[Resolved] wifes comp ---log

ComboFix 07-11-19.3 - Admin 2007-11-21 15:34:01.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.93 [GMT -8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\explorer.exe
C:\WINDOWS\system32\firewall.exe
C:\windows\system32\iexplore.exe
C:\WINDOWS\system32\isass.exe

.
((((((((((((((((((((((((( Files Created from 2007-10-21 to 2007-11-21 )))))))))))))))))))))))))))))))
.

2007-11-21 12:48 d——– C:\Program Files\Windows Defender
2007-11-21 10:53 0 –a—— C:\WINDOWS\nsreg.dat
2007-11-20 15:41 d—s—- C:\Documents and Settings\Admin.BIODROID-001\UserData
2007-11-20 15:30 d——– C:\Documents and Settings\Admin.BIODROID-001\DoctorWeb
2007-11-20 14:36 40,960 –a—— C:\WINDOWS\system32\gebbx.exe
2007-11-20 13:10 37,861 –a—— C:\WINDOWS\system32\gsvit.exe
2007-11-20 13:10 31,110 –a—— C:\WINDOWS\system32\nsqwvrgm.exe
2007-11-20 12:23 6,510 —hs—- C:\WINDOWS\system32\psvyb.ini2
2007-11-20 11:56 31,110 –a—— C:\WINDOWS\system32\tuqd.exe
2007-11-20 11:56 31,110 –a—— C:\WINDOWS\system32\elys.exe
2007-11-20 11:43 d——– C:\2658797892e6d7de257408c2a9f70b
2007-11-20 11:40 d——– C:\9f6f4a0b8eb38798796c9488c6396313
2007-11-20 11:08 6,510 —hs—- C:\WINDOWS\system32\psvyb.bak2
2007-11-20 03:16 129,400 –a—— C:\WINDOWS\system32\TZLog.log
2007-11-19 21:38 d——– C:\VundoFix Backups
2007-11-19 21:16 d——– C:\Documents and Settings\Admin.BIODROID-001\Application Data\TuneUp Software
2007-11-19 19:57 6,510 –ahs—- C:\WINDOWS\system32\psvyb.ini
2007-11-19 19:49 97 –a—— C:\WINDOWS\system32\mcrh.tmp
2007-11-19 18:59 6,510 —hs—- C:\WINDOWS\system32\psvyb.bak1
2007-11-19 18:59 320 —hs—- C:\WINDOWS\system32\psvyb.tmp
2007-11-19 18:09 d——– C:\Documents and Settings\Admin.BIODROID-001\Application Data\ESET
2007-11-19 13:58 2,432 –a—— C:\WINDOWS\system32\unpr.sys
2007-11-19 13:20 d——– C:\Program Files\EsetOnlineScanner
2007-11-19 13:15 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Eset
2007-11-19 13:13 78,415 –a—— C:\WINDOWS\system32\drivers\klif.cab
2007-11-19 11:03 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2007-11-19 11:03 d——– C:\Documents and Settings\Admin.BIODROID-001\Application Data\SUPERAntiSpyware.com
2007-11-19 01:12 1,060,864 –a—— C:\WINDOWS\system32\MFC71.dll
2007-11-19 01:05 28,288 –a–c— C:\WINDOWS\system32\dllcache\xjis.nls
2007-11-19 01:04 41,600 –a–c— C:\WINDOWS\system32\dllcache\weitekp9.dll
2007-11-19 01:03 26,112 –a–c— C:\WINDOWS\system32\dllcache\romanime.ime
2007-11-19 01:03 15,872 –a–c— C:\WINDOWS\system32\dllcache\padrs404.dll
2007-11-19 01:03 14,848 –a–c— C:\WINDOWS\system32\dllcache\register.exe
2007-11-19 01:02 92,416 –a–c— C:\WINDOWS\system32\dllcache\mga.sys
2007-11-19 01:02 92,032 –a–c— C:\WINDOWS\system32\dllcache\mga.dll
2007-11-19 01:02 7,680 –a–c— C:\WINDOWS\system32\dllcache\migregdb.exe
2007-11-19 01:01 471,102 –a–c— C:\WINDOWS\system32\dllcache\imskdic.dll
2007-11-19 01:01 67,072 –a–c— C:\WINDOWS\system32\dllcache\imscinst.exe
2007-11-19 01:01 6,656 –a–c— C:\WINDOWS\system32\dllcache\kbdlk41a.dll
2007-11-19 01:01 6,144 –a–c— C:\WINDOWS\system32\dllcache\kbdlk41j.dll
2007-11-19 01:01 5,632 –a–c— C:\WINDOWS\system32\dllcache\kbdvntc.dll
2007-11-19 01:01 5,632 –a–c— C:\WINDOWS\system32\dllcache\kbdsyr1.dll
2007-11-19 01:01 5,632 –a–c— C:\WINDOWS\system32\dllcache\kbdfa.dll
2007-11-19 01:01 5,120 –a–c— C:\WINDOWS\system32\dllcache\kbdgeo.dll
2007-11-19 01:01 5,120 –a–c— C:\WINDOWS\system32\dllcache\kbdarme.dll
2007-11-19 01:00 514,587 –a–c— C:\WINDOWS\system32\dllcache\edb500.dll
2007-11-19 01:00 480,256 –a–c— C:\WINDOWS\system32\dllcache\cintsetp.exe
2007-11-19 01:00 198,656 –a–c— C:\WINDOWS\system32\dllcache\cintime.dll
2007-11-19 01:00 108,827 –a–c— C:\WINDOWS\system32\dllcache\hanja.lex
2007-11-19 01:00 101,888 –a–c— C:\WINDOWS\system32\dllcache\evntagnt.dll
2007-11-19 01:00 92,160 –a–c— C:\WINDOWS\system32\dllcache\evntwin.exe
2007-11-19 01:00 57,856 –a–c— C:\WINDOWS\system32\dllcache\esuimgd.dll
2007-11-19 01:00 57,344 –a–c— C:\WINDOWS\system32\dllcache\cplexe.exe
2007-11-19 01:00 45,056 –a–c— C:\WINDOWS\system32\dllcache\esunid.dll
2007-11-19 01:00 36,864 –a–c— C:\WINDOWS\system32\dllcache\hanjadic.dll
2007-11-19 01:00 31,744 –a–c— C:\WINDOWS\system32\dllcache\esucmd.dll
2007-11-19 01:00 25,856 –a–c— C:\WINDOWS\system32\dllcache\et4000.sys
2007-11-19 01:00 24,576 –a–c— C:\WINDOWS\system32\dllcache\fpadmcgi.exe
2007-11-19 01:00 24,064 –a–c— C:\WINDOWS\system32\dllcache\evntcmd.exe
2007-11-19 01:00 21,504 –a–c— C:\WINDOWS\system32\dllcache\cintlgnt.ime
2007-11-19 01:00 20,541 –a–c— C:\WINDOWS\system32\dllcache\fpadmdll.dll
2007-11-19 01:00 18,944 –a–c— C:\WINDOWS\system32\dllcache\cprofile.exe
2007-11-19 00:59 66,594 –a–c— C:\WINDOWS\system32\dllcache\c_864.nls
2007-11-19 00:59 66,594 –a–c— C:\WINDOWS\system32\dllcache\c_862.nls
2007-11-19 00:59 66,594 –a–c— C:\WINDOWS\system32\dllcache\c_858.nls
2007-11-19 00:59 45,056 –a–c— C:\WINDOWS\system32\dllcache\EXCH_aqadmin.dll
2007-11-19 00:59 32,768 –a–c— C:\WINDOWS\system32\dllcache\tcptest.exe
2007-11-19 00:59 20,536 –a–c— C:\WINDOWS\system32\dllcache\shtml.dll
2007-11-19 00:59 19,456 –a–c— C:\WINDOWS\system32\dllcache\agt0401.dll
2007-11-19 00:59 16,384 –a–c— C:\WINDOWS\system32\dllcache\tcptsat.dll
2007-11-19 00:59 16,384 –a–c— C:\WINDOWS\system32\dllcache\shtml.exe
2007-11-19 00:59 5,632 –a–c— C:\WINDOWS\system32\dllcache\EXCH_adsiisex.dll
2007-11-19 00:58 188,416 –a–c— C:\WINDOWS\system32\dllcache\fpcount.exe
2007-11-19 00:58 188,416 –a–c— C:\WINDOWS\system32\dllcache\cfgwiz.exe
2007-11-19 00:58 20,540 –a–c— C:\WINDOWS\system32\dllcache\author.dll
2007-11-19 00:58 20,540 –a–c— C:\WINDOWS\system32\dllcache\admin.dll
2007-11-19 00:58 16,384 –a–c— C:\WINDOWS\system32\dllcache\author.exe
2007-11-19 00:58 16,384 –a–c— C:\WINDOWS\system32\dllcache\admin.exe
2007-11-19 00:58 2,577 –a—— C:\WINDOWS\system32\CONFIG.NT
2007-11-19 00:57 23,392 –a—— C:\WINDOWS\system32\nscompat.tlb
2007-11-19 00:55 d–hs—- C:\Documents and Settings\All Users.WINDOWS\DRM
2007-11-19 00:55 488 -rah—– C:\WINDOWS\system32\WindowsLogon.manifest
2007-11-19 00:55 488 -rah—– C:\WINDOWS\system32\logonui.exe.manifest
2007-11-19 00:54 4,399,505 –a–c— C:\WINDOWS\system32\dllcache\nls302en.lex
2007-11-19 00:54 749 -rah—– C:\WINDOWS\system32\sapi.cpl.manifest
2007-11-19 00:54 749 -rah—– C:\WINDOWS\system32\nwc.cpl.manifest
2007-11-19 00:54 749 -rah—– C:\WINDOWS\system32\ncpa.cpl.manifest
2007-11-19 00:53 3,166,208 –a–c— C:\WINDOWS\system32\dllcache\msgr3en.dll
2007-11-19 00:53 1,134,592 –a–c— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-11-19 00:53 786,432 –a–c— C:\WINDOWS\system32\dllcache\migrate.exe
2007-11-19 00:53 774,144 –a–c— C:\WINDOWS\system32\dllcache\setup_wm.exe
2007-11-19 00:53 768,512 –a–c— C:\WINDOWS\system32\dllcache\helpctr.exe
2007-11-19 00:53 430,592 –a–c— C:\WINDOWS\system32\dllcache\wuapi.dll
2007-11-19 00:53 274,944 –a–c— C:\WINDOWS\system32\dllcache\mstask.dll
2007-11-19 00:53 190,976 –a—— C:\WINDOWS\system32\schedsvc.dll
2007-11-19 00:53 188,416 –a—— C:\WINDOWS\system32\msh261.drv
2007-11-19 00:53 183,296 –a–c— C:\WINDOWS\system32\dllcache\wuaueng1.dll
2007-11-19 00:53 165,888 –a–c— C:\WINDOWS\system32\dllcache\wuauclt1.exe
2007-11-19 00:53 162,304 –a–c— C:\WINDOWS\system32\dllcache\wuaucpl.cpl
2007-11-19 00:53 150,528 –a–c— C:\WINDOWS\system32\dllcache\uploadm.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-20 21:10 31,110 —-a-w C:\WINDOWS\system32\tqiphbty.exe
2007-11-19 04:09 ——— d—–w C:\Program Files\Windows Media Connect 2
2007-11-19 04:05 ——— d—–w C:\Program Files\RegVac Registry Cleaner
2007-11-19 03:57 ——— d—–w C:\Program Files\AC3Filter
2007-11-19 02:51 ——— d—–w C:\Documents and Settings\Admin\Application Data\uTorrent
2007-11-19 02:26 ——— d—–w C:\Documents and Settings\Admin\Application Data\Lavasoft
2007-11-09 00:10 27,656 —-a-w C:\WINDOWS\system32\drivers\easdrv.sys
2007-11-09 00:09 33,800 —-a-w C:\WINDOWS\system32\drivers\eamon.sys
2007-11-08 20:56 ——— d—–w C:\Program Files\WildGames
2007-11-07 23:53 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-11-07 21:01 ——— d—–w C:\Program Files\Common Files\Adobe
2007-11-06 01:27 ——— d—–w C:\Program Files\The Weather Channel FW
2007-11-03 23:00 ——— d—–w C:\Program Files\DivX
2007-11-03 04:00 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-03 00:04 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-10-22 01:23 ——— d—–w C:\Program Files\TuneUp Utilities 2007
2007-10-20 13:16 ——— d—–w C:\Program Files\uTorrent
2007-10-19 21:30 ——— d—–w C:\Documents and Settings\Admin\Application Data\Pogo Games
2007-10-19 21:22 ——— d—–w C:\Program Files\ToGo Game
2007-10-19 00:37 ——— d—–w C:\Documents and Settings\Admin\Application Data\WildTangent
2007-10-18 00:35 ——— d—–w C:\Program Files\Astro Gemini Software
2007-10-17 01:51 ——— d—–w C:\Program Files\Jasc Software Inc
2007-10-17 01:05 ——— d—–w C:\Program Files\Lavalys
2007-10-16 23:08 ——— d—–w C:\Program Files\Common Files\xing shared
2007-10-16 23:07 ——— d—–w C:\Program Files\Real
2007-10-16 23:07 ——— d—–w C:\Program Files\Common Files\Real
2007-10-15 00:27 ——— d—–w C:\Program Files\Common Files\Jasc Software Inc
2007-10-15 00:25 ——— d—–w C:\Documents and Settings\Admin\Application Data\Jasc Software Inc
2007-10-14 23:46 ——— d—–w C:\Program Files\Common Files\Adobe Systems Shared
2007-10-14 17:25 ——— d—–w C:\Program Files\Google
2007-10-14 17:23 ——— d—–w C:\Program Files\WinCustomize
2007-10-14 17:07 ——— d—–w C:\Program Files\BillP Studios
2007-10-14 16:57 ——— d—–w C:\Documents and Settings\Admin\Application Data\WinPatrol
2007-10-13 03:07 ——— d—–w C:\Program Files\Xvid
2007-10-11 21:17 ——— d—–w C:\Program Files\Common Files\Stardock
2007-10-11 03:27 ——— d—–w C:\Program Files\Common Files\Acronis
2007-10-11 03:26 ——— d—–w C:\Program Files\Acronis
2007-10-11 03:06 ——— d—–w C:\Documents and Settings\Admin\Application Data\TuneUp Software
2007-10-11 01:47 ——— d—–w C:\Program Files\Java
2007-10-11 01:46 ——— d—–w C:\Program Files\Common Files\Java
2007-10-11 01:32 ——— d—–w C:\Program Files\microsoft frontpage
2007-08-21 06:15 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-11-02 20:49]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe" [2007-11-08 16:13]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]

[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 09:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 09:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

R0 UNPR;UNPR;C:\WINDOWS\system32\unpr.sys
R1 easdrv;easdrv;C:\WINDOWS\system32\DRIVERS\easdrv.sys
R1 epfwtdi;epfwtdi;C:\WINDOWS\system32\DRIVERS\epfwtdi.sys
R2 eamon;EAMON;C:\WINDOWS\system32\DRIVERS\eamon.sys
R2 ekrn;Eset Service;"C:\Program Files\Eset\ESET NOD32 Antivirus\ekrn.exe"
R2 epfw;epfw;C:\WINDOWS\system32\DRIVERS\epfw.sys
R3 Epfwndis;Eset Personal Firewall;C:\WINDOWS\system32\DRIVERS\Epfwndis.sys
R3 rtl8029;Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8029.SYS
S3 EhttpSrv;Eset HTTP Server;"C:\Program Files\Eset\ESET NOD32 Antivirus\EHttpSrv.exe"

*Newly Created Service* - CATCHME
*Newly Created Service* - WINDEFEND
.
Contents of the 'Scheduled Tasks' folder
"2007-11-21 20:51:11 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-21 15:36:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-21 15:36:55
.
— E O F —



just to serve my curiosity what is that "CATCHME" entry?

Logfile of HijackThis v1.99.1
Scan saved at 3:41:21 PM, on 11/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Eset\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\wpabaln.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\Spyware.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forums.whatthetech.com/wifes_comp_l….html&st=15
O4 - HKLM\..\Run: [egui] "C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\Eset\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\Eset\ESET NOD32 Antivirus\ekrn.exe

ComboFix 07-11-19.3 - Admin 2007-11-21 16:00:12.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.70 [GMT -8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Admin.BIODROID-001\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\elys.exe
C:\WINDOWS\system32\gebbx.exe
C:\WINDOWS\system32\gsvit.exe
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nsqwvrgm.exe
C:\WINDOWS\system32\psvyb.bak1
C:\WINDOWS\system32\psvyb.bak2
C:\WINDOWS\system32\psvyb.ini
C:\WINDOWS\system32\psvyb.ini2
C:\WINDOWS\system32\psvyb.tmp
C:\WINDOWS\system32\tqiphbty.exe
C:\WINDOWS\system32\tuqd.exe
C:\WINDOWS\system32\unpr.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\2658797892e6d7de257408c2a9f70b
C:\2658797892e6d7de257408c2a9f70b\$shtdwn$.req
C:\2658797892e6d7de257408c2a9f70b\mrt.exe
C:\2658797892e6d7de257408c2a9f70b\mrtstub.exe
C:\9f6f4a0b8eb38798796c9488c6396313
C:\9f6f4a0b8eb38798796c9488c6396313\$shtdwn$.req
C:\9f6f4a0b8eb38798796c9488c6396313\admparse.dll
C:\9f6f4a0b8eb38798796c9488c6396313\admparse.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\advpack.dll
C:\9f6f4a0b8eb38798796c9488c6396313\advpack.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\browseui.dll
C:\9f6f4a0b8eb38798796c9488c6396313\corpol.dll
C:\9f6f4a0b8eb38798796c9488c6396313\custsat.dll
C:\9f6f4a0b8eb38798796c9488c6396313\dxtmsft.dll
C:\9f6f4a0b8eb38798796c9488c6396313\dxtrans.dll
C:\9f6f4a0b8eb38798796c9488c6396313\extmgr.dll
C:\9f6f4a0b8eb38798796c9488c6396313\extmgr.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\feeddisc.wav
C:\9f6f4a0b8eb38798796c9488c6396313\hmmapi.dll
C:\9f6f4a0b8eb38798796c9488c6396313\hmmapi.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\html.iec
C:\9f6f4a0b8eb38798796c9488c6396313\html.iec.mui
C:\9f6f4a0b8eb38798796c9488c6396313\icardie.dll
C:\9f6f4a0b8eb38798796c9488c6396313\icardie.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\icrav03.rat
C:\9f6f4a0b8eb38798796c9488c6396313\ie4uinit.exe
C:\9f6f4a0b8eb38798796c9488c6396313\ie4uinit.exe.mui
C:\9f6f4a0b8eb38798796c9488c6396313\ieakeng.dll
C:\9f6f4a0b8eb38798796c9488c6396313\ieakeng.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\ieakmmc.chm
C:\9f6f4a0b8eb38798796c9488c6396313\ieaksie.dll
C:\9f6f4a0b8eb38798796c9488c6396313\ieaksie.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\ieakui.dll
C:\9f6f4a0b8eb38798796c9488c6396313\ieakui.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\ieapfltr.dat
C:\9f6f4a0b8eb38798796c9488c6396313\ieapfltr.dll
C:\9f6f4a0b8eb38798796c9488c6396313\iedkcs32.dll
C:\9f6f4a0b8eb38798796c9488c6396313\iedkcs32.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\iedw.exe
C:\9f6f4a0b8eb38798796c9488c6396313\iedw.exe.mui
C:\9f6f4a0b8eb38798796c9488c6396313\ieencode.dll
C:\9f6f4a0b8eb38798796c9488c6396313\ieeula.chm
C:\9f6f4a0b8eb38798796c9488c6396313\ieframe.dll
C:\9f6f4a0b8eb38798796c9488c6396313\ieframe.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\iepeers.dll
C:\9f6f4a0b8eb38798796c9488c6396313\iepeers.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\ieproxy.dll
C:\9f6f4a0b8eb38798796c9488c6396313\iernonce.dll
C:\9f6f4a0b8eb38798796c9488c6396313\iernonce.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\iertutil.dll
C:\9f6f4a0b8eb38798796c9488c6396313\iesetup.dll
C:\9f6f4a0b8eb38798796c9488c6396313\iesetup.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\iesupp.chm
C:\9f6f4a0b8eb38798796c9488c6396313\ieudinit.exe
C:\9f6f4a0b8eb38798796c9488c6396313\ieui.dll
C:\9f6f4a0b8eb38798796c9488c6396313\ieui.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\ieuinit.inf
C:\9f6f4a0b8eb38798796c9488c6396313\ieunatt.exe.mui
C:\9f6f4a0b8eb38798796c9488c6396313\iexplore.chm
C:\9f6f4a0b8eb38798796c9488c6396313\iexplore.exe
C:\9f6f4a0b8eb38798796c9488c6396313\iexplore.exe.mui
C:\9f6f4a0b8eb38798796c9488c6396313\imgutil.dll
C:\9f6f4a0b8eb38798796c9488c6396313\inetcorp.iem
C:\9f6f4a0b8eb38798796c9488c6396313\inetcpl.cpl
C:\9f6f4a0b8eb38798796c9488c6396313\inetcpl.cpl.mui
C:\9f6f4a0b8eb38798796c9488c6396313\inetres.adm
C:\9f6f4a0b8eb38798796c9488c6396313\inetset.iem
C:\9f6f4a0b8eb38798796c9488c6396313\infobar.wav
C:\9f6f4a0b8eb38798796c9488c6396313\inseng.dll
C:\9f6f4a0b8eb38798796c9488c6396313\inseng.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\install.ins
C:\9f6f4a0b8eb38798796c9488c6396313\jscript.dll
C:\9f6f4a0b8eb38798796c9488c6396313\jsproxy.dll
C:\9f6f4a0b8eb38798796c9488c6396313\licmgr10.dll
C:\9f6f4a0b8eb38798796c9488c6396313\licmgr10.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\msfeeds.dll
C:\9f6f4a0b8eb38798796c9488c6396313\msfeeds.mof
C:\9f6f4a0b8eb38798796c9488c6396313\msfeedsbs.dll
C:\9f6f4a0b8eb38798796c9488c6396313\msfeedsbs.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\msfeedsbs.mof
C:\9f6f4a0b8eb38798796c9488c6396313\msfeedssync.exe
C:\9f6f4a0b8eb38798796c9488c6396313\mshta.exe
C:\9f6f4a0b8eb38798796c9488c6396313\mshta.exe.mui
C:\9f6f4a0b8eb38798796c9488c6396313\mshtml.dll
C:\9f6f4a0b8eb38798796c9488c6396313\mshtml.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\mshtml.tlb
C:\9f6f4a0b8eb38798796c9488c6396313\mshtmled.dll
C:\9f6f4a0b8eb38798796c9488c6396313\mshtmled.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\mshtmler.dll
C:\9f6f4a0b8eb38798796c9488c6396313\mshtmler.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\msls31.dll
C:\9f6f4a0b8eb38798796c9488c6396313\msrating.dll
C:\9f6f4a0b8eb38798796c9488c6396313\msrating.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\mstime.dll
C:\9f6f4a0b8eb38798796c9488c6396313\navstart.wav
C:\9f6f4a0b8eb38798796c9488c6396313\occache.dll
C:\9f6f4a0b8eb38798796c9488c6396313\occache.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\occache.ini
C:\9f6f4a0b8eb38798796c9488c6396313\pngfilt.dll
C:\9f6f4a0b8eb38798796c9488c6396313\popupblk.wav
C:\9f6f4a0b8eb38798796c9488c6396313\shdocvw.dll
C:\9f6f4a0b8eb38798796c9488c6396313\shlwapi.dll
C:\9f6f4a0b8eb38798796c9488c6396313\spmsg.dll
C:\9f6f4a0b8eb38798796c9488c6396313\spuninst.exe
C:\9f6f4a0b8eb38798796c9488c6396313\spupdsvc.exe
C:\9f6f4a0b8eb38798796c9488c6396313\tdc.ocx
C:\9f6f4a0b8eb38798796c9488c6396313\ticrf.rat
C:\9f6f4a0b8eb38798796c9488c6396313\update\eula.rtf
C:\9f6f4a0b8eb38798796c9488c6396313\update\idndl.exe
C:\9f6f4a0b8eb38798796c9488c6396313\update\ie7.cat
C:\9f6f4a0b8eb38798796c9488c6396313\update\iecustom.dll
C:\9f6f4a0b8eb38798796c9488c6396313\update\iereseticons.exe
C:\9f6f4a0b8eb38798796c9488c6396313\update\iesetup.exe
C:\9f6f4a0b8eb38798796c9488c6396313\update\legitlibm.dll
C:\9f6f4a0b8eb38798796c9488c6396313\update\nlsdl.exe
C:\9f6f4a0b8eb38798796c9488c6396313\update\update.exe
C:\9f6f4a0b8eb38798796c9488c6396313\update\update.exe.manifest
C:\9f6f4a0b8eb38798796c9488c6396313\update\update.inf
C:\9f6f4a0b8eb38798796c9488c6396313\update\update.ver
C:\9f6f4a0b8eb38798796c9488c6396313\update\updspapi.dll
C:\9f6f4a0b8eb38798796c9488c6396313\update\xmllitesetup.exe
C:\9f6f4a0b8eb38798796c9488c6396313\url.dll
C:\9f6f4a0b8eb38798796c9488c6396313\urlmon.dll
C:\9f6f4a0b8eb38798796c9488c6396313\urlmon.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\vbscript.dll
C:\9f6f4a0b8eb38798796c9488c6396313\vgx.dll
C:\9f6f4a0b8eb38798796c9488c6396313\webcheck.dll
C:\9f6f4a0b8eb38798796c9488c6396313\webcheck.dll.mui
C:\9f6f4a0b8eb38798796c9488c6396313\webcheck.ini
C:\9f6f4a0b8eb38798796c9488c6396313\winfxdocobj.exe
C:\9f6f4a0b8eb38798796c9488c6396313\winfxdocobj.exe.mui
C:\9f6f4a0b8eb38798796c9488c6396313\wininet.dll
C:\9f6f4a0b8eb38798796c9488c6396313\wininet.dll.mui
C:\VundoFix Backups
C:\VundoFix Backups\qomnolm.dll.bad
C:\WINDOWS\system32\elys.exe
C:\WINDOWS\system32\gebbx.exe
C:\WINDOWS\system32\gsvit.exe
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nsqwvrgm.exe
C:\WINDOWS\system32\psvyb.bak1
C:\WINDOWS\system32\psvyb.bak2
C:\WINDOWS\system32\psvyb.ini
C:\WINDOWS\system32\psvyb.ini2
C:\WINDOWS\system32\psvyb.tmp
C:\WINDOWS\system32\tqiphbty.exe
C:\WINDOWS\system32\tuqd.exe
C:\WINDOWS\system32\unpr.sys

.
((((((((((((((((((((((((( Files Created from 2007-10-22 to 2007-11-22 )))))))))))))))))))))))))))))))
.

2007-11-21 12:48 d——– C:\Program Files\Windows Defender
2007-11-21 10:53 0 –a—— C:\WINDOWS\nsreg.dat
2007-11-20 15:41 d—s—- C:\Documents and Settings\Admin.BIODROID-001\UserData
2007-11-20 15:30 d——– C:\Documents and Settings\Admin.BIODROID-001\DoctorWeb
2007-11-20 14:42 29 –ah—– C:\WINDOWS\system32\ir4fc.dns
2007-11-20 03:16 129,400 –a—— C:\WINDOWS\system32\TZLog.log
2007-11-19 21:16 d——– C:\Documents and Settings\Admin.BIODROID-001\Application Data\TuneUp Software
2007-11-19 18:09 d——– C:\Documents and Settings\Admin.BIODROID-001\Application Data\ESET
2007-11-19 13:20 d——– C:\Program Files\EsetOnlineScanner
2007-11-19 13:15 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Eset
2007-11-19 13:13 78,415 –a—— C:\WINDOWS\system32\drivers\klif.cab
2007-11-19 11:03 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2007-11-19 11:03 d——– C:\Documents and Settings\Admin.BIODROID-001\Application Data\SUPERAntiSpyware.com
2007-11-19 01:05 28,288 –a–c— C:\WINDOWS\system32\dllcache\xjis.nls
2007-11-19 01:04 41,600 –a–c— C:\WINDOWS\system32\dllcache\weitekp9.dll
2007-11-19 01:03 26,112 –a–c— C:\WINDOWS\system32\dllcache\romanime.ime
2007-11-19 01:03 15,872 –a–c— C:\WINDOWS\system32\dllcache\padrs404.dll
2007-11-19 01:03 14,848 –a–c— C:\WINDOWS\system32\dllcache\register.exe
2007-11-19 01:02 92,416 –a–c— C:\WINDOWS\system32\dllcache\mga.sys
2007-11-19 01:02 92,032 –a–c— C:\WINDOWS\system32\dllcache\mga.dll
2007-11-19 01:02 7,680 –a–c— C:\WINDOWS\system32\dllcache\migregdb.exe
2007-11-19 01:01 471,102 –a–c— C:\WINDOWS\system32\dllcache\imskdic.dll
2007-11-19 01:01 67,072 –a–c— C:\WINDOWS\system32\dllcache\imscinst.exe
2007-11-19 01:01 6,656 –a–c— C:\WINDOWS\system32\dllcache\kbdlk41a.dll
2007-11-19 01:01 6,144 –a–c— C:\WINDOWS\system32\dllcache\kbdlk41j.dll
2007-11-19 01:01 5,632 –a–c— C:\WINDOWS\system32\dllcache\kbdvntc.dll
2007-11-19 01:01 5,632 –a–c— C:\WINDOWS\system32\dllcache\kbdsyr1.dll
2007-11-19 01:01 5,632 –a–c— C:\WINDOWS\system32\dllcache\kbdfa.dll
2007-11-19 01:01 5,120 –a–c— C:\WINDOWS\system32\dllcache\kbdgeo.dll
2007-11-19 01:01 5,120 –a–c— C:\WINDOWS\system32\dllcache\kbdarme.dll
2007-11-19 01:00 514,587 –a–c— C:\WINDOWS\system32\dllcache\edb500.dll
2007-11-19 01:00 480,256 –a–c— C:\WINDOWS\system32\dllcache\cintsetp.exe
2007-11-19 01:00 198,656 –a–c— C:\WINDOWS\system32\dllcache\cintime.dll
2007-11-19 01:00 108,827 –a–c— C:\WINDOWS\system32\dllcache\hanja.lex
2007-11-19 01:00 101,888 –a–c— C:\WINDOWS\system32\dllcache\evntagnt.dll
2007-11-19 01:00 92,160 –a–c— C:\WINDOWS\system32\dllcache\evntwin.exe
2007-11-19 01:00 57,856 –a–c— C:\WINDOWS\system32\dllcache\esuimgd.dll
2007-11-19 01:00 57,344 –a–c— C:\WINDOWS\system32\dllcache\cplexe.exe
2007-11-19 01:00 45,056 –a–c— C:\WINDOWS\system32\dllcache\esunid.dll
2007-11-19 01:00 36,864 –a–c— C:\WINDOWS\system32\dllcache\hanjadic.dll
2007-11-19 01:00 31,744 –a–c— C:\WINDOWS\system32\dllcache\esucmd.dll
2007-11-19 01:00 25,856 –a–c— C:\WINDOWS\system32\dllcache\et4000.sys
2007-11-19 01:00 24,576 –a–c— C:\WINDOWS\system32\dllcache\fpadmcgi.exe
2007-11-19 01:00 24,064 –a–c— C:\WINDOWS\system32\dllcache\evntcmd.exe
2007-11-19 01:00 21,504 –a–c— C:\WINDOWS\system32\dllcache\cintlgnt.ime
2007-11-19 01:00 20,541 –a–c— C:\WINDOWS\system32\dllcache\fpadmdll.dll
2007-11-19 01:00 18,944 –a–c— C:\WINDOWS\system32\dllcache\cprofile.exe
2007-11-19 00:59 66,594 –a–c— C:\WINDOWS\system32\dllcache\c_864.nls
2007-11-19 00:59 66,594 –a–c— C:\WINDOWS\system32\dllcache\c_862.nls
2007-11-19 00:59 66,594 –a–c— C:\WINDOWS\system32\dllcache\c_858.nls
2007-11-19 00:59 45,056 –a–c— C:\WINDOWS\system32\dllcache\EXCH_aqadmin.dll
2007-11-19 00:59 32,768 –a–c— C:\WINDOWS\system32\dllcache\tcptest.exe
2007-11-19 00:59 20,536 –a–c— C:\WINDOWS\system32\dllcache\shtml.dll
2007-11-19 00:59 19,456 –a–c— C:\WINDOWS\system32\dllcache\agt0401.dll
2007-11-19 00:59 16,384 –a–c— C:\WINDOWS\system32\dllcache\tcptsat.dll
2007-11-19 00:59 16,384 –a–c— C:\WINDOWS\system32\dllcache\shtml.exe
2007-11-19 00:59 5,632 –a–c— C:\WINDOWS\system32\dllcache\EXCH_adsiisex.dll
2007-11-19 00:58 188,416 –a–c— C:\WINDOWS\system32\dllcache\fpcount.exe
2007-11-19 00:58 188,416 –a–c— C:\WINDOWS\system32\dllcache\cfgwiz.exe
2007-11-19 00:58 20,540 –a–c— C:\WINDOWS\system32\dllcache\author.dll
2007-11-19 00:58 20,540 –a–c— C:\WINDOWS\system32\dllcache\admin.dll
2007-11-19 00:58 16,384 –a–c— C:\WINDOWS\system32\dllcache\author.exe
2007-11-19 00:58 16,384 –a–c— C:\WINDOWS\system32\dllcache\admin.exe
2007-11-19 00:58 2,577 –a—— C:\WINDOWS\system32\CONFIG.NT
2007-11-19 00:55 d–hs—- C:\Documents and Settings\All Users.WINDOWS\DRM
2007-11-19 00:55 488 -rah—– C:\WINDOWS\system32\WindowsLogon.manifest
2007-11-19 00:54 4,399,505 –a–c— C:\WINDOWS\system32\dllcache\nls302en.lex
2007-11-19 00:54 749 -rah—– C:\WINDOWS\system32\ncpa.cpl.manifest
2007-11-19 00:53 3,166,208 –a–c— C:\WINDOWS\system32\dllcache\msgr3en.dll
2007-11-19 00:53 1,134,592 –a–c— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-11-19 00:53 786,432 –a–c— C:\WINDOWS\system32\dllcache\migrate.exe
2007-11-19 00:53 774,144 –a–c— C:\WINDOWS\system32\dllcache\setup_wm.exe
2007-11-19 00:53 768,512 –a–c— C:\WINDOWS\system32\dllcache\helpctr.exe
2007-11-19 00:53 683,520 –a—— C:\WINDOWS\system32\inetcomm.dll
2007-11-19 00:53 430,592 –a–c— C:\WINDOWS\system32\dllcache\wuapi.dll
2007-11-19 00:53 274,944 –a–c— C:\WINDOWS\system32\dllcache\mstask.dll
2007-11-19 00:53 274,432 –a—— C:\WINDOWS\system32\inetcfg.dll
2007-11-19 00:53 188,416 –a—— C:\WINDOWS\system32\msh261.drv
2007-11-19 00:53 183,296 –a–c— C:\WINDOWS\system32\dllcache\wuaueng1.dll
2007-11-19 00:53 165,888 –a–c— C:\WINDOWS\system32\dllcache\wuauclt1.exe
2007-11-19 00:53 162,304 –a–c— C:\WINDOWS\system32\dllcache\wuaucpl.cpl
2007-11-19 00:53 150,528 –a–c— C:\WINDOWS\system32\dllcache\uploadm.exe
2007-11-19 00:53 128,896 –a—— C:\WINDOWS\system32\drivers\fltmgr.sys
2007-11-19 00:53 128,896 –a–c— C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-11-19 00:53 120,320 –a–c— C:\WINDOWS\system32\dllcache\wuweb.dll
2007-11-19 00:53 118,784 –a—— C:\WINDOWS\system32\msg723.acm
2007-11-19 00:53 112,640 –a–c— C:\WINDOWS\system32\dllcache\wucltui.dll
2007-11-19 00:53 111,104 –a–c— C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-11-19 00:53 81,920 –a—— C:\WINDOWS\system32\ils.dll
2007-11-19 00:53 81,920 –a–c— C:\WINDOWS\system32\dllcache\ils.dll
2007-11-19 00:53 73,728 –a–c— C:\WINDOWS\system32\dllcache\wmplayer.exe
2007-11-19 00:53 73,472 –a—— C:\WINDOWS\system32\drivers\sr.sys
2007-11-19 00:53 64,512 –a–c— C:\WINDOWS\system32\dllcache\acctres.dll
2007-11-19 00:53 48,128 –a—— C:\WINDOWS\system32\inetres.dll
2007-11-19 00:53 33,624 –a–c— C:\WINDOWS\system32\dllcache\wups.dll
2007-11-19 00:53 23,040 –a–c— C:\WINDOWS\system32\dllcache\fltmc.exe
2007-11-19 00:53 16,896 –a–c— C:\WINDOWS\system32\dllcache\fltlib.dll
2007-11-19 00:53 12,288 –a—— C:\WINDOWS\system32\nmevtmsg.dll
2007-11-19 00:53 12,288 –a–c— C:\WINDOWS\system32\dllcache\mstinit.exe
2007-11-19 00:53 12,288 –a–c— C:\WINDOWS\system32\dllcache\cb32.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-19 04:09 ——— d—–w C:\Program Files\Windows Media Connect 2
2007-11-19 04:05 ——— d—–w C:\Program Files\RegVac Registry Cleaner
2007-11-19 03:57 ——— d—–w C:\Program Files\AC3Filter
2007-11-19 02:51 ——— d—–w C:\Documents and Settings\Admin\Application Data\uTorrent
2007-11-19 02:26 ——— d—–w C:\Documents and Settings\Admin\Application Data\Lavasoft
2007-11-09 00:10 27,656 —-a-w C:\WINDOWS\system32\drivers\easdrv.sys
2007-11-09 00:09 33,800 —-a-w C:\WINDOWS\system32\drivers\eamon.sys
2007-11-08 20:56 ——— d—–w C:\Program Files\WildGames
2007-11-07 23:53 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-11-07 21:01 ——— d—–w C:\Program Files\Common Files\Adobe
2007-11-06 01:27 ——— d—–w C:\Program Files\The Weather Channel FW
2007-11-03 23:00 ——— d—–w C:\Program Files\DivX
2007-11-03 04:00 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-03 00:04 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-10-22 01:23 ——— d—–w C:\Program Files\TuneUp Utilities 2007
2007-10-20 13:16 ——— d—–w C:\Program Files\uTorrent
2007-10-19 21:30 ——— d—–w C:\Documents and Settings\Admin\Application Data\Pogo Games
2007-10-19 21:22 ——— d—–w C:\Program Files\ToGo Game
2007-10-19 00:37 ——— d—–w C:\Documents and Settings\Admin\Application Data\WildTangent
2007-10-18 00:35 ——— d—–w C:\Program Files\Astro Gemini Software
2007-10-17 01:51 ——— d—–w C:\Program Files\Jasc Software Inc
2007-10-17 01:05 ——— d—–w C:\Program Files\Lavalys
2007-10-16 23:08 ——— d—–w C:\Program Files\Common Files\xing shared
2007-10-16 23:07 ——— d—–w C:\Program Files\Real
2007-10-16 23:07 ——— d—–w C:\Program Files\Common Files\Real
2007-10-15 00:27 ——— d—–w C:\Program Files\Common Files\Jasc Software Inc
2007-10-15 00:25 ——— d—–w C:\Documents and Settings\Admin\Application Data\Jasc Software Inc
2007-10-14 23:46 ——— d—–w C:\Program Files\Common Files\Adobe Systems Shared
2007-10-14 17:25 ——— d—–w C:\Program Files\Google
2007-10-14 17:23 ——— d—–w C:\Program Files\WinCustomize
2007-10-14 17:07 ——— d—–w C:\Program Files\BillP Studios
2007-10-14 16:57 ——— d—–w C:\Documents and Settings\Admin\Application Data\WinPatrol
2007-10-13 03:07 ——— d—–w C:\Program Files\Xvid
2007-10-11 21:17 ——— d—–w C:\Program Files\Common Files\Stardock
2007-10-11 03:27 ——— d—–w C:\Program Files\Common Files\Acronis
2007-10-11 03:26 ——— d—–w C:\Program Files\Acronis
2007-10-11 03:06 ——— d—–w C:\Documents and Settings\Admin\Application Data\TuneUp Software
2007-10-11 01:47 ——— d—–w C:\Program Files\Java
2007-10-11 01:46 ——— d—–w C:\Program Files\Common Files\Java
2007-10-11 01:32 ——— d—–w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-11-02 20:49]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe" [2007-11-08 16:13]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]

[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 09:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 09:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

R1 easdrv;easdrv;C:\WINDOWS\system32\DRIVERS\easdrv.sys
R1 epfwtdi;epfwtdi;C:\WINDOWS\system32\DRIVERS\epfwtdi.sys
R2 eamon;EAMON;C:\WINDOWS\system32\DRIVERS\eamon.sys
R2 ekrn;Eset Service;"C:\Program Files\Eset\ESET NOD32 Antivirus\ekrn.exe"
R2 epfw;epfw;C:\WINDOWS\system32\DRIVERS\epfw.sys
R3 Epfwndis;Eset Personal Firewall;C:\WINDOWS\system32\DRIVERS\Epfwndis.sys
R3 rtl8029;Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8029.SYS
S0 UNPR;UNPR;C:\WINDOWS\system32\unpr.sys
S3 EhttpSrv;Eset HTTP Server;"C:\Program Files\Eset\ESET NOD32 Antivirus\EHttpSrv.exe"

.
Contents of the 'Scheduled Tasks' folder
"2007-11-21 20:51:11 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-21 16:05:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-21 16:06:12 - machine was rebooted
C:\ComboFix2.txt … 2007-11-21 15:36
.
— E O F —

Logfile of HijackThis v1.99.1
Scan saved at 4:08:56 PM, on 11/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wpabaln.exe
C:\Program Files\HijackThis\Spyware.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forums.whatthetech.com/wifes_comp_l….html&st=15
O4 - HKLM\..\Run: [egui] "C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\Eset\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\Eset\ESET NOD32 Antivirus\ekrn.exe

ComboFix 07-11-19.3 - Admin 2007-11-23 18:52:23.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.62 [GMT -8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Admin.BIODROID-001\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-10-24 to 2007-11-24 )))))))))))))))))))))))))))))))
.

2007-11-21 23:46 d——– C:\Program Files\ISS
2007-11-21 23:46 147,608 ——— C:\WINDOWS\system32\blackdll.dll
2007-11-21 23:46 104,968 ——— C:\WINDOWS\system32\drivers\RapDrv.sys
2007-11-21 23:46 36,644 ——— C:\WINDOWS\system32\drivers\RapFile.sys
2007-11-21 23:46 24,344 ——— C:\WINDOWS\system32\drivers\RapNet.sys
2007-11-21 23:46 873 –a—— C:\WINDOWS\system32\firewall.log
2007-11-21 23:46 10 –a—— C:\WINDOWS\system32\drivers\tmbi.sys
2007-11-21 23:43 d——– C:\Documents and Settings\ADMIN~1~BIO\LOCALS~1
2007-11-21 23:33 d——– C:\Documents and Settings\Admin.BIODROID-001\Application Data\uTorrent
2007-11-21 23:28 29,704 –a—— C:\WINDOWS\system32\uxtuneup.dll
2007-11-21 23:26 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\TuneUp Software
2007-11-21 22:31 d——– C:\Documents and Settings\Admin.BIODROID-001\Application Data\Bitdefender
2007-11-21 22:30 d——– C:\Program Files\BitDefender
2007-11-21 22:30 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\BitDefender
2007-11-21 22:30 6,058,496 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll
2007-11-21 22:30 2,455,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2007-11-21 22:30 991,232 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2007-11-21 22:30 459,264 —–c— C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-11-21 22:30 383,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-11-21 22:30 267,776 —–c— C:\WINDOWS\system32\dllcache\iertutil.dll
2007-11-21 22:30 52,224 —–c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-11-21 22:30 13,824 —–c— C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-11-21 22:29 d——– C:\Program Files\Common Files\BitDefender
2007-11-21 21:45 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Avg7
2007-11-21 21:15 39,936 –a—— C:\WINDOWS\system32\OLD2.tmp
2007-11-21 21:15 38,912 –a—— C:\WINDOWS\system32\wpabaln.exe
2007-11-21 21:15 24,064 –a—— C:\WINDOWS\system32\devldr32.exe
2007-11-21 21:15 20,480 –a—— C:\WINDOWS\system32\wscntfy.exe
2007-11-21 20:59 33,280 –a—— C:\WINDOWS\system32\rundll32.exe
2007-11-21 20:58 13,312 –a—— C:\WINDOWS\system32\savedump.exe
2007-11-21 20:58 13,312 –a–c— C:\WINDOWS\system32\dllcache\savedump.exe
2007-11-21 12:48 d——– C:\Program Files\Windows Defender
2007-11-21 10:53 0 –a—— C:\WINDOWS\nsreg.dat
2007-11-20 15:41 d—s—- C:\Documents and Settings\Admin.BIODROID-001\UserData
2007-11-20 15:30 d——– C:\Documents and Settings\Admin.BIODROID-001\DoctorWeb
2007-11-20 14:42 29 –ah—– C:\WINDOWS\system32\ir4fc.dns
2007-11-20 03:16 129,400 –a—— C:\WINDOWS\system32\TZLog.log
2007-11-19 21:16 d——– C:\Documents and Settings\Admin.BIODROID-001\Application Data\TuneUp Software
2007-11-19 18:09 d——– C:\Documents and Settings\Admin.BIODROID-001\Application Data\ESET
2007-11-19 13:15 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Eset
2007-11-19 13:13 78,415 –a—— C:\WINDOWS\system32\drivers\klif.cab
2007-11-19 11:03 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2007-11-19 11:03 d——– C:\Documents and Settings\Admin.BIODROID-001\Application Data\SUPERAntiSpyware.com
2007-11-19 01:05 28,288 –a–c— C:\WINDOWS\system32\dllcache\xjis.nls
2007-11-19 01:04 41,600 –a–c— C:\WINDOWS\system32\dllcache\weitekp9.dll
2007-11-19 01:03 15,872 –a–c— C:\WINDOWS\system32\dllcache\padrs404.dll
2007-11-19 01:03 14,848 –a–c— C:\WINDOWS\system32\dllcache\register.exe
2007-11-19 01:02 92,416 –a–c— C:\WINDOWS\system32\dllcache\mga.sys
2007-11-19 01:02 92,032 –a–c— C:\WINDOWS\system32\dllcache\mga.dll
2007-11-19 01:02 7,680 –a–c— C:\WINDOWS\system32\dllcache\migregdb.exe
2007-11-19 01:01 471,102 –a–c— C:\WINDOWS\system32\dllcache\imskdic.dll
2007-11-19 01:01 67,072 –a–c— C:\WINDOWS\system32\dllcache\imscinst.exe
2007-11-19 01:01 6,656 –a–c— C:\WINDOWS\system32\dllcache\kbdlk41a.dll
2007-11-19 01:01 6,144 –a–c— C:\WINDOWS\system32\dllcache\kbdlk41j.dll
2007-11-19 01:01 5,632 –a–c— C:\WINDOWS\system32\dllcache\kbdvntc.dll
2007-11-19 01:01 5,632 –a–c— C:\WINDOWS\system32\dllcache\kbdsyr1.dll
2007-11-19 01:01 5,632 –a–c— C:\WINDOWS\system32\dllcache\kbdfa.dll
2007-11-19 01:01 5,120 –a–c— C:\WINDOWS\system32\dllcache\kbdgeo.dll
2007-11-19 01:01 5,120 –a–c— C:\WINDOWS\system32\dllcache\kbdarme.dll
2007-11-19 01:00 514,587 –a–c— C:\WINDOWS\system32\dllcache\edb500.dll
2007-11-19 01:00 480,256 –a–c— C:\WINDOWS\system32\dllcache\cintsetp.exe
2007-11-19 01:00 198,656 –a–c— C:\WINDOWS\system32\dllcache\cintime.dll
2007-11-19 01:00 108,827 –a–c— C:\WINDOWS\system32\dllcache\hanja.lex
2007-11-19 01:00 101,888 –a–c— C:\WINDOWS\system32\dllcache\evntagnt.dll
2007-11-19 01:00 92,160 –a–c— C:\WINDOWS\system32\dllcache\evntwin.exe
2007-11-19 01:00 57,856 –a–c— C:\WINDOWS\system32\dllcache\esuimgd.dll
2007-11-19 01:00 57,344 –a–c— C:\WINDOWS\system32\dllcache\cplexe.exe
2007-11-19 01:00 45,056 –a–c— C:\WINDOWS\system32\dllcache\esunid.dll
2007-11-19 01:00 36,864 –a–c— C:\WINDOWS\system32\dllcache\hanjadic.dll
2007-11-19 01:00 31,744 –a–c— C:\WINDOWS\system32\dllcache\esucmd.dll
2007-11-19 01:00 25,856 –a–c— C:\WINDOWS\system32\dllcache\et4000.sys
2007-11-19 01:00 24,576 –a–c— C:\WINDOWS\system32\dllcache\fpadmcgi.exe
2007-11-19 01:00 24,064 –a–c— C:\WINDOWS\system32\dllcache\evntcmd.exe
2007-11-19 01:00 21,504 –a–c— C:\WINDOWS\system32\dllcache\cintlgnt.ime
2007-11-19 01:00 20,541 –a–c— C:\WINDOWS\system32\dllcache\fpadmdll.dll
2007-11-19 01:00 18,944 –a–c— C:\WINDOWS\system32\dllcache\cprofile.exe
2007-11-19 00:59 66,594 –a–c— C:\WINDOWS\system32\dllcache\c_864.nls
2007-11-19 00:59 66,594 –a–c— C:\WINDOWS\system32\dllcache\c_862.nls
2007-11-19 00:59 66,594 –a–c— C:\WINDOWS\system32\dllcache\c_858.nls
2007-11-19 00:59 45,056 –a–c— C:\WINDOWS\system32\dllcache\EXCH_aqadmin.dll
2007-11-19 00:59 32,768 –a–c— C:\WINDOWS\system32\dllcache\tcptest.exe
2007-11-19 00:59 20,536 –a–c— C:\WINDOWS\system32\dllcache\shtml.dll
2007-11-19 00:59 19,456 –a–c— C:\WINDOWS\system32\dllcache\agt0401.dll
2007-11-19 00:59 16,384 –a–c— C:\WINDOWS\system32\dllcache\tcptsat.dll
2007-11-19 00:59 16,384 –a–c— C:\WINDOWS\system32\dllcache\shtml.exe
2007-11-19 00:59 5,632 –a–c— C:\WINDOWS\system32\dllcache\EXCH_adsiisex.dll
2007-11-19 00:58 188,416 –a–c— C:\WINDOWS\system32\dllcache\fpcount.exe
2007-11-19 00:58 188,416 –a–c— C:\WINDOWS\system32\dllcache\cfgwiz.exe
2007-11-19 00:58 20,540 –a–c— C:\WINDOWS\system32\dllcache\author.dll
2007-11-19 00:58 20,540 –a–c— C:\WINDOWS\system32\dllcache\admin.dll
2007-11-19 00:58 16,384 –a–c— C:\WINDOWS\system32\dllcache\author.exe
2007-11-19 00:58 16,384 –a–c— C:\WINDOWS\system32\dllcache\admin.exe
2007-11-19 00:58 2,577 –a—— C:\WINDOWS\system32\CONFIG.NT
2007-11-19 00:57 23,392 –a—— C:\WINDOWS\system32\nscompat.tlb
2007-11-19 00:55 d–hs—- C:\Documents and Settings\All Users.WINDOWS\DRM
2007-11-19 00:55 488 -rah—– C:\WINDOWS\system32\WindowsLogon.manifest
2007-11-19 00:54 4,399,505 –a–c— C:\WINDOWS\system32\dllcache\nls302en.lex
2007-11-19 00:54 749 -rah—– C:\WINDOWS\system32\sapi.cpl.manifest
2007-11-19 00:54 749 -rah—– C:\WINDOWS\system32\nwc.cpl.manifest
2007-11-19 00:54 749 -rah—– C:\WINDOWS\system32\ncpa.cpl.manifest

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-22 07:46 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-22 07:43 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-11-22 07:28 ——— d—–w C:\Program Files\TuneUp Utilities 2007
2007-11-19 04:09 ——— d—–w C:\Program Files\Windows Media Connect 2
2007-11-19 04:05 ——— d—–w C:\Program Files\RegVac Registry Cleaner
2007-11-19 03:57 ——— d—–w C:\Program Files\AC3Filter
2007-11-19 02:51 ——— d—–w C:\Documents and Settings\Admin\Application Data\uTorrent
2007-11-19 02:26 ——— d—–w C:\Documents and Settings\Admin\Application Data\Lavasoft
2007-11-08 20:56 ——— d—–w C:\Program Files\WildGames
2007-11-07 21:01 ——— d—–w C:\Program Files\Common Files\Adobe
2007-11-06 01:27 ——— d—–w C:\Program Files\The Weather Channel FW
2007-11-03 23:00 ——— d—–w C:\Program Files\DivX
2007-11-03 00:04 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-10-20 13:16 ——— d—–w C:\Program Files\uTorrent
2007-10-19 21:30 ——— d—–w C:\Documents and Settings\Admin\Application Data\Pogo Games
2007-10-19 21:22 ——— d—–w C:\Program Files\ToGo Game
2007-10-19 00:37 ——— d—–w C:\Documents and Settings\Admin\Application Data\WildTangent
2007-10-18 00:35 ——— d—–w C:\Program Files\Astro Gemini Software
2007-10-17 01:51 ——— d—–w C:\Program Files\Jasc Software Inc
2007-10-17 01:05 ——— d—–w C:\Program Files\Lavalys
2007-10-16 23:08 ——— d—–w C:\Program Files\Common Files\xing shared
2007-10-16 23:07 ——— d—–w C:\Program Files\Real
2007-10-16 23:07 ——— d—–w C:\Program Files\Common Files\Real
2007-10-15 00:27 ——— d—–w C:\Program Files\Common Files\Jasc Software Inc
2007-10-15 00:25 ——— d—–w C:\Documents and Settings\Admin\Application Data\Jasc Software Inc
2007-10-14 23:46 ——— d—–w C:\Program Files\Common Files\Adobe Systems Shared
2007-10-14 17:25 ——— d—–w C:\Program Files\Google
2007-10-14 17:23 ——— d—–w C:\Program Files\WinCustomize
2007-10-14 17:07 ——— d—–w C:\Program Files\BillP Studios
2007-10-14 16:57 ——— d—–w C:\Documents and Settings\Admin\Application Data\WinPatrol
2007-10-13 03:07 ——— d—–w C:\Program Files\Xvid
2007-10-11 21:17 ——— d—–w C:\Program Files\Common Files\Stardock
2007-10-11 03:27 ——— d—–w C:\Program Files\Common Files\Acronis
2007-10-11 03:26 ——— d—–w C:\Program Files\Acronis
2007-10-11 03:06 ——— d—–w C:\Documents and Settings\Admin\Application Data\TuneUp Software
2007-10-11 01:47 ——— d—–w C:\Program Files\Java
2007-10-11 01:46 ——— d—–w C:\Program Files\Common Files\Java
2007-10-11 01:32 ——— d—–w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((( snapshot_2007-11-21_21.21.16.03 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-08-04 12:00:00 61,440 -c–a-w C:\WINDOWS\ie7\admparse.dll
+ 2004-08-04 12:00:00 99,840 -c–a-w C:\WINDOWS\ie7\advpack.dll
+ 2004-08-04 12:00:00 35,328 -c–a-w C:\WINDOWS\ie7\corpol.dll
+ 2006-06-03 11:40:49 33,792 -c–a-w C:\WINDOWS\ie7\custsat.dll
+ 2007-08-22 13:12:16 357,888 -c–a-w C:\WINDOWS\ie7\dxtmsft.dll
+ 2007-08-22 13:12:16 205,312 -c–a-w C:\WINDOWS\ie7\dxtrans.dll
+ 2007-08-22 13:12:16 55,808 -c–a-w C:\WINDOWS\ie7\extmgr.dll
+ 2004-08-08 10:30:00 38,912 -c–a-w C:\WINDOWS\ie7\hmmapi.dll
+ 2004-08-04 12:00:00 34,304 -c–a-w C:\WINDOWS\ie7\ie4uinit.exe
+ 2004-08-04 12:00:00 139,264 -c–a-w C:\WINDOWS\ie7\ieakeng.dll
+ 2004-08-04 12:00:00 216,576 -c–a-w C:\WINDOWS\ie7\ieaksie.dll
+ 2004-08-04 12:00:00 221,184 -c–a-w C:\WINDOWS\ie7\ieakui.dll
+ 2004-08-04 12:00:00 323,584 -c–a-w C:\WINDOWS\ie7\iedkcs32.dll
+ 2007-08-21 10:30:46 18,432 -c–a-w C:\WINDOWS\ie7\iedw.exe
+ 2004-08-04 12:00:00 81,920 -c–a-w C:\WINDOWS\ie7\ieencode.dll
+ 2007-08-22 13:12:16 251,392 -c–a-w C:\WINDOWS\ie7\iepeers.dll
+ 2004-08-04 12:00:00 48,640 -c–a-w C:\WINDOWS\ie7\iernonce.dll
+ 2004-08-04 12:00:00 62,976 -c–a-w C:\WINDOWS\ie7\iesetup.dll
+ 2004-08-04 12:00:00 93,184 -c–a-w C:\WINDOWS\ie7\iexplore.exe
+ 2004-08-04 12:00:00 35,840 -c–a-w C:\WINDOWS\ie7\imgutil.dll
+ 2007-08-22 13:12:16 96,256 -c–a-w C:\WINDOWS\ie7\inseng.dll
+ 2006-05-18 05:24:25 450,560 -c–a-w C:\WINDOWS\ie7\jscript.dll
+ 2007-08-22 13:12:16 16,384 -c–a-w C:\WINDOWS\ie7\jsproxy.dll
+ 2004-08-04 12:00:00 22,016 -c–a-w C:\WINDOWS\ie7\licmgr10.dll
+ 2004-08-04 12:00:00 29,184 -c–a-w C:\WINDOWS\ie7\mshta.exe
+ 2007-08-22 13:12:17 3,058,176 -c–a-w C:\WINDOWS\ie7\mshtml.dll
+ 2007-08-22 13:12:17 449,024 -c–a-w C:\WINDOWS\ie7\mshtmled.dll
+ 2004-08-04 12:00:00 56,832 -c–a-w C:\WINDOWS\ie7\mshtmler.dll
+ 2004-08-04 12:00:00 146,432 -c–a-w C:\WINDOWS\ie7\msls31.dll
+ 2007-08-22 13:12:17 146,432 -c–a-w C:\WINDOWS\ie7\msrating.dll
+ 2007-08-22 13:12:17 532,480 -c–a-w C:\WINDOWS\ie7\mstime.dll
+ 2004-08-04 12:00:00 96,256 -c–a-w C:\WINDOWS\ie7\occache.dll
+ 2007-08-22 13:12:17 39,424 -c–a-w C:\WINDOWS\ie7\pngfilt.dll
+ 2007-08-14 02:54:42 32,960 -c–a-w C:\WINDOWS\ie7\spuninst\iecustom.dll
+ 2007-08-14 02:52:06 66,048 -c–a-w C:\WINDOWS\ie7\spuninst\ieResetIcons.exe
+ 2006-09-07 01:43:16 213,216 -c–a-w C:\WINDOWS\ie7\spuninst\spuninst.exe
+ 2006-09-07 01:43:18 371,424 -c–a-w C:\WINDOWS\ie7\spuninst\updspapi.dll
+ 2004-08-04 12:00:00 37,888 -c–a-w C:\WINDOWS\ie7\url.dll
+ 2007-08-22 13:12:18 615,424 -c–a-w C:\WINDOWS\ie7\urlmon.dll
+ 2004-08-04 12:00:00 417,792 -c–a-w C:\WINDOWS\ie7\vbscript.dll
+ 2007-06-26 15:13:22 851,968 -c–a-w C:\WINDOWS\ie7\vgx.dll
+ 2004-08-04 12:00:00 276,480 -c–a-w C:\WINDOWS\ie7\webcheck.dll
+ 2007-08-22 13:12:18 658,944 -c–a-w C:\WINDOWS\ie7\wininet.dll
+ 2007-08-14 02:39:00 123,904 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\advpack.dll
+ 2007-08-14 02:35:38 214,528 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\dxtrans.dll
+ 2007-08-14 02:54:10 131,584 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\extmgr.dll
+ 2007-08-14 02:36:26 61,952 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\icardie.dll
+ 2007-08-14 02:39:06 54,784 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\ie4uinit.exe
+ 2007-08-14 02:39:26 152,064 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\ieakeng.dll
+ 2007-08-14 02:39:54 229,376 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\ieaksie.dll
+ 2007-08-14 01:56:54 161,792 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\ieakui.dll
+ 2007-02-13 00:10:12 2,451,312 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\ieapfltr.dat
+ 2007-07-11 20:27:48 383,488 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\ieapfltr.dll
+ 2007-08-14 02:39:50 382,976 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\iedkcs32.dll
+ 2007-08-14 02:54:10 6,049,280 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\ieframe.dll
+ 2007-08-14 02:39:10 43,008 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\iernonce.dll
+ 2007-08-14 02:34:04 266,752 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\iertutil.dll
+ 2007-08-14 02:39:10 13,312 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\ieudinit.exe
+ 2007-08-14 02:43:56 622,080 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\iexplore.exe
+ 2007-08-14 02:43:56 622,080 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\iexplore.exe.000
+ 2007-08-14 02:54:10 27,136 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\jsproxy.dll
+ 2007-08-14 02:54:10 458,752 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\msfeeds.dll
+ 2007-08-14 02:54:10 50,688 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\msfeedsbs.dll
+ 2007-08-14 02:54:12 3,578,368 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\mshtml.dll
+ 2007-08-14 02:54:10 475,648 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\mshtmled.dll
+ 2007-08-14 02:44:26 192,000 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\msrating.dll
+ 2007-08-14 02:54:10 670,720 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\mstime.dll
+ 2007-08-14 02:44:06 101,376 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\occache.dll
+ 2007-03-06 01:22:39 213,216 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\updspapi.dll
+ 2007-08-14 02:44:30 105,984 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\url.dll
+ 2007-08-14 02:54:10 1,162,240 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\urlmon.dll
+ 2007-08-14 02:54:10 231,424 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\webcheck.dll
+ 2007-08-14 02:54:10 818,688 -c—-w C:\WINDOWS\ie7updates\KB939653-IE7\wininet.dll
- 2004-08-04 12:00:00 61,440 —-a-w C:\WINDOWS\system32\admparse.dll
+ 2007-08-14 02:39:20 71,680 —-a-w C:\WINDOWS\system32\admparse.dll
- 2004-08-04 12:00:00 99,840 —-a-w C:\WINDOWS\system32\advpack.dll
+ 2007-08-20 10:04:34 124,928 —-a-w C:\WINDOWS\system32\advpack.dll
- 2004-08-04 12:00:00 61,440 -c–a-w C:\WINDOWS\system32\dllcache\admparse.dll
+ 2007-08-14 02:39:20 71,680 -c–a-w C:\WINDOWS\system32\dllcache\admparse.dll
- 2004-08-04 12:00:00 99,840 -c–a-w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2007-08-20 10:04:34 124,928 -c—-w C:\WINDOWS\system32\dllcache\advpack.dll
- 2006-06-03 11:40:49 33,792 -c–a-w C:\WINDOWS\system32\dllcache\custsat.dll
+ 2007-08-14 02:54:10 33,792 -c–a-w C:\WINDOWS\system32\dllcache\custsat.dll
- 2007-08-22 13:12:16 357,888 -c–a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2007-08-14 02:35:46 346,624 -c–a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2007-08-22 13:12:16 205,312 -c–a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2007-08-20 10:04:34 214,528 -c—-w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2007-08-22 13:12:16 55,808 -c–a-w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2007-08-20 10:04:34 132,608 -c—-w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2004-08-08 10:30:00 38,912 -c–a-w C:\WINDOWS\system32\dllcache\hmmapi.dll
+ 2007-08-14 02:18:02 60,416 -c–a-w C:\WINDOWS\system32\dllcache\hmmapi.dll
+ 2007-08-20 10:04:34 63,488 -c—-w C:\WINDOWS\system32\dllcache\icardie.dll
- 2004-08-04 12:00:00 34,304 -c–a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
+ 2007-08-17 10:20:54 63,488 -c—-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
- 2004-08-04 12:00:00 139,264 -c–a-w C:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2007-08-20 10:04:34 153,088 -c—-w C:\WINDOWS\system32\dllcache\ieakeng.dll
- 2004-08-04 12:00:00 216,576 -c–a-w C:\WINDOWS\system32\dllcache\ieaksie.dll
+ 2007-08-20 10:04:35 230,400 -c—-w C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2004-08-04 12:00:00 221,184 -c–a-w C:\WINDOWS\system32\dllcache\ieakui.dll
+ 2007-08-17 07:34:25 161,792 -c—-w C:\WINDOWS\system32\dllcache\ieakui.dll
- 2004-08-04 12:00:00 323,584 -c–a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2007-08-20 10:04:35 384,512 -c—-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
- 2007-08-21 10:30:46 18,432 -c–a-w C:\WINDOWS\system32\dllcache\iedw.exe
+ 2007-08-14 02:44:02 69,120 -c–a-w C:\WINDOWS\system32\dllcache\iedw.exe
- 2004-08-04 12:00:00 81,920 -c–a-w C:\WINDOWS\system32\dllcache\ieencode.dll
+ 2007-08-14 02:45:18 78,336 -c–a-w C:\WINDOWS\system32\dllcache\ieencode.dll
- 2007-08-22 13:12:16 251,392 -c–a-w C:\WINDOWS\system32\dllcache\iepeers.dll
+ 2007-08-14 02:54:10 191,488 -c–a-w C:\WINDOWS\system32\dllcache\iepeers.dll
- 2004-08-04 12:00:00 48,640 -c–a-w C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2007-08-20 10:04:38 44,544 -c—-w C:\WINDOWS\system32\dllcache\iernonce.dll
- 2004-08-04 12:00:00 62,976 -c–a-w C:\WINDOWS\system32\dllcache\iesetup.dll
+ 2007-08-14 02:39:12 55,296 -c–a-w C:\WINDOWS\system32\dllcache\iesetup.dll
- 2004-08-04 12:00:00 93,184 -c–a-w C:\WINDOWS\system32\dllcache\iexplore.exe
+ 2007-08-17 10:21:21 625,152 -c—-w C:\WINDOWS\system32\dllcache\iexplore.exe
- 2004-08-04 12:00:00 35,840 -c–a-w C:\WINDOWS\system32\dllcache\imgutil.dll
+ 2007-08-14 02:36:06 36,352 -c–a-w C:\WINDOWS\system32\dllcache\imgutil.dll
- 2007-08-22 13:12:16 96,256 -c–a-w C:\WINDOWS\system32\dllcache\inseng.dll
+ 2007-08-14 02:39:02 92,672 -c–a-w C:\WINDOWS\system32\dllcache\inseng.dll
- 2006-05-18 05:24:25 450,560 -c–a-w C:\WINDOWS\system32\dllcache\jscript.dll
+ 2007-08-14 02:38:04 491,520 -c–a-w C:\WINDOWS\system32\dllcache\jscript.dll
- 2007-08-22 13:12:16 16,384 -c–a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2007-08-20 10:04:39 27,648 -c—-w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2004-08-04 12:00:00 22,016 -c–a-w C:\WINDOWS\system32\dllcache\licmgr10.dll
+ 2007-08-14 02:44:18 40,960 -c–a-w C:\WINDOWS\system32\dllcache\licmgr10.dll
- 2004-08-04 12:00:00 29,184 -c–a-w C:\WINDOWS\system32\dllcache\mshta.exe
+ 2007-08-14 02:32:30 45,568 -c–a-w C:\WINDOWS\system32\dllcache\mshta.exe
- 2007-08-22 13:12:17 3,058,176 -c–a-w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2007-08-20 23:34:42 3,584,512 -c—-w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2007-08-22 13:12:17 449,024 -c–a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2007-08-20 10:04:41 477,696 -c—-w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2004-08-04 12:00:00 56,832 -c–a-w C:\WINDOWS\system32\dllcache\mshtmler.dll
+ 2007-08-14 02:01:12 48,128 -c–a-w C:\WINDOWS\system32\dllcache\mshtmler.dll
- 2004-08-04 12:00:00 146,432 -c–a-w C:\WINDOWS\system32\dllcache\msls31.dll
+ 2007-08-14 02:54:10 156,160 -c–a-w C:\WINDOWS\system32\dllcache\msls31.dll
- 2007-08-22 13:12:17 146,432 -c–a-w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2007-08-20 10:04:41 193,024 -c—-w C:\WINDOWS\system32\dllcache\msrating.dll
- 2007-08-22 13:12:17 532,480 -c–a-w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2007-08-20 10:04:42 671,232 -c—-w C:\WINDOWS\system32\dllcache\mstime.dll
- 2004-08-04 12:00:00 96,256 -c–a-w C:\WINDOWS\system32\dllcache\occache.dll
+ 2007-08-20 10:04:42 102,400 -c—-w C:\WINDOWS\system32\dllcache\occache.dll
- 2007-08-22 13:12:17 39,424 -c–a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2007-08-14 02:36:12 44,544 -c–a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2004-08-04 12:00:00 37,888 -c–a-w C:\WINDOWS\system32\dllcache\url.dll
+ 2007-08-20 10:04:42 105,984 -c—-w C:\WINDOWS\system32\dllcache\url.dll
- 2007-08-22 13:12:18 615,424 -c–a-w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2007-08-20 10:04:42 1,152,000 -c—-w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2004-08-04 12:00:00 417,792 -c–a-w C:\WINDOWS\system32\dllcache\vbscript.dll
+ 2007-08-14 02:54:10 413,696 -c–a-w C:\WINDOWS\system32\dllcache\vbscript.dll
- 2007-06-26 15:13:22 851,968 -c–a-w C:\WINDOWS\system32\dllcache\vgx.dll
+ 2007-08-14 02:54:10 765,952 -c–a-w C:\WINDOWS\system32\dllcache\VGX.dll
- 2004-08-04 12:00:00 276,480 -c–a-w C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2007-08-20 10:04:42 232,960 -c—-w C:\WINDOWS\system32\dllcache\webcheck.dll
- 2007-08-22 13:12:18 658,944 -c–a-w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2007-08-20 10:04:43 824,832 -c—-w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2007-08-03 00:03:44 188,432 —-a-w C:\WINDOWS\system32\drivers\bdfsfltr.sys
+ 2005-03-30 18:40:42 229,331 ——w C:\WINDOWS\system32\drivers\blackdrv.sys
- 2007-08-22 13:12:16 357,888 —-a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2007-08-14 02:35:46 346,624 —-a-w C:\WINDOWS\system32\dxtmsft.dll
- 2007-08-22 13:12:16 205,312 —-a-w C:\WINDOWS\system32\dxtrans.dll
+ 2007-08-20 10:04:34 214,528 ——w C:\WINDOWS\system32\dxtrans.dll
- 2007-08-22 13:12:16 55,808 —-a-w C:\WINDOWS\system32\extmgr.dll
+ 2007-08-20 10:04:34 132,608 ——w C:\WINDOWS\system32\extmgr.dll
+ 2007-08-20 10:04:34 63,488 —-a-w C:\WINDOWS\system32\icardie.dll
- 2004-08-04 12:00:00 34,304 —-a-w C:\WINDOWS\system32\ie4uinit.exe
+ 2007-08-17 10:20:54 63,488 ——w C:\WINDOWS\system32\ie4uinit.exe
- 2004-08-04 12:00:00 139,264 —-a-w C:\WINDOWS\system32\ieakeng.dll
+ 2007-08-20 10:04:34 153,088 ——w C:\WINDOWS\system32\ieakeng.dll
- 2004-08-04 12:00:00 216,576 —-a-w C:\WINDOWS\system32\ieaksie.dll
+ 2007-08-20 10:04:35 230,400 ——w C:\WINDOWS\system32\ieaksie.dll
- 2004-08-04 12:00:00 221,184 —-a-w C:\WINDOWS\system32\ieakui.dll
+ 2007-08-17 07:34:25 161,792 ——w C:\WINDOWS\system32\ieakui.dll
+ 2007-04-17 09:32:38 2,455,488 —-a-w C:\WINDOWS\system32\ieapfltr.dat
+ 2007-08-20 10:04:35 383,488 —-a-w C:\WINDOWS\system32\ieapfltr.dll
- 2004-08-04 12:00:00 323,584 —-a-w C:\WINDOWS\system32\iedkcs32.dll
+ 2007-08-20 10:04:35 384,512 ——w C:\WINDOWS\system32\iedkcs32.dll
- 2004-08-04 12:00:00 81,920 —-a-w C:\WINDOWS\system32\ieencode.dll
+ 2007-08-14 02:45:18 78,336 —-a-w C:\WINDOWS\system32\ieencode.dll
+ 2007-08-20 10:04:37 6,058,496 —-a-w C:\WINDOWS\system32\ieframe.dll
- 2007-08-22 13:12:16 251,392 —-a-w C:\WINDOWS\system32\iepeers.dll
+ 2007-08-14 02:54:10 191,488 —-a-w C:\WINDOWS\system32\iepeers.dll
- 2004-08-04 12:00:00 48,640 —-a-w C:\WINDOWS\system32\iernonce.dll
+ 2007-08-20 10:04:38 44,544 ——w C:\WINDOWS\system32\iernonce.dll
+ 2007-08-20 10:04:38 267,776 —-a-w C:\WINDOWS\system32\iertutil.dll
- 2004-08-04 12:00:00 62,976 —-a-w C:\WINDOWS\system32\iesetup.dll
+ 2007-08-14 02:39:12 55,296 —-a-w C:\WINDOWS\system32\iesetup.dll
- 2007-08-14 02:39:10 13,312 —-a-w C:\WINDOWS\system32\ieudinit.exe
+ 2007-08-17 10:20:54 13,824 —-a-w C:\WINDOWS\system32\ieudinit.exe
+ 2007-08-14 02:54:10 180,736 ——w C:\WINDOWS\system32\ieui.dll
- 2004-08-04 12:00:00 35,840 —-a-w C:\WINDOWS\system32\imgutil.dll
+ 2007-08-14 02:36:06 36,352 —-a-w C:\WINDOWS\system32\imgutil.dll
- 2007-08-22 13:12:16 96,256 —-a-w C:\WINDOWS\system32\inseng.dll
+ 2007-08-14 02:39:02 92,672 —-a-w C:\WINDOWS\system32\inseng.dll
- 2006-05-18 05:24:25 450,560 —-a-w C:\WINDOWS\system32\jscript.dll
+ 2007-08-14 02:38:04 491,520 —-a-w C:\WINDOWS\system32\jscript.dll
- 2007-08-22 13:12:16 16,384 —-a-w C:\WINDOWS\system32\jsproxy.dll
+ 2007-08-20 10:04:39 27,648 ——w C:\WINDOWS\system32\jsproxy.dll
- 2004-08-04 12:00:00 22,016 —-a-w C:\WINDOWS\system32\licmgr10.dll
+ 2007-08-14 02:44:18 40,960 —-a-w C:\WINDOWS\system32\licmgr10.dll
+ 2002-01-05 10:48:16 974,848 —-a-w C:\WINDOWS\system32\mfc70.dll
+ 2002-01-05 10:36:38 964,608 —-a-w C:\WINDOWS\system32\mfc70u.dll
- 2003-03-18 21:20:00 1,060,864 —-a-w C:\WINDOWS\system32\MFC71.dll
+ 2003-03-19 04:20:00 1,060,864 —-a-w C:\WINDOWS\system32\mfc71.dll
+ 2003-03-19 04:12:12 1,047,552 —-a-w C:\WINDOWS\system32\mfc71u.dll
+ 2007-08-20 10:04:39 459,264 —-a-w C:\WINDOWS\system32\msfeeds.dll
+ 2007-08-20 10:04:39 52,224 —-a-w C:\WINDOWS\system32\msfeedsbs.dll
+ 2007-08-14 02:36:40 12,288 ——w C:\WINDOWS\system32\msfeedssync.exe
- 2004-08-04 12:00:00 29,184 —-a-w C:\WINDOWS\system32\mshta.exe
+ 2007-08-14 02:32:30 45,568 —-a-w C:\WINDOWS\system32\mshta.exe
- 2007-08-22 13:12:17 3,058,176 —-a-w C:\WINDOWS\system32\mshtml.dll
+ 2007-08-20 23:34:42 3,584,512 —-a-w C:\WINDOWS\system32\mshtml.dll
- 2007-08-22 13:12:17 449,024 —-a-w C:\WINDOWS\system32\mshtmled.dll
+ 2007-08-20 10:04:41 477,696 ——w C:\WINDOWS\system32\mshtmled.dll
- 2004-08-04 12:00:00 56,832 —-a-w C:\WINDOWS\system32\mshtmler.dll
+ 2007-08-14 02:01:12 48,128 —-a-w C:\WINDOWS\system32\mshtmler.dll
- 2004-08-04 12:00:00 146,432 —-a-w C:\WINDOWS\system32\msls31.dll
+ 2007-08-14 02:54:10 156,160 —-a-w C:\WINDOWS\system32\msls31.dll
- 2007-08-22 13:12:17 146,432 —-a-w C:\WINDOWS\system32\msrating.dll
+ 2007-08-20 10:04:41 193,024 ——w C:\WINDOWS\system32\msrating.dll
- 2007-08-22 13:12:17 532,480 —-a-w C:\WINDOWS\system32\mstime.dll
+ 2007-08-20 10:04:42 671,232 ——w C:\WINDOWS\system32\mstime.dll
+ 2002-01-05 10:38:38 54,784 —-a-w C:\WINDOWS\system32\msvci70.dll
+ 2002-01-05 10:40:20 487,424 —-a-w C:\WINDOWS\system32\msvcp70.dll
- 2003-03-18 20:14:52 499,712 —-a-w C:\WINDOWS\system32\MSVCP71.dll
+ 2003-03-19 03:14:52 499,712 —-a-w C:\WINDOWS\system32\msvcp71.dll
+ 2002-01-05 09:37:28 344,064 —-a-w C:\WINDOWS\system32\msvcr70.dll
- 2003-02-21 04:42:22 348,160 —-a-w C:\WINDOWS\system32\MSVCR71.dll
+ 2003-02-21 11:42:22 348,160 —-a-w C:\WINDOWS\system32\msvcr71.dll
- 2004-08-04 12:00:00 96,256 —-a-w C:\WINDOWS\system32\occache.dll
+ 2007-08-20 10:04:42 102,400 ——w C:\WINDOWS\system32\occache.dll
- 2007-08-22 13:12:17 39,424 —-a-w C:\WINDOWS\system32\pngfilt.dll
+ 2007-08-14 02:36:12 44,544 —-a-w C:\WINDOWS\system32\pngfilt.dll
- 2006-05-25 18:29:04 14,048 ——w C:\WINDOWS\system32\spmsg.dll
+ 2007-03-06 01:22:33 14,048 ——w C:\WINDOWS\system32\spmsg.dll
- 2006-05-25 18:29:04 22,752 —-a-w C:\WINDOWS\system32\spupdsvc.exe
+ 2006-09-07 01:43:16 22,752 —-a-w C:\WINDOWS\system32\spupdsvc.exe
- 2004-08-04 12:00:00 37,888 —-a-w C:\WINDOWS\system32\url.dll
+ 2007-08-20 10:04:42 105,984 —-a-w C:\WINDOWS\system32\url.dll
- 2007-08-22 13:12:18 615,424 —-a-w C:\WINDOWS\system32\urlmon.dll
+ 2007-08-20 10:04:42 1,152,000 —-a-w C:\WINDOWS\system32\urlmon.dll
- 2004-08-04 12:00:00 417,792 —-a-w C:\WINDOWS\system32\vbscript.dll
+ 2007-08-14 02:54:10 413,696 —-a-w C:\WINDOWS\system32\vbscript.dll
- 2004-08-04 12:00:00 276,480 —-a-w C:\WINDOWS\system32\webcheck.dll
+ 2007-08-20 10:04:42 232,960 —-a-w C:\WINDOWS\system32\webcheck.dll
+ 2007-08-14 02:45:16 206,336 ——w C:\WINDOWS\system32\WinFXDocObj.exe
- 2007-08-22 13:12:18 658,944 —-a-w C:\WINDOWS\system32\wininet.dll
+ 2007-08-20 10:04:43 824,832 —-a-w C:\WINDOWS\system32\wininet.dll
+ 2007-07-20 22:54:30 77,824 —-a-w C:\WINDOWS\system32\xcomm.dll
+ 2007-01-31 21:50:32 913,408 —-a-w C:\WINDOWS\system32\xreglib.dll
+ 2006-12-02 05:54:32 479,232 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-02 05:54:34 548,864 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-02 05:54:32 626,688 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-02 07:25:52 1,101,824 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-02 07:25:56 1,093,120 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-02 07:25:58 69,632 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-02 07:26:00 57,856 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-02 07:08:00 40,960 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-02 07:08:00 45,056 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-02 07:08:00 65,536 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-02 07:08:00 57,344 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-02 07:08:00 61,440 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-02 07:08:00 61,440 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-02 07:08:00 61,440 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-02 07:08:00 49,152 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-02 07:08:00 49,152 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{381FFDE8-2394-4F90-B10D-FC6124A40F8C}"= C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll [2007-10-15 12:36 86016]

[HKEY_CLASSES_ROOT\clsid\{381ffde8-2394-4f90-b10d-fc6124a40f8c}]
[HKEY_CLASSES_ROOT\BitDefender Toolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-11-02 20:49]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]
"BitDefender Antiphishing Helper"="C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 15:46]
"BDAgent"="C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [2007-10-31 16:46]

[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 09:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 09:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

R1 bdftdif;bdftdif;\??\C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe -k netsvcs
R3 bdfsfltr;bdfsfltr;C:\WINDOWS\system32\DRIVERS\bdfsfltr.sys
R3 BDSelfPr;BDSelfPr;\??\C:\Program Files\BitDefender\BitDefender 2008\bdselfpr.sys
R3 rtl8029;Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8029.SYS
R3 scan;BitDefender Threat Scanner;C:\WINDOWS\System32\svchost.exe -kbdx
R4 black;black;C:\WINDOWS\system32\drivers\BlackDrv.sys
S0 UNPR;UNPR;C:\WINDOWS\system32\unpr.sys
S3 RapDrv;RapDrv;\??\C:\WINDOWS\system32\drivers\RapDrv.sys
S3 RapFile;RapFile;\??\C:\WINDOWS\system32\drivers\RapFile.sys
S3 RapNet;RapNet;\??\C:\WINDOWS\system32\drivers\RapNet.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx scan

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2007-11-22 07:29:14 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2007-11-24 02:42:48 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-23 18:55:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\bdfsfltr]
"ImagePath"=hex:73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,\
.
Completion time: 2007-11-23 18:56:28
C:\ComboFix2.txt … 2007-11-21 21:21
C:\ComboFix3.txt … 2007-11-21 20:01
.
— E O F —



it seems to be running fine………..at the moment

ComboFix 07-11-19.3 - Admin 2007-11-24 19:05:00.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.56 [GMT -8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Admin.BIODROID-001\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-10-25 to 2007-11-25 )))))))))))))))))))))))))))))))
.

2007-11-23 22:13 1,168 –a—— C:\WINDOWS\checkip.dat
2007-11-23 21:24 d——– C:\Program Files\Alwil Software
2007-11-21 23:46 d——– C:\Program Files\ISS
2007-11-21 23:46 147,608 ——— C:\WINDOWS\system32\blackdll.dll
2007-11-21 23:46 104,968 ——— C:\WINDOWS\system32\drivers\RapDrv.sys
2007-11-21 23:46 36,644 ——— C:\WINDOWS\system32\drivers\RapFile.sys
2007-11-21 23:46 24,344 ——— C:\WINDOWS\system32\drivers\RapNet.sys
2007-11-21 23:46 873 –a—— C:\WINDOWS\system32\firewall.log
2007-11-21 23:46 10 –a—— C:\WINDOWS\system32\drivers\tmbi.sys
2007-11-21 23:43 d——– C:\Documents and Settings\ADMIN~1~BIO\LOCALS~1
2007-11-21 23:33 d——– C:\Documents and Settings\Admin.BIODROID-001\Application Data\uTorrent
2007-11-21 23:28 29,704 –a—— C:\WINDOWS\system32\uxtuneup.dll
2007-11-21 23:26 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\TuneUp Software
2007-11-21 22:31 d——– C:\Documents and Settings\Admin.BIODROID-001\Application Data\Bitdefender
2007-11-21 22:30 d——– C:\Program Files\BitDefender
2007-11-21 22:30 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\BitDefender
2007-11-21 22:30 6,058,496 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll
2007-11-21 22:30 2,455,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2007-11-21 22:30 991,232 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2007-11-21 22:30 459,264 —–c— C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-11-21 22:30 383,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-11-21 22:30 267,776 —–c— C:\WINDOWS\system32\dllcache\iertutil.dll
2007-11-21 22:30 52,224 —–c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-11-21 22:30 13,824 —–c— C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-11-21 22:29 d——– C:\Program Files\Common Files\BitDefender
2007-11-21 21:45 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Avg7
2007-11-21 21:15 39,936 –a—— C:\WINDOWS\system32\OLD2.tmp
2007-11-21 21:15 38,912 –a—— C:\WINDOWS\system32\wpabaln.exe
2007-11-21 21:15 24,064 –a—— C:\WINDOWS\system32\devldr32.exe
2007-11-21 21:15 20,480 –a—— C:\WINDOWS\system32\wscntfy.exe
2007-11-21 20:59 33,280 –a—— C:\WINDOWS\system32\rundll32.exe
2007-11-21 20:58 13,312 –a—— C:\WINDOWS\system32\savedump.exe
2007-11-21 20:58 13,312 –a–c— C:\WINDOWS\system32\dllcache\savedump.exe
2007-11-21 12:48 d——– C:\Program Files\Windows Defender
2007-11-21 10:53 0 –a—— C:\WINDOWS\nsreg.dat
2007-11-20 15:41 d—s—- C:\Documents and Settings\Admin.BIODROID-001\UserData
2007-11-20 15:30 d——– C:\Documents and Settings\Admin.BIODROID-001\DoctorWeb
2007-11-20 14:42 29 –ah—– C:\WINDOWS\system32\ir4fc.dns
2007-11-20 03:16 129,400 –a—— C:\WINDOWS\system32\TZLog.log
2007-11-19 21:16 d——– C:\Documents and Settings\Admin.BIODROID-001\Application Data\TuneUp Software
2007-11-19 18:09 d——– C:\Documents and Settings\Admin.BIODROID-001\Application Data\ESET
2007-11-19 13:15 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Eset
2007-11-19 11:03 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2007-11-19 11:03 d——– C:\Documents and Settings\Admin.BIODROID-001\Application Data\SUPERAntiSpyware.com
2007-11-19 01:05 28,288 –a–c— C:\WINDOWS\system32\dllcache\xjis.nls
2007-11-19 01:04 41,600 –a–c— C:\WINDOWS\system32\dllcache\weitekp9.dll
2007-11-19 01:03 15,872 –a–c— C:\WINDOWS\system32\dllcache\padrs404.dll
2007-11-19 01:03 14,848 –a–c— C:\WINDOWS\system32\dllcache\register.exe
2007-11-19 01:02 92,416 –a–c— C:\WINDOWS\system32\dllcache\mga.sys
2007-11-19 01:02 92,032 –a–c— C:\WINDOWS\system32\dllcache\mga.dll
2007-11-19 01:02 7,680 –a–c— C:\WINDOWS\system32\dllcache\migregdb.exe
2007-11-19 01:01 471,102 –a–c— C:\WINDOWS\system32\dllcache\imskdic.dll
2007-11-19 01:01 67,072 –a–c— C:\WINDOWS\system32\dllcache\imscinst.exe
2007-11-19 01:01 6,656 –a–c— C:\WINDOWS\system32\dllcache\kbdlk41a.dll
2007-11-19 01:01 6,144 –a–c— C:\WINDOWS\system32\dllcache\kbdlk41j.dll
2007-11-19 01:01 5,632 –a–c— C:\WINDOWS\system32\dllcache\kbdvntc.dll
2007-11-19 01:01 5,632 –a–c— C:\WINDOWS\system32\dllcache\kbdsyr1.dll
2007-11-19 01:01 5,632 –a–c— C:\WINDOWS\system32\dllcache\kbdfa.dll
2007-11-19 01:01 5,120 –a–c— C:\WINDOWS\system32\dllcache\kbdgeo.dll
2007-11-19 01:01 5,120 –a–c— C:\WINDOWS\system32\dllcache\kbdarme.dll
2007-11-19 01:00 514,587 –a–c— C:\WINDOWS\system32\dllcache\edb500.dll
2007-11-19 01:00 480,256 –a–c— C:\WINDOWS\system32\dllcache\cintsetp.exe
2007-11-19 01:00 198,656 –a–c— C:\WINDOWS\system32\dllcache\cintime.dll
2007-11-19 01:00 108,827 –a–c— C:\WINDOWS\system32\dllcache\hanja.lex
2007-11-19 01:00 101,888 –a–c— C:\WINDOWS\system32\dllcache\evntagnt.dll
2007-11-19 01:00 92,160 –a–c— C:\WINDOWS\system32\dllcache\evntwin.exe
2007-11-19 01:00 57,856 –a–c— C:\WINDOWS\system32\dllcache\esuimgd.dll
2007-11-19 01:00 57,344 –a–c— C:\WINDOWS\system32\dllcache\cplexe.exe
2007-11-19 01:00 45,056 –a–c— C:\WINDOWS\system32\dllcache\esunid.dll
2007-11-19 01:00 36,864 –a–c— C:\WINDOWS\system32\dllcache\hanjadic.dll
2007-11-19 01:00 31,744 –a–c— C:\WINDOWS\system32\dllcache\esucmd.dll
2007-11-19 01:00 25,856 –a–c— C:\WINDOWS\system32\dllcache\et4000.sys
2007-11-19 01:00 24,576 –a–c— C:\WINDOWS\system32\dllcache\fpadmcgi.exe
2007-11-19 01:00 24,064 –a–c— C:\WINDOWS\system32\dllcache\evntcmd.exe
2007-11-19 01:00 21,504 –a–c— C:\WINDOWS\system32\dllcache\cintlgnt.ime
2007-11-19 01:00 20,541 –a–c— C:\WINDOWS\system32\dllcache\fpadmdll.dll
2007-11-19 01:00 18,944 –a–c— C:\WINDOWS\system32\dllcache\cprofile.exe
2007-11-19 00:59 66,594 –a–c— C:\WINDOWS\system32\dllcache\c_864.nls
2007-11-19 00:59 66,594 –a–c— C:\WINDOWS\system32\dllcache\c_862.nls
2007-11-19 00:59 66,594 –a–c— C:\WINDOWS\system32\dllcache\c_858.nls
2007-11-19 00:59 45,056 –a–c— C:\WINDOWS\system32\dllcache\EXCH_aqadmin.dll
2007-11-19 00:59 32,768 –a–c— C:\WINDOWS\system32\dllcache\tcptest.exe
2007-11-19 00:59 20,536 –a–c— C:\WINDOWS\system32\dllcache\shtml.dll
2007-11-19 00:59 19,456 –a–c— C:\WINDOWS\system32\dllcache\agt0401.dll
2007-11-19 00:59 16,384 –a–c— C:\WINDOWS\system32\dllcache\tcptsat.dll
2007-11-19 00:59 16,384 –a–c— C:\WINDOWS\system32\dllcache\shtml.exe
2007-11-19 00:59 5,632 –a–c— C:\WINDOWS\system32\dllcache\EXCH_adsiisex.dll
2007-11-19 00:58 188,416 –a–c— C:\WINDOWS\system32\dllcache\fpcount.exe
2007-11-19 00:58 188,416 –a–c— C:\WINDOWS\system32\dllcache\cfgwiz.exe
2007-11-19 00:58 20,540 –a–c— C:\WINDOWS\system32\dllcache\author.dll
2007-11-19 00:58 20,540 –a–c— C:\WINDOWS\system32\dllcache\admin.dll
2007-11-19 00:58 16,384 –a–c— C:\WINDOWS\system32\dllcache\author.exe
2007-11-19 00:58 16,384 –a–c— C:\WINDOWS\system32\dllcache\admin.exe
2007-11-19 00:58 2,626 –a—— C:\WINDOWS\system32\CONFIG.NT
2007-11-19 00:57 23,392 –a—— C:\WINDOWS\system32\nscompat.tlb
2007-11-19 00:55 d–hs—- C:\Documents and Settings\All Users.WINDOWS\DRM
2007-11-19 00:55 488 -rah—– C:\WINDOWS\system32\WindowsLogon.manifest
2007-11-19 00:54 4,399,505 –a–c— C:\WINDOWS\system32\dllcache\nls302en.lex
2007-11-19 00:54 749 -rah—– C:\WINDOWS\system32\sapi.cpl.manifest
2007-11-19 00:54 749 -rah—– C:\WINDOWS\system32\nwc.cpl.manifest

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-22 07:46 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-22 07:43 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-11-22 07:28 ——— d—–w C:\Program Files\TuneUp Utilities 2007
2007-11-19 04:09 ——— d—–w C:\Program Files\Windows Media Connect 2
2007-11-19 04:05 ——— d—–w C:\Program Files\RegVac Registry Cleaner
2007-11-19 03:57 ——— d—–w C:\Program Files\AC3Filter
2007-11-19 02:51 ——— d—–w C:\Documents and Settings\Admin\Application Data\uTorrent
2007-11-19 02:26 ——— d—–w C:\Documents and Settings\Admin\Application Data\Lavasoft
2007-11-08 20:56 ——— d—–w C:\Program Files\WildGames
2007-11-07 21:01 ——— d—–w C:\Program Files\Common Files\Adobe
2007-11-06 01:27 ——— d—–w C:\Program Files\The Weather Channel FW
2007-11-03 23:00 ——— d—–w C:\Program Files\DivX
2007-11-03 00:04 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-10-25 17:05 94,416 —-a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-10-25 17:05 93,264 —-a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-10-25 17:03 23,152 —-a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-10-25 17:01 42,912 —-a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-10-25 16:58 26,624 —-a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-10-25 16:24 815,480 —-a-w C:\WINDOWS\system32\aswBoot.exe
2007-10-25 16:14 95,608 —-a-w C:\WINDOWS\system32\AVASTSS.scr
2007-10-20 13:16 ——— d—–w C:\Program Files\uTorrent
2007-10-19 21:30 ——— d—–w C:\Documents and Settings\Admin\Application Data\Pogo Games
2007-10-19 21:22 ——— d—–w C:\Program Files\ToGo Game
2007-10-19 00:37 ——— d—–w C:\Documents and Settings\Admin\Application Data\WildTangent
2007-10-18 00:35 ——— d—–w C:\Program Files\Astro Gemini Software
2007-10-17 01:51 ——— d—–w C:\Program Files\Jasc Software Inc
2007-10-17 01:05 ——— d—–w C:\Program Files\Lavalys
2007-10-16 23:08 ——— d—–w C:\Program Files\Common Files\xing shared
2007-10-16 23:07 ——— d—–w C:\Program Files\Real
2007-10-16 23:07 ——— d—–w C:\Program Files\Common Files\Real
2007-10-15 00:27 ——— d—–w C:\Program Files\Common Files\Jasc Software Inc
2007-10-15 00:25 ——— d—–w C:\Documents and Settings\Admin\Application Data\Jasc Software Inc
2007-10-14 23:46 ——— d—–w C:\Program Files\Common Files\Adobe Systems Shared
2007-10-14 17:25 ——— d—–w C:\Program Files\Google
2007-10-14 17:23 ——— d—–w C:\Program Files\WinCustomize
2007-10-14 17:07 ——— d—–w C:\Program Files\BillP Studios
2007-10-14 16:57 ——— d—–w C:\Documents and Settings\Admin\Application Data\WinPatrol
2007-10-13 03:07 ——— d—–w C:\Program Files\Xvid
2007-10-11 21:17 ——— d—–w C:\Program Files\Common Files\Stardock
2007-10-11 03:27 ——— d—–w C:\Program Files\Common Files\Acronis
2007-10-11 03:26 ——— d—–w C:\Program Files\Acronis
2007-10-11 03:06 ——— d—–w C:\Documents and Settings\Admin\Application Data\TuneUp Software
2007-10-11 01:47 ——— d—–w C:\Program Files\Java
2007-10-11 01:46 ——— d—–w C:\Program Files\Common Files\Java
2007-10-11 01:32 ——— d—–w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((( snapshot_2007-11-23_18.55.39.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-03-06 01:22:41 213,216 -c—-w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c—-w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\updspapi.dll
+ 2007-08-14 02:54:10 765,952 -c—-w C:\WINDOWS\ie7updates\KB938127-IE7\vgx.dll
- 2007-11-21 00:08:48 16,384 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2007-11-24 03:12:04 16,384 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2007-11-21 00:08:48 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-11-24 03:12:04 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-11-21 00:08:48 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2007-11-24 03:12:04 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2007-08-14 02:54:10 765,952 -c–a-w C:\WINDOWS\system32\dllcache\VGX.dll
+ 2007-07-12 23:31:54 765,952 -c–a-w C:\WINDOWS\system32\dllcache\vgx.dll
- 2007-03-06 01:22:33 14,048 ——w C:\WINDOWS\system32\spmsg.dll
+ 2007-03-06 01:22:36 14,048 ——w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-25 02:58:43 16,384 —-atw C:\WINDOWS\TEMP\Perflib_Perfdata_568.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{381FFDE8-2394-4F90-B10D-FC6124A40F8C}"= C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll [2007-10-15 12:36 86016]

[HKEY_CLASSES_ROOT\clsid\{381ffde8-2394-4f90-b10d-fc6124a40f8c}]
[HKEY_CLASSES_ROOT\BitDefender Toolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-11-02 20:49]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]
"BitDefender Antiphishing Helper"="C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 15:46]
"BDAgent"="C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [2007-10-31 16:46]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-10-25 08:20]

[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 09:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 09:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

R1 bdftdif;bdftdif;\??\C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe -k netsvcs
R3 bdfsfltr;bdfsfltr;C:\WINDOWS\system32\DRIVERS\bdfsfltr.sys
R3 BDSelfPr;BDSelfPr;\??\C:\Program Files\BitDefender\BitDefender 2008\bdselfpr.sys
R3 rtl8029;Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8029.SYS
R3 scan;BitDefender Threat Scanner;C:\WINDOWS\System32\svchost.exe -kbdx
R4 black;black;C:\WINDOWS\system32\drivers\BlackDrv.sys
S0 UNPR;UNPR;C:\WINDOWS\system32\unpr.sys
S3 RapDrv;RapDrv;\??\C:\WINDOWS\system32\drivers\RapDrv.sys
S3 RapFile;RapFile;\??\C:\WINDOWS\system32\drivers\RapFile.sys
S3 RapNet;RapNet;\??\C:\WINDOWS\system32\drivers\RapNet.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx scan

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2007-11-22 07:29:14 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2007-11-25 03:01:49 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-24 19:08:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\bdfsfltr]
"ImagePath"=hex:73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,\
.
Completion time: 2007-11-24 19:09:30
C:\ComboFix2.txt … 2007-11-23 18:56
C:\ComboFix3.txt … 2007-11-21 21:21
.
— E O F —

Logfile of HijackThis v1.99.1
Scan saved at 7:10:32 PM, on 11/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ISS\BlackICE\blackd.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ISS\BlackICE\blackice.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wpabaln.exe
C:\WINDOWS\explorer.exe
C:\Program Files\HijackThis\Spyware.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forums.whatthetech.com/wifes_comp_l….html&st=15
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: BlackICE PC Protection.lnk = C:\Program Files\ISS\BlackICE\blackice.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\blackd.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\rapapp.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe" /service (file missing)