What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] hijack log

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
please help i have a virus on my other computor and its driving me mad it has somehow taken away my internet conection every time i double click on the IE icon i get a new IE shortcut on the desktop
here is my hijack log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17: VIRUS ALERT!, on 24/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

F3 - REG:win.ini: run="C:\Documents and Settings\ian day\Application Data\Adobe\Manager.exe"
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O2 - BHO: {027e5eda-e79e-22c9-80f4-00e57ab99850} - {05899ba7-5e00-4f08-9c22-e97eade5e720} - C:\WINDOWS\system32\zvnspg.dll
O2 - BHO: (no name) - {0C5C4DB4-6C62-49ED-8343-62B9AE7ADF6A} - C:\WINDOWS\system32\ljJAPiFw.dll (file missing)
O2 - BHO: D - {16CF0EA1-C339-3198-B9E3-A16CCE96E765} - C:\WINDOWS\kx17001.dll
O2 - BHO: (no name) - {218E3BCA-9091-4F58-9E58-C00BA6B1DF20} - C:\WINDOWS\system32\urqnnkIa.dll (file missing)
O2 - BHO: (no name) - {88023493-3F3F-4E70-A26D-351587372523} - C:\WINDOWS\system32\jkkhICVN.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: QXK Olive - {D19EA55C-4DA1-4B96-B316-51A8239A6AFD} - C:\WINDOWS\twmxbsqrbtv.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: rafbsvnx - {B36B25DB-E0B4-4058-BEBF-DB0C12B38C89} - C:\WINDOWS\rafbsvnx.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [a04ef211] rundll32.exe "C:\WINDOWS\system32\poginpfi.dll",b
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\AdwareAlert.exe -boot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [WinCalendarTime.exe] C:\Program Files\WinCalendarTime\WinCalendarTime.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1213770062796
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Br…018/flashax.cab
O20 - AppInit_DLLs: lprgke.dll zvnspg.dll
O20 - Winlogon Notify: ljJAPiFw - ljJAPiFw.dll (file missing)
O21 - SSODL: tsxngabr - {4A6AC8C1-F13B-432B-9FD0-6E57A13E358A} - C:\WINDOWS\tsxngabr.dll
O21 - SSODL: vtqnxfko - {AAE2B025-4FD1-41E5-B520-BD0A05774282} - C:\WINDOWS\vtqnxfko.dll (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

–
End of file - 8275 bytes
Post #2
Hi snapper64

Welcome to the What the tech Forums
My name is mschroe919 and I am going to read your log.
I would like to help you So if you would….
Please be patient and I will be back as soon as possible.

Please while I am gone do these steps:

Show hidden files, Here is how:

Windows XP

* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

NEXT:

Please download ATF Cleaner by Atribune.

Download it

HERE:

This program is for XP and Windows 2000 only
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

NEXT:

Malwarebytes' Anti-Malware

HERE

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
post a new scanner[HJT] log and the Malwarebytes' Anti-Malware log

Be sure not to delete anything intill said ok to. also don't run any other cleanup programs till we
get done it may goof ours up.
Also if you have any questions feel fre to ask first.

When you post another rhjt log and the Malwarebytes' Anti-Malware log , let me know how your PC is behavuing

I will be waiting to see new logs
mschroe919
Post #3
first off sorry to be so long getting back i have been to a wedding all day
second sorry again for the lack of the anti-malware log after it finished i did what you said by saving it to the desktop but on reboot it was no where to be found on the pc also the log files within the programe are not there?
but here is the hjt log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:21: VIRUS ALERT!, on 24/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

F3 - REG:win.ini: run="C:\Documents and Settings\ian day\Application Data\Adobe\Manager.exe"
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O2 - BHO: (no name) - {218E3BCA-9091-4F58-9E58-C00BA6B1DF20} - C:\WINDOWS\system32\urqnnkIa.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {88023493-3F3F-4E70-A26D-351587372523} - C:\WINDOWS\system32\jkkhICVN.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: rafbsvnx - {B36B25DB-E0B4-4058-BEBF-DB0C12B38C89} - C:\WINDOWS\rafbsvnx.dll (file missing)
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [WinCalendarTime.exe] C:\Program Files\WinCalendarTime\WinCalendarTime.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB2466] command /c del "C:\Documents and Settings\Administrator\Application Data\AdwareAlert\Log\2008 Aug 23 - 10_14_35 AM_671.log"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4603] cmd /c del "C:\Documents and Settings\Administrator\Application Data\AdwareAlert\Log\2008 Aug 23 - 10_14_35 AM_671.log"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6515] command /c del "C:\Documents and Settings\ian day\Application Data\AdwareAlert\Log\2008 Aug 23 - 01_48_19 PM_406.log"
O4 - HKCU\..\RunOnce: [SpybotDeletingD890] cmd /c del "C:\Documents and Settings\ian day\Application Data\AdwareAlert\Log\2008 Aug 23 - 01_48_19 PM_406.log"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3329] command /c del "C:\Documents and Settings\ian day\Application Data\AdwareAlert\Log\2008 Aug 23 - 10_35_09 AM_765.log"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2850] cmd /c del "C:\Documents and Settings\ian day\Application Data\AdwareAlert\Log\2008 Aug 23 - 10_35_09 AM_765.log"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1907] command /c del "C:\Documents and Settings\ian day\Application Data\PrivacyControl\Log\2008 Aug 24 - 09_58_41 AM_468.log"
O4 - HKCU\..\RunOnce: [SpybotDeletingD611] cmd /c del "C:\Documents and Settings\ian day\Application Data\PrivacyControl\Log\2008 Aug 24 - 09_58_41 AM_468.log"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6601] command /c del "C:\WINDOWS\rafbsvnx.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3456] cmd /c del "C:\WINDOWS\rafbsvnx.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8556] command /c del "C:\WINDOWS\tsxngabr.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6620] cmd /c del "C:\WINDOWS\tsxngabr.dll_old"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1213770062796
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Br…018/flashax.cab
O20 - AppInit_DLLs: lprgke.dll zvnspg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

–
End of file - 9528 bytes
Post #5
also get two boxes one after i close the other one then when i close the second one the first one comes back on again the first box says windows cannot find "c:\documents'. make sure you typed the name correctly, and then try again. to search for a file click the start button, and then click search even tho i have not looked for anything this is from the start up then i click ok and the second box comes up saying could not load or run "c:\documents' specified in the registry. make sure the file exists on your computor or remove the reference to it from the registry then i click ok and the first box reapears
Post #6
Hi

I am late getting back big birthday party.
We will get it done not to worry.

FIRST:
let reboot to safe mode:

Here is how:
* Click Start.
* Select Shutdown.
* Select Restart and click OK.
* During restart, hold down the F8 key on your keyboard until the Windows Startup menu appears.
* If your PC starts beeping then release the key for a few seconds before holding it down again.
* Select Safe Mode WITH NETWORK from the Startup menu, and press the Enter button on your keyboard.
* Windows should start in Safe Mode. If Windows doesn't restart in Safe Mode then please try again.

NEXT:

Once in safe mode:
Click on Start
Then click on all programs
Then click on Malwarebytes' Anti-Malware
Then click on Logs
Then click on log-date.txt

NEXT:

If not able to get it there Open the Anti-Malware program again while in safe mode and
follow this :

Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
Let me know if you were able to open thje internet in safe mode, that is if you chose safe mode with network.
If none of this works we have a few more things to do
good luck mschroe919
Post #7
ok i just realised there is a five hour time difference from the uk to where you are so here is the log you asked for Malwarebytes' Anti-Malware 1.25 Database version: 1083 Windows 5.1.2600 Service Pack 2 10:54:04 25/08/2008 mbam-log-08-25-2008 (10-54-04).txt Scan type: Full Scan (C:\|D:\|) Objects scanned: 131591 Time elapsed: 26 minute(s), 7 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #8
ok i can get onto the internet in safe mode but its very slow i canot get on in normal mode and pc seams very slow i have a intel ® pentium® D cpu 3.00GHz dual processor and 2 gig of ram on a conroe 1333-D667 asrock motherboard to be honest it not much faster when it works from new it dont seam to have the duel processing power i thought it would have as it still seamed to slow down while doing differnt things and i still have a few things to do with the registry that pop up at the begining and when i click start alot of the comands are missing like run search help and support control pannel infact quit a few othes
Post #9 last edited
Good Morning snapper64

First of all :
While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.

* Open Spybot Search & Destroy.
* In the Mode menu click "Advanced mode" if not already selected.
* Choose "Yes" at the Warning prompt.
* Expand the "Tools" menu.
* Click "Resident".
* Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
* In the File menu click "Exit" to exit Spybot Search & Destroy.

NEXT:
it apears as though you are running 2 Anti virus programs.
(1)ESET\ESET Smart Security
(2)AVG
please this is not good they tend to confuse the issue. disable one or the other

NEXT:
Not to worry about the speed yet I want to clean up the pc first.

You may have to do this in safe mode also:
Download ComboFix to your Desktop.
Get it

HERE:

OR

HERE:

**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–
Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.

WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
Please do not re-connect your machine back to the Internet until Combofix has completely finished.

——————————————————————–

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Give it atleast 20-30 minutes to finish

Note Important

This program was designed for the problem on your pc and shouldn't be used on other PC's

Good luck mschroe919
Post #10
ok here are the logs

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:07, on 25/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1213770062796
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Br…018/flashax.cab
O20 - AppInit_DLLs: lprgke.dll zvnspg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

–
End of file - 6159 bytes

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:07, on 25/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1213770062796
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Br…018/flashax.cab
O20 - AppInit_DLLs: lprgke.dll zvnspg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

–
End of file - 6159 bytes


ComboFix 08-08-24.02 - ian day 2008-08-25 17:13:58.3 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1797 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
—- Previous Run ——-
.
C:\Documents and Settings\ian day\Application Data\Adobe\crc.dat
C:\WINDOWS\system32\aIknnqru.ini
C:\WINDOWS\system32\aIknnqru.ini2
C:\WINDOWS\system32\gmufnavp.ini
C:\WINDOWS\system32\NVCIhkkj.ini
C:\WINDOWS\system32\NVCIhkkj.ini2

.
((((((((((((((((((((((((( Files Created from 2008-07-25 to 2008-08-25 )))))))))))))))))))))))))))))))
.

2008-08-25 10:57 . 2008-08-25 10:57 d——– C:\Documents and Settings\Administrator\Application Data\PrivacyControl
2008-08-25 09:41 . 2008-08-25 09:41 d——– C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-08-24 22:38 . 2008-08-24 22:38 d——– C:\Documents and Settings\ian.IAN-0D7B835D1E0\Application Data\PrivacyControl
2008-08-24 22:32 . 2008-08-24 22:32 d——– C:\Documents and Settings\ian.IAN-0D7B835D1E0\Application Data\Malwarebytes
2008-08-24 22:23 . 2008-08-24 22:23 d——– C:\Documents and Settings\ian day\Application Data\Malwarebytes
2008-08-24 21:21 . 2008-08-24 21:21 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-08-24 21:21 . 2008-08-24 21:21 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-08-24 21:21 . 2008-08-17 15:01 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-24 21:21 . 2008-08-17 15:01 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-08-24 11:50 . 2008-08-24 11:51 630 –a—— C:\WINDOWS\wininit.ini
2008-08-24 11:23 . 2008-08-24 11:26 d——– C:\Program Files\Spybot - Search & Destroy
2008-08-24 11:23 . 2008-08-25 00:29 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-08-24 09:49 . 2008-08-24 09:49 d—s—- C:\Documents and Settings\ian.IAN-0D7B835D1E0\UserData
2008-08-23 21:44 . 2008-08-23 21:44 d——– C:\Documents and Settings\ian.IAN-0D7B835D1E0\Application Data\ESET
2008-08-23 21:40 . 2008-08-24 09:49 d——– C:\Documents and Settings\ian.IAN-0D7B835D1E0
2008-08-23 21:26 . 2008-08-23 21:26 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\HPSSUPPLY
2008-08-23 20:19 . 2006-02-28 13:00 13,463,552 –a–c— C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-08-23 20:18 . 2006-02-28 13:00 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2008-08-23 20:06 . 2008-08-23 20:06 749 -rah—– C:\WINDOWS\WindowsShell.Manifest
2008-08-23 20:06 . 2008-08-23 20:06 749 -rah—– C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-08-23 20:06 . 2008-08-23 20:06 749 -rah—– C:\WINDOWS\system32\sapi.cpl.manifest
2008-08-23 20:06 . 2008-08-23 20:06 749 -rah—– C:\WINDOWS\system32\ncpa.cpl.manifest
2008-08-23 20:06 . 2008-08-23 20:06 488 -rah—– C:\WINDOWS\system32\logonui.exe.manifest
2008-08-23 15:44 . 2006-02-28 13:00 24,661 –a—— C:\WINDOWS\system32\spxcoins.dll
2008-08-23 15:44 . 2006-02-28 13:00 24,661 –a–c— C:\WINDOWS\system32\dllcache\spxcoins.dll
2008-08-23 15:44 . 2006-02-28 13:00 13,312 –a—— C:\WINDOWS\system32\irclass.dll
2008-08-23 15:44 . 2006-02-28 13:00 13,312 –a–c— C:\WINDOWS\system32\dllcache\irclass.dll
2008-08-23 10:34 . 2008-08-23 10:34 d——– C:\Documents and Settings\ian day\Application Data\ESET
2008-08-23 10:33 . 2008-08-23 10:33 d——– C:\Program Files\ESET
2008-08-23 10:33 . 2008-08-23 10:33 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\ESET
2008-08-23 10:11 . 2008-08-23 10:11 d——– C:\Documents and Settings\Administrator
2008-08-23 10:05 . 2008-08-21 23:41 87,552 –a—— C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-08-23 10:05 . 2008-08-14 21:52 82,432 –a—— C:\WINDOWS\system32\IEDFix.C.exe
2008-08-23 09:59 . 2007-09-06 00:22 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2008-08-23 09:59 . 2006-04-27 17:49 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2008-08-23 09:59 . 2008-05-29 09:35 86,528 –a—— C:\WINDOWS\system32\VACFix.exe
2008-08-23 09:59 . 2008-07-26 07:48 82,944 –a—— C:\WINDOWS\system32\IEDFix.exe
2008-08-23 09:59 . 2008-05-23 18:21 81,920 –a—— C:\WINDOWS\system32\404Fix.exe
2008-08-23 09:59 . 2003-06-05 21:13 53,248 –a—— C:\WINDOWS\system32\Process.exe
2008-08-23 09:59 . 2004-07-31 18:50 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2008-08-23 09:59 . 2007-10-04 00:36 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2008-08-23 00:05 . 2008-08-23 00:05 126,976 –a—— C:\WINDOWS\kx84316.dll
2008-08-22 20:51 . 2008-08-22 20:52 156 –a—— C:\WINDOWS\Twunk001.MTX
2008-08-22 20:51 . 2008-08-22 20:52 3 –a—— C:\WINDOWS\Twain001.Mtx
2008-08-22 20:51 . 2008-08-22 20:51 0 –a—— C:\WINDOWS\Twunk002.MTX
2008-08-05 22:52 . 2008-08-05 22:52 d——– C:\Program Files\iTunes
2008-08-05 22:52 . 2008-08-05 22:52 d——– C:\Program Files\iPod
2008-08-05 22:49 . 2008-08-05 22:49 d——– C:\Program Files\Safari
2008-08-05 22:48 . 2008-08-05 22:48 d——– C:\Program Files\Apple Software Update
2008-08-05 19:32 . 2008-08-05 19:32 d——– C:\Documents and Settings\ian day\Application Data\CyberLink
2008-08-05 19:31 . 2008-08-05 19:31 d——– C:\Program Files\Common Files\CyberLink
2008-08-05 19:31 . 2008-08-05 19:32 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\CyberLink
2008-08-05 19:30 . 2008-08-05 19:31 d——– C:\Program Files\CyberLink
2008-08-05 19:29 . 2008-08-05 19:29 29,480 –a—— C:\WINDOWS\system32\msxml3a.dll
2008-07-31 19:50 . 2008-07-31 19:50 d——– C:\Program Files\PowerISO
2008-07-31 13:41 . 2004-08-18 02:34 442,368 –a—— C:\WINDOWS\system32\vp6vfw.dll
2008-07-30 17:06 . 2008-07-30 17:06 715,248 –a—— C:\WINDOWS\system32\drivers\sptd.sys
2008-07-29 21:32 . 2008-07-29 21:32 d–hs—- C:\found.000
2008-07-28 18:28 . 2008-07-28 18:28 1,905 –a—— C:\WINDOWS\diagwrn.xml
2008-07-28 18:28 . 2008-07-28 18:28 1,905 –a—— C:\WINDOWS\diagerr.xml
2008-07-28 18:03 . 2008-07-28 18:03 d——– C:\Program Files\Pinnacle
2008-07-28 18:03 . 2008-07-28 18:03 921 –a—— C:\WINDOWS\Recorder.reg
2008-07-28 17:00 . 2008-07-28 17:00 d——– C:\Documents and Settings\ian day\Application Data\Ahead
2008-07-26 14:56 . 2008-07-26 14:56 664 –a—— C:\WINDOWS\system32\d3d9caps.dat
2008-07-26 07:46 . 2008-08-23 10:05 2,766 –a—— C:\WINDOWS\system32\tmp.reg

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-25 11:28 ——— d—–w C:\Program Files\mIRC
2008-08-25 00:11 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\avg8
2008-08-24 20:39 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Google Updater
2008-08-24 10:51 ——— d—–w C:\Program Files\PrivacyControl
2008-08-23 12:56 ——— d—–w C:\Program Files\Bonjour
2008-08-22 23:06 ——— d—–w C:\Documents and Settings\ian day\Application Data\Vso
2008-08-22 23:05 ——— d—–w C:\Documents and Settings\ian day\Application Data\uTorrent
2008-08-22 22:58 ——— d—–w C:\Program Files\xdcc klipper
2008-08-06 11:53 ——— d—–w C:\Documents and Settings\ian day\Application Data\Apple Computer
2008-08-05 18:31 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-07-27 10:30 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Messenger Plus!
2008-07-27 10:28 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
2008-07-26 07:14 97,928 —-a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-23 13:02 ——— d—–w C:\Program Files\Messenger Plus! Live
2008-07-22 21:12 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Logishrd
2008-07-22 21:08 ——— d—–w C:\Program Files\Common Files\logishrd
2008-07-22 21:07 ——— d—–w C:\Program Files\Logitech
2008-07-22 21:07 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Logitech
2008-07-20 10:43 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\MGS
2008-07-20 10:37 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Microgaming
2008-07-15 22:27 ——— d—–w C:\Program Files\QuickTime
2008-07-14 19:38 ——— d—–w C:\Program Files\Windows Live Toolbar
2008-07-14 19:38 ——— d—–w C:\Program Files\Windows Live Favorites
2008-07-14 19:32 ——— dcsh–w C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-14 19:32 ——— d—–w C:\Program Files\Windows Live
2008-07-13 12:07 ——— d—–w C:\Program Files\Dell
2008-07-12 14:27 ——— d—–w C:\Program Files\QuickSFV
2008-07-11 19:36 ——— d—–w C:\Program Files\Smart PC Solutions
2008-07-11 19:16 ——— d—–w C:\Program Files\ParetoLogic
2008-07-11 19:16 ——— d—–w C:\Program Files\Common Files\ParetoLogic
2008-07-11 19:16 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\ParetoLogic
2008-07-11 19:16 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Downloaded Installations
2008-07-11 18:59 ——— d—–w C:\Program Files\Convar
2008-07-10 18:06 ——— d—–w C:\Program Files\Google
2008-07-10 18:00 ——— d—–w C:\Program Files\Trend Micro
2008-07-10 08:51 ——— d—–w C:\Documents and Settings\ian day\Application Data\PrivacyControl
2008-07-09 21:04 ——— d—–w C:\Documents and Settings\ian day\Application Data\HPAppData
2008-07-09 20:09 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Trend Micro
2008-07-09 12:24 ——— d—–w C:\Program Files\Java
2008-07-09 12:23 ——— d—–w C:\Program Files\Common Files\Java
2008-07-09 09:31 ——— d—–w C:\Program Files\Advanced System Optimizer
2008-07-08 08:48 10,520 —-a-w C:\WINDOWS\system32\avgrsstx.dll
2008-07-07 18:49 22,512 —-a-w C:\WINDOWS\system32\drivers\adwarealert.sys
2008-07-07 07:40 56,108 —-a-w C:\WINDOWS\system32\drivers\scdemu.sys
2008-07-05 22:13 ——— d—–w C:\Documents and Settings\ian day\Application Data\Nokia Multimedia Player
2008-07-05 22:13 ——— d—–w C:\Documents and Settings\ian day\Application Data\Nokia
2008-07-05 19:14 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-07-05 19:13 ——— d—–w C:\Program Files\Common Files\Apple
2008-07-05 19:13 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple
2008-07-05 16:15 ——— d—–w C:\Documents and Settings\ian day\Application Data\Datalayer
2008-07-05 16:15 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Suite
2008-07-05 16:14 ——— d—–w C:\Program Files\Nokia
2008-07-05 16:14 ——— d—–w C:\Program Files\DIFX
2008-07-05 16:13 ——— d—–w C:\Program Files\Common Files\PCSuite
2008-07-05 16:13 ——— d—–w C:\Program Files\Common Files\Nokia
2008-07-05 16:13 ——— d—–w C:\Documents and Settings\ian day\Application Data\PC Suite
2008-07-05 06:24 517 —-a-w C:\Program Files\Shortcut to roboform.dll.lnk
2008-07-04 13:54 ——— d—–w C:\Documents and Settings\ian day\Application Data\NeroDCTemplates
2008-07-04 13:47 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\LightScribe
2008-07-04 13:46 ——— d—–w C:\Program Files\Common Files\LightScribe
2008-07-04 13:44 ——— d—–w C:\Program Files\LightScribe
2008-07-04 13:32 ——— d—–w C:\Program Files\coverXP
2008-07-01 21:42 ——— d—–w C:\Program Files\AOER
2008-05-23 10:05 47,360 —-a-w C:\Documents and Settings\ian day\Application Data\pcouffin.sys
.

((((((((((((((((((((((((((((( snapshot@2008-07-10_16.17.54.51 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-08-16 12:08:32 100,352 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\6to4svc.dll
+ 2008-06-20 10:44:08 138,368 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\afd.sys
+ 2008-06-20 17:36:11 147,968 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\dnsapi.dll
+ 2008-06-20 17:36:11 245,248 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\mswsock.dll
+ 2008-06-20 10:44:42 360,960 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
+ 2008-06-20 09:32:39 225,920 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip6.sys
+ 2008-06-20 11:40:08 138,496 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\afd.sys
+ 2008-06-20 17:46:57 147,968 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\dnsapi.dll
+ 2008-06-20 17:46:57 245,248 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\mswsock.dll
+ 2008-06-20 11:51:12 361,600 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
+ 2008-06-20 11:08:27 225,856 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip6.sys
+ 2008-06-20 11:48:03 138,496 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\afd.sys
+ 2008-06-20 17:43:05 147,968 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\dnsapi.dll
+ 2008-06-20 17:43:05 245,248 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\mswsock.dll
+ 2008-06-20 11:59:02 361,600 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
+ 2008-06-20 11:16:44 225,856 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip6.sys
+ 2007-11-30 12:39:22 17,272 —-a-w C:\WINDOWS\$hf_mig$\KB951748\spmsg.dll
+ 2007-11-30 12:39:22 231,288 —-a-w C:\WINDOWS\$hf_mig$\KB951748\spuninst.exe
+ 2007-11-30 12:39:22 26,488 —-a-w C:\WINDOWS\$hf_mig$\KB951748\update\spcustom.dll
+ 2007-11-30 12:39:18 755,576 —-a-w C:\WINDOWS\$hf_mig$\KB951748\update\update.exe
+ 2007-11-30 12:39:19 382,840 —-a-w C:\WINDOWS\$hf_mig$\KB951748\update\updspapi.dll
+ 2006-10-23 09:37:28 241,664 —-a-w C:\WINDOWS\Downloaded Program Files\cpcScan.dll
+ 2008-05-29 15:52:30 3,200,272 —-a-w C:\WINDOWS\Downloaded Program Files\EPUWALcontrol.dll
- 2007-06-13 10:23:07 1,033,216 —-a-w C:\WINDOWS\explorer.exe
+ 2006-02-28 12:00:00 1,032,192 —-a-w C:\WINDOWS\explorer.exe
- 2005-05-26 23:22:01 10,752 —-a-w C:\WINDOWS\hh.exe
+ 2006-02-28 12:00:00 10,752 —-a-w C:\WINDOWS\hh.exe
- 2007-06-26 21:10:26 317,440 —-a-w C:\WINDOWS\inf\unregmp2.exe
+ 2006-02-28 12:00:00 208,896 —-a-w C:\WINDOWS\inf\unregmp2.exe
+ 2008-07-11 19:16:45 69,632 —-a-r C:\WINDOWS\Installer\{15D8D315-BB4C-4867-BCD7-2B829EF0F38B}\ARPPRODUCTICON.exe
+ 2008-07-11 19:16:45 69,632 —-a-r C:\WINDOWS\Installer\{15D8D315-BB4C-4867-BCD7-2B829EF0F38B}\PLDataRecovery.exe_BF1A00C1E04A4C71A37216A64350DAC2.exe
+ 2008-07-11 19:16:45 69,632 —-a-r C:\WINDOWS\Installer\{15D8D315-BB4C-4867-BCD7-2B829EF0F38B}\PLDataRecovery.exe_F46044F4EE394C4D9225332856A1645B.exe
+ 2008-08-05 18:31:06 77,211 —-a-r C:\WINDOWS\Installer\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}\ARPPRODUCTICON.exe
+ 2008-08-05 21:53:04 102,400 —-a-r C:\WINDOWS\Installer\{3DE0053C-FD9A-483E-B7C9-B06E4392206E}\iTunesIco.exe
+ 2008-07-14 19:32:22 29,926 —-a-r C:\WINDOWS\Installer\{508CE775-4BA4-4748-82DF-FE28DA9F03B0}\MsblIco.Exe
+ 2008-08-23 09:34:08 10,134 —-a-r C:\WINDOWS\Installer\{58E05C78-4785-443D-8A1B-CBFF49C2A84E}\callmsi.exe
+ 2008-08-23 09:34:08 140,544 —-a-r C:\WINDOWS\Installer\{58E05C78-4785-443D-8A1B-CBFF49C2A84E}\egui.exe
+ 2008-08-05 21:48:16 27,136 —-a-r C:\WINDOWS\Installer\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}\AppleSoftwareUpdateIco.exe
- 2008-06-25 02:04:10 593,920 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2008-07-10 16:22:47 593,920 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
- 2008-06-25 02:04:11 12,288 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-07-10 16:22:47 12,288 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-06-25 02:04:11 86,016 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2008-07-10 16:22:47 86,016 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2008-06-25 02:04:10 135,168 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-07-10 16:22:47 135,168 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-06-25 02:04:11 11,264 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-07-10 16:22:47 11,264 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2008-06-25 02:04:11 27,136 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-07-10 16:22:47 27,136 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-06-25 02:04:11 4,096 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-07-10 16:22:47 4,096 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-06-25 02:04:11 794,624 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2008-07-10 16:22:47 794,624 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-06-25 02:04:10 249,856 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-07-10 16:22:47 249,856 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2008-06-25 02:04:10 61,440 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2008-07-10 16:22:47 61,440 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2008-06-25 02:04:11 23,040 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-07-10 16:22:47 23,040 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2008-06-25 02:04:10 286,720 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-07-10 16:22:47 286,720 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-06-25 02:04:10 409,600 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-07-10 16:22:47 409,600 —-a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-07-22 21:10:22 15,086 —-a-r C:\WINDOWS\Installer\{945AC98B-3DC8-45BE-BAE0-22CEEE37A103}\ARPPRODUCTICON.exe
+ 2008-07-22 21:10:22 15,086 —-a-r C:\WINDOWS\Installer\{945AC98B-3DC8-45BE-BAE0-22CEEE37A103}\DesktopShortcut_10110FE91EE84A3DADFD1294F86BE5FC.exe
+ 2008-07-22 21:10:22 53,248 —-a-r C:\WINDOWS\Installer\{945AC98B-3DC8-45BE-BAE0-22CEEE37A103}\ProgramGroupShortcut_EFA2BBEBCF93493B904B1B970B8DFAB6.exe
+ 2008-07-28 17:03:25 13,312 —-a-r C:\WINDOWS\Installer\{9ACEBC7B-4D46-462A-929C-99177EC5BEA6}\Icon9ACEBC7B.exe
+ 2008-07-28 17:03:25 18,944 —-a-r C:\WINDOWS\Installer\{9ACEBC7B-4D46-462A-929C-99177EC5BEA6}\Icon9ACEBC7B1.exe
+ 2008-07-28 17:03:25 11,264 —-a-r C:\WINDOWS\Installer\{9ACEBC7B-4D46-462A-929C-99177EC5BEA6}\Icon9D7F2D56.exe
+ 2008-07-28 17:03:25 18,944 —-a-r C:\WINDOWS\Installer\{9ACEBC7B-4D46-462A-929C-99177EC5BEA6}\Icon9D7F2D561.exe
+ 2008-08-05 21:49:17 307,200 —-a-r C:\WINDOWS\Installer\{C9D96682-5A4D-45FA-BA3E-DDCB2B0CB868}\SafariIco.exe
- 2006-10-12 14:02:52 42,496 —-a-w C:\WINDOWS\msagent\agentdp2.dll
+ 2006-02-28 12:00:00 41,984 —-a-w C:\WINDOWS\msagent\agentdp2.dll
- 2007-03-09 13:46:24 57,344 —-a-w C:\WINDOWS\msagent\agentdpv.dll
+ 2006-02-28 12:00:00 58,880 —-a-w C:\WINDOWS\msagent\agentdpv.dll
- 2006-10-12 11:09:53 256,512 —-a-w C:\WINDOWS\msagent\agentsvr.exe
+ 2006-02-28 12:00:00 256,512 —-a-w C:\WINDOWS\msagent\agentsvr.exe
- 2008-04-23 21:45:29 229,376 —ha-w C:\WINDOWS\repair\ntuser.dat
+ 2008-08-23 19:19:06 303,104 —ha-w C:\WINDOWS\repair\ntuser.dat
- 2006-08-16 11:58:05 100,352 —-a-w C:\WINDOWS\system32\6to4svc.dll
+ 2006-02-28 12:00:00 100,352 —-a-w C:\WINDOWS\system32\6to4svc.dll
- 2007-08-13 17:39:20 71,680 —-a-w C:\WINDOWS\system32\admparse.dll
+ 2006-02-28 12:00:00 61,440 —-a-w C:\WINDOWS\system32\admparse.dll
- 2008-04-23 04:16:28 124,928 —-a-w C:\WINDOWS\system32\advpack.dll
+ 2006-02-28 12:00:00 99,840 —-a-w C:\WINDOWS\system32\advpack.dll
+ 2000-04-27 11:31:18 19,456 —-a-w C:\WINDOWS\system32\asapi.dll
- 2006-10-18 20:47:08 7,168 —-a-w C:\WINDOWS\system32\asferror.dll
+ 2006-02-28 12:00:00 8,192 —-a-w C:\WINDOWS\system32\asferror.dll
- 2005-03-02 18:09:29 56,832 —-a-w C:\WINDOWS\system32\authz.dll
+ 2006-02-28 12:00:00 56,832 —-a-w C:\WINDOWS\system32\authz.dll
- 2006-10-18 20:47:10 542,720 —-a-w C:\WINDOWS\system32\blackbox.dll
+ 2006-02-28 12:00:00 286,208 —-a-w C:\WINDOWS\system32\blackbox.dll
- 2008-04-21 07:03:56 1,023,488 —-a-w C:\WINDOWS\system32\browseui.dll
+ 2006-02-28 12:00:00 1,022,976 —-a-w C:\WINDOWS\system32\browseui.dll
- 2005-07-26 04:39:42 225,792 —-a-w C:\WINDOWS\system32\catsrv.dll
+ 2006-02-28 12:00:00 229,888 —-a-w C:\WINDOWS\system32\catsrv.dll
- 2005-07-26 04:39:43 625,152 —-a-w C:\WINDOWS\system32\catsrvut.dll
+ 2006-02-28 12:00:00 628,224 —-a-w C:\WINDOWS\system32\catsrvut.dll
- 2008-04-21 07:03:56 151,040 —-a-w C:\WINDOWS\system32\cdfview.dll
+ 2006-02-28 12:00:00 150,528 —-a-w C:\WINDOWS\system32\cdfview.dll
- 2005-09-10 01:53:41 2,067,968 —-a-w C:\WINDOWS\system32\cdosys.dll
+ 2006-02-28 12:00:00 2,067,968 —-a-w C:\WINDOWS\system32\cdosys.dll
- 2006-10-18 20:47:10 229,376 —-a-w C:\WINDOWS\system32\cewmdm.dll
+ 2006-02-28 12:00:00 159,232 —-a-w C:\WINDOWS\system32\cewmdm.dll
- 2006-06-22 05:06:29 69,120 —-a-w C:\WINDOWS\system32\ciodm.dll
+ 2006-02-28 12:00:00 69,120 —-a-w C:\WINDOWS\system32\ciodm.dll
- 2005-07-26 04:39:43 110,080 —-a-w C:\WINDOWS\system32\clbcatex.dll
+ 2006-02-28 12:00:00 110,080 —-a-w C:\WINDOWS\system32\clbcatex.dll
- 2005-07-26 04:39:43 498,688 —-a-w C:\WINDOWS\system32\clbcatq.dll
+ 2006-02-28 12:00:00 501,248 —-a-w C:\WINDOWS\system32\clbcatq.dll
- 2005-07-26 04:39:43 60,416 —-a-w C:\WINDOWS\system32\colbact.dll
+ 2006-02-28 12:00:00 62,464 —-a-w C:\WINDOWS\system32\colbact.dll
- 2005-07-26 04:39:44 195,072 —-a-w C:\WINDOWS\system32\Com\comadmin.dll
+ 2006-02-28 12:00:00 195,584 —-a-w C:\WINDOWS\system32\Com\comadmin.dll
- 2006-08-25 15:45:58 617,472 —-a-w C:\WINDOWS\system32\comctl32.dll
+ 2006-02-28 12:00:00 611,328 —-a-w C:\WINDOWS\system32\comctl32.dll
- 2005-07-26 04:39:44 97,792 —-a-w C:\WINDOWS\system32\comrepl.dll
+ 2006-02-28 12:00:00 82,432 —-a-w C:\WINDOWS\system32\comrepl.dll
- 2005-07-26 04:39:44 1,267,200 —-a-w C:\WINDOWS\system32\comsvcs.dll
+ 2006-02-28 12:00:00 1,251,840 —-a-w C:\WINDOWS\system32\comsvcs.dll
- 2005-07-26 04:39:45 540,160 —-a-w C:\WINDOWS\system32\comuid.dll
+ 2006-02-28 12:00:00 540,160 —-a-w C:\WINDOWS\system32\comuid.dll
- 2008-04-23 21:48:30 16,384 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-08-24 20:39:10 16,384 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-04-23 21:48:30 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-08-24 20:39:10 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-08-23 19:23:47 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082320080824\index.dat
- 2008-04-21 07:03:57 1,054,208 —-a-w C:\WINDOWS\system32\danim.dll
+ 2006-02-28 12:00:00 1,053,696 —-a-w C:\WINDOWS\system32\danim.dll
+ 2002-02-28 08:46:28 217,088 —-a-w C:\WINDOWS\system32\DartSock.dll
+ 2002-02-21 09:12:18 118,784 —-a-w C:\WINDOWS\system32\DartWeb.dll
- 2006-05-19 12:59:41 111,616 —-a-w C:\WINDOWS\system32\dhcpcsvc.dll
+ 2006-02-28 12:00:00 111,104 —-a-w C:\WINDOWS\system32\dhcpcsvc.dll
- 2006-08-16 11:58:05 100,352 -c–a-w C:\WINDOWS\system32\dllcache\6to4svc.dll
+ 2006-02-28 12:00:00 100,352 -c–a-w C:\WINDOWS\system32\dllcache\6to4svc.dll
- 2007-08-13 17:39:20 71,680 -c–a-w C:\WINDOWS\system32\dllcache\admparse.dll
+ 2006-02-28 12:00:00 61,440 -c–a-w C:\WINDOWS\system32\dllcache\admparse.dll
- 2008-04-23 04:16:28 124,928 -c—-w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2006-02-28 12:00:00 99,840 -c–a-w C:\WINDOWS\system32\dllcache\advpack.dll
- 2006-10-12 14:02:52 42,496 -c–a-w C:\WINDOWS\system32\dllcache\agentdp2.dll
+ 2006-02-28 12:00:00 41,984 -c–a-w C:\WINDOWS\system32\dllcache\agentdp2.dll
- 2007-03-09 13:46:24 57,344 -c–a-w C:\WINDOWS\system32\dllcache\agentdpv.dll
+ 2006-02-28 12:00:00 58,880 -c–a-w C:\WINDOWS\system32\dllcache\agentdpv.dll
- 2006-10-12 11:09:53 256,512 -c–a-w C:\WINDOWS\system32\dllcache\agentsvr.exe
+ 2006-02-28 12:00:00 256,512 -c–a-w C:\WINDOWS\system32\dllcache\agentsvr.exe
- 2006-10-18 20:47:08 7,168 -c–a-w C:\WINDOWS\system32\dllcache\asferror.dll
+ 2006-02-28 12:00:00 8,192 -c–a-w C:\WINDOWS\system32\dllcache\asferror.dll
- 2005-03-02 18:09:29 56,832 -c–a-w C:\WINDOWS\system32\dllcache\authz.dll
+ 2006-02-28 12:00:00 56,832 -c–a-w C:\WINDOWS\system32\dllcache\authz.dll
- 2006-10-18 20:47:10 542,720 -c–a-w C:\WINDOWS\system32\dllcache\blackbox.dll
+ 2006-02-28 12:00:00 286,208 -c–a-w C:\WINDOWS\system32\dllcache\blackbox.dll
- 2008-04-21 07:03:56 1,023,488 -c–a-w C:\WINDOWS\system32\dllcache\browseui.dll
+ 2006-02-28 12:00:00 1,022,976 -c–a-w C:\WINDOWS\system32\dllcache\browseui.dll
- 2005-07-26 04:39:42 225,792 -c–a-w C:\WINDOWS\system32\dllcache\catsrv.dll
+ 2006-02-28 12:00:00 229,888 -c–a-w C:\WINDOWS\system32\dllcache\catsrv.dll
- 2005-07-26 04:39:43 625,152 -c–a-w C:\WINDOWS\system32\dllcache\catsrvut.dll
+ 2006-02-28 12:00:00 628,224 -c–a-w C:\WINDOWS\system32\dllcache\catsrvut.dll
- 2008-04-21 07:03:56 151,040 -c–a-w C:\WINDOWS\system32\dllcache\cdfview.dll
+ 2006-02-28 12:00:00 150,528 -c–a-w C:\WINDOWS\system32\dllcache\cdfview.dll
- 2007-07-30 18:19:20 92,504 -c–a-w C:\WINDOWS\system32\dllcache\cdm.dll
+ 2006-02-28 12:00:00 66,560 -c–a-w C:\WINDOWS\system32\dllcache\cdm.dll
- 2005-09-10 01:53:41 2,067,968 -c–a-w C:\WINDOWS\system32\dllcache\cdosys.dll
+ 2006-02-28 12:00:00 2,067,968 -c–a-w C:\WINDOWS\system32\dllcache\cdosys.dll
- 2006-10-18 20:47:10 229,376 -c–a-w C:\WINDOWS\system32\dllcache\cewmdm.dll
+ 2006-02-28 12:00:00 159,232 -c–a-w C:\WINDOWS\system32\dllcache\cewmdm.dll
- 2006-06-22 05:06:29 69,120 -c–a-w C:\WINDOWS\system32\dllcache\ciodm.dll
+ 2006-02-28 12:00:00 69,120 -c–a-w C:\WINDOWS\system32\dllcache\ciodm.dll
- 2005-07-26 04:39:43 110,080 -c–a-w C:\WINDOWS\system32\dllcache\clbcatex.dll
+ 2006-02-28 12:00:00 110,080 -c–a-w C:\WINDOWS\system32\dllcache\clbcatex.dll
- 2005-07-26 04:39:43 498,688 -c–a-w C:\WINDOWS\system32\dllcache\clbcatq.dll
+ 2006-02-28 12:00:00 501,248 -c–a-w C:\WINDOWS\system32\dllcache\clbcatq.dll
- 2005-07-26 04:39:43 60,416 -c–a-w C:\WINDOWS\system32\dllcache\colbact.dll
+ 2006-02-28 12:00:00 62,464 -c–a-w C:\WINDOWS\system32\dllcache\colbact.dll
- 2005-07-26 04:39:44 195,072 -c–a-w C:\WINDOWS\system32\dllcache\comadmin.dll
+ 2006-02-28 12:00:00 195,584 -c–a-w C:\WINDOWS\system32\dllcache\comadmin.dll
- 2006-08-25 15:45:58 617,472 -c–a-w C:\WINDOWS\system32\dllcache\comctl32.dll
+ 2006-02-28 12:00:00 611,328 -c–a-w C:\WINDOWS\system32\dllcache\comctl32.dll
- 2005-07-26 04:39:44 97,792 -c–a-w C:\WINDOWS\system32\dllcache\comrepl.dll
+ 2006-02-28 12:00:00 82,432 -c–a-w C:\WINDOWS\system32\dllcache\comrepl.dll
- 2005-07-26 04:39:44 1,267,200 -c–a-w C:\WINDOWS\system32\dllcache\comsvcs.dll
+ 2006-02-28 12:00:00 1,251,840 -c–a-w C:\WINDOWS\system32\dllcache\comsvcs.dll
- 2005-07-26 04:39:45 540,160 -c–a-w C:\WINDOWS\system32\dllcache\comuid.dll
+ 2006-02-28 12:00:00 540,160 -c–a-w C:\WINDOWS\system32\dllcache\comuid.dll
- 2007-08-13 17:54:10 33,792 -c–a-w C:\WINDOWS\system32\dllcache\custsat.dll
+ 2006-02-28 12:00:00 28,672 -c–a-w C:\WINDOWS\system32\dllcache\custsat.dll
- 2008-04-21 07:03:57 1,054,208 -c–a-w C:\WINDOWS\system32\dllcache\danim.dll
+ 2006-02-28 12:00:00 1,053,696 -c–a-w C:\WINDOWS\system32\dllcache\danim.dll
- 2008-03-25 04:50:25 554,008 -c–a-w C:\WINDOWS\system32\dllcache\dao360.dll
+ 2006-02-28 12:00:00 561,179 -c–a-w C:\WINDOWS\system32\dllcache\dao360.dll
- 2006-05-19 12:59:41 111,616 -c–a-w C:\WINDOWS\system32\dllcache\dhcpcsvc.dll
+ 2006-02-28 12:00:00 111,104 -c–a-w C:\WINDOWS\system32\dllcache\dhcpcsvc.dll
- 2007-05-16 15:12:00 86,528 -c–a-w C:\WINDOWS\system32\dllcache\directdb.dll
+ 2006-02-28 12:00:00 81,408 -c–a-w C:\WINDOWS\system32\dllcache\directdb.dll
- 2008-02-20 05:32:43 148,992 -c–a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
+ 2006-02-28 12:00:00 148,480 -c–a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
- 2008-02-20 05:32:43 45,568 -c–a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
+ 2006-02-28 12:00:00 45,568 -c–a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
- 2006-10-18 20:47:10 991,744 -c–a-w C:\WINDOWS\system32\dllcache\drmv2clt.dll
+ 2006-02-28 12:00:00 695,296 -c–a-w C:\WINDOWS\system32\dllcache\drmv2clt.dll
- 2006-08-22 03:05:26 498,742 -c–a-w C:\WINDOWS\system32\dllcache\dxmasf.dll
+ 2006-02-28 12:00:00 498,205 -c–a-w C:\WINDOWS\system32\dllcache\dxmasf.dll
- 2008-04-23 04:16:28 347,136 -c—-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2006-02-28 12:00:00 357,888 -c–a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2008-04-23 04:16:28 214,528 -c—-w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2006-02-28 12:00:00 201,728 -c–a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2005-07-26 04:39:45 243,200 -c–a-w C:\WINDOWS\system32\dllcache\es.dll
+ 2006-02-28 12:00:00 243,200 -c–a-w C:\WINDOWS\system32\dllcache\es.dll
- 2005-10-20 22:20:03 1,082,368 -c–a-w C:\WINDOWS\system32\dllcache\esent.dll
+ 2006-02-28 12:00:00 1,082,368 -c–a-w C:\WINDOWS\system32\dllcache\esent.dll
- 2007-06-13 10:23:07 1,033,216 -c–a-w C:\WINDOWS\system32\dllcache\explorer.exe
+ 2006-02-28 12:00:00 1,032,192 -c–a-w C:\WINDOWS\system32\dllcache\explorer.exe
- 2008-04-23 04:16:28 133,120 -c—-w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2006-02-28 12:00:00 55,808 -c–a-w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2006-08-21 12:21:06 16,896 -c–a-w C:\WINDOWS\system32\dllcache\fltlib.dll
+ 2006-02-28 12:00:00 16,896 -c–a-w C:\WINDOWS\system32\dllcache\fltlib.dll
- 2006-08-21 09:14:58 23,040 -c–a-w C:\WINDOWS\system32\dllcache\fltmc.exe
+ 2006-02-28 12:00:00 22,528 -c–a-w C:\WINDOWS\system32\dllcache\fltmc.exe
- 2006-08-21 09:14:58 128,896 -c–a-w C:\WINDOWS\system32\dllcache\fltmgr.sys
+ 2006-02-28 12:00:00 124,800 -c–a-w C:\WINDOWS\system32\dllcache\fltmgr.sys
- 2005-10-17 21:14:45 80,896 -c–a-w C:\WINDOWS\system32\dllcache\fontsub.dll
+ 2006-02-28 12:00:00 79,360 -c–a-w C:\WINDOWS\system32\dllcache\fontsub.dll
- 2008-02-20 06:51:05 282,624 -c–a-w C:\WINDOWS\system32\dllcache\gdi32.dll
+ 2006-02-28 12:00:00 278,016 -c–a-w C:\WINDOWS\system32\dllcache\gdi32.dll
- 2005-05-26 23:22:01 10,752 -c–a-w C:\WINDOWS\system32\dllcache\hh.exe
+ 2006-02-28 12:00:00 10,752 -c–a-w C:\WINDOWS\system32\dllcache\hh.exe
- 2005-05-27 02:04:27 41,472 -c–a-w C:\WINDOWS\system32\dllcache\hhsetup.dll
+ 2006-02-28 12:00:00 38,912 -c–a-w C:\WINDOWS\system32\dllcache\hhsetup.dll
- 2006-07-21 08:24:43 72,704 -c–a-w C:\WINDOWS\system32\dllcache\hlink.dll
+ 2006-02-28 12:00:00 77,850 -c–a-w C:\WINDOWS\system32\dllcache\hlink.dll
- 2007-08-13 17:18:02 60,416 -c–a-w C:\WINDOWS\system32\dllcache\hmmapi.dll
+ 2006-02-28 12:00:00 38,912 -c–a-w C:\WINDOWS\system32\dllcache\hmmapi.dll
- 2005-06-29 01:46:00 254,976 -c–a-w C:\WINDOWS\system32\dllcache\icm32.dll
+ 2006-02-28 12:00:00 253,952 -c–a-w C:\WINDOWS\system32\dllcache\icm32.dll
- 2008-04-22 07:39:58 70,656 -c—-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
+ 2006-02-28 12:00:00 34,304 -c–a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
- 2008-04-23 04:16:28 153,088 -c—-w C:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2006-02-28 12:00:00 139,264 -c–a-w C:\WINDOWS\system32\dllcache\ieakeng.dll
- 2008-04-23 04:16:28 230,400 -c—-w C:\WINDOWS\system32\dllcache\ieaksie.dll
+ 2006-02-28 12:00:00 216,576 -c–a-w C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2008-04-20 05:07:51 161,792 -c—-w C:\WINDOWS\system32\dllcache\ieakui.dll
+ 2006-02-28 12:00:00 221,184 -c–a-w C:\WINDOWS\system32\dllcache\ieakui.dll
- 2008-04-23 04:16:28 384,512 -c—-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2006-02-28 12:00:00 323,584 -c–a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
- 2007-08-13 17:44:02 69,120 -c–a-w C:\WINDOWS\system32\dllcache\iedw.exe
+ 2006-02-28 12:00:00 18,432 -c–a-w C:\WINDOWS\system32\dllcache\iedw.exe
- 2007-08-13 17:45:18 78,336 -c–a-w C:\WINDOWS\system32\dllcache\ieencode.dll
+ 2006-02-28 12:00:00 81,920 -c–a-w C:\WINDOWS\system32\dllcache\ieencode.dll
- 2007-08-13 17:54:10 191,488 -c–a-w C:\WINDOWS\system32\dllcache\iepeers.dll
+ 2006-02-28 12:00:00 251,392 -c–a-w C:\WINDOWS\system32\dllcache\iepeers.dll
- 2008-04-23 04:16:28 44,544 -c—-w C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2006-02-28 12:00:00 48,640 -c–a-w C:\WINDOWS\system32\dllcache\iernonce.dll
- 2007-08-13 17:39:12 55,296 -c–a-w C:\WINDOWS\system32\dllcache\iesetup.dll
+ 2006-02-28 12:00:00 62,976 -c–a-w C:\WINDOWS\system32\dllcache\iesetup.dll
- 2008-04-22 07:40:18 625,664 -c—-w C:\WINDOWS\system32\dllcache\iexplore.exe
+ 2006-02-28 12:00:00 93,184 -c–a-w C:\WINDOWS\system32\dllcache\iexplore.exe
- 2007-08-13 17:36:06 36,352 -c–a-w C:\WINDOWS\system32\dllcache\imgutil.dll
+ 2006-02-28 12:00:00 35,840 -c–a-w C:\WINDOWS\system32\dllcache\imgutil.dll
- 2007-08-21 06:15:44 683,520 -c–a-w C:\WINDOWS\system32\dllcache\inetcomm.dll
+ 2006-02-28 12:00:00 678,400 -c–a-w C:\WINDOWS\system32\dllcache\inetcomm.dll
- 2007-08-13 17:39:02 92,672 -c–a-w C:\WINDOWS\system32\dllcache\inseng.dll
+ 2006-02-28 12:00:00 96,256 -c–a-w C:\WINDOWS\system32\dllcache\inseng.dll
- 2006-05-19 12:59:41 94,720 -c–a-w C:\WINDOWS\system32\dllcache\iphlpapi.dll
+ 2006-02-28 12:00:00 94,720 -c–a-w C:\WINDOWS\system32\dllcache\iphlpapi.dll
- 2004-09-29 22:28:37 134,912 -c–a-w C:\WINDOWS\system32\dllcache\ipnat.sys
+ 2006-02-28 12:00:00 134,912 -c–a-w C:\WINDOWS\system32\dllcache\ipnat.sys
- 2005-05-27 02:04:27 155,136 -c–a-w C:\WINDOWS\system32\dllcache\itircl.dll
+ 2006-02-28 12:00:00 143,872 -c–a-w C:\WINDOWS\system32\dllcache\itircl.dll
- 2005-05-27 02:04:27 137,216 -c–a-w C:\WINDOWS\system32\dllcache\itss.dll
+ 2006-02-28 12:00:00 134,144 -c–a-w C:\WINDOWS\system32\dllcache\itss.dll
- 2007-08-13 17:38:04 491,520 -c–a-w C:\WINDOWS\system32\dllcache\jscript.dll
+ 2006-02-28 12:00:00 450,560 -c–a-w C:\WINDOWS\system32\dllcache\jscript.dll
- 2008-04-23 04:16:28 27,648 -c—-w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2006-02-28 12:00:00 15,872 -c–a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2005-06-15 17:49:30 295,936 -c–a-w C:\WINDOWS\system32\dllcache\kerberos.dll
+ 2006-02-28 12:00:00 294,400 -c–a-w C:\WINDOWS\system32\dllcache\kerberos.dll
- 2007-04-16 15:52:53 984,576 -c–a-w C:\WINDOWS\system32\dllcache\kernel32.dll
+ 2006-02-28 12:00:00 983,552 -c–a-w C:\WINDOWS\system32\dllcache\kernel32.dll
- 2006-10-18 20:47:14 11,264 -c–a-w C:\WINDOWS\system32\dllcache\LAPRXY.dll
+ 2006-02-28 12:00:00 6,656 -c–a-w C:\WINDOWS\system32\dllcache\laprxy.dll
- 2007-08-13 17:44:18 40,960 -c–a-w C:\WINDOWS\system32\dllcache\licmgr10.dll
+ 2006-02-28 12:00:00 22,016 -c–a-w C:\WINDOWS\system32\dllcache\licmgr10.dll
- 2005-09-01 01:41:53 19,968 -c–a-w C:\WINDOWS\system32\dllcache\linkinfo.dll
+ 2006-02-28 12:00:00 18,944 -c–a-w C:\WINDOWS\system32\dllcache\linkinfo.dll
- 2006-10-18 19:03:58 100,864 -c–a-w C:\WINDOWS\system32\dllcache\logagent.exe
+ 2006-02-28 12:00:00 103,936 -c–a-w C:\WINDOWS\system32\dllcache\logagent.exe
- 2007-11-07 09:26:56 721,920 -c–a-w C:\WINDOWS\system32\dllcache\lsasrv.dll
+ 2006-02-28 12:00:00 721,920 -c–a-w C:\WINDOWS\system32\dllcache\lsasrv.dll
- 2007-03-08 15:36:28 40,960 -c–a-w C:\WINDOWS\system32\dllcache\mf3216.dll
+ 2006-02-28 12:00:00 39,936 -c–a-w C:\WINDOWS\system32\dllcache\mf3216.dll
- 2006-11-01 19:17:45 927,504 -c–a-w C:\WINDOWS\system32\dllcache\mfc40u.dll
+ 2006-02-28 12:00:00 924,432 -c–a-w C:\WINDOWS\system32\dllcache\mfc40u.dll
- 2006-10-14 08:13:25 981,760 -c–a-w C:\WINDOWS\system32\dllcache\mfc42u.dll
+ 2006-02-28 12:00:00 1,024,000 -c–a-w C:\WINDOWS\system32\dllcache\mfc42u.dll
- 2005-07-25 23:46:57 7,680 -c–a-w C:\WINDOWS\system32\dllcache\migregdb.exe
+ 2006-02-28 12:00:00 7,680 -c–a-w C:\WINDOWS\system32\dllcache\migregdb.exe
- 2006-10-18 20:47:14 4,096 -c–a-w C:\WINDOWS\system32\dllcache\MP43DMOD.dll
+ 2006-02-28 12:00:00 310,272 -c–a-w C:\WINDOWS\system32\dllcache\mp43dmod.dll
- 2006-10-18 20:47:14 4,096 -c–a-w C:\WINDOWS\system32\dllcache\MP4SDMOD.dll
+ 2006-02-28 12:00:00 384,512 -c–a-w C:\WINDOWS\system32\dllcache\mp4sdmod.dll
- 2006-10-18 20:47:14 4,096 -c–a-w C:\WINDOWS\system32\dllcache\MPG4DMOD.dll
+ 2006-02-28 12:00:00 240,640 -c–a-w C:\WINDOWS\system32\dllcache\mpg4dmod.dll
- 2006-10-18 20:47:14 243,712 -c–a-w C:\WINDOWS\system32\dllcache\mpvis.dll
+ 2006-02-28 12:00:00 368,640 -c–a-w C:\WINDOWS\system32\dllcache\mpvis.dll
- 2007-12-18 09:51:35 179,584 -c–a-w C:\WINDOWS\system32\dllcache\mrxdav.sys
+ 2006-02-28 12:00:00 181,248 -c–a-w C:\WINDOWS\system32\dllcache\mrxdav.sys
- 2006-03-23 05:44:21 143,360 -c–a-w C:\WINDOWS\system32\dllcache\msadco.dll
+ 2006-02-28 12:00:00 143,360 -c–a-w C:\WINDOWS\system32\dllcache\msadco.dll
- 2006-12-26 13:07:23 536,576 -c–a-w C:\WINDOWS\system32\dllcache\msado15.dll
+ 2006-02-28 12:00:00 536,576 -c–a-w C:\WINDOWS\system32\dllcache\msado15.dll
- 2006-12-26 13:07:23 180,224 -c–a-w C:\WINDOWS\system32\dllcache\msadomd.dll
+ 2006-02-28 12:00:00 180,224 -c–a-w C:\WINDOWS\system32\dllcache\msadomd.dll
- 2006-12-26 13:07:23 200,704 -c–a-w C:\WINDOWS\system32\dllcache\msadox.dll
+ 2006-02-28 12:00:00 200,704 -c–a-w C:\WINDOWS\system32\dllcache\msadox.dll
- 2005-06-29 01:46:00 74,240 -c–a-w C:\WINDOWS\system32\dllcache\mscms.dll
+ 2006-02-28 12:00:00 73,728 -c–a-w C:\WINDOWS\system32\dllcache\mscms.dll
- 2008-02-26 11:59:50 294,912 -c–a-w C:\WINDOWS\system32\dllcache\msctf.dll
+ 2006-02-28 12:00:00 294,400 -c–a-w C:\WINDOWS\system32\dllcache\msctf.dll
- 2006-03-01 19:42:42 426,496 -c–a-w C:\WINDOWS\system32\dllcache\msdtcprx.dll
+ 2006-02-28 12:00:00 425,472 -c–a-w C:\WINDOWS\system32\dllcache\msdtcprx.dll
- 2006-03-01 19:42:42 956,416 -c–a-w C:\WINDOWS\system32\dllcache\msdtctm.dll
+ 2006-02-28 12:00:00 949,248 -c–a-w C:\WINDOWS\system32\dllcache\msdtctm.dll
- 2006-03-01 19:42:42 161,280 -c–a-w C:\WINDOWS\system32\dllcache\msdtcuiu.dll
+ 2006-02-28 12:00:00 161,280 -c–a-w C:\WINDOWS\system32\dllcache\msdtcuiu.dll
- 2008-03-25 04:50:28 518,944 -c–a-w C:\WINDOWS\system32\dllcache\msexch40.dll
+ 2006-02-28 12:00:00 512,029 -c–a-w C:\WINDOWS\system32\dllcache\msexch40.dll
- 2008-03-25 04:50:30 326,432 -c–a-w C:\WINDOWS\system32\dllcache\msexcl40.dll
+ 2006-02-28 12:00:00 319,517 -c–a-w C:\WINDOWS\system32\dllcache\msexcl40.dll
- 2006-11-27 14:54:06 539,136 -c–a-w C:\WINDOWS\system32\dllcache\msftedit.dll
+ 2006-02-28 12:00:00 537,088 -c–a-w C:\WINDOWS\system32\dllcache\msftedit.dll
- 2007-08-13 17:32:30 45,568 -c–a-w C:\WINDOWS\system32\dllcache\mshta.exe
+ 2006-02-28 12:00:00 29,184 -c–a-w C:\WINDOWS\system32\dllcache\mshta.exe
- 2008-04-23 21:16:30 3,591,680 -c—-w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2006-02-28 12:00:00 3,049,472 -c–a-w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2008-04-23 04:16:28 478,208 -c—-w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2006-02-28 12:00:00 448,512 -c–a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2007-08-13 17:01:12 48,128 -c–a-w C:\WINDOWS\system32\dllcache\mshtmler.dll
+ 2006-02-28 12:00:00 56,832 -c–a-w C:\WINDOWS\system32\dllcache\mshtmler.dll
- 2007-04-18 16:12:23 2,854,400 -c–a-w C:\WINDOWS\system32\dllcache\msi.dll
+ 2006-02-28 12:00:00 2,804,224 -c–a-w C:\WINDOWS\system32\dllcache\msi.dll
- 2005-05-04 13:45:36 78,848 -c–a-w C:\WINDOWS\system32\dllcache\msiexec.exe
+ 2006-02-28 12:00:00 77,312 -c–a-w C:\WINDOWS\system32\dllcache\msiexec.exe
- 2005-05-04 13:45:36 271,360 -c–a-w C:\WINDOWS\system32\dllcache\msihnd.dll
+ 2006-02-28 12:00:00 331,264 -c–a-w C:\WINDOWS\system32\dllcache\msihnd.dll
- 2005-05-04 13:45:36 884,736 -c–a-w C:\WINDOWS\system32\dllcache\msimsg.dll
+ 2006-02-28 12:00:00 884,736 -c–a-w C:\WINDOWS\system32\dllcache\msimsg.dll
- 2005-05-04 13:45:36 15,360 -c–a-w C:\WINDOWS\system32\dllcache\msisip.dll
+ 2006-02-28 12:00:00 44,032 -c–a-w C:\WINDOWS\system32\dllcache\msisip.dll
- 2008-03-25 04:50:34 1,516,568 -c–a-w C:\WINDOWS\system32\dllcache\msjet40.dll
+ 2006-02-28 12:00:00 1,507,356 -c–a-w C:\WINDOWS\system32\dllcache\msjet40.dll
- 2008-03-25 04:50:40 355,112 -c–a-w C:\WINDOWS\system32\dllcache\msjetol1.dll
+ 2006-02-28 12:00:00 358,976 -c–a-w C:\WINDOWS\system32\dllcache\msjetol1.dll
- 2008-03-27 08:12:54 151,583 -c–a-w C:\WINDOWS\system32\dllcache\msjint40.dll
+ 2006-02-28 12:00:00 151,583 -c–a-w C:\WINDOWS\system32\dllcache\msjint40.dll
- 2006-12-26 13:07:23 102,400 -c–a-w C:\WINDOWS\system32\dllcache\msjro.dll
+ 2006-02-28 12:00:00 102,400 -c–a-w C:\WINDOWS\system32\dllcache\msjro.dll
- 2008-03-25 04:50:42 60,192 -c–a-w C:\WINDOWS\system32\dllcache\msjter40.dll
+ 2006-02-28 12:00:00 53,279 -c–a-w C:\WINDOWS\system32\dllcache\msjter40.dll
- 2008-03-25 04:50:42 248,608 -c–a-w C:\WINDOWS\system32\dllcache\msjtes40.dll
+ 2006-02-28 12:00:00 241,693 -c–a-w C:\WINDOWS\system32\dllcache\msjtes40.dll
- 2007-08-13 17:54:10 156,160 -c–a-w C:\WINDOWS\system32\dllcache\msls31.dll
+ 2006-02-28 12:00:00 146,432 -c–a-w C:\WINDOWS\system32\dllcache\msls31.dll
- 2008-03-25 04:50:44 219,936 -c–a-w C:\WINDOWS\system32\dllcache\msltus40.dll
+ 2006-02-28 12:00:00 213,023 -c–a-w C:\WINDOWS\system32\dllcache\msltus40.dll
- 2006-10-18 20:47:16 179,712 -c–a-w C:\WINDOWS\system32\dllcache\msnetobj.dll
+ 2006-02-28 12:00:00 259,072 -c–a-w C:\WINDOWS\system32\dllcache\msnetobj.dll
- 2007-05-16 15:12:08 1,314,816 -c–a-w C:\WINDOWS\system32\dllcache\msoe.dll
+ 2006-02-28 12:00:00 1,311,232 -c–a-w C:\WINDOWS\system32\dllcache\msoe.dll
- 2008-03-25 04:50:45 355,104 -c–a-w C:\WINDOWS\system32\dllcache\mspbde40.dll
+ 2006-02-28 12:00:00 348,189 -c–a-w C:\WINDOWS\system32\dllcache\mspbde40.dll
- 2006-10-18 20:47:16 27,136 -c–a-w C:\WINDOWS\system32\dllcache\mspmsnsv.dll
+ 2006-02-28 12:00:00 52,224 -c–a-w C:\WINDOWS\system32\dllcache\mspmsnsv.dll
- 2006-10-18 20:47:16 175,616 -c–a-w C:\WINDOWS\system32\dllcache\mspmsp.dll
+ 2006-02-28 12:00:00 201,728 -c–a-w C:\WINDOWS\system32\dllcache\mspmsp.dll
- 2008-04-23 04:16:28 193,024 -c—-w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2006-02-28 12:00:00 146,432 -c–a-w C:\WINDOWS\system32\dllcache\msrating.dll
- 2008-03-25 04:50:47 432,928 -c–a-w C:\WINDOWS\system32\dllcache\msrd2x40.dll
+ 2006-02-28 12:00:00 421,919 -c–a-w C:\WINDOWS\system32\dllcache\msrd2x40.dll
- 2008-03-25 04:50:49 322,336 -c–a-w C:\WINDOWS\system32\dllcache\msrd3x40.dll
+ 2006-02-28 12:00:00 315,423 -c–a-w C:\WINDOWS\system32\dllcache\msrd3x40.dll
- 2008-03-25 04:50:52 559,904 -c–a-w C:\WINDOWS\system32\dllcache\msrepl40.dll
+ 2006-02-28 12:00:00 552,989 -c–a-w C:\WINDOWS\system32\dllcache\msrepl40.dll
- 2006-12-04 15:21:50 414,720 -c–a-w C:\WINDOWS\system32\dllcache\msscp.dll
+ 2006-02-28 12:00:00 356,352 -c–a-w C:\WINDOWS\system32\dllcache\msscp.dll
- 2008-03-25 04:50:55 264,992 -c–a-w C:\WINDOWS\system32\dllcache\mstext40.dll
+ 2006-02-28 12:00:00 258,077 -c–a-w C:\WINDOWS\system32\dllcache\mstext40.dll
- 2008-04-23 04:16:28 671,232 -c—-w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2006-02-28 12:00:00 530,432 -c–a-w C:\WINDOWS\system32\dllcache\mstime.dll
- 2008-03-25 04:50:57 838,432 -c–a-w C:\WINDOWS\system32\dllcache\mswdat10.dll
+ 2006-02-28 12:00:00 831,519 -c–a-w C:\WINDOWS\system32\dllcache\mswdat10.dll
- 2006-10-18 20:47:16 321,536 -c–a-w C:\WINDOWS\system32\dllcache\mswmdm.dll
+ 2006-02-28 12:00:00 245,760 -c–a-w C:\WINDOWS\system32\dllcache\mswmdm.dll
- 2008-03-25 04:50:58 621,344 -c–a-w C:\WINDOWS\system32\dllcache\mswstr10.dll
+ 2006-02-28 12:00:00 614,429 -c–a-w C:\WINDOWS\system32\dllcache\mswstr10.dll
- 2008-03-25 04:50:58 355,104 -c–a-w C:\WINDOWS\system32\dllcache\msxbde40.dll
+ 2006-02-28 12:00:00 348,189 -c–a-w C:\WINDOWS\system32\dllcache\msxbde40.dll
- 2007-06-26 06:08:16 1,104,896 -c–a-w C:\WINDOWS\system32\dllcache\msxml3.dll
+ 2006-02-28 12:00:00 1,236,480 -c–a-w C:\WINDOWS\system32\dllcache\msxml3.dll
- 2006-03-01 19:42:42 66,560 -c–a-w C:\WINDOWS\system32\dllcache\mtxclu.dll
+ 2006-02-28 12:00:00 66,560 -c–a-w C:\WINDOWS\system32\dllcache\mtxclu.dll
- 2006-03-01 19:42:42 91,136 -c–a-w C:\WINDOWS\system32\dllcache\mtxoci.dll
+ 2006-02-28 12:00:00 90,112 -c–a-w C:\WINDOWS\system32\dllcache\mtxoci.dll
- 2006-08-17 12:28:27 332,288 -c–a-w C:\WINDOWS\system32\dllcache\netapi32.dll
+ 2006-02-28 12:00:00 332,288 -c–a-w C:\WINDOWS\system32\dllcache\netapi32.dll
- 2005-08-22 18:29:46 197,632 -c–a-w C:\WINDOWS\system32\dllcache\netman.dll
+ 2006-02-28 12:00:00 198,144 -c–a-w C:\WINDOWS\system32\dllcache\netman.dll
- 2005-11-29 15:27:06 364,544 -c–a-w C:\WINDOWS\system32\dllcache\npdsplay.dll
+ 2006-02-28 12:00:00 364,544 -c–a-w C:\WINDOWS\system32\dllcache\npdsplay.dll
- 2007-02-09 11:10:35 574,464 -c–a-w C:\WINDOWS\system32\dllcache\ntfs.sys
+ 2006-02-28 12:00:00 574,592 -c–a-w C:\WINDOWS\system32\dllcache\ntfs.sys
- 2006-10-13 12:35:12 142,336 -c–a-w C:\WINDOWS\system32\dllcache\nwprovau.dll
+ 2006-02-28 12:00:00 144,384 -c–a-w C:\WINDOWS\system32\dllcache\nwprovau.dll
- 2008-04-23 04:16:28 102,912 -c—-w C:\WINDOWS\system32\dllcache\occache.dll
+ 2006-02-28 12:00:00 96,256 -c–a-w C:\WINDOWS\system32\dllcache\occache.dll
- 2005-07-26 04:39:48 1,285,120 -c–a-w C:\WINDOWS\system32\dllcache\ole32.dll
+ 2006-02-28 12:00:00 1,281,536 -c–a-w C:\WINDOWS\system32\dllcache\ole32.dll
- 2007-12-04 18:38:13 550,912 -c–a-w C:\WINDOWS\system32\dllcache\oleaut32.dll
+ 2006-02-28 12:00:00 553,472 -c–a-w C:\WINDOWS\system32\dllcache\oleaut32.dll
- 2005-07-26 04:39:48 74,752 -c–a-w C:\WINDOWS\system32\dllcache\olecli32.dll
+ 2006-02-28 12:00:00 68,608 -c–a-w C:\WINDOWS\system32\dllcache\olecli32.dll
- 2005-07-26 04:39:49 37,888 -c–a-w C:\WINDOWS\system32\dllcache\olecnv32.dll
+ 2006-02-28 12:00:00 34,304 -c–a-w C:\WINDOWS\system32\dllcache\olecnv32.dll
- 2006-10-16 16:15:00 122,880 -c–a-w C:\WINDOWS\system32\dllcache\oledlg.dll
+ 2006-02-28 12:00:00 117,760 -c–a-w C:\WINDOWS\system32\dllcache\oledlg.dll
- 2008-04-23 04:16:28 44,544 -c—-w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2006-02-28 12:00:00 39,424 -c–a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2006-10-18 20:47:18 211,456 -c–a-w C:\WINDOWS\system32\dllcache\qasf.dll
+ 2006-02-28 12:00:00 237,568 -c–a-w C:\WINDOWS\system32\dllcache\qasf.dll
- 2008-05-07 05:18:48 1,287,680 -c–a-w C:\WINDOWS\system32\dllcache\quartz.dll
+ 2006-02-28 12:00:00 1,287,680 -c–a-w C:\WINDOWS\system32\dllcache\quartz.dll
- 2006-06-22 05:06:30 1,435,648 -c–a-w C:\WINDOWS\system32\dllcache\query.dll
+ 2006-02-28 12:00:00 1,435,648 -c–a-w C:\WINDOWS\system32\dllcache\query.dll
- 2006-06-26 17:37:10 8,192 -c–a-w C:\WINDOWS\system32\dllcache\rasadhlp.dll
+ 2006-02-28 12:00:00 8,192 -c–a-w C:\WINDOWS\system32\dllcache\rasadhlp.dll
- 2006-06-22 10:47:18 181,248 -c–a-w C:\WINDOWS\system32\dllcache\rasmans.dll
+ 2006-02-28 12:00:00 174,080 -c–a-w C:\WINDOWS\system32\dllcache\rasmans.dll
- 2006-05-05 09:47:57 174,592 -c–a-w C:\WINDOWS\system32\dllcache\rdbss.sys
+ 2006-02-28 12:00:00 176,512 -c–a-w C:\WINDOWS\system32\dllcache\rdbss.sys
- 2005-06-10 04:09:46 139,528 -c–a-w C:\WINDOWS\system32\dllcache\rdpwd.sys
+ 2006-02-28 12:00:00 139,400 -c–a-w C:\WINDOWS\system32\dllcache\rdpwd.sys
- 2006-11-27 14:54:06 433,152 -c–a-w C:\WINDOWS\system32\dllcache\riched20.dll
+ 2006-02-28 12:00:00 431,616 -c–a-w C:\WINDOWS\system32\dllcache\riched20.dll
- 2008-05-08 12:28:49 202,752 -c–a-w C:\WINDOWS\system32\dllcache\rmcast.sys
+ 2006-02-28 12:00:00 200,064 -c–a-w C:\WINDOWS\system32\dllcache\rmcast.sys
- 2007-07-09 13:09:42 584,192 -c–a-w C:\WINDOWS\system32\dllcache\rpcrt4.dll
+ 2006-02-28 12:00:00 581,120 -c–a-w C:\WINDOWS\system32\dllcache\rpcrt4.dll
- 2005-07-26 04:39:49 397,824 -c–a-w C:\WINDOWS\system32\dllcache\rpcss.dll
+ 2006-02-28 12:00:00 395,776 -c–a-w C:\WINDOWS\system32\dllcache\rpcss.dll
- 2007-04-25 14:21:15 144,896 -c–a-w C:\WINDOWS\system32\dllcache\schannel.dll
+ 2006-02-28 12:00:00 144,896 -c–a-w C:\WINDOWS\system32\dllcache\schannel.dll
- 2006-11-01 17:31:38 1,669,120 -c–a-w C:\WINDOWS\system32\dllcache\setup_wm.exe
+ 2006-02-28 12:00:00 774,144 -c–a-w C:\WINDOWS\system32\dllcache\setup_wm.exe
- 2008-04-21 07:04:00 1,494,528 -c–a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
+ 2006-02-28 12:00:00 1,492,480 -c–a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
- 2007-10-26 03:36:51 8,454,656 -c–a-w C:\WINDOWS\system32\dllcache\shell32.dll
+ 2006-02-28 12:00:00 8,384,000 -c–a-w C:\WINDOWS\system32\dllcache\shell32.dll
- 2008-04-21 07:04:00 474,112 -c–a-w C:\WINDOWS\system32\dllcache\shlwapi.dll
+ 2006-02-28 12:00:00 474,112 -c–a-w C:\WINDOWS\system32\dllcache\shlwapi.dll
- 2006-12-19 21:52:18 134,656 -c–a-w C:\WINDOWS\system32\dllcache\shsvcs.dll
+ 2006-02-28 12:00:00 134,656 -c–a-w C:\WINDOWS\system32\dllcache\shsvcs.dll
- 2005-06-10 23:53:32 57,856 -c–a-w C:\WINDOWS\system32\dllcache\spoolsv.exe
+ 2006-02-28 12:00:00 57,856 -c–a-w C:\WINDOWS\system32\dllcache\spoolsv.exe
- 2006-08-14 10:34:41 332,928 -c–a-w C:\WINDOWS\system32\dllcache\srv.sys
+ 2006-02-28 12:00:00 336,256 -c–a-w C:\WINDOWS\system32\dllcache\srv.sys
- 2004-12-07 19:32:34 96,768 -c–a-w C:\WINDOWS\system32\dllcache\srvsvc.dll
+ 2006-02-28 12:00:00 96,768 -c–a-w C:\WINDOWS\system32\dllcache\srvsvc.dll
- 2006-08-21 08:52:08 246,814 -c–a-w C:\WINDOWS\system32\dllcache\strmdll.dll
+ 2006-02-28 12:00:00 246,302 -c–a-w C:\WINDOWS\system32\dllcache\strmdll.dll
- 2006-10-19 13:56:32 713,216 -c–a-w C:\WINDOWS\system32\dllcache\sxs.dll
+ 2006-02-28 12:00:00 713,216 -c–a-w C:\WINDOWS\system32\dllcache\sxs.dll
- 2005-10-17 21:14:46 118,272 -c–a-w C:\WINDOWS\system32\dllcache\t2embed.dll
+ 2006-02-28 12:00:00 210,432 -c–a-w C:\WINDOWS\system32\dllcache\t2embed.dll
- 2005-07-08 16:27:56 249,344 -c–a-w C:\WINDOWS\system32\dllcache\tapisrv.dll
+ 2006-02-28 12:00:00 246,272 -c–a-w C:\WINDOWS\system32\dllcache\tapisrv.dll
- 2007-10-30 17:20:55 360,064 -c–a-w C:\WINDOWS\system32\dllcache\tcpip.sys
+ 2006-02-28 12:00:00 359,040 -c–a-w C:\WINDOWS\system32\dllcache\tcpip.sys
- 2006-08-16 09:37:30 225,664 -c–a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
+ 2006-02-28 12:00:00 223,616 -c–a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
- 2005-05-10 23:45:48 75,776 -c–a-w C:\WINDOWS\system32\dllcache\telnet.exe
+ 2006-02-28 12:00:00 75,264 -c–a-w C:\WINDOWS\system32\dllcache\telnet.exe
- 2005-07-26 04:39:49 101,376 -c–a-w C:\WINDOWS\system32\dllcache\txflog.dll
+ 2006-02-28 12:00:00 101,376 -c–a-w C:\WINDOWS\system32\dllcache\txflog.dll
- 2005-08-23 03:35:42 123,392 -c–a-w C:\WINDOWS\system32\dllcache\umpnpmgr.dll
+ 2006-02-28 12:00:00 118,272 -c–a-w C:\WINDOWS\system32\dllcache\umpnpmgr.dll
- 2007-06-26 21:10:26 317,440 -c–a-w C:\WINDOWS\system32\dllcache\unregmp2.exe
+ 2006-02-28 12:00:00 208,896 -c–a-w C:\WINDOWS\system32\dllcache\unregmp2.exe
- 2007-04-23 10:32:54 364,160 -c–a-w C:\WINDOWS\system32\dllcache\update.sys
+ 2006-02-28 12:00:00 209,408 -c–a-w C:\WINDOWS\system32\dllcache\update.sys
- 2007-02-05 20:17:02 185,344 -c–a-w C:\WINDOWS\system32\dllcache\upnphost.dll
+ 2006-02-28 12:00:00 185,344 -c–a-w C:\WINDOWS\system32\dllcache\upnphost.dll
- 2008-04-23 04:16:28 105,984 -c—-w C:\WINDOWS\system32\dllcache\url.dll
+ 2006-02-28 12:00:00 37,888 -c–a-w C:\WINDOWS\system32\dllcache\url.dll
- 2008-04-23 04:16:29 1,159,680 -c—-w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2006-02-28 12:00:00 612,352 -c–a-w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2007-03-08 15:36:28 577,536 -c–a-w C:\WINDOWS\system32\dllcache\user32.dll
+ 2006-02-28 12:00:00 577,024 -c–a-w C:\WINDOWS\system32\dllcache\user32.dll
- 2007-08-13 17:54:10 413,696 -c–a-w C:\WINDOWS\system32\dllcache\vbscript.dll
+ 2006-02-28 12:00:00 417,792 -c–a-w C:\WINDOWS\system32\dllcache\vbscript.dll
- 2007-07-12 23:31:54 765,952 -c–a-w C:\WINDOWS\system32\dllcache\vgx.dll
+ 2006-02-28 12:00:00 848,384 -c–a-w C:\WINDOWS\system32\dllcache\vgx.dll
- 2007-05-16 15:12:12 510,976 -c–a-w C:\WINDOWS\system32\dllcache\wab32.dll
+ 2006-02-28 12:00:00 504,832 -c–a-w C:\WINDOWS\system32\dllcache\wab32.dll
- 2007-05-16 15:12:15 85,504 -c–a-w C:\WINDOWS\system32\dllcache\wabimp.dll
+ 2006-02-28 12:00:00 84,992 -c–a-w C:\WINDOWS\system32\dllcache\wabimp.dll
- 2006-03-24 04:37:50 49,152 -c–a-w C:\WINDOWS\system32\dllcache\wdigest.dll
+ 2006-02-28 12:00:00 49,152 -c–a-w C:\WINDOWS\system32\dllcache\wdigest.dll
- 2008-04-23 04:16:29 233,472 -c—-w C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2006-02-28 12:00:00 276,480 -c–a-w C:\WINDOWS\system32\dllcache\webcheck.dll
- 2006-01-04 03:35:05 68,096 -c–a-w C:\WINDOWS\system32\dllcache\webclnt.dll
+ 2006-02-28 12:00:00 67,584 -c–a-w C:\WINDOWS\system32\dllcache\webclnt.dll
- 2006-12-19 18:16:47 333,824 -c–a-w C:\WINDOWS\system32\dllcache\wiaservc.dll
+ 2006-02-28 12:00:00 333,312 -c–a-w C:\WINDOWS\system32\dllcache\wiaservc.dll
- 2008-03-19 09:47:00 1,845,248 -c–a-w C:\WINDOWS\system32\dllcache\win32k.sys
+ 2006-02-28 12:00:00 1,835,904 -c–a-w C:\WINDOWS\system32\dllcache\win32k.sys
- 2008-04-23 04:16:29 826,368 -c—-w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2006-02-28 12:00:00 656,384 -c–a-w C:\WINDOWS\system32\dllcache\wininet.dll
- 2007-03-17 13:43:01 292,864 -c–a-w C:\WINDOWS\system32\dllcache\winsrv.dll
+ 2006-02-28 12:00:00 290,816 -c–a-w C:\WINDOWS\system32\dllcache\winsrv.dll
- 2006-08-17 12:28:27 132,096 -c–a-w C:\WINDOWS\system32\dllcache\wkssvc.dll
+ 2006-02-28 12:00:00 132,096 -c–a-w C:\WINDOWS\system32\dllcache\wkssvc.dll
- 2006-10-18 20:47:18 757,248 -c–a-w C:\WINDOWS\system32\dllcache\WMADMOD.dll
+ 2006-02-28 12:00:00 408,064 -c–a-w C:\WINDOWS\system32\dllcache\wmadmod.dll
- 2006-10-18 20:47:18 1,117,696 -c–a-w C:\WINDOWS\system32\dllcache\WMADMOE.dll
+ 2006-02-28 12:00:00 670,720 -c–a-w C:\WINDOWS\system32\dllcache\wmadmoe.dll
- 2007-10-27 16:40:30 222,720 -c–a-w C:\WINDOWS\system32\dllcache\wmasf.dll
+ 2006-02-28 12:00:00 230,400 -c–a-w C:\WINDOWS\system32\dllcache\wmasf.dll
- 2006-10-18 20:47:18 33,792 -c–a-w C:\WINDOWS\system32\dllcache\wmdmlog.dll
+ 2006-02-28 12:00:00 27,136 -c–a-w C:\WINDOWS\system32\dllcache\wmdmlog.dll
- 2006-10-18 20:47:18 37,376 -c–a-w C:\WINDOWS\system32\dllcache\wmdmps.dll
+ 2006-02-28 12:00:00 23,552 -c–a-w C:\WINDOWS\system32\dllcache\wmdmps.dll
- 2006-10-18 20:47:20 227,328 -c–a-w C:\WINDOWS\system32\dllcache\wmerror.dll
+ 2006-02-28 12:00:00 168,448 -c–a-w C:\WINDOWS\system32\dllcache\wmerror.dll
- 2006-10-18 20:47:20 157,184 -c–a-w C:\WINDOWS\system32\dllcache\wmidx.dll
+ 2006-02-28 12:00:00 151,552 -c–a-w C:\WINDOWS\system32\dllcache\wmidx.dll
- 2006-10-18 20:47:20 937,984 -c–a-w C:\WINDOWS\system32\dllcache\WMNetMgr.dll
+ 2006-02-28 12:00:00 1,050,624 -c–a-w C:\WINDOWS\system32\dllcache\wmnetmgr.dll
- 2007-06-11 22:51:12 10,834,944 -c–a-w C:\WINDOWS\system32\dllcache\wmp.dll
+ 2006-02-28 12:00:00 4,874,240 -c–a-w C:\WINDOWS\system32\dllcache\wmp.dll
- 2006-10-18 20:47:20 242,688 -c–a-w C:\WINDOWS\system32\dllcache\wmpasf.dll
+ 2006-02-28 12:00:00 114,688 -c–a-w C:\WINDOWS\system32\dllcache\wmpasf.dll
- 2006-10-18 20:47:20 96,256 -c–a-w C:\WINDOWS\system32\dllcache\wmpband.dll
+ 2006-02-28 12:00:00 98,304 -c–a-w C:\WINDOWS\system32\dllcache\wmpband.dll
- 2006-10-18 20:47:20 314,880 -c–a-w C:\WINDOWS\system32\dllcache\wmpdxm.dll
+ 2006-02-28 12:00:00 233,472 -c–a-w C:\WINDOWS\system32\dllcache\wmpdxm.dll
- 2006-10-18 20:46:20 64,000 -c–a-w C:\WINDOWS\system32\dllcache\wmplayer.exe
+ 2006-02-28 12:00:00 73,728 -c–a-w C:\WINDOWS\system32\dllcache\wmplayer.exe
- 2006-10-18 20:47:20 8,231,936 -c–a-w C:\WINDOWS\system32\dllcache\wmploc.dll
+ 2006-02-28 12:00:00 2,940,928 -c–a-w C:\WINDOWS\system32\dllcache\wmploc.dll
- 2006-10-18 20:47:20 99,840 -c–a-w C:\WINDOWS\system32\dllcache\wmpshell.dll
+ 2006-02-28 12:00:00 102,400 -c–a-w C:\WINDOWS\system32\dllcache\wmpshell.dll
- 2006-10-18 20:47:22 4,096 -c–a-w C:\WINDOWS\system32\dllcache\wmsdmod.dll
+ 2006-02-28 12:00:00 759,296 -c–a-w C:\WINDOWS\system32\dllcache\wmsdmod.dll
- 2006-10-18 20:47:22 4,096 -c–a-w C:\WINDOWS\system32\dllcache\wmsdmoe2.dll
+ 2006-02-28 12:00:00 1,119,744 -c–a-w C:\WINDOWS\system32\dllcache\wmsdmoe2.dll
- 2006-10-18 20:47:22 603,648 -c–a-w C:\WINDOWS\system32\dllcache\WMSPDMOD.dll
+ 2006-02-28 12:00:00 484,864 -c–a-w C:\WINDOWS\system32\dllcache\wmspdmod.dll
- 2006-10-18 20:47:22 1,329,152 -c–a-w C:\WINDOWS\system32\dllcache\WMSPDMOE.dll
+ 2006-02-28 12:00:00 896,512 -c–a-w C:\WINDOWS\system32\dllcache\wmspdmoe.dll
- 2006-10-18 20:47:22 2,450,944 -c–a-w C:\WINDOWS\system32\dllcache\wmvcore.dll
+ 2006-02-28 12:00:00 2,105,344 -c–a-w C:\WINDOWS\system32\dllcache\wmvcore.dll
- 2006-10-18 20:47:22 4,096 -c–a-w C:\WINDOWS\system32\dllcache\wmvdmod.dll
+ 2006-02-28 12:00:00 809,984 -c–a-w C:\WINDOWS\system32\dllcache\wmvdmod.dll
- 2006-10-18 20:47:22 4,096 -c–a-w C:\WINDOWS\system32\dllcache\wmvdmoe2.dll
+ 2006-02-28 12:00:00 1,001,472 -c–a-w C:\WINDOWS\system32\dllcache\wmvdmoe2.dll
- 2007-07-30 18:19:36 549,720 -c–a-w C:\WINDOWS\system32\dllcache\wuapi.dll
+ 2006-02-28 12:00:00 430,592 -c–a-w C:\WINDOWS\system32\dllcache\wuapi.dll
- 2007-07-30 18:19:16 53,080 -c–a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
+ 2006-02-28 12:00:00 111,104 -c–a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
- 2007-07-30 18:19:42 1,712,984 -c–a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
+ 2006-02-28 12:00:00 1,134,592 -c–a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
- 2007-07-30 18:19:32 325,976 -c–a-w C:\WINDOWS\system32\dllcache\wucltui.dll
+ 2006-02-28 12:00:00 112,640 -c–a-w C:\WINDOWS\system32\dllcache\wucltui.dll
- 2007-07-30 18:19:28 203,096 -c–a-w C:\WINDOWS\system32\dllcache\wuweb.dll
+ 2006-02-28 12:00:00 120,320 -c–a-w C:\WINDOWS\system32\dllcache\wuweb.dll
- 2006-03-01 19:42:42 11,776 -c–a-w C:\WINDOWS\system32\dllcache\xolehlp.dll
+ 2006-02-28 12:00:00 11,776 -c–a-w C:\WINDOWS\system32\dllcache\xolehlp.dll
- 2008-02-20 05:32:43 148,992 —-a-w C:\WINDOWS\system32\dnsapi.dll
+ 2006-02-28 12:00:00 148,480 —-a-w C:\WINDOWS\system32\dnsapi.dll
- 2008-02-20 05:32:43 45,568 —-a-w C:\WINDOWS\system32\dnsrslvr.dll
+ 2006-02-28 12:00:00 45,568 —-a-w C:\WINDOWS\system32\dnsrslvr.dll
- 2006-02-15 00:22:26 142,464 —-a-w C:\WINDOWS\system32\drivers\aec.sys
+ 2006-02-28 12:00:00 142,464 —-a-w C:\WINDOWS\system32\drivers\aec.sys
+ 2006-02-28 12:00:00 42,368 —-a-w C:\WINDOWS\system32\drivers\agp440.sys
+ 2006-02-28 12:00:00 44,928 —-a-w C:\WINDOWS\system32\drivers\agpcpq.sys
+ 2006-02-28 12:00:00 42,752 —-a-w C:\WINDOWS\system32\drivers\alim1541.sys
+ 2006-02-28 12:00:00 43,008 —-a-w C:\WINDOWS\system32\drivers\amdagp.sys
+ 2002-04-17 19:27:02 11,264 —-a-w C:\WINDOWS\system32\drivers\asapiW2k.sys
- 2008-06-13 13:10:50 272,128 ——w C:\WINDOWS\system32\drivers\bthport.sys
+ 2006-02-28 12:00:00 274,304 —-a-w C:\WINDOWS\system32\drivers\bthport.sys
+ 2004-08-03 22:10:18 17,024 —-a-w C:\WINDOWS\system32\drivers\CCDECODE.sys
- 2004-08-03 22:08:00 60,288 —-a-w C:\WINDOWS\system32\drivers\drmk.sys
+ 2006-02-28 12:00:00 60,288 —-a-w C:\WINDOWS\system32\drivers\drmk.sys
- 2004-08-03 22:07:58 2,944 —-a-w C:\WINDOWS\system32\drivers\drmkaud.sys
+ 2006-02-28 12:00:00 2,944 —-a-w C:\WINDOWS\system32\drivers\drmkaud.sys
+ 2008-06-10 17:47:42 39,944 —-a-w C:\WINDOWS\system32\drivers\eamon.sys
+ 2008-06-10 17:48:38 53,256 —-a-w C:\WINDOWS\system32\drivers\easdrv.sys
+ 2008-06-10 17:56:04 71,688 —-a-w C:\WINDOWS\system32\drivers\epfw.sys
+ 2008-06-10 17:56:08 30,728 —-a-w C:\WINDOWS\system32\drivers\epfwndis.sys
+ 2008-06-10 17:56:08 54,280 —-a-w C:\WINDOWS\system32\drivers\epfwtdi.sys
- 2006-08-21 09:14:58 128,896 —-a-w C:\WINDOWS\system32\drivers\fltmgr.sys
+ 2006-02-28 12:00:00 124,800 —-a-w C:\WINDOWS\system32\drivers\fltMgr.sys
+ 2006-02-28 12:00:00 46,464 —-a-w C:\WINDOWS\system32\drivers\gagp30kx.sys
- 2006-03-17 00:33:10 262,784 —-a-w C:\WINDOWS\system32\drivers\http.sys
+ 2006-02-28 12:00:00 263,040 —-a-w C:\WINDOWS\system32\drivers\http.sys
- 2004-09-29 22:28:37 134,912 —-a-w C:\WINDOWS\system32\drivers\ipnat.sys
+ 2006-02-28 12:00:00 134,912 —-a-w C:\WINDOWS\system32\drivers\ipnat.sys
- 2006-06-14 08:47:45 172,416 —-a-w C:\WINDOWS\system32\drivers\kmixer.sys
+ 2006-02-28 12:00:00 171,776 —-a-w C:\WINDOWS\system32\drivers\kmixer.sys
- 2004-08-03 22:15:22 140,928 —-a-w C:\WINDOWS\system32\drivers\ks.sys
+ 2006-02-28 12:00:00 140,928 —-a-w C:\WINDOWS\system32\drivers\ks.sys
+ 2007-10-12 00:56:00 1,279,000 —-a-w C:\WINDOWS\system32\drivers\LV302V32.SYS
+ 2007-10-19 12:16:30 2,109,976 —-a-w C:\WINDOWS\system32\drivers\Lvckap.sys
+ 2007-10-11 17:59:02 2,142,488 —-a-w C:\WINDOWS\system32\drivers\LVMVdrv.sys
+ 2007-10-11 17:59:24 25,624 —-a-w C:\WINDOWS\system32\drivers\LVPr2Mon.sys
+ 2007-10-12 01:00:44 41,752 —-a-w C:\WINDOWS\system32\drivers\LVUSBSta.sys
- 2007-12-18 09:51:35 179,584 —-a-w C:\WINDOWS\system32\drivers\mrxdav.sys
+ 2006-02-28 12:00:00 181,248 —-a-w C:\WINDOWS\system32\drivers\mrxdav.sys
- 2006-05-05 09:41:45 453,120 —-a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
+ 2006-02-28 12:00:00 451,456 —-a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
- 2004-08-03 21:58:42 7,552 —-a-w C:\WINDOWS\system32\drivers\MSKSSRV.sys
+ 2006-02-28 12:00:00 7,552 —-a-w C:\WINDOWS\system32\drivers\mskssrv.sys
- 2004-08-03 21:58:40 5,376 —-a-w C:\WINDOWS\system32\drivers\MSPCLOCK.sys
+ 2006-02-28 12:00:00 5,376 —-a-w C:\WINDOWS\system32\drivers\mspclock.sys
- 2004-08-03 21:58:42 4,992 —-a-w C:\WINDOWS\system32\drivers\MSPQM.sys
+ 2006-02-28 12:00:00 4,992 —-a-w C:\WINDOWS\system32\drivers\mspqm.sys
+ 2004-08-03 21:58:40 5,504 —-a-w C:\WINDOWS\system32\drivers\MSTEE.sys
+ 2004-08-03 22:10:30 85,376 —-a-w C:\WINDOWS\system32\drivers\NABTSFEC.sys
+ 2006-02-28 12:00:00 10,880 —-a-w C:\WINDOWS\system32\drivers\ndisip.sys
- 2007-02-09 11:10:35 574,464 —-a-w C:\WINDOWS\system32\drivers\ntfs.sys
+ 2006-02-28 12:00:00 574,592 —-a-w C:\WINDOWS\system32\drivers\ntfs.sys
- 2004-03-16 09:58:20 136,960 —-a-w C:\WINDOWS\system32\drivers\portcls.sys
+ 2006-02-28 12:00:00 145,792 —-a-w C:\WINDOWS\system32\drivers\portcls.sys
- 2006-05-05 09:47:57 174,592 —-a-w C:\WINDOWS\system32\drivers\rdbss.sys
+ 2006-02-28 12:00:00 176,512 —-a-w C:\WINDOWS\system32\drivers\rdbss.sys
- 2005-06-10 04:09:46 139,528 —-a-w C:\WINDOWS\system32\drivers\rdpwd.sys
+ 2006-02-28 12:00:00 139,400 —-a-w C:\WINDOWS\system32\drivers\rdpwd.sys
- 2008-05-08 12:28:49 202,752 —-a-w C:\WINDOWS\system32\drivers\rmcast.sys
+ 2006-02-28 12:00:00 200,064 —-a-w C:\WINDOWS\system32\drivers\RMCast.sys
- 2007-11-13 10:25:53 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
+ 2006-02-28 12:00:00 27,440 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
+ 2006-02-28 12:00:00 41,088 —-a-w C:\WINDOWS\system32\drivers\sisagp.sys
+ 2006-02-28 12:00:00 11,136 —-a-w C:\WINDOWS\system32\drivers\slip.sys
- 2006-06-14 08:47:46 6,400 —-a-w C:\WINDOWS\system32\drivers\splitter.sys
+ 2004-08-03 22:07:48 6,400 —-a-w C:\WINDOWS\system32\drivers\splitter.sys
- 2006-08-14 10:34:41 332,928 —-a-w C:\WINDOWS\system32\drivers\srv.sys
+ 2006-02-28 12:00:00 336,256 —-a-w C:\WINDOWS\system32\drivers\srv.sys
- 2004-08-03 22:08:04 48,640 —-a-w C:\WINDOWS\system32\drivers\stream.sys
+ 2006-02-28 12:00:00 48,640 —-a-w C:\WINDOWS\system32\drivers\stream.sys
+ 2006-02-28 12:00:00 15,360 —-a-w C:\WINDOWS\system32\drivers\streamip.sys
- 2001-08-17 13:00:52 54,272 —-a-w C:\WINDOWS\system32\drivers\swmidi.sys
+ 2006-02-28 12:00:00 54,272 —-a-w C:\WINDOWS\system32\drivers\swmidi.sys
- 2004-08-03 22:15:56 60,800 —-a-w C:\WINDOWS\system32\drivers\sysaudio.sys
+ 2006-02-28 12:00:00 60,800 —-a-w C:\WINDOWS\system32\drivers\sysaudio.sys
- 2007-10-30 17:20:55 360,064 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
+ 2006-02-28 12:00:00 359,040 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
- 2006-08-16 09:37:30 225,664 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
+ 2006-02-28 12:00:00 223,616 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
+ 2006-02-28 12:00:00 44,672 —-a-w C:\WINDOWS\system32\drivers\uagp35.sys
- 2007-04-23 10:32:54 364,160 —-a-w C:\WINDOWS\system32\drivers\update.sys
+ 2006-02-28 12:00:00 209,408 —-a-w C:\WINDOWS\system32\drivers\update.sys
+ 2004-08-03 22:07:56 59,264 —-a-w C:\WINDOWS\system32\drivers\USBAUDIO.sys
+ 2006-02-28 12:00:00 42,240 —-a-w C:\WINDOWS\system32\drivers\viaagp.sys
+ 2003-08-01 13:47:24 29,239 —-a-w C:\WINDOWS\system32\drivers\vobid.sys
- 2006-06-14 09:00:45 82,944 —-a-w C:\WINDOWS\system32\drivers\wdmaud.sys
+ 2006-02-28 12:00:00 82,944 —-a-w C:\WINDOWS\system32\drivers\wdmaud.sys
+ 2004-08-03 22:10:22 19,328 —-a-w C:\WINDOWS\system32\drivers\WSTCODEC.SYS
- 2006-10-18 20:47:10 991,744 —-a-w C:\WINDOWS\system32\drmv2clt.dll
+ 2006-02-28 12:00:00 695,296 —-a-w C:\WINDOWS\system32\drmv2clt.dll
+ 2008-07-22 19:32:44 32,000 -c–a-w C:\WINDOWS\system32\DRVSTORE\usbaapl_97B931EF204A3188AFFD15A9A5337268E8B6F312\usbaapl.sys
- 2006-08-22 03:05:26 498,742 —-a-w C:\WINDOWS\system32\dxmasf.dll
+ 2006-02-28 12:00:00 498,205 —-a-w C:\WINDOWS\system32\dxmasf.dll
- 2008-04-23 04:16:28 347,136 —-a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2006-02-28 12:00:00 357,888 —-a-w C:\WINDOWS\system32\dxtmsft.dll
- 2008-04-23 04:16:28 214,528 —-a-w C:\WINDOWS\system32\dxtrans.dll
+ 2006-02-28 12:00:00 201,728 —-a-w C:\WINDOWS\system32\dxtrans.dll
+ 2006-02-28 12:00:00 514,587 —-a-w C:\WINDOWS\system32\edb500.dll
- 2008-04-23 21:42:54 21,640 —-a-w C:\WINDOWS\system32\emptyregdb.dat
+ 2008-08-23 19:05:39 22,720 —-a-w C:\WINDOWS\system32\emptyregdb.dat
- 2005-07-26 04:39:45 243,200 —-a-w C:\WINDOWS\system32\es.dll
+ 2006-02-28 12:00:00 243,200 —-a-w C:\WINDOWS\system32\es.dll
- 2005-10-20 22:20:03 1,082,368 —-a-w C:\WINDOWS\system32\esent.dll
+ 2006-02-28 12:00:00 1,082,368 —-a-w C:\WINDOWS\system32\esent.dll
- 2008-04-23 04:16:28 133,120 ——w C:\WINDOWS\system32\extmgr.dll
+ 2006-02-28 12:00:00 55,808 —-a-w C:\WINDOWS\system32\extmgr.dll
- 2006-08-21 12:21:06 16,896 —-a-w C:\WINDOWS\system32\fltlib.dll
+ 2006-02-28 12:00:00 16,896 —-a-w C:\WINDOWS\system32\fltlib.dll
- 2006-08-21 09:14:58 23,040 —-a-w C:\WINDOWS\system32\fltmc.exe
+ 2006-02-28 12:00:00 22,528 —-a-w C:\WINDOWS\system32\fltMc.exe
- 2008-06-25 14:26:10 272,288 —-a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-08-23 20:15:46 271,520 —-a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2005-10-17 21:14:45 80,896 —-a-w C:\WINDOWS\system32\fontsub.dll
+ 2006-02-28 12:00:00 79,360 —-a-w C:\WINDOWS\system32\fontsub.dll
- 2008-02-20 06:51:05 282,624 —-a-w C:\WINDOWS\system32\gdi32.dll
+ 2006-02-28 12:00:00 278,016 —-a-w C:\WINDOWS\system32\gdi32.dll
+ 1998-06-13 21:53:26 44,544 —-a-w C:\WINDOWS\system32\Gif89.dll
- 2005-05-27 02:04:27 41,472 —-a-w C:\WINDOWS\system32\hhsetup.dll
+ 2006-02-28 12:00:00 38,912 —-a-w C:\WINDOWS\system32\hhsetup.dll
- 2004-08-04 00:56:44 21,504 —-a-w C:\WINDOWS\system32\hidserv.dll
+ 2006-02-28 12:00:00 21,504 —-a-w C:\WINDOWS\system32\hidserv.dll
- 2006-07-21 08:24:43 72,704 —-a-w C:\WINDOWS\system32\hlink.dll
+ 2006-02-28 12:00:00 77,850 —-a-w C:\WINDOWS\system32\hlink.dll
- 2004-11-17 17:41:24 347,136 —-a-w C:\WINDOWS\system32\hypertrm.dll
+ 2006-02-28 12:00:00 345,088 —-a-w C:\WINDOWS\system32\hypertrm.dll
- 2005-06-29 01:46:00 254,976 —-a-w C:\WINDOWS\system32\icm32.dll
+ 2006-02-28 12:00:00 253,952 —-a-w C:\WINDOWS\system32\icm32.dll
- 2008-04-22 07:39:58 70,656 ——w C:\WINDOWS\system32\ie4uinit.exe
+ 2006-02-28 12:00:00 34,304 —-a-w C:\WINDOWS\system32\ie4uinit.exe
- 2008-04-23 04:16:28 153,088 ——w C:\WINDOWS\system32\ieakeng.dll
+ 2006-02-28 12:00:00 139,264 —-a-w C:\WINDOWS\system32\ieakeng.dll
- 2008-04-23 04:16:28 230,400 ——w C:\WINDOWS\system32\ieaksie.dll
+ 2006-02-28 12:00:00 216,576 —-a-w C:\WINDOWS\system32\ieaksie.dll
- 2008-04-20 05:07:51 161,792 ——w C:\WINDOWS\system32\ieakui.dll
+ 2006-02-28 12:00:00 221,184 —-a-w C:\WINDOWS\system32\ieakui.dll
- 2008-04-23 04:16:28 384,512 ——w C:\WINDOWS\system32\iedkcs32.dll
+ 2006-02-28 12:00:00 323,584 —-a-w C:\WINDOWS\system32\iedkcs32.dll
- 2007-08-13 17:45:18 78,336 —-a-w C:\WINDOWS\system32\ieencode.dll
+ 2006-02-28 12:00:00 81,920 —-a-w C:\WINDOWS\system32\ieencode.dll
- 2007-08-13 17:54:10 191,488 —-a-w C:\WINDOWS\system32\iepeers.dll
+ 2006-02-28 12:00:00 251,392 —-a-w C:\WINDOWS\system32\iepeers.dll
- 2008-04-23 04:16:28 44,544 ——w C:\WINDOWS\system32\iernonce.dll
+ 2006-02-28 12:00:00 48,640 —-a-w C:\WINDOWS\system32\iernonce.dll
- 2007-08-13 17:39:12 55,296 —-a-w C:\WINDOWS\system32\iesetup.dll
+ 2006-02-28 12:00:00 62,976 —-a-w C:\WINDOWS\system32\iesetup.dll
- 2007-08-13 17:36:06 36,352 —-a-w C:\WINDOWS\system32\imgutil.dll
+ 2006-02-28 12:00:00 35,840 —-a-w C:\WINDOWS\system32\imgutil.dll
- 2007-08-21 06:15:44 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
+ 2006-02-28 12:00:00 678,400 —-a-w C:\WINDOWS\system32\inetcomm.dll
- 2007-08-13 17:39:02 92,672 —-a-w C:\WINDOWS\system32\inseng.dll
+ 2006-02-28 12:00:00 96,256 —-a-w C:\WINDOWS\system32\inseng.dll
- 2006-05-19 12:59:41 94,720 —-a-w C:\WINDOWS\system32\iphlpapi.dll
+ 2006-02-28 12:00:00 94,720 —-a-w C:\WINDOWS\system32\iphlpapi.dll
- 2005-05-27 02:04:27 155,136 —-a-w C:\WINDOWS\system32\itircl.dll
+ 2006-02-28 12:00:00 143,872 —-a-w C:\WINDOWS\system32\itircl.dll
- 2005-05-27 02:04:27 137,216 —-a-w C:\WINDOWS\system32\itss.dll
+ 2006-02-28 12:00:00 134,144 —-a-w C:\WINDOWS\system32\itss.dll
- 2006-06-01 18:47:07 163,840 —-a-w C:\WINDOWS\system32\jgdw400.dll
+ 2006-02-28 12:00:00 144,896 —-a-w C:\WINDOWS\system32\jgdw400.dll
- 2006-06-01 18:47:07 27,648 —-a-w C:\WINDOWS\system32\jgpl400.dll
+ 2006-02-28 12:00:00 42,496 —-a-w C:\WINDOWS\system32\jgpl400.dll
- 2007-08-13 17:38:04 491,520 —-a-w C:\WINDOWS\system32\jscript.dll
+ 2006-02-28 12:00:00 450,560 —-a-w C:\WINDOWS\system32\jscript.dll
- 2008-04-23 04:16:28 27,648 ——w C:\WINDOWS\system32\jsproxy.dll
+ 2006-02-28 12:00:00 15,872 —-a-w C:\WINDOWS\system32\jsproxy.dll
- 2005-06-15 17:49:30 295,936 —-a-w C:\WINDOWS\system32\kerberos.dll
+ 2006-02-28 12:00:00 294,400 —-a-w C:\WINDOWS\system32\kerberos.dll
- 2007-04-16 15:52:53 984,576 —-a-w C:\WINDOWS\system32\kernel32.dll
+ 2006-02-28 12:00:00 983,552 —-a-w C:\WINDOWS\system32\kernel32.dll
- 2006-10-18 20:47:14 11,264 —-a-w C:\WINDOWS\system32\LAPRXY.dll
+ 2006-02-28 12:00:00 6,656 —-a-w C:\WINDOWS\system32\laprxy.dll
- 2007-08-13 17:44:18 40,960 —-a-w C:\WINDOWS\system32\licmgr10.dll
+ 2006-02-28 12:00:00 22,016 —-a-w C:\WINDOWS\system32\licmgr10.dll
- 2005-09-01 01:41:53 19,968 —-a-w C:\WINDOWS\system32\linkinfo.dll
+ 2006-02-28 12:00:00 18,944 —-a-w C:\WINDOWS\system32\linkinfo.dll
- 2006-10-18 19:03:58 100,864 —-a-w C:\WINDOWS\system32\logagent.exe
+ 2006-02-28 12:00:00 103,936 —-a-w C:\WINDOWS\system32\logagent.exe
- 2007-11-07 09:26:56 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
+ 2006-02-28 12:00:00 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
+ 2007-10-12 00:57:42 195,096 —-a-w C:\WINDOWS\system32\lvci1150.dll
+ 2007-10-12 00:57:30 416,280 —-a-w C:\WINDOWS\system32\lvcodec2.dll
+ 2007-10-12 01:00:22 490,008 —-a-w C:\WINDOWS\system32\LVUI2.dll
+ 2007-10-12 01:00:34 465,432 —-a-w C:\WINDOWS\system32\LVUI2RC.dll
- 2007-03-08 15:36:28 40,960 —-a-w C:\WINDOWS\system32\mf3216.dll
+ 2006-02-28 12:00:00 39,936 —-a-w C:\WINDOWS\system32\mf3216.dll
- 2006-11-01 19:17:45 927,504 —-a-w C:\WINDOWS\system32\mfc40u.dll
+ 2006-02-28 12:00:00 924,432 —-a-w C:\WINDOWS\system32\mfc40u.dll
- 2006-10-14 08:13:25 981,760 —-a-w C:\WINDOWS\system32\mfc42u.dll
+ 2006-02-28 12:00:00 1,024,000 —-a-w C:\WINDOWS\system32\mfc42u.dll
- 2006-10-18 20:47:14 4,096 —-a-w C:\WINDOWS\system32\MP43DMOD.dll
+ 2006-02-28 12:00:00 310,272 —-a-w C:\WINDOWS\system32\mp43dmod.dll
- 2006-10-18 20:47:14 4,096 —-a-w C:\WINDOWS\system32\MP4SDMOD.dll
+ 2006-02-28 12:00:00 384,512 —-a-w C:\WINDOWS\system32\mp4sdmod.dll
- 2006-10-18 20:47:14 4,096 —-a-w C:\WINDOWS\system32\MPG4DMOD.dll
+ 2006-02-28 12:00:00 240,640 —-a-w C:\WINDOWS\system32\mpg4dmod.dll
- 2008-05-29 23:35:11 17,486,968 —-a-w C:\WINDOWS\system32\MRT.exe
+ 2008-06-25 16:15:46 17,972,344 —-a-w C:\WINDOWS\system32\MRT.exe
- 2005-06-29 01:46:00 74,240 —-a-w C:\WINDOWS\system32\mscms.dll
+ 2006-02-28 12:00:00 73,728 —-a-w C:\WINDOWS\system32\mscms.dll
- 2008-02-26 11:59:50 294,912 —-a-w C:\WINDOWS\system32\msctf.dll
+ 2006-02-28 12:00:00 294,400 —-a-w C:\WINDOWS\system32\MSCTF.dll
- 2006-03-01 19:42:42 426,496 —-a-w C:\WINDOWS\system32\msdtcprx.dll
+ 2006-02-28 12:00:00 425,472 —-a-w C:\WINDOWS\system32\msdtcprx.dll
- 2006-03-01 19:42:42 956,416 —-a-w C:\WINDOWS\system32\msdtctm.dll
+ 2006-02-28 12:00:00 949,248 —-a-w C:\WINDOWS\system32\msdtctm.dll
- 2006-03-01 19:42:42 161,280 —-a-w C:\WINDOWS\system32\msdtcuiu.dll
+ 2006-02-28 12:00:00 161,280 —-a-w C:\WINDOWS\system32\msdtcuiu.dll
- 2008-03-25 04:50:28 518,944 —-a-w C:\WINDOWS\system32\msexch40.dll
+ 2006-02-28 12:00:00 512,029 —-a-w C:\WINDOWS\system32\msexch40.dll
- 2008-03-25 04:50:30 326,432 —-a-w C:\WINDOWS\system32\msexcl40.dll
+ 2006-02-28 12:00:00 319,517 —-a-w C:\WINDOWS\system32\msexcl40.dll
- 2006-11-27 14:54:06 539,136 —-a-w C:\WINDOWS\system32\msftedit.dll
+ 2006-02-28 12:00:00 537,088 —-a-w C:\WINDOWS\system32\msftedit.dll
- 2007-08-13 17:32:30 45,568 —-a-w C:\WINDOWS\system32\mshta.exe
+ 2006-02-28 12:00:00 29,184 —-a-w C:\WINDOWS\system32\mshta.exe
- 2008-04-23 21:16:30 3,591,680 —-a-w C:\WINDOWS\system32\mshtml.dll
+ 2006-02-28 12:00:00 3,049,472 —-a-w C:\WINDOWS\system32\mshtml.dll
- 2008-04-23 04:16:28 478,208 —-a-w C:\WINDOWS\system32\mshtmled.dll
+ 2006-02-28 12:00:00 448,512 —-a-w C:\WINDOWS\system32\mshtmled.dll
- 2007-08-13 17:01:12 48,128 —-a-w C:\WINDOWS\system32\mshtmler.dll
+ 2006-02-28 12:00:00 56,832 —-a-w C:\WINDOWS\system32\mshtmler.dll
- 2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll
+ 2006-02-28 12:00:00 2,804,224 —-a-w C:\WINDOWS\system32\msi.dll
- 2005-05-04 13:45:36 78,848 —-a-w C:\WINDOWS\system32\msiexec.exe
+ 2006-02-28 12:00:00 77,312 —-a-w C:\WINDOWS\system32\msiexec.exe
- 2005-05-04 13:45:36 271,360 —-a-w C:\WINDOWS\system32\msihnd.dll
+ 2006-02-28 12:00:00 331,264 —-a-w C:\WINDOWS\system32\msihnd.dll
- 2005-05-04 13:45:36 884,736 —-a-w C:\WINDOWS\system32\msimsg.dll
+ 2006-02-28 12:00:00 884,736 —-a-w C:\WINDOWS\system32\msimsg.dll
+ 2006-02-28 12:00:00 40,960 —-a-w C:\WINDOWS\system32\msiregmv.exe
- 2005-05-04 13:45:36 15,360 —-a-w C:\WINDOWS\system32\msisip.dll
+ 2006-02-28 12:00:00 44,032 —-a-w C:\WINDOWS\system32\msisip.dll
- 2008-03-25 04:50:34 1,516,568 —-a-w C:\WINDOWS\system32\msjet40.dll
+ 2006-02-28 12:00:00 1,507,356 —-a-w C:\WINDOWS\system32\msjet40.dll
- 2008-03-25 04:50:40 355,112 —-a-w C:\WINDOWS\system32\msjetoledb40.dll
+ 2006-02-28 12:00:00 358,976 —-a-w C:\WINDOWS\system32\msjetoledb40.dll
- 2008-03-27 08:12:54 151,583 —-a-w C:\WINDOWS\system32\msjint40.dll
+ 2006-02-28 12:00:00 151,583 —-a-w C:\WINDOWS\system32\msjint40.dll
- 2008-03-25 04:50:42 60,192 —-a-w C:\WINDOWS\system32\msjter40.dll
+ 2006-02-28 12:00:00 53,279 —-a-w C:\WINDOWS\system32\msjter40.dll
- 2008-03-25 04:50:42 248,608 —-a-w C:\WINDOWS\system32\msjtes40.dll
+ 2006-02-28 12:00:00 241,693 —-a-w C:\WINDOWS\system32\msjtes40.dll
- 2007-08-13 17:54:10 156,160 —-a-w C:\WINDOWS\system32\msls31.dll
+ 2006-02-28 12:00:00 146,432 —-a-w C:\WINDOWS\system32\msls31.dll
- 2008-03-25 04:50:44 219,936 —-a-w C:\WINDOWS\system32\msltus40.dll
+ 2006-02-28 12:00:00 213,023 —-a-w C:\WINDOWS\system32\msltus40.dll
- 2006-10-18 20:47:16 179,712 —-a-w C:\WINDOWS\system32\msnetobj.dll
+ 2006-02-28 12:00:00 259,072 —-a-w C:\WINDOWS\system32\msnetobj.dll
- 2008-03-25 04:50:45 355,104 —-a-w C:\WINDOWS\system32\mspbde40.dll
+ 2006-02-28 12:00:00 348,189 —-a-w C:\WINDOWS\system32\mspbde40.dll
- 2006-10-18 20:47:16 27,136 —-a-w C:\WINDOWS\system32\mspmsnsv.dll
+ 2006-02-28 12:00:00 52,224 —-a-w C:\WINDOWS\system32\mspmsnsv.dll
- 2006-10-18 20:47:16 175,616 —-a-w C:\WINDOWS\system32\mspmsp.dll
+ 2006-02-28 12:00:00 201,728 —-a-w C:\WINDOWS\system32\mspmsp.dll
- 2008-04-23 04:16:28 193,024 ——w C:\WINDOWS\system32\msrating.dll
+ 2006-02-28 12:00:00 146,432 —-a-w C:\WINDOWS\system32\msrating.dll
- 2008-03-25 04:50:47 432,928 —-a-w C:\WINDOWS\system32\msrd2x40.dll
+ 2006-02-28 12:00:00 421,919 —-a-w C:\WINDOWS\system32\msrd2x40.dll
- 2008-03-25 04:50:49 322,336 —-a-w C:\WINDOWS\system32\msrd3x40.dll
+ 2006-02-28 12:00:00 315,423 —-a-w C:\WINDOWS\system32\msrd3x40.dll
- 2008-03-25 04:50:52 559,904 —-a-w C:\WINDOWS\system32\msrepl40.dll
+ 2006-02-28 12:00:00 552,989 —-a-w C:\WINDOWS\system32\msrepl40.dll
- 2006-12-04 15:21:50 414,720 —-a-w C:\WINDOWS\system32\msscp.dll
+ 2006-02-28 12:00:00 356,352 —-a-w C:\WINDOWS\system32\msscp.dll
- 2008-03-25 04:50:55 264,992 —-a-w C:\WINDOWS\system32\mstext40.dll
+ 2006-02-28 12:00:00 258,077 —-a-w C:\WINDOWS\system32\mstext40.dll
- 2008-04-23 04:16:28 671,232 ——w C:\WINDOWS\system32\mstime.dll
+ 2006-02-28 12:00:00 530,432 —-a-w C:\WINDOWS\system32\mstime.dll
+ 1998-06-17 08:00:00 94,285 —-a-w C:\WINDOWS\system32\MSVCIRTD.DLL
+ 1998-06-17 08:00:00 385,100 —-a-w C:\WINDOWS\system32\MSVCRTD.DLL
- 2008-03-25 04:50:57 838,432 —-a-w C:\WINDOWS\system32\mswdat10.dll
+ 2006-02-28 12:00:00 831,519 —-a-w C:\WINDOWS\system32\mswdat10.dll
- 2006-10-18 20:47:16 321,536 —-a-w C:\WINDOWS\system32\mswmdm.dll
+ 2006-02-28 12:00:00 245,760 —-a-w C:\WINDOWS\system32\mswmdm.dll
- 2008-03-25 04:50:58 621,344 —-a-w C:\WINDOWS\system32\mswstr10.dll
+ 2006-02-28 12:00:00 614,429 —-a-w C:\WINDOWS\system32\mswstr10.dll
- 2008-03-25 04:50:58 355,104 —-a-w C:\WINDOWS\system32\msxbde40.dll
+ 2006-02-28 12:00:00 348,189 —-a-w C:\WINDOWS\system32\msxbde40.dll
- 2007-06-26 06:08:16 1,104,896 —-a-w C:\WINDOWS\system32\msxml3.dll
+ 2006-02-28 12:00:00 1,236,480 —-a-w C:\WINDOWS\system32\msxml3.dll
- 2006-03-01 19:42:42 66,560 —-a-w C:\WINDOWS\system32\mtxclu.dll
+ 2006-02-28 12:00:00 66,560 —-a-w C:\WINDOWS\system32\mtxclu.dll
- 2006-03-01 19:42:42 91,136 —-a-w C:\WINDOWS\system32\mtxoci.dll
+ 2006-02-28 12:00:00 90,112 —-a-w C:\WINDOWS\system32\mtxoci.dll
- 2006-08-17 12:28:27 332,288 —-a-w C:\WINDOWS\system32\netapi32.dll
+ 2006-02-28 12:00:00 332,288 —-a-w C:\WINDOWS\system32\netapi32.dll
- 2005-08-22 18:29:46 197,632 —-a-w C:\WINDOWS\system32\netman.dll
+ 2006-02-28 12:00:00 198,144 —-a-w C:\WINDOWS\system32\netman.dll
- 2007-02-28 08:38:57 2,015,744 —-a-w C:\WINDOWS\system32\ntkrnlpa.exe
+ 2006-02-28 12:00:00 2,015,232 —-a-w C:\WINDOWS\system32\ntkrnlpa.exe
- 2007-02-28 09:08:48 2,136,064 —-a-w C:\WINDOWS\system32\ntoskrnl.exe
+ 2006-02-28 12:00:00 2,148,352 —-a-w C:\WINDOWS\system32\ntoskrnl.exe
- 2006-10-13 12:35:12 142,336 —-a-w C:\WINDOWS\system32\nwprovau.dll
+ 2006-02-28 12:00:00 144,384 —-a-w C:\WINDOWS\system32\nwprovau.dll
- 2008-04-23 04:16:28 102,912 ——w C:\WINDOWS\system32\occache.dll
+ 2006-02-28 12:00:00 96,256 —-a-w C:\WINDOWS\system32\occache.dll
- 2005-07-26 04:39:48 1,285,120 —-a-w C:\WINDOWS\system32\ole32.dll
+ 2006-02-28 12:00:00 1,281,536 —-a-w C:\WINDOWS\system32\ole32.dll
- 2007-12-04 18:38:13 550,912 —-a-w C:\WINDOWS\system32\oleaut32.dll
+ 2006-02-28 12:00:00 553,472 —-a-w C:\WINDOWS\system32\oleaut32.dll
- 2005-07-26 04:39:48 74,752 —-a-w C:\WINDOWS\system32\olecli32.dll
+ 2006-02-28 12:00:00 68,608 —-a-w C:\WINDOWS\system32\olecli32.dll
- 2005-07-26 04:39:49 37,888 —-a-w C:\WINDOWS\system32\olecnv32.dll
+ 2006-02-28 12:00:00 34,304 —-a-w C:\WINDOWS\system32\olecnv32.dll
- 2006-10-16 16:15:00 122,880 —-a-w C:\WINDOWS\system32\oledlg.dll
+ 2006-02-28 12:00:00 117,760 —-a-w C:\WINDOWS\system32\oledlg.dll
- 2008-05-05 11:16:47 40,448 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-08-23 20:16:34 40,196 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2008-05-05 11:16:47 312,378 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-08-23 20:16:34 311,934 —-a-w C:\WINDOWS\system32\perfh009.dat
- 2008-04-23 04:16:28 44,544 —-a-w C:\WINDOWS\system32\pngfilt.dll
+ 2006-02-28 12:00:00 39,424 —-a-w C:\WINDOWS\system32\pngfilt.dll
+ 2003-05-28 15:37:44 394,240 —-a-w C:\WINDOWS\system32\PSDrvCheck.exe
- 2006-10-18 20:47:18 211,456 —-a-w C:\WINDOWS\system32\qasf.dll
+ 2006-02-28 12:00:00 237,568 —-a-w C:\WINDOWS\system32\qasf.dll
- 2008-05-07 05:18:48 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
+ 2006-02-28 12:00:00 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
- 2006-06-22 05:06:30 1,435,648 —-a-w C:\WINDOWS\system32\query.dll
+ 2006-02-28 12:00:00 1,435,648 —-a-w C:\WINDOWS\system32\query.dll
- 2006-06-26 17:37:10 8,192 —-a-w C:\WINDOWS\system32\rasadhlp.dll
+ 2006-02-28 12:00:00 8,192 —-a-w C:\WINDOWS\system32\rasadhlp.dll
- 2006-06-22 10:47:18 181,248 —-a-w C:\WINDOWS\system32\rasmans.dll
+ 2006-02-28 12:00:00 174,080 —-a-w C:\WINDOWS\system32\rasmans.dll
- 2006-11-27 14:54:06 433,152 —-a-w C:\WINDOWS\system32\riched20.dll
+ 2006-02-28 12:00:00 431,616 —-a-w C:\WINDOWS\system32\riched20.dll
- 2007-07-09 13:09:42 584,192 —-a-w C:\WINDOWS\system32\rpcrt4.dll
+ 2006-02-28 12:00:00 581,120 —-a-w C:\WINDOWS\system32\rpcrt4.dll
- 2005-07-26 04:39:49 397,824 —-a-w C:\WINDOWS\system32\rpcss.dll
+ 2006-02-28 12:00:00 395,776 —-a-w C:\WINDOWS\system32\rpcss.dll
- 2007-04-25 14:21:15 144,896 —-a-w C:\WINDOWS\system32\schannel.dll
+ 2006-02-28 12:00:00 144,896 —-a-w C:\WINDOWS\system32\schannel.dll
- 2008-04-21 07:04:00 1,494,528 —-a-w C:\WINDOWS\system32\shdocvw.dll
+ 2006-02-28 12:00:00 1,492,480 —-a-w C:\WINDOWS\system32\shdocvw.dll
- 2007-10-26 03:36:51 8,454,656 —-a-w C:\WINDOWS\system32\shell32.dll
+ 2006-02-28 12:00:00 8,384,000 —-a-w C:\WINDOWS\system32\shell32.dll
+ 2003-02-24 09:48:50 100,352 —-a-w C:\WINDOWS\system32\ShellExt\CDWshext.dll
- 2008-04-21 07:04:00 474,112 —-a-w C:\WINDOWS\system32\shlwapi.dll
+ 2006-02-28 12:00:00 474,112 —-a-w C:\WINDOWS\system32\shlwapi.dll
- 2006-12-19 21:52:18 134,656 —-a-w C:\WINDOWS\system32\shsvcs.dll
+ 2006-02-28 12:00:00 134,656 —-a-w C:\WINDOWS\system32\shsvcs.dll
+ 2007-10-18 10:31:46 51,224 —-a-w C:\WINDOWS\system32\sirenacm.dll
- 2007-11-30 11:18:51 17,272 ——w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 12:39:22 17,272 —-a-w C:\WINDOWS\system32\spmsg.dll
- 2005-06-10 23:53:32 57,856 —-a-w C:\WINDOWS\system32\spoolsv.exe
+ 2006-02-28 12:00:00 57,856 —-a-w C:\WINDOWS\system32\spoolsv.exe
- 2004-12-07 19:32:34 96,768 —-a-w C:\WINDOWS\system32\srvsvc.dll
+ 2006-02-28 12:00:00 96,768 —-a-w C:\WINDOWS\system32\srvsvc.dll
- 2006-08-21 08:52:08 246,814 —-a-w C:\WINDOWS\system32\strmdll.dll
+ 2006-02-28 12:00:00 246,302 —-a-w C:\WINDOWS\system32\strmdll.dll
- 2006-10-19 13:56:32 713,216 —-a-w C:\WINDOWS\system32\sxs.dll
+ 2006-02-28 12:00:00 713,216 —-a-w C:\WINDOWS\system32\sxs.dll
- 2005-10-17 21:14:46 118,272 —-a-w C:\WINDOWS\system32\t2embed.dll
+ 2006-02-28 12:00:00 210,432 —-a-w C:\WINDOWS\system32\t2embed.dll
- 2005-07-08 16:27:56 249,344 —-a-w C:\WINDOWS\system32\tapisrv.dll
+ 2006-02-28 12:00:00 246,272 —-a-w C:\WINDOWS\system32\tapisrv.dll
- 2005-05-10 23:45:48 75,776 —-a-w C:\WINDOWS\system32\telnet.exe
+ 2006-02-28 12:00:00 75,264 —-a-w C:\WINDOWS\system32\telnet.exe
- 2005-07-26 04:39:49 101,376 —-a-w C:\WINDOWS\system32\txflog.dll
+ 2006-02-28 12:00:00 101,376 —-a-w C:\WINDOWS\system32\txflog.dll
+ 2003-02-19 13:09:54 90,112 —-a-w C:\WINDOWS\system32\UDFLib.dll
- 2005-08-23 03:35:42 123,392 —-a-w C:\WINDOWS\system32\umpnpmgr.dll
+ 2006-02-28 12:00:00 118,272 —-a-w C:\WINDOWS\system32\umpnpmgr.dll
- 2007-02-05 20:17:02 185,344 —-a-w C:\WINDOWS\system32\upnphost.dll
+ 2006-02-28 12:00:00 185,344 —-a-w C:\WINDOWS\system32\upnphost.dll
- 2008-04-23 04:16:28 105,984 —-a-w C:\WINDOWS\system32\url.dll
+ 2006-02-28 12:00:00 37,888 —-a-w C:\WINDOWS\system32\url.dll
- 2008-04-23 04:16:29 1,159,680 —-a-w C:\WINDOWS\system32\urlmon.dll
+ 2006-02-28 12:00:00 612,352 —-a-w C:\WINDOWS\system32\urlmon.dll
- 2004-08-04 00:56:48 74,240 —-a-w C:\WINDOWS\system32\usbui.dll
+ 2006-02-28 12:00:00 74,240 —-a-w C:\WINDOWS\system32\usbui.dll
- 2007-03-08 15:36:28 577,536 —-a-w C:\WINDOWS\system32\user32.dll
+ 2006-02-28 12:00:00 577,024 —-a-w C:\WINDOWS\system32\user32.dll
+ 1998-06-17 23:00:00 89,360 —-a-w C:\WINDOWS\system32\VB5DB.DLL
- 2007-08-13 17:54:10 413,696 —-a-w C:\WINDOWS\system32\vbscript.dll
+ 2006-02-28 12:00:00 417,792 —-a-w C:\WINDOWS\system32\vbscript.dll
+ 2004-08-03 23:56:48 53,760 —-a-w C:\WINDOWS\system32\vfwwdm32.dll
- 2006-03-24 04:37:50 49,152 —-a-w C:\WINDOWS\system32\wdigest.dll
+ 2006-02-28 12:00:00 49,152 —-a-w C:\WINDOWS\system32\wdigest.dll
- 2004-08-03 23:56:58 23,552 —-a-w C:\WINDOWS\system32\wdmaud.drv
+ 2006-02-28 12:00:00 23,552 —-a-w C:\WINDOWS\system32\wdmaud.drv
- 2008-04-23 04:16:29 233,472 —-a-w C:\WINDOWS\system32\webcheck.dll
+ 2006-02-28 12:00:00 276,480 —-a-w C:\WINDOWS\system32\webcheck.dll
- 2006-01-04 03:35:05 68,096 —-a-w C:\WINDOWS\system32\webclnt.dll
+ 2006-02-28 12:00:00 67,584 —-a-w C:\WINDOWS\system32\webclnt.dll
+ 2007-10-21 17:51:58 323,624 —-a-w C:\WINDOWS\system32\wiaaut.dll
- 2006-12-19 18:16:47 333,824 —-a-w C:\WINDOWS\system32\wiaservc.dll
+ 2006-02-28 12:00:00 333,312 —-a-w C:\WINDOWS\system32\wiaservc.dll
- 2008-03-19 09:47:00 1,845,248 —-a-w C:\WINDOWS\system32\win32k.sys
+ 2006-02-28 12:00:00 1,835,904 —-a-w C:\WINDOWS\system32\win32k.sys
- 2008-04-23 04:16:29 826,368 —-a-w C:\WINDOWS\system32\wininet.dll
+ 2006-02-28 12:00:00 656,384 —-a-w C:\WINDOWS\system32\wininet.dll
- 2007-03-17 13:43:01 292,864 —-a-w C:\WINDOWS\system32\winsrv.dll
+ 2006-02-28 12:00:00 290,816 —-a-w C:\WINDOWS\system32\winsrv.dll
- 2006-08-17 12:28:27 132,096 —-a-w C:\WINDOWS\system32\wkssvc.dll
+ 2006-02-28 12:00:00 132,096 —-a-w C:\WINDOWS\system32\wkssvc.dll
- 2006-10-18 20:47:18 757,248 —-a-w C:\WINDOWS\system32\WMADMOD.dll
+ 2006-02-28 12:00:00 408,064 —-a-w C:\WINDOWS\system32\wmadmod.dll
- 2006-10-18 20:47:18 1,117,696 —-a-w C:\WINDOWS\system32\WMADMOE.dll
+ 2006-02-28 12:00:00 670,720 —-a-w C:\WINDOWS\system32\wmadmoe.dll
- 2007-10-27 16:40:30 222,720 —-a-w C:\WINDOWS\system32\wmasf.dll
+ 2006-02-28 12:00:00 230,400 —-a-w C:\WINDOWS\system32\wmasf.dll
- 2006-10-18 20:47:18 33,792 —-a-w C:\WINDOWS\system32\wmdmlog.dll
+ 2006-02-28 12:00:00 27,136 —-a-w C:\WINDOWS\system32\wmdmlog.dll
- 2006-10-18 20:47:18 37,376 —-a-w C:\WINDOWS\system32\wmdmps.dll
+ 2006-02-28 12:00:00 23,552 —-a-w C:\WINDOWS\system32\wmdmps.dll
- 2006-10-18 20:47:20 227,328 —-a-w C:\WINDOWS\system32\wmerror.dll
+ 2006-02-28 12:00:00 168,448 —-a-w C:\WINDOWS\system32\wmerror.dll
- 2006-10-18 20:47:20 157,184 —-a-w C:\WINDOWS\system32\wmidx.dll
+ 2006-02-28 12:00:00 151,552 —-a-w C:\WINDOWS\system32\wmidx.dll
- 2006-10-18 20:47:20 937,984 —-a-w C:\WINDOWS\system32\WMNetMgr.dll
+ 2006-02-28 12:00:00 1,050,624 —-a-w C:\WINDOWS\system32\wmnetmgr.dll
- 2007-06-11 22:51:12 10,834,944 —-a-w C:\WINDOWS\system32\wmp.dll
+ 2006-02-28 12:00:00 4,874,240 —-a-w C:\WINDOWS\system32\wmp.dll
- 2006-10-18 20:47:20 242,688 —-a-w C:\WINDOWS\system32\wmpasf.dll
+ 2006-02-28 12:00:00 114,688 —-a-w C:\WINDOWS\system32\wmpasf.dll
- 2006-10-18 20:47:20 314,880 —-a-w C:\WINDOWS\system32\wmpdxm.dll
+ 2006-02-28 12:00:00 233,472 —-a-w C:\WINDOWS\system32\wmpdxm.dll
- 2006-10-18 20:47:20 8,231,936 —-a-w C:\WINDOWS\system32\wmploc.dll
+ 2006-02-28 12:00:00 2,940,928 —-a-w C:\WINDOWS\system32\wmploc.dll
- 2006-10-18 20:47:20 99,840 —-a-w C:\WINDOWS\system32\wmpshell.dll
+ 2006-02-28 12:00:00 102,400 —-a-w C:\WINDOWS\system32\wmpshell.dll
- 2006-10-18 20:47:22 4,096 —-a-w C:\WINDOWS\system32\wmsdmod.dll
+ 2006-02-28 12:00:00 759,296 —-a-w C:\WINDOWS\system32\wmsdmod.dll
- 2006-10-18 20:47:22 4,096 —-a-w C:\WINDOWS\system32\wmsdmoe2.dll
+ 2006-02-28 12:00:00 1,119,744 —-a-w C:\WINDOWS\system32\wmsdmoe2.dll
- 2006-10-18 20:47:22 603,648 —-a-w C:\WINDOWS\system32\WMSPDMOD.dll
+ 2006-02-28 12:00:00 484,864 —-a-w C:\WINDOWS\system32\wmspdmod.dll
- 2006-10-18 20:47:22 1,329,152 —-a-w C:\WINDOWS\system32\WMSPDMOE.dll
+ 2006-02-28 12:00:00 896,512 —-a-w C:\WINDOWS\system32\wmspdmoe.dll
- 2006-10-18 20:47:22 2,450,944 —-a-w C:\WINDOWS\system32\wmvcore.dll
+ 2006-02-28 12:00:00 2,105,344 —-a-w C:\WINDOWS\system32\wmvcore.dll
- 2006-10-18 20:47:22 4,096 —-a-w C:\WINDOWS\system32\wmvdmod.dll
+ 2006-02-28 12:00:00 809,984 —-a-w C:\WINDOWS\system32\wmvdmod.dll
- 2006-10-18 20:47:22 4,096 —-a-w C:\WINDOWS\system32\wmvdmoe2.dll
+ 2006-02-28 12:00:00 1,001,472 —-a-w C:\WINDOWS\system32\wmvdmoe2.dll
+ 2003-07-18 12:58:46 516,784 —-a-r C:\WINDOWS\system32\XceedCry.dll
- 2006-03-01 19:42:42 11,776 —-a-w C:\WINDOWS\system32\xolehlp.dll
+ 2006-02-28 12:00:00 11,776 —-a-w C:\WINDOWS\system32\xolehlp.dll
+ 2007-10-12 01:01:30 236,056 —-a-w C:\WINDOWS\twain_32\QuickCam\lvWIAext.dll
+ 2006-02-28 12:00:00 921,088 —-a-w C:\WINDOWS\WinSxS\InstallTemp\80892\comctl32.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-03-27 14:12 1164600]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 13:00 15360]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2006-09-15 13:27 2048000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-26 08:14 1235736]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-02 22:46 13529088]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"RemoteControl8"="C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 20:23 83240]
"PDVD8LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 11:36 50472]
"BDRegion"="C:\Program Files\Cyberlink\Shared Files\brs.exe" [2008-03-21 10:21 91432]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 20:42 116040]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-06-10 18:52 1447168]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-02 22:46 86016]
"nwiz"="nwiz.exe" [2008-05-02 22:46 1630208 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-12 09:58 16264192 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-02-28 13:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=lprgke.dll zvnspg.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2008-07-30 10:47 289064 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
–a—— 2008-06-09 10:16 2363392 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
–a—— 2007-10-25 16:33 563984 C:\Program Files\Common Files\logishrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
–a—— 2007-10-25 16:37 2178832 C:\Program Files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-10-13 17:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSLauncher]
–a—— 2006-11-28 01:12 2658304 C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
–a—— 2006-06-27 16:21 1449984 C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
–a—— 2003-05-28 16:37 394240 C:\WINDOWS\system32\PSDrvCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
–a—— 2008-07-07 08:34 167936 C:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2008-06-10 04:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
–a—— 2008-06-06 17:54 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
-ra—— 2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-06-22 17:58]
R0 VOBID;VOBID;C:\WINDOWS\system32\DRIVERS\vobid.sys [2003-08-01 14:47]
S1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-26 08:14]
S2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};C:\Program Files\CyberLink\PowerDVD8\000.fcl [2008-02-01 17:24]
S2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-22 17:24]
S2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-26 08:14]
S2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-22 17:58]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1cb32080-49c1-11dd-9113-806d6172696f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2008-08-07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-08-25 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]

2008-08-24 C:\WINDOWS\Tasks\ParetoLogic Registration.job
- C:\WINDOWS\system32\rundll32.exe [2006-02-28 13:00]

2008-08-24 C:\WINDOWS\Tasks\ParetoLogic Update Version2.job
- C:\Program Files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2007-10-24 12:54]
.
- - - - ORPHANS REMOVED - - - -

BHO-{218E3BCA-9091-4F58-9E58-C00BA6B1DF20} - C:\WINDOWS\system32\urqnnkIa.dll
BHO-{88023493-3F3F-4E70-A26D-351587372523} - C:\WINDOWS\system32\jkkhICVN.dll
Toolbar-{B36B25DB-E0B4-4058-BEBF-DB0C12B38C89} - C:\WINDOWS\rafbsvnx.dll
HKCU-Run-WinCalendarTime.exe - C:\Program Files\WinCalendarTime\WinCalendarTime.exe
ShellExecuteHooks-{0C5C4DB4-6C62-49ED-8343-62B9AE7ADF6A} - (no file)


.
——- Supplementary Scan ——-
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com/
O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 -: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-25 17:18:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …


**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD8\000.fcl"
.
Completion time: 2008-08-25 17:20:50
ComboFix-quarantined-files.txt 2008-08-25 16:19:48
ComboFix2.txt 2008-07-10 15:18:34

Pre-Run: 122,204,962,816 bytes free
Post-Run: 122,191,667,200 bytes free

1315 — E O F — 2008-08-25 08:38:44
Post #11 last edited
Hi snapper64
Sorry about getting back so late, had a lot of log to read.
We are getting there.
FIRST:
1. Please open Notepad
Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

File::
C:\WINDOWS\kx84316.dll

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=lprgke.dll zvnspg.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
[external image: Posted Image]
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

6. ComboFix will automatically REBOOT your machine when the KillAll:: switch is used..

7. Next, re-enable all the programs that you disabled prior to running ComboFix.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

NEXT:

After reboot

Do this:

[external image: Posted Image]

NEXT:

Make sure Internet Explorer isn't open

Run hijackthis again. Hit None of the above,
Click Do a System Scan Only.
Put a Check in the box on the left side on these: (Not to worry if not there)

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user'
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Br…018/flashax.cab
O20 - AppInit_DLLs: lprgke.dll zvnspg.dll

Close ALL windows and browsers except HijackThis and click Fix checked


NEXT:

Delete the files in RED>>not to worry if not there.
C:\WINDOWS\system32\tscupgrd.exe

NEXT:
Reboot

After reboot
Post the following logs/Reports:
ComboFix.txt
Fresh HijackThis log

Also let me know how your PC is behaving at this moment

good luck mschroe919
Post #12
computer seams fine all buttons have returned but internet is still screwed up, first the internet explorer icon when double clicked would just place another shortcut to it in the desktop. so i deleted it and made a new shortcut which when double clicked did after about 40 seconds get me to my home page of google.but i did notice it went to an ip adress first of [removed] which i belive is in japan and not googles ip adress? then when i try to search the internet the pages get slower each time then after the second page it just freezes and stops responding. i know my broadband connection is ok as i am using my laptop all the time while we fix my pc.

here are the latest logs
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:00, on 26/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1213770062796
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

–
End of file - 6501 bytes
ComboFix 08-08-24.02 - ian day 2008-08-26 10:11:57.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1665 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: M:\CFScript.txt
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\kx84316.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\kx84316.dll

.
((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 )))))))))))))))))))))))))))))))
.

2008-08-26 10:01 . 2008-08-26 10:01 d——– C:\WINDOWS\LastGood.Tmp
2008-08-25 10:57 . 2008-08-25 10:57 d——– C:\Documents and Settings\Administrator\Application Data\PrivacyControl
2008-08-25 09:41 . 2008-08-25 09:41 d——– C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-08-24 22:38 . 2008-08-24 22:38 d——– C:\Documents and Settings\ian.IAN-0D7B835D1E0\Application Data\PrivacyControl
2008-08-24 22:32 . 2008-08-24 22:32 d——– C:\Documents and Settings\ian.IAN-0D7B835D1E0\Application Data\Malwarebytes
2008-08-24 22:23 . 2008-08-24 22:23 d——– C:\Documents and Settings\ian day\Application Data\Malwarebytes
2008-08-24 21:21 . 2008-08-24 21:21 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-08-24 21:21 . 2008-08-24 21:21 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-08-24 21:21 . 2008-08-17 15:01 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-24 21:21 . 2008-08-17 15:01 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-08-24 11:50 . 2008-08-24 11:51 630 –a—— C:\WINDOWS\wininit.ini
2008-08-24 11:23 . 2008-08-24 11:26 d——– C:\Program Files\Spybot - Search & Destroy
2008-08-24 11:23 . 2008-08-25 00:29 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-08-24 09:49 . 2008-08-24 09:49 d—s—- C:\Documents and Settings\ian.IAN-0D7B835D1E0\UserData
2008-08-23 21:44 . 2008-08-23 21:44 d——– C:\Documents and Settings\ian.IAN-0D7B835D1E0\Application Data\ESET
2008-08-23 21:40 . 2008-08-24 09:49 d——– C:\Documents and Settings\ian.IAN-0D7B835D1E0
2008-08-23 21:26 . 2008-08-23 21:26 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\HPSSUPPLY
2008-08-23 20:19 . 2006-02-28 13:00 13,463,552 –a–c— C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-08-23 20:18 . 2006-02-28 13:00 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2008-08-23 20:06 . 2008-08-23 20:06 749 -rah—– C:\WINDOWS\WindowsShell.Manifest
2008-08-23 20:06 . 2008-08-23 20:06 749 -rah—– C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-08-23 20:06 . 2008-08-23 20:06 749 -rah—– C:\WINDOWS\system32\sapi.cpl.manifest
2008-08-23 20:06 . 2008-08-23 20:06 749 -rah—– C:\WINDOWS\system32\ncpa.cpl.manifest
2008-08-23 20:06 . 2008-08-23 20:06 488 -rah—– C:\WINDOWS\system32\logonui.exe.manifest
2008-08-23 15:44 . 2006-02-28 13:00 24,661 –a—— C:\WINDOWS\system32\spxcoins.dll
2008-08-23 15:44 . 2006-02-28 13:00 24,661 –a–c— C:\WINDOWS\system32\dllcache\spxcoins.dll
2008-08-23 15:44 . 2006-02-28 13:00 13,312 –a—— C:\WINDOWS\system32\irclass.dll
2008-08-23 15:44 . 2006-02-28 13:00 13,312 –a–c— C:\WINDOWS\system32\dllcache\irclass.dll
2008-08-23 10:34 . 2008-08-23 10:34 d——– C:\Documents and Settings\ian day\Application Data\ESET
2008-08-23 10:33 . 2008-08-23 10:33 d——– C:\Program Files\ESET
2008-08-23 10:33 . 2008-08-23 10:33 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\ESET
2008-08-23 10:11 . 2008-08-23 10:11 d——– C:\Documents and Settings\Administrator
2008-08-23 10:05 . 2008-08-21 23:41 87,552 –a—— C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-08-23 10:05 . 2008-08-14 21:52 82,432 –a—— C:\WINDOWS\system32\IEDFix.C.exe
2008-08-23 09:59 . 2007-09-06 00:22 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2008-08-23 09:59 . 2006-04-27 17:49 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2008-08-23 09:59 . 2008-05-29 09:35 86,528 –a—— C:\WINDOWS\system32\VACFix.exe
2008-08-23 09:59 . 2008-07-26 07:48 82,944 –a—— C:\WINDOWS\system32\IEDFix.exe
2008-08-23 09:59 . 2008-05-23 18:21 81,920 –a—— C:\WINDOWS\system32\404Fix.exe
2008-08-23 09:59 . 2003-06-05 21:13 53,248 –a—— C:\WINDOWS\system32\Process.exe
2008-08-23 09:59 . 2004-07-31 18:50 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2008-08-23 09:59 . 2007-10-04 00:36 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2008-08-22 20:51 . 2008-08-22 20:52 156 –a—— C:\WINDOWS\Twunk001.MTX
2008-08-22 20:51 . 2008-08-22 20:52 3 –a—— C:\WINDOWS\Twain001.Mtx
2008-08-22 20:51 . 2008-08-22 20:51 0 –a—— C:\WINDOWS\Twunk002.MTX
2008-08-05 22:52 . 2008-08-05 22:52 d——– C:\Program Files\iTunes
2008-08-05 22:52 . 2008-08-05 22:52 d——– C:\Program Files\iPod
2008-08-05 22:49 . 2008-08-05 22:49 d——– C:\Program Files\Safari
2008-08-05 22:48 . 2008-08-05 22:48 d——– C:\Program Files\Apple Software Update
2008-08-05 19:32 . 2008-08-05 19:32 d——– C:\Documents and Settings\ian day\Application Data\CyberLink
2008-08-05 19:31 . 2008-08-05 19:31 d——– C:\Program Files\Common Files\CyberLink
2008-08-05 19:31 . 2008-08-05 19:32 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\CyberLink
2008-08-05 19:30 . 2008-08-05 19:31 d——– C:\Program Files\CyberLink
2008-08-05 19:29 . 2008-08-05 19:29 29,480 –a—— C:\WINDOWS\system32\msxml3a.dll
2008-07-31 19:50 . 2008-07-31 19:50 d——– C:\Program Files\PowerISO
2008-07-31 13:41 . 2004-08-18 02:34 442,368 –a—— C:\WINDOWS\system32\vp6vfw.dll
2008-07-30 17:06 . 2008-07-30 17:06 715,248 –a—— C:\WINDOWS\system32\drivers\sptd.sys
2008-07-29 21:32 . 2008-07-29 21:32 d–hs—- C:\found.000
2008-07-28 18:28 . 2008-07-28 18:28 1,905 –a—— C:\WINDOWS\diagwrn.xml
2008-07-28 18:28 . 2008-07-28 18:28 1,905 –a—— C:\WINDOWS\diagerr.xml
2008-07-28 18:03 . 2008-07-28 18:03 d——– C:\Program Files\Pinnacle
2008-07-28 18:03 . 2008-07-28 18:03 921 –a—— C:\WINDOWS\Recorder.reg
2008-07-28 17:00 . 2008-07-28 17:00 d——– C:\Documents and Settings\ian day\Application Data\Ahead
2008-07-26 14:56 . 2008-07-26 14:56 664 –a—— C:\WINDOWS\system32\d3d9caps.dat
2008-07-26 07:46 . 2008-08-23 10:05 2,766 –a—— C:\WINDOWS\system32\tmp.reg

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-26 09:08 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Google Updater
2008-08-25 11:28 ——— d—–w C:\Program Files\mIRC
2008-08-25 00:11 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\avg8
2008-08-24 10:51 ——— d—–w C:\Program Files\PrivacyControl
2008-08-23 12:56 ——— d—–w C:\Program Files\Bonjour
2008-08-22 23:06 ——— d—–w C:\Documents and Settings\ian day\Application Data\Vso
2008-08-22 23:05 ——— d—–w C:\Documents and Settings\ian day\Application Data\uTorrent
2008-08-22 22:58 ——— d—–w C:\Program Files\xdcc klipper
2008-08-06 11:53 ——— d—–w C:\Documents and Settings\ian day\Application Data\Apple Computer
2008-08-05 18:31 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-07-27 10:30 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Messenger Plus!
2008-07-27 10:28 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
2008-07-26 07:14 97,928 —-a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-23 13:02 ——— d—–w C:\Program Files\Messenger Plus! Live
2008-07-22 21:12 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Logishrd
2008-07-22 21:08 ——— d—–w C:\Program Files\Common Files\logishrd
2008-07-22 21:07 ——— d—–w C:\Program Files\Logitech
2008-07-22 21:07 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Logitech
2008-07-20 10:43 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\MGS
2008-07-20 10:37 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Microgaming
2008-07-15 22:27 ——— d—–w C:\Program Files\QuickTime
2008-07-14 19:38 ——— d—–w C:\Program Files\Windows Live Toolbar
2008-07-14 19:38 ——— d—–w C:\Program Files\Windows Live Favorites
2008-07-14 19:32 ——— dcsh–w C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-14 19:32 ——— d—–w C:\Program Files\Windows Live
2008-07-13 12:07 ——— d—–w C:\Program Files\Dell
2008-07-12 14:27 ——— d—–w C:\Program Files\QuickSFV
2008-07-11 19:36 ——— d—–w C:\Program Files\Smart PC Solutions
2008-07-11 19:16 ——— d—–w C:\Program Files\ParetoLogic
2008-07-11 19:16 ——— d—–w C:\Program Files\Common Files\ParetoLogic
2008-07-11 19:16 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\ParetoLogic
2008-07-11 19:16 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Downloaded Installations
2008-07-11 18:59 ——— d—–w C:\Program Files\Convar
2008-07-10 18:06 ——— d—–w C:\Program Files\Google
2008-07-10 18:00 ——— d—–w C:\Program Files\Trend Micro
2008-07-10 08:51 ——— d—–w C:\Documents and Settings\ian day\Application Data\PrivacyControl
2008-07-09 21:04 ——— d—–w C:\Documents and Settings\ian day\Application Data\HPAppData
2008-07-09 20:09 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Trend Micro
2008-07-09 12:24 ——— d—–w C:\Program Files\Java
2008-07-09 12:23 ——— d—–w C:\Program Files\Common Files\Java
2008-07-09 09:31 ——— d—–w C:\Program Files\Advanced System Optimizer
2008-07-07 18:49 22,512 —-a-w C:\WINDOWS\system32\drivers\adwarealert.sys
2008-07-07 07:40 56,108 —-a-w C:\WINDOWS\system32\drivers\scdemu.sys
2008-07-05 22:13 ——— d—–w C:\Documents and Settings\ian day\Application Data\Nokia Multimedia Player
2008-07-05 22:13 ——— d—–w C:\Documents and Settings\ian day\Application Data\Nokia
2008-07-05 19:14 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-07-05 19:13 ——— d—–w C:\Program Files\Common Files\Apple
2008-07-05 19:13 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple
2008-07-05 16:15 ——— d—–w C:\Documents and Settings\ian day\Application Data\Datalayer
2008-07-05 16:15 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Suite
2008-07-05 16:14 ——— d—–w C:\Program Files\Nokia
2008-07-05 16:14 ——— d—–w C:\Program Files\DIFX
2008-07-05 16:13 ——— d—–w C:\Program Files\Common Files\PCSuite
2008-07-05 16:13 ——— d—–w C:\Program Files\Common Files\Nokia
2008-07-05 16:13 ——— d—–w C:\Documents and Settings\ian day\Application Data\PC Suite
2008-07-05 06:24 517 —-a-w C:\Program Files\Shortcut to roboform.dll.lnk
2008-07-04 13:54 ——— d—–w C:\Documents and Settings\ian day\Application Data\NeroDCTemplates
2008-07-04 13:47 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\LightScribe
2008-07-04 13:46 ——— d—–w C:\Program Files\Common Files\LightScribe
2008-07-04 13:44 ——— d—–w C:\Program Files\LightScribe
2008-07-04 13:32 ——— d—–w C:\Program Files\coverXP
2008-07-01 21:42 ——— d—–w C:\Program Files\AOER
2008-05-23 10:05 47,360 —-a-w C:\Documents and Settings\ian day\Application Data\pcouffin.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-03-27 14:12 1164600]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 13:00 15360]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2006-09-15 13:27 2048000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-26 08:14 1235736]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-02 22:46 13529088]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"RemoteControl8"="C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 20:23 83240]
"PDVD8LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 11:36 50472]
"BDRegion"="C:\Program Files\Cyberlink\Shared Files\brs.exe" [2008-03-21 10:21 91432]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 20:42 116040]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-06-10 18:52 1447168]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-02 22:46 86016]
"nwiz"="nwiz.exe" [2008-05-02 22:46 1630208 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-12 09:58 16264192 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-02-28 13:00 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2008-07-30 10:47 289064 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
–a—— 2008-06-09 10:16 2363392 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
–a—— 2007-10-25 16:33 563984 C:\Program Files\Common Files\logishrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
–a—— 2007-10-25 16:37 2178832 C:\Program Files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-10-13 17:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSLauncher]
–a—— 2006-11-28 01:12 2658304 C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
–a—— 2006-06-27 16:21 1449984 C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
–a—— 2003-05-28 16:37 394240 C:\WINDOWS\system32\PSDrvCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
–a—— 2008-07-07 08:34 167936 C:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2008-06-10 04:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
–a—— 2008-06-06 17:54 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
-ra—— 2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-06-22 17:58]
R0 VOBID;VOBID;C:\WINDOWS\system32\DRIVERS\vobid.sys [2003-08-01 14:47]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-26 08:14]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};C:\Program Files\CyberLink\PowerDVD8\000.fcl [2008-02-01 17:24]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-22 17:24]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-26 08:14]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-22 17:58]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1cb32080-49c1-11dd-9113-806d6172696f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2008-08-07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-08-25 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]

2008-08-24 C:\WINDOWS\Tasks\ParetoLogic Registration.job
- C:\WINDOWS\system32\rundll32.exe [2006-02-28 13:00]

2008-08-24 C:\WINDOWS\Tasks\ParetoLogic Update Version2.job
- C:\Program Files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2007-10-24 12:54]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-26 10:17:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD8\000.fcl"
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\logishrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Common Files\logishrd\LVCOMSER\LVComSer.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-08-26 10:23:56 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-26 09:23:46
ComboFix2.txt 2008-08-25 16:20:51
ComboFix3.txt 2008-07-10 15:18:34

Pre-Run: 125,994,758,144 bytes free
Post-Run: 125,982,597,120 bytes free

294 — E O F — 2008-08-25 21:03:47
Post #13
Good morning

Well we are gaining ground here.
First of all looks like I missed one item here:

NEXT:

Make sure Internet Explorer isn't open

Run hijackthis again. Hit None of the above,
Click Do a System Scan Only.
Put a Check in the box on the left side on this:

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

Close ALL windows and browsers except HijackThis and click Fix checked
Then reboot

After reboot let do the Malwarebytes' Anti-Malware again
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt

post a new scanner[HJT] log and the Malwarebytes' Anti-Malware log
good luck mschroe919
Post #14
latest logs
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:13, on 26/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\Cyberlink\Shared Files\brs.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1213770062796
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

–
End of file - 6541 bytesMalwarebytes' Anti-Malware 1.25
Database version: 1083
Windows 5.1.2600 Service Pack 2

13:05:20 26/08/2008
mbam-log-08-26-2008 (13-05-20).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 120771
Time elapsed: 36 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
Post #15 last edited
Hi I am fixing another program for you I will be back. In the mean time how is your IE doing mschroe919 also what about the two av programs?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI