Spyware / Malware / Virus Removal

[Resolved] Spyware hijacked

8 min read

Looking for the outcome? Ask AI

aeweber Topic Starter

Post #1October 14, 2008, 9:23 PM UTC

My computere screen now says Warning: Spyware has been detected on your pc, and a website keeps poping up for a spyware removal program.
I can't control, alt, del. because it says my administrator had turned off task manager.

Please help.

Logfile of HijackThis v1.99.1
Scan saved at 2:22:12 PM, on 10/14/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\stacsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Symantec\LiveUpdate\LUALL.EXE
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Adam Weber\Local Settings\Temporary Internet Files\Content.IE5\OIG4MNGM\VundoFix[1].exe
C:\Weber\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=1060908
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=1060908
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\uesiuqcr.exe,
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {36142BDD-7850-42FC-9681-1534A35285B9} - (no file)
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\Quickset.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Unknown owner - C:\Program Files\Dantz\Retrospect\retrorun.exe (file missing)
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\stacsv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

Rorschach112

Post #2October 14, 2008, 9:37 PM UTC

Hello

Please visit this web page for instructions for downloading and running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. Don't select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

aeweber

Post #3October 14, 2008, 10:15 PM UTC

2008-08-26 20:39 ——— d—–w C:\Program Files\YAMAHA
2008-08-20 20:22 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-08-20 20:22 60,800 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-08-20 20:22 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-08-20 20:22 10,671 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-08-20 20:22 ——— d—–w C:\Program Files\Symantec
2008-08-20 20:02 ——— d—–w C:\Program Files\Updates
2008-08-20 19:17 ——— d—–w C:\Program Files\Rosetta Stone
2008-08-20 19:17 ——— d—–w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-08-20 18:12 ——— d—–w C:\Documents and Settings\Adam Weber\Application Data\BitZipper
2008-08-20 03:27 ——— d—–w C:\Documents and Settings\Adam Weber\Application Data\Roxio
2008-08-20 02:03 ——— d—–w C:\Program Files\Common Files\Macrovision Shared
2008-07-19 05:10 94,920 —-a-w C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-19 05:10 94,920 —-a-w C:\WINDOWS\system32\cdm.dll
2008-07-19 05:10 53,448 —-a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-19 05:10 53,448 —-a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-19 05:10 45,768 —-a-w C:\WINDOWS\system32\wups2.dll
2008-07-19 05:10 36,552 —-a-w C:\WINDOWS\system32\wups.dll
2008-07-19 05:10 36,552 —-a-w C:\WINDOWS\system32\dllcache\wups.dll
2008-07-19 05:09 563,912 —-a-w C:\WINDOWS\system32\wuapi.dll
2008-07-19 05:09 563,912 —-a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-19 05:09 325,832 —-a-w C:\WINDOWS\system32\wucltui.dll
2008-07-19 05:09 325,832 —-a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-19 05:09 205,000 —-a-w C:\WINDOWS\system32\wuweb.dll
2008-07-19 05:09 205,000 —-a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-19 05:09 1,811,656 —-a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-19 05:09 1,811,656 —-a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-19 05:07 270,880 —-a-w C:\WINDOWS\system32\mucltui.dll
2008-07-19 05:07 210,976 —-a-w C:\WINDOWS\system32\muweb.dll
2008-07-17 00:52 0 —-a-w C:\Documents and Settings\Adam Weber\Application Data\wklnhst.dat
2007-09-05 02:15 73,336 —-a-w C:\Documents and Settings\Adam Weber\Application Data\GDIPFONTCACHEV1.DAT
2006-10-06 18:46 88 –sh–r C:\WINDOWS\system32\C1D64A06F0.sys
2006-10-06 18:46 3,350 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—-a-w 368,706 2002-09-11 05:26:26 C:\Program Files\BroadJump\Client Foundation\bak\CFD.exe

—-a-w 81,920 2005-06-10 15:44:02 C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe
—-a-w 86,960 2006-09-11 11:40:34 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

—-a-w 249,856 2005-06-10 15:44:02 C:\Program Files\Common Files\InstallShield\UpdateService\bak\isuspm.exe
—-a-w 218,032 2006-09-11 11:40:32 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

-c–a-w 185,896 2006-11-28 09:33:47 C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe

—-a-w 57,344 2005-10-31 15:51:52 C:\Program Files\Creative\SBAudigy\Surround Mixer\bak\CTSysVol.exe

—-a-w 1,118,208 2006-02-16 14:20:20 C:\Program Files\Creative\VoiceCenter\bak\AndreaVC.exe

—-a-w 98,304 2006-05-03 11:12:00 C:\Program Files\Dell\Media Experience\bak\DMXLauncher.exe

—-a-w 1,032,192 2006-06-02 16:05:58 C:\Program Files\Dell\QuickSet\bak\Quickset.exe

-c–a-w 602,182 2006-05-01 14:28:26 C:\Program Files\Intel\Wireless\Bin\bak\ifrmewrk.exe

-c–a-w 667,718 2006-05-01 14:28:06 C:\Program Files\Intel\Wireless\Bin\bak\ZCfgSvc.exe

—-a-w 282,624 2006-10-26 02:58:18 C:\Program Files\QuickTime\bak\qttask.exe

-c–a-w 761,947 2006-03-08 16:48:02 C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe
—-a-w 774,233 2006-05-19 21:51:16 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

—-a-w 35,328 2007-02-13 18:29:00 C:\Program Files\Winamp\bak\winampa.exe

—-a-w 90,112 2000-05-11 06:00:00 C:\WINDOWS\bak\UpdReg.EXE

—-a-w 67,584 2005-09-29 19:01:14 C:\WINDOWS\ehome\bak\ehtray.exe

—-a-w 15,360 2004-08-10 10:00:00 C:\WINDOWS\system32\bak\ctfmon.exe
—-a-w 15,360 2008-04-14 00:12:16 C:\WINDOWS\system32\ctfmon.exe

—-a-w 237,568 2006-05-04 13:59:48 C:\WINDOWS\system32\bak\LVCOMSX.EXE

—-a-w 127,036 2006-09-21 13:20:00 C:\WINDOWS\system32\DLA\bak\DLACTRLW.EXE
—-a-w 122,940 2005-11-07 13:20:00 C:\WINDOWS\system32\DLA\DLACTRLW.EXE

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [N/A]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 C:\WINDOWS\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [N/A]
"VoiceCenter"="C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [N/A]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [N/A]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [N/A]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-19 774233]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-21 7557120]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [N/A]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 86960]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-09-11 218032]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [N/A]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [N/A]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [N/A]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [N/A]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-11-07 122940]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\Quickset.exe" [N/A]
"CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [N/A]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 115816]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-01-14 771704]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-08-16 236016]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 C:\WINDOWS\stsystra.exe]
"nwiz"="nwiz.exe" [2006-03-21 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2006-03-21 C:\WINDOWS\system32\nvhotkey.dll]
"MBMon"="CTMBHA.DLL" [2006-06-28 C:\WINDOWS\system32\CTMBHA.DLL]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-09-08 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.CEGSM"= mobilev.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD]
C:\Program Files\BroadJump\Client Foundation\CFD.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eFax 4.2]
–a—— 2006-07-14 13:36 107008 C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2006-10-30 10:36 256576 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCameraAssistant]
–a—— 2006-05-04 06:24 489472 C:\Program Files\Logitech\Video\CameraAssistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideo[inspector]]
–a—— 2006-05-04 06:32 73728 C:\Program Files\Logitech\Video\InstallHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
–a—— 2008-01-11 18:54 166304 c:\Program Files\Zune\ZuneLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)
"LVPrcSrv"=2 (0x2)
"ZuneWlanCfgSvc"=3 (0x3)
"ZuneNetworkSvc"=3 (0x3)
"ZuneBusEnum"=2 (0x2)
"SQLAgent$MICROSOFTSMLBIZ"=3 (0x3)
"MSSQL$MICROSOFTSMLBIZ"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\RosettaStoneVersion3.exe"=
"C:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\support\\bin\\win\\RosettaStoneLtdServices.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9713:TCP"= 9713:TCP:BitComet 9713 TCP
"9713:UDP"= 9713:UDP:BitComet 9713 UDP
""=

R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-01-11 40832]
S3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2006-05-04 16768]
S4 ZuneBusEnum;Zune Bus Enumerator;c:\WINDOWS\system32\ZuneBusEnum.exe [2008-01-11 61856]
S4 ZuneWlanCfgSvc;Zune Wireless Configuration Service;c:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-01-11 245664]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

*Newly Created Service* - COMHOST
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-10-14 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Adam Weber.job
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-01-14 02:09]
.
- - - - ORPHANS REMOVED - - - -

BHO-{36142BDD-7850-42FC-9681-1534A35285B9} - (no file)

.
——- Supplementary Scan ——-
.
R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
R1 -: HKCU-Internet Settings,ProxyOverride = 127.0.0.1
O8 -: &D&ownload &with BitComet - C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 -: &D&ownload all video with BitComet - C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 -: &D&ownload all with BitComet - C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 -: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-14 15:08:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-10-14 15:11:03
ComboFix-quarantined-files.txt 2008-10-14 22:10:15

Pre-Run: 39,420,428,288 bytes free
Post-Run: 42,138,980,352 bytes free

248 — E O F — 2008-09-13 20:38:56

And Here's the Hijack this

Logfile of HijackThis v1.99.1
Scan saved at 3:14:33 PM, on 10/14/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\stacsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Weber\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=1060908
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\Quickset.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Unknown owner - C:\Program Files\Dantz\Retrospect\retrorun.exe (file missing)
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\stacsv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

Rorschach112

Post #4October 14, 2008, 10:16 PM UTC

Some of the CF log is missing at the start, can you post it again please, no need for the HJT log

aeweber

Post #5October 14, 2008, 10:29 PM UTC

ComboFix 08-10-14.03 - Adam Weber 2008-10-14 15:01:08.1 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\WinBudget
C:\WINDOWS\default.htm
C:\WINDOWS\IE4 Error Log.txt
C:\WINDOWS\system32\drivers\isapnp.exe

.
((((((((((((((((((((((((( Files Created from 2008-09-14 to 2008-10-14 )))))))))))))))))))))))))))))))
.

2008-10-14 14:39 . 2008-10-14 14:39 d——– C:\Program Files\Spybot - Search & Destroy
2008-10-14 14:39 . 2008-10-14 14:39 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-14 14:05 . 2008-10-14 14:05 d——– C:\VundoFix Backups
2008-10-13 16:16 . 2008-10-13 16:19 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-10-13 16:15 . 2008-10-13 16:15 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-10-11 20:39 . 2008-10-11 20:39 16,896 –a—— C:\Documents and Settings\Adam Weber\~.exe
2008-10-10 16:09 . 2008-10-10 16:09 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-10-10 16:09 . 2008-10-10 16:09 1,409 –a—— C:\WINDOWS\QTFont.for
2008-10-03 14:34 . 2008-10-03 14:34 625,032 –a—— C:\WINDOWS\system32\SymNeti.dll
2008-10-03 14:34 . 2008-10-03 14:34 242,056 –a—— C:\WINDOWS\system32\SymRedir.dll
2008-10-03 14:14 . 2008-10-03 14:14 37,936 –a—— C:\WINDOWS\system32\drivers\symndisv.sys
2008-10-03 14:14 . 2008-10-03 14:14 10,804 –a—— C:\WINDOWS\system32\drivers\SymRedir.cat
2008-10-03 14:14 . 2008-10-03 14:14 1,358 –a—— C:\WINDOWS\system32\drivers\SymRedir.inf

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-14 21:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-10-14 21:45 0 —-a-w C:\WINDOWS\system32\drivers\lvuvc.hs
2008-10-14 21:38 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-10-13 23:17 ——— d—–w C:\Program Files\Lavasoft
2008-10-13 23:17 ——— d—–w C:\Documents and Settings\Adam Weber\Application Data\Lavasoft
2008-10-03 21:14 39,984 —-a-w C:\WINDOWS\system32\drivers\symids.sys
2008-10-03 21:14 35,120 —-a-w C:\WINDOWS\system32\drivers\symndis.sys
2008-10-03 21:14 27,696 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys
2008-10-03 21:14 187,952 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys
2008-10-03 21:14 146,096 —-a-w C:\WINDOWS\system32\drivers\symfw.sys
2008-10-03 21:14 12,848 —-a-w C:\WINDOWS\system32\drivers\symdns.sys
2008-09-13 21:56 ——— d—–w C:\Program Files\Soulseek
2008-09-13 20:31 ——— d—–w C:\Program Files\Microsoft Works
2008-09-08 21:06 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-09-08 21:06 ——— d—–w C:\Program Files\Spectrum Commander
2008-09-08 21:06 ——— d—–w C:\Program Files\Signal Intelligence
2008-09-03 23:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Rosetta Stone
2008-08-26 20:39 ——— d—–w C:\Program Files\YAMAHA
2008-08-20 20:22 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-08-20 20:22 60,800 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-08-20 20:22 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-08-20 20:22 10,671 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-08-20 20:22 ——— d—–w C:\Program Files\Symantec
2008-08-20 20:02 ——— d—–w C:\Program Files\Updates
2008-08-20 19:17 ——— d—–w C:\Program Files\Rosetta Stone
2008-08-20 19:17 ——— d—–w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-08-20 18:12 ——— d—–w C:\Documents and Settings\Adam Weber\Application Data\BitZipper
2008-08-20 03:27 ——— d—–w C:\Documents and Settings\Adam Weber\Application Data\Roxio
2008-08-20 02:03 ——— d—–w C:\Program Files\Common Files\Macrovision Shared
2008-07-19 05:10 94,920 —-a-w C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-19 05:10 94,920 —-a-w C:\WINDOWS\system32\cdm.dll
2008-07-19 05:10 53,448 —-a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-19 05:10 53,448 —-a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-19 05:10 45,768 —-a-w C:\WINDOWS\system32\wups2.dll
2008-07-19 05:10 36,552 —-a-w C:\WINDOWS\system32\wups.dll
2008-07-19 05:10 36,552 —-a-w C:\WINDOWS\system32\dllcache\wups.dll
2008-07-19 05:09 563,912 —-a-w C:\WINDOWS\system32\wuapi.dll
2008-07-19 05:09 563,912 —-a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-19 05:09 325,832 —-a-w C:\WINDOWS\system32\wucltui.dll
2008-07-19 05:09 325,832 —-a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-19 05:09 205,000 —-a-w C:\WINDOWS\system32\wuweb.dll
2008-07-19 05:09 205,000 —-a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-19 05:09 1,811,656 —-a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-19 05:09 1,811,656 —-a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-19 05:07 270,880 —-a-w C:\WINDOWS\system32\mucltui.dll
2008-07-19 05:07 210,976 —-a-w C:\WINDOWS\system32\muweb.dll
2008-07-17 00:52 0 —-a-w C:\Documents and Settings\Adam Weber\Application Data\wklnhst.dat
2007-09-05 02:15 73,336 —-a-w C:\Documents and Settings\Adam Weber\Application Data\GDIPFONTCACHEV1.DAT
2006-10-06 18:46 88 –sh–r C:\WINDOWS\system32\C1D64A06F0.sys
2006-10-06 18:46 3,350 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—-a-w 368,706 2002-09-11 05:26:26 C:\Program Files\BroadJump\Client Foundation\bak\CFD.exe

—-a-w 81,920 2005-06-10 15:44:02 C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe
—-a-w 86,960 2006-09-11 11:40:34 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

—-a-w 249,856 2005-06-10 15:44:02 C:\Program Files\Common Files\InstallShield\UpdateService\bak\isuspm.exe
—-a-w 218,032 2006-09-11 11:40:32 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

-c–a-w 185,896 2006-11-28 09:33:47 C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe

—-a-w 57,344 2005-10-31 15:51:52 C:\Program Files\Creative\SBAudigy\Surround Mixer\bak\CTSysVol.exe

—-a-w 1,118,208 2006-02-16 14:20:20 C:\Program Files\Creative\VoiceCenter\bak\AndreaVC.exe

—-a-w 98,304 2006-05-03 11:12:00 C:\Program Files\Dell\Media Experience\bak\DMXLauncher.exe

—-a-w 1,032,192 2006-06-02 16:05:58 C:\Program Files\Dell\QuickSet\bak\Quickset.exe

-c–a-w 602,182 2006-05-01 14:28:26 C:\Program Files\Intel\Wireless\Bin\bak\ifrmewrk.exe

-c–a-w 667,718 2006-05-01 14:28:06 C:\Program Files\Intel\Wireless\Bin\bak\ZCfgSvc.exe

—-a-w 282,624 2006-10-26 02:58:18 C:\Program Files\QuickTime\bak\qttask.exe

-c–a-w 761,947 2006-03-08 16:48:02 C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe
—-a-w 774,233 2006-05-19 21:51:16 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

—-a-w 35,328 2007-02-13 18:29:00 C:\Program Files\Winamp\bak\winampa.exe

—-a-w 90,112 2000-05-11 06:00:00 C:\WINDOWS\bak\UpdReg.EXE

—-a-w 67,584 2005-09-29 19:01:14 C:\WINDOWS\ehome\bak\ehtray.exe

—-a-w 15,360 2004-08-10 10:00:00 C:\WINDOWS\system32\bak\ctfmon.exe
—-a-w 15,360 2008-04-14 00:12:16 C:\WINDOWS\system32\ctfmon.exe

—-a-w 237,568 2006-05-04 13:59:48 C:\WINDOWS\system32\bak\LVCOMSX.EXE

—-a-w 127,036 2006-09-21 13:20:00 C:\WINDOWS\system32\DLA\bak\DLACTRLW.EXE
—-a-w 122,940 2005-11-07 13:20:00 C:\WINDOWS\system32\DLA\DLACTRLW.EXE

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [N/A]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 C:\WINDOWS\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [N/A]
"VoiceCenter"="C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [N/A]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [N/A]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [N/A]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-19 774233]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-21 7557120]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [N/A]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 86960]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-09-11 218032]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [N/A]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [N/A]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [N/A]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [N/A]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-11-07 122940]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\Quickset.exe" [N/A]
"CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [N/A]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 115816]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-01-14 771704]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-08-16 236016]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 C:\WINDOWS\stsystra.exe]
"nwiz"="nwiz.exe" [2006-03-21 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2006-03-21 C:\WINDOWS\system32\nvhotkey.dll]
"MBMon"="CTMBHA.DLL" [2006-06-28 C:\WINDOWS\system32\CTMBHA.DLL]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-09-08 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.CEGSM"= mobilev.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD]
C:\Program Files\BroadJump\Client Foundation\CFD.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eFax 4.2]
–a—— 2006-07-14 13:36 107008 C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2006-10-30 10:36 256576 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCameraAssistant]
–a—— 2006-05-04 06:24 489472 C:\Program Files\Logitech\Video\CameraAssistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideo[inspector]]
–a—— 2006-05-04 06:32 73728 C:\Program Files\Logitech\Video\InstallHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
–a—— 2008-01-11 18:54 166304 c:\Program Files\Zune\ZuneLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)
"LVPrcSrv"=2 (0x2)
"ZuneWlanCfgSvc"=3 (0x3)
"ZuneNetworkSvc"=3 (0x3)
"ZuneBusEnum"=2 (0x2)
"SQLAgent$MICROSOFTSMLBIZ"=3 (0x3)
"MSSQL$MICROSOFTSMLBIZ"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\RosettaStoneVersion3.exe"=
"C:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\support\\bin\\win\\RosettaStoneLtdServices.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9713:TCP"= 9713:TCP:BitComet 9713 TCP
"9713:UDP"= 9713:UDP:BitComet 9713 UDP
""=

R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-01-11 40832]
S3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2006-05-04 16768]
S4 ZuneBusEnum;Zune Bus Enumerator;c:\WINDOWS\system32\ZuneBusEnum.exe [2008-01-11 61856]
S4 ZuneWlanCfgSvc;Zune Wireless Configuration Service;c:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-01-11 245664]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

*Newly Created Service* - COMHOST
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-10-14 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Adam Weber.job
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-01-14 02:09]
.
- - - - ORPHANS REMOVED - - - -

BHO-{36142BDD-7850-42FC-9681-1534A35285B9} - (no file)

.
——- Supplementary Scan ——-
.
R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
R1 -: HKCU-Internet Settings,ProxyOverride = 127.0.0.1
O8 -: &D&ownload &with BitComet - C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 -: &D&ownload all video with BitComet - C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 -: &D&ownload all with BitComet - C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 -: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-14 15:08:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-10-14 15:11:03
ComboFix-quarantined-files.txt 2008-10-14 22:10:15

Pre-Run: 39,420,428,288 bytes free
Post-Run: 42,138,980,352 bytes free

248 — E O F — 2008-09-13 20:38:56

Rorschach112

Post #6October 14, 2008, 10:33 PM UTC

Hello

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Documents and Settings\Adam Weber\~.exe
C:\WINDOWS\system32\drivers\lvuvc.hs

KillAll::

Sysrst::

AWF::

C:\Program Files\BroadJump\Client Foundation\bak\CFD.exe
C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe
C:\Program Files\Common Files\InstallShield\UpdateService\bak\isuspm.exe
C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\bak\CTSysVol.exe
C:\Program Files\Creative\VoiceCenter\bak\AndreaVC.exe
C:\Program Files\Dell\Media Experience\bak\DMXLauncher.exe
C:\Program Files\Dell\QuickSet\bak\Quickset.exe
C:\Program Files\Intel\Wireless\Bin\bak\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\bak\ZCfgSvc.exe
C:\Program Files\QuickTime\bak\qttask.exe
C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe
C:\Program Files\Winamp\bak\winampa.exe
C:\WINDOWS\bak\UpdReg.EXE
C:\WINDOWS\ehome\bak\ehtray.exe
C:\WINDOWS\system32\bak\ctfmon.exe
C:\WINDOWS\system32\bak\LVCOMSX.EXE
C:\WINDOWS\system32\DLA\bak\DLACTRLW.EXE

Folder::

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]

Driver::

Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

aeweber

Post #7October 14, 2008, 11:08 PM UTC

the message on my desktop is now gone and I can ctrl alt del to the task manager again…. Thanks.

ComboFix 08-10-14.03 - Adam Weber 2008-10-14 15:40:34.2 - NTFSx86
Running from: C:\Weber\ComboFix.exe
Command switches used :: C:\Weber\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Documents and Settings\Adam Weber\~.exe
C:\WINDOWS\system32\drivers\lvuvc.hs
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Adam Weber\~.exe
C:\WINDOWS\system32\drivers\lvuvc.hs

.
((((((((((((((((((((((((( Files Created from 2008-09-14 to 2008-10-14 )))))))))))))))))))))))))))))))
.

2008-10-14 15:40 . 2008-10-14 15:40 d——– C:\WINDOWS\LastGood.Tmp
2008-10-14 15:40 . 2008-10-14 15:40 0 –a—— C:\WINDOWS\system32\OLD13.tmp
2008-10-14 14:49 . 2008-09-08 03:41 333,824 ——— C:\WINDOWS\system32\dllcache\srv.sys
2008-10-14 14:39 . 2008-10-14 14:39 d——– C:\Program Files\Spybot - Search & Destroy
2008-10-14 14:39 . 2008-10-14 14:39 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-14 14:05 . 2008-10-14 14:05 d——– C:\VundoFix Backups
2008-10-14 13:40 . 2008-08-14 03:11 2,189,184 ——— C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-14 13:40 . 2008-08-14 03:09 2,145,280 ——— C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-14 13:40 . 2008-08-14 02:33 2,066,048 ——— C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-14 13:40 . 2008-08-14 02:33 2,023,936 ——— C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-14 13:40 . 2008-09-15 05:12 1,846,400 ——— C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-13 16:16 . 2008-10-13 16:19 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-10-13 16:15 . 2008-10-13 16:15 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-10-10 16:09 . 2008-10-10 16:09 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-10-10 16:09 . 2008-10-10 16:09 1,409 –a—— C:\WINDOWS\QTFont.for
2008-10-03 14:34 . 2008-10-03 14:34 625,032 –a—— C:\WINDOWS\system32\SymNeti.dll
2008-10-03 14:34 . 2008-10-03 14:34 242,056 –a—— C:\WINDOWS\system32\SymRedir.dll
2008-10-03 14:14 . 2008-10-03 14:14 37,936 –a—— C:\WINDOWS\system32\drivers\symndisv.sys
2008-10-03 14:14 . 2008-10-03 14:14 10,804 –a—— C:\WINDOWS\system32\drivers\SymRedir.cat
2008-10-03 14:14 . 2008-10-03 14:14 1,358 –a—— C:\WINDOWS\system32\drivers\SymRedir.inf

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-14 22:49 ——— d—–w C:\Program Files\Winamp
2008-10-14 22:49 ——— d—–w C:\Program Files\QuickTime
2008-10-14 22:46 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-10-14 22:26 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-10-13 23:17 ——— d—–w C:\Program Files\Lavasoft
2008-10-13 23:17 ——— d—–w C:\Documents and Settings\Adam Weber\Application Data\Lavasoft
2008-10-03 21:14 39,984 —-a-w C:\WINDOWS\system32\drivers\symids.sys
2008-10-03 21:14 35,120 —-a-w C:\WINDOWS\system32\drivers\symndis.sys
2008-10-03 21:14 27,696 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys
2008-10-03 21:14 187,952 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys
2008-10-03 21:14 146,096 —-a-w C:\WINDOWS\system32\drivers\symfw.sys
2008-10-03 21:14 12,848 —-a-w C:\WINDOWS\system32\drivers\symdns.sys
2008-09-13 21:56 ——— d—–w C:\Program Files\Soulseek
2008-09-13 20:31 ——— d—–w C:\Program Files\Microsoft Works
2008-09-08 21:06 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-09-08 21:06 ——— d—–w C:\Program Files\Spectrum Commander
2008-09-08 21:06 ——— d—–w C:\Program Files\Signal Intelligence
2008-09-08 10:41 333,824 —-a-w C:\WINDOWS\system32\drivers\srv.sys
2008-09-03 23:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Rosetta Stone
2008-08-26 20:39 ——— d—–w C:\Program Files\YAMAHA
2008-08-20 20:22 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-08-20 20:22 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-08-20 20:22 10,671 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-08-20 20:22 ——— d—–w C:\Program Files\Symantec
2008-08-20 20:02 ——— d—–w C:\Program Files\Updates
2008-08-20 19:17 ——— d—–w C:\Program Files\Rosetta Stone
2008-08-20 19:17 ——— d—–w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-08-20 18:12 ——— d—–w C:\Documents and Settings\Adam Weber\Application Data\BitZipper
2008-08-20 03:27 ——— d—–w C:\Documents and Settings\Adam Weber\Application Data\Roxio
2008-08-20 02:03 ——— d—–w C:\Program Files\Common Files\Macrovision Shared
2008-08-14 10:04 138,496 —-a-w C:\WINDOWS\system32\drivers\afd.sys
2008-07-17 00:52 0 —-a-w C:\Documents and Settings\Adam Weber\Application Data\wklnhst.dat
2007-09-05 02:15 73,336 —-a-w C:\Documents and Settings\Adam Weber\Application Data\GDIPFONTCACHEV1.DAT
2006-10-06 18:46 88 –sh–r C:\WINDOWS\system32\C1D64A06F0.sys
2006-10-06 18:46 3,350 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

——- Sigcheck ——-

2004-08-10 03:00 15360 24232996a38c0b0cf151c2140ae29fc8 C:\WINDOWS\$NtServicePackUninstall$\ctfmon.exe
md5deep: C:\WINDOWS\LastGood.Tmp\system32\ctfmon.exe: No such file or directory
2008-04-13 17:12 15360 5f1d5f88303d4a4dbc8e5f97ba967cc3 C:\WINDOWS\ServicePackFiles\i386\ctfmon.exe
2004-08-10 03:00 15360 24232996a38c0b0cf151c2140ae29fc8 C:\WINDOWS\system32\ctfmon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-10-14_15.09.53.07 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-14 10:09:26 2,145,280 ——w C:\WINDOWS\Driver Cache\i386\ntkrnlmp.exe
+ 2008-08-14 09:33:16 2,066,048 ——w C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
+ 2008-08-14 09:33:16 2,023,936 ——w C:\WINDOWS\Driver Cache\i386\ntkrpamp.exe
+ 2008-08-14 10:11:02 2,189,184 ——w C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
+ 2005-09-29 19:01:14 67,584 —-a-w C:\WINDOWS\ehome\ehtray.exe
+ 2008-06-23 16:57:27 124,928 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\advpack.dll
+ 2008-06-23 16:57:27 347,136 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\dxtmsft.dll
+ 2008-06-23 16:57:27 214,528 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\dxtrans.dll
+ 2008-06-23 16:57:27 133,120 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\extmgr.dll
+ 2008-06-23 16:57:28 63,488 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\icardie.dll
+ 2008-06-23 09:20:25 70,656 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\ie4uinit.exe
+ 2008-06-23 16:57:29 153,088 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\ieakeng.dll
+ 2008-06-23 16:57:29 230,400 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\ieaksie.dll
+ 2008-06-21 05:23:54 161,792 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\ieakui.dll
+ 2008-06-23 16:57:29 383,488 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\ieapfltr.dll
+ 2008-06-23 16:57:29 384,512 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\iedkcs32.dll
+ 2008-06-23 16:57:33 6,066,176 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\ieframe.dll
+ 2008-06-23 16:57:33 44,544 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\iernonce.dll
+ 2008-06-23 16:57:34 267,776 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\iertutil.dll
+ 2008-06-23 09:20:26 13,824 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\ieudinit.exe
+ 2008-06-23 09:20:52 625,664 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\iexplore.exe
+ 2008-06-23 16:57:35 27,648 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\jsproxy.dll
+ 2008-06-23 16:57:36 459,264 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\msfeeds.dll
+ 2008-06-23 16:57:36 52,224 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\msfeedsbs.dll
+ 2008-06-24 17:57:40 3,592,192 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\mshtml.dll
+ 2008-06-23 16:57:39 477,696 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\mshtmled.dll
+ 2008-06-23 16:57:39 193,024 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\msrating.dll
+ 2008-06-23 16:57:40 671,232 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\mstime.dll
+ 2008-06-23 16:57:40 102,912 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\occache.dll
+ 2008-06-23 16:57:40 44,544 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\pngfilt.dll
+ 2007-03-06 01:22:41 213,216 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\updspapi.dll
+ 2008-06-23 16:57:40 105,984 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\url.dll
+ 2008-06-23 16:57:40 1,159,680 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\urlmon.dll
+ 2008-06-23 16:57:41 233,472 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\webcheck.dll
+ 2008-06-23 16:57:41 826,368 -c—-w C:\WINDOWS\ie7updates\KB956390-IE7\wininet.dll
+ 2004-08-10 10:00:00 15,360 —-a-w C:\WINDOWS\LastGood.Tmp\system32\ctfmon.exe
- 2008-06-23 16:57:27 124,928 —-a-w C:\WINDOWS\system32\advpack.dll
+ 2008-08-26 07:24:28 124,928 —-a-w C:\WINDOWS\system32\advpack.dll
- 2005-11-07 13:20:00 122,940 —-a-w C:\WINDOWS\system32\DLA\DLACTRLW.EXE
+ 2006-09-21 13:20:00 127,036 —-a-w C:\WINDOWS\system32\DLA\DLACTRLW.EXE
- 2008-06-23 16:57:27 124,928 ——w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2008-08-26 07:24:28 124,928 ——w C:\WINDOWS\system32\dllcache\advpack.dll
- 2008-06-20 11:40:08 138,496 ——w C:\WINDOWS\system32\dllcache\afd.sys
+ 2008-08-14 10:04:36 138,496 ——w C:\WINDOWS\system32\dllcache\afd.sys
- 2008-06-23 16:57:27 347,136 —-a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-08-26 07:24:28 347,136 —-a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2008-06-23 16:57:27 214,528 —-a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-08-26 07:24:28 214,528 —-a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2008-06-23 16:57:27 133,120 —-a-w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-08-26 07:24:28 133,120 —-a-w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2008-06-23 16:57:28 63,488 ——w C:\WINDOWS\system32\dllcache\icardie.dll
+ 2008-08-26 07:24:28 63,488 ——w C:\WINDOWS\system32\dllcache\icardie.dll
- 2008-06-23 09:20:25 70,656 ——w C:\WINDOWS\system32\dllcache\ie4uinit.exe
+ 2008-08-25 08:37:59 70,656 ——w C:\WINDOWS\system32\dllcache\ie4uinit.exe
- 2008-06-23 16:57:29 153,088 ——w C:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2008-08-26 07:24:28 153,088 ——w C:\WINDOWS\system32\dllcache\ieakeng.dll
- 2008-06-23 16:57:29 230,400 ——w C:\WINDOWS\system32\dllcache\ieaksie.dll
+ 2008-08-26 07:24:28 230,400 ——w C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2008-06-21 05:23:54 161,792 ——w C:\WINDOWS\system32\dllcache\ieakui.dll
+ 2008-08-23 05:54:51 161,792 ——w C:\WINDOWS\system32\dllcache\ieakui.dll
- 2008-06-23 16:57:29 383,488 ——w C:\WINDOWS\system32\dllcache\ieapfltr.dll
+ 2008-08-26 07:24:28 383,488 ——w C:\WINDOWS\system32\dllcache\ieapfltr.dll
- 2008-06-23 16:57:29 384,512 ——w C:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2008-08-26 07:24:29 384,512 ——w C:\WINDOWS\system32\dllcache\iedkcs32.dll
- 2008-06-23 16:57:33 6,066,176 ——w C:\WINDOWS\system32\dllcache\ieframe.dll
+ 2008-10-03 17:41:15 6,066,176 ——w C:\WINDOWS\system32\dllcache\ieframe.dll
- 2008-06-23 16:57:33 44,544 ——w C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2008-08-26 07:24:29 44,544 ——w C:\WINDOWS\system32\dllcache\iernonce.dll
- 2008-06-23 16:57:34 267,776 ——w C:\WINDOWS\system32\dllcache\iertutil.dll
+ 2008-08-26 07:24:29 267,776 ——w C:\WINDOWS\system32\dllcache\iertutil.dll
- 2008-06-23 09:20:26 13,824 ——w C:\WINDOWS\system32\dllcache\ieudinit.exe
+ 2008-08-25 08:38:00 13,824 ——w C:\WINDOWS\system32\dllcache\ieudinit.exe
- 2008-06-23 09:20:52 625,664 ——w C:\WINDOWS\system32\dllcache\iexplore.exe
+ 2008-08-23 05:56:15 635,848 ——w C:\WINDOWS\system32\dllcache\iexplore.exe
- 2008-06-23 16:57:35 27,648 —-a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-08-26 07:24:30 27,648 —-a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2008-06-23 16:57:36 459,264 ——w C:\WINDOWS\system32\dllcache\msfeeds.dll
+ 2008-08-26 07:24:30 459,264 ——w C:\WINDOWS\system32\dllcache\msfeeds.dll
- 2008-06-23 16:57:36 52,224 ——w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
+ 2008-08-26 07:24:30 52,224 ——w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
- 2008-06-24 17:57:40 3,592,192 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-08-27 08:24:32 3,593,216 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2008-06-23 16:57:39 477,696 —-a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-08-26 07:24:30 477,696 —-a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2008-06-23 16:57:39 193,024 —-a-w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-08-26 07:24:30 193,024 —-a-w C:\WINDOWS\system32\dllcache\msrating.dll
- 2008-06-23 16:57:40 671,232 —-a-w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-08-26 07:24:30 671,232 —-a-w C:\WINDOWS\system32\dllcache\mstime.dll
- 2008-06-23 16:57:40 102,912 ——w C:\WINDOWS\system32\dllcache\occache.dll
+ 2008-08-26 07:24:30 102,912 ——w C:\WINDOWS\system32\dllcache\occache.dll
- 2008-06-23 16:57:40 44,544 —-a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-08-26 07:24:30 44,544 —-a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2008-06-23 16:57:40 105,984 ——w C:\WINDOWS\system32\dllcache\url.dll
+ 2008-08-26 07:24:30 105,984 ——w C:\WINDOWS\system32\dllcache\url.dll
- 2008-06-23 16:57:40 1,159,680 —-a-w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-08-26 07:24:31 1,159,680 —-a-w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2008-06-23 16:57:41 233,472 ——w C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2008-08-26 07:24:31 233,472 ——w C:\WINDOWS\system32\dllcache\webcheck.dll
- 2008-06-23 16:57:41 826,368 —-a-w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-08-26 07:24:31 826,368 —-a-w C:\WINDOWS\system32\dllcache\wininet.dll
- 2008-06-23 16:57:27 347,136 —-a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-08-26 07:24:28 347,136 —-a-w C:\WINDOWS\system32\dxtmsft.dll
- 2008-06-23 16:57:27 214,528 —-a-w C:\WINDOWS\system32\dxtrans.dll
+ 2008-08-26 07:24:28 214,528 —-a-w C:\WINDOWS\system32\dxtrans.dll
- 2008-06-23 16:57:27 133,120 —-a-w C:\WINDOWS\system32\extmgr.dll
+ 2008-08-26 07:24:28 133,120 —-a-w C:\WINDOWS\system32\extmgr.dll
- 2008-09-02 03:50:46 319,544 —-a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-10-14 22:23:28 319,544 —-a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2008-06-23 16:57:28 63,488 —-a-w C:\WINDOWS\system32\icardie.dll
+ 2008-08-26 07:24:28 63,488 —-a-w C:\WINDOWS\system32\icardie.dll
- 2008-06-23 09:20:25 70,656 —-a-w C:\WINDOWS\system32\ie4uinit.exe
+ 2008-08-25 08:37:59 70,656 —-a-w C:\WINDOWS\system32\ie4uinit.exe
- 2008-06-23 16:57:29 153,088 —-a-w C:\WINDOWS\system32\ieakeng.dll
+ 2008-08-26 07:24:28 153,088 —-a-w C:\WINDOWS\system32\ieakeng.dll
- 2008-06-23 16:57:29 230,400 —-a-w C:\WINDOWS\system32\ieaksie.dll
+ 2008-08-26 07:24:28 230,400 —-a-w C:\WINDOWS\system32\ieaksie.dll
- 2008-06-21 05:23:54 161,792 —-a-w C:\WINDOWS\system32\ieakui.dll
+ 2008-08-23 05:54:51 161,792 —-a-w C:\WINDOWS\system32\ieakui.dll
- 2008-06-23 16:57:29 383,488 —-a-w C:\WINDOWS\system32\ieapfltr.dll
+ 2008-08-26 07:24:28 383,488 —-a-w C:\WINDOWS\system32\ieapfltr.dll
- 2008-06-23 16:57:29 384,512 —-a-w C:\WINDOWS\system32\iedkcs32.dll
+ 2008-08-26 07:24:29 384,512 —-a-w C:\WINDOWS\system32\iedkcs32.dll
- 2008-06-23 16:57:33 6,066,176 —-a-w C:\WINDOWS\system32\ieframe.dll
+ 2008-10-03 17:41:15 6,066,176 —-a-w C:\WINDOWS\system32\ieframe.dll
- 2008-06-23 16:57:33 44,544 —-a-w C:\WINDOWS\system32\iernonce.dll
+ 2008-08-26 07:24:29 44,544 —-a-w C:\WINDOWS\system32\iernonce.dll
- 2008-06-23 16:57:34 267,776 —-a-w C:\WINDOWS\system32\iertutil.dll
+ 2008-08-26 07:24:29 267,776 —-a-w C:\WINDOWS\system32\iertutil.dll
- 2008-06-23 09:20:26 13,824 —-a-w C:\WINDOWS\system32\ieudinit.exe
+ 2008-08-25 08:38:00 13,824 —-a-w C:\WINDOWS\system32\ieudinit.exe
- 2008-06-23 16:57:35 27,648 —-a-w C:\WINDOWS\system32\jsproxy.dll
+ 2008-08-26 07:24:30 27,648 —-a-w C:\WINDOWS\system32\jsproxy.dll
+ 2006-05-04 13:59:48 237,568 —-a-w C:\WINDOWS\system32\LVCOMSX.EXE
- 2008-08-26 20:28:12 16,208,504 —-a-w C:\WINDOWS\system32\MRT.exe
+ 2008-10-07 19:19:40 16,721,856 —-a-w C:\WINDOWS\system32\MRT.exe
- 2008-06-23 16:57:36 459,264 —-a-w C:\WINDOWS\system32\msfeeds.dll
+ 2008-08-26 07:24:30 459,264 —-a-w C:\WINDOWS\system32\msfeeds.dll
- 2008-06-23 16:57:36 52,224 —-a-w C:\WINDOWS\system32\msfeedsbs.dll
+ 2008-08-26 07:24:30 52,224 —-a-w C:\WINDOWS\system32\msfeedsbs.dll
- 2008-06-24 17:57:40 3,592,192 —-a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-08-27 08:24:32 3,593,216 —-a-w C:\WINDOWS\system32\mshtml.dll
- 2008-06-23 16:57:39 477,696 —-a-w C:\WINDOWS\system32\mshtmled.dll
+ 2008-08-26 07:24:30 477,696 —-a-w C:\WINDOWS\system32\mshtmled.dll
- 2008-06-23 16:57:39 193,024 —-a-w C:\WINDOWS\system32\msrating.dll
+ 2008-08-26 07:24:30 193,024 —-a-w C:\WINDOWS\system32\msrating.dll
- 2008-06-23 16:57:40 671,232 —-a-w C:\WINDOWS\system32\mstime.dll
+ 2008-08-26 07:24:30 671,232 —-a-w C:\WINDOWS\system32\mstime.dll
- 2008-04-13 18:31:21 2,023,936 —-a-w C:\WINDOWS\system32\ntkrnlpa.exe
+ 2008-08-14 09:33:16 2,023,936 —-a-w C:\WINDOWS\system32\ntkrnlpa.exe
- 2008-04-13 19:24:37 2,145,280 —-a-w C:\WINDOWS\system32\ntoskrnl.exe
+ 2008-08-14 10:09:26 2,145,280 —-a-w C:\WINDOWS\system32\ntoskrnl.exe
- 2008-06-23 16:57:40 102,912 —-a-w C:\WINDOWS\system32\occache.dll
+ 2008-08-26 07:24:30 102,912 —-a-w C:\WINDOWS\system32\occache.dll
- 2008-06-23 16:57:40 44,544 —-a-w C:\WINDOWS\system32\pngfilt.dll
+ 2008-08-26 07:24:30 44,544 —-a-w C:\WINDOWS\system32\pngfilt.dll
- 2007-11-30 12:39:22 17,272 ——w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 11:18:51 17,272 ——w C:\WINDOWS\system32\spmsg.dll
- 2008-06-23 16:57:40 105,984 —-a-w C:\WINDOWS\system32\url.dll
+ 2008-08-26 07:24:30 105,984 —-a-w C:\WINDOWS\system32\url.dll
- 2008-06-23 16:57:40 1,159,680 —-a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-08-26 07:24:31 1,159,680 —-a-w C:\WINDOWS\system32\urlmon.dll
- 2008-06-23 16:57:41 233,472 —-a-w C:\WINDOWS\system32\webcheck.dll
+ 2008-08-26 07:24:31 233,472 —-a-w C:\WINDOWS\system32\webcheck.dll
- 2008-04-13 19:30:10 1,845,632 —-a-w C:\WINDOWS\system32\win32k.sys
+ 2008-09-15 12:12:56 1,846,400 —-a-w C:\WINDOWS\system32\win32k.sys
- 2008-06-23 16:57:41 826,368 —-a-w C:\WINDOWS\system32\wininet.dll
+ 2008-08-26 07:24:31 826,368 —-a-w C:\WINDOWS\system32\wininet.dll
+ 2000-05-11 06:00:00 90,112 —-a-w C:\WINDOWS\UpdReg.EXE
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((((( System Restore )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Adam Weber\~.exe
2008-10-11 20:39 16896 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP393\A0104385.exe

2008-08-08 09:57 20040 C:\Documents and Settings\Adam Weber\Application Data\Microsoft\IdentityCRL\Production\ppcrlconfig.dll
{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP356\A0097553.dllC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll
2008-08-08 10:57 531932 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP357\A0097555.dll

C:\Documents and Settings\All Users\Application Data\Symantec\COHLU.reg
2008-07-30 18:54 403 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP356\A0097535.reg

C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\Quarantine\AP66CA8ADC.dll
2008-10-13 16:00 31744 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP390\A0104020.dll

2008-09-29 06:09 1290584 C:\Documents and Settings\All Users\Application Data\Symantec\SyKnAppS\SyKnAppS.dll
2008-03-07 16:17 1314648 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP387\A0103878.dll

C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\_003325_.tmp.dll
2005-08-16 02:43 1487 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098601.dll

2008-07-24 15:01 548963 C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\_ISRES1033.dll
2007-07-12 20:02 548963 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP347\A0094289.dll

2008-07-24 15:01 778240 C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriver.exe
2007-07-12 20:02 778240 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP347\A0094290.exe

2008-07-24 15:01 200704 C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\iGdiCnv.dll
2007-07-12 20:02 200704 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP347\A0094295.dll

2008-07-24 15:01 274432 C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IScrCnv.dll
2007-07-12 20:02 274432 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP347\A0094294.dll

2008-07-24 15:01 421888 C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\ISRT.dll
2007-07-12 20:02 421888 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP347\A0094292.dll

2008-07-24 15:01 184320 C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IUserCnv.dll
2007-07-12 20:02 184320 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP347\A0094291.dll

2008-07-24 15:01 32768 C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\objpscnv.dll
2007-07-12 20:02 32768 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP347\A0094293.dll

2005-06-10 08:44 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
2006-09-11 04:40 86960 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP393\A0104378.exe

2005-06-10 08:44 249856 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
2006-09-11 04:40 218032 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP393\A0104379.exe

2008-04-13 17:12 741376 C:\Program Files\Common Files\Microsoft Shared\Speech\sapi.dll
2004-08-10 03:00 741376 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099645.dll

2008-04-13 17:12 153088 C:\Program Files\Common Files\Microsoft Shared\Triedit\triedit.dll
2004-08-10 03:00 153088 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099647.DLL

2008-04-13 17:11 618605 C:\Program Files\Common Files\Microsoft Shared\web server extensions\40\bin\fp4autl.dll
2003-03-24 14:52 618605 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099610.dll

2008-10-14 15:57 531932 C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll
2008-07-16 14:09 531932 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP344\A0094149.dll
2008-10-14 15:25 531932 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP393\A0104395.dll

2008-07-30 17:42 649040 C:\Program Files\Common Files\Symantec Shared\COH\AHS.dll
2008-03-06 21:28 1131872 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP356\A0097530.dll

2008-07-30 17:42 1227600 C:\Program Files\Common Files\Symantec Shared\COH\COH32.exe
2008-03-06 21:28 1250656 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP356\A0097531.exe

2008-07-30 17:42 158544 C:\Program Files\Common Files\Symantec Shared\COH\COHClean.dll
2008-03-06 21:30 148832 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP356\A0097529.dll

2008-07-30 17:42 283984 C:\Program Files\Common Files\Symantec Shared\COH\sesHlp.dll
2008-03-06 21:28 296288 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP356\A0097532.dll
2008-03-06 21:28 296288 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP356\A0097533.dll

C:\Program Files\Common Files\Symantec Shared\COH\sH0003.dll
2008-03-06 21:28 431456 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP356\A0097534.dll

2008-09-02 01:00 371248 C:\Program Files\Common Files\Symantec Shared\eengine\eeCtrl.sys
2008-08-20 01:00 371248 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP375\A0100797.sys

C:\Program Files\Common Files\Symantec Shared\eengine\EraserUtilDrv10822.sys
2008-09-02 01:00 99376 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP379\A0101787.sys

2008-09-02 01:00 99376 C:\Program Files\Common Files\Symantec Shared\eengine\EraserUtilRebootDrv.sys
2008-08-20 01:00 99376 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP379\A0101788.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080314.001\IDS9xx86.dll
2008-02-14 03:51 157120 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP368\A0097896.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080314.001\IDSviA64.sys
2008-02-14 03:51 359472 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP368\A0097899.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080314.001\IDSvix86.sys
2008-02-14 03:51 261680 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP368\A0097902.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080314.001\IDSxpx86.dll
2008-02-14 03:51 685424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP368\A0097903.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080314.001\SymIDSCo.sys
2008-02-14 03:51 240496 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP368\A0097904.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080314.001\SymIDSI.dll
2008-02-14 03:51 173424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP368\A0097906.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080825.001\IDSviA64.sys
2008-02-14 03:51 359472 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP373\A0100745.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080825.001\IDSvix86.sys
2008-02-14 03:51 261680 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP373\A0100748.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080825.001\IDSxpx86.dll
2008-02-14 03:51 685424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP373\A0100749.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080825.001\SymIDSCo.sys
2008-02-14 03:51 240496 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP373\A0100750.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080825.001\SymIDSI.dll
2008-02-14 03:51 173424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP373\A0100752.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080828.001\IDS9xx86.dll
2008-02-14 03:51 157120 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP377\A0100826.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080828.001\IDSviA64.sys
2008-02-14 03:51 359472 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP377\A0100829.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080828.001\IDSvix86.sys
2008-02-14 03:51 261680 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP377\A0100832.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080828.001\IDSxpx86.dll
2008-02-14 03:51 685424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP377\A0100833.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080828.001\SymIDSCo.sys
2008-02-14 03:51 240496 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP377\A0100834.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080828.001\SymIDSI.dll
2008-02-14 03:51 173424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP377\A0100836.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080829.001\IDS9xx86.dll
2008-02-14 03:51 157120 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP379\A0102796.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080829.001\IDSviA64.sys
2008-02-14 03:51 359472 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP379\A0102799.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080829.001\IDSvix86.sys
2008-02-14 03:51 261680 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP379\A0102802.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080829.001\IDSxpx86.dll
2008-02-14 03:51 685424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP379\A0102803.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080829.001\SymIDSCo.sys
2008-02-14 03:51 240496 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP379\A0102804.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080829.001\SymIDSI.dll
2008-02-14 03:51 173424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP379\A0102806.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080905.002\IDS9xx86.dll
2008-02-14 03:51 157120 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP382\A0102887.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080905.002\IDSviA64.sys
2008-02-14 03:51 359472 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP382\A0102890.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080905.002\IDSvix86.sys
2008-02-14 03:51 261680 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP382\A0102893.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080905.002\IDSxpx86.dll
2008-02-14 03:51 685424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP382\A0102894.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080905.002\SymIDSCo.sys
2008-02-14 03:51 240496 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP382\A0102895.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080905.002\SymIDSI.dll
2008-02-14 03:51 173424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP382\A0102897.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080911.001\IDS9xx86.dll
2008-02-14 03:51 157120 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP382\A0102898.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080911.001\IDSviA64.sys
2008-02-14 03:51 359472 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP382\A0102901.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080911.001\IDSvix86.sys
2008-02-14 03:51 261680 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP382\A0102904.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080911.001\IDSxpx86.dll
2008-02-14 03:51 685424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP382\A0102905.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080911.001\SymIDSCo.sys
2008-02-14 03:51 240496 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP382\A0102906.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080911.001\SymIDSI.dll
2008-02-14 03:51 173424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP382\A0102908.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080917.001\IDS9xx86.dll
2008-02-14 03:51 157120 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP385\A0103858.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080917.001\IDSviA64.sys
2008-02-14 03:51 359472 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP385\A0103861.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080917.001\IDSvix86.sys
2008-02-14 03:51 261680 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP385\A0103864.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080917.001\IDSxpx86.dll
2008-02-14 03:51 685424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP385\A0103865.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080917.001\SymIDSCo.sys
2008-02-14 03:51 240496 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP385\A0103866.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080917.001\SymIDSI.dll
2008-02-14 03:51 173424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP385\A0103868.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080917.005\IDS9xx86.dll
2008-02-14 03:51 157120 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP387\A0103890.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080917.005\IDSviA64.sys
2008-09-12 00:33 368688 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP387\A0103893.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080917.005\IDSvix86.sys
2008-09-12 00:33 270384 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP387\A0103896.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080917.005\IDSxpx86.dll
2008-09-11 14:59 685424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP387\A0103897.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080917.005\SymIDSCo.sys
2008-09-12 00:33 250224 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP387\A0103898.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080917.005\SymIDSI.dll
2008-09-12 00:33 173424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP387\A0103900.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080926.002\IDS9xx86.dll
2008-02-14 03:51 157120 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP392\A0104355.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080926.002\IDSviA64.sys
2008-09-12 00:33 368688 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP392\A0104358.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080926.002\IDSvix86.sys
2008-09-12 00:33 270384 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP392\A0104361.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080926.002\IDSxpx86.dll
2008-09-11 14:59 685424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP392\A0104362.dll

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080926.002\SymIDSCo.sys
2008-09-12 00:33 250224 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP392\A0104363.sys

C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080926.002\SymIDSI.dll
2008-09-12 00:33 173424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP392\A0104365.dll

2008-09-12 00:33 368688 C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\BinHub\IDSviA64.sys
2008-02-14 03:51 359472 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP387\A0103885.sys

2008-09-12 00:33 270384 C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\BinHub\IDSvix86.sys
2008-02-14 03:51 261680 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP387\A0103886.sys

2008-09-11 14:59 685424 C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\BinHub\idsxpx86.dll
2008-02-14 03:51 685424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP387\A0103887.dll

2008-09-12 00:33 250224 C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\BinHub\symidsco.sys
2008-02-14 03:51 240496 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP387\A0103888.sys

2008-09-12 00:33 173424 C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\BinHub\SymIDSI.dll
2008-02-14 03:51 173424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP387\A0103889.dll

2008-04-13 17:11 86528 C:\Program Files\Common Files\System\directdb.dll
2007-05-16 08:12 86528 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099594.dll

2008-05-01 07:33 331776 C:\Program Files\Common Files\System\msadc\msadce.dll
2004-08-10 03:00 331776 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP360\A0097657.dll
2004-08-10 03:00 331776 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP360\A0097699.dll

2008-04-13 10:25 20480 C:\Program Files\Common Files\System\msadc\msadcer.dll
2004-08-10 03:00 20480 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098806.dll

2008-04-13 17:11 61440 C:\Program Files\Common Files\System\msadc\msadcf.dll
2004-08-10 03:00 61440 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098805.dll

2008-04-13 10:25 16384 C:\Program Files\Common Files\System\msadc\msadcfr.dll
2004-08-10 03:00 16384 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098804.dll

2008-04-13 17:11 143360 C:\Program Files\Common Files\System\msadc\msadco.dll
2006-03-22 22:44 143360 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098803.dll

2008-04-13 10:25 16384 C:\Program Files\Common Files\System\msadc\msadcor.dll
2004-08-10 03:00 16384 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098802.dll

2008-04-13 17:11 53248 C:\Program Files\Common Files\System\msadc\msadcs.dll
2004-08-10 03:00 53248 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098801.dll

2008-04-13 17:11 155648 C:\Program Files\Common Files\System\msadc\msadds.dll
2004-08-10 03:00 155648 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098800.dll

2008-04-13 10:25 24576 C:\Program Files\Common Files\System\msadc\msaddsr.dll
2004-08-10 03:00 24576 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098799.dll

2008-04-13 10:25 16384 C:\Program Files\Common Files\System\msadc\msdaprsr.dll
2004-08-10 03:00 16384 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098798.dll

2008-04-13 17:11 200704 C:\Program Files\Common Files\System\msadc\msdaprst.dll
2004-08-10 03:00 200704 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098797.dll

2008-04-13 17:11 118784 C:\Program Files\Common Files\System\msadc\msdarem.dll
2004-08-10 03:00 118784 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098796.dll

2008-04-13 10:25 16384 C:\Program Files\Common Files\System\msadc\msdaremr.dll
2004-08-10 03:00 16384 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098795.dll

2008-04-13 17:11 36864 C:\Program Files\Common Files\System\msadc\msdfmap.dll
2004-08-10 03:00 36864 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098794.dll

2008-04-13 17:12 510976 C:\Program Files\Common Files\System\wab32.dll
2007-05-16 08:12 510976 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099593.dll

2008-04-13 09:21 249856 C:\Program Files\Common Files\System\wab32res.dll
2004-08-10 03:00 249856 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099592.dll

C:\Program Files\GetModule\GetModule23.exe
2008-10-03 09:10 344064 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP390\A0104022.exe

C:\Program Files\GetPack\GetPack22.exe
2008-10-06 11:58 350208 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP390\A0104021.exe

C:\Program Files\iCheck\iCheck.exe
2008-06-11 05:12 49152 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP390\A0104023.exe

C:\Program Files\iCheck\Uninstall.exe
2008-10-13 15:22 32077 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP390\A0104024.exe

2001-09-05 04:23 56320 C:\Program Files\InstallShield Installation Information\{F4AAE86E-F119-4570-88A4-051E752A1520}\Setup.exe
2001-09-05 04:23 56320 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP378\A0100849.exe

2008-04-13 17:11 61440 C:\Program Files\Internet Explorer\Connection Wizard\icwconn.dll
2004-08-10 03:00 61440 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099619.dll

2008-04-13 17:12 214528 C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe
2004-08-10 03:00 214528 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099618.exe

2008-04-13 17:12 86016 C:\Program Files\Internet Explorer\Connection Wizard\icwconn2.exe
2004-08-10 03:00 86016 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099617.exe

2008-04-13 17:11 32768 C:\Program Files\Internet Explorer\Connection Wizard\icwdl.dll
2004-08-10 03:00 32768 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099616.dll

2008-04-13 17:11 172032 C:\Program Files\Internet Explorer\Connection Wizard\icwhelp.dll
2004-08-10 03:00 172032 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099615.dll

2008-04-13 17:12 24576 C:\Program Files\Internet Explorer\Connection Wizard\icwrmind.exe
2004-08-10 03:00 24576 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099614.exe

2008-04-13 17:11 49152 C:\Program Files\Internet Explorer\Connection Wizard\icwutil.dll
2004-08-10 03:00 49152 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099613.dll

2008-04-13 17:12 20480 C:\Program Files\Internet Explorer\Connection Wizard\inetwiz.exe
2004-08-10 03:00 20480 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099612.exe

2008-08-22 22:56 635848 C:\Program Files\Internet Explorer\iexplore.exe
2008-04-22 00:40 625664 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP360\A0097622.exe
2008-06-23 02:20 625664 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP392\A0104290.exe

C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
2005-05-27 14:22 824832 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP390\A0104003.exe

C:\Program Files\Lavasoft\Ad-Aware SE Personal\unregaaw.exe
2005-05-25 16:08 162816 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP390\A0104005.exe

C:\Program Files\Lavasoft\Ad-Aware SE Personal\UNWISE.EXE
2001-09-28 17:00 164864 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP390\A0104012.EXE

2008-04-13 17:11 33792 C:\Program Files\Messenger\custsat.dll
2004-08-10 03:00 28672 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0100027.dll

2008-05-02 07:01 83968 C:\Program Files\Messenger\msgsc.dll
2004-08-03 23:06 82944 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP360\A0097673.dll
2008-05-02 07:22 83968 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0100026.dll

2008-04-13 10:30 180224 C:\Program Files\Messenger\msgslang.dll
2004-08-03 23:06 180224 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0100025.dll

2008-04-13 17:12 1695232 C:\Program Files\Messenger\msmsgs.exe
2004-10-13 09:24 1694208 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0100024.exe

2008-04-13 17:12 3558912 C:\Program Files\Movie Maker\moviemk.exe
2004-08-10 03:00 3555328 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099684.exe

2008-04-13 17:12 167936 C:\Program Files\Movie Maker\wmm2ae.dll
2004-08-10 03:00 167936 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099802.dll

2008-04-13 17:12 402432 C:\Program Files\Movie Maker\wmm2filt.dll
2004-08-10 03:00 402432 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099801.dll

2008-04-13 17:12 502272 C:\Program Files\Movie Maker\wmm2fxa.dll
2004-08-10 03:00 502272 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099800.dll

2008-04-13 17:12 325632 C:\Program Files\Movie Maker\wmm2fxb.dll
2004-08-10 03:00 325632 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099799.dll

2008-04-13 17:12 4256768 C:\Program Files\Movie Maker\wmm2res.dll
2004-08-10 03:00 4256768 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099798.dll

2008-04-13 17:12 5632 C:\Program Files\Movie Maker\wmm2res2.dll
2004-08-10 03:00 5632 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099797.dll

2008-04-13 17:10 229376 C:\Program Files\MSN\MSNCoreFiles\OOBE\obelog.dll
2004-08-10 03:00 229376 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099813.dll

2008-04-13 17:10 966656 C:\Program Files\MSN\MSNCoreFiles\OOBE\obemetal.dll
2004-08-10 03:00 966656 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099812.dll

2007-04-02 11:44 77824 C:\Program Files\MSN\MSNCoreFiles\OOBE\obemtllc.dll
2004-08-10 03:00 77824 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099811.dll

2008-04-13 17:10 86016 C:\Program Files\MSN\MSNCoreFiles\OOBE\obepopc.dll
2004-08-10 03:00 86016 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099810.dll

C:\Program Files\Netflix\Netflix Movie Viewer\InstallAction.exe
2008-07-30 20:25 121920 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP354\A0097501.exe

2008-04-13 17:11 385024 C:\Program Files\NetMeeting\callcont.dll
2004-08-10 03:00 385024 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099638.dll

2008-04-13 17:12 1032192 C:\Program Files\NetMeeting\conf.exe
2004-08-10 03:00 1032192 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099637.exe

2008-04-13 17:11 45056 C:\Program Files\NetMeeting\confmrsl.dll
2004-08-10 03:00 45056 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099636.dll

2008-04-13 17:11 40960 C:\Program Files\NetMeeting\dcap32.dll
2004-08-10 03:00 40960 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099635.dll

2008-04-13 17:11 57344 C:\Program Files\NetMeeting\h323cc.dll
2004-08-10 03:00 57344 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099634.dll

2008-04-13 17:12 274432 C:\Program Files\NetMeeting\mst120.dll
2004-08-10 03:00 274432 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099633.DLL

2008-04-13 17:12 57344 C:\Program Files\NetMeeting\mst123.dll
2004-08-10 03:00 57344 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099632.DLL

2008-04-13 17:12 221184 C:\Program Files\NetMeeting\nac.dll
2004-08-10 03:00 221184 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099631.dll

2008-04-13 17:12 229376 C:\Program Files\NetMeeting\nmas.dll
2004-08-10 03:00 229376 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099630.dll

2008-04-13 17:12 28672 C:\Program Files\NetMeeting\nmasnt.dll
2004-08-10 03:00 28672 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099629.dll

2008-04-13 17:12 81920 C:\Program Files\NetMeeting\nmchat.dll
2004-08-10 03:00 81920 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099628.dll

2008-04-13 17:12 77824 C:\Program Files\NetMeeting\nmcom.dll
2004-08-10 03:00 77824 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099627.dll

2008-04-13 17:12 151552 C:\Program Files\NetMeeting\nmft.dll
2004-08-10 03:00 151552 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099626.dll

2008-04-13 17:12 172032 C:\Program Files\NetMeeting\nmoldwb.dll
2004-08-10 03:00 172032 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099625.dll

2008-04-13 17:12 188416 C:\Program Files\NetMeeting\nmwb.dll
2004-08-10 03:00 188416 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099624.dll

2008-04-13 17:12 61440 C:\Program Files\NetMeeting\rrcm.dll
2004-08-10 03:00 61440 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099623.dll

2008-07-16 15:42 305528 C:\Program Files\Norton Internet Security\ISLAlert.dll
2007-09-11 14:20 303480 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP352\A0095467.dll

2008-07-10 12:37 464232 C:\Program Files\Norton Internet Security\Norton AntiVirus\DefAlert.dll
2007-09-06 22:36 460136 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP352\A0095468.dll

2008-04-13 17:12 60416 C:\Program Files\Outlook Express\msimn.exe
2004-08-10 03:00 60416 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099608.exe

2008-04-13 17:12 1314816 C:\Program Files\Outlook Express\msoe.dll
2007-05-16 08:12 1314816 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099607.dll

2008-04-13 09:23 2479616 C:\Program Files\Outlook Express\msoeres.dll
2004-08-10 03:00 2479616 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099606.dll

2008-04-13 17:12 104448 C:\Program Files\Outlook Express\oeimport.dll
2004-08-10 03:00 104448 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099605.dll

2008-04-13 17:12 60416 C:\Program Files\Outlook Express\oemig50.exe
2004-08-10 03:00 60416 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099604.exe

2008-04-13 17:12 35328 C:\Program Files\Outlook Express\oemiglib.dll
2004-08-10 03:00 35328 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099603.dll

2008-04-13 17:12 73216 C:\Program Files\Outlook Express\setup50.exe
2004-08-10 03:00 73216 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099602.exe

2008-04-13 17:12 46080 C:\Program Files\Outlook Express\wab.exe
2004-08-10 03:00 46080 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099601.exe

2008-04-13 17:12 32768 C:\Program Files\Outlook Express\wabfind.dll
2004-08-10 03:00 32768 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099600.dll

2008-04-13 17:12 85504 C:\Program Files\Outlook Express\wabimp.dll
2007-05-16 08:12 85504 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099599.dll

2008-04-13 17:12 30208 C:\Program Files\Outlook Express\wabmig.exe
2004-08-10 03:00 30208 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099598.exe

C:\Program Files\Spectrum Commander\Commander.exe
2007-09-13 08:36 2437124 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP378\A0100844.exe

C:\Program Files\Spectrum Commander\Engine.dll
2007-09-13 08:33 724996 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP378\A0100845.dll

C:\Program Files\Spectrum Commander\l3com.dll
2007-09-13 08:36 1073156 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP378\A0100843.dll

C:\Program Files\Spectrum Commander\l3nlk.dll
2007-09-13 08:36 614404 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP378\A0100842.dll

C:\Program Files\Spectrum Commander\scancore.dll
2007-09-13 08:32 2158596 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP378\A0100846.dll

C:\Program Files\Spectrum Commander\xtp.dll
2007-09-13 08:36 5529604 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP378\A0100841.dll

2006-03-08 09:48 761947 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
2006-05-19 14:51 774233 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP393\A0104380.exe

2008-04-13 17:12 214528 C:\Program Files\Windows NT\Accessories\wordpad.exe
2004-08-10 03:00 214528 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099682.exe

2008-04-13 17:12 539136 C:\Program Files\Windows NT\dialer.exe
2004-08-10 03:00 539136 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099609.exe

2008-04-13 17:12 281088 C:\Program Files\Windows NT\Pinball\pinball.exe
2004-08-10 03:00 281088 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099683.EXE

C:\WINDOWS\_000004_.tmp.dll
2008-04-11 12:18 12431 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP360\A0097596.dll
2008-04-15 11:51 12305 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP381\A0102836.dll

C:\WINDOWS\_000005_.tmp.dll
2008-05-01 08:30 12431 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP360\A0097656.dll
2008-08-14 08:33 12431 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP392\A0104331.dll

C:\WINDOWS\_000006_.tmp.dll
2008-08-14 08:33 17099 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP392\A0104261.dll

C:\WINDOWS\_000012_.tmp.dll
2008-06-19 02:25 15271 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP375\A0100777.dll

C:\WINDOWS\_000048_.tmp.dll
2008-06-26 11:16 32215 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP360\A0097600.dll
2008-10-03 11:49 29984 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP392\A0104268.dll

C:\WINDOWS\_003058_.tmp.dll
2004-08-10 03:00 7334 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098395.dll

C:\WINDOWS\_003059_.tmp.dll
2008-04-13 19:04 1088840 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098396.dll

C:\WINDOWS\_003060_.tmp.dll
2008-04-13 19:04 2144487 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098397.dll

C:\WINDOWS\_003061_.tmp.dll
2008-04-13 19:04 10027 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098398.dll

C:\WINDOWS\_003062_.tmp.dll
2008-04-13 19:04 14433 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098399.dll

C:\WINDOWS\_003063_.tmp.dll
2008-04-13 19:04 26991 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098400.dll

C:\WINDOWS\_003064_.tmp.dll
2008-04-13 19:04 12363 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098401.dll

C:\WINDOWS\_003065_.tmp.dll
2008-04-13 19:04 16535 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098402.dll

C:\WINDOWS\_003066_.tmp.dll
2008-04-13 19:04 34063 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098403.dll

C:\WINDOWS\_003067_.tmp.dll
2008-04-14 07:40 1296669 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098404.dll

C:\WINDOWS\_003068_.tmp.dll
2008-04-13 19:10 112918 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098405.dll

C:\WINDOWS\_003069_.tmp.dll
2008-04-13 19:04 522220 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098406.dll

C:\WINDOWS\_003070_.tmp.dll
2008-04-13 19:04 144484 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098407.dll

C:\WINDOWS\_003071_.tmp.dll
2008-04-13 19:04 34747 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098408.dll

C:\WINDOWS\_003072_.tmp.dll
2008-04-13 19:04 36549 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098409.dll

C:\WINDOWS\AppPatch\_003533_.tmp.dll
2004-08-10 03:00 9424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098771.dll

2008-04-13 17:11 39424 C:\WINDOWS\AppPatch\acadproc.dll
2006-10-04 07:05 39424 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099906.dll

C:\WINDOWS\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP\WiseCustCall64.dll
2008-10-13 16:15 42248 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP390\A0104013.dll

C:\WINDOWS\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP\WiseCustomCall.dll
2008-10-13 16:15 27912 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP390\A0104014.dll

C:\WINDOWS\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP\WiseCustomCalla.dll
2008-10-13 16:15 73728 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP390\A0104015.dll

C:\WINDOWS\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP\WiseCustomCalla1.dll
2008-10-13 16:15 83296 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP390\A0104016.dll

C:\WINDOWS\Driver Cache\i386\_003073_.tmp.dll
2005-06-21 08:00 474624 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098410.dll

C:\WINDOWS\Driver Cache\i386\_003074_.tmp.dll
2005-06-21 08:00 52736 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098411.dll

C:\WINDOWS\Driver Cache\i386\_003082_.tmp.dll
2006-06-14 02:00 82944 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098419.dll

C:\WINDOWS\Driver Cache\i386\_003096_.tmp.dll
2005-10-25 16:39 143104 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098433.dll

C:\WINDOWS\Driver Cache\i386\_003098_.tmp.dll
2006-02-20 20:39 58240 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098435.dll

C:\WINDOWS\Driver Cache\i386\_003099_.tmp.dll
2005-10-25 16:39 27264 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098436.dll

C:\WINDOWS\Driver Cache\i386\_003100_.tmp.dll
2004-12-08 07:34 12800 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098437.dll

C:\WINDOWS\Driver Cache\i386\_003114_.tmp.dll
2006-06-14 01:47 6400 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098451.dll

C:\WINDOWS\Driver Cache\i386\_003121_.tmp.dll
2005-05-31 09:46 43264 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098458.dll

C:\WINDOWS\Driver Cache\i386\_003123_.tmp.dll
2004-11-30 16:28 30464 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098460.dll
2004-11-30 16:28 30464 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098460.dll

C:\WINDOWS\Driver Cache\i386\_003131_.tmp.dll
2005-06-24 09:47 8832 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098468.dll

C:\WINDOWS\Driver Cache\i386\_003133_.tmp.dll
2004-03-16 09:58 136960 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098470.dll

C:\WINDOWS\Driver Cache\i386\_003143_.tmp.dll
2007-02-28 02:55 2182144 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098480.dll

C:\WINDOWS\Driver Cache\i386\_003145_.tmp.dll
2007-02-28 02:15 2017280 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098482.dll

C:\WINDOWS\Driver Cache\i386\_003147_.tmp.dll
2007-02-28 02:15 2059392 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098484.dll

C:\WINDOWS\Driver Cache\i386\_003149_.tmp.dll
2007-02-28 02:53 2137600 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098486.dll

C:\WINDOWS\Driver Cache\i386\_003152_.tmp.dll
2005-06-20 11:52 14592 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098489.dll

C:\WINDOWS\Driver Cache\i386\_003171_.tmp.dll
2006-05-05 02:41 453120 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098508.dll

C:\WINDOWS\Driver Cache\i386\_003191_.tmp.dll
2006-06-14 01:47 172416 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098528.dll

C:\WINDOWS\Driver Cache\i386\_003198_.tmp.dll
2004-09-30 10:49 27136 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098535.dll

C:\WINDOWS\Driver Cache\i386\_003215_.tmp.dll
2006-01-10 17:48 46592 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098552.dll

C:\WINDOWS\Driver Cache\i386\_003219_.tmp.dll
2006-03-16 17:33 262784 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098556.dll

C:\WINDOWS\Driver Cache\i386\_003223_.tmp.dll
2006-01-10 17:48 19200 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098560.dll

C:\WINDOWS\Driver Cache\i386\_003225_.tmp.dll
2004-11-15 18:37 77696 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098562.dll

C:\WINDOWS\Driver Cache\i386\_003226_.tmp.dll
2004-11-15 18:37 152576 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098563.dll

C:\WINDOWS\Driver Cache\i386\_003227_.tmp.dll
2005-06-22 17:05 134272 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098564.dll

C:\WINDOWS\Driver Cache\i386\_003228_.tmp.dll
2004-11-15 18:37 150400 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098565.dll

C:\WINDOWS\Driver Cache\i386\_003229_.tmp.dll
2004-11-15 18:37 81152 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098566.dll

C:\WINDOWS\Driver Cache\i386\_003230_.tmp.dll
2004-11-15 18:37 131712 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098567.dll

C:\WINDOWS\Driver Cache\i386\_003231_.tmp.dll
2004-11-15 18:37 105344 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098568.dll

C:\WINDOWS\Driver Cache\i386\_003253_.tmp.dll
2008-06-13 06:10 272128 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098590.dll

C:\WINDOWS\Driver Cache\i386\_003263_.tmp.dll
2006-02-14 17:22 142464 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098599.dll

2008-04-13 17:12 1033728 C:\WINDOWS\explorer.exe
2007-06-13 03:23 1033216 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099538.exe

2008-04-13 17:12 34816 C:\WINDOWS\Help\sniffpol.dll
2004-08-10 03:00 34816 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099597.dll

2008-04-13 17:12 33280 C:\WINDOWS\Help\sstub.dll
2004-08-10 03:00 33280 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099596.dll

2008-04-13 17:12 279040 C:\WINDOWS\Help\tshoot.dll
2004-08-10 03:00 279040 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099595.dll

2008-04-13 17:12 10752 C:\WINDOWS\hh.exe
2005-05-26 16:22 10752 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099537.exe

2008-04-13 17:11 220160 C:\WINDOWS\ime\mscandui.dll
2004-08-10 03:00 220160 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099641.dll

2008-04-13 17:12 130048 C:\WINDOWS\ime\softkbd.dll
2004-08-10 03:00 130048 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099640.DLL

2008-04-13 09:43 62976 C:\WINDOWS\ime\spgrmr.dll
2004-08-10 03:00 62976 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099907.dll

2008-04-13 17:12 250368 C:\WINDOWS\ime\sptip.dll
2004-08-10 03:00 250880 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099639.dll

C:\WINDOWS\inf\_000000_.tmp.dll
2008-06-20 10:55 926 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP360\A0097595.dll
2008-10-03 07:34 926 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP392\A0104329.dll

C:\WINDOWS\inf\_003327_.tmp.dll
2006-09-14 12:22 108916 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098602.dll

C:\WINDOWS\inf\_003328_.tmp.dll
2006-09-14 12:22 67708 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098603.dll

C:\WINDOWS\inf\_003329_.tmp.dll
2006-09-08 03:51 28188 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0098604.dll

C:\WINDOWS\Installer\{37E1EB56-C59B-4C5C-B0B3-B5076046EF8A}\RedirectorEXE_770DFD1204C24F4DA163D64FACCB5CBD.exe
2007-07-12 20:05 6502 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP348\A0094432.exe

C:\WINDOWS\Installer\{37E1EB56-C59B-4C5C-B0B3-B5076046EF8A}\RedirectorEXE1_770DFD1204C24F4DA163D64FACCB5CBD.exe
2007-07-12 20:05 6502 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP348\A0094433.exe

C:\WINDOWS\Installer\{37E1EB56-C59B-4C5C-B0B3-B5076046EF8A}\RedirectorEXE2_770DFD1204C24F4DA163D64FACCB5CBD.exe
2007-07-12 20:05 6502 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP348\A0094434.exe

2008-08-20 13:01 405504 C:\WINDOWS\Installer\{7210BCFE-ED8D-4261-8537-81B5A4BDFA2A}\ARPPRODUCTICON.exe
2008-08-19 19:03 405504 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP364\A0097759.exe
2008-08-20 11:39 405504 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP366\A0097825.exe

2008-08-20 13:01 405504 C:\WINDOWS\Installer\{7210BCFE-ED8D-4261-8537-81B5A4BDFA2A}\NewShortcut1_7210BCFEED8D4261853781B5A4BDFA2A.exe
2008-08-19 19:03 405504 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP364\A0097760.exe
2008-08-20 11:39 405504 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP366\A0097826.exe

2008-08-20 13:01 65536 C:\WINDOWS\Installer\{7210BCFE-ED8D-4261-8537-81B5A4BDFA2A}\RS_WebsiteShortcut_7210BCFEED8D4261853781B5A4BDFA2A.exe
2008-08-19 19:03 65536 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP364\A0097761.exe
2008-08-20 11:39 65536 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP366\A0097827.exe

C:\WINDOWS\LastGood.Tmp\system32\cdm.dll
2007-07-30 19:19 92504 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP370\A0098086.dll

C:\WINDOWS\LastGood.Tmp\system32\ctfmon.exe
2004-08-10 03:00 15360 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP393\A0104403.exe

C:\WINDOWS\LastGood.Tmp\system32\DRIVERS\RimSerial.sys
2006-06-30 16:10 26752 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP349\A0094475.sys

C:\WINDOWS\LastGood.Tmp\system32\mucltui.dll
2007-07-30 20:19 271224 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP370\A0098087.dll

C:\WINDOWS\LastGood.Tmp\system32\muweb.dll
2007-07-30 20:19 207736 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP370\A0098088.dll

C:\WINDOWS\LastGood.Tmp\system32\wuapi.dll
2007-07-30 19:19 549720 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP370\A0098089.dll

C:\WINDOWS\LastGood.Tmp\system32\wuauclt.exe
2007-07-30 19:19 53080 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP370\A0098090.exe

C:\WINDOWS\LastGood.Tmp\system32\wuaueng.dll
2007-07-30 19:19 1712984 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP370\A0098092.dll

C:\WINDOWS\LastGood.Tmp\system32\wucltui.dll
2007-07-30 19:19 325976 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP370\A0098093.dll

C:\WINDOWS\LastGood.Tmp\system32\wups.dll
2007-07-30 19:18 33624 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP370\A0098094.dll

C:\WINDOWS\LastGood.Tmp\system32\wups2.dll
2007-07-30 19:19 43352 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP370\A0098095.dll

C:\WINDOWS\LastGood.Tmp\system32\wuweb.dll
2007-07-30 19:19 203096 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP370\A0098096.dll

2008-04-13 09:09 20480 C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\aspnet_filter.dll
2002-06-21 15:31 20480 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0100021.dll

2008-04-13 09:09 200704 C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\aspnet_isapi.dll
2007-01-02 16:34 200704 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0100020.dll

2008-04-13 09:10 24576 C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\aspnet_regiis.exe
2004-08-03 20:11 24576 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0100018.exe

2008-04-13 09:10 32768 C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\aspnet_state.exe
2002-06-21 15:31 32768 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0100017.exe

2008-04-13 09:10 32768 C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\aspnet_wp.exe
2007-01-02 16:34 32768 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0100016.exe

2008-04-13 09:10 61440 C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\gacutil.exe
2004-09-29 18:04 61440 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0100015.exe

2007-12-17 04:58 2273280 C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscorsvr.dll
2007-01-02 16:28 2273280 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0100014.dll

2007-12-17 04:59 2281472 C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
2007-01-02 16:28 2281472 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0100013.dll

2007-12-17 04:59 82976 C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\netfxupdate.exe
2007-01-15 16:11 73728 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0100012.exe

2007-12-17 04:59 66592 C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\setregni.exe
2007-01-15 16:11 57344 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0100011.exe

2007-12-17 04:59 1179648 C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\system.dll
2004-07-19 16:54 1179648 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0100010.dll

2007-12-17 05:00 66592 C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\togac.exe
2007-01-15 16:11 57344 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0100009.exe

2008-04-13 17:11 24064 C:\WINDOWS\msagent\agentanm.dll
2004-08-10 03:00 24064 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099659.dll

2008-04-13 17:11 214016 C:\WINDOWS\msagent\agentctl.dll
2004-08-10 03:00 214016 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099658.dll

2008-04-13 17:11 42496 C:\WINDOWS\msagent\agentdp2.dll
2006-10-12 06:54 42496 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099657.dll

2008-04-13 17:11 57344 C:\WINDOWS\msagent\agentdpv.dll
2007-03-09 06:58 57344 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099656.dll

2008-04-13 17:11 49152 C:\WINDOWS\msagent\agentmpx.dll
2004-08-10 03:00 49152 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099655.dll

2008-04-13 17:11 24064 C:\WINDOWS\msagent\agentpsh.dll
2004-08-10 03:00 24064 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099654.dll

2008-04-13 17:11 44032 C:\WINDOWS\msagent\agentsr.dll
2004-08-10 03:00 44032 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099653.dll

2008-04-13 17:12 256512 C:\WINDOWS\msagent\agentsvr.exe
2006-10-12 04:54 256512 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099652.exe

2008-04-13 17:11 24064 C:\WINDOWS\msagent\agtintl.dll
2004-08-10 03:00 24064 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099650.dll

2007-04-02 11:25 19456 C:\WINDOWS\msagent\intl\agt0405.dll
2004-08-10 03:00 19456 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099677.dll

2007-04-02 11:25 19456 C:\WINDOWS\msagent\intl\agt0406.dll
2004-08-10 03:00 19456 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099676.dll

2007-04-02 11:26 21504 C:\WINDOWS\msagent\intl\agt0407.dll
2004-08-10 03:00 21504 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099675.dll

2007-04-02 11:26 22016 C:\WINDOWS\msagent\intl\agt0408.dll
2004-08-10 03:00 22016 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099674.dll

2008-04-13 10:32 19968 C:\WINDOWS\msagent\intl\agt0409.dll
2004-08-10 03:00 19456 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099673.dll

2007-04-02 11:26 19456 C:\WINDOWS\msagent\intl\agt040b.dll
2004-08-10 03:00 19456 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099672.dll

2007-04-02 11:26 21504 C:\WINDOWS\msagent\intl\agt040c.dll
2004-08-10 03:00 21504 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099671.dll

2007-04-02 11:26 19968 C:\WINDOWS\msagent\intl\agt040e.dll
2004-08-10 03:00 19968 {129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP371\A0099670.dll

2007-04-02 11:26 20992 C:\WINDOWS\msagent\intl\agt0410.dll
{129201FA-B0AC-49B3-96
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 15360]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-06-10 249856]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 C:\WINDOWS\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-02-13 35328]
"VoiceCenter"="C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [2006-02-16 1118208]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-10 90112]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-11-28 185896]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-21 7557120]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2006-05-04 237568]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-06-10 249856]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-05-01 667718]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-05-01 602182]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 67584]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2006-05-03 98304]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2006-09-21 127036]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\Quickset.exe" [2006-06-02 1032192]
"CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 115816]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-01-14 771704]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-08-16 236016]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 C:\WINDOWS\stsystra.exe]
"nwiz"="nwiz.exe" [2006-03-21 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2006-03-21 C:\WINDOWS\system32\nvhotkey.dll]
"MBMon"="CTMBHA.DLL" [2006-06-28 C:\WINDOWS\system32\CTMBHA.DLL]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-09-08 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.CEGSM"= mobilev.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD]
–a—— 2002-09-10 22:26 368706 C:\Program Files\BroadJump\Client Foundation\CFD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eFax 4.2]
–a—— 2006-07-14 13:36 107008 C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2006-10-30 10:36 256576 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCameraAssistant]
–a—— 2006-05-04 06:24 489472 C:\Program Files\Logitech\Video\CameraAssistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideo[inspector]]
–a—— 2006-05-04 06:32 73728 C:\Program Files\Logitech\Video\InstallHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2006-10-25 19:58 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
–a—— 2008-01-11 18:54 166304 c:\Program Files\Zune\ZuneLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)
"LVPrcSrv"=2 (0x2)
"ZuneWlanCfgSvc"=3 (0x3)
"ZuneNetworkSvc"=3 (0x3)
"ZuneBusEnum"=2 (0x2)
"SQLAgent$MICROSOFTSMLBIZ"=3 (0x3)
"MSSQL$MICROSOFTSMLBIZ"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\RosettaStoneVersion3.exe"=
"C:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\support\\bin\\win\\RosettaStoneLtdServices.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9713:TCP"= 9713:TCP:BitComet 9713 TCP
"9713:UDP"= 9713:UDP:BitComet 9713 UDP
""=

R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-01-11 40832]
S3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2006-05-04 16768]
S4 ZuneBusEnum;Zune Bus Enumerator;c:\WINDOWS\system32\ZuneBusEnum.exe [2008-01-11 61856]
S4 ZuneWlanCfgSvc;Zune Wireless Configuration Service;c:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-01-11 245664]

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2008-10-14 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Adam Weber.job
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-01-14 02:09]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-H/PC Connection Agent - C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
MSConfigStartUp-Motive SmartBridge - C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-14 15:50:40
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\DOCUME~1\ADAMWE~1\LOCALS~1\temp\clclean.0001
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\QuickSet\NicConfigSvc.exe
C:\Program Files\Real\RealPlayer\realplay.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\stacsv.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\fxssvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
.
**************************************************************************
.
Completion time: 2008-10-14 16:05:33 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-14 23:05:26
ComboFix2.txt 2008-10-14 22:11:04

Pre-Run: 41,933,799,424 bytes free
Post-Run: 41,911,975,936 bytes free

1014 — E O F — 2008-10-14 22:22:10

Rorschach112

Post #8October 14, 2008, 11:16 PM UTC

Hello

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.

aeweber

Post #9October 15, 2008, 5:53 AM UTC

Malwarebytes' Anti-Malware 1.28 Database version: 1271 Windows 5.1.2600 Service Pack 3 10/14/2008 10:51:54 PM mbam-log-2008-10-14 (22-51-54).txt Scan type: Quick Scan Objects scanned: 66501 Time elapsed: 11 minute(s), 10 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\smwin32.mdr (Trojan.FakeAlert) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ——————————————————————————– KASPERSKY ONLINE SCANNER 7 REPORT Tuesday, October 14, 2008 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Tuesday, October 14, 2008 22:28:01 Records in database: 1312015 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Files scanned: 105427 Threat name: 8 Infected objects: 19 Suspicious objects: 0 Duration of the scan: 01:44:38 File name / Threat name / Threats count C:\Documents and Settings\Adam Weber\.housecall6.6\Quarantine\BitDownload fastets Bittorrent downloader.].bac_a03900 Infected: Trojan.Win32.Obfuscated.en 1 C:\Documents and Settings\Adam Weber\.housecall6.6\Quarantine\BitDownload fastets Bittorrent downloade].bac_a03900 Infected: Trojan.Win32.Obfuscated.en 1 C:\Documents and Settings\Adam Weber\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-51fad18-43776e04.zip Infected: Exploit.Java.Gimsh.a 1 C:\Documents and Settings\Adam Weber\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-6d00d9f7-71600f29.zip Infected: Exploit.Java.Gimsh.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\080369FE.exe Infected: Trojan-Banker.Win32.Bancos.axr 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\21B1171F.exe Infected: Trojan-Spy.Win32.Bancos.adm 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A924270 Infected: Trojan-Banker.Win32.Bancos.axr 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\385C5B5F.htm Infected: Trojan-Downloader.JS.Small.hr 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3A4C1413.exe Infected: Trojan.Win32.Agent.bxj 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D32040D.htm Infected: Trojan-Downloader.JS.Small.hr 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\42184980.exe Infected: Trojan.Win32.Agent.bxj 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\42321963.exe Infected: Trojan.Win32.Agent.bxj 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4235435F.exe Infected: Trojan.Win32.Agent.bxj 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\42386D5C.exe Infected: Trojan.Win32.Agent.bxj 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\45AA0680.tmp Infected: Trojan.Java.ClassLoader.as 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\54206FEF.htm Infected: Trojan-Downloader.JS.Small.hr 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6AA267F1 Infected: Trojan-Banker.Win32.Bancos.axr 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\774E1635.tmp Infected: Trojan.Java.ClassLoader.as 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\isapnp.exe.vir Infected: Trojan-Banker.Win32.Bancos.asd 1 The selected area was scanned.

Rorschach112

Post #10October 15, 2008, 11:45 AM UTC

Post a new HJT Log

aeweber

Post #11October 15, 2008, 8:23 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 1:23:00 PM, on 10/15/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\stacsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\DOCUME~1\ADAMWE~1\LOCALS~1\Temp\clclean.0001
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\ehome\ehtray.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Dell\QuickSet\Quickset.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Weber\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=1060908
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\Quickset.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Unknown owner - C:\Program Files\Dantz\Retrospect\retrorun.exe (file missing)
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\stacsv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

Rorschach112

Post #12October 15, 2008, 8:51 PM UTC

Your logs are clean

Follow these steps to uninstall Combofix and tools used in the removal of malware

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

Make sure you have an Internet Connection.
Download OTCleanIt to your desktop and run it
A list of tool components used in the Cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OTCleanUp to reach the Internet, please allow the application to do so.
Click Yes to beging the Cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:

SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program or there will be a conflict.

Make Internet Explorer more secure

Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.

*ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

*NoScript - Addon for Firefox that stops all scripts from running on websites. Stops malicious software from invading via flash, java, javascript, and many other entry points.

*Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.

aeweber

Post #13October 17, 2008, 10:28 PM UTC

Thank you so much for all your help! You're doing a wonderful thing for the world.

Rorschach112

Post #14October 17, 2008, 10:36 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Spyware hijacked

✨ Ask AI

Ask AI