What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Repost: Trojan downloader problem

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
So sorry jpshortstuff, i wasnt able to follow up on my last thread, i've been away. anyway here is the result of my new Hijackthis scan

Logfile of HijackThis v1.99.1
Scan saved at 11:08:44 PM, on 2007-10-22
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\DetectorApp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\X3watch\x3watch.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\ChikkaLauncher.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\USBDeviceService.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\progra~1\common~1\instal~1\update~1\isuspm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\DetectorApp.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [x3watch] C:\Program Files\X3watch\x3watch.exe
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [ChikkaDefault] C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\ChikkaLauncher.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\USBDeviceService.exe

any help is greatly apprecaited, thanks!
Post #2
Hi, and Welcome to WhatTheTech :)

My name is jpshortstuff. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:
  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
As I am still training here, my posts to you will be checked by an Expert member. This will ensure that all advice and instructions I give you are accurate and safe. This may mean that my replies may take a little longer.


Show all hidden files:
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.
Please do not delete anything unless instructed to.

Next, rename HijackThis.exe to scanner.exe.
Scan again with HijackThis, and "copy/paste" a new log file into this thread.

Then I will analyze your log and sort out a fix for you :)

Also please describe how your computer behaves at the moment.


jpshortstuff
Post #3
good day! Thanks.

this is my scanner log.
:unsure: :unsure: :unsure:
Logfile of HijackThis v1.99.1
Scan saved at 11:52:09 PM, on 2007-10-23
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\DetectorApp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\X3watch\x3watch.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\ChikkaLauncher.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\USBDeviceService.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HijackThis\Scanner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2CC0C396-FEF7-4388-A5F8-0C5EBF985BFE} - C:\WINDOWS\System32\vtstr.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\DetectorApp.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [x3watch] C:\Program Files\X3watch\x3watch.exe
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [ChikkaDefault] C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\ChikkaLauncher.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O20 - Winlogon Notify: awttrpq - awttrpq.dll (file missing)
O20 - Winlogon Notify: awtuttr - awtuttr.dll (file missing)
O20 - Winlogon Notify: cbxusro - cbxusro.dll (file missing)
O20 - Winlogon Notify: cbxvttq - cbxvttq.dll (file missing)
O20 - Winlogon Notify: cbxyxvv - cbxyxvv.dll (file missing)
O20 - Winlogon Notify: fccaxus - fccaxus.dll (file missing)
O20 - Winlogon Notify: fccdeca - fccdeca.dll (file missing)
O20 - Winlogon Notify: gebbcaw - gebbcaw.dll (file missing)
O20 - Winlogon Notify: gebcaya - gebcaya.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: iiffcaa - iiffcaa.dll (file missing)
O20 - Winlogon Notify: jkkjihh - jkkjihh.dll (file missing)
O20 - Winlogon Notify: ljjkjjg - ljjkjjg.dll (file missing)
O20 - Winlogon Notify: nnnnmmm - nnnnmmm.dll (file missing)
O20 - Winlogon Notify: pmnljhh - pmnljhh.dll (file missing)
O20 - Winlogon Notify: rqrqonk - rqrqonk.dll (file missing)
O20 - Winlogon Notify: rqrsssq - rqrsssq.dll (file missing)
O20 - Winlogon Notify: ssqnmli - ssqnmli.dll (file missing)
O20 - Winlogon Notify: tuvvtts - tuvvtts.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O20 - Winlogon Notify: xxyaabc - xxyaabc.dll (file missing)
O20 - Winlogon Notify: yaywutr - yaywutr.dll (file missing)
O20 - Winlogon Notify: yayxvwt - yayxvwt.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\USBDeviceService.exe

Thanks for the help!
Post #5
Hi radjap


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.



Download ComboFix by sUBs from here or here

**Save it to your desktop**

Double click on ComboFix.exe & follow the prompts.
When finished, it shall produce a log for you. Please save that log to post in your next reply along with a fresh HJT log

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Thanks,

jpshortstuff
Post #6
Here is my Combofix log
ComboFix 07-10-23.2 - HP 2007-10-24 23:16:41.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.186 [GMT 9:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\check_LSA7.txt
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\cyeiwdim.dll
C:\WINDOWS\system32\edopuvkf.dll
C:\WINDOWS\system32\eodbmrpm.dll
C:\WINDOWS\system32\lsxlrpyr.dll
C:\WINDOWS\system32\midwieyc.ini
C:\WINDOWS\system32\mprmbdoe.ini
C:\WINDOWS\system32\rtstv.bak1
C:\WINDOWS\system32\rtstv.bak2
C:\WINDOWS\system32\rtstv.ini
C:\WINDOWS\system32\rtstv.ini2
C:\WINDOWS\system32\rtstv.tmp
C:\WINDOWS\system32\rxiwcxwo.dll
C:\WINDOWS\system32\uerfrodb.dll
C:\WINDOWS\system32\vtstr.dll

.
((((((((((((((((((((((((( Files Created from 2007-09-24 to 2007-10-24 )))))))))))))))))))))))))))))))
.

2007-10-24 23:15 84,544 –a—— C:\WINDOWS\system32\fvqpyesy.dll
2007-10-16 22:43 d——– C:\Program Files\BillP Studios
2007-10-16 22:43 d——– C:\Documents and Settings\HP\Application Data\WinPatrol
2007-09-29 07:57 d——– C:\Program Files\iPod

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-29 00:25 ——— d—–w C:\Program Files\iTunes
2007-09-22 11:55 ——— d—–w C:\Program Files\e-Sword
2007-09-08 01:46 ——— d—–w C:\Program Files\Apple Software Update
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"@"="" []
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2005-05-19 03:29]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2003-10-08 12:40]
"DetectorApp"="C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\DetectorApp.exe" [2005-10-20 23:15]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-18 12:29 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-28 09:50]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-28 09:50]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-07-17 06:01]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]
"x3watch"="C:\Program Files\X3watch\x3watch.exe" [2007-05-03 07:40]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 23:59]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42]
"WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2007-09-24 02:30]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2003-04-01 04:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-11-16 08:18]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 23:59]
"ChikkaDefault"="C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\ChikkaLauncher.exe" [2007-04-11 19:40]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
@=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awttrpq]
awttrpq.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtuttr]
awtuttr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxusro]
cbxusro.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxvttq]
cbxvttq.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxyxvv]
cbxyxvv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccaxus]
fccaxus.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccdeca]
fccdeca.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebbcaw]
gebbcaw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebcaya]
gebcaya.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iiffcaa]
iiffcaa.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkjihh]
jkkjihh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjkjjg]
ljjkjjg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnnnmmm]
nnnnmmm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnljhh]
pmnljhh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrqonk]
rqrqonk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrsssq]
rqrsssq.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqnmli]
ssqnmli.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvvtts]
tuvvtts.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxyaabc]
xxyaabc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yaywutr]
yaywutr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yayxvwt]
yayxvwt.dll

R1 BUFADPT;BUFADPT;\??\C:\WINDOWS\System32\BUFADPT.SYS
S3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\System32\DRIVERS\snp2sxp.sys
S3 U2SG54HP;BUFFALO WLI-U2-SG54HP Wireless LAN Driver;C:\WINDOWS\System32\DRIVERS\U2SG54HP.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-09-27 12:57:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-24 23:19:21
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe?????????A?p?????????? ???B?????????????hLC? ??????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-24 23:20:50 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-10-16 23:07
C:\ComboFix2.txt … 2007-10-16 23:07
C:\ComboFix3.txt … 2007-10-03 22:40
.
— E O F —


Here is my new HJT log
Logfile of HijackThis v1.99.1
Scan saved at 10:25:06 PM, on 2007-10-25
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\DetectorApp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\X3watch\x3watch.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\ChikkaLauncher.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\USBDeviceService.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\DetectorApp.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [x3watch] C:\Program Files\X3watch\x3watch.exe
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [ChikkaDefault] C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\ChikkaLauncher.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O20 - Winlogon Notify: awttrpq - awttrpq.dll (file missing)
O20 - Winlogon Notify: awtuttr - awtuttr.dll (file missing)
O20 - Winlogon Notify: cbxusro - cbxusro.dll (file missing)
O20 - Winlogon Notify: cbxvttq - cbxvttq.dll (file missing)
O20 - Winlogon Notify: cbxyxvv - cbxyxvv.dll (file missing)
O20 - Winlogon Notify: fccaxus - fccaxus.dll (file missing)
O20 - Winlogon Notify: fccdeca - fccdeca.dll (file missing)
O20 - Winlogon Notify: gebbcaw - gebbcaw.dll (file missing)
O20 - Winlogon Notify: gebcaya - gebcaya.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: iiffcaa - iiffcaa.dll (file missing)
O20 - Winlogon Notify: jkkjihh - jkkjihh.dll (file missing)
O20 - Winlogon Notify: ljjkjjg - ljjkjjg.dll (file missing)
O20 - Winlogon Notify: nnnnmmm - nnnnmmm.dll (file missing)
O20 - Winlogon Notify: pmnljhh - pmnljhh.dll (file missing)
O20 - Winlogon Notify: rqrqonk - rqrqonk.dll (file missing)
O20 - Winlogon Notify: rqrsssq - rqrsssq.dll (file missing)
O20 - Winlogon Notify: ssqnmli - ssqnmli.dll (file missing)
O20 - Winlogon Notify: tuvvtts - tuvvtts.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O20 - Winlogon Notify: xxyaabc - xxyaabc.dll (file missing)
O20 - Winlogon Notify: yaywutr - yaywutr.dll (file missing)
O20 - Winlogon Notify: yayxvwt - yayxvwt.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\USBDeviceService.exe

thanks for the help!
Post #7
radjap,

Just letting you know, we're still looking into a couple of entries in your log.

Sorry about the delays, we'll try and get the fix posted as soon as possible.

Thanks for your understanding,

jpshortstuff
Post #8
Hi radjap

Sorry again, for the delays :(


You need to disable TeaTimer, so that it doesn't interfere with our fix.

This is a two step process.
First step:
  • Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
  • If you have the new version 1.5, click once on Resident Protection, then right-click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
  • If you have Version 1.4, Click on Exit Spybot S&D Resident
Second step, For both versions :
  • Open Spybot S&D
  • Click Mode, choose Advanced Mode
  • Go to the bottom of the vertical panel on the left, click Tools
  • Then, also in left panel, click Resident shows a red/white shield.
  • If your firewall raises a question, say OK
  • In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
  • OK any prompts.
  • Use File, Exit to terminate Spybot
  • Reboot your machine for the changes to take effect.

1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\system32\fvqpyesy.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}] 
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awttrpq]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtuttr]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxusro]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxvttq]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxyxvv]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccaxus]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccdeca]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebbcaw]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebcaya]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iiffcaa]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkjihh]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjkjjg]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnnnmmm]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnljhh]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrqonk]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrsssq]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqnmli]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvvtts]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxyaabc]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yaywutr]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yayxvwt]


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. Make sure your computer reboots at this point - if ComboFix doesn't do it, please do it manually.



Please do an online scan with Kaspersky WebScanner

Follow this link in Internet Explorer (Note: You must use Internet explorer to use Kaspersky): Kaspersky WebScanner

You will be prompted to install an ActiveX component from Kaspersky,
Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make sure that the following are selected:
    o Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    o Scan Options:
    Scan Archives Scan Mail Bases
  • Click OK
  • Now under select a target to scan:
    Select My Computer
  • The program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    o Now click on the Save as Text button:
  • Save the file to your desktop.
In your next reply:
  • Include the ComboFix log
  • Include a fresh HijackThis log
  • Include the results of the Kaspersky scan
  • Please describe how you computer is behaving now
Thanks,

jpshortstuff
Post #9
Hi! Thanks for the instructions and help.Here are my new logs.



ComboFix 07-10-23.2 - HP 2007-10-29 20:30:33.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.72 [GMT 9:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\HP\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\system32\fvqpyesy.dll
.

((((((((((((((((((((((((( Files Created from 2007-09-28 to 2007-10-29 )))))))))))))))))))))))))))))))
.

2007-10-28 01:30 d——– C:\Program Files\EA SPORTS
2007-10-16 22:43 d——– C:\Program Files\BillP Studios
2007-10-16 22:43 d——– C:\Documents and Settings\HP\Application Data\WinPatrol
2007-09-29 07:57 d——– C:\Program Files\iPod

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-29 00:25 ——— d—–w C:\Program Files\iTunes
2007-09-22 11:55 ——— d—–w C:\Program Files\e-Sword
2007-09-08 01:46 ——— d—–w C:\Program Files\Apple Software Update
2007-07-30 10:19 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-07-30 10:19 549,720 —-a-w C:\WINDOWS\system32\wuapi.dll
2007-07-30 10:19 53,080 —-a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-30 10:19 43,352 —-a-w C:\WINDOWS\system32\wups2.dll
2007-07-30 10:19 325,976 —-a-w C:\WINDOWS\system32\wucltui.dll
2007-07-30 10:19 203,096 —-a-w C:\WINDOWS\system32\wuweb.dll
2007-07-30 10:19 1,712,984 —-a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-30 10:18 33,624 —-a-w C:\WINDOWS\system32\wups.dll
.

((((((((((((((((((((((((((((( snapshot@2007-10-24_23.20.15.70 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-07-08 19:26:38 11,392 —-a-w C:\WINDOWS\Driver Cache\i386\bdasup.sys
+ 2004-07-08 19:26:38 16,384 —-a-w C:\WINDOWS\Driver Cache\i386\ccdecode.sys
+ 2002-12-11 15:14:32 130,304 —-a-w C:\WINDOWS\Driver Cache\i386\ks.sys
+ 2002-12-11 15:14:32 4,096 —-a-w C:\WINDOWS\Driver Cache\i386\ksuser.dll
+ 2004-07-08 19:26:38 15,104 —-a-w C:\WINDOWS\Driver Cache\i386\mpe.sys
+ 2004-07-08 19:26:38 52,096 —-a-w C:\WINDOWS\Driver Cache\i386\msdv.sys
+ 2002-12-11 15:14:32 7,424 —-a-w C:\WINDOWS\Driver Cache\i386\mskssrv.sys
+ 2002-12-11 15:14:32 5,248 —-a-w C:\WINDOWS\Driver Cache\i386\mspclock.sys
+ 2001-08-22 20:00:00 4,608 —-a-w C:\WINDOWS\Driver Cache\i386\mspqm.sys
+ 2002-12-11 15:14:32 5,504 —-a-w C:\WINDOWS\Driver Cache\i386\mstee.sys
+ 2004-07-08 19:26:38 16,896 —-a-w C:\WINDOWS\Driver Cache\i386\msyuv.dll
+ 2004-07-08 19:26:38 83,968 —-a-w C:\WINDOWS\Driver Cache\i386\nabtsfec.sys
+ 2004-07-08 19:26:38 10,112 —-a-w C:\WINDOWS\Driver Cache\i386\ndisip.sys
+ 2002-08-28 18:41:00 31,744 —-a-w C:\WINDOWS\Driver Cache\i386\pid.dll
+ 2004-07-08 19:26:40 354,816 —-a-w C:\WINDOWS\Driver Cache\i386\psisdecd.dll
+ 2004-07-08 19:26:40 10,880 —-a-w C:\WINDOWS\Driver Cache\i386\slip.sys
+ 2004-07-08 19:27:28 48,512 —-a-w C:\WINDOWS\Driver Cache\i386\stream.sys
+ 2004-07-08 19:26:40 14,976 —-a-w C:\WINDOWS\Driver Cache\i386\streamip.sys
+ 2002-12-11 15:14:32 4,096 —-a-w C:\WINDOWS\Driver Cache\i386\swenum.sys
+ 2004-07-08 19:26:40 18,688 —-a-w C:\WINDOWS\Driver Cache\i386\wstcodec.sys
+ 2003-03-31 19:00:00 63,488 —-a-w C:\WINDOWS\LastGood\System32\amstream.dll
+ 2003-03-31 19:00:00 1,180,672 —-a-w C:\WINDOWS\LastGood\System32\d3d8.dll
+ 2003-03-31 19:00:00 8,192 —-a-w C:\WINDOWS\LastGood\System32\d3d8thk.dll
+ 2003-03-31 19:00:00 436,224 —-a-w C:\WINDOWS\LastGood\System32\d3dim.dll
+ 2003-03-31 19:00:00 791,040 —-a-w C:\WINDOWS\LastGood\System32\d3dim700.dll
+ 2003-03-31 19:00:00 34,816 —-a-w C:\WINDOWS\LastGood\System32\d3dpmesh.dll
+ 2003-03-31 19:00:00 590,336 —-a-w C:\WINDOWS\LastGood\System32\d3dramp.dll
+ 2003-03-31 19:00:00 350,208 —-a-w C:\WINDOWS\LastGood\System32\d3drm.dll
+ 2003-03-31 19:00:00 47,616 —-a-w C:\WINDOWS\LastGood\System32\d3dxof.dll
+ 2003-03-31 19:00:00 253,440 —-a-w C:\WINDOWS\LastGood\System32\ddraw.dll
+ 2003-03-31 19:00:00 24,064 —-a-w C:\WINDOWS\LastGood\System32\ddrawex.dll
+ 2003-03-31 19:00:00 51,712 —-a-w C:\WINDOWS\LastGood\System32\devenum.dll
+ 2003-03-31 19:00:00 394,240 —-a-w C:\WINDOWS\LastGood\System32\diactfrm.dll
+ 2003-03-31 19:00:00 44,032 —-a-w C:\WINDOWS\LastGood\System32\dimap.dll
+ 2003-03-31 19:00:00 151,552 —-a-w C:\WINDOWS\LastGood\System32\dinput.dll
+ 2003-03-31 19:00:00 168,960 —-a-w C:\WINDOWS\LastGood\System32\dinput8.dll
+ 2002-12-11 15:14:32 64,512 —-a-w C:\WINDOWS\LastGood\System32\DllCache\amstream.dll
+ 2004-07-08 19:27:28 1,201,152 —-a-w C:\WINDOWS\LastGood\System32\DllCache\d3d8.dll
+ 2002-12-11 15:14:32 8,192 —-a-w C:\WINDOWS\LastGood\System32\DllCache\d3d8thk.dll
+ 2003-03-31 19:00:00 436,224 —-a-w C:\WINDOWS\LastGood\System32\DllCache\d3dim.dll
+ 2003-05-30 00:00:02 797,184 —-a-w C:\WINDOWS\LastGood\System32\DllCache\d3dim700.dll
+ 2003-03-31 19:00:00 34,816 —-a-w C:\WINDOWS\LastGood\System32\DllCache\d3dpmesh.dll
+ 2003-03-31 19:00:00 590,336 —-a-w C:\WINDOWS\LastGood\System32\DllCache\d3dramp.dll
+ 2003-03-31 19:00:00 350,208 —-a-w C:\WINDOWS\LastGood\System32\DllCache\d3drm.dll
+ 2003-03-31 19:00:00 47,616 —-a-w C:\WINDOWS\LastGood\System32\DllCache\d3dxof.dll
+ 2004-07-08 19:27:28 292,864 —-a-w C:\WINDOWS\LastGood\System32\DllCache\ddraw.dll
+ 2002-12-11 15:14:32 24,064 —-a-w C:\WINDOWS\LastGood\System32\DllCache\ddrawex.dll
+ 2003-03-31 19:00:00 51,712 —-a-w C:\WINDOWS\LastGood\System32\DllCache\devenum.dll
+ 2003-03-31 19:00:00 394,240 —-a-w C:\WINDOWS\LastGood\System32\DllCache\diactfrm.dll
+ 2003-03-31 19:00:00 44,032 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dimap.dll
+ 2003-03-31 19:00:00 151,552 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dinput.dll
+ 2003-03-31 19:00:00 168,960 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dinput8.dll
+ 2002-12-11 15:14:32 27,136 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dmband.dll
+ 2002-12-11 15:14:32 58,368 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dmcompos.dll
+ 2004-07-08 19:27:28 181,248 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dmime.dll
+ 2002-12-11 15:14:32 33,280 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dmloader.dll
+ 2002-12-11 15:14:32 76,800 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dmscript.dll
+ 2002-12-11 15:14:32 98,816 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dmstyle.dll
+ 2002-12-11 15:14:32 100,864 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dmsynth.dll
+ 2004-07-08 19:27:28 122,880 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dmusic.dll
+ 2002-12-11 15:14:32 28,160 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dplaysvr.exe
+ 2004-07-08 19:27:28 230,400 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dplayx.dll
+ 2002-12-11 15:14:32 77,824 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dpmodemx.dll
+ 2002-12-11 15:14:32 3,072 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dpnaddr.dll
+ 2002-12-11 15:14:32 723,968 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dpnet.dll
+ 2003-03-24 00:00:02 32,768 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dpnhpast.dll
+ 2003-03-31 19:00:00 56,320 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dpnhupnp.dll
+ 2002-12-11 15:14:32 3,072 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dpnlobby.dll
+ 2002-12-11 15:14:32 16,896 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dpnsvr.exe
+ 2002-12-11 15:14:32 19,968 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dpvacm.dll
+ 2002-12-11 15:14:32 381,952 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dpvoice.dll
+ 2002-12-11 15:14:32 80,896 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dpvsetup.exe
+ 2002-12-11 15:14:32 112,128 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dpvvox.dll
+ 2004-07-08 19:27:28 79,360 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dpwsockx.dll
+ 2002-12-11 15:14:32 186,880 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dsdmo.dll
+ 2002-12-11 15:14:32 491,520 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dsdmoprp.dll
+ 2003-03-31 19:00:00 338,944 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dsound.dll
+ 2002-12-11 15:14:32 1,294,336 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dsound3d.dll
+ 2002-12-11 15:14:32 18,432 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dswave.dll
+ 2002-12-11 15:14:32 602,624 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dx7vb.dll
+ 2003-05-30 00:00:02 1,189,888 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dx8vb.dll
+ 2003-03-31 19:00:00 10,496 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dxapi.sys
+ 2004-07-08 19:27:28 974,848 —-a-w C:\WINDOWS\LastGood\System32\DllCache\dxdiag.exe
+ 2003-03-31 19:00:00 76,800 —-a-w C:\WINDOWS\LastGood\System32\DllCache\gcdef.dll
+ 2002-12-11 15:14:32 34,304 —-a-w C:\WINDOWS\LastGood\System32\DllCache\mciqtz32.dll
+ 2003-03-31 19:00:00 11,264 —-a-w C:\WINDOWS\LastGood\System32\DllCache\msdmo.dll
+ 2003-03-31 19:00:00 1,220,608 —-a-w C:\WINDOWS\LastGood\System32\DllCache\msvidctl.dll
+ 2002-12-11 15:14:32 324,096 —-a-w C:\WINDOWS\LastGood\System32\DllCache\mswebdvd.dll
+ 2004-08-11 09:45:04 221,184 —-a-w C:\WINDOWS\LastGood\System32\DllCache\qasf.dll
+ 2002-12-11 15:14:32 257,024 —-a-w C:\WINDOWS\LastGood\System32\DllCache\qcap.dll
+ 2004-07-08 19:27:28 316,928 —-a-w C:\WINDOWS\LastGood\System32\DllCache\qdv.dll
+ 2004-07-08 19:27:28 470,528 —-a-w C:\WINDOWS\LastGood\System32\DllCache\qdvd.dll
+ 2002-12-11 15:14:32 1,798,144 —-a-w C:\WINDOWS\LastGood\System32\DllCache\qedit.dll
+ 2002-12-11 15:14:32 733,184 —-a-w C:\WINDOWS\LastGood\System32\DllCache\qedwipes.dll
+ 2005-08-30 04:02:45 1,158,656 —-a-w C:\WINDOWS\LastGood\System32\DllCache\quartz.dll
+ 2003-03-31 19:00:00 46,080 —-a-w C:\WINDOWS\LastGood\System32\DllCache\wstdecod.dll
+ 2003-03-31 19:00:00 26,112 —-a-w C:\WINDOWS\LastGood\System32\dmband.dll
+ 2003-03-31 19:00:00 57,344 —-a-w C:\WINDOWS\LastGood\System32\dmcompos.dll
+ 2003-03-31 19:00:00 172,544 —-a-w C:\WINDOWS\LastGood\System32\dmime.dll
+ 2003-03-31 19:00:00 31,744 —-a-w C:\WINDOWS\LastGood\System32\dmloader.dll
+ 2003-03-31 19:00:00 77,312 —-a-w C:\WINDOWS\LastGood\System32\dmscript.dll
+ 2003-03-31 19:00:00 110,080 —-a-w C:\WINDOWS\LastGood\System32\dmstyle.dll
+ 2003-03-31 19:00:00 99,840 —-a-w C:\WINDOWS\LastGood\System32\dmsynth.dll
+ 2003-03-31 19:00:00 94,720 —-a-w C:\WINDOWS\LastGood\System32\dmusic.dll
+ 2003-03-31 19:00:00 26,112 —-a-w C:\WINDOWS\LastGood\System32\dplaysvr.exe
+ 2003-03-31 19:00:00 212,992 —-a-w C:\WINDOWS\LastGood\System32\dplayx.dll
+ 2003-03-31 19:00:00 20,992 —-a-w C:\WINDOWS\LastGood\System32\dpmodemx.dll
+ 2003-03-31 19:00:00 26,112 —-a-w C:\WINDOWS\LastGood\System32\dpnaddr.dll
+ 2003-03-31 19:00:00 156,672 —-a-w C:\WINDOWS\LastGood\System32\dpnet.dll
+ 2003-03-31 19:00:00 29,696 —-a-w C:\WINDOWS\LastGood\System32\dpnhpast.dll
+ 2003-03-31 19:00:00 56,320 —-a-w C:\WINDOWS\LastGood\System32\dpnhupnp.dll
+ 2003-03-31 19:00:00 38,400 —-a-w C:\WINDOWS\LastGood\System32\dpnlobby.dll
+ 2003-03-31 19:00:00 18,944 —-a-w C:\WINDOWS\LastGood\System32\dpnsvr.exe
+ 2003-03-31 19:00:00 24,064 —-a-w C:\WINDOWS\LastGood\System32\dpvacm.dll
+ 2003-03-31 19:00:00 206,336 —-a-w C:\WINDOWS\LastGood\System32\dpvoice.dll
+ 2003-03-31 19:00:00 58,368 —-a-w C:\WINDOWS\LastGood\System32\dpvsetup.exe
+ 2003-03-31 19:00:00 113,152 —-a-w C:\WINDOWS\LastGood\System32\dpvvox.dll
+ 2003-03-31 19:00:00 49,664 —-a-w C:\WINDOWS\LastGood\System32\dpwsockx.dll
+ 2002-08-29 08:33:24 16,384 —-a-w C:\WINDOWS\LastGood\System32\DRIVERS\ccdecode.sys
+ 2003-03-31 19:00:00 10,496 —-a-w C:\WINDOWS\LastGood\System32\DRIVERS\dxapi.sys
+ 2002-08-29 09:27:12 7,040 —-a-w C:\WINDOWS\LastGood\System32\DRIVERS\mskssrv.sys
+ 2001-08-17 21:48:42 5,120 —-a-w C:\WINDOWS\LastGood\System32\DRIVERS\mspclock.sys
+ 2001-08-17 21:48:46 4,608 —-a-w C:\WINDOWS\LastGood\System32\DRIVERS\mspqm.sys
+ 2002-08-29 08:27:12 4,992 —-a-w C:\WINDOWS\LastGood\System32\DRIVERS\mstee.sys
+ 2001-08-17 21:07:30 83,712 —-a-w C:\WINDOWS\LastGood\System32\DRIVERS\nabtsfec.sys
+ 2001-08-17 21:07:06 8,064 —-a-w C:\WINDOWS\LastGood\System32\DRIVERS\ndisip.sys
+ 2001-08-17 21:07:12 10,752 —-a-w C:\WINDOWS\LastGood\System32\DRIVERS\slip.sys
+ 2002-08-29 09:32:34 44,416 —-a-w C:\WINDOWS\LastGood\System32\DRIVERS\stream.sys
+ 2001-08-17 21:07:06 14,592 —-a-w C:\WINDOWS\LastGood\System32\DRIVERS\streamip.sys
+ 2003-03-31 19:00:00 3,840 —-a-w C:\WINDOWS\LastGood\System32\DRIVERS\swenum.sys
+ 2001-08-17 21:07:22 18,560 —-a-w C:\WINDOWS\LastGood\System32\DRIVERS\wstcodec.sys
+ 2003-03-31 19:00:00 165,888 —-a-w C:\WINDOWS\LastGood\System32\dsdmo.dll
+ 2003-03-31 19:00:00 66,560 —-a-w C:\WINDOWS\LastGood\System32\dsdmoprp.dll
+ 2003-03-31 19:00:00 338,944 —-a-w C:\WINDOWS\LastGood\System32\dsound.dll
+ 2003-03-31 19:00:00 1,293,824 —-a-w C:\WINDOWS\LastGood\System32\dsound3d.dll
+ 2003-03-31 19:00:00 16,896 —-a-w C:\WINDOWS\LastGood\System32\dswave.dll
+ 2003-03-31 19:00:00 595,456 —-a-w C:\WINDOWS\LastGood\System32\dx7vb.dll
+ 2003-03-31 19:00:00 1,185,792 —-a-w C:\WINDOWS\LastGood\System32\dx8vb.dll
+ 2003-03-31 19:00:00 786,432 —-a-w C:\WINDOWS\LastGood\System32\dxdiag.exe
+ 2003-03-31 19:00:00 12,288 —-a-w C:\WINDOWS\LastGood\System32\encapi.dll
+ 2003-03-31 19:00:00 76,800 —-a-w C:\WINDOWS\LastGood\System32\gcdef.dll
+ 2003-03-31 19:00:00 33,280 —-a-w C:\WINDOWS\LastGood\System32\mciqtz32.dll
+ 2003-03-31 19:00:00 11,264 —-a-w C:\WINDOWS\LastGood\System32\msdmo.dll
+ 2003-03-31 19:00:00 1,220,608 —-a-w C:\WINDOWS\LastGood\System32\msvidctl.dll
+ 2003-03-31 19:00:00 192,512 —-a-w C:\WINDOWS\LastGood\System32\mswebdvd.dll
+ 2003-03-31 19:00:00 31,744 —-a-w C:\WINDOWS\LastGood\System32\pid.dll
+ 2004-08-11 09:45:04 221,184 —-a-w C:\WINDOWS\LastGood\System32\qasf.dll
+ 2003-03-31 19:00:00 184,832 —-a-w C:\WINDOWS\LastGood\System32\qcap.dll
+ 2003-03-31 19:00:00 266,752 —-a-w C:\WINDOWS\LastGood\System32\qdv.dll
+ 2003-03-31 19:00:00 357,376 —-a-w C:\WINDOWS\LastGood\System32\qdvd.dll
+ 2003-03-31 19:00:00 511,488 —-a-w C:\WINDOWS\LastGood\System32\qedit.dll
+ 2003-03-31 19:00:00 734,208 —-a-w C:\WINDOWS\LastGood\System32\qedwipes.dll
+ 2005-08-30 04:02:45 1,158,656 —-a-w C:\WINDOWS\LastGood\System32\quartz.dll
+ 2003-03-31 19:00:00 46,080 —-a-w C:\WINDOWS\LastGood\System32\wstdecod.dll
+ 2002-12-11 15:14:32 64,512 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\amstream.dll
+ 2004-07-08 19:27:28 1,201,152 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\d3d8.dll
+ 2002-12-11 15:14:32 8,192 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\d3d8thk.dll
+ 2003-05-30 00:00:02 797,184 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\d3dim700.dll
+ 2004-07-08 19:27:28 292,864 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\ddraw.dll
+ 2002-12-11 15:14:32 24,064 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\ddrawex.dll
+ 2003-05-30 00:00:02 132,608 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\devenum.dll
+ 2002-12-11 15:14:32 27,136 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmband.dll
+ 2002-12-11 15:14:32 58,368 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmcompos.dll
+ 2004-07-08 19:27:28 181,248 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmime.dll
+ 2002-12-11 15:14:32 33,280 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmloader.dll
+ 2002-12-11 15:14:32 76,800 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmscript.dll
+ 2002-12-11 15:14:32 98,816 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmstyle.dll
+ 2002-12-11 15:14:32 100,864 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmsynth.dll
+ 2004-07-08 19:27:28 122,880 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dmusic.dll
+ 2002-12-11 15:14:32 28,160 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dplaysvr.exe
+ 2004-07-08 19:27:28 230,400 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dplayx.dll
+ 2002-12-11 15:14:32 77,824 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpmodemx.dll
+ 2002-12-11 15:14:32 3,072 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpnaddr.dll
+ 2002-12-11 15:14:32 723,968 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpnet.dll
+ 2003-03-24 00:00:02 32,768 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpnhpast.dll
+ 2003-03-24 00:00:02 68,096 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpnhupnp.dll
+ 2002-12-11 15:14:32 3,072 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpnlobby.dll
+ 2002-12-11 15:14:32 16,896 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpnsvr.exe
+ 2002-12-11 15:14:32 19,968 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpvacm.dll
+ 2002-12-11 15:14:32 381,952 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpvoice.dll
+ 2002-12-11 15:14:32 80,896 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpvsetup.exe
+ 2002-12-11 15:14:32 112,128 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpvvox.dll
+ 2004-07-08 19:27:28 79,360 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dpwsockx.dll
+ 2002-12-11 15:14:32 186,880 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dsdmo.dll
+ 2002-12-11 15:14:32 491,520 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dsdmoprp.dll
+ 2004-07-08 19:27:28 381,952 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dsound.dll
+ 2002-12-11 15:14:32 1,294,336 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dsound3d.dll
+ 2002-12-11 15:14:32 18,432 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dswave.dll
+ 2002-12-11 15:14:32 602,624 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dx7vb.dll
+ 2003-05-30 00:00:02 1,189,888 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dx8vb.dll
+ 2004-07-08 19:27:28 974,848 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dxdiag.exe
+ 2002-12-11 15:14:32 46,592 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dxdllreg.exe
+ 2002-12-11 15:14:32 18,944 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\encapi.dll
+ 2002-12-11 15:14:32 130,304 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\ks.sys
+ 2002-12-11 15:14:32 4,096 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\ksuser.dll
+ 2002-12-11 15:14:32 34,304 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\mciqtz32.dll
+ 2002-12-11 15:14:32 13,312 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\msdmo.dll
+ 2002-12-11 15:14:32 7,424 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\mskssrv.sys
+ 2002-12-11 15:14:32 5,248 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\mspclock.sys
+ 2001-08-22 20:00:00 4,608 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\mspqm.sys
+ 2002-12-11 15:14:32 5,504 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\mstee.sys
+ 2002-12-11 15:14:32 324,096 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\mswebdvd.dll
+ 2002-12-11 15:14:32 173,056 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\qasf.dll
+ 2002-12-11 15:14:32 257,024 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\qcap.dll
+ 2004-07-08 19:27:28 316,928 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\qdv.dll
+ 2004-07-08 19:27:28 470,528 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\qdvd.dll
+ 2002-12-11 15:14:32 1,798,144 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\qedit.dll
+ 2002-12-11 15:14:32 733,184 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\qedwipes.dll
+ 2003-05-30 00:00:02 1,962,496 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\quartz.dll
+ 2004-07-08 19:27:28 48,512 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\stream.sys
+ 2002-12-11 15:14:32 4,096 —-a-w C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\swenum.sys
+ 2004-07-08 19:26:38 11,392 —-a-w C:\WINDOWS\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\bdasup.sys
+ 2004-07-08 19:26:38 16,384 —-a-w C:\WINDOWS\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\ccdecode.sys
+ 2004-07-08 19:26:38 15,104 —-a-w C:\WINDOWS\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\mpe.sys
+ 2004-07-08 19:26:38 1,230,336 —-a-w C:\WINDOWS\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\msvidctl.dll
+ 2004-07-08 19:26:38 16,896 —-a-w C:\WINDOWS\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\msyuv.dll
+ 2004-07-08 19:26:38 83,968 —-a-w C:\WINDOWS\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\nabtsfec.sys
+ 2004-07-08 19:26:38 10,112 —-a-w C:\WINDOWS\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\ndisip.sys
+ 2004-07-08 19:26:40 354,816 —-a-w C:\WINDOWS\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\psisdecd.dll
+ 2004-07-08 19:26:40 10,880 —-a-w C:\WINDOWS\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\slip.sys
+ 2004-07-08 19:26:40 14,976 —-a-w C:\WINDOWS\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\streamip.sys
+ 2004-07-08 19:26:40 18,688 —-a-w C:\WINDOWS\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\wstcodec.sys
+ 2004-07-08 19:26:40 47,104 —-a-w C:\WINDOWS\RegisteredPackages\{AA936DF4-2B08-4B1F-B071-72192E287704}\wstdecod.dll
- 2003-03-31 19:00:00 63,488 —-a-w C:\WINDOWS\system32\amstream.dll
+ 2002-12-11 15:14:32 64,512 —-a-w C:\WINDOWS\system32\amstream.dll
- 2007-10-24 14:19:04 16,384 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2007-10-27 02:18:59 16,384 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2007-10-24 14:19:04 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-10-27 02:18:59 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-10-24 14:19:04 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2007-10-27 02:18:59 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2003-03-31 19:00:00 1,180,672 —-a-w C:\WINDOWS\system32\d3d8.dll
+ 2004-07-08 19:27:28 1,201,152 —-a-w C:\WINDOWS\system32\d3d8.dll
- 2003-03-31 19:00:00 8,192 —-a-w C:\WINDOWS\system32\d3d8thk.dll
+ 2002-12-11 15:14:32 8,192 —-a-w C:\WINDOWS\system32\d3d8thk.dll
+ 2004-07-08 19:27:28 1,703,936 —-a-w C:\WINDOWS\system32\d3d9.dll
- 2003-03-31 19:00:00 791,040 —-a-w C:\WINDOWS\system32\d3dim700.dll
+ 2003-05-30 00:00:02 797,184 —-a-w C:\WINDOWS\system32\d3dim700.dll
- 2003-03-31 19:00:00 253,440 —-a-w C:\WINDOWS\system32\ddraw.dll
+ 2004-07-08 19:27:28 292,864 —-a-w C:\WINDOWS\system32\ddraw.dll
- 2003-03-31 19:00:00 24,064 —-a-w C:\WINDOWS\system32\ddrawex.dll
+ 2002-12-11 15:14:32 24,064 —-a-w C:\WINDOWS\system32\ddrawex.dll
- 2003-03-31 19:00:00 51,712 —-a-w C:\WINDOWS\system32\devenum.dll
+ 2003-05-30 00:00:02 132,608 —-a-w C:\WINDOWS\system32\devenum.dll
- 2003-03-31 19:00:00 63,488 -c–a-w C:\WINDOWS\system32\dllcache\amstream.dll
+ 2002-12-11 15:14:32 64,512 -c–a-w C:\WINDOWS\system32\dllcache\amstream.dll
+ 2004-07-08 19:26:38 11,392 -c–a-w C:\WINDOWS\system32\dllcache\bdasup.sys
- 2002-08-29 08:33:24 16,384 -c–a-w C:\WINDOWS\system32\dllcache\ccdecode.sys
+ 2004-07-08 19:26:38 16,384 -c–a-w C:\WINDOWS\system32\dllcache\ccdecode.sys
- 2003-03-31 19:00:00 1,180,672 -c–a-w C:\WINDOWS\system32\dllcache\d3d8.dll
+ 2004-07-08 19:27:28 1,201,152 -c–a-w C:\WINDOWS\system32\dllcache\d3d8.dll
- 2003-03-31 19:00:00 8,192 -c–a-w C:\WINDOWS\system32\dllcache\d3d8thk.dll
+ 2002-12-11 15:14:32 8,192 -c–a-w C:\WINDOWS\system32\dllcache\d3d8thk.dll
- 2003-03-31 19:00:00 791,040 -c–a-w C:\WINDOWS\system32\dllcache\d3dim700.dll
+ 2003-05-30 00:00:02 797,184 -c–a-w C:\WINDOWS\system32\dllcache\d3dim700.dll
- 2003-03-31 19:00:00 253,440 -c–a-w C:\WINDOWS\system32\dllcache\ddraw.dll
+ 2004-07-08 19:27:28 292,864 -c–a-w C:\WINDOWS\system32\dllcache\ddraw.dll
- 2003-03-31 19:00:00 24,064 -c–a-w C:\WINDOWS\system32\dllcache\ddrawex.dll
+ 2002-12-11 15:14:32 24,064 -c–a-w C:\WINDOWS\system32\dllcache\ddrawex.dll
- 2003-03-31 19:00:00 51,712 -c–a-w C:\WINDOWS\system32\dllcache\devenum.dll
+ 2003-05-30 00:00:02 132,608 -c–a-w C:\WINDOWS\system32\dllcache\devenum.dll
- 2003-03-31 19:00:00 26,112 -c–a-w C:\WINDOWS\system32\dllcache\dmband.dll
+ 2002-12-11 15:14:32 27,136 -c–a-w C:\WINDOWS\system32\dllcache\dmband.dll
- 2003-03-31 19:00:00 57,344 -c–a-w C:\WINDOWS\system32\dllcache\dmcompos.dll
+ 2002-12-11 15:14:32 58,368 -c–a-w C:\WINDOWS\system32\dllcache\dmcompos.dll
- 2003-03-31 19:00:00 172,544 -c–a-w C:\WINDOWS\system32\dllcache\dmime.dll
+ 2004-07-08 19:27:28 181,248 -c–a-w C:\WINDOWS\system32\dllcache\dmime.dll
- 2003-03-31 19:00:00 31,744 -c–a-w C:\WINDOWS\system32\dllcache\dmloader.dll
+ 2002-12-11 15:14:32 33,280 -c–a-w C:\WINDOWS\system32\dllcache\dmloader.dll
- 2003-03-31 19:00:00 77,312 -c–a-w C:\WINDOWS\system32\dllcache\dmscript.dll
+ 2002-12-11 15:14:32 76,800 -c–a-w C:\WINDOWS\system32\dllcache\dmscript.dll
- 2003-03-31 19:00:00 110,080 -c–a-w C:\WINDOWS\system32\dllcache\dmstyle.dll
+ 2002-12-11 15:14:32 98,816 -c–a-w C:\WINDOWS\system32\dllcache\dmstyle.dll
- 2003-03-31 19:00:00 99,840 -c–a-w C:\WINDOWS\system32\dllcache\dmsynth.dll
+ 2002-12-11 15:14:32 100,864 -c–a-w C:\WINDOWS\system32\dllcache\dmsynth.dll
- 2003-03-31 19:00:00 94,720 -c–a-w C:\WINDOWS\system32\dllcache\dmusic.dll
+ 2004-07-08 19:27:28 122,880 -c–a-w C:\WINDOWS\system32\dllcache\dmusic.dll
- 2003-03-31 19:00:00 26,112 -c–a-w C:\WINDOWS\system32\dllcache\dplaysvr.exe
+ 2002-12-11 15:14:32 28,160 -c–a-w C:\WINDOWS\system32\dllcache\dplaysvr.exe
- 2003-03-31 19:00:00 212,992 -c–a-w C:\WINDOWS\system32\dllcache\dplayx.dll
+ 2004-07-08 19:27:28 230,400 -c–a-w C:\WINDOWS\system32\dllcache\dplayx.dll
- 2003-03-31 19:00:00 20,992 -c–a-w C:\WINDOWS\system32\dllcache\dpmodemx.dll
+ 2002-12-11 15:14:32 77,824 -c–a-w C:\WINDOWS\system32\dllcache\dpmodemx.dll
- 2003-03-31 19:00:00 26,112 -c–a-w C:\WINDOWS\system32\dllcache\dpnaddr.dll
+ 2002-12-11 15:14:32 3,072 -c–a-w C:\WINDOWS\system32\dllcache\dpnaddr.dll
- 2003-03-31 19:00:00 156,672 -c–a-w C:\WINDOWS\system32\dllcache\dpnet.dll
+ 2002-12-11 15:14:32 723,968 -c–a-w C:\WINDOWS\system32\dllcache\dpnet.dll
- 2003-03-31 19:00:00 29,696 -c–a-w C:\WINDOWS\system32\dllcache\dpnhpast.dll
+ 2003-03-24 00:00:02 32,768 -c–a-w C:\WINDOWS\system32\dllcache\dpnhpast.dll
- 2003-03-31 19:00:00 56,320 -c–a-w C:\WINDOWS\system32\dllcache\dpnhupnp.dll
+ 2003-03-24 00:00:02 68,096 -c–a-w C:\WINDOWS\system32\dllcache\dpnhupnp.dll
- 2003-03-31 19:00:00 38,400 -c–a-w C:\WINDOWS\system32\dllcache\dpnlobby.dll
+ 2002-12-11 15:14:32 3,072 -c–a-w C:\WINDOWS\system32\dllcache\dpnlobby.dll
- 2003-03-31 19:00:00 18,944 -c–a-w C:\WINDOWS\system32\dllcache\dpnsvr.exe
+ 2002-12-11 15:14:32 16,896 -c–a-w C:\WINDOWS\system32\dllcache\dpnsvr.exe
- 2003-03-31 19:00:00 24,064 -c–a-w C:\WINDOWS\system32\dllcache\dpvacm.dll
+ 2002-12-11 15:14:32 19,968 -c–a-w C:\WINDOWS\system32\dllcache\dpvacm.dll
- 2003-03-31 19:00:00 206,336 -c–a-w C:\WINDOWS\system32\dllcache\dpvoice.dll
+ 2002-12-11 15:14:32 381,952 -c–a-w C:\WINDOWS\system32\dllcache\dpvoice.dll
- 2003-03-31 19:00:00 58,368 -c–a-w C:\WINDOWS\system32\dllcache\dpvsetup.exe
+ 2002-12-11 15:14:32 80,896 -c–a-w C:\WINDOWS\system32\dllcache\dpvsetup.exe
- 2003-03-31 19:00:00 113,152 -c–a-w C:\WINDOWS\system32\dllcache\dpvvox.dll
+ 2002-12-11 15:14:32 112,128 -c–a-w C:\WINDOWS\system32\dllcache\dpvvox.dll
- 2003-03-31 19:00:00 49,664 -c–a-w C:\WINDOWS\system32\dllcache\dpwsockx.dll
+ 2004-07-08 19:27:28 79,360 -c–a-w C:\WINDOWS\system32\dllcache\dpwsockx.dll
- 2003-03-31 19:00:00 165,888 -c–a-w C:\WINDOWS\system32\dllcache\dsdmo.dll
+ 2002-12-11 15:14:32 186,880 -c–a-w C:\WINDOWS\system32\dllcache\dsdmo.dll
- 2003-03-31 19:00:00 66,560 -c–a-w C:\WINDOWS\system32\dllcache\dsdmoprp.dll
+ 2002-12-11 15:14:32 491,520 -c–a-w C:\WINDOWS\system32\dllcache\dsdmoprp.dll
- 2003-03-31 19:00:00 338,944 -c–a-w C:\WINDOWS\system32\dllcache\dsound.dll
+ 2004-07-08 19:27:28 381,952 -c–a-w C:\WINDOWS\system32\dllcache\dsound.dll
- 2003-03-31 19:00:00 1,293,824 -c–a-w C:\WINDOWS\system32\dllcache\dsound3d.dll
+ 2002-12-11 15:14:32 1,294,336 -c–a-w C:\WINDOWS\system32\dllcache\dsound3d.dll
- 2003-03-31 19:00:00 16,896 -c–a-w C:\WINDOWS\system32\dllcache\dswave.dll
+ 2002-12-11 15:14:32 18,432 -c–a-w C:\WINDOWS\system32\dllcache\dswave.dll
- 2003-03-31 19:00:00 595,456 -c–a-w C:\WINDOWS\system32\dllcache\dx7vb.dll
+ 2002-12-11 15:14:32 602,624 -c–a-w C:\WINDOWS\system32\dllcache\dx7vb.dll
- 2003-03-31 19:00:00 1,185,792 -c–a-w C:\WINDOWS\system32\dllcache\dx8vb.dll
+ 2003-05-30 00:00:02 1,189,888 -c–a-w C:\WINDOWS\system32\dllcache\dx8vb.dll
- 2003-03-31 19:00:00 786,432 -c–a-w C:\WINDOWS\system32\dllcache\dxdiag.exe
+ 2004-07-08 19:27:28 974,848 -c–a-w C:\WINDOWS\system32\dllcache\dxdiag.exe
- 2002-08-29 09:13:42 131,712 -c–a-w C:\WINDOWS\system32\dllcache\ks.sys
+ 2002-12-11 15:14:32 130,304 -c–a-w C:\WINDOWS\system32\dllcache\ks.sys
- 2001-08-18 05:36:18 4,096 -c–a-w C:\WINDOWS\system32\dllcache\ksuser.dll
+ 2002-12-11 15:14:32 4,096 -c–a-w C:\WINDOWS\system32\dllcache\ksuser.dll
- 2003-03-31 19:00:00 33,280 -c–a-w C:\WINDOWS\system32\dllcache\mciqtz32.dll
+ 2002-12-11 15:14:32 34,304 -c–a-w C:\WINDOWS\system32\dllcache\mciqtz32.dll
+ 2004-07-08 19:26:38 15,104 -c–a-w C:\WINDOWS\system32\dllcache\mpe.sys
- 2003-03-31 19:00:00 11,264 -c–a-w C:\WINDOWS\system32\dllcache\msdmo.dll
+ 2002-12-11 15:14:32 13,312 -c–a-w C:\WINDOWS\system32\dllcache\msdmo.dll
+ 2004-07-08 19:26:38 52,096 -c–a-w C:\WINDOWS\system32\dllcache\msdv.sys
- 2002-08-29 09:27:12 7,040 -c–a-w C:\WINDOWS\system32\dllcache\mskssrv.sys
+ 2002-12-11 15:14:32 7,424 -c–a-w C:\WINDOWS\system32\dllcache\mskssrv.sys
- 2001-08-17 21:48:42 5,120 -c–a-w C:\WINDOWS\system32\dllcache\mspclock.sys
+ 2002-12-11 15:14:32 5,248 -c–a-w C:\WINDOWS\system32\dllcache\mspclock.sys
- 2001-08-17 21:48:46 4,608 -c–a-w C:\WINDOWS\system32\dllcache\mspqm.sys
+ 2001-08-22 20:00:00 4,608 -c–a-w C:\WINDOWS\system32\dllcache\mspqm.sys
- 2002-08-29 08:27:12 4,992 -c–a-w C:\WINDOWS\system32\dllcache\mstee.sys
+ 2002-12-11 15:14:32 5,504 -c–a-w C:\WINDOWS\system32\dllcache\mstee.sys
- 2003-03-31 19:00:00 1,220,608 -c–a-w C:\WINDOWS\system32\dllcache\msvidctl.dll
+ 2004-07-08 19:26:38 1,230,336 -c–a-w C:\WINDOWS\system32\dllcache\msvidctl.dll
- 2003-03-31 19:00:00 192,512 -c–a-w C:\WINDOWS\system32\dllcache\mswebdvd.dll
+ 2002-12-11 15:14:32 324,096 -c–a-w C:\WINDOWS\system32\dllcache\mswebdvd.dll
- 2001-08-18 05:36:26 16,384 -c–a-w C:\WINDOWS\system32\dllcache\msyuv.dll
+ 2004-07-08 19:26:38 16,896 -c–a-w C:\WINDOWS\system32\dllcache\msyuv.dll
- 2001-08-17 21:07:30 83,712 -c–a-w C:\WINDOWS\system32\dllcache\nabtsfec.sys
+ 2004-07-08 19:26:38 83,968 -c–a-w C:\WINDOWS\system32\dllcache\nabtsfec.sys
- 2001-08-17 21:07:06 8,064 -c–a-w C:\WINDOWS\system32\dllcache\ndisip.sys
+ 2004-07-08 19:26:38 10,112 -c–a-w C:\WINDOWS\system32\dllcache\ndisip.sys
+ 2002-08-28 18:41:00 31,744 -c–a-w C:\WINDOWS\system32\dllcache\pid.dll
+ 2004-07-08 19:26:40 354,816 -c–a-w C:\WINDOWS\system32\dllcache\psisdecd.dll
- 2003-03-31 19:00:00 184,832 -c–a-w C:\WINDOWS\system32\dllcache\qcap.dll
+ 2002-12-11 15:14:32 257,024 -c–a-w C:\WINDOWS\system32\dllcache\qcap.dll
- 2003-03-31 19:00:00 266,752 -c–a-w C:\WINDOWS\system32\dllcache\qdv.dll
+ 2004-07-08 19:27:28 316,928 -c–a-w C:\WINDOWS\system32\dllcache\qdv.dll
- 2003-03-31 19:00:00 357,376 -c–a-w C:\WINDOWS\system32\dllcache\qdvd.dll
+ 2004-07-08 19:27:28 470,528 -c–a-w C:\WINDOWS\system32\dllcache\qdvd.dll
- 2003-03-31 19:00:00 511,488 -c–a-w C:\WINDOWS\system32\dllcache\qedit.dll
+ 2002-12-11 15:14:32 1,798,144 -c–a-w C:\WINDOWS\system32\dllcache\qedit.dll
- 2003-03-31 19:00:00 734,208 -c–a-w C:\WINDOWS\system32\dllcache\qedwipes.dll
+ 2002-12-11 15:14:32 733,184 -c–a-w C:\WINDOWS\system32\dllcache\qedwipes.dll
- 2005-08-30 04:02:45 1,158,656 -c–a-w C:\WINDOWS\system32\dllcache\quartz.dll
+ 2003-05-30 00:00:02 1,962,496 -c–a-w C:\WINDOWS\system32\dllcache\quartz.dll
- 2001-08-17 21:07:12 10,752 -c–a-w C:\WINDOWS\system32\dllcache\slip.sys
+ 2004-07-08 19:26:40 10,880 -c–a-w C:\WINDOWS\system32\dllcache\slip.sys
- 2002-08-29 09:32:34 44,416 -c–a-w C:\WINDOWS\system32\dllcache\stream.sys
+ 2004-07-08 19:27:28 48,512 -c–a-w C:\WINDOWS\system32\dllcache\stream.sys
- 2001-08-17 21:07:06 14,592 -c–a-w C:\WINDOWS\system32\dllcache\streamip.sys
+ 2004-07-08 19:26:40 14,976 -c–a-w C:\WINDOWS\system32\dllcache\streamip.sys
+ 2002-12-11 15:14:32 4,096 -c–a-w C:\WINDOWS\system32\dllcache\swenum.sys
- 2001-08-17 21:07:22 18,560 -c–a-w C:\WINDOWS\system32\dllcache\wstcodec.sys
+ 2004-07-08 19:26:40 18,688 -c–a-w C:\WINDOWS\system32\dllcache\wstcodec.sys
- 2003-03-31 19:00:00 46,080 -c–a-w C:\WINDOWS\system32\dllcache\wstdecod.dll
+ 2004-07-08 19:26:40 47,104 -c–a-w C:\WINDOWS\system32\dllcache\wstdecod.dll
- 2003-03-31 19:00:00 26,112 —-a-w C:\WINDOWS\system32\dmband.dll
+ 2002-12-11 15:14:32 27,136 —-a-w C:\WINDOWS\system32\dmband.dll
- 2003-03-31 19:00:00 57,344 —-a-w C:\WINDOWS\system32\dmcompos.dll
+ 2002-12-11 15:14:32 58,368 —-a-w C:\WINDOWS\system32\dmcompos.dll
- 2003-03-31 19:00:00 172,544 —-a-w C:\WINDOWS\system32\dmime.dll
+ 2004-07-08 19:27:28 181,248 —-a-w C:\WINDOWS\system32\dmime.dll
- 2003-03-31 19:00:00 31,744 —-a-w C:\WINDOWS\system32\dmloader.dll
+ 2002-12-11 15:14:32 33,280 —-a-w C:\WINDOWS\system32\dmloader.dll
- 2003-03-31 19:00:00 77,312 —-a-w C:\WINDOWS\system32\dmscript.dll
+ 2002-12-11 15:14:32 76,800 —-a-w C:\WINDOWS\system32\dmscript.dll
- 2003-03-31 19:00:00 110,080 —-a-w C:\WINDOWS\system32\dmstyle.dll
+ 2002-12-11 15:14:32 98,816 —-a-w C:\WINDOWS\system32\dmstyle.dll
- 2003-03-31 19:00:00 99,840 —-a-w C:\WINDOWS\system32\dmsynth.dll
+ 2002-12-11 15:14:32 100,864 —-a-w C:\WINDOWS\system32\dmsynth.dll
- 2003-03-31 19:00:00 94,720 —-a-w C:\WINDOWS\system32\dmusic.dll
+ 2004-07-08 19:27:28 122,880 —-a-w C:\WINDOWS\system32\dmusic.dll
- 2003-03-31 19:00:00 26,112 —-a-w C:\WINDOWS\system32\dplaysvr.exe
+ 2002-12-11 15:14:32 28,160 —-a-w C:\WINDOWS\system32\dplaysvr.exe
- 2003-03-31 19:00:00 212,992 —-a-w C:\WINDOWS\system32\dplayx.dll
+ 2004-07-08 19:27:28 230,400 —-a-w C:\WINDOWS\system32\dplayx.dll
- 2003-03-31 19:00:00 20,992 —-a-w C:\WINDOWS\system32\dpmodemx.dll
+ 2002-12-11 15:14:32 77,824 —-a-w C:\WINDOWS\system32\dpmodemx.dll
- 2003-03-31 19:00:00 26,112 —-a-w C:\WINDOWS\system32\dpnaddr.dll
+ 2002-12-11 15:14:32 3,072 —-a-w C:\WINDOWS\system32\dpnaddr.dll
- 2003-03-31 19:00:00 156,672 —-a-w C:\WINDOWS\system32\dpnet.dll
+ 2002-12-11 15:14:32 723,968 —-a-w C:\WINDOWS\system32\dpnet.dll
- 2003-03-31 19:00:00 29,696 —-a-w C:\WINDOWS\system32\dpnhpast.dll
+ 2003-03-24 00:00:02 32,768 —-a-w C:\WINDOWS\system32\dpnhpast.dll
- 2003-03-31 19:00:00 56,320 —-a-w C:\WINDOWS\system32\dpnhupnp.dll
+ 2003-03-24 00:00:02 68,096 —-a-w C:\WINDOWS\system32\dpnhupnp.dll
- 2003-03-31 19:00:00 38,400 —-a-w C:\WINDOWS\system32\dpnlobby.dll
+ 2002-12-11 15:14:32 3,072 —-a-w C:\WINDOWS\system32\dpnlobby.dll
- 2003-03-31 19:00:00 18,944 —-a-w C:\WINDOWS\system32\dpnsvr.exe
+ 2002-12-11 15:14:32 16,896 —-a-w C:\WINDOWS\system32\dpnsvr.exe
- 2003-03-31 19:00:00 24,064 —-a-w C:\WINDOWS\system32\dpvacm.dll
+ 2002-12-11 15:14:32 19,968 —-a-w C:\WINDOWS\system32\dpvacm.dll
- 2003-03-31 19:00:00 206,336 —-a-w C:\WINDOWS\system32\dpvoice.dll
+ 2002-12-11 15:14:32 381,952 —-a-w C:\WINDOWS\system32\dpvoice.dll
- 2003-03-31 19:00:00 58,368 —-a-w C:\WINDOWS\system32\dpvsetup.exe
+ 2002-12-11 15:14:32 80,896 —-a-w C:\WINDOWS\system32\dpvsetup.exe
- 2003-03-31 19:00:00 113,152 —-a-w C:\WINDOWS\system32\dpvvox.dll
+ 2002-12-11 15:14:32 112,128 —-a-w C:\WINDOWS\system32\dpvvox.dll
- 2003-03-31 19:00:00 49,664 —-a-w C:\WINDOWS\system32\dpwsockx.dll
+ 2004-07-08 19:27:28 79,360 —-a-w C:\WINDOWS\system32\dpwsockx.dll
+ 2004-07-08 19:26:38 11,392 —-a-w C:\WINDOWS\system32\drivers\bdasup.sys
- 2002-08-29 08:33:24 16,384 —-a-w C:\WINDOWS\system32\drivers\CCDECODE.sys
+ 2004-07-08 19:26:38 16,384 —-a-w C:\WINDOWS\system32\drivers\ccdecode.sys
- 2002-08-29 09:13:42 131,712 —-a-w C:\WINDOWS\system32\drivers\ks.sys
+ 2002-12-11 15:14:32 130,304 —-a-w C:\WINDOWS\system32\drivers\ks.sys
+ 2004-07-08 19:26:38 15,104 —-a-w C:\WINDOWS\system32\drivers\mpe.sys
+ 2004-07-08 19:26:38 52,096 —-a-w C:\WINDOWS\system32\drivers\msdv.sys
- 2002-08-29 09:27:12 7,040 —-a-w C:\WINDOWS\system32\drivers\MSKSSRV.sys
+ 2002-12-11 15:14:32 7,424 —-a-w C:\WINDOWS\system32\drivers\mskssrv.sys
- 2001-08-17 21:48:42 5,120 —-a-w C:\WINDOWS\system32\drivers\MSPCLOCK.sys
+ 2002-12-11 15:14:32 5,248 —-a-w C:\WINDOWS\system32\drivers\mspclock.sys
- 2001-08-17 21:48:46 4,608 —-a-w C:\WINDOWS\system32\drivers\MSPQM.sys
+ 2001-08-22 20:00:00 4,608 —-a-w C:\WINDOWS\system32\drivers\mspqm.sys
- 2002-08-29 08:27:12 4,992 —-a-w C:\WINDOWS\system32\drivers\MSTEE.sys
+ 2002-12-11 15:14:32 5,504 —-a-w C:\WINDOWS\system32\drivers\mstee.sys
- 2001-08-17 21:07:30 83,712 —-a-w C:\WINDOWS\system32\drivers\NABTSFEC.sys
+ 2004-07-08 19:26:38 83,968 —-a-w C:\WINDOWS\system32\drivers\nabtsfec.sys
- 2001-08-17 21:07:06 8,064 —-a-w C:\WINDOWS\system32\drivers\NdisIP.sys
+ 2004-07-08 19:26:38 10,112 —-a-w C:\WINDOWS\system32\drivers\ndisip.sys
- 2001-08-17 21:07:12 10,752 —-a-w C:\WINDOWS\system32\drivers\SLIP.sys
+ 2004-07-08 19:26:40 10,880 —-a-w C:\WINDOWS\system32\drivers\slip.sys
- 2002-08-29 09:32:34 44,416 —-a-w C:\WINDOWS\system32\drivers\stream.sys
+ 2004-07-08 19:27:28 48,512 —-a-w C:\WINDOWS\system32\drivers\stream.sys
- 2001-08-17 21:07:06 14,592 —-a-w C:\WINDOWS\system32\drivers\StreamIP.sys
+ 2004-07-08 19:26:40 14,976 —-a-w C:\WINDOWS\system32\drivers\streamip.sys
- 2003-03-31 19:00:00 3,840 —-a-w C:\WINDOWS\system32\drivers\swenum.sys
+ 2002-12-11 15:14:32 4,096 —-a-w C:\WINDOWS\system32\drivers\swenum.sys
- 2001-08-17 21:07:22 18,560 —-a-w C:\WINDOWS\system32\drivers\WSTCODEC.SYS
+ 2004-07-08 19:26:40 18,688 —-a-w C:\WINDOWS\system32\drivers\wstcodec.sys
- 2003-03-31 19:00:00 165,888 —-a-w C:\WINDOWS\system32\dsdmo.dll
+ 2002-12-11 15:14:32 186,880 —-a-w C:\WINDOWS\system32\dsdmo.dll
- 2003-03-31 19:00:00 66,560 —-a-w C:\WINDOWS\system32\dsdmoprp.dll
+ 2002-12-11 15:14:32 491,520 —-a-w C:\WINDOWS\system32\dsdmoprp.dll
- 2003-03-31 19:00:00 338,944 —-a-w C:\WINDOWS\system32\dsound.dll
+ 2004-07-08 19:27:28 381,952 —-a-w C:\WINDOWS\system32\dsound.dll
- 2003-03-31 19:00:00 1,293,824 —-a-w C:\WINDOWS\system32\dsound3d.dll
+ 2002-12-11 15:14:32 1,294,336 —-a-w C:\WINDOWS\system32\dsound3d.dll
- 2003-03-31 19:00:00 16,896 —-a-w C:\WINDOWS\system32\dswave.dll
+ 2002-12-11 15:14:32 18,432 —-a-w C:\WINDOWS\system32\dswave.dll
- 2003-03-31 19:00:00 595,456 —-a-w C:\WINDOWS\system32\dx7vb.dll
+ 2002-12-11 15:14:32 602,624 —-a-w C:\WINDOWS\system32\dx7vb.dll
- 2003-03-31 19:00:00 1,185,792 —-a-w C:\WINDOWS\system32\dx8vb.dll
+ 2003-05-30 00:00:02 1,189,888 —-a-w C:\WINDOWS\system32\dx8vb.dll
- 2003-03-31 19:00:00 786,432 —-a-w C:\WINDOWS\system32\dxdiag.exe
+ 2004-07-08 19:27:28 974,848 —-a-w C:\WINDOWS\system32\dxdiag.exe
+ 2004-07-08 19:27:28 1,769,472 —-a-w C:\WINDOWS\system32\dxdiagn.dll
+ 2002-12-11 15:14:32 46,592 —-a-w C:\WINDOWS\system32\dxdllreg.exe
- 2003-03-31 19:00:00 12,288 —-a-w C:\WINDOWS\system32\encapi.dll
+ 2002-12-11 15:14:32 18,944 —-a-w C:\WINDOWS\system32\encapi.dll
- 2001-08-18 05:36:18 4,096 —-a-w C:\WINDOWS\system32\ksuser.dll
+ 2002-12-11 15:14:32 4,096 —-a-w C:\WINDOWS\system32\ksuser.dll
- 2003-03-31 19:00:00 33,280 —-a-w C:\WINDOWS\system32\mciqtz32.dll
+ 2002-12-11 15:14:32 34,304 —-a-w C:\WINDOWS\system32\mciqtz32.dll
- 2003-03-31 19:00:00 11,264 —-a-w C:\WINDOWS\system32\msdmo.dll
+ 2002-12-11 15:14:32 13,312 —-a-w C:\WINDOWS\system32\msdmo.dll
- 2003-03-31 19:00:00 1,220,608 —-a-w C:\WINDOWS\system32\msvidctl.dll
+ 2004-07-08 19:26:38 1,230,336 —-a-w C:\WINDOWS\system32\msvidctl.dll
- 2003-03-31 19:00:00 192,512 —-a-w C:\WINDOWS\system32\mswebdvd.dll
+ 2002-12-11 15:14:32 324,096 —-a-w C:\WINDOWS\system32\mswebdvd.dll
- 2001-08-18 05:36:26 16,384 —-a-w C:\WINDOWS\system32\msyuv.dll
+ 2004-07-08 19:26:38 16,896 —-a-w C:\WINDOWS\system32\msyuv.dll
+ 2004-07-08 19:26:40 354,816 —-a-w C:\WINDOWS\system32\psisdecd.dll
- 2003-03-31 19:00:00 184,832 —-a-w C:\WINDOWS\system32\qcap.dll
+ 2002-12-11 15:14:32 257,024 —-a-w C:\WINDOWS\system32\qcap.dll
- 2003-03-31 19:00:00 266,752 —-a-w C:\WINDOWS\system32\qdv.dll
+ 2004-07-08 19:27:28 316,928 —-a-w C:\WINDOWS\system32\qdv.dll
- 2003-03-31 19:00:00 357,376 —-a-w C:\WINDOWS\system32\qdvd.dll
+ 2004-07-08 19:27:28 470,528 —-a-w C:\WINDOWS\system32\qdvd.dll
- 2003-03-31 19:00:00 511,488 —-a-w C:\WINDOWS\system32\qedit.dll
+ 2002-12-11 15:14:32 1,798,144 —-a-w C:\WINDOWS\system32\qedit.dll
- 2003-03-31 19:00:00 734,208 —-a-w C:\WINDOWS\system32\qedwipes.dll
+ 2002-12-11 15:14:32 733,184 —-a-w C:\WINDOWS\system32\qedwipes.dll
- 2005-08-30 04:02:45 1,158,656 —-a-w C:\WINDOWS\system32\quartz.dll
+ 2003-05-30 00:00:02 1,962,496 —-a-w C:\WINDOWS\system32\quartz.dll
- 2003-03-31 19:00:00 46,080 —-a-w C:\WINDOWS\system32\wstdecod.dll
+ 2004-07-08 19:26:40 47,104 —-a-w C:\WINDOWS\system32\wstdecod.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2005-05-19 03:29]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2003-10-08 12:40]
"DetectorApp"="C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\DetectorApp.exe" [2005-10-20 23:15]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-18 12:29 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-28 09:50]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-28 09:50]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-07-17 06:01]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]
"x3watch"="C:\Program Files\X3watch\x3watch.exe" [2007-05-03 07:40]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 23:59]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42]
"WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2007-09-24 02:30]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2003-04-01 04:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-11-16 08:18]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 23:59]
"ChikkaDefault"="C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\ChikkaLauncher.exe" [2007-04-11 19:40]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-06-12 10:16]

R1 BUFADPT;BUFADPT;\??\C:\WINDOWS\System32\BUFADPT.SYS
S3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\System32\DRIVERS\snp2sxp.sys
S3 U2SG54HP;BUFFALO WLI-U2-SG54HP Wireless LAN Driver;C:\WINDOWS\System32\DRIVERS\U2SG54HP.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-09-27 12:57:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-29 20:32:04
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe?????????A?p?????????? ???B?????????????hLC? ??????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-29 20:32:48
C:\ComboFix-quarantined-files.txt … 2007-10-16 23:07
C:\ComboFix2.txt … 2007-10-28 01:20
C:\ComboFix3.txt … 2007-10-24 23:20
.
— E O F —


Logfile of HijackThis v1.99.1
Scan saved at 12:25:56 AM, on 2007-10-30
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\DetectorApp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\X3watch\x3watch.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\ChikkaLauncher.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\USBDeviceService.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\DetectorApp.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [x3watch] C:\Program Files\X3watch\x3watch.exe
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [ChikkaDefault] C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\ChikkaLauncher.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\USBDeviceService.exe


I will run the Kaspersky scan later, Is that ok?
Thanks for the help!
Post #10
Sure, run it whenever you can :)

Also, in your next reply could you please let me know how your computer is running now?

Thanks,

jpshortstuff

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI