Spyware / Malware / Virus Removal

[Resolved] i have a brontok.c i-worm

8 min read

Looking for the outcome? Ask AI

charliemoss13 Topic Starter

Post #1March 26, 2008, 5:37 AM UTC

this is doing my head in now. i cant find anyone with any helpful answers. i have avg anti-virus free edition and about 3 times a day it pops up telling me i have a brontok.c i-worm however, when it has finished scanning and deleting files (around 115 different files), it comes back up to five times a day. it clearly isnt getting rid of it and so i have scanned my computer with hijackthis for you to have a look. really hope you can help.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:31:43, on 26/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\VistaDriveIcon\DrvIcon.exe
C:\WINDOWS\HCWemmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\glass2k\Glass2k.exe
C:\Program Files\TrueTransparency\TrueTransparency.exe
C:\Program Files\VisualTaskTips\VisualTaskTips.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\WinTV\Ir.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\User\Desktop\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AddTask Class - {24F06550-65E3-4D1C-8CFE-839C296B5530} - C:\Program Files\real\IEeREAD.dll
O2 - BHO: (no name) - {26B386B5-A093-4D4F-AC6E-146616BFE900} - (no file)
O2 - BHO: (no name) - {4fbc733a-9723-4835-813f-43340e5f377e} - (no file)
O2 - BHO: AddTask Class - {6A19C29D-ED45-4483-8999-9F939C8161F2} - C:\Program Files\real\WebHook.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {CED233DD-EE2E-4ED2-A727-3F82E90AC14F} - (no file)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FF77F93C-A100-410D-AD16-763C7A4883C6} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\styler\TB\StylerTB.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\VistaDriveIcon\DrvIcon.exe
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [HCWemmon] HCWemmon.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\WINDOWS\TEMP\E_SC4.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Startup: Glass2k.lnk = C:\Program Files\glass2k\Glass2k.exe
O4 - Startup: TrueTransparency.lnk = C:\Program Files\TrueTransparency\TrueTransparency.exe
O4 - Startup: VisualTaskTips.lnk = C:\Program Files\VisualTaskTips\VisualTaskTips.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo…toUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O20 - Winlogon Notify: opnlkhe - opnlkhe.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\toxnmpos.exe (file missing)
O23 - Service: EPGService - Hauppauge Computer Works - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Corporation - C:\Program Files\Retrospect\Retrospect 7.5\retrorun.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

–
End of file - 9446 bytes

Rorschach112

Post #2April 8, 2008, 6:03 PM UTC

Hello

Please download Deckard's System Scanner (DSS) and save it to your Desktop.

Close all other windows before proceeding.
Double-click on dss.exe and follow the prompts.
If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
When it has finished, dss will open two Notepads main.txt and extra.txt – please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

charliemoss13

Post #3April 10, 2008, 2:28 PM UTC

Deckard's System Scanner v20071014.68
Run by [removed] on 2008-04-10 15:21:39
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

– Last 5 Restore Point(s) –
74: 2008-04-10 13:56:17 UTC - RP213 - Deckard's System Scanner Restore Point
73: 2008-04-09 14:33:06 UTC - RP212 - Software Distribution Service 3.0
72: 2008-04-09 04:04:09 UTC - RP211 - System Checkpoint
71: 2008-04-08 03:19:22 UTC - RP210 - System Checkpoint
70: 2008-04-07 02:24:44 UTC - RP209 - System Checkpoint

– First Restore Point –
1: 2008-01-11 15:14:13 UTC - RP140 - System Checkpoint

Backed up registry hives.
Performed disk cleanup.

– HijackThis (run as User.exe) ————————————————

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:23:19, on 10/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\VistaDriveIcon\DrvIcon.exe
C:\WINDOWS\HCWemmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\glass2k\Glass2k.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\TrueTransparency\TrueTransparency.exe
C:\Program Files\VisualTaskTips\VisualTaskTips.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\User\Desktop\dss.exe
C:\DOCUME~1\User\Desktop\User.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AddTask Class - {24F06550-65E3-4D1C-8CFE-839C296B5530} - C:\Program Files\real\IEeREAD.dll
O2 - BHO: (no name) - {26B386B5-A093-4D4F-AC6E-146616BFE900} - (no file)
O2 - BHO: (no name) - {4fbc733a-9723-4835-813f-43340e5f377e} - (no file)
O2 - BHO: AddTask Class - {6A19C29D-ED45-4483-8999-9F939C8161F2} - C:\Program Files\real\WebHook.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: (no name) - {CED233DD-EE2E-4ED2-A727-3F82E90AC14F} - (no file)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FF77F93C-A100-410D-AD16-763C7A4883C6} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\styler\TB\StylerTB.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\VistaDriveIcon\DrvIcon.exe
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [HCWemmon] HCWemmon.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\WINDOWS\TEMP\E_SC4.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Startup: Glass2k.lnk = C:\Program Files\glass2k\Glass2k.exe
O4 - Startup: TrueTransparency.lnk = C:\Program Files\TrueTransparency\TrueTransparency.exe
O4 - Startup: VisualTaskTips.lnk = C:\Program Files\VisualTaskTips\VisualTaskTips.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo…toUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: opnlkhe - opnlkhe.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\toxnmpos.exe (file missing)
O23 - Service: EPGService - Hauppauge Computer Works - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

–
End of file - 9747 bytes

– File Associations ———————————————————–

All associations okay.

– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R3 SASENUM - c:\program files\superantispyware\sasenum.sys

Rorschach112

Post #4April 10, 2008, 4:22 PM UTC

Hello

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

———————————————————–
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  
  ———————————————————–
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
———————————————————–
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

charliemoss13

Post #5April 12, 2008, 1:06 AM UTC

ComboFix 08-04-11.5 - User 2008-04-12 1:53:16.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.508 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Temp\abW9
C:\WINDOWS\cookies.ini
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\Fonts\'
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\crwnexad.ini
C:\WINDOWS\system32\geelrybk.ini
C:\WINDOWS\system32\gzmrot-uninst.exe
C:\WINDOWS\system32\kjllm.ini
C:\WINDOWS\system32\kjllm.ini2
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\rgadbidb.ini
C:\WINDOWS\system32\rMa05yy
C:\WINDOWS\system32\wnopudhj.ini
C:\WINDOWS\system32\ybmlagfu.ini
F:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_DOMAINSERVICE
——-\Service_DomainService

((((((((((((((((((((((((( Files Created from 2008-03-12 to 2008-04-12 )))))))))))))))))))))))))))))))
.

2008-04-11 05:29 . 2008-04-11 12:55 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-04-11 05:29 . 2008-04-11 05:29 1,409 –a—— C:\WINDOWS\QTFont.for
2008-04-10 14:55 . 2008-04-10 14:55 d——– C:\Deckard
2008-04-10 14:37 . 2008-04-11 05:39 42,688 –a—— C:\temp\temp.exe
2008-04-10 14:33 . 2008-04-11 05:35 42,688 –a—— C:\Data Laptop.exe
2008-04-10 14:33 . 2008-04-11 05:35 42,688 –a—— C:\C.exe
2008-04-09 15:33 . 2008-04-09 15:35 1,355 –a—— C:\WINDOWS\imsins.BAK
2008-04-08 16:54 . 2008-04-08 16:55 15,364 –ah—– C:\.DS_Store
2008-04-04 22:08 . 2008-04-04 22:08 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-03-26 06:50 . 2008-03-26 06:50 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-26 06:49 . 2008-03-26 09:22 d——– C:\Program Files\SUPERAntiSpyware
2008-03-26 06:49 . 2008-03-26 06:49 d——– C:\Documents and Settings\User\Application Data\SUPERAntiSpyware.com
2008-03-25 04:15 . 2008-03-25 04:15 d——– C:\Program Files\MSXML 4.0
2008-03-24 09:08 . 2008-03-24 09:08 d——– C:\Program Files\Yahoo!
2008-03-24 06:46 . 2008-03-24 06:46 d——– C:\Documents and Settings\All Users\Application Data\Nokia
2008-03-19 22:44 . 2008-03-19 22:45 d——– C:\Documents and Settings\All Users\Application Data\Retrospect
2008-03-19 21:50 . 2008-03-19 21:50 d——– C:\Program Files\Western Digital Technologies
2008-03-19 21:50 . 2008-03-19 22:41 364,544 –a—— C:\WINDOWS\system32\WDBtnMgr.exe
2008-03-17 18:50 . 2008-03-17 18:50 d——– C:\Documents and Settings\All Users\Application Data\InstallShield
2008-03-17 18:49 . 2002-11-02 10:53 57,344 –a—— C:\WINDOWS\system32\WNASPINT.DLL
2008-03-17 03:01 . 2008-03-17 03:01 268 –ah—– C:\sqmdata19.sqm
2008-03-17 03:01 . 2008-03-17 03:01 244 –ah—– C:\sqmnoopt19.sqm
2008-03-15 21:24 . 2008-03-15 21:24 4,096 –a—— C:\WINDOWS\d3dx.dat
2008-03-14 14:15 . 2008-03-17 16:49 d——– C:\Program Files\GameSpy Arcade

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-12 00:59 ——— d—–w C:\Program Files\WinTV
2008-04-12 00:56 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kontiki
2008-04-11 10:38 ——— d—–w C:\Documents and Settings\User\Application Data\AVG7
2008-04-04 14:19 ——— d—–w C:\Documents and Settings\User\Application Data\LimeWire
2008-03-26 05:47 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-24 05:46 ——— d—–w C:\Program Files\Nokia
2008-03-24 05:46 ——— d—–w C:\Program Files\Common Files\Nokia
2008-03-24 05:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Installations
2008-03-22 12:51 ——— d—–w C:\Program Files\VirtualDJ
2008-03-22 12:50 ——— d—–w C:\Documents and Settings\User\Application Data\uTorrent
2008-03-22 12:47 ——— d—–w C:\Program Files\Real
2008-03-20 09:28 ——— d—–w C:\Program Files\PKR
2008-03-20 04:24 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-26 01:10 ——— d—–w C:\Program Files\DivX
2008-02-24 13:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2008-02-24 12:36 ——— d—–w C:\Documents and Settings\LocalService\Application Data\AVG7
2008-02-24 12:36 ——— d—–w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-23 19:34 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
2008-02-23 19:16 ——— d—–w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-02-20 18:11 ——— d—–w C:\Documents and Settings\User\Application Data\Apple Computer
2008-02-20 18:03 ——— d—–w C:\Program Files\3ivx
2008-02-19 02:20 3,532 —-a-w C:\drmHeader.bin
2008-02-17 16:29 ——— d—–w C:\Documents and Settings\All Users\Application Data\UDL
2008-02-13 15:50 ——— d—–w C:\Program Files\Kontiki
2008-02-13 15:50 ——— d—–w C:\Program Files\Channel4
2008-02-13 15:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\Channel4
2008-02-13 13:48 ——— d—–w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-13 13:47 ——— d—–w C:\Program Files\Lavasoft
2008-02-13 13:20 ——— d—–w C:\Program Files\Enigma Software Group
2008-02-13 13:11 ——— d—–w C:\Documents and Settings\User\Application Data\Uniblue
2007-11-27 18:13 6,641 –sha-w C:\WINDOWS\system32\klkkj.ini2
2007-11-27 18:39 6,587 –sha-w C:\WINDOWS\system32\pqstv.ini2
.

——- Sigcheck ——-

2004-08-04 13:00 541696 55aca85eb80e2155e20211aaaddd711a C:\WINDOWS\system32\winlogon.exe
2004-08-04 13:00 541696 55aca85eb80e2155e20211aaaddd711a C:\WINDOWS\system32\dllcache\winlogon.exe
2004-08-04 13:00 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\VistaMizer\old\winlogon.exe

2005-03-02 01:36 2056832 d8aba3eab509627e707a3b14f00fbb6b C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2007-02-28 10:15 2059392 4d3dbdccbf97f5ba1e74f322b155c3ba C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
2007-02-28 09:38 2057600 515d30e2c90a3665a2739309334c9283 C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
2007-02-28 09:38 2314752 dec5e0d5185864e2beeef76daa3d38c2 C:\WINDOWS\system32\ntkrnlpa.exe
2007-02-28 09:38 2314752 dec5e0d5185864e2beeef76daa3d38c2 C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2007-02-28 09:38 2057600 515d30e2c90a3665a2739309334c9283 C:\WINDOWS\VistaMizer\old\ntkrnlpa.exe

2005-03-02 02:04 2179456 28187802b7c368c0d3aef7d4c382aabb C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2007-02-28 10:55 2182144 5a5c8db4aa962c714c8371fbdf189fc9 C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
2007-02-28 10:10 2180352 582a8dbaa58c3b1f176eb2817daee77c C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
2007-02-28 10:10 2437504 9809aefbe836dfd733fd520a40d5f67c C:\WINDOWS\system32\ntoskrnl.exe
2007-02-28 10:10 2437504 9809aefbe836dfd733fd520a40d5f67c C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2007-02-28 10:10 2180352 582a8dbaa58c3b1f176eb2817daee77c C:\WINDOWS\VistaMizer\old\ntoskrnl.exe

2007-06-13 11:23 1551360 4893afc1937e67f288983e23f36a9f48 C:\WINDOWS\explorer.exe
2007-06-13 12:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2007-06-13 11:23 1551360 4893afc1937e67f288983e23f36a9f48 C:\WINDOWS\system32\dllcache\explorer.exe
2007-06-13 11:23 1033216 97bd6515465659ff8f3b7be375b2ea87 C:\WINDOWS\VistaMizer\old\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{24F06550-65E3-4D1C-8CFE-839C296B5530}]
2007-06-28 18:25 57344 –a—— C:\Program Files\real\IEeREAD.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{26B386B5-A093-4D4F-AC6E-146616BFE900}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4fbc733a-9723-4835-813f-43340e5f377e}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6A19C29D-ED45-4483-8999-9F939C8161F2}]
2008-02-01 11:20 57224 –a—— C:\Program Files\real\WebHook.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CED233DD-EE2E-4ED2-A727-3F82E90AC14F}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FF77F93C-A100-410D-AD16-763C7A4883C6}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 18:05 143360]
"EPSON Stylus DX4400 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.exe" [2007-03-01 07:01 180736]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 25088]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-12 16:52 68856]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 17:03 1481968]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 11:12 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 10:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 10:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 10:36 114688]
"DrvIcon"="C:\Program Files\VistaDriveIcon\DrvIcon.exe" [2007-07-04 20:59 45056]
"Zune Launcher"="c:\Program Files\Zune\ZuneLauncher.exe" [2008-01-11 18:54 166304]
"HCWemmon"="HCWemmon.exe" [2007-03-29 19:22 61440 C:\WINDOWS\HCWemmon.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-24 13:36 579072]
"WD Button Manager"="WDBtnMgr.exe" [2008-03-19 22:41 364544 C:\WINDOWS\system32\WDBtnMgr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 18:35 1294336]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-24 13:36 219136]

C:\Documents and Settings\User\Start Menu\Programs\Startup\
Glass2k.lnk - C:\Program Files\glass2k\Glass2k.exe [2007-10-17 00:04:00 56325]
TrueTransparency.lnk - C:\Program Files\TrueTransparency\TrueTransparency.exe [2007-10-14 18:22:56 134144]
VisualTaskTips.lnk - C:\Program Files\VisualTaskTips\VisualTaskTips.exe [2007-09-05 18:20:12 36352]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-10-31 18:19:34 113664]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 09:15:54 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnlkhe]
opnlkhe.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2007-05-11 03:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
–a—— 2006-12-05 22:55 54832 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
–a—— 2007-01-19 12:54 5674352 C:\Program Files\MSN Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
——— 2006-11-23 15:10 56928 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2007-07-12 04:00 132496 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2007-10-03 04:03 185632 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\mmc.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Sports Interactive\\Football Manager 2007\\fm.exe"=
"C:\\Program Files\\WinTV\\EPG Services\\System\\EPGClient.exe"=
"C:\\Program Files\\Kontiki\\KService.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"C:\\Program Files\\Real\\eREAD_Cookcase.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=

R2 EPGService;EPGService;C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe [2006-11-28 18:17]
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2007-01-04 23:13]
R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-01-11 18:39]
R2 ZuneBusEnum;Zune Bus Enumerator;c:\WINDOWS\system32\ZuneBusEnum.exe [2008-01-11 18:54]
R3 USB28xxBGA;WinTV HVR-900;C:\WINDOWS\system32\DRIVERS\emBDA.sys [2007-01-29 23:20]
R3 USB28xxOEM;WinTV OEM Filter;C:\WINDOWS\system32\DRIVERS\emOEM.sys [2007-01-29 23:19]
S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 00:01]
S3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2006-12-06 00:39]
S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;c:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-01-11 18:54]
S4 Usbncht;Usbncht;C:\WINDOWS\system32\drivers\mf.sys [2004-08-04 13:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{33d2a3f4-ca7d-11dc-b2bf-000d60f57444}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a

.
Contents of the 'Scheduled Tasks' folder
"2007-10-26 19:33:54 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_vVX1000_exe.job"
- C:\WINDOWS\vVX1000.exe
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-12 01:59:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\VisualTaskTips\VttHooks.dll
-> C:\Program Files\TrueTransparency\TrueTransparencyHook.dll
.
———————— Other Running Processes ————————
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
.
**************************************************************************
.
Completion time: 2008-04-12 2:03:38 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-12 01:03:30
Pre-Run: 18,720,780,288 bytes free
Post-Run: 18,654,478,336 bytes free
.
2008-04-09 14:36:01 — E O F —

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:06:07, on 12/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe
C:\Program Files\Kontiki\KService.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\VistaDriveIcon\DrvIcon.exe
C:\WINDOWS\HCWemmon.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\glass2k\Glass2k.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\TrueTransparency\TrueTransparency.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\VisualTaskTips\VisualTaskTips.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\User\Desktop\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AddTask Class - {24F06550-65E3-4D1C-8CFE-839C296B5530} - C:\Program Files\real\IEeREAD.dll
O2 - BHO: (no name) - {26B386B5-A093-4D4F-AC6E-146616BFE900} - (no file)
O2 - BHO: (no name) - {4fbc733a-9723-4835-813f-43340e5f377e} - (no file)
O2 - BHO: AddTask Class - {6A19C29D-ED45-4483-8999-9F939C8161F2} - C:\Program Files\real\WebHook.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: (no name) - {CED233DD-EE2E-4ED2-A727-3F82E90AC14F} - (no file)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FF77F93C-A100-410D-AD16-763C7A4883C6} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\styler\TB\StylerTB.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\VistaDriveIcon\DrvIcon.exe
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [HCWemmon] HCWemmon.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\WINDOWS\TEMP\E_SC4.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Startup: Glass2k.lnk = C:\Program Files\glass2k\Glass2k.exe
O4 - Startup: TrueTransparency.lnk = C:\Program Files\TrueTransparency\TrueTransparency.exe
O4 - Startup: VisualTaskTips.lnk = C:\Program Files\VisualTaskTips\VisualTaskTips.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo…toUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: opnlkhe - opnlkhe.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: EPGService - Hauppauge Computer Works - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

–
End of file - 9503 bytes

Rorschach112

Post #6April 12, 2008, 12:48 PM UTC

Hello

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O2 - BHO: (no name) - {26B386B5-A093-4D4F-AC6E-146616BFE900} - (no file)
O2 - BHO: (no name) - {4fbc733a-9723-4835-813f-43340e5f377e} - (no file)
O2 - BHO: (no name) - {CED233DD-EE2E-4ED2-A727-3F82E90AC14F} - (no file)
O2 - BHO: (no name) - {FF77F93C-A100-410D-AD16-763C7A4883C6} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O20 - Winlogon Notify: opnlkhe - opnlkhe.dll (file missing)

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\temp\temp.exe
C:\Data Laptop.exe
C:\C.exe
C:\WINDOWS\system32\klkkj.ini2
C:\WINDOWS\system32\pqstv.ini2
G:\LaunchU3.exe

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{33d2a3f4-ca7d-11dc-b2bf-000d60f57444}]

charliemoss13

Post #7April 13, 2008, 1:17 AM UTC

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:16:15, on 13/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\VistaDriveIcon\DrvIcon.exe
C:\WINDOWS\HCWemmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe
C:\Program Files\glass2k\Glass2k.exe
C:\Program Files\TrueTransparency\TrueTransparency.exe
C:\Program Files\VisualTaskTips\VisualTaskTips.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\User\Desktop\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AddTask Class - {24F06550-65E3-4D1C-8CFE-839C296B5530} - C:\Program Files\real\IEeREAD.dll
O2 - BHO: AddTask Class - {6A19C29D-ED45-4483-8999-9F939C8161F2} - C:\Program Files\real\WebHook.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\styler\TB\StylerTB.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\VistaDriveIcon\DrvIcon.exe
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [HCWemmon] HCWemmon.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\WINDOWS\TEMP\E_SC4.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Startup: Glass2k.lnk = C:\Program Files\glass2k\Glass2k.exe
O4 - Startup: TrueTransparency.lnk = C:\Program Files\TrueTransparency\TrueTransparency.exe
O4 - Startup: VisualTaskTips.lnk = C:\Program Files\VisualTaskTips\VisualTaskTips.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo…toUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: EPGService - Hauppauge Computer Works - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

–
End of file - 9147 bytes

Rorschach112

Post #8April 13, 2008, 1:50 PM UTC

Can you post the ComboFix log and do this

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Full Scan", then click Scan. Check all the boxes and click Start Scan
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Also tell me how your PC is running

charliemoss13

Post #9April 14, 2008, 4:33 PM UTC

ComboFix 08-04-11.5 - User 2008-04-13 2:05:19.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.488 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\User\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\C.exe
C:\Data Laptop.exe
C:\temp\temp.exe
C:\WINDOWS\system32\klkkj.ini2
C:\WINDOWS\system32\pqstv.ini2
G:\LaunchU3.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\C.exe
C:\Data Laptop.exe
C:\temp\temp.exe
C:\WINDOWS\system32\klkkj.ini2
C:\WINDOWS\system32\pqstv.ini2

.
((((((((((((((((((((((((( Files Created from 2008-03-13 to 2008-04-13 )))))))))))))))))))))))))))))))
.

2008-04-11 05:29 . 2008-04-11 12:55 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-04-11 05:29 . 2008-04-11 05:29 1,409 –a—— C:\WINDOWS\QTFont.for
2008-04-10 14:55 . 2008-04-10 14:55 d——– C:\Deckard
2008-04-08 16:54 . 2008-04-08 16:55 15,364 –ah—– C:\.DS_Store
2008-04-04 22:08 . 2008-04-04 22:08 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-03-26 06:50 . 2008-03-26 06:50 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-26 06:49 . 2008-03-26 09:22 d——– C:\Program Files\SUPERAntiSpyware
2008-03-26 06:49 . 2008-03-26 06:49 d——– C:\Documents and Settings\User\Application Data\SUPERAntiSpyware.com
2008-03-25 04:15 . 2008-03-25 04:15 d——– C:\Program Files\MSXML 4.0
2008-03-24 09:08 . 2008-03-24 09:08 d——– C:\Program Files\Yahoo!
2008-03-24 06:46 . 2008-03-24 06:46 d——– C:\Documents and Settings\All Users\Application Data\Nokia
2008-03-19 22:44 . 2008-03-19 22:45 d——– C:\Documents and Settings\All Users\Application Data\Retrospect
2008-03-19 21:50 . 2008-03-19 21:50 d——– C:\Program Files\Western Digital Technologies
2008-03-19 21:50 . 2008-03-19 22:41 364,544 –a—— C:\WINDOWS\system32\WDBtnMgr.exe
2008-03-17 18:50 . 2008-03-17 18:50 d——– C:\Documents and Settings\All Users\Application Data\InstallShield
2008-03-17 18:49 . 2002-11-02 10:53 57,344 –a—— C:\WINDOWS\system32\WNASPINT.DLL
2008-03-17 03:01 . 2008-03-17 03:01 268 –ah—– C:\sqmdata19.sqm
2008-03-17 03:01 . 2008-03-17 03:01 244 –ah—– C:\sqmnoopt19.sqm
2008-03-15 21:24 . 2008-03-15 21:24 4,096 –a—— C:\WINDOWS\d3dx.dat
2008-03-14 14:15 . 2008-03-17 16:49 d——– C:\Program Files\GameSpy Arcade

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-13 01:07 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kontiki
2008-04-13 00:40 ——— d—–w C:\Documents and Settings\User\Application Data\AVG7
2008-04-13 00:39 ——— d—–w C:\Program Files\WinTV
2008-04-04 14:19 ——— d—–w C:\Documents and Settings\User\Application Data\LimeWire
2008-03-26 05:47 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-24 05:46 ——— d—–w C:\Program Files\Nokia
2008-03-24 05:46 ——— d—–w C:\Program Files\Common Files\Nokia
2008-03-24 05:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Installations
2008-03-22 12:51 ——— d—–w C:\Program Files\VirtualDJ
2008-03-22 12:50 ——— d—–w C:\Documents and Settings\User\Application Data\uTorrent
2008-03-22 12:47 ——— d—–w C:\Program Files\Real
2008-03-20 09:28 ——— d—–w C:\Program Files\PKR
2008-03-20 04:24 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-03-19 09:47 1,845,248 —-a-w C:\WINDOWS\system32\win32k.sys
2008-03-01 13:06 826,368 —-a-w C:\WINDOWS\system32\wininet.dll
2008-02-26 01:10 ——— d—–w C:\Program Files\DivX
2008-02-24 13:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2008-02-24 12:36 ——— d—–w C:\Documents and Settings\LocalService\Application Data\AVG7
2008-02-24 12:36 ——— d—–w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-23 19:34 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
2008-02-23 19:16 ——— d—–w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-02-23 18:16 6,929 —-a-w C:\WINDOWS\system32\dkstaneu.dll
2008-02-23 18:13 6,929 —-a-w C:\WINDOWS\system32\gjkyjvou.dll
2008-02-21 02:05 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2008-02-21 02:05 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2008-02-21 02:05 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2008-02-21 02:04 823,296 —-a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-02-21 02:04 823,296 —-a-w C:\WINDOWS\system32\divx_xx07.dll
2008-02-21 02:04 81,920 —-a-w C:\WINDOWS\system32\dpl100.dll
2008-02-21 02:04 802,816 —-a-w C:\WINDOWS\system32\divx_xx11.dll
2008-02-21 02:04 682,496 —-a-w C:\WINDOWS\system32\DivX.dll
2008-02-21 02:04 593,920 —-a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-02-21 02:04 57,344 —-a-w C:\WINDOWS\system32\dpv11.dll
2008-02-21 02:04 53,248 -c–a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-02-21 02:04 344,064 -c–a-w C:\WINDOWS\system32\dpus11.dll
2008-02-21 02:04 294,912 -c–a-w C:\WINDOWS\system32\dpu10.dll
2008-02-21 02:04 294,912 —-a-w C:\WINDOWS\system32\dpu11.dll
2008-02-21 02:04 196,608 -c–a-w C:\WINDOWS\system32\dtu100.dll
2008-02-21 02:03 156,992 —-a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-02-21 02:03 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-02-20 18:11 ——— d—–w C:\Documents and Settings\User\Application Data\Apple Computer
2008-02-20 18:03 ——— d—–w C:\Program Files\3ivx
2008-02-20 06:51 282,624 —-a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 —-a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-19 15:09 6,929 —-a-w C:\WINDOWS\system32\keddamxf.dll
2008-02-19 15:06 6,929 —-a-w C:\WINDOWS\system32\tbbpfamw.dll
2008-02-19 15:03 6,929 —-a-w C:\WINDOWS\system32\bcdiamjt.dll
2008-02-19 14:06 6,929 —-a-w C:\WINDOWS\system32\htyqofge.dll
2008-02-19 14:03 6,929 —-a-w C:\WINDOWS\system32\lynykqvs.dll
2008-02-19 14:00 6,929 —-a-w C:\WINDOWS\system32\lmnxbjoj.dll
2008-02-19 02:20 3,532 —-a-w C:\drmHeader.bin
2008-02-17 16:29 ——— d—–w C:\Documents and Settings\All Users\Application Data\UDL
2008-02-17 13:04 6,929 —-a-w C:\WINDOWS\system32\omxqefiv.dll
2008-02-17 13:02 6,929 —-a-w C:\WINDOWS\system32\dbvagyjr.dll
2008-02-16 09:20 6,929 —-a-w C:\WINDOWS\system32\dgsfddse.dll
2008-02-16 09:18 6,929 —-a-w C:\WINDOWS\system32\sedxlowu.dll
2008-02-15 03:57 6,929 —-a-w C:\WINDOWS\system32\opkpqvga.dll
2008-02-15 03:54 6,929 —-a-w C:\WINDOWS\system32\sivryblf.dll
2008-02-15 03:51 6,929 —-a-w C:\WINDOWS\system32\ntedlomm.dll
2008-02-14 03:43 6,929 —-a-w C:\WINDOWS\system32\nnhgywew.dll
2008-02-14 03:40 6,929 —-a-w C:\WINDOWS\system32\xmdfvvin.dll
2008-02-14 03:37 6,929 —-a-w C:\WINDOWS\system32\miuobejv.dll
2008-02-13 15:50 ——— d—–w C:\Program Files\Kontiki
2008-02-13 15:50 ——— d—–w C:\Program Files\Channel4
2008-02-13 15:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\Channel4
2008-02-13 13:48 ——— d—–w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-13 13:47 ——— d—–w C:\Program Files\Lavasoft
2008-02-13 13:20 ——— d—–w C:\Program Files\Enigma Software Group
2008-02-13 13:11 ——— d—–w C:\Documents and Settings\User\Application Data\Uniblue
2008-02-13 03:44 6,929 —-a-w C:\WINDOWS\system32\mijqulph.dll
2008-02-13 03:38 6,929 —-a-w C:\WINDOWS\system32\hnvejtxp.dll
2008-02-13 03:35 6,929 —-a-w C:\WINDOWS\system32\rlcdunhg.dll
2008-02-12 00:13 6,929 —-a-w C:\WINDOWS\system32\nsxbynrg.dll
2008-02-12 00:10 6,929 —-a-w C:\WINDOWS\system32\teupieky.dll
2008-02-12 00:07 6,929 —-a-w C:\WINDOWS\system32\twpquriv.dll
2008-02-11 23:16 6,929 —-a-w C:\WINDOWS\system32\wjiboehf.dll
2008-02-11 23:13 6,929 —-a-w C:\WINDOWS\system32\pcvpsyyi.dll
2008-02-11 23:10 6,929 —-a-w C:\WINDOWS\system32\aujekhgx.dll
2008-02-10 23:15 6,929 —-a-w C:\WINDOWS\system32\jkeyebej.dll
2008-02-10 23:12 6,929 —-a-w C:\WINDOWS\system32\tctfkqft.dll
2008-02-10 23:09 6,929 —-a-w C:\WINDOWS\system32\rgrsepep.dll
2008-02-09 23:14 6,929 —-a-w C:\WINDOWS\system32\tjcdpols.dll
2008-02-09 23:11 6,929 —-a-w C:\WINDOWS\system32\coaxrmqr.dll
2008-02-09 23:08 6,929 —-a-w C:\WINDOWS\system32\ccvciuxx.dll
2008-02-07 23:14 6,929 —-a-w C:\WINDOWS\system32\oejtvtgk.dll
2008-02-07 23:11 6,929 —-a-w C:\WINDOWS\system32\xidirbnt.dll
2008-02-07 23:08 6,929 —-a-w C:\WINDOWS\system32\lsyjsjgh.dll
2008-02-06 23:12 6,929 —-a-w C:\WINDOWS\system32\idkdksgt.dll
2008-02-06 23:09 6,929 —-a-w C:\WINDOWS\system32\lpmmohor.dll
2008-02-06 23:06 6,929 —-a-w C:\WINDOWS\system32\jjjifmbs.dll
2008-02-05 23:04 6,929 —-a-w C:\WINDOWS\system32\viecippk.dll
2008-02-05 23:04 6,929 —-a-w C:\WINDOWS\system32\pewtbytr.dll
2008-02-02 22:58 6,929 —-a-w C:\WINDOWS\system32\wauxahvy.dll
2008-02-02 22:52 6,929 —-a-w C:\WINDOWS\system32\vischgcd.dll
2008-02-02 22:49 6,929 —-a-w C:\WINDOWS\system32\phrkfubk.dll
2008-02-01 19:07 6,929 —-a-w C:\WINDOWS\system32\haeweycf.dll
2008-02-01 19:06 6,929 —-a-w C:\WINDOWS\system32\uwlwnuls.dll
2008-01-31 17:06 6,929 —-a-w C:\WINDOWS\system32\cfkurpoe.dll
2008-01-31 17:03 6,929 —-a-w C:\WINDOWS\system32\npoloffp.dll
.

——- Sigcheck ——-

2004-08-04 13:00 541696 55aca85eb80e2155e20211aaaddd711a C:\WINDOWS\system32\winlogon.exe
2004-08-04 13:00 541696 55aca85eb80e2155e20211aaaddd711a C:\WINDOWS\system32\dllcache\winlogon.exe
2004-08-04 13:00 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\VistaMizer\old\winlogon.exe

2005-03-02 01:36 2056832 d8aba3eab509627e707a3b14f00fbb6b C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2007-02-28 10:15 2059392 4d3dbdccbf97f5ba1e74f322b155c3ba C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
2007-02-28 09:38 2057600 515d30e2c90a3665a2739309334c9283 C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
2007-02-28 09:38 2314752 dec5e0d5185864e2beeef76daa3d38c2 C:\WINDOWS\system32\ntkrnlpa.exe
2007-02-28 09:38 2314752 dec5e0d5185864e2beeef76daa3d38c2 C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2007-02-28 09:38 2057600 515d30e2c90a3665a2739309334c9283 C:\WINDOWS\VistaMizer\old\ntkrnlpa.exe

2005-03-02 02:04 2179456 28187802b7c368c0d3aef7d4c382aabb C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2007-02-28 10:55 2182144 5a5c8db4aa962c714c8371fbdf189fc9 C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
2007-02-28 10:10 2180352 582a8dbaa58c3b1f176eb2817daee77c C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
2007-02-28 10:10 2437504 9809aefbe836dfd733fd520a40d5f67c C:\WINDOWS\system32\ntoskrnl.exe
2007-02-28 10:10 2437504 9809aefbe836dfd733fd520a40d5f67c C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2007-02-28 10:10 2180352 582a8dbaa58c3b1f176eb2817daee77c C:\WINDOWS\VistaMizer\old\ntoskrnl.exe

2007-06-13 11:23 1551360 4893afc1937e67f288983e23f36a9f48 C:\WINDOWS\explorer.exe
2007-06-13 12:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2007-06-13 11:23 1551360 4893afc1937e67f288983e23f36a9f48 C:\WINDOWS\system32\dllcache\explorer.exe
2007-06-13 11:23 1033216 97bd6515465659ff8f3b7be375b2ea87 C:\WINDOWS\VistaMizer\old\explorer.exe
.
((((((((((((((((((((((((((((( snapshot@2008-04-12_ 2.03.12.69 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-19 07:36:23 68,608 —-a-w C:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2008-04-12 09:04:26 69,120 —-a-w C:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2007-11-19 07:36:43 72,192 —-a-w C:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2008-04-12 09:04:34 72,192 —-a-w C:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2007-11-19 07:36:43 4,308,992 —-a-w C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2008-04-12 09:04:06 4,444,160 —-a-w C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
- 2007-11-19 07:36:46 482,304 —-a-w C:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2008-04-12 09:04:36 483,840 —-a-w C:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
- 2007-11-19 07:36:38 2,902,016 —-a-w C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2008-04-12 09:04:17 3,036,160 —-a-w C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- 2007-11-19 07:36:12 258,048 —-a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2008-04-12 09:04:40 258,048 —-a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2007-11-19 07:36:12 114,176 —-a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2008-04-12 09:04:40 113,664 —-a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
- 2007-11-19 07:36:55 260,096 —-a-w C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2008-04-12 09:04:34 261,120 —-a-w C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2007-11-19 07:36:28 5,156,864 —-a-w C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2008-04-12 09:04:14 5,431,296 —-a-w C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- 2007-11-19 07:36:21 10,752 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2008-04-12 09:04:23 10,752 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2007-11-19 07:36:11 507,904 —-a-w C:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2008-04-12 09:04:15 507,904 —-a-w C:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2007-11-19 07:36:17 13,312 —-a-w C:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2008-04-12 09:04:25 13,312 —-a-w C:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2007-11-19 07:36:40 8,192 —-a-w C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2008-04-12 09:04:29 8,192 —-a-w C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
- 2007-11-19 07:36:41 36,864 —-a-w C:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2008-04-12 09:04:30 77,824 —-a-w C:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2007-11-19 07:36:42 5,632 —-a-w C:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2008-04-12 09:04:31 6,656 —-a-w C:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2007-11-19 07:36:18 413,696 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2008-04-12 09:04:41 348,160 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
- 2007-11-19 07:36:19 36,864 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2008-04-12 09:04:42 36,864 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2007-11-19 07:36:20 647,168 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2008-04-12 09:04:43 655,360 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
- 2007-11-19 07:36:21 73,728 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2008-04-12 09:04:44 77,824 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
- 2007-11-19 07:36:18 749,568 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2008-04-12 09:04:32 749,568 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- 2007-11-19 07:36:58 110,592 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2008-04-12 09:04:30 110,592 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
- 2007-11-19 07:36:57 372,736 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
+ 2008-04-12 09:04:28 372,736 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2007-11-19 07:36:08 28,672 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2008-04-12 09:04:37 28,672 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2007-11-19 07:36:56 667,648 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2008-04-12 09:04:28 671,744 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2007-11-19 07:36:59 5,632 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2008-04-12 09:04:10 5,632 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2007-11-19 07:36:11 12,800 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2008-04-12 09:04:39 12,800 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2007-11-19 07:36:09 32,768 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2008-04-12 09:04:27 32,768 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2007-11-19 07:36:10 7,168 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2008-04-12 09:04:26 7,168 —-a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2007-11-19 07:36:50 110,592 —-a-w C:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2008-04-12 09:04:32 110,592 —-a-w C:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2007-11-19 07:36:24 81,920 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2008-04-12 09:04:33 81,920 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2007-11-19 07:36:51 413,696 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2008-04-12 09:04:16 425,984 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
- 2007-11-19 07:36:47 716,800 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2008-04-12 09:04:17 741,376 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2007-11-19 07:36:15 888,832 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2008-04-12 09:04:18 933,888 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2007-11-19 07:36:39 5,001,216 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2008-04-12 09:04:45 5,070,848 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
- 2007-11-19 07:36:25 188,416 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2008-04-12 09:04:43 188,416 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
- 2007-11-19 07:36:25 397,312 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2008-04-12 09:04:23 401,408 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2007-11-19 07:36:26 81,920 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2008-04-12 09:04:38 81,920 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2007-11-19 07:36:53 577,536 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2008-04-12 09:04:11 630,784 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2007-11-19 07:36:48 372,736 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2008-04-12 09:04:40 372,736 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
- 2007-11-19 07:36:54 258,048 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2008-04-12 09:04:38 258,048 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2007-11-19 07:36:48 299,008 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2008-04-12 09:04:36 299,008 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2007-11-19 07:36:49 131,072 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2008-04-12 09:04:35 131,072 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2007-11-19 07:36:22 258,048 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2008-04-12 09:04:11 258,048 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
- 2007-11-19 07:36:27 114,688 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2008-04-12 09:04:13 114,688 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2007-11-19 07:36:56 835,584 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2008-04-12 09:04:21 884,736 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2007-11-19 07:36:30 86,016 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2008-04-12 09:04:22 90,112 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2007-11-19 07:36:32 823,296 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2008-04-12 09:04:20 839,680 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2007-11-19 07:36:35 5,152,768 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2008-04-12 09:04:24 5,013,504 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2007-11-19 07:36:36 2,027,520 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2008-04-12 09:04:13 2,068,480 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2007-11-19 07:36:53 2,940,928 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2008-04-12 09:04:19 3,076,096 —-a-w C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2008-04-12 09:10:47 27,136 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\c6772fd12a581ad3be49e3f2a80b5622\Accessibility.ni.dll
+ 2008-04-12 09:10:49 884,736 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\a1d353edc300e3aff0784202f68a657b\AspNetMMCExt.ni.dll
+ 2008-04-12 09:10:51 237,568 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\c10ec9b4de2b366236ec83237dc31281\CustomMarshalers.ni.dll
+ 2008-04-12 09:10:50 15,360 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\dfsvc\837fe02bdcf637d5bf1e5ffb935ebb80\dfsvc.ni.exe
+ 2008-04-12 09:10:54 876,544 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\9710a3c0d11dd264c3a6b88977699e9b\Microsoft.Build.Engine.ni.dll
+ 2008-04-12 09:10:55 81,920 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\e2858a45971fb30b0c0523dbb52c1d4e\Microsoft.Build.Framework.ni.dll
+ 2008-04-12 09:11:00 1,695,744 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\63d69ffdf3c640d2d104a4b74e8115f8\Microsoft.Build.Tasks.ni.dll
+ 2008-04-12 09:11:01 167,936 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\11cb5418c06e30100616fbf205588489\Microsoft.Build.Utilities.ni.dll
+ 2008-04-12 09:11:06 1,740,800 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\923bd55258380eae77353d36a5a1b08f\Microsoft.VisualBasic.ni.dll
+ 2008-04-12 09:12:50 17,920 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\cd0730694ba5927a6efd32129783e1b4\Microsoft.VisualC.ni.dll
+ 2008-04-12 09:07:09 11,722,752 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\32e6f703c114f3a971cbe706586e3655\mscorlib.ni.dll
+ 2008-04-12 09:12:59 163,840 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\c46625ea87db53ccf6194fe17ee05c19\System.Configuration.Install.ni.dll
+ 2008-04-12 09:11:10 1,011,712 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\eee9b48577689e92db5a7b5c5de98d9b\System.Configuration.ni.dll
+ 2008-04-12 09:12:58 1,183,744 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\1abdb47765d0696a2fc0a1095bac0249\System.Data.OracleClient.ni.dll
+ 2008-04-12 09:12:50 2,756,608 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\e59504af41afab5e04681af951d9b302\System.Data.SqlXml.ni.dll
+ 2008-04-12 09:07:59 7,049,216 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\5f669e819da7010c1dca347a25597c42\System.Data.ni.dll
+ 2008-04-12 09:11:13 1,798,144 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Deployment\c7dea4895e1fa33d65e448c03de48d26\System.Deployment.ni.dll
+ 2008-04-12 09:08:31 10,969,088 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Design\c1e16b40e30a05c39be8aee46311841c\System.Design.ni.dll
+ 2008-04-12 09:11:18 1,224,704 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\914668b240550f529e54bb772c6fc881\System.DirectoryServices.ni.dll
+ 2008-04-12 09:11:20 512,000 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\f11bc82c09955cb8438d3885a99c297d\System.DirectoryServices.Protocols.ni.dll
+ 2008-04-12 09:08:37 229,376 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\b974f6c17d17a533adf6e7710c5a62fa\System.Drawing.Design.ni.dll
+ 2008-04-12 09:08:35 1,667,072 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\0e83aac37b2623f1a24c70979f31dd56\System.Drawing.ni.dll
+ 2008-04-12 09:11:22 659,456 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\646131eda5f21f4e6216733d49c22c56\System.EnterpriseServices.ni.dll
+ 2008-04-12 09:11:22 294,912 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\646131eda5f21f4e6216733d49c22c56\System.EnterpriseServices.Wrapper.dll
+ 2008-04-12 09:12:53 815,104 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0898f6c1de8cb89413d206e3d6a3ce1d\System.Runtime.Remoting.ni.dll
+ 2008-04-12 09:12:54 339,968 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\1f5cf8178029f5b959a9af75cb8cfedb\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2008-04-12 09:11:25 733,184 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Security\2b5994269cc5b996231c9b21afea9a91\System.Security.ni.dll
+ 2008-04-12 09:11:26 233,472 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\193ac978af569ad9ee45110b359961b9\System.ServiceProcess.ni.dll
+ 2008-04-12 09:11:28 679,936 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\12e0aa1030badf4524f897e3f57b037a\System.Transactions.ni.dll
+ 2008-04-12 09:12:13 2,342,912 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\37d87b3cab1c66ec4430ebb2abeaa570\System.Web.Mobile.ni.dll
+ 2008-04-12 09:12:14 237,568 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\b5b81faf46fc63c20d5339b36edd02fa\System.Web.RegularExpressions.ni.dll
+ 2008-04-12 09:12:20 1,986,560 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\38991368499e2109ea4099a0fe29c5a3\System.Web.Services.ni.dll
+ 2008-04-12 09:12:05 12,509,184 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\67cfb70213562afe2ca9b9066764af3a\System.Web.ni.dll
+ 2008-04-12 09:09:13 13,193,216 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3d8c79c45aa674e43f075e2e66b8caf5\System.Windows.Forms.ni.dll
+ 2008-04-12 09:09:31 5,771,264 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\c98cb65a79cfccb44ea727ebe4593ede\System.Xml.ni.dll
+ 2008-04-12 09:07:36 8,265,728 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\ba0e3a22211ba7343e0116b051f2965a\System.ni.dll
+ 2008-04-12 09:12:39 5,816,320 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\UIX\660d7b7bf8c8dc24bfaac30e96f7d293\UIX.ni.dll
+ 2008-04-12 09:13:04 1,208,320 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\ZuneDBApi\707a768c877e79c22b8ca93b711597bd\ZuneDBApi.ni.dll
+ 2008-04-12 09:13:12 1,785,856 —-a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\ZuneShell\e5d481c447d93bf9e55bf32fa30f2066\ZuneShell.ni.dll
- 2005-09-23 07:28:52 72,704 —-a-w C:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe
+ 2007-10-24 00:47:38 82,944 —-a-w C:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe
- 2005-09-23 07:28:52 7,680 —-a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp10.dll
+ 2007-10-24 00:47:38 16,896 —-a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp10.dll
- 2005-09-23 07:28:56 7,680 —-a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp20_mscorwks.dll
+ 2007-10-24 00:47:40 16,896 —-a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp20_mscorwks.dll
- 2005-09-23 07:28:58 7,680 —-a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp20_perfcounter.dll
+ 2007-10-24 00:47:42 16,896 —-a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp20_perfcounter.dll
- 2005-09-23 07:28:56 7,680 —-a-w C:\WINDOWS\Microsoft.NET\Framework\SharedReg12.dll
+ 2007-10-24 00:47:40 16,896 —-a-w C:\WINDOWS\Microsoft.NET\Framework\SharedReg12.dll
- 2005-09-23 07:28:52 86,528 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll
+ 2007-10-24 00:47:38 97,280 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll
- 2005-09-23 07:28:36 18,944 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll
+ 2007-10-24 00:47:26 28,672 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll
- 2005-09-23 07:28:42 136,192 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll
+ 2007-10-24 00:47:30 145,408 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll
- 2005-09-23 07:28:44 4,608 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll
+ 2007-10-24 00:47:32 13,824 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll
- 2005-09-23 07:29:04 183,808 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll
+ 2007-10-24 00:47:48 193,016 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll
- 2005-09-23 07:28:28 208,896 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll
+ 2007-10-24 00:47:20 218,112 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll
- 2005-09-23 07:28:56 10,752 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll
+ 2007-10-24 00:47:40 10,752 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll
- 2005-09-23 07:28:58 138,240 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll
+ 2007-10-24 00:47:42 147,968 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll
- 2005-09-23 07:28:36 87,552 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\alink.dll
+ 2007-10-24 00:47:26 99,320 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\alink.dll
- 2007-04-13 03:21:18 58,712 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
+ 2007-10-24 00:47:42 59,392 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
- 2005-09-23 07:28:32 36,864 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
+ 2007-10-24 00:47:22 36,864 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
- 2007-04-13 03:20:52 10,752 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
+ 2007-10-24 00:47:22 22,024 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
- 2007-04-13 03:20:52 8,192 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
+ 2007-10-24 00:47:22 17,928 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
- 2007-04-13 03:20:52 23,552 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
+ 2007-10-24 00:47:22 33,288 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
- 2007-04-13 03:20:50 75,264 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
+ 2007-10-24 00:47:22 84,480 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
- 2005-09-23 07:28:32 13,824 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
+ 2007-10-24 00:47:22 24,576 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
- 2007-04-13 03:20:52 32,608 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
+ 2007-10-24 00:47:22 32,776 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
- 2005-09-23 07:28:32 106,496 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
+ 2007-10-24 00:47:22 106,496 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
- 2007-04-13 03:20:52 33,632 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
+ 2007-10-24 00:47:22 33,800 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
- 2007-04-13 03:20:52 32,600 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
+ 2007-10-24 00:47:22 33,280 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
- 2007-04-13 03:20:52 507,904 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
+ 2007-10-24 00:47:22 507,904 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
- 2005-09-23 07:28:56 106,496 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
+ 2007-10-24 00:47:40 106,496 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
- 2007-04-13 03:21:16 88,576 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
+ 2007-10-24 00:47:40 101,896 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
- 2005-09-23 07:28:42 76,984 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe
+ 2007-10-24 00:47:30 80,376 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe
- 2005-09-23 07:28:42 1,144,832 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscomp.dll
+ 2007-10-24 00:47:30 1,162,744 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscomp.dll
- 2005-09-23 07:28:42 13,312 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll
+ 2007-10-24 00:47:30 13,312 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll
- 2005-09-23 07:28:58 17,920 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll
+ 2007-10-24 00:47:42 27,136 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll
- 2005-09-23 07:28:56 68,608 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll
+ 2007-10-24 00:47:40 69,120 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll
- 2005-09-23 07:28:44 31,936 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
+ 2007-10-24 00:47:30 35,320 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
- 2005-09-23 07:28:38 52,736 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfdll.dll
+ 2007-10-24 00:47:28 66,552 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfdll.dll
- 2007-04-13 03:20:58 5,120 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
+ 2007-10-24 00:47:28 5,120 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
- 2005-09-23 07:29:12 547,840 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
+ 2007-10-24 00:47:54 572,936 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
- 2005-09-23 07:28:56 788,992 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll
+ 2007-10-24 00:47:40 798,224 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll
- 2005-09-23 07:28:50 9,216 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fusion.dll
+ 2007-10-24 00:47:36 18,936 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fusion.dll
- 2007-04-13 03:21:16 9,728 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
+ 2007-10-24 00:47:40 9,728 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
- 2005-09-23 07:28:56 8,192 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll
+ 2007-10-24 00:47:40 8,192 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll
- 2005-09-23 07:28:56 36,864 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEHost.dll
+ 2007-10-24 00:47:40 77,824 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEHost.dll
- 2005-09-23 07:28:56 5,632 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll
+ 2007-10-24 00:47:40 6,656 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll
- 2007-04-13 03:21:16 228,688 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
+ 2007-10-24 00:47:40 230,904 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
- 2007-04-13 03:21:16 28,672 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
+ 2007-10-24 00:47:40 28,672 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
- 2005-09-23 07:28:56 55,296 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll
+ 2007-10-24 00:47:40 65,032 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll
- 2005-09-23 07:28:56 72,192 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll
+ 2007-10-24 00:47:40 72,192 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll
- 2005-09-23 07:28:48 40,960 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe
+ 2007-10-24 00:47:34 40,960 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe
- 2007-04-13 03:21:10 413,696 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
+ 2007-10-24 00:47:36 348,160 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
- 2005-09-23 07:28:48 36,864 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll
+ 2007-10-24 00:47:36 36,864 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll
- 2007-04-13 03:21:10 647,168 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
+ 2007-10-24 00:47:36 655,360 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
- 2005-09-23 07:28:48 73,728 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll
+ 2007-10-24 00:47:36 77,824 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll
- 2007-04-13 03:21:08 749,568 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
+ 2007-10-24 00:47:34 749,568 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
- 2005-09-23 07:29:10 110,592 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2007-10-24 00:47:52 110,592 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll
- 2005-09-23 07:29:10 372,736 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll
+ 2007-10-24 00:47:52 372,736 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll
- 2005-09-23 07:29:08 667,648 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll
+ 2007-10-24 00:47:50 671,744 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll
- 2005-09-23 07:28:30 28,672 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll
+ 2007-10-24 00:47:20 28,672 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll
- 2005-09-23 07:29:10 5,632 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll
+ 2007-10-24 00:47:52 5,632 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll
- 2005-09-23 07:28:30 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll
+ 2007-10-24 00:47:20 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll
- 2005-09-23 07:28:30 12,800 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2007-10-24 00:47:20 12,800 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2005-09-23 07:28:30 7,168 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll
+ 2007-10-24 00:47:20 7,168 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll
- 2007-04-13 03:20:52 87,040 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
+ 2007-10-24 00:47:22 97,792 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
- 2005-09-23 07:28:48 69,632 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
+ 2007-10-24 00:47:36 69,632 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
- 2007-04-13 03:21:18 802,304 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
+ 2007-10-24 00:47:40 822,280 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
- 2005-09-23 07:28:56 73,216 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll
+ 2007-10-24 00:47:40 83,456 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll
- 2005-09-23 07:28:56 288,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll
+ 2007-10-24 00:47:40 308,224 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll
- 2007-04-13 03:21:16 36,864 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
+ 2007-10-24 00:47:40 47,104 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
- 2007-04-13 03:21:16 326,656 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
+ 2007-10-24 00:47:40 348,672 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
- 2005-09-23 07:28:56 81,408 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorld.dll
+ 2007-10-24 00:47:40 94,208 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorld.dll
- 2007-04-13 03:21:16 4,308,992 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
+ 2007-10-24 00:47:40 4,444,160 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
- 2007-04-13 03:21:16 102,912 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
+ 2007-10-24 00:47:40 114,688 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
- 2005-09-23 07:29:00 330,752 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
+ 2007-10-24 00:47:44 340,992 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
- 2005-09-23 07:28:56 67,072 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
+ 2007-10-24 00:47:40 77,312 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
- 2005-09-23 07:28:50 9,216 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll
+ 2007-10-24 00:47:36 18,944 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll
- 2007-04-13 03:21:18 227,328 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
+ 2007-10-24 00:47:40 242,688 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
- 2007-04-13 03:21:18 68,952 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
+ 2007-10-24 00:47:40 70,144 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
- 2005-09-23 07:28:56 10,240 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscortim.dll
+ 2007-10-24 00:47:40 19,456 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscortim.dll
- 2007-04-13 03:21:12 5,634,048 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
+ 2007-10-24 00:47:36 5,814,784 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
- 2005-09-23 07:29:00 22,528 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MUI\0409\mscorsecr.dll
+ 2007-10-24 00:47:44 31,744 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MUI\0409\mscorsecr.dll
- 2007-04-13 03:21:16 99,152 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe
+ 2007-10-24 00:47:40 101,880 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe
- 2007-04-13 03:21:18 15,360 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normalization.dll
+ 2007-10-24 00:47:40 24,584 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normalization.dll
- 2005-09-23 07:28:56 78,336 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll
+ 2007-10-24 00:47:40 89,096 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll
- 2007-04-13 03:21:12 136,192 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\peverify.dll
+ 2007-10-24 00:47:36 144,896 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\peverify.dll
- 2005-09-23 07:28:56 53,248 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
+ 2007-10-24 00:47:40 53,248 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
- 2005-09-23 07:28:56 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
+ 2007-10-24 00:47:40 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
- 2005-09-23 07:29:02 59,072 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
+ 2007-10-24 00:47:46 61,952 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
- 2005-09-23 07:28:58 7,680 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll
+ 2007-10-24 00:47:42 16,896 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll
- 2005-09-23 07:28:56 107,520 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\shfusion.dll
+ 2007-10-24 00:47:40 119,296 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\shfusion.dll
- 2005-09-23 07:29:00 85,504 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll
+ 2007-10-24 00:47:44 95,232 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll
- 2007-04-13 03:21:18 382,464 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\SOS.dll
+ 2007-10-24 00:47:40 392,696 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\SOS.dll
- 2007-04-13 03:21:18 110,592 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
+ 2007-10-24 00:47:40 110,592 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
- 2007-04-13 03:21:18 413,696 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
+ 2007-10-24 00:47:42 425,984 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
- 2005-09-23 07:28:56 81,920 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll
+ 2007-10-24 00:47:40 81,920 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll
- 2007-04-13 03:21:16 2,902,016 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
+ 2007-10-24 00:47:40 3,036,160 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
- 2007-04-13 03:21:18 482,304 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
+ 2007-10-24 00:47:40 483,840 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
- 2007-04-13 03:21:18 716,800 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
+ 2007-10-24 00:47:40 741,376 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
- 2007-04-13 03:20:58 888,832 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
+ 2007-10-24 00:47:28 933,888 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
- 2007-04-13 03:21:16 5,001,216 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
+ 2007-10-24 00:47:40 5,070,848 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
- 2005-09-23 07:28:56 397,312 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll
+ 2007-10-24 00:47:40 401,408 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll
- 2007-04-13 03:21:18 188,416 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
+ 2007-10-24 00:47:40 188,416 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
- 2007-04-13 03:21:16 2,940,928 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.dll
+ 2007-10-24 00:47:40 3,076,096 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.dll
- 2005-09-23 07:28:56 81,920 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll
+ 2007-10-24 00:47:40 81,920 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll
- 2007-04-13 03:21:16 577,536 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
+ 2007-10-24 00:47:40 630,784 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
- 2007-04-13 03:21:16 258,048 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
+ 2007-10-24 00:47:40 258,048 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
- 2007-04-13 03:21:18 47,616 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
+ 2007-10-24 00:47:40 57,392 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
- 2007-04-13 03:21:18 114,176 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
+ 2007-10-24 00:47:40 113,664 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
- 2007-04-13 03:21:16 372,736 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
+ 2007-10-24 00:47:40 372,736 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
- 2005-09-23 07:28:56 258,048 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll
+ 2007-10-24 00:47:40 258,048 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll
- 2007-04-13 03:21:16 299,008 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
+ 2007-10-24 00:47:40 299,008 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
- 2005-09-23 07:28:56 131,072 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll
+ 2007-10-24 00:47:40 131,072 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll
- 2005-09-23 07:28:56 258,048 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Security.dll
+ 2007-10-24 00:47:40 258,048 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Security.dll
- 2005-09-23 07:28:56 114,688 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll
+ 2007-10-24 00:47:40 114,688 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll
- 2007-04-13 03:21:18 260,096 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
+ 2007-10-24 00:47:40 261,120 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
- 2007-04-13 03:21:16 5,156,864 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
+ 2007-10-24 00:47:40 5,431,296 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
- 2005-09-23 07:28:56 835,584 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll
+ 2007-10-24 00:47:40 884,736 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll
- 2005-09-23 07:28:56 86,016 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll
+ 2007-10-24 00:47:40 90,112 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll
- 2005-09-23 07:28:56 823,296 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll
+ 2007-10-24 00:47:40 839,680 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll
- 2007-04-13 03:21:16 5,152,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
+ 2007-10-24 00:47:40 5,013,504 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
- 2007-04-13 03:21:16 2,027,520 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
+ 2007-10-24 00:47:40 2,068,480 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
- 2005-09-23 07:28:56 71,680 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL
+ 2007-10-24 00:47:40 81,400 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL
- 2007-04-13 03:21:28 1,166,672 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
+ 2007-10-24 00:47:48 1,172,472 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
- 2007-04-13 03:20:50 1,330,688 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
+ 2007-10-24 00:47:20 1,344,000 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
- 2007-04-13 03:20:52 426,496 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\webengine.dll
+ 2007-10-24 00:47:22 434,688 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\webengine.dll
- 2005-09-23 07:28:56 28,160 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll
+ 2007-10-24 00:47:40 37,896 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll
- 2005-09-23 07:28:38 125,952 —-a-w C:\WINDOWS\system32\dfshim.dll
+ 2007-10-24 00:47:28 96,760 —-a-w C:\WINDOWS\system32\dfshim.dll
- 2007-04-13 03:21:14 271,360 —-a-w C:\WINDOWS\system32\mscoree.dll
+ 2007-10-24 00:47:38 282,112 —-a-w C:\WINDOWS\system32\mscoree.dll
- 2005-09-23 07:28:52 197,120 —-a-w C:\WINDOWS\system32\mscorier.dll
+ 2007-10-24 00:47:38 158,720 —-a-w C:\WINDOWS\system32\mscorier.dll
- 2005-09-23 07:28:52 74,240 —-a-w C:\WINDOWS\system32\mscories.dll
+ 2007-10-24 00:47:38 84,480 —-a-w C:\WINDOWS\system32\mscories.dll
- 2005-09-23 07:29:00 6,144 —-a-w C:\WINDOWS\system32\mui\0409\mscorees.dll
+ 2007-10-24 00:47:44 15,360 —-a-w C:\WINDOWS\system32\mui\0409\mscorees.dll
- 2008-04-02 23:39:55 58,800 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-04-12 09:04:53 59,984 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2008-04-02 23:39:55 392,626 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-12 09:04:53 397,890 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-13 00:40:01 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_5c4.dat
+ 2008-04-12 09:04:29 8,192 —-a-w C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2007-10-24 00:47:56 479,232 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\msvcm80.dll
+ 2007-10-24 00:47:56 558,080 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\msvcp80.dll
+ 2007-10-24 00:47:56 635,904 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\msvcr80.dll
- 2007-11-19 07:36:12 258,048 —-a-w C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2008-04-12 09:04:40 258,048 —-a-w C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
- 2007-11-19 07:36:12 114,176 —-a-w C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2008-04-12 09:04:40 113,664 —-a-w C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{24F06550-65E3-4D1C-8CFE-839C296B5530}]
2007-06-28 18:25 57344 –a—— C:\Program Files\real\IEeREAD.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6A19C29D-ED45-4483-8999-9F939C8161F2}]
2008-02-01 11:20 57224 –a—— C:\Program Files\real\WebHook.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 18:05 143360]
"EPSON Stylus DX4400 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.exe" [2007-03-01 07:01 180736]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 25088]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-12 16:52 68856]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 17:03 1481968]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 11:12 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 10:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 10:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 10:36 114688]
"DrvIcon"="C:\Program Files\VistaDriveIcon\DrvIcon.exe" [2007-07-04 20:59 45056]
"Zune Launcher"="c:\Program Files\Zune\ZuneLauncher.exe" [2008-01-11 18:54 166304]
"HCWemmon"="HCWemmon.exe" [2007-03-29 19:22 61440 C:\WINDOWS\HCWemmon.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-24 13:36 579072]
"WD Button Manager"="WDBtnMgr.exe" [2008-03-19 22:41 364544 C:\WINDOWS\system32\WDBtnMgr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 18:35 1294336]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-24 13:36 219136]

C:\Documents and Settings\User\Start Menu\Programs\Startup\
Glass2k.lnk - C:\Program Files\glass2k\Glass2k.exe [2007-10-17 00:04:00 56325]
TrueTransparency.lnk - C:\Program Files\TrueTransparency\TrueTransparency.exe [2007-10-14 18:22:56 134144]
VisualTaskTips.lnk - C:\Program Files\VisualTaskTips\VisualTaskTips.exe [2007-09-05 18:20:12 36352]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-10-31 18:19:34 113664]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 09:15:54 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2007-05-11 03:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
–a—— 2006-12-05 22:55 54832 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
–a—— 2007-01-19 12:54 5674352 C:\Program Files\MSN Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
——— 2006-11-23 15:10 56928 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2007-07-12 04:00 132496 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2007-10-03 04:03 185632 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\mmc.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Sports Interactive\\Football Manager 2007\\fm.exe"=
"C:\\Program Files\\WinTV\\EPG Services\\System\\EPGClient.exe"=
"C:\\Program Files\\Kontiki\\KService.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"C:\\Program Files\\Real\\eREAD_Cookcase.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=

R2 EPGService;EPGService;C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe [2006-11-28 18:17]
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2007-01-04 23:13]
R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-01-11 18:39]
R2 ZuneBusEnum;Zune Bus Enumerator;c:\WINDOWS\system32\ZuneBusEnum.exe [2008-01-11 18:54]
R3 USB28xxBGA;WinTV HVR-900;C:\WINDOWS\system32\DRIVERS\emBDA.sys [2007-01-29 23:20]
R3 USB28xxOEM;WinTV OEM Filter;C:\WINDOWS\system32\DRIVERS\emOEM.sys [2007-01-29 23:19]
S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 00:01]
S3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2006-12-06 00:39]
S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;c:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-01-11 18:54]
S4 Usbncht;Usbncht;C:\WINDOWS\system32\drivers\mf.sys [2004-08-04 13:00]

.
Contents of the 'Scheduled Tasks' folder
"2007-10-26 19:33:54 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_vVX1000_exe.job"
- C:\WINDOWS\vVX1000.exe
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-13 02:08:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-13 2:09:44
ComboFix-quarantined-files.txt 2008-04-13 01:09:14
ComboFix2.txt 2008-04-12 01:03:39
Pre-Run: 18,434,211,840 bytes free
Post-Run: 18,436,009,984 bytes free
.
2008-04-12 09:06:33 — E O F —

Malwarebytes' Anti-Malware 1.11
Database version: 624

Scan type: Full Scan (A:\|C:\|D:\|E:\|)
Objects scanned: 141725
Time elapsed: 45 minute(s), 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\HID_Layer (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\C.exe (Trojan.Agent) -> Quarantined and deleted successfully.

charliemoss13

Post #10April 17, 2008, 1:18 PM UTC

PC is running fine apart from the fact I have these pop ups everyday from avg and when i'm in the middle of something, they slow everything right down almost so it's crashed. thanks for your help so far by the way, however, all the files are still coming up. viruses eh! what's the point in them

Rorschach112

Post #11April 17, 2008, 11:39 PM UTC

Hello

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\keddamxf.dll
C:\WINDOWS\system32\tbbpfamw.dll
C:\WINDOWS\system32\bcdiamjt.dll
C:\WINDOWS\system32\htyqofge.dll
C:\WINDOWS\system32\lynykqvs.dll
C:\WINDOWS\system32\lmnxbjoj.dll
C:\WINDOWS\system32\omxqefiv.dll
C:\WINDOWS\system32\dbvagyjr.dll
C:\WINDOWS\system32\dgsfddse.dll
C:\WINDOWS\system32\sedxlowu.dll
C:\WINDOWS\system32\opkpqvga.dll
C:\WINDOWS\system32\sivryblf.dll
C:\WINDOWS\system32\ntedlomm.dll
C:\WINDOWS\system32\nnhgywew.dll
C:\WINDOWS\system32\xmdfvvin.dll
C:\WINDOWS\system32\miuobejv.dll
C:\WINDOWS\system32\mijqulph.dll
C:\WINDOWS\system32\hnvejtxp.dll
C:\WINDOWS\system32\rlcdunhg.dll
C:\WINDOWS\system32\nsxbynrg.dll
C:\WINDOWS\system32\teupieky.dll
C:\WINDOWS\system32\twpquriv.dll
C:\WINDOWS\system32\wjiboehf.dll
C:\WINDOWS\system32\pcvpsyyi.dll
C:\WINDOWS\system32\aujekhgx.dll
C:\WINDOWS\system32\jkeyebej.dll
C:\WINDOWS\system32\tctfkqft.dll
C:\WINDOWS\system32\rgrsepep.dll
C:\WINDOWS\system32\tjcdpols.dll
C:\WINDOWS\system32\coaxrmqr.dll
C:\WINDOWS\system32\ccvciuxx.dll
C:\WINDOWS\system32\oejtvtgk.dll
C:\WINDOWS\system32\xidirbnt.dll
C:\WINDOWS\system32\lsyjsjgh.dll
C:\WINDOWS\system32\idkdksgt.dll
C:\WINDOWS\system32\lpmmohor.dll
C:\WINDOWS\system32\jjjifmbs.dll
C:\WINDOWS\system32\viecippk.dll
C:\WINDOWS\system32\pewtbytr.dll
C:\WINDOWS\system32\wauxahvy.dll
C:\WINDOWS\system32\vischgcd.dll
C:\WINDOWS\system32\phrkfubk.dll
C:\WINDOWS\system32\haeweycf.dll
C:\WINDOWS\system32\uwlwnuls.dll
C:\WINDOWS\system32\cfkurpoe.dll
C:\WINDOWS\system32\npoloffp.dll

charliemoss13

Post #12April 18, 2008, 3:09 PM UTC

ComboFix 08-04-11.5 - User 2008-04-18 16:02:11.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.434 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\Virus Help\ComboFix.exe
Command switches used :: C:\Documents and Settings\User\Desktop\Virus Help\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\aujekhgx.dll
C:\WINDOWS\system32\bcdiamjt.dll
C:\WINDOWS\system32\ccvciuxx.dll
C:\WINDOWS\system32\cfkurpoe.dll
C:\WINDOWS\system32\coaxrmqr.dll
C:\WINDOWS\system32\dbvagyjr.dll
C:\WINDOWS\system32\dgsfddse.dll
C:\WINDOWS\system32\haeweycf.dll
C:\WINDOWS\system32\hnvejtxp.dll
C:\WINDOWS\system32\htyqofge.dll
C:\WINDOWS\system32\idkdksgt.dll
C:\WINDOWS\system32\jjjifmbs.dll
C:\WINDOWS\system32\jkeyebej.dll
C:\WINDOWS\system32\keddamxf.dll
C:\WINDOWS\system32\lmnxbjoj.dll
C:\WINDOWS\system32\lpmmohor.dll
C:\WINDOWS\system32\lsyjsjgh.dll
C:\WINDOWS\system32\lynykqvs.dll
C:\WINDOWS\system32\mijqulph.dll
C:\WINDOWS\system32\miuobejv.dll
C:\WINDOWS\system32\nnhgywew.dll
C:\WINDOWS\system32\npoloffp.dll
C:\WINDOWS\system32\nsxbynrg.dll
C:\WINDOWS\system32\ntedlomm.dll
C:\WINDOWS\system32\oejtvtgk.dll
C:\WINDOWS\system32\omxqefiv.dll
C:\WINDOWS\system32\opkpqvga.dll
C:\WINDOWS\system32\pcvpsyyi.dll
C:\WINDOWS\system32\pewtbytr.dll
C:\WINDOWS\system32\phrkfubk.dll
C:\WINDOWS\system32\rgrsepep.dll
C:\WINDOWS\system32\rlcdunhg.dll
C:\WINDOWS\system32\sedxlowu.dll
C:\WINDOWS\system32\sivryblf.dll
C:\WINDOWS\system32\tbbpfamw.dll
C:\WINDOWS\system32\tctfkqft.dll
C:\WINDOWS\system32\teupieky.dll
C:\WINDOWS\system32\tjcdpols.dll
C:\WINDOWS\system32\twpquriv.dll
C:\WINDOWS\system32\uwlwnuls.dll
C:\WINDOWS\system32\viecippk.dll
C:\WINDOWS\system32\vischgcd.dll
C:\WINDOWS\system32\wauxahvy.dll
C:\WINDOWS\system32\wjiboehf.dll
C:\WINDOWS\system32\xidirbnt.dll
C:\WINDOWS\system32\xmdfvvin.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\aujekhgx.dll
C:\WINDOWS\system32\bcdiamjt.dll
C:\WINDOWS\system32\ccvciuxx.dll
C:\WINDOWS\system32\cfkurpoe.dll
C:\WINDOWS\system32\coaxrmqr.dll
C:\WINDOWS\system32\dbvagyjr.dll
C:\WINDOWS\system32\dgsfddse.dll
C:\WINDOWS\system32\haeweycf.dll
C:\WINDOWS\system32\hnvejtxp.dll
C:\WINDOWS\system32\htyqofge.dll
C:\WINDOWS\system32\idkdksgt.dll
C:\WINDOWS\system32\jjjifmbs.dll
C:\WINDOWS\system32\jkeyebej.dll
C:\WINDOWS\system32\keddamxf.dll
C:\WINDOWS\system32\lmnxbjoj.dll
C:\WINDOWS\system32\lpmmohor.dll
C:\WINDOWS\system32\lsyjsjgh.dll
C:\WINDOWS\system32\lynykqvs.dll
C:\WINDOWS\system32\mijqulph.dll
C:\WINDOWS\system32\miuobejv.dll
C:\WINDOWS\system32\nnhgywew.dll
C:\WINDOWS\system32\npoloffp.dll
C:\WINDOWS\system32\nsxbynrg.dll
C:\WINDOWS\system32\ntedlomm.dll
C:\WINDOWS\system32\oejtvtgk.dll
C:\WINDOWS\system32\omxqefiv.dll
C:\WINDOWS\system32\opkpqvga.dll
C:\WINDOWS\system32\pcvpsyyi.dll
C:\WINDOWS\system32\pewtbytr.dll
C:\WINDOWS\system32\phrkfubk.dll
C:\WINDOWS\system32\rgrsepep.dll
C:\WINDOWS\system32\rlcdunhg.dll
C:\WINDOWS\system32\sedxlowu.dll
C:\WINDOWS\system32\sivryblf.dll
C:\WINDOWS\system32\tbbpfamw.dll
C:\WINDOWS\system32\tctfkqft.dll
C:\WINDOWS\system32\teupieky.dll
C:\WINDOWS\system32\tjcdpols.dll
C:\WINDOWS\system32\twpquriv.dll
C:\WINDOWS\system32\uwlwnuls.dll
C:\WINDOWS\system32\viecippk.dll
C:\WINDOWS\system32\vischgcd.dll
C:\WINDOWS\system32\wauxahvy.dll
C:\WINDOWS\system32\wjiboehf.dll
C:\WINDOWS\system32\xidirbnt.dll
C:\WINDOWS\system32\xmdfvvin.dll

.
((((((((((((((((((((((((( Files Created from 2008-03-18 to 2008-04-18 )))))))))))))))))))))))))))))))
.

2008-04-18 13:54 . 2008-04-18 13:54 42,688 –a—— C:\temp\temp.exe
2008-04-18 13:50 . 2008-04-18 13:50 42,688 –a—— C:\Data Aaron.LAPTOP.exe
2008-04-18 13:50 . 2008-04-18 13:50 42,688 –a—— C:\C.exe
2008-04-16 23:15 . 2008-04-16 23:15 d——– C:\Program Files\iPod
2008-04-16 23:14 . 2008-04-16 23:15 d——– C:\Program Files\iTunes
2008-04-16 23:14 . 2008-04-16 23:14 d——– C:\Program Files\Bonjour
2008-04-16 23:07 . 2008-04-16 23:07 d——– C:\Program Files\Common Files\Apple
2008-04-16 14:44 . 2008-04-18 12:52 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-04-16 14:44 . 2008-04-16 14:44 1,409 –a—— C:\WINDOWS\QTFont.for
2008-04-14 16:31 . 2008-04-14 16:31 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-04-14 16:31 . 2008-04-14 16:31 d——– C:\Documents and Settings\User\Application Data\Malwarebytes
2008-04-14 16:31 . 2008-04-14 16:31 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-10 14:55 . 2008-04-10 14:55 d——– C:\Deckard
2008-04-08 16:54 . 2008-04-08 16:55 15,364 –ah—– C:\.DS_Store
2008-04-04 22:08 . 2008-04-04 22:08 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-03-28 23:37 . 2008-03-28 23:37 90,112 –a—— C:\WINDOWS\system32\QuickTimeVR.qtx
2008-03-28 23:37 . 2008-03-28 23:37 57,344 –a—— C:\WINDOWS\system32\QuickTime.qts
2008-03-26 06:50 . 2008-03-26 06:50 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-26 06:49 . 2008-03-26 09:22 d——– C:\Program Files\SUPERAntiSpyware
2008-03-26 06:49 . 2008-03-26 06:49 d——– C:\Documents and Settings\User\Application Data\SUPERAntiSpyware.com
2008-03-25 04:15 . 2008-03-25 04:15 d——– C:\Program Files\MSXML 4.0
2008-03-24 09:08 . 2008-03-24 09:08 d——– C:\Program Files\Yahoo!
2008-03-24 06:46 . 2008-03-24 06:46 d——– C:\Documents and Settings\All Users\Application Data\Nokia
2008-03-19 22:44 . 2008-03-19 22:45 d——– C:\Documents and Settings\All Users\Application Data\Retrospect
2008-03-19 21:50 . 2008-03-19 21:50 d——– C:\Program Files\Western Digital Technologies
2008-03-19 21:50 . 2008-03-19 22:41 364,544 –a—— C:\WINDOWS\system32\WDBtnMgr.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-18 15:05 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kontiki
2008-04-18 11:52 ——— d—–w C:\Program Files\WinTV
2008-04-18 11:52 ——— d—–w C:\Documents and Settings\User\Application Data\AVG7
2008-04-16 22:15 ——— d—–w C:\Documents and Settings\User\Application Data\Apple Computer
2008-04-16 22:14 ——— d—–w C:\Program Files\QuickTime
2008-04-16 22:14 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-04-15 01:49 ——— d—–w C:\Documents and Settings\User\Application Data\LimeWire
2008-04-14 02:04 ——— d—–w C:\Documents and Settings\User\Application Data\uTorrent
2008-03-26 05:47 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-24 05:46 ——— d—–w C:\Program Files\Nokia
2008-03-24 05:46 ——— d—–w C:\Program Files\Common Files\Nokia
2008-03-24 05:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Installations
2008-03-22 12:51 ——— d—–w C:\Program Files\VirtualDJ
2008-03-22 12:47 ——— d—–w C:\Program Files\Real
2008-03-20 09:28 ——— d—–w C:\Program Files\PKR
2008-03-20 04:24 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-03-19 09:47 1,845,248 —-a-w C:\WINDOWS\system32\win32k.sys
2008-03-17 17:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\InstallShield
2008-03-17 15:49 ——— d—–w C:\Program Files\GameSpy Arcade
2008-03-01 13:06 826,368 —-a-w C:\WINDOWS\system32\wininet.dll
2008-02-26 01:10 ——— d—–w C:\Program Files\DivX
2008-02-24 13:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2008-02-24 12:36 ——— d—–w C:\Documents and Settings\LocalService\Application Data\AVG7
2008-02-24 12:36 ——— d—–w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-23 19:34 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
2008-02-23 19:16 ——— d—–w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-02-23 18:16 6,929 —-a-w C:\WINDOWS\system32\dkstaneu.dll
2008-02-23 18:13 6,929 —-a-w C:\WINDOWS\system32\gjkyjvou.dll
2008-02-21 02:05 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2008-02-21 02:05 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2008-02-21 02:05 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2008-02-21 02:04 823,296 —-a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-02-21 02:04 823,296 —-a-w C:\WINDOWS\system32\divx_xx07.dll
2008-02-21 02:04 81,920 —-a-w C:\WINDOWS\system32\dpl100.dll
2008-02-21 02:04 802,816 —-a-w C:\WINDOWS\system32\divx_xx11.dll
2008-02-21 02:04 682,496 —-a-w C:\WINDOWS\system32\DivX.dll
2008-02-21 02:04 593,920 —-a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-02-21 02:04 57,344 —-a-w C:\WINDOWS\system32\dpv11.dll
2008-02-21 02:04 53,248 -c–a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-02-21 02:04 344,064 -c–a-w C:\WINDOWS\system32\dpus11.dll
2008-02-21 02:04 294,912 -c–a-w C:\WINDOWS\system32\dpu10.dll
2008-02-21 02:04 294,912 —-a-w C:\WINDOWS\system32\dpu11.dll
2008-02-21 02:04 196,608 -c–a-w C:\WINDOWS\system32\dtu100.dll
2008-02-21 02:03 156,992 —-a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-02-21 02:03 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-02-20 18:03 ——— d—–w C:\Program Files\3ivx
2008-02-20 06:51 282,624 —-a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 —-a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-19 02:20 3,532 —-a-w C:\drmHeader.bin
2008-01-31 17:00 6,929 —-a-w C:\WINDOWS\system32\dlculvkp.dll
2008-01-30 15:32 6,929 —-a-w C:\WINDOWS\system32\mykfrfcg.dll
2008-01-30 15:26 6,929 —-a-w C:\WINDOWS\system32\whtitsjm.dll
2008-01-30 15:23 6,929 —-a-w C:\WINDOWS\system32\clwqxapk.dll
2008-01-29 15:34 6,929 —-a-w C:\WINDOWS\system32\fuaetvkx.dll
2008-01-29 15:28 6,929 —-a-w C:\WINDOWS\system32\yvmdurcg.dll
2008-01-29 15:25 6,929 —-a-w C:\WINDOWS\system32\ocxmdpur.dll
2008-01-29 11:02 107,368 —-a-w C:\WINDOWS\system32\GEARAspi.dll
2008-01-28 15:32 6,929 —-a-w C:\WINDOWS\system32\kdtbmavx.dll
2008-01-28 15:29 6,929 —-a-w C:\WINDOWS\system32\sublmiok.dll
2008-01-28 15:26 6,929 —-a-w C:\WINDOWS\system32\pcmmsdpj.dll
2008-01-26 15:31 6,929 —-a-w C:\WINDOWS\system32\gjvwpxsy.dll
2008-01-26 15:29 6,929 —-a-w C:\WINDOWS\system32\hsfxxgxh.dll
2008-01-26 15:25 6,929 —-a-w C:\WINDOWS\system32\tjhgtrvk.dll
2008-01-24 15:29 6,929 —-a-w C:\WINDOWS\system32\pvfjhnnh.dll
2008-01-24 15:26 6,929 —-a-w C:\WINDOWS\system32\brsqjldh.dll
2008-01-24 15:23 6,929 —-a-w C:\WINDOWS\system32\jtpdqecp.dll
2008-01-23 15:26 6,929 —-a-w C:\WINDOWS\system32\vsrssueg.dll
2008-01-23 15:26 6,929 —-a-w C:\WINDOWS\system32\uqbmsrcs.dll
2008-01-23 15:20 6,929 —-a-w C:\WINDOWS\system32\acaldobh.dll
2008-01-22 15:18 6,929 —-a-w C:\WINDOWS\system32\ywnrtyby.dll
2008-01-22 15:18 6,929 —-a-w C:\WINDOWS\system32\omwgpfuk.dll
2008-01-20 02:13 6,929 —-a-w C:\WINDOWS\system32\hmtjggll.dll
2008-01-20 02:10 6,929 —-a-w C:\WINDOWS\system32\omtqbbxn.dll
2008-01-20 02:04 6,929 —-a-w C:\WINDOWS\system32\khsbpxex.dll
2008-01-19 02:08 6,929 —-a-w C:\WINDOWS\system32\vswnwrqa.dll
2008-01-19 02:02 6,929 —-a-w C:\WINDOWS\system32\sshkhvqr.dll
2008-01-19 02:01 6,929 —-a-w C:\WINDOWS\system32\lkbjyauo.dll
.

——- Sigcheck ——-

2004-08-04 13:00 541696 55aca85eb80e2155e20211aaaddd711a C:\WINDOWS\system32\winlogon.exe
2004-08-04 13:00 541696 55aca85eb80e2155e20211aaaddd711a C:\WINDOWS\system32\dllcache\winlogon.exe
2004-08-04 13:00 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\VistaMizer\old\winlogon.exe

2005-03-02 01:36 2056832 d8aba3eab509627e707a3b14f00fbb6b C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2007-02-28 10:15 2059392 4d3dbdccbf97f5ba1e74f322b155c3ba C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
2007-02-28 09:38 2057600 515d30e2c90a3665a2739309334c9283 C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
2007-02-28 09:38 2314752 dec5e0d5185864e2beeef76daa3d38c2 C:\WINDOWS\system32\ntkrnlpa.exe
2007-02-28 09:38 2314752 dec5e0d5185864e2beeef76daa3d38c2 C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2007-02-28 09:38 2057600 515d30e2c90a3665a2739309334c9283 C:\WINDOWS\VistaMizer\old\ntkrnlpa.exe

2005-03-02 02:04 2179456 28187802b7c368c0d3aef7d4c382aabb C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2007-02-28 10:55 2182144 5a5c8db4aa962c714c8371fbdf189fc9 C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
2007-02-28 10:10 2180352 582a8dbaa58c3b1f176eb2817daee77c C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
2007-02-28 10:10 2437504 9809aefbe836dfd733fd520a40d5f67c C:\WINDOWS\system32\ntoskrnl.exe
2007-02-28 10:10 2437504 9809aefbe836dfd733fd520a40d5f67c C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2007-02-28 10:10 2180352 582a8dbaa58c3b1f176eb2817daee77c C:\WINDOWS\VistaMizer\old\ntoskrnl.exe

2007-06-13 11:23 1551360 4893afc1937e67f288983e23f36a9f48 C:\WINDOWS\explorer.exe
2007-06-13 12:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2007-06-13 11:23 1551360 4893afc1937e67f288983e23f36a9f48 C:\WINDOWS\system32\dllcache\explorer.exe
2007-06-13 11:23 1033216 97bd6515465659ff8f3b7be375b2ea87 C:\WINDOWS\VistaMizer\old\explorer.exe
.
((((((((((((((((((((((((((((( snapshot_2008-04-13_ 2.09.02.76 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-16 22:14:37 86,016 —-a-r C:\WINDOWS\Installer\{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}\PrntWzrdIco.exe
+ 2008-04-16 22:15:31 102,400 —-a-r C:\WINDOWS\Installer\{585776BC-4BD6-4BD2-A19A-1D6CB44A403B}\iTunesIco.exe
+ 2007-07-24 14:17:08 81,920 —-a-w C:\WINDOWS\system32\dns-sd.exe
+ 2007-07-24 14:17:08 61,440 —-a-w C:\WINDOWS\system32\dnssd.dll
+ 2008-01-29 11:01:28 16,168 —-a-w C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
+ 2008-02-18 10:16:24 30,464 -c–a-w C:\WINDOWS\system32\DRVSTORE\usbaapl_4351B7DAFF62FD33510D77DFAE3CF8CC82517571\usbaapl.sys
+ 2008-04-18 11:52:16 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_504.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{24F06550-65E3-4D1C-8CFE-839C296B5530}]
2007-06-28 18:25 57344 –a—— C:\Program Files\real\IEeREAD.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6A19C29D-ED45-4483-8999-9F939C8161F2}]
2008-02-01 11:20 57224 –a—— C:\Program Files\real\WebHook.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 18:05 143360]
"EPSON Stylus DX4400 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.exe" [2007-03-01 07:01 180736]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 25088]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-12 16:52 68856]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 17:03 1481968]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 11:12 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 10:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 10:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 10:36 114688]
"DrvIcon"="C:\Program Files\VistaDriveIcon\DrvIcon.exe" [2007-07-04 20:59 45056]
"Zune Launcher"="c:\Program Files\Zune\ZuneLauncher.exe" [2008-01-11 18:54 166304]
"HCWemmon"="HCWemmon.exe" [2007-03-29 19:22 61440 C:\WINDOWS\HCWemmon.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-24 13:36 579072]
"WD Button Manager"="WDBtnMgr.exe" [2008-03-19 22:41 364544 C:\WINDOWS\system32\WDBtnMgr.exe]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 18:35 1294336]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-24 13:36 219136]

C:\Documents and Settings\User\Start Menu\Programs\Startup\
Glass2k.lnk - C:\Program Files\glass2k\Glass2k.exe [2007-10-17 00:04:00 56325]
TrueTransparency.lnk - C:\Program Files\TrueTransparency\TrueTransparency.exe [2007-10-14 18:22:56 134144]
VisualTaskTips.lnk - C:\Program Files\VisualTaskTips\VisualTaskTips.exe [2007-09-05 18:20:12 36352]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-10-31 18:19:34 113664]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 09:15:54 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2007-05-11 03:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
–a—— 2006-12-05 22:55 54832 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
–a—— 2007-01-19 12:54 5674352 C:\Program Files\MSN Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
——— 2006-11-23 15:10 56928 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2007-07-12 04:00 132496 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2007-10-03 04:03 185632 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\mmc.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Sports Interactive\\Football Manager 2007\\fm.exe"=
"C:\\Program Files\\WinTV\\EPG Services\\System\\EPGClient.exe"=
"C:\\Program Files\\Kontiki\\KService.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"C:\\Program Files\\Real\\eREAD_Cookcase.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R2 EPGService;EPGService;C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe [2006-11-28 18:17]
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2007-01-04 23:13]
R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-01-11 18:39]
R2 ZuneBusEnum;Zune Bus Enumerator;c:\WINDOWS\system32\ZuneBusEnum.exe [2008-01-11 18:54]
R3 USB28xxBGA;WinTV HVR-900;C:\WINDOWS\system32\DRIVERS\emBDA.sys [2007-01-29 23:20]
R3 USB28xxOEM;WinTV OEM Filter;C:\WINDOWS\system32\DRIVERS\emOEM.sys [2007-01-29 23:19]
S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 00:01]
S3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2006-12-06 00:39]
S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;c:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-01-11 18:54]
S4 Usbncht;Usbncht;C:\WINDOWS\system32\drivers\mf.sys [2004-08-04 13:00]

.
Contents of the 'Scheduled Tasks' folder
"2007-10-26 19:33:54 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_vVX1000_exe.job"
- C:\WINDOWS\vVX1000.exe
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-18 16:05:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-18 16:06:58
ComboFix-quarantined-files.txt 2008-04-18 15:06:34
ComboFix2.txt 2008-04-13 01:09:45
ComboFix3.txt 2008-04-12 01:03:39
Pre-Run: 18,550,964,224 bytes free
Post-Run: 18,539,278,336 bytes free
.
2008-04-12 09:06:33 — E O F —

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:09:12, on 18/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\VistaDriveIcon\DrvIcon.exe
C:\WINDOWS\HCWemmon.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\glass2k\Glass2k.exe
C:\Program Files\TrueTransparency\TrueTransparency.exe
C:\Program Files\VisualTaskTips\VisualTaskTips.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\User\Desktop\Virus Help\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AddTask Class - {24F06550-65E3-4D1C-8CFE-839C296B5530} - C:\Program Files\real\IEeREAD.dll
O2 - BHO: AddTask Class - {6A19C29D-ED45-4483-8999-9F939C8161F2} - C:\Program Files\real\WebHook.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\styler\TB\StylerTB.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\VistaDriveIcon\DrvIcon.exe
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [HCWemmon] HCWemmon.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\WINDOWS\TEMP\E_SC4.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Startup: Glass2k.lnk = C:\Program Files\glass2k\Glass2k.exe
O4 - Startup: TrueTransparency.lnk = C:\Program Files\TrueTransparency\TrueTransparency.exe
O4 - Startup: VisualTaskTips.lnk = C:\Program Files\VisualTaskTips\VisualTaskTips.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo…toUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: EPGService - Hauppauge Computer Works - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

–
End of file - 9879 bytes

Rorschach112

Post #13April 21, 2008, 12:05 AM UTC

Hello

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\temp\temp.exe
C:\Data Aaron.LAPTOP.exe
C:\C.exe
C:\WINDOWS\system32\dkstaneu.dll
C:\WINDOWS\system32\gjkyjvou.dll
C:\WINDOWS\system32\mykfrfcg.dll
C:\WINDOWS\system32\whtitsjm.dll
C:\WINDOWS\system32\clwqxapk.dll
C:\WINDOWS\system32\fuaetvkx.dll
C:\WINDOWS\system32\yvmdurcg.dll
C:\WINDOWS\system32\ocxmdpur.dll
C:\WINDOWS\system32\dlculvkp.dll
C:\WINDOWS\system32\kdtbmavx.dll
C:\WINDOWS\system32\sublmiok.dll
C:\WINDOWS\system32\pcmmsdpj.dll
C:\WINDOWS\system32\gjvwpxsy.dll
C:\WINDOWS\system32\hsfxxgxh.dll
C:\WINDOWS\system32\tjhgtrvk.dll
C:\WINDOWS\system32\pvfjhnnh.dll
C:\WINDOWS\system32\brsqjldh.dll
C:\WINDOWS\system32\jtpdqecp.dll
C:\WINDOWS\system32\vsrssueg.dll
C:\WINDOWS\system32\uqbmsrcs.dll
C:\WINDOWS\system32\acaldobh.dll
C:\WINDOWS\system32\ywnrtyby.dll
C:\WINDOWS\system32\omwgpfuk.dll
C:\WINDOWS\system32\hmtjggll.dll
C:\WINDOWS\system32\omtqbbxn.dll
C:\WINDOWS\system32\khsbpxex.dll
C:\WINDOWS\system32\vswnwrqa.dll
C:\WINDOWS\system32\sshkhvqr.dll
C:\WINDOWS\system32\lkbjyauo.dll

Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Go to this site:
http://www.virustotal.com/
On top you'll find 'Browse'
Click the browse button and browse to the file:

C:\WINDOWS\Installer\{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}\PrntWzrdIco.exe

Click open.
Then click the 'Send' button next to it.
This will scan the file. Please be patient.
Once scanned, copy and paste the results as well in your next reply.

And for this file

C:\WINDOWS\Installer\{585776BC-4BD6-4BD2-A19A-1D6CB44A403B}\iTunesIco.exe

charliemoss13

Post #14April 21, 2008, 12:25 PM UTC

ComboFix 08-04-11.5 - User 2008-04-21 13:07:19.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.381 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\Virus Help\ComboFix.exe
Command switches used :: C:\Documents and Settings\User\Desktop\Virus Help\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\C.exe
C:\Data Aaron.LAPTOP.exe
C:\temp\temp.exe
C:\WINDOWS\system32\acaldobh.dll
C:\WINDOWS\system32\brsqjldh.dll
C:\WINDOWS\system32\clwqxapk.dll
C:\WINDOWS\system32\dkstaneu.dll
C:\WINDOWS\system32\dlculvkp.dll
C:\WINDOWS\system32\fuaetvkx.dll
C:\WINDOWS\system32\gjkyjvou.dll
C:\WINDOWS\system32\gjvwpxsy.dll
C:\WINDOWS\system32\hmtjggll.dll
C:\WINDOWS\system32\hsfxxgxh.dll
C:\WINDOWS\system32\jtpdqecp.dll
C:\WINDOWS\system32\kdtbmavx.dll
C:\WINDOWS\system32\khsbpxex.dll
C:\WINDOWS\system32\lkbjyauo.dll
C:\WINDOWS\system32\mykfrfcg.dll
C:\WINDOWS\system32\ocxmdpur.dll
C:\WINDOWS\system32\omtqbbxn.dll
C:\WINDOWS\system32\omwgpfuk.dll
C:\WINDOWS\system32\pcmmsdpj.dll
C:\WINDOWS\system32\pvfjhnnh.dll
C:\WINDOWS\system32\sshkhvqr.dll
C:\WINDOWS\system32\sublmiok.dll
C:\WINDOWS\system32\tjhgtrvk.dll
C:\WINDOWS\system32\uqbmsrcs.dll
C:\WINDOWS\system32\vsrssueg.dll
C:\WINDOWS\system32\vswnwrqa.dll
C:\WINDOWS\system32\whtitsjm.dll
C:\WINDOWS\system32\yvmdurcg.dll
C:\WINDOWS\system32\ywnrtyby.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\acaldobh.dll
C:\WINDOWS\system32\brsqjldh.dll
C:\WINDOWS\system32\clwqxapk.dll
C:\WINDOWS\system32\dkstaneu.dll
C:\WINDOWS\system32\dlculvkp.dll
C:\WINDOWS\system32\fuaetvkx.dll
C:\WINDOWS\system32\gjkyjvou.dll
C:\WINDOWS\system32\gjvwpxsy.dll
C:\WINDOWS\system32\hmtjggll.dll
C:\WINDOWS\system32\hsfxxgxh.dll
C:\WINDOWS\system32\jtpdqecp.dll
C:\WINDOWS\system32\kdtbmavx.dll
C:\WINDOWS\system32\khsbpxex.dll
C:\WINDOWS\system32\lkbjyauo.dll
C:\WINDOWS\system32\mykfrfcg.dll
C:\WINDOWS\system32\ocxmdpur.dll
C:\WINDOWS\system32\omtqbbxn.dll
C:\WINDOWS\system32\omwgpfuk.dll
C:\WINDOWS\system32\pcmmsdpj.dll
C:\WINDOWS\system32\pvfjhnnh.dll
C:\WINDOWS\system32\sshkhvqr.dll
C:\WINDOWS\system32\sublmiok.dll
C:\WINDOWS\system32\tjhgtrvk.dll
C:\WINDOWS\system32\uqbmsrcs.dll
C:\WINDOWS\system32\vsrssueg.dll
C:\WINDOWS\system32\vswnwrqa.dll
C:\WINDOWS\system32\whtitsjm.dll
C:\WINDOWS\system32\yvmdurcg.dll
C:\WINDOWS\system32\ywnrtyby.dll

.
((((((((((((((((((((((((( Files Created from 2008-03-21 to 2008-04-21 )))))))))))))))))))))))))))))))
.

2008-04-19 02:18 . 2008-04-21 11:59 d——– C:\Program Files\Steam
2008-04-16 23:15 . 2008-04-16 23:15 d——– C:\Program Files\iPod
2008-04-16 23:14 . 2008-04-16 23:15 d——– C:\Program Files\iTunes
2008-04-16 23:14 . 2008-04-16 23:14 d——– C:\Program Files\Bonjour
2008-04-16 23:07 . 2008-04-16 23:07 d——– C:\Program Files\Common Files\Apple
2008-04-16 14:44 . 2008-04-21 11:56 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-04-16 14:44 . 2008-04-16 14:44 1,409 –a—— C:\WINDOWS\QTFont.for
2008-04-14 16:31 . 2008-04-14 16:31 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-04-14 16:31 . 2008-04-14 16:31 d——– C:\Documents and Settings\User\Application Data\Malwarebytes
2008-04-14 16:31 . 2008-04-14 16:31 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-10 14:55 . 2008-04-10 14:55 d——– C:\Deckard
2008-04-08 16:54 . 2008-04-08 16:55 15,364 –ah—– C:\.DS_Store
2008-04-04 22:08 . 2008-04-04 22:08 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-03-28 23:37 . 2008-03-28 23:37 90,112 –a—— C:\WINDOWS\system32\QuickTimeVR.qtx
2008-03-28 23:37 . 2008-03-28 23:37 57,344 –a—— C:\WINDOWS\system32\QuickTime.qts
2008-03-26 06:50 . 2008-03-26 06:50 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-26 06:49 . 2008-03-26 09:22 d——– C:\Program Files\SUPERAntiSpyware
2008-03-26 06:49 . 2008-03-26 06:49 d——– C:\Documents and Settings\User\Application Data\SUPERAntiSpyware.com
2008-03-25 04:15 . 2008-03-25 04:15 d——– C:\Program Files\MSXML 4.0
2008-03-24 09:08 . 2008-03-24 09:08 d——– C:\Program Files\Yahoo!
2008-03-24 06:46 . 2008-03-24 06:46 d——– C:\Documents and Settings\All Users\Application Data\Nokia

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-21 12:10 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kontiki
2008-04-21 10:57 ——— d—–w C:\Program Files\WinTV
2008-04-21 10:57 ——— d—–w C:\Documents and Settings\User\Application Data\AVG7
2008-04-16 22:15 ——— d—–w C:\Documents and Settings\User\Application Data\Apple Computer
2008-04-16 22:14 ——— d—–w C:\Program Files\QuickTime
2008-04-16 22:14 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-04-15 01:49 ——— d—–w C:\Documents and Settings\User\Application Data\LimeWire
2008-04-14 02:04 ——— d—–w C:\Documents and Settings\User\Application Data\uTorrent
2008-03-26 05:47 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-24 05:46 ——— d—–w C:\Program Files\Nokia
2008-03-24 05:46 ——— d—–w C:\Program Files\Common Files\Nokia
2008-03-24 05:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Installations
2008-03-22 12:51 ——— d—–w C:\Program Files\VirtualDJ
2008-03-22 12:47 ——— d—–w C:\Program Files\Real
2008-03-20 09:28 ——— d—–w C:\Program Files\PKR
2008-03-20 04:24 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-03-19 21:45 ——— d—–w C:\Documents and Settings\All Users\Application Data\Retrospect
2008-03-19 20:50 ——— d—–w C:\Program Files\Western Digital Technologies
2008-03-17 17:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\InstallShield
2008-03-17 15:49 ——— d—–w C:\Program Files\GameSpy Arcade
2008-02-26 01:10 ——— d—–w C:\Program Files\DivX
2008-02-24 13:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2008-02-24 12:36 ——— d—–w C:\Documents and Settings\LocalService\Application Data\AVG7
2008-02-24 12:36 ——— d—–w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-23 19:34 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
2008-02-23 19:16 ——— d—–w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-02-19 02:20 3,532 —-a-w C:\drmHeader.bin
.

——- Sigcheck ——-

2004-08-04 13:00 541696 55aca85eb80e2155e20211aaaddd711a C:\WINDOWS\system32\winlogon.exe
2004-08-04 13:00 541696 55aca85eb80e2155e20211aaaddd711a C:\WINDOWS\system32\dllcache\winlogon.exe
2004-08-04 13:00 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\VistaMizer\old\winlogon.exe

2005-03-02 01:36 2056832 d8aba3eab509627e707a3b14f00fbb6b C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2007-02-28 10:15 2059392 4d3dbdccbf97f5ba1e74f322b155c3ba C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
2007-02-28 09:38 2057600 515d30e2c90a3665a2739309334c9283 C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
2007-02-28 09:38 2314752 dec5e0d5185864e2beeef76daa3d38c2 C:\WINDOWS\system32\ntkrnlpa.exe
2007-02-28 09:38 2314752 dec5e0d5185864e2beeef76daa3d38c2 C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2007-02-28 09:38 2057600 515d30e2c90a3665a2739309334c9283 C:\WINDOWS\VistaMizer\old\ntkrnlpa.exe

2005-03-02 02:04 2179456 28187802b7c368c0d3aef7d4c382aabb C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2007-02-28 10:55 2182144 5a5c8db4aa962c714c8371fbdf189fc9 C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
2007-02-28 10:10 2180352 582a8dbaa58c3b1f176eb2817daee77c C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
2007-02-28 10:10 2437504 9809aefbe836dfd733fd520a40d5f67c C:\WINDOWS\system32\ntoskrnl.exe
2007-02-28 10:10 2437504 9809aefbe836dfd733fd520a40d5f67c C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2007-02-28 10:10 2180352 582a8dbaa58c3b1f176eb2817daee77c C:\WINDOWS\VistaMizer\old\ntoskrnl.exe

2007-06-13 11:23 1551360 4893afc1937e67f288983e23f36a9f48 C:\WINDOWS\explorer.exe
2007-06-13 12:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2007-06-13 11:23 1551360 4893afc1937e67f288983e23f36a9f48 C:\WINDOWS\system32\dllcache\explorer.exe
2007-06-13 11:23 1033216 97bd6515465659ff8f3b7be375b2ea87 C:\WINDOWS\VistaMizer\old\explorer.exe
.
((((((((((((((((((((((((((((( snapshot_2008-04-13_ 2.09.02.76 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-19 01:18:10 27,648 —-a-r C:\WINDOWS\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C91.exe
+ 2008-04-16 22:14:37 86,016 —-a-r C:\WINDOWS\Installer\{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}\PrntWzrdIco.exe
+ 2008-04-16 22:15:31 102,400 —-a-r C:\WINDOWS\Installer\{585776BC-4BD6-4BD2-A19A-1D6CB44A403B}\iTunesIco.exe
+ 2007-07-24 14:17:08 81,920 —-a-w C:\WINDOWS\system32\dns-sd.exe
+ 2007-07-24 14:17:08 61,440 —-a-w C:\WINDOWS\system32\dnssd.dll
+ 2008-01-29 11:01:28 16,168 —-a-w C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
+ 2008-02-18 10:16:24 30,464 -c–a-w C:\WINDOWS\system32\DRVSTORE\usbaapl_4351B7DAFF62FD33510D77DFAE3CF8CC82517571\usbaapl.sys
+ 2008-01-29 11:02:30 107,368 —-a-w C:\WINDOWS\system32\GEARAspi.dll
+ 2008-04-21 10:57:12 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_628.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{24F06550-65E3-4D1C-8CFE-839C296B5530}]
2007-06-28 18:25 57344 –a—— C:\Program Files\real\IEeREAD.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6A19C29D-ED45-4483-8999-9F939C8161F2}]
2008-02-01 11:20 57224 –a—— C:\Program Files\real\WebHook.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 18:05 143360]
"EPSON Stylus DX4400 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.exe" [2007-03-01 07:01 180736]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 25088]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-12 16:52 68856]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 17:03 1481968]
"Steam"="C:\Program Files\Steam\Steam.exe" [2008-04-19 02:18 1271032]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 11:12 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 10:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 10:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 10:36 114688]
"DrvIcon"="C:\Program Files\VistaDriveIcon\DrvIcon.exe" [2007-07-04 20:59 45056]
"Zune Launcher"="c:\Program Files\Zune\ZuneLauncher.exe" [2008-01-11 18:54 166304]
"HCWemmon"="HCWemmon.exe" [2007-03-29 19:22 61440 C:\WINDOWS\HCWemmon.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-24 13:36 579072]
"WD Button Manager"="WDBtnMgr.exe" [2008-03-19 22:41 364544 C:\WINDOWS\system32\WDBtnMgr.exe]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 18:35 1294336]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-24 13:36 219136]

C:\Documents and Settings\User\Start Menu\Programs\Startup\
Glass2k.lnk - C:\Program Files\glass2k\Glass2k.exe [2007-10-17 00:04:00 56325]
TrueTransparency.lnk - C:\Program Files\TrueTransparency\TrueTransparency.exe [2007-10-14 18:22:56 134144]
VisualTaskTips.lnk - C:\Program Files\VisualTaskTips\VisualTaskTips.exe [2007-09-05 18:20:12 36352]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-10-31 18:19:34 113664]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 09:15:54 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2007-05-11 03:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
–a—— 2006-12-05 22:55 54832 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
–a—— 2007-01-19 12:54 5674352 C:\Program Files\MSN Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
——— 2006-11-23 15:10 56928 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2007-07-12 04:00 132496 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2007-10-03 04:03 185632 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\mmc.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Sports Interactive\\Football Manager 2007\\fm.exe"=
"C:\\Program Files\\WinTV\\EPG Services\\System\\EPGClient.exe"=
"C:\\Program Files\\Kontiki\\KService.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"C:\\Program Files\\Real\\eREAD_Cookcase.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R2 EPGService;EPGService;C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe [2006-11-28 18:17]
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2007-01-04 23:13]
R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-01-11 18:39]
R2 ZuneBusEnum;Zune Bus Enumerator;c:\WINDOWS\system32\ZuneBusEnum.exe [2008-01-11 18:54]
R3 USB28xxBGA;WinTV HVR-900;C:\WINDOWS\system32\DRIVERS\emBDA.sys [2007-01-29 23:20]
R3 USB28xxOEM;WinTV OEM Filter;C:\WINDOWS\system32\DRIVERS\emOEM.sys [2007-01-29 23:19]
S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 00:01]
S3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2006-12-06 00:39]
S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;c:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-01-11 18:54]
S4 Usbncht;Usbncht;C:\WINDOWS\system32\drivers\mf.sys [2004-08-04 13:00]

.
Contents of the 'Scheduled Tasks' folder
"2007-10-26 19:33:54 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_vVX1000_exe.job"
- C:\WINDOWS\vVX1000.exe
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-21 13:10:54
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-21 13:11:59
ComboFix-quarantined-files.txt 2008-04-21 12:11:35
ComboFix2.txt 2008-04-18 15:06:59
ComboFix3.txt 2008-04-13 01:09:45
ComboFix4.txt 2008-04-12 01:03:39
Pre-Run: 18,497,847,296 bytes free
Post-Run: 18,486,284,288 bytes free
.
2008-04-12 09:06:33 — E O F —

File PrntWzrdIco.exe received on 04.21.2008 14:14:00 (CET)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED
Result: 0/32 (0%)
Loading server information…
Your file is queued in position: 1.
Estimated start time is between 38 and 55 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
AhnLab-V3 2008.4.19.0 2008.04.21 -
AntiVir 7.8.0.8 2008.04.21 -
Authentium 4.93.8 2008.04.20 -
Avast 4.8.1169.0 2008.04.21 -
AVG 7.5.0.516 2008.04.20 -
BitDefender 7.2 2008.04.21 -
CAT-QuickHeal 9.50 2008.04.19 -
ClamAV 0.92.1 2008.04.21 -
DrWeb 4.44.0.09170 2008.04.21 -
eSafe 7.0.15.0 2008.04.17 -
eTrust-Vet 31.3.5720 2008.04.21 -
Ewido 4.0 2008.04.21 -
F-Prot 4.4.2.54 2008.04.20 -
F-Secure 6.70.13260.0 2008.04.21 -
FileAdvisor 1 2008.04.21 -
Fortinet 3.14.0.0 2008.04.21 -
Ikarus T3.1.1.26 2008.04.21 -
Kaspersky 7.0.0.125 2008.04.21 -
McAfee 5277 2008.04.18 -
Microsoft 1.3408 2008.04.21 -
NOD32v2 3042 2008.04.21 -
Norman 5.80.02 2008.04.18 -
Panda 9.0.0.4 2008.04.20 -
Prevx1 V2 2008.04.21 -
Rising 20.41.02.00 2008.04.21 -
Sophos 4.28.0 2008.04.21 -
Sunbelt 3.0.1056.0 2008.04.17 -
Symantec 10 2008.04.21 -
TheHacker 6.2.92.285 2008.04.19 -
VBA32 3.12.6.4 2008.04.16 -
VirusBuster 4.3.26:9 2008.04.20 -
Webwasher-Gateway 6.6.2 2008.04.21 -
Additional information
File size: 86016 bytes
MD5…: 2e1a0c4812bea8c43e0715ece239a3ab
SHA1..: 8178e3cee0b8a3d15ad843909bd0a6378f6556b0
SHA256: 8dc1bcd9f3fa853aaa437f2ce9666d8dd6085245a9035231d3150f7fb1ed9103
SHA512: 9203d7fb29e5c84698b4dd6a9bdd0d9972bbdcceb9abb5c2e4f627c0f7c64e68
eef266eb76a4d4865a98341e43da7979084e3d70d0311522a78f4c84f815fc31
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10000000
timedatestamp…..: 0x4513fc18 (Fri Sep 22 15:07:04 2006)
machinetype…….: 0x14c (I386)

( 2 sections )
name viradd virsiz rawdsiz ntrpy md5
.rsrc 0x1000 0x12f50 0x13000 5.71 6f259d1cd1129d05ce56b8b19ece9131
.reloc 0x14000 0x8 0x1000 0.00 3808644f11ba1ee3cb2b6326fcd2e01a

( 0 imports )

( 0 exports )

File iTunesIco.exe received on 04.10.2008 18:02:38 (CET)
Current status: finished
Result: 0/32 (0.00%)
Compact Compact
Print results Print results
Antivirus Version Last Update Result
AhnLab-V3 2008.4.10.2 2008.04.10 -
AntiVir 7.6.0.81 2008.04.10 -
Authentium 4.93.8 2008.04.10 -
Avast 4.8.1169.0 2008.04.10 -
AVG 7.5.0.516 2008.04.10 -
BitDefender 7.2 2008.04.10 -
CAT-QuickHeal 9.50 2008.04.10 -
ClamAV 0.92.1 2008.04.10 -
DrWeb 4.44.0.09170 2008.04.10 -
eSafe 7.0.15.0 2008.04.09 -
eTrust-Vet 31.3.5687 2008.04.10 -
Ewido 4.0 2008.04.10 -
F-Prot 4.4.2.54 2008.04.08 -
F-Secure 6.70.13260.0 2008.04.10 -
FileAdvisor 1 2008.04.10 -
Fortinet 3.14.0.0 2008.04.10 -
Ikarus T3.1.1.26 2008.04.10 -
Kaspersky 7.0.0.125 2008.04.10 -
McAfee 5270 2008.04.09 -
Microsoft 1.3408 2008.04.10 -
NOD32v2 3016 2008.04.10 -
Norman 5.80.02 2008.04.10 -
Panda 9.0.0.4 2008.04.10 -
Prevx1 V2 2008.04.10 -
Rising 20.39.32.00 2008.04.10 -
Sophos 4.28.0 2008.04.10 -
Sunbelt 3.0.1032.0 2008.04.08 -
Symantec 10 2008.04.10 -
TheHacker 6.2.92.271 2008.04.10 -
VBA32 3.12.6.4 2008.04.06 -
VirusBuster 4.3.26:9 2008.04.10 -
Webwasher-Gateway 6.6.2 2008.04.10 -
Additional information
File size: 102400 bytes
MD5…: 5f86baa76c0e1456dd8b17b6ee72482c
SHA1..: 156ed2e777ac6c9126a970739f768152c1f85c95
SHA256: 0ea106d12119975f7cc8c20732b6cad5e050c9b36469858f04f075b45615aac4
SHA512: a981059562c34716ccee88d85a99224c64f94313ff2a40ab994b40a5d90dcd6a
97d7f789e0f8d7a4354dde6cfb9e6e2633c06d18b9f0c94da6e6e5dc7520c6a2
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10000000
timedatestamp…..: 0x47efcfbb (Sun Mar 30 17:36:59 2008)
machinetype…….: 0x14c (I386)

( 2 sections )
name viradd virsiz rawdsiz ntrpy md5
.rsrc 0x1000 0x161c0 0x17000 5.55 5c2d75219c687fd80aaea0df4da206fb
.reloc 0x18000 0x8 0x1000 0.00 3808644f11ba1ee3cb2b6326fcd2e01a

( 0 imports )

( 0 exports )

Rorschach112

Post #15April 21, 2008, 12:51 PM UTC

Hello

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Full Scan", then click Scan. Check all the boxes and click Start Scan
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] i have a brontok.c i-worm

✨ Ask AI

Ask AI