon80;Visual Studio 2005 Remote Debugger;"C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /service msvsmon80

.
Contents of the 'Scheduled Tasks' folder
"2007-09-24 23:13:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-26 20:48:22
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-26 20:49:19 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-26 20:49
C:\ComboFix2.txt … 2007-09-26 09:22
C:\ComboFix3.txt … 2007-09-26 06:01
.
— E O F —
Post #21
PERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/27/2007 at 01:11 AM

Application Version : 3.9.1008

Core Rules Database Version : 3313
Trace Rules Database Version: 1316

Scan type : Complete Scan
Total Scan Time : 04:03:28

Memory items scanned : 540
Memory threats detected : 0
Registry items scanned : 6152
Registry threats detected : 0
File items scanned : 186048
File threats detected : 13

Adware.Tracking Cookie
C:\Documents and Settings\Tristan\Cookies\tristan@adinterax[2].txt
C:\Documents and Settings\Tristan\Cookies\tristan@doubleclick[2].txt
C:\Documents and Settings\Tristan\Cookies\tristan@atdmt[2].txt
C:\Documents and Settings\Tristan\Cookies\tristan@imrworldwide[2].txt
C:\Documents and Settings\Tristan\Cookies\tristan@2o7[2].txt
C:\Documents and Settings\Tristan\Cookies\tristan@mediaplex[1].txt
C:\Documents and Settings\Tristan\Cookies\tristan@atwola[1].txt
C:\Documents and Settings\Tristan\Cookies\[removed]-sys[2].txt
C:\Documents and Settings\Tristan\Cookies\tristan@revsci[2].txt
C:\Documents and Settings\Tristan\Cookies\[removed][1].txt
C:\Documents and Settings\Tristan\Cookies\tristan@serving-sys[2].txt
C:\Documents and Settings\Tristan\Cookies\tristan@msnportal.112.2o7[1].txt

Adware.ClickSpring/Outer Info Network
C:\DOCUMENTS AND SETTINGS\TRISTAN\DESKTOP\OIUNINSTALLER.EXE


Logfile of HijackThis v1.99.1
Scan saved at 5:51:52 AM, on 9/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\PowerDVD\DVDLauncher.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\program files\mozilla firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
c:\program files\hijackthis\hijackthis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpeedswitchXP] C:\Program Files\SpeedswitchXP\SpeedswitchXP.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Tristan\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Tristan\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Program Files\PartyGaming\PartyGammon\RunBackGammon.exe
O9 - Extra 'Tools' menuitem: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Program Files\PartyGaming\PartyGammon\RunBackGammon.exe
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A16BB4EC-0357-4A91-83F7-3418EE3A6D2F}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB1046F5-2CFC-498B-8E58-9C657F86AA1A}: NameServer = 192.168.1.254
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleDesktopManager - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc32.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe (file missing)
Post #22
Hi

It appears some files are being recreated.
  • Download GMER by GMER from here
  • Unzip it to a folder on your desktop
  • Double click on gmer.exe to launch GMER
  • If asked, allow the gmer.sys driver load
  • If it warns you about rootkit activity and asks if you want to run scan, click OK
  • If you don't get a warning then
    • Click the rootkit tab
    • Click Scan
  • Once the scan has finished, click copy
  • Paste the log into notepad using Ctrl+V
  • Save it to your desktop as gmerrk.txt
  • Click on the >>> tab
  • This will open up the rest of the tabs for you
  • Click on the Autostart tab
  • Click on Scan
  • Once the scan has finished, click copy
  • Paste the log into notepad using Ctrl+V
  • Save it to your desktop as gmerautos.txt
  • Copy and paste the contents of gmerautos.txt and gmerrk.txt as a reply to this topic
Post #23
Here we go again! gmerrk.txt

GMER 1.0.13.12551 - http://www.gmer.net
Rootkit scan 2007-09-27 07:32:22
Windows 5.1.2600 Service Pack 2


—- System - GMER 1.0.13 —-

SSDT d347bus.sys ZwClose
SSDT d347bus.sys ZwCreateKey
SSDT d347bus.sys ZwCreatePagingFile
SSDT d347bus.sys ZwEnumerateKey
SSDT d347bus.sys ZwEnumerateValueKey
SSDT d347bus.sys ZwOpenKey
SSDT d347bus.sys ZwQueryKey
SSDT d347bus.sys ZwQueryValueKey
SSDT d347bus.sys ZwSetSystemPowerState

—- User code sections - GMER 1.0.13 —-

.text c:\documents and settings\tristan\desktop\gmer\gmer.exe[176] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text c:\documents and settings\tristan\desktop\gmer\gmer.exe[176] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\WINDOWS\system32\spoolsv.exe[240] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\WINDOWS\system32\spoolsv.exe[240] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\WINDOWS\system32\spoolsv.exe[240] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\WINDOWS\system32\spoolsv.exe[240] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[348] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[348] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[348] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[348] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\WINDOWS\Explorer.EXE[700] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\WINDOWS\Explorer.EXE[700] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\WINDOWS\Explorer.EXE[700] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\WINDOWS\Explorer.EXE[700] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\Program Files\AIM6\aolsoftware.exe[716] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\Program Files\AIM6\aolsoftware.exe[716] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\Program Files\AIM6\aolsoftware.exe[716] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\Program Files\AIM6\aolsoftware.exe[716] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\Program Files\AIM6\aim6.exe[856] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\Program Files\AIM6\aim6.exe[856] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\Program Files\AIM6\aim6.exe[856] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\Program Files\AIM6\aim6.exe[856] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[892] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[892] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[892] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[892] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\Program Files\PowerDVD\DVDLauncher.exe[992] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\Program Files\PowerDVD\DVDLauncher.exe[992] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\Program Files\PowerDVD\DVDLauncher.exe[992] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\Program Files\PowerDVD\DVDLauncher.exe[992] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[1004] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[1004] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[1004] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[1004] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe[1020] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe[1020] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe[1020] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe[1020] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\PROGRA~1\Grisoft\AVG7\avgemc.exe[1064] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\PROGRA~1\Grisoft\AVG7\avgemc.exe[1064] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\PROGRA~1\Grisoft\AVG7\avgemc.exe[1064] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\PROGRA~1\Grisoft\AVG7\avgemc.exe[1064] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe[1084] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe[1084] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe[1084] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe[1084] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\WINDOWS\system32\winlogon.exe[1176] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\WINDOWS\system32\winlogon.exe[1176] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\WINDOWS\system32\winlogon.exe[1176] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\WINDOWS\system32\winlogon.exe[1176] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\WINDOWS\system32\services.exe[1228] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\WINDOWS\system32\services.exe[1228] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\WINDOWS\system32\services.exe[1228] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\WINDOWS\system32\services.exe[1228] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe[1396] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe[1396] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe[1396] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe[1396] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\WINDOWS\system32\svchost.exe[1412] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\WINDOWS\system32\svchost.exe[1412] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\WINDOWS\system32\svchost.exe[1412] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\WINDOWS\system32\svchost.exe[1412] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\WINDOWS\system32\svchost.exe[1460] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\WINDOWS\system32\svchost.exe[1460] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\WINDOWS\system32\svchost.exe[1460] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\WINDOWS\system32\svchost.exe[1460] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\WINDOWS\system32\svchost.exe[1528] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\WINDOWS\system32\svchost.exe[1528] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\WINDOWS\system32\svchost.exe[1528] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\WINDOWS\system32\svchost.exe[1528] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[1604] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[1604] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[1604] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[1604] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\WINDOWS\System32\svchost.exe[1616] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\WINDOWS\System32\svchost.exe[1616] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\WINDOWS\System32\svchost.exe[1616] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\WINDOWS\System32\svchost.exe[1616] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\WINDOWS\system32\svchost.exe[1688] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\WINDOWS\system32\svchost.exe[1688] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\WINDOWS\system32\svchost.exe[1688] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\WINDOWS\system32\svchost.exe[1688] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\Program Files\iTunes\iTunesHelper.exe[1704] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\Program Files\iTunes\iTunesHelper.exe[1704] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\Program Files\iTunes\iTunesHelper.exe[1704] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\Program Files\iTunes\iTunesHelper.exe[1704] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\WINDOWS\system32\svchost.exe[1824] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\WINDOWS\system32\svchost.exe[1824] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\WINDOWS\system32\svchost.exe[1824] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\WINDOWS\system32\svchost.exe[1824] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\Program Files\Google\Google Talk\googletalk.exe[1896] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\Program Files\Google\Google Talk\googletalk.exe[1896] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\Program Files\Google\Google Talk\googletalk.exe[1896] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\Program Files\Google\Google Talk\googletalk.exe[1896] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1928] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1928] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1928] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1928] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1928] kernel32.dll!SetUnhandledExceptionFilter 7C84467D 5 Bytes JMP 004DE392 C:\Program Files\MSN Messenger\MsnMsgr.Exe
.text C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\Program Files\Skype\Phone\Skype.exe[2008] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\Program Files\Skype\Phone\Skype.exe[2008] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\Program Files\Skype\Phone\Skype.exe[2008] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\Program Files\Skype\Phone\Skype.exe[2008] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text c:\program files\mozilla firefox\firefox.exe[2128] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text c:\program files\mozilla firefox\firefox.exe[2128] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text c:\program files\mozilla firefox\firefox.exe[2128] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text c:\program files\mozilla firefox\firefox.exe[2128] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\WINDOWS\System32\alg.exe[2172] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\WINDOWS\System32\alg.exe[2172] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\WINDOWS\System32\alg.exe[2172] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\WINDOWS\System32\alg.exe[2172] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\WINDOWS\system32\wscntfy.exe[2424] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\WINDOWS\system32\wscntfy.exe[2424] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\WINDOWS\system32\wscntfy.exe[2424] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\WINDOWS\system32\wscntfy.exe[2424] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\Program Files\iPod\bin\iPodService.exe[2652] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\Program Files\iPod\bin\iPodService.exe[2652] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\Program Files\iPod\bin\iPodService.exe[2652] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\Program Files\iPod\bin\iPodService.exe[2652] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\WINDOWS\System32\svchost.exe[3160] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\WINDOWS\System32\svchost.exe[3160] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\WINDOWS\System32\svchost.exe[3160] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\WINDOWS\System32\svchost.exe[3160] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963
.text C:\Program Files\MSN Messenger\usnsvc.exe[3968] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA2916
.text C:\Program Files\MSN Messenger\usnsvc.exe[3968] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA296A
.text C:\Program Files\MSN Messenger\usnsvc.exe[3968] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2977
.text C:\Program Files\MSN Messenger\usnsvc.exe[3968] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes CALL 7FFA2963

—- User IAT/EAT - GMER 1.0.13 —-

IAT C:\Program Files\AIM6\aolsoftware.exe[716] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aolsoftware.exe[716] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aolsoftware.exe[716] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aolsoftware.exe[716] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aolsoftware.exe[716] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aolsoftware.exe[716] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aolsoftware.exe[716] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aolsoftware.exe[716] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aolsoftware.exe[716] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aolsoftware.exe[716] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aolsoftware.exe[716] @ C:\WINDOWS\system32\secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aolsoftware.exe[716] @ C:\WINDOWS\system32\secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aim6.exe[856] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aim6.exe[856] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aim6.exe[856] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aim6.exe[856] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aim6.exe[856] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aim6.exe[856] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aim6.exe[856] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aim6.exe[856] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aim6.exe[856] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aim6.exe[856] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aim6.exe[856] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aim6.exe[856] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aim6.exe[856] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aim6.exe[856] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aim6.exe[856] @ C:\WINDOWS\system32\wininet.dll [ADVAPI32.dll!RegQueryValueExA] [0109EAA2] c:\program files\aim6\services\imApp\ver6_1_41_2\imAppService.dll
IAT C:\Program Files\AIM6\aim6.exe[856] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\AIM6\aim6.exe[856] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [63602B3E] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [63602A5B] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [63602441] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [63602AA2] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [63602B3E] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [63602A5B] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [63602441] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [63602AA2] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [63602AE9] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [63602B3E] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [63602AA2] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [63602A5B] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [63602441] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!DefWindowProcA] [6360208F] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!DefWindowProcW] [63602065] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!GetSysColor] [63601FC4] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TrackPopupMenu] [636015C8] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TrackPopupMenuEx] [636015EF] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [63602A5B] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [63602AA2] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [63602441] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [63602B3E] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [63602AE9] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!AnimateWindow] [63601740] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TrackPopupMenuEx] [636015EF] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!DefWindowProcA] [6360208F] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetSysColor] [63601FC4] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!DefWindowProcW] [63602065] C:\Program Files\Yahoo!\Shared\YbSkin2.dll
IAT C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE[2000] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TrackPopupMenu] [636015C8] C:\Program Files\Yahoo!\Shared\YbSkin2.dll

Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 8675DBF8

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_NAMED_PIPE [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_READ [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_POWER [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA [F7B9F404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA [F7B9F404] avg7rsw.sys

Device \FileSystem\Fastfat \FatCdrom IRP_MJ_READ 8566FC20
Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_READ 861B40D8
Device \FileSystem\Udfs \UdfsDisk IRP_MJ_READ 861B40D8
Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [F7B4385A] avgtdi.sys

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_NAMED_PIPE [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CLOSE [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_READ [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_WRITE [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_INFORMATION [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_INFORMATION [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_EA [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_EA [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_FLUSH_BUFFERS [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_VOLUME_INFORMATION [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_VOLUME_INFORMATION [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DIRECTORY_CONTROL [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_FILE_SYSTEM_CONTROL [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CONTROL [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_INTERNAL_DEVICE_CONTROL [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SHUTDOWN [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_LOCK_CONTROL [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CLEANUP [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_MAILSLOT [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_SECURITY [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_SECURITY [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_POWER [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SYSTEM_CONTROL [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CHANGE [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_QUOTA [F5EE99D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_QUOTA [F5EE99D0] SynTP.sys
Post #24
Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [F7B4385A] avgtdi.sys Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_NAMED_PIPE 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_EA 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_EA 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_VOLUME_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_VOLUME_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DIRECTORY_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FILE_SYSTEM_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_LOCK_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLEANUP 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_MAILSLOT 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_SECURITY 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_SECURITY 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CHANGE 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_QUOTA 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_QUOTA 8619C7C8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 8619C7C8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_READ 85F5C620 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_NAMED_PIPE 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSE 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_READ 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_EA 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_EA 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_VOLUME_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_VOLUME_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DIRECTORY_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FILE_SYSTEM_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_LOCK_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLEANUP 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_MAILSLOT 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_SECURITY 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_SECURITY 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CHANGE 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_QUOTA 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_QUOTA 8619C7C8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 8619C7C8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE_NAMED_PIPE 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CLOSE 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_READ 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_WRITE 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_INFORMATION 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_INFORMATION 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_EA 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_EA 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_FLUSH_BUFFERS 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_VOLUME_INFORMATION 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_VOLUME_INFORMATION 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DIRECTORY_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_FILE_SYSTEM_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DEVICE_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_INTERNAL_DEVICE_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SHUTDOWN 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_LOCK_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CLEANUP 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE_MAILSLOT 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_SECURITY 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_SECURITY 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_POWER 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SYSTEM_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DEVICE_CHANGE 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_QUOTA 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_QUOTA 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_PNP 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_NAMED_PIPE 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLOSE 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_READ 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_WRITE 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_INFORMATION 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_INFORMATION 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_EA 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_EA 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FLUSH_BUFFERS 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_VOLUME_INFORMATION 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_VOLUME_INFORMATION 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DIRECTORY_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FILE_SYSTEM_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_INTERNAL_DEVICE_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SHUTDOWN 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_LOCK_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLEANUP 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_MAILSLOT 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_SECURITY 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_SECURITY 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_POWER 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SYSTEM_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CHANGE 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_QUOTA 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_QUOTA 8619C988 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_PNP 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE_NAMED_PIPE 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLOSE 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_READ 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_WRITE 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_INFORMATION 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_INFORMATION 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_EA 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_EA 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_FLUSH_BUFFERS 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_VOLUME_INFORMATION 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_VOLUME_INFORMATION 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DIRECTORY_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_FILE_SYSTEM_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_INTERNAL_DEVICE_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SHUTDOWN 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_LOCK_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLEANUP 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE_MAILSLOT 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_SECURITY 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_SECURITY 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_POWER 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SYSTEM_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CHANGE 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_QUOTA 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_QUOTA 8619C988 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_PNP 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_CREATE 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_CREATE_NAMED_PIPE 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_CLOSE 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_READ 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_WRITE 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_QUERY_INFORMATION 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_SET_INFORMATION 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_QUERY_EA 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_SET_EA 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_FLUSH_BUFFERS 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_QUERY_VOLUME_INFORMATION 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_SET_VOLUME_INFORMATION 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_DIRECTORY_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_FILE_SYSTEM_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_DEVICE_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_INTERNAL_DEVICE_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_SHUTDOWN 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_LOCK_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_CLEANUP 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_CREATE_MAILSLOT 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_QUERY_SECURITY 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_SET_SECURITY 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_POWER 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_SYSTEM_CONTROL 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_DEVICE_CHANGE 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_QUERY_QUOTA 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_SET_QUOTA 8619C988 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e IRP_MJ_PNP 8619C988 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE_NAMED_PIPE 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CLOSE 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_READ 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_WRITE 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_EA 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_EA 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_FLUSH_BUFFERS 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_VOLUME_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_VOLUME_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DIRECTORY_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_FILE_SYSTEM_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DEVICE_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_INTERNAL_DEVICE_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SHUTDOWN 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_LOCK_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CLEANUP 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE_MAILSLOT 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_SECURITY 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_SECURITY 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_POWER 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SYSTEM_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DEVICE_CHANGE 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_QUOTA 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_QUOTA 8619C7C8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_PNP 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_CREATE 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_CREATE_NAMED_PIPE 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_CLOSE 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_READ 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_WRITE 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_QUERY_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SET_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_QUERY_EA 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SET_EA 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_FLUSH_BUFFERS 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_QUERY_VOLUME_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SET_VOLUME_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_DIRECTORY_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_FILE_SYSTEM_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_DEVICE_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_INTERNAL_DEVICE_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SHUTDOWN 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_LOCK_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_CLEANUP 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_CREATE_MAILSLOT 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_QUERY_SECURITY 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SET_SECURITY 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_POWER 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SYSTEM_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_DEVICE_CHANGE 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_QUERY_QUOTA 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SET_QUOTA 8619C7C8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_PNP 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_CREATE 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_CREATE_NAMED_PIPE 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_CLOSE 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_READ 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_WRITE 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_QUERY_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_SET_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_QUERY_EA 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_SET_EA 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_FLUSH_BUFFERS 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_QUERY_VOLUME_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_SET_VOLUME_INFORMATION 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_DIRECTORY_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_FILE_SYSTEM_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_DEVICE_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_INTERNAL_DEVICE_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_SHUTDOWN 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_LOCK_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_CLEANUP 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_CREATE_MAILSLOT 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_QUERY_SECURITY 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_SET_SECURITY 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_POWER 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_SYSTEM_CONTROL 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_DEVICE_CHANGE 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_QUERY_QUOTA 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_SET_QUOTA 8619C7C8 Device \Driver\Cdrom \Device\CdRom4 IRP_MJ_PNP 8619C7C8 Device \FileSystem\Srv \Device\LanmanServer IRP_MJ_READ 8624D030 Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [F7B4385A] avgtdi.sys Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [F7B4385A] avgtdi.sys Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_READ 86752F60 Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_INTERNAL_DEVICE_CONTROL [F7B4385A] avgtdi.sys Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_READ 86752F60 Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_READ 860DE178 Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_READ 85F1F8D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_CREATE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_CREATE_NAMED_PIPE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_CLOSE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_READ 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_WRITE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_QUERY_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_SET_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_QUERY_EA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_SET_EA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_FLUSH_BUFFERS 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_QUERY_VOLUME_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_SET_VOLUME_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_DIRECTORY_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_FILE_SYSTEM_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_DEVICE_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_SHUTDOWN 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_LOCK_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_CLEANUP 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_CREATE_MAILSLOT 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_QUERY_SECURITY 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_SET_SECURITY 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_POWER 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_SYSTEM_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_DEVICE_CHANGE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_QUERY_QUOTA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_SET_QUOTA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_PNP 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_CREATE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_CREATE_NAMED_PIPE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_CLOSE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_READ 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_WRITE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_QUERY_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_SET_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_QUERY_EA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_SET_EA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_FLUSH_BUFFERS 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_QUERY_VOLUME_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_SET_VOLUME_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_DIRECTORY_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_FILE_SYSTEM_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_DEVICE_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_SHUTDOWN 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_LOCK_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_CLEANUP 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_CREATE_MAILSLOT 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_QUERY_SECURITY 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_SET_SECURITY 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_POWER 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_SYSTEM_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_DEVICE_CHANGE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_QUERY_QUOTA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_SET_QUOTA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target2Lun0 IRP_MJ_PNP 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_CREATE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_CREATE_NAMED_PIPE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_CLOSE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_READ 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_WRITE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_QUERY_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_SET_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_QUERY_EA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_SET_EA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_FLUSH_BUFFERS 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_QUERY_VOLUME_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_SET_VOLUME_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_DIRECTORY_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_FILE_SYSTEM_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_DEVICE_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_SHUTDOWN 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_LOCK_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_CLEANUP 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_CREATE_MAILSLOT 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_QUERY_SECURITY 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_SET_SECURITY 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_POWER 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_SYSTEM_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_DEVICE_CHANGE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_QUERY_QUOTA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_SET_QUOTA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target3Lun0 IRP_MJ_PNP 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_CREATE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_CREATE_NAMED_PIPE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_CLOSE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_READ 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_WRITE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_QUERY_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_SET_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_QUERY_EA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_SET_EA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_FLUSH_BUFFERS 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_QUERY_VOLUME_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_SET_VOLUME_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_DIRECTORY_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_FILE_SYSTEM_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_DEVICE_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_SHUTDOWN 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_LOCK_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_CLEANUP 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_CREATE_MAILSLOT 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_QUERY_SECURITY 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_SET_SECURITY 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_POWER 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_SYSTEM_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_DEVICE_CHANGE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_QUERY_QUOTA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_SET_QUOTA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target1Lun0 IRP_MJ_PNP 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CREATE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CREATE_NAMED_PIPE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CLOSE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_READ 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_WRITE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_EA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_EA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_FLUSH_BUFFERS 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_VOLUME_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_VOLUME_INFORMATION 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_DIRECTORY_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_FILE_SYSTEM_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_DEVICE_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_INTERNAL_DEVICE_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SHUTDOWN 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_LOCK_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CLEANUP 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CREATE_MAILSLOT 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_SECURITY 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_SECURITY 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_POWER 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SYSTEM_CONTROL 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_DEVICE_CHANGE 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_QUOTA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_QUOTA 861842D8 Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_PNP 861842D8 Device \FileSystem\Fastfat \Fat IRP_MJ_READ 8566FC20 AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE_NAMED_PIPE [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CLOSE [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_READ [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_WRITE [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_EA [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_INTERNAL_DEVICE_CONTROL [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE_MAILSLOT [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_SECURITY [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_SECURITY [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_POWER [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SYSTEM_CONTROL [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CHANGE [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_QUERY_QUOTA [F7B9F404] avg7rsw.sys AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_SET_QUOTA [F7B9F404] avg7rsw.sys Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer IRP_MJ_READ 8619D348 Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer IRP_MJ_READ 8619D348 Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer IRP_MJ_READ 8619D348 Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer IRP_MJ_READ 8619D348 Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer IRP_MJ_READ 8619D348 Device \FileSystem\Cdfs \Cdfs IRP_MJ_READ 862B53C8 —- Modules - GMER 1.0.13 —- Module _________ F744E000-F7466000 (98304 bytes) —- Registry - GMER 1.0.13 —- Reg \Registry\USER\S-1-5-21-1659004503-220523388-1417001333-1003\Software\SecuROM\!CAUTION! NEVER DELETE OR CHANGE ANY KEY@?? 0x84 0xD1 0x67 0xF7 … Reg \Registry\USER\S-1-5-21-1659004503-220523388-1417001333-1003\Software\SecuROM\!CAUTION! NEVER DELETE OR CHANGE ANY KEY@?? 0xD3 0x0B 0xFC 0x11 … —- EOF - GMER 1.0.13 —-
Post #25
And now for gmerautos.txt

GMER 1.0.13.12551 - http://www.gmer.net
Autostart scan 2007-09-27 07:35:33
Windows 5.1.2600 Service Pack 2


HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@Userinit = C:\WINDOWS\system32\userinit.exe,

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ >>>
!SASWinLogon@DLLName = C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
WgaLogon@DLLName = WgaLogon.dll

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs = C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

HKLM\SYSTEM\CurrentControlSet\Services\ >>>
Apple Mobile Device /*Apple Mobile Device*/@ = "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
Avg7Alrt /*AVG7 Alert Manager Server*/@ = C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
Avg7UpdSvc /*AVG7 Update Service*/@ = C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
AVGEMS /*AVG E-mail Scanner*/@ = C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
Bonjour Service /*##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##*/@ = "C:\Program Files\Bonjour\mDNSResponder.exe" /*file not found*/
EvtEng /*Intel® PROSet/Wireless Event Log*/@ = C:\Program Files\Intel\Wireless\Bin\EvtEng.exe /*file not found*/
NVSvc /*NVIDIA Display Driver Service*/@ = %SystemRoot%\system32\nvsvc32.exe /*file not found*/
RegSrvc /*Intel® PROSet/Wireless Registry Service*/@ = C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe /*file not found*/
S24EventMonitor /*Intel® PROSet/Wireless Service*/@ = C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe /*file not found*/
Spooler /*Print Spooler*/@ = %SystemRoot%\system32\spoolsv.exe
Viewpoint Manager Service /*Viewpoint Manager Service*/@ = "C:\Program Files\Viewpoint\Common\ViewpointService.exe"
WLANKEEPER /*Intel® PROSet/Wireless SSO Service*/@ = C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe /*file not found*/

HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@IntelZeroConfig"C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" /*file not found*/ = "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" /*file not found*/
@IntelWireless"C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless /*file not found*/ = "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless /*file not found*/
@NVHotkeyrundll32.exe nvHotkey.dll,Start = rundll32.exe nvHotkey.dll,Start
@DVDLauncher"C:\Program Files\PowerDVD\DVDLauncher.exe" = "C:\Program Files\PowerDVD\DVDLauncher.exe"
@SunJavaUpdateSched"C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" = "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
@TkBellExe"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
@DAEMON Tools-1033"C:\Program Files\D-Tools\daemon.exe" -lang 1033 /*file not found*/ = "C:\Program Files\D-Tools\daemon.exe" -lang 1033 /*file not found*/
@Google Desktop Search"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup /*file not found*/ = "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup /*file not found*/
@Adobe Photo Downloader"C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" = "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
@Adobe Reader Speed Launcher"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" = "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
@NvCplDaemonRUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
@nwiznwiz.exe /install /*file not found*/ = nwiz.exe /install /*file not found*/
@QuickTime Task"C:\Program Files\QuickTime\QTTask.exe" -atboottime /*file not found*/ = "C:\Program Files\QuickTime\QTTask.exe" -atboottime /*file not found*/
@iTunesHelper"C:\Program Files\iTunes\iTunesHelper.exe" = "C:\Program Files\iTunes\iTunesHelper.exe"
@AVG7_CCC:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP = C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
@googletalkC:\Program Files\Google\Google Talk\googletalk.exe /autostart /*file not found*/ = C:\Program Files\Google\Google Talk\googletalk.exe /autostart /*file not found*/

HKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>
@googletalk"C:\Program Files\Google\Google Talk\googletalk.exe" /autostart = "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
@MsnMsgr"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background = "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
@Yahoo! Pager"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet = "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
@Skype"C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized = "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
@SpeedswitchXPC:\Program Files\SpeedswitchXP\SpeedswitchXP.exe /*file not found*/ = C:\Program Files\SpeedswitchXP\SpeedswitchXP.exe /*file not found*/
@ICQ"C:\Program Files\ICQ6\ICQ.exe" silent = "C:\Program Files\ICQ6\ICQ.exe" silent
@ctfmon.exeC:\WINDOWS\system32\ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
@Aim6"C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp = "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
@SUPERAntiSpywareC:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe = C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

HKLM\Software\Classes\.exe@ = rundll32 ktaskr.dll,PreExec "%1" %*

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks@{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} = C:\Program Files\SUPERAntiSpyware\SASSEH.DLL

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*Display Panning CPL Extension*/deskpan.dll /*file not found*/ = deskpan.dll /*file not found*/
@{596AB062-B4D2-4215-9F74-E9109B0A8153} /*Previous Versions Property Page*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll
@{9DB7A13C-F208-4981-8353-73CC61AE2783} /*Previous Versions*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll
@{30D02401-6A81-11d0-8274-00C04FD5AE38} /*IE Search Band*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3028902F-6374-48b2-8DC6-9725E775B926} /*IE AutoComplete*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} /*Shell DocObject Viewer*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FBF23B40-E3F0-101B-8488-00AA003E56F8} /*InternetShortcut*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3C374A40-BAE4-11CF-BF7D-00AA006946EE} /*Microsoft Url History Service*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FF393560-C2A7-11CF-BFF4-444553540000} /*History*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{7BD29E00-76C1-11CF-9DD0-00A0C9034933} /*Temporary Internet Files*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{7BD29E01-76C1-11CF-9DD0-00A0C9034933} /*Temporary Internet Files*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{CFBFAE00-17A6-11D0-99CB-00C04FD64497} /*Microsoft Url Search Hook*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3DC7A020-0ACD-11CF-A9BB-00AA004AE837} /*The Internet*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{871C5380-42A0-1069-A2EA-08002B30309D} /*Internet Name Space*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} /*Autoplay for SlideShow*/(null) =
@{692F0339-CBAA-47e6-B5B5-3B84DB604E87} /*Extensions Manager Folder*/C:\WINDOWS\system32\extmgr.dll = C:\WINDOWS\system32\extmgr.dll
@{2F603045-309F-11CF-9774-0020AFD0CFF6} /*Synaptics Control Panel*/C:\Program Files\Synaptics\SynTP\SynTPCpl.dll = C:\Program Files\Synaptics\SynTP\SynTPCpl.dll
@{0561EC90-CE54-4f0c-9C55-E226110A740C} /*Haali Column Provider*/C:\WINDOWS\system32\mmfinfo.dll = C:\WINDOWS\system32\mmfinfo.dll
@{E4D8441D-F89C-4b5c-90AC-A857E1768F1F} /*Haali Matroska Thumbnail Exctractor*/(null) =
@{8FF88D21-7BD0-11D1-BFB7-00AA00262A11} /*WinAce Archiver 2.61 Context Menu Shell Extension*/(null) =
@{8FF88D25-7BD0-11D1-BFB7-00AA00262A11} /*WinAce Archiver 2.61 DragDrop Shell Extension*/(null) =
@{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} /*WinAce Archiver 2.61 Context Menu Shell Extension*/(null) =
@{8FF88D23-7BD0-11D1-BFB7-00AA00262A11} /*WinAce Archiver 2.61 Property Sheet Shell Extension*/(null) =
@{e82a2d71-5b2f-43a0-97b8-81be15854de8} /*ShellLink for Application References*/C:\WINDOWS\system32\dfshim.dll = C:\WINDOWS\system32\dfshim.dll
@{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} /*Shell Icon Handler for Application References*/C:\WINDOWS\system32\dfshim.dll = C:\WINDOWS\system32\dfshim.dll
@{BDEADF00-C265-11D0-BCED-00A0C90AB50F} /*Web Folders*/C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
@{0006F045-0000-0000-C000-000000000046} /*Microsoft Outlook Custom Icon Handler*/C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL = C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL
@{42042206-2D85-11D3-8CFF-005004838597} /*Microsoft Office HTML Icon Handler*/C:\Program Files\Microsoft Office\Office10\msohev.dll = C:\Program Files\Microsoft Office\Office10\msohev.dll
@{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} /*Shell Extensions for RealOne Player*/C:\Program Files\RealPlayer\rpshell.dll = C:\Program Files\RealPlayer\rpshell.dll
@{B41DB860-8EE4-11D2-9906-E49FADC173CA} /*WinRAR shell extension*/C:\Program Files\WinRAR\rarext.dll = C:\Program Files\WinRAR\rarext.dll
@{35786D3C-B075-49b9-88DD-029876E11C01} /*Portable Devices*/%SystemRoot%\system32\wpdshext.dll = %SystemRoot%\system32\wpdshext.dll
@{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8} /*Portable Devices Menu*/%SystemRoot%\system32\wpdshext.dll = %SystemRoot%\system32\wpdshext.dll
@{9999A076-A9E2-4C99-8A2B-632FC9429223} /*Bonjour*/C:\Program Files\Bonjour\ExplorerPlugin.dll = C:\Program Files\Bonjour\ExplorerPlugin.dll
@{28710882-150A-48A6-A858-2FC774BA822E} /*Viewpoint Photos Shell Extension*/C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\FotomatShellExt.dll = C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\FotomatShellExt.dll
@{967B2D40-8B7D-4127-9049-61EA0C2C6DCE} /*PowerISO*/C:\Program Files\PowerISO\PWRISOSH.DLL = C:\Program Files\PowerISO\PWRISOSH.DLL
@{A70C977A-BF00-412C-90B7-034C51DA2439} /*NvCpl DesktopContext Class*/C:\WINDOWS\system32\nvcpl.dll = C:\WINDOWS\system32\nvcpl.dll
@{FFB699E0-306A-11d3-8BD1-00104B6F7516} /*Play on my TV helper*/C:\WINDOWS\system32\nvcpl.dll = C:\WINDOWS\system32\nvcpl.dll
@{1CDB2949-8F65-4355-8456-263E7C208A5D} /*Desktop Explorer*/C:\WINDOWS\system32\nvshell.dll = C:\WINDOWS\system32\nvshell.dll
@{1E9B04FB-F9E5-4718-997B-B8DA88302A47} /*Desktop Explorer Menu*/C:\WINDOWS\system32\nvshell.dll = C:\WINDOWS\system32\nvshell.dll
@{1E9B04FB-F9E5-4718-997B-B8DA88302A48} /*nView Desktop Context Menu*/C:\WINDOWS\system32\nvshell.dll = C:\WINDOWS\system32\nvshell.dll
@{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} /*iTunes*/C:\Program Files\iTunes\iTunesMiniPlayer.dll = C:\Program Files\iTunes\iTunesMiniPlayer.dll
@{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} /*Messenger Sharing Folders*/C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll = C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll
@{07C45BB1-4A8C-4642-A1F5-237E7215FF66} /*IE Microsoft BrowserBand*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{1C1EDB47-CE22-4bbb-B608-77B48F83C823} /*IE Fade Task*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{205D7A97-F16D-4691-86EF-F3075DCCA57D} /*IE Menu Desk Bar*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{43886CD5-6529-41c4-A707-7B3C92C05E68} /*IE Navigation Bar*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{44C76ECD-F7FA-411c-9929-1B77BA77F524} /*IE Menu Site*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{4B78D326-D922-44f9-AF2A-07805C2A3560} /*IE Menu Band*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6038EF75-ABFC-4e59-AB6F-12D397F6568D} /*IE Microsoft History AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6B4ECC4F-16D1-4474-94AB-5A763F2A54AE} /*IE Tracking Shell Menu*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6CF48EF8-44CD-45d2-8832-A16EA016311B} /*IE IShellFolderBand*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{73CFD649-CD48-4fd8-A272-2070EA56526B} /*IE BandProxy*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{98FF6D4B-6387-4b0a-8FBD-C5C4BB17B4F8} /*IE MRU AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{9A096BB5-9DC3-4D1C-8526-C3CBF991EA4E} /*IE RSS Feeder Folder*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{9D958C62-3954-4b44-8FAB-C4670C1DB4C2} /*IE Microsoft Shell Folder AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{B31C5FAE-961F-415b-BAF0-E697A5178B94} /*IE Microsoft Multiple AutoComplete List Container*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{BC476F4C-D9D7-4100-8D4E-E043F6DEC409} /*Microsoft Browser Architecture*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{BFAD62EE-9D54-4b2a-BF3B-76F90697BD2A} /*IE Shell Rebar BandSite*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{E6EE9AAC-F76B-4947-8260-A9F136138E11} /*IE Shell Band Site Menu*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{F2CF5485-4E02-4f68-819C-B92DE9277049} /*&Links*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{F83DAC1C-9BB9-4f2b-B619-09819DA81B0E} /*IE Registry Tree Options Utility*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} /*IE User Assist*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FDE7673D-2E19-4145-8376-BBD58C4BC7BA} /*IE Custom MRU AutoCompleted List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} /*AVG7 Shell Extension*/C:\Program Files\Grisoft\AVG7\avgse.dll = C:\Program Files\Grisoft\AVG7\avgse.dll
@{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} /*AVG7 Find Extension*/C:\Program Files\Grisoft\AVG7\avgse.dll = C:\Program Files\Grisoft\AVG7\avgse.dll

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>
AVG7 Shell Extension@{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Program Files\Grisoft\AVG7\avgse.dll
PowerISO@{967B2D40-8B7D-4127-9049-61EA0C2C6DCE} = C:\Program Files\PowerISO\PWRISOSH.DLL
ViewpointPhotosExt@{28710882-150A-48A6-A858-2FC774BA822E} = C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\FotomatShellExt.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll

HKLM\Software\Classes\*\shellex\ContextMenuHandlers >>>
@{B95057E0-44DB-11CE-A5D1-00608C83BD3F}shellwp.dll = shellwp.dll
@{CA8ACAFA-5FBB-467B-B348-90DD488DE003}C:\Program Files\SUPERAntiSpyware\SASCTXMN.DLL = C:\Program Files\SUPERAntiSpyware\SASCTXMN.DLL

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ >>>
PowerISO@{967B2D40-8B7D-4127-9049-61EA0C2C6DCE} = C:\Program Files\PowerISO\PWRISOSH.DLL
QuickFinderMenu@{C0E10002-0028-0001-C0E1-C0E1C0E1C0E1} = C:\Corel\Suite8\Programs\PFSE80.DLL
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers@{CA8ACAFA-5FBB-467B-B348-90DD488DE003} = C:\Program Files\SUPERAntiSpyware\SASCTXMN.DLL

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ >>>
AVG7 Shell Extension@{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Program Files\Grisoft\AVG7\avgse.dll
PowerISO@{967B2D40-8B7D-4127-9049-61EA0C2C6DCE} = C:\Program Files\PowerISO\PWRISOSH.DLL
QuickFinderMenu@{C0E10002-0028-0001-C0E1-C0E1C0E1C0E1} = C:\Corel\Suite8\Programs\PFSE80.DLL
ViewpointPhotosExt@{28710882-150A-48A6-A858-2FC774BA822E} = C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\FotomatShellExt.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>>
@{02478D38-C3F9-4EFB-9B51-7695ECA05670}C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll = C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
@{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll = C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
@{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll = C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
@{A7327C09-B521-4EDB-8509-7D2660C9EC98}C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll = C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll

HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://go.microsoft.com/fwlink/?LinkId=69157 = http://go.microsoft.com/fwlink/?LinkId=69157
@Start Pagehttp://go.microsoft.com/fwlink/?LinkId=69157 = http://go.microsoft.com/fwlink/?LinkId=69157
@Local Page%SystemRoot%\system32\blank.htm = %SystemRoot%\system32\blank.htm

HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Start Pagehttp://www.google.com/ = http://www.google.com/
@Local Page\blank.htm = \blank.htm

HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
cdo@CLSID = C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
dvd@CLSID = C:\WINDOWS\system32\msvidctl.dll
its@CLSID = C:\WINDOWS\system32\itss.dll
livecall@CLSID = C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
mhtml@CLSID = %SystemRoot%\system32\inetcomm.dll
ms-help@CLSID = C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
ms-its@CLSID = C:\WINDOWS\system32\itss.dll
msnim@CLSID = C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
mso-offdap@CLSID = C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
tv@CLSID = C:\WINDOWS\system32\msvidctl.dll
wia@CLSID = C:\WINDOWS\system32\wiascr.dll

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A16BB4EC-0357-4A91-83F7-3418EE3A6D2F} /*Local Area Connection*/ >>>
@IPAddress192.168.1.20 = 192.168.1.20
@NameServer192.168.1.1 = 192.168.1.1
@DefaultGateway192.168.1.1 = 192.168.1.1
@Domain =

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DB1046F5-2CFC-498B-8E58-9C657F86AA1A} /*Wireless Network Connection*/ >>>
@IPAddress192.168.1.20 = 192.168.1.20
@NameServer192.168.1.254 = 192.168.1.254
@DefaultGateway192.168.1.254 = 192.168.1.254
@Domain =

HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\0000000004@LibraryPath = C:\Program Files\Bonjour\mdnsNSP.dll

C:\Documents and Settings\Tristan\Start Menu\Programs\Startup = PowerReg Scheduler V3.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup = Microsoft Office.lnk

—- EOF - GMER 1.0.13 —-
Post #26
Hmmm, nothing in there. Lets try killing them again.

Open Notepad and Copy/Paste the text in the codebox below into it: 

File::
C:\nawf.exe
C:\pqukg.exe 
C:\WINDOWS\system32\btaskv.dll
C:\uhded.exe
C:\fsbl.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\1.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\2.exe

Save this as "CFScript"

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log with a new HijackThis log.

Download ATF (Atribune Temp File) Cleaner� by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

*Note* If you do not have Firefox or Opera, those options will be greyed out.

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make sure that the following are selected:
    • Scan using the following Anti-Virus database:

      + Extended(If available otherwise Standard)
    • Scan Options:

      + Scan Archives
      + Scan Mail Bases
  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
Post #27
Hi Scotty, why would this kapersky scan be different to the last? Won't it just be another 5000 entries of win32.virut.q, which I won't be able to realistically paste? I also added a couple other files in c:\ that I'd checked with virustotal and had been identified as virut.q

ComboFix 07-09-26 - Tristan 2007-09-27 9:01:44.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.233 [GMT 10:00]
Running from: c:\documents and settings\[removed]\desktop\combofix.exe
Command switches used :: C:\Documents and Settings\Tristan\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\nawf.exe
C:\rkburvxa.exe
C:\pgwgygwn.exe
C:\uvbbeuu.exe
C:\pqukg.exe
C:\WINDOWS\system32\btaskv.dll
C:\uhded.exe
C:\fsbl.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\1.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\2.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\fsbl.exe
C:\nawf.exe
C:\pgwgygwn.exe
C:\pqukg.exe
C:\rkburvxa.exe
C:\uhded.exe
C:\uvbbeuu.exe
C:\WINDOWS\system32\btaskv.dll
C:\WINDOWS\system32\ktaskr.dll

.
((((((((((((((((((((((((( Files Created from 2007-08-26 to 2007-09-26 )))))))))))))))))))))))))))))))
.

2007-09-27 09:12 53,248 –a—— C:\pgwgygwn.exe
2007-09-27 09:12 5,632 –a—— C:\rkburvxa.exe
2007-09-27 09:12 45,016 –a—— C:\WINDOWS\system32\btaskv.dll
2007-09-27 09:12 28,160 –a—— C:\uvbbeuu.exe
2007-09-26 21:03 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-09-26 21:02 d——– C:\Program Files\SUPERAntiSpyware
2007-09-26 21:02 d——– C:\Documents and Settings\Tristan\Application Data\SUPERAntiSpyware.com
2007-09-26 20:43 94 –a—— C:\WINDOWS\system32\conf.dat
2007-09-26 19:06 76,288 –a—— C:\WINDOWS\system32\RLDDI.DLL
2007-09-26 19:06 76,288 –a—— C:\WINDOWS\system32\RLDDF.DLL
2007-09-26 19:06 d——– C:\WINDOWS\system32\RL
2007-09-26 18:32 d——– C:\games
2007-09-26 18:19 92,208 –a—— C:\WINDOWS\system32\WING.DLL
2007-09-26 09:43 92,208 –a—— C:\WINDOWS\system\WING.DLL
2007-09-26 09:43 76,288 –a—— C:\WINDOWS\system\RLDDI.DLL
2007-09-26 09:43 76,288 –a—— C:\WINDOWS\system\RLDDF.DLL
2007-09-26 09:43 253,952 –a—— C:\WINDOWS\system\MSVCRT20.DLL
2007-09-26 09:43 188,960 –a—— C:\WINDOWS\system\WINGDE.DLL
2007-09-26 09:43 12,800 –a—— C:\WINDOWS\system\WING32.DLL
2007-09-26 09:43 d——– C:\WINDOWS\system\RL
2007-09-26 09:43 d——– C:\Program Files\OG
2007-09-26 09:42 310,784 –a—— C:\WINDOWS\uninst.exe
2007-09-26 09:41 d——– C:\Warhummer
2007-09-26 09:35 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-09-26 09:35 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-09-25 19:12 d——– C:\WINDOWS\ERUNT
2007-09-25 03:58 62,464 –a—— C:\WINDOWS\NirCmd.exe
2007-09-19 17:44 d——– C:\Program Files\NoAdware5.0
2007-09-18 18:26 d–h—– C:\WINDOWS\system32\GroupPolicy
2007-09-18 18:04 77,824 –a—— C:\WINDOWS\system32\rundll32.exe
2007-09-18 07:00 2,829 –a—— C:\WINDOWS\W2BNEUnin.pif
2007-09-18 07:00 19,840 –a—— C:\WINDOWS\W2BNEUnin.dat
2007-09-18 06:58 d——– C:\Program Files\Warcraft II BNE
2007-09-18 06:43 d——– C:\Warcraft II BNE
2007-09-18 01:17 d——– C:\WARCRAFT
2007-09-14 21:28 d——– C:\Program Files\Black Isle
2007-09-06 15:39 d——– C:\Program Files\AIM6
2007-09-04 15:58 d——– C:\WIZWORX
2007-09-04 15:58 d——– C:\POOLRAD
2007-09-03 01:46 d——– C:\EYE3
2007-09-03 01:46 d——– C:\EYE2
2007-09-03 01:46 d——– C:\EYE1
2007-08-31 01:45 d——– C:\Documents and Settings\Tristan\.housecall6.6

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-27 09:12 ——— d——– C:\Program Files\ICQ6
2007-09-27 09:12 ——— d——– C:\Documents and Settings\Tristan\Application Data\Skype
2007-09-26 21:02 ——— d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-09-26 20:23 ——— d——– C:\Program Files\OCTGN
2007-09-25 06:43 ——— d——– C:\Program Files\SPSSEval
2007-09-23 05:24 ——— d——– C:\Documents and Settings\Tristan\Application Data\Azureus
2007-09-23 02:22 ——— d——– C:\Program Files\Azureus
2007-09-19 07:32 ——— d——– C:\Program Files\YahELite
2007-09-19 07:31 ——— d——– C:\Program Files\SpeedswitchXP
2007-09-19 07:31 ——— d——– C:\Program Files\QuickTime
2007-09-19 07:31 ——— d——– C:\Program Files\PowerISO
2007-09-19 07:31 ——— d——– C:\Program Files\D-Tools
2007-09-19 07:31 ——— d——– C:\Program Files\Bonjour
2007-09-19 05:28 ——— d——– C:\Program Files\WoWed
2007-09-18 22:46 ——— d——– C:\Program Files\eMule
2007-09-17 01:34 ——— d——– C:\Program Files\Apple Software Update
2007-09-15 01:02 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-09-06 16:07 ——— d——– C:\Documents and Settings\All Users\Application Data\AOL
2007-09-06 16:06 ——— d——– C:\Program Files\Common Files\AOL
2007-09-06 15:32 ——— d——– C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-08-29 01:31 ——— d——– C:\Program Files\LimeWire
2007-08-21 15:27 ——— d——– C:\Program Files\MSN Messenger
2007-08-18 18:36 ——— d——– C:\Program Files\Fallout2
2007-08-16 12:12 ——— d——– C:\Program Files\MSXML 6.0
2007-08-14 16:07 ——— d——– C:\Documents and Settings\Tristan\Application Data\vlc
2007-08-14 16:06 ——— d——– C:\Program Files\VideoLAN
2007-08-13 18:47 ——— d——– C:\Program Files\Microsoft Device Emulator
2007-08-13 18:46 ——— d——– C:\Program Files\Microsoft SQL Server 2005 Mobile Edition
2007-08-13 18:42 ——— d——– C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-08-13 18:40 ——— d——– C:\Program Files\Microsoft Visual Studio 8
2007-08-13 18:40 ——— d——– C:\Program Files\CE Remote Tools
2007-08-10 21:25 ——— d——– C:\Program Files\iTunes
2007-08-10 21:25 ——— d——– C:\Program Files\iPod
2007-08-05 21:45 ——— d——– C:\Documents and Settings\Tristan\Application Data\Media Center Programs
2007-08-05 21:19 ——— d——– C:\Documents and Settings\Tristan\Application Data\InstallShield Installation Information
2007-08-02 20:39 ——— d——– C:\Program Files\Command & Conquer The First Decade
2007-07-29 13:21 ——— d——– C:\Documents and Settings\All Users\Application Data\FLEXnet
2007-04-29 00:14 26 –a—— C:\Documents and Settings\Tristan\p.bat
.

((((((((((((((((((((((((((((( snapshot_2007-09-26_ 60030.32 )))))))))))))))))))))))))))))))))))))))))
.
—-a-w 123,392 2007-07-19 14:47:22 C:\WINDOWS\catchme.exe
—-a-w 585,791 2007-09-26 21:18:25 C:\WINDOWS\gmer.dll
—-a-r 724,992 2007-06-28 23:38:18 C:\WINDOWS\gmer.exe
—-a-w 280,064 2004-10-14 00:36:18 C:\WINDOWS\$hf_mig$\KB873339\spuninst.exe
—-a-w 698,880 2004-10-14 00:34:54 C:\WINDOWS\$hf_mig$\KB873339\update\update.exe
—-a-w 214,016 2004-11-30 10:22:42 C:\WINDOWS\$hf_mig$\KB885250\spuninst.exe
—-a-w 698,880 2004-11-30 04:46:40 C:\WINDOWS\$hf_mig$\KB885250\update\update.exe
—-a-w 214,016 2004-10-14 01:36:18 C:\WINDOWS\$hf_mig$\KB885835\spuninst.exe
—-a-w 666,112 2004-10-14 01:34:54 C:\WINDOWS\$hf_mig$\KB885835\update\update.exe
—-a-w 280,064 2004-10-14 01:36:18 C:\WINDOWS\$hf_mig$\KB885836\spuninst.exe
—-a-w 698,880 2004-10-14 01:34:54 C:\WINDOWS\$hf_mig$\KB885836\update\update.exe
—-a-w 214,016 2004-10-14 18:36:16 C:\WINDOWS\$hf_mig$\KB886185\spuninst.exe
—-a-w 666,112 2004-10-14 18:34:52 C:\WINDOWS\$hf_mig$\KB886185\update\update.exe
—-a-w 246,784 2004-10-14 01:36:18 C:\WINDOWS\$hf_mig$\KB887472\spuninst.exe
—-a-w 1,705,472 2004-10-13 16:21:24 C:\WINDOWS\$hf_mig$\KB887472\SP2QFE\msmsgs.exe
—-a-w 666,112 2004-10-14 01:34:54 C:\WINDOWS\$hf_mig$\KB887472\update\update.exe
—-a-w 181,248 2004-10-14 00:36:18 C:\WINDOWS\$hf_mig$\KB887742\spuninst.exe
—-a-w 764,928 2004-10-14 00:34:54 C:\WINDOWS\$hf_mig$\KB887742\update\update.exe
—-a-w 246,784 2004-10-14 00:36:18 C:\WINDOWS\$hf_mig$\KB888113\spuninst.exe
—-a-w 731,648 2004-10-14 00:34:54 C:\WINDOWS\$hf_mig$\KB888113\update\update.exe
—-a-w 181,248 2004-11-30 10:22:42 C:\WINDOWS\$hf_mig$\KB888302\spuninst.exe
—-a-w 698,880 2004-11-30 04:46:40 C:\WINDOWS\$hf_mig$\KB888302\update\update.exe
—-a-w 280,064 2004-11-30 10:22:42 C:\WINDOWS\$hf_mig$\KB891781\spuninst.exe
—-a-w 698,880 2004-11-30 04:46:40 C:\WINDOWS\$hf_mig$\KB891781\update\update.exe
—-a-w 74,752 2005-07-07 09:27:08 C:\WINDOWS\$hf_mig$\KB893756\update\arpidfix.exe
—-a-w 22,016 2005-05-26 23:26:50 C:\WINDOWS\$hf_mig$\KB896358\SP2QFE\hh.exe
—-a-w 101,888 2005-06-11 00:17:13 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
—-a-w 75,264 2005-06-29 06:54:32 C:\WINDOWS\$hf_mig$\KB896423\update\arpidfix.exe
—-a-w 75,264 2005-10-05 06:39:46 C:\WINDOWS\$hf_mig$\KB896424\update\arpidfix.exe
—-a-w 87,040 2005-05-10 23:51:10 C:\WINDOWS\$hf_mig$\KB896428\SP2QFE\telnet.exe
—-a-w 74,752 2005-06-29 06:54:32 C:\WINDOWS\$hf_mig$\KB899587\update\arpidfix.exe
—-a-w 74,752 2005-08-17 06:38:14 C:\WINDOWS\$hf_mig$\KB899589\update\arpidfix.exe
—-a-w 41,984 2005-06-29 06:54:32 C:\WINDOWS\$hf_mig$\KB899591\update\arpidfix.exe
—-a-w 74,752 2005-09-26 07:36:24 C:\WINDOWS\$hf_mig$\KB900725\update\arpidfix.exe
—-a-w 41,984 2005-09-09 06:26:26 C:\WINDOWS\$hf_mig$\KB901017\update\arpidfix.exe
—-a-w 52,736 2005-07-25 23:42:35 C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\migregdb.exe
—-a-w 74,752 2005-07-25 09:21:18 C:\WINDOWS\$hf_mig$\KB902400\update\arpidfix.exe
—-a-w 41,984 2005-08-19 23:50:31 C:\WINDOWS\$hf_mig$\KB905414\update\arpidfix.exe
—-a-w 74,752 2005-08-22 08:01:30 C:\WINDOWS\$hf_mig$\KB905749\update\arpidfix.exe
—-a-w 39,936 2006-03-17 01:05:35 C:\WINDOWS\$hf_mig$\KB908531\SP2QFE\verclsid.exe
—-a-w 29,696 2006-03-04 01:34:41 C:\WINDOWS\$hf_mig$\KB912812\SP2QFE\iedw.exe
—-a-w 62,464 2006-05-09 11:41:31 C:\WINDOWS\$hf_mig$\KB916281\SP2QFE\iedw.exe
—-a-w 62,464 2006-06-23 08:48:30 C:\WINDOWS\$hf_mig$\KB918899\SP2QFE\iedw.exe
—-a-w 300,544 2006-10-12 11:54:07 C:\WINDOWS\$hf_mig$\KB920213\SP2QFE\agentsvr.exe
.
—-a-w 109,056 2007-07-19 14:47:22 C:\WINDOWS\catchme.exe
—-a-w 169,984 2004-10-14 00:36:18 C:\WINDOWS\$hf_mig$\KB873339\spuninst.exe
—-a-w 654,848 2004-10-14 00:34:54 C:\WINDOWS\$hf_mig$\KB873339\update\update.exe
—-a-w 169,984 2004-11-30 10:22:42 C:\WINDOWS\$hf_mig$\KB885250\spuninst.exe
—-a-w 654,848 2004-11-30 04:46:40 C:\WINDOWS\$hf_mig$\KB885250\update\update.exe
—-a-w 169,984 2004-10-14 01:36:18 C:\WINDOWS\$hf_mig$\KB885835\spuninst.exe
—-a-w 654,848 2004-10-14 01:34:54 C:\WINDOWS\$hf_mig$\KB885835\update\update.exe
—-a-w 169,984 2004-10-14 01:36:18 C:\WINDOWS\$hf_mig$\KB885836\spuninst.exe
—-a-w 654,848 2004-10-14 01:34:54 C:\WINDOWS\$hf_mig$\KB885836\update\update.exe
—-a-w 169,984 2004-10-14 18:36:16 C:\WINDOWS\$hf_mig$\KB886185\spuninst.exe
—-a-w 654,848 2004-10-14 18:34:52 C:\WINDOWS\$hf_mig$\KB886185\update\update.exe
—-a-w 169,984 2004-10-14 01:36:18 C:\WINDOWS\$hf_mig$\KB887472\spuninst.exe
—-a-w 1,694,208 2004-10-13 16:21:24 C:\WINDOWS\$hf_mig$\KB887472\SP2QFE\msmsgs.exe
—-a-w 654,848 2004-10-14 01:34:54 C:\WINDOWS\$hf_mig$\KB887472\update\update.exe
—-a-w 169,984 2004-10-14 00:36:18 C:\WINDOWS\$hf_mig$\KB887742\spuninst.exe
—-a-w 654,848 2004-10-14 00:34:54 C:\WINDOWS\$hf_mig$\KB887742\update\update.exe
—-a-w 169,984 2004-10-14 00:36:18 C:\WINDOWS\$hf_mig$\KB888113\spuninst.exe
—-a-w 654,848 2004-10-14 00:34:54 C:\WINDOWS\$hf_mig$\KB888113\update\update.exe
—-a-w 169,984 2004-11-30 10:22:42 C:\WINDOWS\$hf_mig$\KB888302\spuninst.exe
—-a-w 654,848 2004-11-30 04:46:40 C:\WINDOWS\$hf_mig$\KB888302\update\update.exe
—-a-w 169,984 2004-11-30 10:22:42 C:\WINDOWS\$hf_mig$\KB891781\spuninst.exe
—-a-w 654,848 2004-11-30 04:46:40 C:\WINDOWS\$hf_mig$\KB891781\update\update.exe
—-a-w 30,720 2005-07-07 09:27:08 C:\WINDOWS\$hf_mig$\KB893756\update\arpidfix.exe
—-a-w 10,752 2005-05-26 23:26:50 C:\WINDOWS\$hf_mig$\KB896358\SP2QFE\hh.exe
—-a-w 57,856 2005-06-11 00:17:13 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
—-a-w 30,720 2005-06-29 06:54:32 C:\WINDOWS\$hf_mig$\KB896423\update\arpidfix.exe
—-a-w 30,720 2005-10-05 06:39:46 C:\WINDOWS\$hf_mig$\KB896424\update\arpidfix.exe
—-a-w 75,776 2005-05-10 23:51:10 C:\WINDOWS\$hf_mig$\KB896428\SP2QFE\telnet.exe
—-a-w 30,720 2005-06-29 06:54:32 C:\WINDOWS\$hf_mig$\KB899587\update\arpidfix.exe
—-a-w 30,720 2005-08-17 06:38:14 C:\WINDOWS\$hf_mig$\KB899589\update\arpidfix.exe
—-a-w 30,720 2005-06-29 06:54:32 C:\WINDOWS\$hf_mig$\KB899591\update\arpidfix.exe
—-a-w 30,720 2005-09-26 07:36:24 C:\WINDOWS\$hf_mig$\KB900725\update\arpidfix.exe
—-a-w 30,720 2005-09-09 06:26:26 C:\WINDOWS\$hf_mig$\KB901017\update\arpidfix.exe
—-a-w 8,704 2005-07-25 23:42:35 C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\migregdb.exe
—-a-w 30,720 2005-07-25 09:21:18 C:\WINDOWS\$hf_mig$\KB902400\update\arpidfix.exe
—-a-w 30,720 2005-08-19 23:50:31 C:\WINDOWS\$hf_mig$\KB905414\update\arpidfix.exe
—-a-w 30,720 2005-08-22 08:01:30 C:\WINDOWS\$hf_mig$\KB905749\update\arpidfix.exe
—-a-w 28,672 2006-03-17 01:05:35 C:\WINDOWS\$hf_mig$\KB908531\SP2QFE\verclsid.exe
—-a-w 18,432 2006-03-04 01:34:41 C:\WINDOWS\$hf_mig$\KB912812\SP2QFE\iedw.exe
—-a-w 18,432 2006-05-09 11:41:31 C:\WINDOWS\$hf_mig$\KB916281\SP2QFE\iedw.exe
—-a-w 18,432 2006-06-23 08:48:30 C:\WINDOWS\$hf_mig$\KB918899\SP2QFE\iedw.exe
—-a-w 256,512 2006-10-12 11:54:07 C:\WINDOWS\$hf_mig$\KB920213\SP2QFE\agentsvr.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" []
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" []
"NVHotkey"="nvHotkey.dll" [2006-03-21 20:03 C:\WINDOWS\system32\nvhotkey.dll]
"DVDLauncher"="C:\Program Files\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-08-30 22:11]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" []
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" []
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-25 11:28]
"nwiz"="nwiz.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" []
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-18 19:41]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-02 07:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-02 07:22]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2006-11-30 20:49]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-06-12 17:33]
"SpeedswitchXP"="C:\Program Files\SpeedswitchXP\SpeedswitchXP.exe" []
"ICQ"="C:\Program Files\ICQ6\ICQ.exe" [2007-09-26 20:58]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-28 07:17]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

C:\Documents and Settings\Tristan\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [2006-06-07 00:54:52]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

R3 ICAM5USB;Intel® PC Camera CS110;C:\WINDOWS\system32\Drivers\ICAM5D2.sys
R3 portio;winThrottle PortIO Service;C:\WINDOWS\system32\DRIVERS\throttle.sys
S3 NTGUARD;NTGUARD;\??\C:\Program Files\Ikarus\virus utilities\bin\NTGUARD.SYS
S4 msvsmon80;Visual Studio 2005 Remote Debugger;"C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /service msvsmon80

.
Contents of the 'Scheduled Tasks' folder
"2007-09-24 23:13:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-27 09:12:08
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2007-09-27 9:15:17 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-27 09:14
C:\ComboFix2.txt … 2007-09-27 05:49
C:\ComboFix3.txt … 2007-09-26 09:22
.
— E O F —
Post #28
Logfile of HijackThis v1.99.1
Scan saved at 9:18:32 AM, on 9/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\PowerDVD\DVDLauncher.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ICQ6\ICQ.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\usnsvc.exe
c:\program files\mozilla firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpeedswitchXP] C:\Program Files\SpeedswitchXP\SpeedswitchXP.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Tristan\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Tristan\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Program Files\PartyGaming\PartyGammon\RunBackGammon.exe
O9 - Extra 'Tools' menuitem: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Program Files\PartyGaming\PartyGammon\RunBackGammon.exe
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A16BB4EC-0357-4A91-83F7-3418EE3A6D2F}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB1046F5-2CFC-498B-8E58-9C657F86AA1A}: NameServer = 192.168.1.254
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleDesktopManager - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc32.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe (file missing)
Post #29
Well kapersky only turned up 2500 infected files this time around. What would you like me to do with the 540kb text file? I could email it to you if you like.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI