What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Antivrius 2009

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
cece, You have a couple of files infected that are related to microsoft publisher. I don't find that they are a known false positive so they are probably really infected. Typically we just delete an infected file. I hate to do that as Microsoft publisher may not operate correctly if we do. Do you use Microsoft publisher?
Post #18
cece,

Alrighty then.

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    File::
C:\Program Files\Microsoft Office\OFFICE11\1033\CLRCHK.JSP 
C:\Program Files\Microsoft Office\OFFICE11\1033\FONTLIST.JSP

Folder::

Registry::

Driver::
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Also please give me a (hopefully) final HijackThis log.
Post #19
Tomk,

Here is the Combofix log:

ComboFix 08-12-09.03 - a 2008-12-13 16:28:27.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.[removed].18.197 [GMT -8:00]
執行位置: c:\documents and settings\a\Desktop\Fixme.exe
Command switches used :: c:\documents and settings\a\Desktop\CFScript.txt
* 成功創造新還原點

FILE ::
c:\program files\Microsoft Office\OFFICE11\1033\CLRCHK.JSP
c:\program files\Microsoft Office\OFFICE11\1033\FONTLIST.JSP
.

((((((((((((((((((((((((((((((((((((((( 被刪除的檔案 )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Microsoft Office\OFFICE11\1033\CLRCHK.JSP
c:\program files\Microsoft Office\OFFICE11\1033\FONTLIST.JSP

.
((((((((((((((((((((((((( 2008-11-14 至 2008-12-14 的新的檔案 )))))))))))))))))))))))))))))))
.

2008-12-13 01:15 . 2008-12-13 01:15 d——– c:\program files\Java
2008-12-13 01:15 . 2008-12-13 01:15 410,984 –a—— c:\windows\system32\deploytk.dll
2008-12-13 01:15 . 2008-12-13 01:15 73,728 –a—— c:\windows\system32\javacpl.cpl
2008-12-12 10:00 . 2008-12-12 10:00 d——– c:\program files\Windows Media Connect 2
2008-12-12 10:00 . 2004-08-03 23:56 221,184 –a—— c:\windows\system32\wmpns.dll
2008-12-12 09:58 . 2008-12-12 09:59 d——– c:\windows\system32\drivers\UMDF
2008-12-12 07:41 . 2008-06-13 05:10 272,128 ——— c:\windows\system32\drivers\bthport.sys
2008-12-12 07:41 . 2008-06-13 05:10 272,128 —–c— c:\windows\system32\dllcache\bthport.sys
2008-12-12 07:38 . 2008-08-14 02:00 2,180,352 —–c— c:\windows\system32\dllcache\ntoskrnl.exe
2008-12-12 07:38 . 2008-08-14 01:58 2,136,064 —–c— c:\windows\system32\dllcache\ntkrnlmp.exe
2008-12-12 07:38 . 2008-08-14 01:22 2,057,728 —–c— c:\windows\system32\dllcache\ntkrnlpa.exe
2008-12-12 07:38 . 2008-08-14 01:22 2,015,744 —–c— c:\windows\system32\dllcache\ntkrpamp.exe
2008-12-12 07:37 . 2008-10-24 03:10 453,632 —–c— c:\windows\system32\dllcache\mrxsmb.sys
2008-12-12 07:29 . 2008-10-16 14:09 31,768 –a—— c:\windows\system32\wucltui.dll.mui
2008-12-12 07:29 . 2008-10-16 14:07 23,576 –a—— c:\windows\system32\wuaucpl.cpl.mui
2008-12-12 07:29 . 2008-10-16 14:07 23,576 –a—— c:\windows\system32\wuapi.dll.mui
2008-12-12 07:29 . 2008-10-16 14:07 18,456 –a—— c:\windows\system32\wuaueng.dll.mui
2008-12-11 23:51 . 2008-12-11 23:51 d——– c:\program files\Malwarebytes' Anti-Malware
2008-12-11 23:51 . 2008-12-03 19:52 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-11 23:51 . 2008-12-03 19:52 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-12-10 23:28 . 2008-12-13 01:07 d——– C:\Downloads
2008-12-10 23:27 . 2008-12-13 16:25 d——– c:\documents and settings\a\Application Data\GetRight
2008-12-10 23:26 . 2008-12-11 11:15 d——– c:\program files\GetRight
2008-12-10 19:49 . 2008-12-10 19:49 d——– C:\_OTMoveIt

.
(((((((((((((((((((((((((((((((((((((((( 在三個月內被修改的檔案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-24 11:10 453,632 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 13:01 283,648 —-a-w c:\windows\system32\gdi32.dll
2008-10-16 22:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 22:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 22:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 22:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 22:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 22:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 22:09 43,544 —-a-w c:\windows\system32\wups2.dll
2008-10-16 22:08 34,328 —-a-w c:\windows\system32\wups.dll
2008-10-16 10:37 659,456 —-a-w c:\windows\system32\wininet.dll
2008-10-03 10:15 247,326 —-a-w c:\windows\system32\strmdll.dll
2008-09-15 11:57 1,846,016 —-a-w c:\windows\system32\win32k.sys
2008-06-23 02:19 22,311,160 —-a-w c:\program files\antivir_workstation_winu_en_h.exe
2008-06-21 19:14 14 —-a-w c:\documents and settings\a\getfile.dat
2008-06-18 08:25 74 —-a-w c:\program files\fix.bat
2007-06-03 18:59 9 —-a-w c:\program files\Statement.DailyMonthlyStatement
2007-06-02 03:34 12,336,288 —-a-w c:\program files\tws40_install.exe
2007-01-09 05:51 2,948 —-a-w c:\program files\Report-Scan-20070108-215042.txt
2007-01-09 04:41 47,104 —-a-w c:\program files\ATF-Cleaner.exe
2007-01-09 04:39 6,469,352 —-a-w c:\program files\avgas-setup-7.5.0.50.exe
2007-01-09 03:57 2,855,080 —-a-w c:\program files\aawsepersonal.exe
2007-01-09 03:54 5,037,072 —-a-w c:\program files\spybotsd14.exe
2006-12-13 05:33 13,817,440 —-a-w c:\program files\bitdefender_free_v8.exe
2006-06-04 03:24 102,400 —-a-w c:\documents and settings\a\com_securenetasia_p11wrapper2.dll
2005-11-26 07:10 5,529,600 —-a-w c:\program files\mplayerc.exe
2001-11-23 04:08 712,704 —-a-r c:\windows\inf\OTHER\AUDIO3D.DLL
2004-08-08 14:26 520 –sh–w c:\windows\system32\smdsbsrv.sys
.

((((((((((((((((((((((((((((( snapshot@2008-12-11_21.49.17.39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-10-04 14:05:26 39,424 ——w c:\windows\AppPatch\acadproc.dll
+ 2008-06-13 13:10:50 272,128 ——w c:\windows\Driver Cache\i386\bthport.sys
+ 2008-10-24 11:10:42 453,632 ——w c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2008-08-14 09:58:27 2,136,064 ——w c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2008-08-14 09:22:13 2,057,728 ——w c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2008-08-14 09:22:14 2,015,744 ——w c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2008-08-14 10:00:45 2,180,352 ——w c:\windows\Driver Cache\i386\ntoskrnl.exe
- 2004-08-04 07:56:58 208,896 —-a-w c:\windows\inf\unregmp2.exe
+ 2006-11-02 02:31:34 315,904 —-a-w c:\windows\inf\unregmp2.exe
- 2004-08-04 07:56:00 8,192 —-a-w c:\windows\system32\asferror.dll
+ 2006-10-19 05:47:08 7,168 —-a-w c:\windows\system32\asferror.dll
+ 2006-10-19 05:47:08 276,992 ——w c:\windows\system32\audiodev.dll
- 2004-08-04 07:56:42 286,208 —-a-w c:\windows\system32\blackbox.dll
+ 2006-10-19 05:47:10 542,720 —-a-w c:\windows\system32\blackbox.dll
- 2004-08-04 07:56:42 1,016,832 —-a-w c:\windows\system32\browseui.dll
+ 2008-10-16 10:37:04 1,023,488 —-a-w c:\windows\system32\browseui.dll
- 2004-08-04 07:56:42 150,528 —-a-w c:\windows\system32\cdfview.dll
+ 2008-10-16 10:37:02 151,040 —-a-w c:\windows\system32\cdfview.dll
- 2004-08-04 07:56:42 159,232 —-a-w c:\windows\system32\cewmdm.dll
+ 2006-10-19 05:47:10 229,376 —-a-w c:\windows\system32\cewmdm.dll
- 2004-08-04 07:56:42 1,053,696 —-a-w c:\windows\system32\danim.dll
+ 2008-10-16 10:37:02 1,054,208 —-a-w c:\windows\system32\danim.dll
- 2004-08-04 06:14:16 138,496 -c–a-w c:\windows\system32\dllcache\afd.sys
+ 2008-08-14 09:51:43 138,368 -c–a-w c:\windows\system32\dllcache\afd.sys
- 2004-08-04 07:56:00 8,192 -c–a-w c:\windows\system32\dllcache\asferror.dll
+ 2006-10-19 05:47:08 7,168 -c–a-w c:\windows\system32\dllcache\asferror.dll
- 2004-08-04 07:56:42 286,208 -c–a-w c:\windows\system32\dllcache\blackbox.dll
+ 2006-10-19 05:47:10 542,720 -c–a-w c:\windows\system32\dllcache\blackbox.dll
- 2004-08-04 07:56:42 1,016,832 -c–a-w c:\windows\system32\dllcache\browseui.dll
+ 2008-10-16 10:37:04 1,023,488 -c–a-w c:\windows\system32\dllcache\browseui.dll
- 2004-08-04 07:56:42 150,528 -c–a-w c:\windows\system32\dllcache\cdfview.dll
+ 2008-10-16 10:37:02 151,040 -c–a-w c:\windows\system32\dllcache\cdfview.dll
- 2005-05-26 11:16:24 75,544 -c–a-w c:\windows\system32\dllcache\cdm.dll
+ 2008-10-16 22:09:44 92,696 -c–a-w c:\windows\system32\dllcache\cdm.dll
- 2004-08-04 07:56:42 159,232 -c–a-w c:\windows\system32\dllcache\cewmdm.dll
+ 2006-10-19 05:47:10 229,376 -c–a-w c:\windows\system32\dllcache\cewmdm.dll
- 2004-08-04 07:56:42 1,053,696 -c–a-w c:\windows\system32\dllcache\danim.dll
+ 2008-10-16 10:37:02 1,054,208 -c–a-w c:\windows\system32\dllcache\danim.dll
- 2004-08-04 07:57:04 695,296 -c–a-w c:\windows\system32\dllcache\drmv2clt.dll
+ 2006-10-19 05:47:10 991,744 -c–a-w c:\windows\system32\dllcache\drmv2clt.dll
- 2004-08-04 07:56:44 357,888 -c–a-w c:\windows\system32\dllcache\dxtmsft.dll
+ 2008-10-16 10:37:02 357,888 -c–a-w c:\windows\system32\dllcache\dxtmsft.dll
- 2004-08-04 07:56:44 201,728 -c–a-w c:\windows\system32\dllcache\dxtrans.dll
+ 2008-10-16 10:37:02 205,312 -c–a-w c:\windows\system32\dllcache\dxtrans.dll
- 2004-08-04 07:56:44 243,200 -c–a-w c:\windows\system32\dllcache\es.dll
+ 2008-07-07 20:32:22 253,952 -c–a-w c:\windows\system32\dllcache\es.dll
- 2004-08-04 07:56:44 55,808 -c–a-w c:\windows\system32\dllcache\extmgr.dll
+ 2008-10-16 10:37:02 55,808 -c–a-w c:\windows\system32\dllcache\extmgr.dll
- 2004-08-04 07:56:44 278,016 -c–a-w c:\windows\system32\dllcache\gdi32.dll
+ 2008-10-23 13:01:36 283,648 -c–a-w c:\windows\system32\dllcache\gdi32.dll
- 2004-08-04 07:56:52 18,432 -c–a-w c:\windows\system32\dllcache\iedw.exe
+ 2008-10-15 09:45:01 18,432 -c–a-w c:\windows\system32\dllcache\iedw.exe
- 2004-08-04 07:56:44 249,344 -c–a-w c:\windows\system32\dllcache\iepeers.dll
+ 2008-10-16 10:37:02 251,392 -c–a-w c:\windows\system32\dllcache\iepeers.dll
- 2004-08-04 07:56:44 678,400 -c–a-w c:\windows\system32\dllcache\inetcomm.dll
+ 2008-04-11 18:50:43 683,520 -c–a-w c:\windows\system32\dllcache\inetcomm.dll
- 2004-08-04 07:56:44 96,256 -c–a-w c:\windows\system32\dllcache\inseng.dll
+ 2008-10-16 10:37:02 96,256 -c–a-w c:\windows\system32\dllcache\inseng.dll
- 2004-08-04 07:56:44 450,560 -c–a-w c:\windows\system32\dllcache\jscript.dll
+ 2007-12-18 14:40:58 450,560 -c–a-w c:\windows\system32\dllcache\jscript.dll
- 2004-08-04 07:56:44 15,872 -c–a-w c:\windows\system32\dllcache\jsproxy.dll
+ 2008-10-16 10:37:03 16,384 -c–a-w c:\windows\system32\dllcache\jsproxy.dll
- 2004-08-04 07:56:44 6,656 -c–a-w c:\windows\system32\dllcache\laprxy.dll
+ 2006-10-19 05:47:14 11,264 -c–a-w c:\windows\system32\dllcache\LAPRXY.dll
- 2004-08-04 07:56:52 103,936 -c–a-w c:\windows\system32\dllcache\logagent.exe
+ 2008-06-18 09:09:22 100,864 -c–a-w c:\windows\system32\dllcache\logagent.exe
- 2004-08-04 07:56:44 310,272 -c–a-w c:\windows\system32\dllcache\mp43dmod.dll
+ 2006-10-19 05:47:14 4,096 -c–a-w c:\windows\system32\dllcache\MP43DMOD.dll
- 2004-08-04 07:56:44 384,512 -c–a-w c:\windows\system32\dllcache\mp4sdmod.dll
+ 2006-10-19 05:47:14 4,096 -c–a-w c:\windows\system32\dllcache\MP4SDMOD.dll
- 2004-08-04 07:56:44 240,640 -c–a-w c:\windows\system32\dllcache\mpg4dmod.dll
+ 2006-10-19 05:47:14 4,096 -c–a-w c:\windows\system32\dllcache\MPG4DMOD.dll
- 2004-08-04 07:56:44 368,640 -c–a-w c:\windows\system32\dllcache\mpvis.dll
+ 2006-10-19 05:47:14 243,712 -c–a-w c:\windows\system32\dllcache\mpvis.dll
- 2004-08-04 07:56:44 331,776 -c–a-w c:\windows\system32\dllcache\msadce.dll
+ 2008-05-01 14:30:33 331,776 -c–a-w c:\windows\system32\dllcache\msadce.dll
- 2004-08-04 07:56:44 73,728 -c–a-w c:\windows\system32\dllcache\mscms.dll
+ 2008-06-24 16:23:05 74,240 -c–a-w c:\windows\system32\dllcache\mscms.dll
- 2004-08-04 07:56:44 3,003,392 -c–a-w c:\windows\system32\dllcache\mshtml.dll
+ 2008-10-16 10:37:05 3,059,712 -c–a-w c:\windows\system32\dllcache\mshtml.dll
- 2004-08-04 07:56:44 448,512 -c–a-w c:\windows\system32\dllcache\mshtmled.dll
+ 2008-10-16 10:37:03 449,024 -c–a-w c:\windows\system32\dllcache\mshtmled.dll
- 2004-08-04 07:57:02 259,072 -c–a-w c:\windows\system32\dllcache\msnetobj.dll
+ 2006-10-19 05:47:16 179,712 -c–a-w c:\windows\system32\dllcache\msnetobj.dll
- 2004-08-04 07:56:44 52,224 -c–a-w c:\windows\system32\dllcache\mspmsnsv.dll
+ 2006-10-19 05:47:16 27,136 -c–a-w c:\windows\system32\dllcache\mspmsnsv.dll
- 2004-08-04 07:56:44 201,728 -c–a-w c:\windows\system32\dllcache\mspmsp.dll
+ 2006-10-19 05:47:16 175,616 -c–a-w c:\windows\system32\dllcache\mspmsp.dll
- 2004-08-04 07:56:44 146,432 -c–a-w c:\windows\system32\dllcache\msrating.dll
+ 2008-10-16 10:37:02 146,432 -c–a-w c:\windows\system32\dllcache\msrating.dll
- 2004-08-04 07:57:02 356,352 -c–a-w c:\windows\system32\dllcache\msscp.dll
+ 2006-12-05 00:21:50 414,720 -c–a-w c:\windows\system32\dllcache\msscp.dll
- 2004-08-04 07:56:44 530,432 -c–a-w c:\windows\system32\dllcache\mstime.dll
+ 2008-10-16 10:37:02 532,480 -c–a-w c:\windows\system32\dllcache\mstime.dll
- 2004-08-04 07:56:46 245,760 -c–a-w c:\windows\system32\dllcache\mswmdm.dll
+ 2006-10-19 05:47:16 321,536 -c–a-w c:\windows\system32\dllcache\mswmdm.dll
- 2004-08-04 07:56:46 1,236,480 -c–a-w c:\windows\system32\dllcache\msxml3.dll
+ 2008-09-04 16:42:02 1,106,944 -c–a-w c:\windows\system32\dllcache\msxml3.dll
- 2004-08-04 07:56:46 332,288 -c–a-w c:\windows\system32\dllcache\netapi32.dll
+ 2008-10-15 16:57:55 332,800 -c–a-w c:\windows\system32\dllcache\netapi32.dll
- 2004-08-04 07:56:46 39,424 -c–a-w c:\windows\system32\dllcache\pngfilt.dll
+ 2008-10-16 10:37:02 39,424 -c–a-w c:\windows\system32\dllcache\pngfilt.dll
- 2004-08-04 07:56:46 237,568 -c–a-w c:\windows\system32\dllcache\qasf.dll
+ 2006-10-19 05:47:18 211,456 -c–a-w c:\windows\system32\dllcache\qasf.dll
- 2004-08-04 07:56:46 1,287,680 -c–a-w c:\windows\system32\dllcache\quartz.dll
+ 2008-05-07 05:18:48 1,287,680 -c–a-w c:\windows\system32\dllcache\quartz.dll
- 2001-08-23 05:00:00 200,064 -c–a-w c:\windows\system32\dllcache\rmcast.sys
+ 2008-05-08 12:28:49 202,752 -c–a-w c:\windows\system32\dllcache\rmcast.sys
- 2004-08-04 07:56:58 774,144 -c–a-w c:\windows\system32\dllcache\setup_wm.exe
+ 2006-11-02 02:31:38 1,669,120 -c–a-w c:\windows\system32\dllcache\setup_wm.exe
- 2004-08-04 07:56:46 1,483,264 -c–a-w c:\windows\system32\dllcache\shdocvw.dll
+ 2008-10-16 10:37:03 1,494,528 -c–a-w c:\windows\system32\dllcache\shdocvw.dll
- 2004-08-04 07:56:46 473,600 -c–a-w c:\windows\system32\dllcache\shlwapi.dll
+ 2008-10-16 10:37:03 474,112 -c–a-w c:\windows\system32\dllcache\shlwapi.dll
- 2004-08-04 06:14:46 336,256 -c–a-w c:\windows\system32\dllcache\srv.sys
+ 2008-08-28 10:04:17 333,056 -c–a-w c:\windows\system32\dllcache\srv.sys
- 2004-08-04 07:56:46 246,302 -c–a-w c:\windows\system32\dllcache\strmdll.dll
+ 2008-10-03 10:15:47 247,326 -c–a-w c:\windows\system32\dllcache\strmdll.dll
- 2004-08-04 07:56:58 208,896 -c–a-w c:\windows\system32\dllcache\unregmp2.exe
+ 2006-11-02 02:31:34 315,904 -c–a-w c:\windows\system32\dllcache\unregmp2.exe
- 2004-08-04 07:56:48 601,088 -c–a-w c:\windows\system32\dllcache\urlmon.dll
+ 2008-10-16 10:37:04 615,936 -c–a-w c:\windows\system32\dllcache\urlmon.dll
- 2004-08-04 07:56:48 417,792 -c–a-w c:\windows\system32\dllcache\vbscript.dll
+ 2007-12-18 14:40:58 417,792 -c–a-w c:\windows\system32\dllcache\vbscript.dll
- 2004-08-04 06:17:42 1,835,904 -c–a-w c:\windows\system32\dllcache\win32k.sys
+ 2008-09-15 11:57:41 1,846,016 -c–a-w c:\windows\system32\dllcache\win32k.sys
- 2004-08-04 07:56:48 656,384 -c–a-w c:\windows\system32\dllcache\wininet.dll
+ 2008-10-16 10:37:03 659,456 -c–a-w c:\windows\system32\dllcache\wininet.dll
- 2004-08-04 07:56:48 408,064 -c–a-w c:\windows\system32\dllcache\wmadmod.dll
+ 2006-10-19 05:47:18 757,248 -c–a-w c:\windows\system32\dllcache\WMADMOD.dll
- 2004-08-04 07:56:48 670,720 -c–a-w c:\windows\system32\dllcache\wmadmoe.dll
+ 2006-10-19 05:47:18 1,117,696 -c–a-w c:\windows\system32\dllcache\WMADMOE.dll
- 2004-08-04 07:56:48 230,400 -c–a-w c:\windows\system32\dllcache\wmasf.dll
+ 2007-10-28 01:40:30 222,720 -c–a-w c:\windows\system32\dllcache\wmasf.dll
- 2004-08-04 07:56:48 27,136 -c–a-w c:\windows\system32\dllcache\wmdmlog.dll
+ 2006-10-19 05:47:18 33,792 -c–a-w c:\windows\system32\dllcache\wmdmlog.dll
- 2004-08-04 07:56:48 23,552 -c–a-w c:\windows\system32\dllcache\wmdmps.dll
+ 2006-10-19 05:47:18 37,376 -c–a-w c:\windows\system32\dllcache\wmdmps.dll
- 2004-08-04 07:56:36 168,448 -c–a-w c:\windows\system32\dllcache\wmerror.dll
+ 2006-10-19 05:47:20 227,328 -c–a-w c:\windows\system32\dllcache\wmerror.dll
- 2004-08-04 07:56:48 151,552 -c–a-w c:\windows\system32\dllcache\wmidx.dll
+ 2006-10-19 05:47:20 157,184 -c–a-w c:\windows\system32\dllcache\wmidx.dll
- 2004-08-04 07:56:48 1,050,624 -c–a-w c:\windows\system32\dllcache\wmnetmgr.dll
+ 2008-06-18 13:03:08 938,496 -c–a-w c:\windows\system32\dllcache\WMNetmgr.dll
- 2004-08-04 07:56:48 4,874,240 -c–a-w c:\windows\system32\dllcache\wmp.dll
+ 2007-06-12 07:51:12 10,834,944 -c–a-w c:\windows\system32\dllcache\wmp.dll
- 2004-08-04 07:56:48 114,688 -c–a-w c:\windows\system32\dllcache\wmpasf.dll
+ 2006-10-19 05:47:20 242,688 -c–a-w c:\windows\system32\dllcache\wmpasf.dll
- 2004-08-04 07:56:48 98,304 -c–a-w c:\windows\system32\dllcache\wmpband.dll
+ 2006-10-19 05:47:20 96,256 -c–a-w c:\windows\system32\dllcache\wmpband.dll
- 2004-08-04 07:56:48 233,472 -c–a-w c:\windows\system32\dllcache\wmpdxm.dll
+ 2006-10-19 05:47:20 314,880 -c–a-w c:\windows\system32\dllcache\wmpdxm.dll
- 2004-08-04 07:56:58 73,728 -c–a-w c:\windows\system32\dllcache\wmplayer.exe
+ 2006-10-19 05:46:20 64,000 -c–a-w c:\windows\system32\dllcache\wmplayer.exe
- 2004-08-04 07:56:38 2,940,928 -c–a-w c:\windows\system32\dllcache\wmploc.dll
+ 2006-10-19 05:47:20 8,231,936 -c–a-w c:\windows\system32\dllcache\wmploc.dll
- 2004-08-04 07:56:48 102,400 -c–a-w c:\windows\system32\dllcache\wmpshell.dll
+ 2006-10-19 05:47:20 99,840 -c–a-w c:\windows\system32\dllcache\wmpshell.dll
- 2004-08-04 07:56:48 759,296 -c–a-w c:\windows\system32\dllcache\wmsdmod.dll
+ 2006-10-19 05:47:22 4,096 -c–a-w c:\windows\system32\dllcache\wmsdmod.dll
- 2004-08-04 07:56:48 1,119,744 -c–a-w c:\windows\system32\dllcache\wmsdmoe2.dll
+ 2006-10-19 05:47:22 4,096 -c–a-w c:\windows\system32\dllcache\wmsdmoe2.dll
- 2004-08-04 07:56:48 484,864 -c–a-w c:\windows\system32\dllcache\wmspdmod.dll
+ 2006-10-19 05:47:22 603,648 -c–a-w c:\windows\system32\dllcache\WMSPDMOD.dll
- 2004-08-04 07:56:48 896,512 -c–a-w c:\windows\system32\dllcache\wmspdmoe.dll
+ 2006-10-19 05:47:22 1,329,152 -c–a-w c:\windows\system32\dllcache\WMSPDMOE.dll
- 2004-08-04 07:57:04 2,105,344 -c–a-w c:\windows\system32\dllcache\wmvcore.dll
+ 2008-06-18 13:03:14 2,458,112 -c–a-w c:\windows\system32\dllcache\WMVCore.dll
- 2004-08-04 07:56:48 809,984 -c–a-w c:\windows\system32\dllcache\wmvdmod.dll
+ 2006-10-19 05:47:22 4,096 -c–a-w c:\windows\system32\dllcache\wmvdmod.dll
- 2004-08-04 07:56:48 1,001,472 -c–a-w c:\windows\system32\dllcache\wmvdmoe2.dll
+ 2006-10-19 05:47:22 4,096 -c–a-w c:\windows\system32\dllcache\wmvdmoe2.dll
- 2005-05-26 11:16:30 465,176 -c–a-w c:\windows\system32\dllcache\wuapi.dll
+ 2008-10-16 22:12:20 561,688 -c–a-w c:\windows\system32\dllcache\wuapi.dll
- 2005-05-26 11:16:30 124,184 -c–a-w c:\windows\system32\dllcache\wuauclt.exe
+ 2008-10-16 22:09:44 51,224 -c–a-w c:\windows\system32\dllcache\wuauclt.exe
- 2005-05-26 11:16:30 1,343,768 -c–a-w c:\windows\system32\dllcache\wuaueng.dll
+ 2008-10-16 22:13:40 1,809,944 -c–a-w c:\windows\system32\dllcache\wuaueng.dll
- 2005-05-26 11:16:30 127,256 -c–a-w c:\windows\system32\dllcache\wucltui.dll
+ 2008-10-16 22:12:22 323,608 -c–a-w c:\windows\system32\dllcache\wucltui.dll
- 2005-05-26 11:16:30 41,240 -c–a-w c:\windows\system32\dllcache\wups.dll
+ 2008-10-16 22:08:58 34,328 -c–a-w c:\windows\system32\dllcache\wups.dll
- 2005-05-26 11:19:32 173,536 -c–a-w c:\windows\system32\dllcache\wuweb.dll
+ 2008-10-16 22:13:40 202,776 -c–a-w c:\windows\system32\dllcache\wuweb.dll
- 2004-08-04 06:14:16 138,496 —-a-w c:\windows\system32\drivers\afd.sys
+ 2008-08-14 09:51:43 138,368 —-a-w c:\windows\system32\drivers\afd.sys
- 2001-08-23 05:00:00 200,064 —-a-w c:\windows\system32\drivers\RMCast.sys
+ 2008-05-08 12:28:49 202,752 —-a-w c:\windows\system32\drivers\rmcast.sys
- 2004-08-04 06:14:46 336,256 —-a-w c:\windows\system32\drivers\srv.sys
+ 2008-08-28 10:04:17 333,056 —-a-w c:\windows\system32\drivers\srv.sys
+ 2006-10-19 05:47:22 671,232 ——w c:\windows\system32\drivers\UMDF\wpdmtpdr.dll
+ 2006-10-19 04:00:00 38,528 ——w c:\windows\system32\drivers\wpdusb.sys
+ 2006-09-29 02:55:50 77,568 ——w c:\windows\system32\drivers\WudfPf.sys
+ 2006-09-29 03:00:34 82,944 ——w c:\windows\system32\drivers\WudfRd.sys
+ 2006-10-19 04:00:46 249,856 ——w c:\windows\system32\drmupgds.exe
- 2004-08-04 07:57:04 695,296 —-a-w c:\windows\system32\drmv2clt.dll
+ 2006-10-19 05:47:10 991,744 —-a-w c:\windows\system32\drmv2clt.dll
- 2004-08-04 07:56:44 357,888 —-a-w c:\windows\system32\dxtmsft.dll
+ 2008-10-16 10:37:02 357,888 —-a-w c:\windows\system32\dxtmsft.dll
- 2004-08-04 07:56:44 201,728 —-a-w c:\windows\system32\dxtrans.dll
+ 2008-10-16 10:37:02 205,312 —-a-w c:\windows\system32\dxtrans.dll
- 2004-08-04 07:56:44 243,200 —-a-w c:\windows\system32\es.dll
+ 2008-07-07 20:32:22 253,952 —-a-w c:\windows\system32\es.dll
- 2004-08-04 07:56:44 55,808 —-a-w c:\windows\system32\extmgr.dll
+ 2008-10-16 10:37:02 55,808 —-a-w c:\windows\system32\extmgr.dll
- 2008-12-11 19:13:42 252,680 —-a-w c:\windows\system32\FNTCACHE.DAT
+ 2008-12-13 09:05:07 252,680 —-a-w c:\windows\system32\FNTCACHE.DAT
- 2004-08-04 07:56:44 249,344 —-a-w c:\windows\system32\iepeers.dll
+ 2008-10-16 10:37:02 251,392 —-a-w c:\windows\system32\iepeers.dll
- 2004-08-04 07:56:44 678,400 —-a-w c:\windows\system32\inetcomm.dll
+ 2008-04-11 18:50:43 683,520 —-a-w c:\windows\system32\inetcomm.dll
- 2004-08-04 07:56:44 96,256 —-a-w c:\windows\system32\inseng.dll
+ 2008-10-16 10:37:02 96,256 —-a-w c:\windows\system32\inseng.dll
- 2008-03-25 08:28:39 135,168 —-a-w c:\windows\system32\java.exe
+ 2008-12-13 09:15:19 144,792 —-a-w c:\windows\system32\java.exe
- 2008-03-25 08:28:43 135,168 —-a-w c:\windows\system32\javaw.exe
+ 2008-12-13 09:15:19 144,792 —-a-w c:\windows\system32\javaw.exe
- 2008-03-25 09:37:01 139,264 —-a-w c:\windows\system32\javaws.exe
+ 2008-12-13 09:15:20 148,888 —-a-w c:\windows\system32\javaws.exe
- 2004-08-04 07:56:44 450,560 —-a-w c:\windows\system32\jscript.dll
+ 2007-12-18 14:40:58 450,560 —-a-w c:\windows\system32\jscript.dll
- 2004-08-04 07:56:44 15,872 —-a-w c:\windows\system32\jsproxy.dll
+ 2008-10-16 10:37:03 16,384 —-a-w c:\windows\system32\jsproxy.dll
- 2004-08-04 07:56:44 6,656 —-a-w c:\windows\system32\laprxy.dll
+ 2006-10-19 05:47:14 11,264 —-a-w c:\windows\system32\LAPRXY.dll
- 2004-08-04 07:56:52 103,936 —-a-w c:\windows\system32\logagent.exe
+ 2008-06-18 09:09:22 100,864 —-a-w c:\windows\system32\logagent.exe
+ 2006-10-19 05:47:14 212,992 ——w c:\windows\system32\MFPLAT.dll
+ 2006-10-19 05:47:14 259,072 ——w c:\windows\system32\MP43DECD.dll
- 2004-08-04 07:56:44 310,272 —-a-w c:\windows\system32\mp43dmod.dll
+ 2006-10-19 05:47:14 4,096 —-a-w c:\windows\system32\MP43DMOD.dll
+ 2006-10-19 05:47:14 317,440 ——w c:\windows\system32\MP4SDECD.dll
- 2004-08-04 07:56:44 384,512 —-a-w c:\windows\system32\mp4sdmod.dll
+ 2006-10-19 05:47:14 4,096 —-a-w c:\windows\system32\MP4SDMOD.dll
+ 2006-10-19 05:47:14 259,072 ——w c:\windows\system32\MPG4DECD.dll
- 2004-08-04 07:56:44 240,640 —-a-w c:\windows\system32\mpg4dmod.dll
+ 2006-10-19 05:47:14 4,096 —-a-w c:\windows\system32\MPG4DMOD.dll
- 2004-08-04 07:56:44 73,728 —-a-w c:\windows\system32\mscms.dll
+ 2008-06-24 16:23:05 74,240 —-a-w c:\windows\system32\mscms.dll
+ 2006-10-02 23:28:42 312,128 ——w c:\windows\system32\msdelta.dll
- 2004-08-04 07:56:44 3,003,392 —-a-w c:\windows\system32\mshtml.dll
+ 2008-10-16 10:37:05 3,059,712 —-a-w c:\windows\system32\mshtml.dll
- 2004-08-04 07:56:44 448,512 —-a-w c:\windows\system32\mshtmled.dll
+ 2008-10-16 10:37:03 449,024 —-a-w c:\windows\system32\mshtmled.dll
- 2004-08-04 07:57:02 259,072 —-a-w c:\windows\system32\msnetobj.dll
+ 2006-10-19 05:47:16 179,712 —-a-w c:\windows\system32\msnetobj.dll
- 2004-08-04 07:56:44 52,224 —-a-w c:\windows\system32\mspmsnsv.dll
+ 2006-10-19 05:47:16 27,136 —-a-w c:\windows\system32\mspmsnsv.dll
- 2004-08-04 07:56:44 201,728 —-a-w c:\windows\system32\mspmsp.dll
+ 2006-10-19 05:47:16 175,616 —-a-w c:\windows\system32\mspmsp.dll
- 2004-08-04 07:56:44 146,432 —-a-w c:\windows\system32\msrating.dll
+ 2008-10-16 10:37:02 146,432 —-a-w c:\windows\system32\msrating.dll
- 2004-08-04 07:57:02 356,352 —-a-w c:\windows\system32\msscp.dll
+ 2006-12-05 00:21:50 414,720 —-a-w c:\windows\system32\msscp.dll
- 2004-08-04 07:56:44 530,432 —-a-w c:\windows\system32\mstime.dll
+ 2008-10-16 10:37:02 532,480 —-a-w c:\windows\system32\mstime.dll
- 2004-08-04 07:56:46 245,760 —-a-w c:\windows\system32\mswmdm.dll
+ 2006-10-19 05:47:16 321,536 —-a-w c:\windows\system32\mswmdm.dll
- 2004-08-04 07:56:46 1,236,480 —-a-w c:\windows\system32\msxml3.dll
+ 2008-09-04 16:42:02 1,106,944 —-a-w c:\windows\system32\msxml3.dll
- 2004-08-04 07:56:46 332,288 —-a-w c:\windows\system32\netapi32.dll
+ 2008-10-15 16:57:55 332,800 —-a-w c:\windows\system32\netapi32.dll
- 2004-08-04 08:05:44 2,056,832 —-a-w c:\windows\system32\ntkrnlpa.exe
+ 2008-08-14 09:22:13 2,057,728 —-a-w c:\windows\system32\ntkrnlpa.exe
- 2004-08-04 06:20:00 2,180,992 —-a-w c:\windows\system32\ntoskrnl.exe
+ 2008-08-14 10:00:45 2,180,352 —-a-w c:\windows\system32\ntoskrnl.exe
- 2004-08-04 07:56:46 39,424 —-a-w c:\windows\system32\pngfilt.dll
+ 2008-10-16 10:37:02 39,424 —-a-w c:\windows\system32\pngfilt.dll
+ 2006-10-19 05:47:18 284,160 ——w c:\windows\system32\PortableDeviceApi.dll
+ 2006-10-19 05:47:18 101,888 ——w c:\windows\system32\PortableDeviceClassExtension.dll
+ 2006-10-19 05:47:18 166,912 ——w c:\windows\system32\PortableDeviceTypes.dll
+ 2006-10-19 05:47:18 132,096 ——w c:\windows\system32\PortableDeviceWiaCompat.dll
+ 2006-10-19 05:47:18 199,168 ——w c:\windows\system32\PortableDeviceWMDRM.dll
- 2004-08-04 07:56:46 237,568 —-a-w c:\windows\system32\qasf.dll
+ 2006-10-19 05:47:18 211,456 —-a-w c:\windows\system32\qasf.dll
- 2004-08-04 07:56:46 1,287,680 —-a-w c:\windows\system32\quartz.dll
+ 2008-05-07 05:18:48 1,287,680 —-a-w c:\windows\system32\quartz.dll
- 2004-08-04 07:56:46 1,483,264 —-a-w c:\windows\system32\shdocvw.dll
+ 2008-10-16 10:37:03 1,494,528 —-a-w c:\windows\system32\shdocvw.dll
- 2004-08-04 07:56:46 473,600 —-a-w c:\windows\system32\shlwapi.dll
+ 2008-10-16 10:37:03 474,112 —-a-w c:\windows\system32\shlwapi.dll
+ 2008-10-16 22:08:58 34,328 —-a-w c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.788\wups.dll
+ 2008-10-16 22:09:44 43,544 —-a-w c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.788\wups2.dll
- 2005-02-25 03:35:05 14,048 ——w c:\windows\system32\spmsg.dll
+ 2007-07-27 18:41:40 16,760 ——w c:\windows\system32\spmsg.dll
- 2005-02-25 03:35:05 22,752 —-a-w c:\windows\system32\spupdsvc.exe
+ 2006-09-26 01:58:48 23,856 —-a-w c:\windows\system32\spupdsvc.exe
+ 2008-10-22 09:47:07 62,976 ——w c:\windows\system32\tzchange.exe
- 2004-08-04 07:56:48 601,088 —-a-w c:\windows\system32\urlmon.dll
+ 2008-10-16 10:37:04 615,936 —-a-w c:\windows\system32\urlmon.dll
+ 2006-10-19 05:58:00 8,704 ——w c:\windows\system32\uwdf.exe
- 2004-08-04 07:56:48 417,792 —-a-w c:\windows\system32\vbscript.dll
+ 2007-12-18 14:40:58 417,792 —-a-w c:\windows\system32\vbscript.dll
+ 2006-10-19 05:47:18 4,096 ——w c:\windows\system32\wdfapi.dll
+ 2006-10-19 05:58:00 8,704 ——w c:\windows\system32\wdfmgr.exe
- 2004-08-04 07:56:48 408,064 —-a-w c:\windows\system32\wmadmod.dll
+ 2006-10-19 05:47:18 757,248 —-a-w c:\windows\system32\wmadmod.dll
- 2004-08-04 07:56:48 670,720 —-a-w c:\windows\system32\wmadmoe.dll
+ 2006-10-19 05:47:18 1,117,696 —-a-w c:\windows\system32\WMADMOE.dll
- 2004-08-04 07:56:48 230,400 —-a-w c:\windows\system32\wmasf.dll
+ 2007-10-28 01:40:30 222,720 —-a-w c:\windows\system32\wmasf.dll
- 2004-08-04 07:56:48 27,136 —-a-w c:\windows\system32\wmdmlog.dll
+ 2006-10-19 05:47:18 33,792 —-a-w c:\windows\system32\wmdmlog.dll
- 2004-08-04 07:56:48 23,552 —-a-w c:\windows\system32\wmdmps.dll
+ 2006-10-19 05:47:18 37,376 —-a-w c:\windows\system32\wmdmps.dll
+ 2006-10-19 05:47:18 429,056 ——w c:\windows\system32\wmdrmdev.dll
+ 2006-10-19 05:47:20 348,672 ——w c:\windows\system32\wmdrmnet.dll
+ 2006-10-19 05:47:20 535,040 ——w c:\windows\system32\wmdrmsdk.dll
- 2004-08-04 07:56:36 168,448 —-a-w c:\windows\system32\wmerror.dll
+ 2006-10-19 05:47:20 227,328 —-a-w c:\windows\system32\wmerror.dll
- 2004-08-04 07:56:48 151,552 —-a-w c:\windows\system32\wmidx.dll
+ 2006-10-19 05:47:20 157,184 —-a-w c:\windows\system32\wmidx.dll
- 2004-08-04 07:56:48 1,050,624 —-a-w c:\windows\system32\wmnetmgr.dll
+ 2008-06-18 13:03:08 938,496 —-a-w c:\windows\system32\WMNetmgr.dll
- 2004-08-04 07:56:48 4,874,240 —-a-w c:\windows\system32\wmp.dll
+ 2007-06-12 07:51:12 10,834,944 —-a-w c:\windows\system32\wmp.dll
- 2004-08-04 07:56:48 114,688 —-a-w c:\windows\system32\wmpasf.dll
+ 2006-10-19 05:47:20 242,688 —-a-w c:\windows\system32\wmpasf.dll
- 2004-08-04 07:56:48 233,472 —-a-w c:\windows\system32\wmpdxm.dll
+ 2006-10-19 05:47:20 314,880 —-a-w c:\windows\system32\wmpdxm.dll
+ 2008-06-25 02:12:58 295,936 ——w c:\windows\system32\wmpeffects.dll
+ 2006-10-19 05:47:20 1,661,440 ——w c:\windows\system32\wmpencen.dll
- 2004-08-04 07:56:38 2,940,928 —-a-w c:\windows\system32\wmploc.dll
+ 2006-10-19 05:47:20 8,231,936 —-a-w c:\windows\system32\wmploc.dll
+ 2006-10-19 05:47:20 613,376 ——w c:\windows\system32\wmpmde.dll
+ 2006-10-19 05:47:20 130,048 ——w c:\windows\system32\wmpps.dll
- 2004-08-04 07:56:48 102,400 —-a-w c:\windows\system32\wmpshell.dll
+ 2006-10-19 05:47:20 99,840 —-a-w c:\windows\system32\wmpshell.dll
+ 2006-10-19 05:47:20 204,288 ——w c:\windows\system32\wmpsrcwp.dll
- 2004-08-04 07:56:48 759,296 —-a-w c:\windows\system32\wmsdmod.dll
+ 2006-10-19 05:47:22 4,096 —-a-w c:\windows\system32\wmsdmod.dll
- 2004-08-04 07:56:48 1,119,744 —-a-w c:\windows\system32\wmsdmoe2.dll
+ 2006-10-19 05:47:22 4,096 —-a-w c:\windows\system32\wmsdmoe2.dll
- 2004-08-04 07:56:48 484,864 —-a-w c:\windows\system32\wmspdmod.dll
+ 2006-10-19 05:47:22 603,648 —-a-w c:\windows\system32\WMSPDMOD.dll
- 2004-08-04 07:56:48 896,512 —-a-w c:\windows\system32\wmspdmoe.dll
+ 2006-10-19 05:47:22 1,329,152 —-a-w c:\windows\system32\WMSPDMOE.dll
+ 2006-10-19 05:47:22 4,096 ——w c:\windows\system32\WMVADVD.dll
+ 2006-10-19 05:47:22 4,096 ——w c:\windows\system32\WMVADVE.DLL
- 2004-08-04 07:57:04 2,105,344 —-a-w c:\windows\system32\wmvcore.dll
+ 2008-06-18 13:03:14 2,458,112 —-a-w c:\windows\system32\WMVCore.dll
+ 2006-10-19 05:47:22 1,543,680 ——w c:\windows\system32\WMVDECOD.dll
- 2004-08-04 07:56:48 809,984 —-a-w c:\windows\system32\wmvdmod.dll
+ 2006-10-19 05:47:22 4,096 —-a-w c:\windows\system32\wmvdmod.dll
- 2004-08-04 07:56:48 1,001,472 —-a-w c:\windows\system32\wmvdmoe2.dll
+ 2006-10-19 05:47:22 4,096 —-a-w c:\windows\system32\wmvdmoe2.dll
+ 2006-10-19 05:47:22 1,574,912 ——w c:\windows\system32\WMVENCOD.dll
+ 2006-10-19 05:47:22 1,382,912 ——w c:\windows\system32\WMVSDECD.dll
+ 2006-10-19 05:47:22 767,488 ——w c:\windows\system32\WMVSENCD.dll
+ 2006-10-19 05:47:22 656,896 ——w c:\windows\system32\WMVXENCD.dll
+ 2006-10-19 05:47:22 629,760 ——w c:\windows\system32\wpd_ci.dll
+ 2006-10-19 05:47:22 35,840 ——w c:\windows\system32\wpdconns.dll
+ 2006-10-19 05:47:22 154,624 ——w c:\windows\system32\wpdmtp.dll
+ 2006-10-19 05:47:22 63,488 ——w c:\windows\system32\wpdmtpus.dll
+ 2006-10-19 05:47:22 2,603,008 ——w c:\windows\system32\WpdShext.dll
+ 2006-10-19 04:00:14 17,408 ——w c:\windows\system32\wpdshextautoplay.exe
+ 2006-10-19 05:47:22 38,400 ——w c:\windows\system32\wpdshextres.dll
+ 2006-10-19 05:47:22 133,632 ——w c:\windows\system32\WPDShServiceObj.dll
+ 2006-10-19 05:47:22 356,352 ——w c:\windows\system32\wpdsp.dll
+ 2006-09-29 04:13:26 95,344 ——w c:\windows\system32\WUDFCoinstaller.dll
+ 2006-09-29 02:56:38 146,432 ——w c:\windows\system32\WudfHost.exe
+ 2006-09-29 02:56:16 165,376 ——w c:\windows\system32\WudfPlatform.dll
+ 2006-09-29 02:56:14 55,808 ——w c:\windows\system32\WudfSvc.dll
+ 2006-09-29 02:56:38 316,416 ——w c:\windows\system32\WUDFx.dll
+ 2008-10-15 14:00:41 351,744 ——w c:\windows\system32\xpsp3res.dll
+ 2008-12-14 00:24:10 16,384 —-atw c:\windows\temp\Perflib_Perfdata_264.dat
+ 2008-04-15 17:54:19 1,724,416 —-a-w c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll
.
– 快照技術重新設置 –
.
((((((((((((((((((((((((((((((((((((( 重要登入點 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白與合法缺省登錄將不會被顯示
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-13 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-24 266497]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-13 136600]
"VTTimer"="VTTimer.exe" [2005-03-07 c:\windows\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2005-03-11 c:\windows\system32\VTTrayp.exe]

c:\documents and settings\a\Start Menu\Programs\Startup\
Check for TWS Updates.lnk - c:\jts\WiseUpdt.exe [2007-06-01 194775]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
GetRight.lnk - c:\program files\GetRight\GetRight.exe [2008-12-10 4628752]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
cstmsvc REG_MULTI_SZ cstmsvc
bcvnsvc REG_MULTI_SZ bcvnsvc
MSPlugPlay REG_MULTI_SZ MSPlugPlay
.
.
——- 而外的掃描 ——-
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Download with GetRight - c:\program files\GetRight\GRdownload.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Open with GetRight Browser - c:\program files\GetRight\GRbrowse.htm
Handler: intu-qt2007 - {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} - c:\program files\QuickTax 2007\ic2007pp.dll

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

- c:\windows\Downloaded Program Files\smsx.inf

c:\windows\Downloaded Program Files\TNSSPPC.dll - c:\windows\Downloaded Program Files\DataStore.dll
c:\windows\Downloaded Program Files\IEZoneHlp.dll
c:\windows\Downloaded Program Files\IEZoneSet.exe
c:\windows\Downloaded Program Files\EWinSKey.dll
c:\windows\Downloaded Program Files\EWinECertRegAX.dll
O16 -: {3AC7F64E-6154-47B0-82B5-764ED4077F77}
hxxp://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
c:\windows\Downloaded Program Files\eWinCtl.inf

c:\windows\Downloaded Program Files\DataStore.dll - c:\windows\Downloaded Program Files\EWinSKey.dll
c:\windows\Downloaded Program Files\TNSSPPC.dll
c:\windows\Downloaded Program Files\IEZoneSet.exe
c:\windows\Downloaded Program Files\IEZoneHlp.dll
O16 -: {8A4943CC-1950-44F9-9045-D3D428FD3948}
hxxp://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
c:\windows\Downloaded Program Files\eWinCtl.inf

c:\windows\Downloaded Program Files\IEZoneHlp.dll - c:\windows\Downloaded Program Files\EWinECertRegAX.dll
c:\windows\Downloaded Program Files\CONFLICT.1\EWinSecurityAX.dll
c:\windows\Downloaded Program Files\EWinSKey.dll
c:\windows\Downloaded Program Files\CONFLICT.1\IEZoneSet.exe
O16 -: {8DE6AB9C-8C62-486B-8C06-5C9AD6FD06F1}
hxxp://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
c:\windows\Downloaded Program Files\CONFLICT.1\eWinCtl.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-13 16:29:52
Windows 5.1.2600 Service Pack 2 NTFS

掃描被隱藏的進程。。。 …

掃描被隱藏的啟動組。。。

掃描被隱藏的文件。。。

掃描完成
被隱藏的檔案: 0

**************************************************************************
.
完成時間: 2008-12-13 16:30:54
ComboFix-quarantined-files.txt 2008-12-14 00:30:38
ComboFix2.txt 2008-12-12 07:50:05
ComboFix3.txt 2008-12-12 05:50:11

Pre-Run: 73,215,107,072 bytes free
Post-Run: 73,262,718,976 bytes free

532 — E O F — 2008-12-13 10:54:26


and here is the HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:32:05 PM, on 12/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\explorer.exe
E:\HijackThis.exe

O2 - BHO: IE to GetRight Helper - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: Check for TWS Updates.lnk = C:\Jts\WiseUpdt.exe
O4 - Global Startup: GetRight.lnk = C:\Program Files\GetRight\GetRight.exe
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: Norton Confidence Online - {144FDEB7-A23D-4D39-A00E-AA44195535B6} - C:\WINDOWS\wcidButton.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - https://www.epost.ca/printing/smsx.cab
O16 - DPF: {3AC7F64E-6154-47B0-82B5-764ED4077F77} (DataStorage Class) - http://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {8A4943CC-1950-44F9-9045-D3D428FD3948} (SecureX Class) - http://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
O16 - DPF: {8DE6AB9C-8C62-486B-8C06-5C9AD6FD06F1} (DataStore Class) - http://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
O16 - DPF: {CCC46940-DED0-476C-A27E-115B10DAE0B4} - http://td.nortonconfidenceonline.com/plug-in/WSAS.cab
O18 - Protocol: intu-qt2007 - {026BF40D-BA05-467B-9F1F-AD0D7A3F5F11} - C:\Program Files\QuickTax 2007\ic2007pp.dll
O23 - Service: Avira AntiVir Personal !V Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal !V Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

–
End of file - 5038 bytes
Post #20
cece,

Log looks good :D


Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK
  • Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]
The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.

Please re-enable any security that was disabled.

Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls

Keep Microsoft Windows Updated - This will ensure your computer has always the latest security updates available installed on your computer. The easiest way to do this is to turn on Automatic Updates. Do this by:
  • From your desktop, right-click on My Computer,
  • click on Properties
  • Select the Automatic Updates tab
  • Click on Automatic
  • Click on Apply button
  • Click on OK to exit.
If there are new updates to install, install them immediately, until there are no more critical updates.

Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware

Download and install the free version of WinPatrol - This program protects your computer in a variety of ways and will work well with your existing security software.
Winpatrol


Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.


Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:
Post #23
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI