What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Trojan + Registry Entries

25 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I started to get Spybot Popups advising of a registry change which I denied. Then I started to get multiple popups. Ran Malwarebytes and it identified 12 problems. Problems oersisted afterward: flashing numlock key, jery mouse, programs randomly launched. Did a WIndows repair installation and at first behaviour persisted, now has stopped. Not sure if I have fixed it or not. THus the following HiJack Log. Many thkns for your comments:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:36:41, on 2008-10-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
f:\Program Files\FaxTalk Messenger Pro 7.0\FTMSGSVC.EXE
f:\Program Files\FaxTalk Messenger Pro 7.0\FAPIEXE.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
F:\Program Files\FaxTalk Messenger Pro 7.0\FTClCtrl.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\JK.NS2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
f:\PROGRA~1\POPFile\popfileib.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {2e0f1d95-7bc8-4bea-8da5-8cc28c8b15b9} - (no file)
O2 - BHO: (no name) - {39D81A93-F4B0-4D39-89CE-519854C24F05} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {9449BBA0-5EA5-4B6B-BA8D-48EB1F98A408} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [FaxTalk Messenger Pro 7.0] "F:\Program Files\FaxTalk Messenger Pro 7.0\FTClCtrl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [FaxTalk CallControl 7.0] "f:\Program Files\FaxTalk Messenger Pro 7.0\FTClCtrl.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\JK.NS2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKUS\S-1-5-21-57989841-789336058-1957994488-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
O4 - HKUS\S-1-5-21-57989841-789336058-1957994488-1003\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User '?')
O4 - HKUS\S-1-5-21-57989841-789336058-1957994488-1003\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User '?')
O4 - HKUS\S-1-5-21-57989841-789336058-1957994488-1003\..\Run: [Google Update] "C:\Documents and Settings\JK.NS2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c (User '?')
O4 - HKUS\S-1-5-21-57989841-789336058-1957994488-1003\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User '?')
O4 - HKUS\S-1-5-18\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User '?')
O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')
O4 - S-1-5-21-57989841-789336058-1957994488-1003 Startup: Run POPFile.lnk = F:\Program Files\POPFile\runpopfile.exe (User '?')
O4 - .DEFAULT User Startup: Run POPFile.lnk = D:\Program Files\POPFile\runpopfile.exe (User 'Default user')
O4 - Startup: Run POPFile.lnk = F:\Program Files\POPFile\runpopfile.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://142.179.144.33:8080/plugin/h263ctrl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D15F4A69-7188-4C20-A150-F80E084BBFFE}: NameServer = 75.154.132.68,75.154.132.100
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll ohnova.dll qivqgb.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FaxTalk Messenger Pro 7.0 - Thought Communications, Inc. - f:\Program Files\FaxTalk Messenger Pro 7.0\FTMSGSVC.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

–
End of file - 11330 bytes
Post #2
Hello Tom Sellers, and welcome back to WhattheTech! My name is BHowett and I will be helping you to get sorted. If for any reason you do not understand any of the instructions, or are just unsure then please do not guess , simply post back with your question, and we will go through it again.

I am looking over you log now, and I will get back to you shortly :thumbup:
Post #3 last edited
Hi Tom Sellers,

Your log looks pretty good, however A Repair Install will replace files altered by malware, but in most cases will not fix the malware problem itself.

So lets take a look at some things….


Fix with HijackThis

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

O2 - BHO: (no name) - {2e0f1d95-7bc8-4bea-8da5-8cc28c8b15b9} - (no file)
O2 - BHO: (no name) - {39D81A93-F4B0-4D39-89CE-519854C24F05} - (no file)
O2 - BHO: (no name) - {9449BBA0-5EA5-4B6B-BA8D-48EB1F98A408} - (no file)


Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.

===============================================

ATF Cleaner

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

===============================================

Malwarebytes' Anti-Malware
Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
===============================================

RSIT
  • Download random's system information tool (RSIT) by random/random from here.
  • It is important that is saved to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt (<info.txt (<
===============================================

Needed in your next reply:

Malwarebytes log
RSIT logs

And let me know how things are running, and if you are having any problems :thumbup:
Post #4
Thanks for that. I've done as noted. While running the Malrebytes scan BTW, ATV resident shield found Trojan: Generic11.AWXY (in temp internet files) Generic11.AVTW (in .dll file eeyoudrb.dll) Here is the Malware log: Malwarebytes' Anti-Malware 1.28 Database version: 1134 Windows 5.1.2600 Service Pack 2 2008-10-11 18:07:04 mbam-log-2008-10-11 (18-07-04).txt Scan type: Quick Scan Objects scanned: 95950 Time elapsed: 15 minute(s), 52 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 2 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully. When I run RSIT I see: AutoIT Error: Incorrect number of parameters in function call.
Post #5

When I run RSIT I see:

AutoIT Error:
Incorrect number of parameters in function call.


I will partner with the creator of that tool to look into that error, but in the mean time please do the following…


ComboFix

Please visit below webpage for instructions for downloading and running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. DO NOT select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix (located in C:\combofix.txt) when you've accomplished that, along with a new HijackThis log.
Post #6
Thanks, here are the logs:

ComboFix 08-10-11.02 - JK 2008-10-11 22:33:53.2 - NTFSx86

Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\install_flash_player.exe
C:\Program Files\INSTALL.LOG
C:\WINDOWS\system32\wmodxsdh.ini
C:\WINDOWS\winhelp.ini
E:\Autorun.inf
E:\check_LSA7.txt
E:\Winrar.exe
F:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-09-12 to 2008-10-12 )))))))))))))))))))))))))))))))
.

2008-10-11 18:07 . 2008-10-11 18:07 d——– C:\rsit
2008-10-11 13:48 . 2008-10-11 13:48 749 -rah—– C:\WINDOWS\WindowsShell.Manifest
2008-10-11 13:48 . 2008-10-11 13:48 749 -rah—– C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-10-11 13:48 . 2008-10-11 13:48 749 -rah—– C:\WINDOWS\system32\sapi.cpl.manifest
2008-10-11 13:48 . 2008-10-11 13:48 749 -rah—– C:\WINDOWS\system32\nwc.cpl.manifest
2008-10-11 13:48 . 2008-10-11 13:48 749 -rah—– C:\WINDOWS\system32\ncpa.cpl.manifest
2008-10-11 13:48 . 2008-10-11 13:48 488 -rah—– C:\WINDOWS\system32\logonui.exe.manifest
2008-10-11 13:35 . 2004-08-03 22:31 20,992 –a—— C:\WINDOWS\system32\drivers\RTL8139.sys
2008-10-07 21:16 . 2008-10-07 21:16 d——– C:\Program Files\CommTest
2008-10-07 21:06 . 2008-10-07 23:06 d-a—— C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-10-07 18:49 . 2008-10-07 18:49 d——– C:\Program Files\FTB2070
2008-10-07 18:49 . 2002-12-02 09:03 447,760 –a—— C:\WINDOWS\system32\Vsflex7L.ocx
2008-10-07 18:49 . 2004-04-29 14:23 311,296 –a—— C:\WINDOWS\system32\c1sizer.ocx
2008-10-07 18:49 . 2000-05-21 23:00 198,848 –a—— C:\WINDOWS\system32\MCI32.OCX
2008-10-07 18:49 . 1998-06-23 23:00 103,744 –a—— C:\WINDOWS\system32\MSCOMM32.OCX
2008-10-07 18:44 . 2004-06-28 12:08 42,752 –a—— C:\WINDOWS\system32\drivers\ser2pl.sys
2008-09-28 22:40 . 2008-10-11 19:43 d——– C:\Torrents
2008-09-13 11:08 . 2008-09-13 11:08 d——– C:\Program Files\Common Files\Macromedia Shared
2008-09-13 11:08 . 2008-09-13 11:08 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Macrovision

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-12 04:31 ——— d—–w C:\Documents and Settings\JK.NS2\Application Data\uTorrent
2008-10-11 20:39 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Google Updater
2008-10-11 18:45 ——— d—–w C:\Program Files\Thumbs5
2008-10-11 15:09 ——— d—–w C:\Program Files\Malwarebytes' Anti-Malware
2008-10-08 00:44 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-09-10 06:04 38,528 —-a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-10 06:03 17,200 —-a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-08-29 15:03 97,928 —-a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-15 04:44 ——— d—–w C:\Program Files\Common Files\WexTech Shared
2008-07-30 18:29 2,386 —-a-w C:\WINDOWS\system32\tmp.reg
2008-07-30 03:46 2,666,409 —-a-w C:\ComboFix.exe
2008-07-29 04:29 10,520 —-a-w C:\WINDOWS\system32\avgrsstx.dll
2008-07-19 04:10 53,448 —-a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-19 04:10 45,768 —-a-w C:\WINDOWS\system32\wups2.dll
2008-07-19 04:10 36,552 —-a-w C:\WINDOWS\system32\wups.dll
2008-07-19 04:09 563,912 —-a-w C:\WINDOWS\system32\wuapi.dll
2008-07-19 04:09 325,832 —-a-w C:\WINDOWS\system32\wucltui.dll
2008-07-19 04:09 205,000 —-a-w C:\WINDOWS\system32\wuweb.dll
2008-07-19 04:09 1,811,656 —-a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-17 15:03 86,016 —-a-w C:\WINDOWS\system32\mdmxsdk.dll
2008-07-17 15:03 110,592 —-a-w C:\WINDOWS\system32\uci100.dll
.

((((((((((((((((((((((((((((( snapshot@2008-07-29_22.19.05.71 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-02-25 03:35:05 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB898461\spmsg.dll
+ 2005-02-25 03:35:05 209,632 —-a-w C:\WINDOWS\$hf_mig$\KB898461\spuninst.exe
+ 2005-02-25 03:35:05 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB898461\spupdsvc.exe
+ 2005-02-25 03:35:05 22,240 —-a-w C:\WINDOWS\$hf_mig$\KB898461\update\spcustom.dll
+ 2005-02-25 03:35:05 718,048 —-a-w C:\WINDOWS\$hf_mig$\KB898461\update\update.exe
+ 2005-02-25 03:35:06 371,936 —-a-w C:\WINDOWS\$hf_mig$\KB898461\update\updspapi.dll
+ 2006-05-18 05:37:43 450,560 —-a-w C:\WINDOWS\$hf_mig$\KB917344\SP2QFE\jscript.dll
+ 2005-10-12 23:16:49 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB917344\spmsg.dll
+ 2005-10-12 23:16:49 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB917344\spuninst.exe
+ 2005-10-12 23:16:49 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB917344\update\spcustom.dll
+ 2005-10-12 23:16:51 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB917344\update\update.exe
+ 2005-10-12 23:16:56 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB917344\update\updspapi.dll
+ 2007-11-30 12:39:22 17,272 —-a-w C:\WINDOWS\$hf_mig$\KB938464\spmsg.dll
+ 2007-11-30 12:39:22 231,288 —-a-w C:\WINDOWS\$hf_mig$\KB938464\spuninst.exe
+ 2007-11-30 12:39:22 26,488 —-a-w C:\WINDOWS\$hf_mig$\KB938464\update\spcustom.dll
+ 2007-11-30 11:20:44 755,576 —-a-w C:\WINDOWS\$hf_mig$\KB938464\update\update.exe
+ 2007-11-30 12:39:22 382,840 —-a-w C:\WINDOWS\$hf_mig$\KB938464\update\updspapi.dll
+ 2008-03-27 09:22:32 60,416 —-a-w C:\WINDOWS\$hf_mig$\KB942763\SP2QFE\tzchange.exe
+ 2008-03-27 10:40:24 60,416 —-a-w C:\WINDOWS\$hf_mig$\KB942763\SP3GDR\tzchange.exe
+ 2008-03-27 10:46:15 60,416 —-a-w C:\WINDOWS\$hf_mig$\KB942763\SP3QFE\tzchange.exe
+ 2007-11-30 11:18:51 17,272 —-a-w C:\WINDOWS\$hf_mig$\KB942763\spmsg.dll
+ 2007-11-30 11:18:51 231,288 —-a-w C:\WINDOWS\$hf_mig$\KB942763\spuninst.exe
+ 2007-11-30 11:18:51 26,488 —-a-w C:\WINDOWS\$hf_mig$\KB942763\update\spcustom.dll
+ 2007-11-30 11:18:51 755,576 —-a-w C:\WINDOWS\$hf_mig$\KB942763\update\update.exe
+ 2007-11-30 11:18:51 382,840 —-a-w C:\WINDOWS\$hf_mig$\KB942763\update\updspapi.dll
+ 2007-11-14 07:18:03 450,560 —-a-w C:\WINDOWS\$hf_mig$\KB942840\SP2QFE\jscript.dll
+ 2007-03-06 01:22:36 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB942840\spmsg.dll
+ 2007-03-06 01:22:41 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB942840\spuninst.exe
+ 2007-03-06 01:22:34 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB942840\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB942840\update\update.exe
+ 2007-03-06 01:23:51 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB942840\update\updspapi.dll
+ 2007-12-18 14:32:13 450,560 —-a-w C:\WINDOWS\$hf_mig$\KB944338-v2\SP2QFE\jscript.dll
+ 2007-12-18 14:32:13 417,792 —-a-w C:\WINDOWS\$hf_mig$\KB944338-v2\SP2QFE\vbscript.dll
+ 2007-03-06 01:22:36 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB944338-v2\spmsg.dll
+ 2007-03-06 01:22:41 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB944338-v2\spuninst.exe
+ 2007-03-06 01:22:34 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB944338-v2\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB944338-v2\update\update.exe
+ 2007-03-06 01:23:51 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB944338-v2\update\updspapi.dll
+ 2008-05-02 13:30:08 83,968 —-a-w C:\WINDOWS\$hf_mig$\KB946648\SP2QFE\msgsc.dll
+ 2008-05-02 14:01:49 83,968 —-a-w C:\WINDOWS\$hf_mig$\KB946648\SP3GDR\msgsc.dll
+ 2008-05-02 13:42:10 83,968 —-a-w C:\WINDOWS\$hf_mig$\KB946648\SP3QFE\msgsc.dll
+ 2007-11-30 12:39:22 17,272 —-a-w C:\WINDOWS\$hf_mig$\KB946648\spmsg.dll
+ 2007-11-30 12:39:22 231,288 —-a-w C:\WINDOWS\$hf_mig$\KB946648\spuninst.exe
+ 2007-11-30 12:39:22 26,488 —-a-w C:\WINDOWS\$hf_mig$\KB946648\update\spcustom.dll
+ 2007-11-30 11:20:44 755,576 —-a-w C:\WINDOWS\$hf_mig$\KB946648\update\update.exe
+ 2007-11-30 12:39:22 382,840 —-a-w C:\WINDOWS\$hf_mig$\KB946648\update\updspapi.dll
+ 2008-01-23 04:56:21 554,008 —-a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\dao360.dll
+ 2007-12-10 12:41:11 518,944 —-a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msexch40.dll
+ 2007-12-10 12:41:11 326,432 —-a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msexcl40.dll
+ 2007-12-10 12:41:11 1,516,568 —-a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjet40.dll
+ 2007-12-10 12:41:11 355,112 —-a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjetol1.dll
+ 2008-03-27 07:39:13 151,583 —-a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjint40.dll
+ 2007-12-10 12:41:12 60,192 —-a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjter40.dll
+ 2007-12-10 12:41:12 248,608 —-a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjtes40.dll
+ 2007-12-10 12:41:12 219,936 —-a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msltus40.dll
+ 2007-12-10 12:41:12 355,104 —-a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mspbde40.dll
+ 2007-12-10 12:41:13 432,928 —-a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrd2x40.dll
+ 2007-12-10 12:41:13 322,336 —-a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrd3x40.dll
+ 2007-12-10 12:41:13 559,904 —-a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrepl40.dll
+ 2007-12-10 12:41:13 264,992 —-a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mstext40.dll
+ 2007-12-10 12:41:13 838,432 —-a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mswdat10.dll
+ 2007-12-10 12:41:14 621,344 —-a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mswstr10.dll
+ 2007-12-10 12:41:14 355,104 —-a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msxbde40.dll
+ 2007-03-06 01:22:36 14,048 —-a-w C:\WINDOWS\$hf_mig$\KB950749\spmsg.dll
+ 2007-03-06 01:22:41 213,216 —-a-w C:\WINDOWS\$hf_mig$\KB950749\spuninst.exe
+ 2007-03-06 01:22:34 22,752 —-a-w C:\WINDOWS\$hf_mig$\KB950749\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 —-a-w C:\WINDOWS\$hf_mig$\KB950749\update\update.exe
+ 2007-03-06 01:23:51 371,424 —-a-w C:\WINDOWS\$hf_mig$\KB950749\update\updspapi.dll
+ 2008-04-21 06:56:54 1,024,000 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\browseui.dll
+ 2008-04-21 06:56:54 151,040 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\cdfview.dll
+ 2008-04-21 06:56:55 1,054,208 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\danim.dll
+ 2008-04-21 06:56:55 357,888 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\dxtmsft.dll
+ 2008-04-21 06:56:55 205,312 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\dxtrans.dll
+ 2008-04-21 06:56:55 55,808 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\extmgr.dll
+ 2008-04-17 10:46:59 18,432 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\iedw.exe
+ 2008-04-21 06:56:56 251,904 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\iepeers.dll
+ 2008-04-21 06:56:56 96,256 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\inseng.dll
+ 2008-04-21 06:56:56 16,384 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\jsproxy.dll
+ 2008-04-21 06:56:57 3,066,880 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\mshtml.dll
+ 2008-04-21 06:56:57 449,024 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\mshtmled.dll
+ 2008-04-21 06:56:57 146,432 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\msrating.dll
+ 2008-04-21 06:56:58 532,480 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\mstime.dll
+ 2008-04-21 06:56:58 39,424 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\pngfilt.dll
+ 2008-04-21 06:56:58 1,499,136 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\shdocvw.dll
+ 2008-04-21 06:56:58 474,112 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\shlwapi.dll
+ 2008-04-21 06:56:58 618,496 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\urlmon.dll
+ 2008-04-21 06:56:59 666,624 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\wininet.dll
+ 2008-04-17 10:37:04 351,744 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\xpsp3res.dll
+ 2008-04-21 06:44:29 3,066,880 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP3GDR\mshtml.dll
+ 2008-04-21 06:44:29 666,112 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP3GDR\wininet.dll
+ 2008-04-21 06:24:01 3,067,392 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP3QFE\mshtml.dll
+ 2008-04-21 06:24:02 666,624 —-a-w C:\WINDOWS\$hf_mig$\KB950759\SP3QFE\wininet.dll
+ 2007-11-30 12:39:22 17,272 —-a-w C:\WINDOWS\$hf_mig$\KB950759\spmsg.dll
+ 2007-11-30 12:39:22 231,288 —-a-w C:\WINDOWS\$hf_mig$\KB950759\spuninst.exe
+ 2007-11-30 12:39:22 26,488 —-a-w C:\WINDOWS\$hf_mig$\KB950759\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 —-a-w C:\WINDOWS\$hf_mig$\KB950759\update\update.exe
+ 2007-11-30 12:39:22 382,840 —-a-w C:\WINDOWS\$hf_mig$\KB950759\update\updspapi.dll
+ 2007-11-30 12:39:22 17,272 —-a-w C:\WINDOWS\$hf_mig$\KB950760\spmsg.dll
+ 2007-11-30 12:39:22 231,288 —-a-w C:\WINDOWS\$hf_mig$\KB950760\spuninst.exe
+ 2007-11-30 12:39:22 26,488 —-a-w C:\WINDOWS\$hf_mig$\KB950760\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 —-a-w C:\WINDOWS\$hf_mig$\KB950760\update\update.exe
+ 2007-11-30 12:39:22 382,840 —-a-w C:\WINDOWS\$hf_mig$\KB950760\update\updspapi.dll
+ 2008-05-08 12:14:51 203,008 —-a-w C:\WINDOWS\$hf_mig$\KB950762\SP2QFE\rmcast.sys
+ 2008-05-08 14:02:52 203,136 —-a-w C:\WINDOWS\$hf_mig$\KB950762\SP3GDR\rmcast.sys
+ 2008-05-08 13:58:17 203,136 —-a-w C:\WINDOWS\$hf_mig$\KB950762\SP3QFE\rmcast.sys
+ 2007-11-30 12:39:22 17,272 —-a-w C:\WINDOWS\$hf_mig$\KB950762\spmsg.dll
+ 2007-11-30 12:39:22 231,288 —-a-w C:\WINDOWS\$hf_mig$\KB950762\spuninst.exe
+ 2007-11-30 12:39:22 26,488 —-a-w C:\WINDOWS\$hf_mig$\KB950762\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 —-a-w C:\WINDOWS\$hf_mig$\KB950762\update\update.exe
+ 2007-11-30 12:39:22 382,840 —-a-w C:\WINDOWS\$hf_mig$\KB950762\update\updspapi.dll
+ 2008-07-07 20:06:43 253,952 —-a-w C:\WINDOWS\$hf_mig$\KB950974\SP2QFE\es.dll
+ 2008-07-07 20:26:58 253,952 —-a-w C:\WINDOWS\$hf_mig$\KB950974\SP3GDR\es.dll
+ 2008-07-07 20:23:18 253,952 —-a-w C:\WINDOWS\$hf_mig$\KB950974\SP3QFE\es.dll
+ 2007-11-30 12:39:22 17,272 —-a-w C:\WINDOWS\$hf_mig$\KB950974\spmsg.dll
+ 2007-11-30 12:39:22 231,288 —-a-w C:\WINDOWS\$hf_mig$\KB950974\spuninst.exe
+ 2007-11-30 12:39:22 26,488 —-a-w C:\WINDOWS\$hf_mig$\KB950974\update\spcustom.dll
+ 2007-11-30 12:39:18 755,576 —-a-w C:\WINDOWS\$hf_mig$\KB950974\update\update.exe
+ 2007-11-30 12:39:19 382,840 —-a-w C:\WINDOWS\$hf_mig$\KB950974\update\updspapi.dll
+ 2008-04-11 18:39:39 683,520 —-a-w C:\WINDOWS\$hf_mig$\KB951066\SP2QFE\inetcomm.dll
+ 2008-04-11 19:04:26 691,712 —-a-w C:\WINDOWS\$hf_mig$\KB951066\SP3GDR\inetcomm.dll
+ 2008-04-12 06:22:26 691,712 —-a-w C:\WINDOWS\$hf_mig$\KB951066\SP3QFE\inetcomm.dll
+ 2007-11-30 12:39:22 17,272 —-a-w C:\WINDOWS\$hf_mig$\KB951066\spmsg.dll
+ 2007-11-30 12:39:22 231,288 —-a-w C:\WINDOWS\$hf_mig$\KB951066\spuninst.exe
+ 2007-11-30 12:39:22 26,488 —-a-w C:\WINDOWS\$hf_mig$\KB951066\update\spcustom.dll
+ 2007-12-03 15:25:31 755,576 —-a-w C:\WINDOWS\$hf_mig$\KB951066\update\update.exe
+ 2007-11-30 12:39:22 382,840 —-a-w C:\WINDOWS\$hf_mig$\KB951066\update\updspapi.dll
+ 2008-07-14 11:03:00 62,976 —-a-w C:\WINDOWS\$hf_mig$\KB951072-v2\SP2QFE\tzchange.exe
+ 2008-07-11 12:42:28 62,976 —-a-w C:\WINDOWS\$hf_mig$\KB951072-v2\SP3GDR\tzchange.exe
+ 2008-07-11 12:51:51 62,976 —-a-w C:\WINDOWS\$hf_mig$\KB951072-v2\SP3QFE\tzchange.exe
+ 2007-11-30 11:18:51 17,272 —-a-w C:\WINDOWS\$hf_mig$\KB951072-v2\spmsg.dll
+ 2007-11-30 11:18:51 231,288 —-a-w C:\WINDOWS\$hf_mig$\KB951072-v2\spuninst.exe
+ 2007-11-30 11:18:51 26,488 —-a-w C:\WINDOWS\$hf_mig$\KB951072-v2\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 —-a-w C:\WINDOWS\$hf_mig$\KB951072-v2\update\update.exe
+ 2007-11-30 12:39:22 382,840 —-a-w C:\WINDOWS\$hf_mig$\KB951072-v2\update\updspapi.dll
+ 2008-06-13 09:52:16 272,128 —-a-w C:\WINDOWS\$hf_mig$\KB951376-v2\SP2QFE\bthport.sys
+ 2008-06-13 11:05:51 272,128 —-a-w C:\WINDOWS\$hf_mig$\KB951376-v2\SP3GDR\bthport.sys
+ 2008-06-13 11:27:43 272,128 —-a-w C:\WINDOWS\$hf_mig$\KB951376-v2\SP3QFE\bthport.sys
+ 2007-11-30 11:18:51 17,272 —-a-w C:\WINDOWS\$hf_mig$\KB951376-v2\spmsg.dll
+ 2007-11-30 11:18:51 231,288 —-a-w C:\WINDOWS\$hf_mig$\KB951376-v2\spuninst.exe
+ 2007-11-30 11:18:51 26,488 —-a-w C:\WINDOWS\$hf_mig$\KB951376-v2\update\spcustom.dll
+ 2007-11-30 11:18:51 755,576 —-a-w C:\WINDOWS\$hf_mig$\KB951376-v2\update\update.exe
+ 2007-11-30 11:18:51 382,840 —-a-w C:\WINDOWS\$hf_mig$\KB951376-v2\update\updspapi.dll
+ 2008-05-07 04:55:40 1,288,192 —-a-w C:\WINDOWS\$hf_mig$\KB951698\SP2QFE\quartz.dll
+ 2008-05-07 05:12:40 1,288,192 —-a-w C:\WINDOWS\$hf_mig$\KB951698\SP3GDR\quartz.dll
+ 2008-05-07 05:04:15 1,288,192 —-a-w C:\WINDOWS\$hf_mig$\KB951698\SP3QFE\quartz.dll
+ 2007-11-30 11:18:51 17,272 —-a-w C:\WINDOWS\$hf_mig$\KB951698\spmsg.dll
+ 2007-11-30 11:18:51 231,288 —-a-w C:\WINDOWS\$hf_mig$\KB951698\spuninst.exe
+ 2007-11-30 11:18:51 26,488 —-a-w C:\WINDOWS\$hf_mig$\KB951698\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 —-a-w C:\WINDOWS\$hf_mig$\KB951698\update\update.exe
+ 2007-11-30 12:39:22 382,840 —-a-w C:\WINDOWS\$hf_mig$\KB951698\update\updspapi.dll
+ 2006-08-16 12:08:32 100,352 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\6to4svc.dll
+ 2008-06-20 10:44:08 138,368 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\afd.sys
+ 2008-06-20 17:36:11 147,968 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\dnsapi.dll
+ 2008-06-20 17:36:11 245,248 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\mswsock.dll
+ 2008-06-20 10:44:42 360,960 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
+ 2008-06-20 09:32:39 225,920 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip6.sys
+ 2008-06-20 11:40:08 138,496 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\afd.sys
+ 2008-06-20 17:46:57 147,968 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\dnsapi.dll
+ 2008-06-20 17:46:57 245,248 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\mswsock.dll
+ 2008-06-20 11:51:12 361,600 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
+ 2008-06-20 11:08:27 225,856 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip6.sys
+ 2008-06-20 11:48:03 138,496 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\afd.sys
+ 2008-06-20 17:43:05 147,968 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\dnsapi.dll
+ 2008-06-20 17:43:05 245,248 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\mswsock.dll
+ 2008-06-20 11:59:02 361,600 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
+ 2008-06-20 11:16:44 225,856 —-a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip6.sys
+ 2007-11-30 12:39:22 17,272 —-a-w C:\WINDOWS\$hf_mig$\KB951748\spmsg.dll
+ 2007-11-30 12:39:22 231,288 —-a-w C:\WINDOWS\$hf_mig$\KB951748\spuninst.exe
+ 2007-11-30 12:39:22 26,488 —-a-w C:\WINDOWS\$hf_mig$\KB951748\update\spcustom.dll
+ 2007-11-30 12:39:18 755,576 —-a-w C:\WINDOWS\$hf_mig$\KB951748\update\update.exe
+ 2007-11-30 12:39:19 382,840 —-a-w C:\WINDOWS\$hf_mig$\KB951748\update\updspapi.dll
+ 2008-05-01 15:04:00 331,776 —-a-w C:\WINDOWS\$hf_mig$\KB952287\SP2QFE\msadce.dll
+ 2008-05-01 14:33:02 331,776 —-a-w C:\WINDOWS\$hf_mig$\KB952287\SP3GDR\msadce.dll
+ 2008-05-01 14:38:05 331,776 —-a-w C:\WINDOWS\$hf_mig$\KB952287\SP3QFE\msadce.dll
+ 2007-11-30 11:18:51 17,272 —-a-w C:\WINDOWS\$hf_mig$\KB952287\spmsg.dll
+ 2007-11-30 11:18:51 231,288 —-a-w C:\WINDOWS\$hf_mig$\KB952287\spuninst.exe
+ 2007-11-30 11:18:51 26,488 —-a-w C:\WINDOWS\$hf_mig$\KB952287\update\spcustom.dll
+ 2007-11-30 11:18:51 755,576 —-a-w C:\WINDOWS\$hf_mig$\KB952287\update\update.exe
+ 2007-11-30 11:18:51 382,840 —-a-w C:\WINDOWS\$hf_mig$\KB952287\update\updspapi.dll
+ 2008-06-24 16:28:00 74,240 —-a-w C:\WINDOWS\$hf_mig$\KB952954\SP2QFE\mscms.dll
+ 2008-06-24 16:43:16 74,240 —-a-w C:\WINDOWS\$hf_mig$\KB952954\SP3GDR\mscms.dll
+ 2008-06-24 16:53:10 74,240 —-a-w C:\WINDOWS\$hf_mig$\KB952954\SP3QFE\mscms.dll
+ 2007-11-30 12:39:22 17,272 —-a-w C:\WINDOWS\$hf_mig$\KB952954\spmsg.dll
+ 2007-11-30 12:39:22 231,288 —-a-w C:\WINDOWS\$hf_mig$\KB952954\spuninst.exe
+ 2007-11-30 12:39:22 26,488 —-a-w C:\WINDOWS\$hf_mig$\KB952954\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 —-a-w C:\WINDOWS\$hf_mig$\KB952954\update\update.exe
+ 2007-11-30 12:39:22 382,840 —-a-w C:\WINDOWS\$hf_mig$\KB952954\update\updspapi.dll
+ 2008-06-23 16:11:40 1,024,000 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\browseui.dll
+ 2008-06-23 16:11:40 151,040 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\cdfview.dll
+ 2008-06-23 16:11:42 1,054,208 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\danim.dll
+ 2008-06-23 16:11:43 357,888 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\dxtmsft.dll
+ 2008-06-23 16:11:43 205,312 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\dxtrans.dll
+ 2008-06-23 16:11:43 55,808 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\extmgr.dll
+ 2008-06-23 09:53:58 18,432 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\iedw.exe
+ 2008-06-23 16:11:52 251,904 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\iepeers.dll
+ 2008-06-23 16:11:52 96,256 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\inseng.dll
+ 2008-06-23 16:11:52 16,384 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\jsproxy.dll
+ 2008-06-23 16:11:58 3,067,392 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\mshtml.dll
+ 2008-06-23 16:12:00 449,024 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\mshtmled.dll
+ 2008-06-23 16:12:02 146,432 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\msrating.dll
+ 2008-06-23 16:12:02 532,480 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\mstime.dll
+ 2008-06-23 16:12:02 39,424 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\pngfilt.dll
+ 2008-06-23 16:12:05 1,499,136 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\shdocvw.dll
+ 2008-06-23 16:12:05 474,112 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\shlwapi.dll
+ 2008-06-23 16:12:06 618,496 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\urlmon.dll
+ 2008-06-23 16:12:08 667,136 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\wininet.dll
+ 2008-07-03 09:14:02 351,744 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\xpsp3res.dll
+ 2008-06-23 15:09:27 3,067,392 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP3GDR\mshtml.dll
+ 2008-06-26 08:15:29 1,499,136 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP3GDR\shdocvw.dll
+ 2008-06-26 08:15:30 619,520 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP3GDR\urlmon.dll
+ 2008-06-23 15:09:27 666,112 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP3GDR\wininet.dll
+ 2008-06-25 04:24:48 3,067,904 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP3QFE\mshtml.dll
+ 2008-06-26 08:00:52 1,499,136 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP3QFE\shdocvw.dll
+ 2008-06-26 08:00:52 619,520 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP3QFE\urlmon.dll
+ 2008-06-23 14:54:47 666,624 —-a-w C:\WINDOWS\$hf_mig$\KB953838\SP3QFE\wininet.dll
+ 2007-11-30 12:39:22 17,272 —-a-w C:\WINDOWS\$hf_mig$\KB953838\spmsg.dll
+ 2007-11-30 12:39:22 231,288 —-a-w C:\WINDOWS\$hf_mig$\KB953838\spuninst.exe
+ 2007-11-30 12:39:22 26,488 —-a-w C:\WINDOWS\$hf_mig$\KB953838\update\spcustom.dll
+ 2007-11-30 12:39:18 755,576 —-a-w C:\WINDOWS\$hf_mig$\KB953838\update\update.exe
+ 2007-11-30 12:39:19 382,840 —-a-w C:\WINDOWS\$hf_mig$\KB953838\update\updspapi.dll
+ 2007-11-30 12:39:22 17,272 —-a-w C:\WINDOWS\$hf_mig$\KB953839\spmsg.dll
+ 2007-11-30 12:39:22 231,288 —-a-w C:\WINDOWS\$hf_mig$\KB953839\spuninst.exe
+ 2007-11-30 12:39:22 26,488 —-a-w C:\WINDOWS\$hf_mig$\KB953839\update\spcustom.dll
+ 2007-11-30 11:18:51 755,576 —-a-w C:\WINDOWS\$hf_mig$\KB953839\update\update.exe
+ 2007-11-30 11:18:51 382,840 —-a-w C:\WINDOWS\$hf_mig$\KB953839\update\updspapi.dll
- 2007-02-22 18:58:31 1,200,128 —-a-w C:\WINDOWS\assembly\GAC\System.Web\1.0.3300.0__b03f5f7f11d50a3a\System.Web.dll
+ 2008-07-30 09:02:14 1,200,128 —-a-w C:\WINDOWS\assembly\GAC\System.Web\1.0.3300.0__b03f5f7f11d50a3a\System.Web.dll
+ 2008-07-30 09:02:26 61,440 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.0.3705\CustomMarshalers\1.0.3300.0__b03f5f7f11d50a3a_7461ad1f\CustomMarshalers.dll
+ 2008-07-30 09:02:32 3,301,376 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.0.3705\mscorlib\1.0.3300.0__b77a5c561934e089_2e63bbf6\mscorlib.dll
+ 2008-07-30 09:02:53 1,454,080 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.0.3705\System.Design\1.0.3300.0__b03f5f7f11d50a3a_fcb3acf6\System.Design.dll
+ 2008-07-30 09:03:00 90,112 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.0.3705\System.Drawing.Design\1.0.3300.0__b03f5f7f11d50a3a_bff385bb\System.Drawing.Design.dll
+ 2008-07-30 09:02:58 847,872 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.0.3705\System.Drawing\1.0.3300.0__b03f5f7f11d50a3a_87c7c7d5\System.Drawing.dll
+ 2008-07-30 09:03:07 2,953,216 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.0.3705\System.Windows.Forms\1.0.3300.0__b77a5c561934e089_0817e849\System.Windows.Forms.dll
+ 2008-07-30 09:03:14 2,027,520 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.0.3705\System.Xml\1.0.3300.0__b77a5c561934e089_f8e8565b\System.Xml.dll
+ 2008-07-30 09:02:40 1,855,488 —-a-w C:\WINDOWS\assembly\NativeImages1_v1.0.3705\System\1.0.3300.0__b77a5c561934e089_b1a51f18\System.dll
+ 2004-09-07 17:43:50 297,472 —-a-w C:\WINDOWS\Downloaded Program Files\VAPGDecoder.dll
- 2008-07-28 18:35:06 65,536 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\PM_Designer.exe
+ 2008-10-11 21:06:00 65,536 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\PM_Designer.exe
- 2008-07-28 18:35:06 25,214 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe
+ 2008-10-11 21:06:00 25,214 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe
- 2008-07-28 18:35:06 25,214 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat_Standard.exe
+ 2008-10-11 21:06:01 25,214 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat_Standard.exe
- 2008-07-28 18:35:07 25,214 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Distiller.exe
+ 2008-10-11 21:06:01 25,214 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Distiller.exe
- 2008-07-28 18:35:06 7,278 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_ELEMENTS_DT.exe
+ 2008-10-11 21:06:01 7,278 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_ELEMENTS_DT.exe
- 2004-08-04 05:11:02 200,704 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\aspnet_isapi.dll
+ 2007-01-02 22:34:04 200,704 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\aspnet_isapi.dll
- 2004-08-04 05:11:06 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\aspnet_wp.exe
+ 2007-01-02 22:34:04 32,768 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\aspnet_wp.exe
+ 2007-01-15 22:10:00 61,440 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\gacutil.exe
- 2004-07-20 01:54:06 7,680 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\IEExec.exe
+ 2007-01-02 22:29:28 8,192 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\IEExec.exe
- 2004-08-04 05:12:04 73,728 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscorie.dll
+ 2007-01-02 22:29:12 73,728 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscorie.dll
- 2004-08-04 05:12:06 86,016 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscorld.dll
+ 2007-01-02 22:29:12 86,016 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscorld.dll
- 2004-07-20 01:54:08 1,998,848 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscorlib.dll
+ 2007-01-02 22:21:20 1,998,848 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscorlib.dll
- 2004-07-20 01:54:12 2,265,088 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscorsvr.dll
+ 2007-01-02 22:28:28 2,273,280 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscorsvr.dll
- 2004-07-20 01:54:14 2,269,184 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
+ 2007-01-02 22:28:46 2,281,472 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
+ 2007-01-15 22:11:26 73,728 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\netfxupdate.exe
+ 2007-01-15 22:11:30 57,344 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\SetRegNI.exe
- 2004-07-20 01:54:20 1,200,128 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\System.Web.dll
+ 2007-01-02 22:40:24 1,200,128 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\System.Web.dll
+ 2007-01-15 22:11:30 57,344 —-a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\ToGac.exe
- 2008-07-28 18:21:48 319,488 —ha-w C:\WINDOWS\repair\ntuser.dat
+ 2008-10-11 19:49:32 3,018,752 —ha-w C:\WINDOWS\repair\ntuser.dat
+ 2008-05-24 00:21:42 81,920 —-a-w C:\WINDOWS\system32\404Fix.exe
- 2007-07-31 01:19:20 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
+ 2004-08-04 12:00:00 66,560 —-a-w C:\WINDOWS\system32\cdm.dll
- 2008-07-28 18:31:53 16,384 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-10-11 19:59:16 16,384 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-07-28 18:31:53 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-10-11 19:59:16 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-10-11 19:59:23 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2004-08-04 12:00:00 430,592 -c–a-w C:\WINDOWS\system32\dllcache\wuapi.dll
+ 2008-07-19 04:09:44 563,912 -c–a-w C:\WINDOWS\system32\dllcache\wuapi.dll
- 2004-08-04 12:00:00 111,104 -c–a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
+ 2008-07-19 04:10:42 53,448 -c–a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
- 2004-08-04 12:00:00 1,134,592 -c–a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
+ 2008-07-19 04:09:42 1,811,656 -c–a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
- 2004-08-04 12:00:00 112,640 -c–a-w C:\WINDOWS\system32\dllcache\wucltui.dll
+ 2008-07-19 04:09:46 325,832 -c–a-w C:\WINDOWS\system32\dllcache\wucltui.dll
- 2004-08-04 02:56:46 36,864 -c–a-w C:\WINDOWS\system32\dllcache\wups.dll
+ 2008-07-19 04:10:20 36,552 -c–a-w C:\WINDOWS\system32\dllcache\wups.dll
- 2004-08-04 12:00:00 120,320 -c–a-w C:\WINDOWS\system32\dllcache\wuweb.dll
+ 2008-07-19 04:09:44 205,000 -c–a-w C:\WINDOWS\system32\dllcache\wuweb.dll
+ 2004-08-04 12:00:00 274,304 —-a-w C:\WINDOWS\system32\drivers\bthport.sys
+ 2002-09-25 13:09:12 140,800 —-a-w C:\WINDOWS\system32\drivers\e100b325.sys
+ 2004-08-01 00:50:36 51,200 —-a-w C:\WINDOWS\system32\dumphive.exe
+ 2002-10-08 01:15:36 16,384 —-a-w C:\WINDOWS\system32\e100bmsg.dll
- 2008-07-24 04:43:44 1,514,048 —-a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-08-11 20:07:20 1,514,048 —-a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2004-08-04 12:00:00 21,504 —-a-w C:\WINDOWS\system32\hidserv.dll
- 2004-08-04 02:56:42 678,400 —-a-w C:\WINDOWS\system32\inetcomm.dll
+ 2008-04-11 18:50:43 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
+ 2001-07-20 13:40:28 23,040 —-a-w C:\WINDOWS\system32\IntelNic.dll
- 2004-09-29 02:29:28 45,161 —-a-w C:\WINDOWS\system32\java.exe
+ 2008-06-10 07:21:01 135,168 —-a-w C:\WINDOWS\system32\java.exe
- 2004-09-29 02:29:34 45,163 —-a-w C:\WINDOWS\system32\javaw.exe
+ 2008-06-10 07:21:04 135,168 —-a-w C:\WINDOWS\system32\javaw.exe
+ 2008-06-10 08:32:34 139,264 —-a-w C:\WINDOWS\system32\javaws.exe
+ 2008-03-25 03:21:18 2,889,088 —-a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
+ 2008-03-25 03:21:20 218,496 —-a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2008-09-09 03:28:50 70,264 —-a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
- 2000-07-15 06:00:00 118,784 —-a-w C:\WINDOWS\system32\MSSTDFMT.DLL
+ 2004-02-23 05:00:00 119,808 —-a-w C:\WINDOWS\system32\MSSTDFMT.DLL
- 2008-07-28 07:49:01 46,456 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-10-11 19:29:12 46,456 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2008-07-28 07:49:01 366,968 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-10-11 19:29:12 366,968 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2003-06-06 03:13:00 53,248 —-a-w C:\WINDOWS\system32\Process.exe
+ 2006-12-18 07:07:17 52,600 —-a-w C:\WINDOWS\system32\Prounstl.exe
+ 2008-07-19 04:10:20 36,552 —-a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.784\wups.dll
+ 2008-07-19 04:10:40 45,768 —-a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.784\wups2.dll
- 2005-05-04 20:45:26 13,536 —-a-w C:\WINDOWS\system32\spmsg.dll
+ 2007-07-27 16:41:40 16,760 —-a-w C:\WINDOWS\system32\spmsg.dll
+ 2005-02-25 03:35:05 22,752 —-a-w C:\WINDOWS\system32\spupdsvc.exe
+ 2006-04-27 23:49:30 288,417 —-a-w C:\WINDOWS\system32\SrchSTS.exe
+ 2006-01-09 16:36:06 40,960 —-a-w C:\WINDOWS\system32\swsc.exe
+ 2008-07-14 11:09:18 62,976 —-a-w C:\WINDOWS\system32\tzchange.exe
+ 2008-05-29 15:35:36 86,528 —-a-w C:\WINDOWS\system32\VACFix.exe
+ 2007-09-06 06:22:23 289,144 —-a-w C:\WINDOWS\system32\VCCLSID.exe
+ 2007-10-04 06:36:46 25,600 —-a-w C:\WINDOWS\system32\WS2Fix.exe
+ 2008-07-03 09:14:02 351,744 —-a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2004-08-04 12:00:00 921,088 —-a-w C:\WINDOWS\WinSxS\InstallTemp\69787\comctl32.dll
+ 2008-04-15 17:54:19 1,724,416 —-a-w C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-14 68856]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"Google Update"="C:\Documents and Settings\JK.NS2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-08 133104]
"RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-07-20 160592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 59392]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"FaxTalk Messenger Pro 7.0"="F:\Program Files\FaxTalk Messenger Pro 7.0\FTClCtrl.exe" [2004-12-22 122880]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-09-29 1234712]
"FaxTalk CallControl 7.0"="f:\Program Files\FaxTalk Messenger Pro 7.0\FTClCtrl.exe" [2004-12-22 122880]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-07-20 160592]

C:\Documents and Settings\JK.NS2\Start Menu\Programs\Startup\
Run POPFile.lnk - F:\Program Files\POPFile\runpopfile.exe [2008-05-10 71160]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2008-07-17 25214]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-04-09 651264]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll ohnova.dll qivqgb.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e38c648a-51a7-11dd-a30d-806d6172696f}]
\Shell\AutoRun\command - L:\WD_Windows_Tools\Setup.exe

*Newly Created Service* - MSISERVER
.
Contents of the 'Scheduled Tasks' folder

2008-10-12 C:\WINDOWS\Tasks\GoogleUpdateTaskUser.job
- C:\Documents and Settings\JK.NS2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-08 20:57]
.
.
——- Supplementary Scan ——-
.
R0 -: HKCU-Main,Start Page = about:blank
R0 -: HKCU-Main,Search Page = hxxp://www.google.com
R0 -: HKCU-Main,Search Bar = hxxp://www.google.com/ie
R0 -: HKLM-Main,Search Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
O8 -: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 -: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 -: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convert to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 -: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 -: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 -: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O17 -: HKLM\CCS\Interface\{D15F4A69-7188-4C20-A150-F80E084BBFFE}: NameServer = 75.154.132.68,75.154.132.100
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-11 22:37:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-10-11 22:41:34
ComboFix-quarantined-files.txt 2008-10-12 04:41:21
ComboFix2.txt 2008-07-30 04:19:50

Pre-Run: 14,895,861,760 bytes free
Post-Run: 15,296,913,408 bytes free

484 — E O F — 2008-09-10 09:00:46

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:44:10, on 2008-10-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
f:\Program Files\FaxTalk Messenger Pro 7.0\FTMSGSVC.EXE
f:\Program Files\FaxTalk Messenger Pro 7.0\FAPIEXE.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
F:\Program Files\FaxTalk Messenger Pro 7.0\FTClCtrl.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Documents and Settings\JK.NS2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
f:\PROGRA~1\POPFile\popfileib.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\acrotray.exe
f:\Program Files\FaxTalk Messenger Pro 7.0\FTMSGR32.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [FaxTalk Messenger Pro 7.0] "F:\Program Files\FaxTalk Messenger Pro 7.0\FTClCtrl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [FaxTalk CallControl 7.0] "f:\Program Files\FaxTalk Messenger Pro 7.0\FTClCtrl.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\JK.NS2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKUS\S-1-5-21-57989841-789336058-1957994488-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
O4 - HKUS\S-1-5-21-57989841-789336058-1957994488-1003\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User '?')
O4 - HKUS\S-1-5-21-57989841-789336058-1957994488-1003\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User '?')
O4 - HKUS\S-1-5-21-57989841-789336058-1957994488-1003\..\Run: [Google Update] "C:\Documents and Settings\JK.NS2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c (User '?')
O4 - HKUS\S-1-5-21-57989841-789336058-1957994488-1003\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User '?')
O4 - HKUS\S-1-5-18\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User '?')
O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')
O4 - S-1-5-21-57989841-789336058-1957994488-1003 Startup: Run POPFile.lnk = F:\Program Files\POPFile\runpopfile.exe (User '?')
O4 - .DEFAULT User Startup: Run POPFile.lnk = D:\Program Files\POPFile\runpopfile.exe (User 'Default user')
O4 - Startup: Run POPFile.lnk = F:\Program Files\POPFile\runpopfile.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://142.179.144.33:8080/plugin/h263ctrl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D15F4A69-7188-4C20-A150-F80E084BBFFE}: NameServer = 75.154.132.68,75.154.132.100
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll ohnova.dll qivqgb.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FaxTalk Messenger Pro 7.0 - Thought Communications, Inc. - f:\Program Files\FaxTalk Messenger Pro 7.0\FTMSGSVC.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

–
End of file - 11044 bytes
Post #7
Hello again,

Please do the following….

Download FixIEDef by ShadowPuterDude to the Desktop.

Note: Please disable any real time protection that may interfere with FixIEDef, such as Microsoft Defender, Spybot Search and Destroy's Tea Timer and SUPERAntiSpyware. Make sure you enable this protection once your computer is cleaned.

Instructions:

Disable Windows Defender until the computer is clean
  • Open Windows Defender
  • Select Tools and then General Settings
  • Under Real Time Protection Options uncheck Turn on real-time protection
  • Select Save
Don't forget to re-enable it, when your computer is clean.

Disable SUPERAntiSpyware until the computer is clean
  • Right-click on the shortcut from the system tray
  • Choose View Control Center (preferences/options)
  • On the General and Startup tab, uncheck Start SUPERAntispyware when Windows starts.
  • Click Close to exit.
Don't forget to re-enable it, when your computer is clean.

Disable Teatimer
First:
  • Right click Spybot in the System Tray (looks like a calendar with a padlock symbol)
  • Choose Exit Spybot S&D Resident
Second:
  • Open Spybot S&D
  • Click Mode, check Advanced Mode
  • Go To Left Panel, Click Tools, then also in left panel, click Resident
  • If your firewall raises a question, say OK
  • Uncheck the box labeled Resident Tea-Timer and OK any prompts.
  • Use File, Exit to terminate Spybot
  • Reboot your machine for the changes to take effect.
Don't forget to re-enable it, when your computer is clean.

Run FixIEDef:

Double-click FixIEDef
[external image: Posted Image]

Click 'Accept'
[external image: Posted Image]

Click 'Scan'
[external image: Posted Image]

Wait for the scan to finish. It won't take very long.
[external image: Posted Image]

WARNING: FixIEDef will kill all copies of Internet Explorer and Explorer that are running, during scanning. The icons and Start Menu on your Desktop will not be visible while FixIEDef is scanning. This is necessary to remove parts of the infection that would otherwise not be removed.

Everything will be restored to normal, once the malicious file is removed.

Click 'Exit' once FixIEDef displays the All Finished message.
[external image: Posted Image]

Post the Results of the scan:

Post the FixIEDef log file, located on the Desktop, in your next reply.
[external image: Posted Image]
Post #8 last edited
Thanks again for that. If I remember correctly this is only the Thanksgiving weekend north of the border and not where you are. I did as noted and disabled the programs noted that were relevant to this system, which in this case is just SPyBot S&D and its Tea Timer.. Unfortunately, I ran into a similar problem to the one we had with RSIT: I see: AutoIT Error: Line: -1 Error: Expected Object not found (this is roughly what it says on the last line as I am forced to reboot at that point and I lose it as the whole desktop disappears when you run FixIEDef.exe). There must be something in particular with the way my system is configured that is giving both these programs this grief.
Post #9
Hi Tom,

That’s ok there is always something else we can try :thumbup:

OTmoveIT3

Please download the OTMoveIt3 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Processes
explorer.exe
:Files
C:\WINDOWS\system32\tmp.reg
:Commands
[Purity]
[EmptyTemp]
[Start Explorer]
[Reboot]
  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

===============================================
Kaspersky WebScanner
please go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.
===============================================

Needed in your next reply:

OTMoveIT3 log
Kaspersky report

And let me know how things are running.
Post #10

When I run RSIT I see:

AutoIT Error:
Incorrect number of parameters in function call.


I spoke with the creator of RSIT and we would like you to please navigate to C:\rsit and check to see if there is a log there from when you tried the scan. This will be able to help us better in determining the cause of the failure.

Please post it in your next reply.
Post #11
Sorry for the delay, was away for a couple of days and just returned. I'll try to get to the last post later this evening if possible, in the meantime here is what that logfile contains, unfortunately it doesn't look too promising:

Logfile of random's system information tool 1.04 (written by random/random)
Run by [removed] at 2008-10-12 12:54:36

Post #13
THanks, I'll have to post this log while I have it as it looks like the Kaspersky scan will be an overnighter: ========== PROCESSES ========== Process explorer.exe killed successfully. ========== FILES ========== C:\WINDOWS\system32\tmp.reg moved successfully. ========== COMMANDS ========== File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\Perflib_Perfdata_4a8.dat scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_0fMS1nTqLGaspLD scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_0MRZsQfgmmcOJoe scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_2cNJ8BaTGXMvNj7 scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_2uE3y9rHkFIoGph scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_2z3yfrt0KNOhD78 scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_5ajPkjcjdSHbyMK scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_6EZAM8sAZ4PZ2iH scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_6jh61W8JuJYVi8u scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_6VHezk5J3uYZFtj scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_7E6MRGxkydDtz3J scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_7oJAHIbMPLSXRhk scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_86LcjGVsNeMnn8S scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_8DgBLPvNjNOpz9h scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_9SnIrRRehNE1Yo6 scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_BeIy0PRKlXwdWbK scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_bKcDpmoxBF5aNmt scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_bo3fWAAAqSrOWXE scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_DEsUmuFUtID8xh3 scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_dggvLcEVTYmi0WN scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_DMvUQ6NEIoq05RV scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_Fg68uOAbEWzayM2 scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_H5w09Pf0HSYJiTs scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_m1VTPOF8NizS2vB scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_mB3yW2qe0JujJiR scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_MnR09oenuyGg4hp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_NrfRNa4VXum0gra scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_NXdVvB8YGYs2M2S scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_nZVrvl0PUJ12af7 scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_qtJLRbEtyFQjNsJ scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_qZiG2JrMLmquIiR scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_rhvHtv0HO9eieOi scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_rzDEiBgdmeN3scC scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_sdksOWbhuiaKwG9 scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_SHthRmb9egf1o8B scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_stvoFBB5QzpScQ5 scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_TLuqJy58njFNyrY scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_UwmDdyABDqUkt8V scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_vkpTEXmgZF6sPuM scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_VRBZAYBK5cZU7tp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_WiQP93wqsE1pgqd scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_x8sWrkpJJpUByrk scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_xv2vEXsccFXm5ZN scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_XyutTyYpajifsgN scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_Y9sL40KRzVj9pQg scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_yy3djjjRKufugFq scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\~DF19C1.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\~WRF0000.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\~WRS0002.tmp scheduled to be deleted on reboot. User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. Local Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_168.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.5.0 log created on 10152008_211422 Files moved on Reboot… File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\Perflib_Perfdata_4a8.dat not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_0fMS1nTqLGaspLD not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_0MRZsQfgmmcOJoe not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_2cNJ8BaTGXMvNj7 not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_2uE3y9rHkFIoGph not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_2z3yfrt0KNOhD78 not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_5ajPkjcjdSHbyMK not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_6EZAM8sAZ4PZ2iH not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_6jh61W8JuJYVi8u not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_6VHezk5J3uYZFtj not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_7E6MRGxkydDtz3J not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_7oJAHIbMPLSXRhk not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_86LcjGVsNeMnn8S not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_8DgBLPvNjNOpz9h not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_9SnIrRRehNE1Yo6 not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_BeIy0PRKlXwdWbK not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_bKcDpmoxBF5aNmt not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_bo3fWAAAqSrOWXE not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_DEsUmuFUtID8xh3 not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_dggvLcEVTYmi0WN not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_DMvUQ6NEIoq05RV not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_Fg68uOAbEWzayM2 not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_H5w09Pf0HSYJiTs not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_m1VTPOF8NizS2vB not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_mB3yW2qe0JujJiR not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_MnR09oenuyGg4hp not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_NrfRNa4VXum0gra not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_NXdVvB8YGYs2M2S not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_nZVrvl0PUJ12af7 not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_qtJLRbEtyFQjNsJ not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_qZiG2JrMLmquIiR not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_rhvHtv0HO9eieOi not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_rzDEiBgdmeN3scC not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_sdksOWbhuiaKwG9 not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_SHthRmb9egf1o8B not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_stvoFBB5QzpScQ5 not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_TLuqJy58njFNyrY not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_UwmDdyABDqUkt8V not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_vkpTEXmgZF6sPuM not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_VRBZAYBK5cZU7tp not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_WiQP93wqsE1pgqd not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_x8sWrkpJJpUByrk not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_xv2vEXsccFXm5ZN not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_XyutTyYpajifsgN not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_Y9sL40KRzVj9pQg not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\sqlite_yy3djjjRKufugFq not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\~DF19C1.tmp not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\~WRF0000.tmp not found! File C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\~WRS0002.tmp not found! File C:\WINDOWS\temp\Perflib_Perfdata_168.dat not found!
Post #15
Whew… That took awhile. I kept accidently closing the browser before the scan had finished so it took me 6 attempts before I actually managed to let it finish before I closed it. Anyway, the main weird behaviour I still see is IE Explorer does not launch. I ran the Kaspersky and do all my browsing in Maxthon Browser. Also you may wish to note, "Google Chrome" Browser will not run the Kaspersky online scan, at least it wouldn't for me with my configuration. Also, I assume you can disregard all the trojans found in the popfile messages as they are all in received SPAM emails that would just get deleted as soon as Popfile is cleaned out. KASPERSKY ONLINE SCANNER 7 REPORT Saturday, October 18, 2008 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Saturday, October 18, 2008 07:38:53 Records in database: 1320399 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\ Scan statistics: Files scanned: 523235 Threat name: 11 Infected objects: 30 Suspicious objects: 3 Duration of the scan: 14:59:26 File name / Threat name / Threats count C:\Documents and Settings\Administrator.NS2\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Infected: Trojan-Spy.HTML.Southfraud.r 6 C:\Documents and Settings\JK.NS2\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1 C:\System Volume Information\_restore{A50FA7F5-86D5-409A-AACB-4463F98E0FFE}\RP3\A0000049.dll Infected: Trojan.Win32.Monder.pfg 1 C:\System Volume Information\_restore{A50FA7F5-86D5-409A-AACB-4463F98E0FFE}\RP3\A0000050.dll Infected: Trojan.Win32.Monder.pfg 1 E:\Documents and Settings\John.MPARAM-2006\Local Settings\Temp\RarSFX1\RockXP4_.exe Infected: not-a-virus:PSWTool.Win32.RAS.a 1 E:\Downloads_2007\Virus Tools\SmitfraudFix.zip\SmitfraudFix.zip Infected: not-a-virus:RiskTool.Win32.Reboot.f 1 E:\RECYCLER\S-1-5-21-57989841-789336058-1957994488-1003\De1.rar Infected: not-a-virus:NetTool.Win32.Portscan.c 1 F:\Documents and Settings\John.MPARAM-2006\Local Settings\Temp\RarSFX1\RockXP4_.exe Infected: not-a-virus:PSWTool.Win32.RAS.a 1 F:\A_DATA\Mail\mparam-1.pst Infected: Backdoor.Win32.UltimateDefender.tt 8 F:\A_DATA\Mail\messages\00\00\00\popfile84.msg Suspicious: Trojan-Spy.HTML.Fraud.gen 1 F:\A_DATA\Mail\messages\00\00\00\popfile88.msg Suspicious: Trojan-Spy.HTML.Fraud.gen 1 F:\A_DATA\Mail\messages\00\00\00\popfile8d.msg Suspicious: Trojan-Spy.HTML.Fraud.gen 1 F:\Program Files\CyberKit\CyberKit.exe Infected: not-a-virus:NetTool.Win32.Scan.d 1 F:\Program Files\POPFile\messages\00\00\0a\popfile6e.msg Infected: Backdoor.Win32.UltimateDefender.tt 1 F:\Program Files\POPFile\messages\00\00\0a\popfile6f.msg Infected: Backdoor.Win32.UltimateDefender.tt 1 F:\Program Files\POPFile\messages\00\00\0a\popfile76.msg Infected: Backdoor.Win32.UltimateDefender.tt 1 F:\Program Files\POPFile\messages\00\00\0a\popfile79.msg Infected: Backdoor.Win32.UltimateDefender.tt 1 F:\Program Files\POPFile\messages\00\00\0a\popfile7a.msg Infected: Backdoor.Win32.UltimateDefender.tt 1 F:\Program Files\POPFile\messages\00\00\0a\popfile87.msg Infected: Backdoor.Win32.UltimateDefender.tt 1 F:\Program Files\POPFile\messages\00\00\0a\popfileff.msg Infected: Backdoor.Win32.UltimateDefender.tt 1 F:\Program Files\POPFile\messages\00\00\0d\popfile1a.msg Infected: Backdoor.Win32.UltimateDefender.tt 1 The selected area was scanned.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI