# Help! super infected computer



## monkeybubbles (Apr 26, 2007)

I recently reformated my computer. However, in doing so I ended up with a bunch of viruses on my computer. I have AVG installed and it gets rid of the viruses it says but then they just re-appear. I don't know what else I can do. Please help me.

Thanks

Also, here's a copy of my hijack this log.

Logfile of HijackThis v1.99.1
Scan saved at 1:47:22 PM, on 26/04/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\DHCP.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\dllisp.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\tmrsrv32.exe
C:\WINDOWS\System32\idleserv.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\System32\wbnjn.exe
C:\WINDOWS\System32\servics3.exe
C:\WINDOWS\System32\tcpipmon.exe
C:\WINDOWS\System32\logon.exe
C:\WINDOWS\System32\iexplore.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32\spoolsvc.exe
C:\windows\system32\uvnx.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\tcpipmon.exe
C:\WINDOWS\System32\ccjlc.exe
C:\WINDOWS\System32\ipateum.exe
c:\q7i1j3n9q3s2.exe
C:\WINDOWS\System32\svchost.exe
c:\windows\system32\uvnx.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\4.tmp
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wpabaln.exe
C:\PROGRA~1\Grisoft\AVG7\avgwa.dat
C:\WINDOWS\System32\cmd.exe
C:\WINDOWS\System32\cmd.exe
C:\WINDOWS\System32\cmd.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.ca
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\ipateum.exe
O4 - HKLM\..\Run: [SvcManager] servics3.exe
O4 - HKLM\..\Run: [tcpipmon] tcpipmon.exe
O4 - HKLM\..\Run: [Windows Logon Application] C:\WINDOWS\System32\logon.exe
O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\System32\iexplore.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spoolsvc.exe
O4 - HKLM\..\Run: [uvnx] c:\windows\system32\uvnx.exe
O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\System32\tamvqxtw.dll",realset
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Documents and Settings\Owner\Desktop\HijackThis.exe /startupscan
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: CDRecorder036 - {A3BC5E20-0235-1ABF-9CE1-00AA00512036} - C:\WINDOWS\System32\tsjpf32.dll
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: DHCP Clients - Unknown owner - C:\WINDOWS\DHCP.EXE
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Unknown owner - C:\Program Files\Norton AntiVirus\isPwdSvc.exe (file missing)
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Windows DLLISP Service - Unknown owner - C:\WINDOWS\dllisp.exe


----------



## sjpritch25 (Sep 8, 2005)

Welcome to TSG

You are infected with a couple of infection. Lets get started with the fix.

Download *SDFix* and save it to your Desktop.

Double click *SDFix.exe* and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in *Safe Mode* by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press *Enter*.
Choose your usual account.

 Open the extracted SDFix folder and double click *RunThis.bat* to start the script.
 Type *Y* to begin the cleanup process.
 It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
 Press any Key and it will restart the PC.
 When the PC restarts the Fixtool will run again and complete the removal process then display *Finished*, press any key to end the script and load your desktop icons.
 Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as *Report.txt*
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
 Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

==================================

Download Combofix and save it to your desktop.
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Note: It is important that it is saved directly to your desktop

Close any open browsers.

Double click on combofix.exe & follow the prompts.
When finished, it shall produce a log for you.

Post the ComboFix.txt in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall


----------



## monkeybubbles (Apr 26, 2007)

My computer now will not let me do anything. As soon as it boots up a blue screen appears saying that the comptuer needs to be rebooted and that if i've seen this before that I need to start my computer in safemode and remove any new hardware or drivers and that it is dumping my files to a disk.


----------



## monkeybubbles (Apr 26, 2007)

I ran SDFix but it won't finish it runs and then i have to restart my computer in safemode and the application doesn't finish removing the problems.


----------



## monkeybubbles (Apr 26, 2007)

SDFix: Version 1.79

Run by Owner - 27/04/2007 - 11:55:40.95

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:
Windows DLLISP Service
wlmsngr
Windows DLLISP Service
wlmsngr

ImagePath:

C:\WINDOWS\system32\Microsoft\backup.ftp Found...
C:\WINDOWS\system32\Microsoft\backup.tftp Found...

Checking files:

Genuine:

Dummy:
C:\WINDOWS\system32\Microsoft\backup.ftp
C:\WINDOWS\system32\Microsoft\backup.tftp
C:\WINDOWS\system32\ftp.exe
C:\WINDOWS\system32\tftp.exe
C:\WINDOWS\system32\dllcache\ftp.exe
C:\WINDOWS\system32\dllcache\tftp.exe

Files copied to SDFix\Backups

Restoring files if backups are found

Final Check:

Genuine:

Dummy:
C:\WINDOWS\system32\Microsoft\backup.ftp
C:\WINDOWS\system32\Microsoft\backup.tftp
C:\WINDOWS\system32\ftp.exe
C:\WINDOWS\system32\tftp.exe
C:\WINDOWS\system32\dllcache\ftp.exe
C:\WINDOWS\system32\dllcache\tftp.exe

Killing PID 128 'smss.exe'
Killing PID 200 'winlogon.exe'

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

Below files will be copied to Backups folder then removed:

C:\GXMJVVBV.EXE - Deleted
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM~1\LOCALS~1\TEMPOR~1\CONTENT.IE5\APML4VA7\CA24AFY2.HTM - Deleted
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM~1\LOCALS~1\TEMPOR~1\CONTENT.IE5\APML4VA7\PPUYGL~1.HTM - Deleted
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM~1\LOCALS~1\TEMPOR~1\CONTENT.IE5\APML4VA7\XJCLF_~1.HTM - Deleted
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM~1\LOCALS~1\TEMPOR~1\CONTENT.IE5\M1WZIJ85\XJCLF_~1.HTM - Deleted
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM~1\LOCALS~1\TEMPOR~1\CONTENT.IE5\WT0FYX4B\XJCLF_~1.HTM - Deleted
C:\-20092~1 - Deleted
C:\WINDOWS\SYSTEM32\SETUP_~1.EXE - Deleted
C:\WINDOWS\SYSTEM32\SETUP_~3.EXE - Deleted
C:\WINDOWS\SYSTEM32\YJQCSQXM.EXE - Deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\winlogon.exe - Deleted
C:\WINDOWS\dllisp.exe - Deleted
C:\WINDOWS\loader.exe - Deleted
C:\WINDOWS\system32\explorer.exe - Deleted
C:\WINDOWS\system32\i - Deleted
C:\WINDOWS\system32\max1d1641.exe - Deleted
C:\WINDOWS\system32\Microsoft\backup.ftp - Deleted
C:\WINDOWS\system32\Microsoft\backup.tftp - Deleted
C:\WINDOWS\system32\rpcc.dll - Deleted
C:\WINDOWS\system32\setup_55471.exe - Deleted
C:\WINDOWS\system32\setup_62512.exe - Deleted
C:\WINDOWS\system32\spoolsvc.exe - Deleted
C:\WINDOWS\system32\tcpipmon.exe - Deleted
C:\WINDOWS\system32\uvnx.exe - Deleted
C:\WINDOWS\system32\winIogon.exe - Deleted
C:\WINDOWS\Temp\removalfile.bat - Deleted
C:\WINDOWS\system32\Microsoft\backup.ftp - Deleted
C:\WINDOWS\system32\Microsoft\backup.tftp - Deleted
C:\WINDOWS\system32\Microsoft\backup.ftp - Deleted
C:\WINDOWS\system32\Microsoft\backup.tftp - Deleted

Removing Temp Files

ADS Check:

Checking if ADS is attached to system32 Folder 
C:\WINDOWS\system32
No streams found.

Checking if ADS is attached to svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.

Final Check:

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"

Remaining Files:
---------------

Backups Folder: - C:\SDFix\backups\backups.zip

Checking For Files with Hidden Attributes:

C:\WINDOWS\DHCP.EXE
C:\WINDOWS\system32\oayx.exe
C:\WINDOWS\system32\rttae.exe
C:\WINDOWS\system32\sqmk.exe
C:\WINDOWS\system32\tftemgiz.exe
C:\WINDOWS\system32\zmle.exe
C:\WINDOWS\LastGood.Tmp\INF\oem0.inf
C:\WINDOWS\LastGood.Tmp\INF\oem0.PNF
C:\WINDOWS\system32\jmllm.tmp
C:\WINDOWS\system32\config\default.tmp.LOG
C:\WINDOWS\system32\config\software.tmp.LOG
C:\WINDOWS\system32\config\system.tmp.LOG

Finished


----------



## monkeybubbles (Apr 26, 2007)

SDFix: Version 1.79

Run by Owner - 27/04/2007 - 12:44:25.85

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Killing PID 128 'smss.exe'
Killing PID 208 'winlogon.exe'

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

Below files will be copied to Backups folder then removed:

C:\GXMJVVBV.EXE - Deleted
C:\-20092~1 - Deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\winlogon.exe - Deleted
C:\WINDOWS\system32\iexplore.exe - Deleted
C:\WINDOWS\system32\max1d1641.exe - Deleted
C:\WINDOWS\system32\rpcc.dll - Deleted
C:\WINDOWS\system32\tcpipmon.exe - Deleted
C:\WINDOWS\system32\winIogon.exe - Deleted
C:\WINDOWS\Temp\removalfile.bat - Deleted

Removing Temp Files

ADS Check:

Checking if ADS is attached to system32 Folder 
C:\WINDOWS\system32
No streams found.

Checking if ADS is attached to svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.

Final Check:

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"explorer.exe"="explorer.exe::*:Enabled:Explorer"

Remaining Files:
---------------

Checking For Files with Hidden Attributes:

C:\WINDOWS\DHCP.EXE
C:\WINDOWS\system32\oayx.exe
C:\WINDOWS\system32\rttae.exe
C:\WINDOWS\system32\sqmk.exe
C:\WINDOWS\system32\tftemgiz.exe
C:\WINDOWS\system32\zmle.exe
C:\WINDOWS\LastGood.Tmp\INF\oem0.inf
C:\WINDOWS\LastGood.Tmp\INF\oem0.PNF
C:\WINDOWS\system32\jmllm.tmp
C:\WINDOWS\system32\config\default.tmp.LOG
C:\WINDOWS\system32\config\software.tmp.LOG
C:\WINDOWS\system32\config\system.tmp.LOG

Finished


----------



## monkeybubbles (Apr 26, 2007)

Logfile of HijackThis v1.99.1
Scan saved at 12:50:54 PM, on 27/04/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\DHCP.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\wpabaln.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.ca
O2 - BHO: (no name) - {00000026-8735-428D-B81F-DD098223B25F} - (no file)
O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file)
O2 - BHO: (no name) - {000006b1-19b5-414a-849f-2a3c64ae6939} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file)
O2 - BHO: (no name) - {2265EED7-6022-4d6c-ADF2-E932FEFD433C} - (no file)
O2 - BHO: (no name) - {30000273-8230-4dd4-be4f-6889d1e74167} - (no file)
O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file)
O2 - BHO: (no name) - {4e7bd74f-2b8d-469e-92c6-ce7eb590a94d} - (no file)
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
O2 - BHO: (no name) - {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file)
O2 - BHO: (no name) - {9DED2B32-743B-47EB-874C-28AECF2A268D} - (no file)
O2 - BHO: IE Assistant - {B08D32DE-64B2-4137-8345-87293E70D40B} - C:\WINDOWS\System32\iea.dll
O2 - BHO: (no name) - {B4409DDA-13BD-4AC7-96F5-54F14E0ED61c} - C:\WINDOWS\System32\augueook.dll (file missing)
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: (no name) - {D46E6398-D6EE-489C-81F3-5A9C7ADBC3C2} - C:\WINDOWS\System32\ddcawuv.dll (file missing)
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\System32\pdwcdasg.dll (file missing)
O2 - BHO: msnhlp32.msn_hlp - {EEFBE5D6-FEFF-4CB4-AA26-6A464090CB89} - C:\WINDOWS\System32\msnhlp32.dll
O2 - BHO: (no name) - {F621B5FB-6E1E-4D0E-B88C-34B4775537B5} - C:\WINDOWS\System32\augueook.dll (file missing)
O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Documents and Settings\Owner\Desktop\HijackThis.exe /startupscan
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: DHCP Clients - Unknown owner - C:\WINDOWS\DHCP.EXE
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Unknown owner - C:\Program Files\Norton AntiVirus\isPwdSvc.exe (file missing)
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


----------



## sjpritch25 (Sep 8, 2005)

Go ahead and run Combofix Thanks.


----------



## monkeybubbles (Apr 26, 2007)

C:\WINDOWS\system32\augueook.dll
C:\WINDOWS\system32\eudtqjxi.dll
C:\WINDOWS\system32\iglgpgxv.dll
C:\WINDOWS\system32\owjrojwa.dll
C:\WINDOWS\system32\wghyomwq.dll
C:\WINDOWS\system32\yrvurpsh.dll
C:\WINDOWS\system32\pdwcdasg.dll
C:\WINDOWS\system32\nnnnmmm.dll
C:\WINDOWS\system32\ejprpqwt.dll
C:\WINDOWS\system32\evnaydmf.dll
C:\WINDOWS\system32\jfaeewks.dll
C:\WINDOWS\system32\mcjsdwmt.dll
C:\WINDOWS\system32\motsvonw.dll
C:\WINDOWS\system32\ouxuqikv.dll
C:\WINDOWS\system32\ukuiucgq.dll
C:\WINDOWS\system32\ddcawuv.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * 
Other Deletions 


C:\WINDOWS\system32\mst.sys
C:\WINDOWS\200.exe
C:\WINDOWS\764.exe
C:\WINDOWS\system32\fklzcugw.exe


Files Created from 2007-03-27 to 2007-04-27 


2007-04-27 11:03	8,222	--a------	C:\WINDOWS\system32\mljgffc.dll
2007-04-27 11:03	26,524	--a------	C:\WINDOWS\system32\kfmylalv.exe
2007-04-27 11:03	22,712	--a------	C:\WINDOWS\system32\vgpwol.exe
2007-04-27 11:03	11,148	--a------	C:\WINDOWS\system32\huht.exe
2007-04-27 11:03	11,148	---------	C:\WINDOWS\system32\fhcy.exe
2007-04-27 11:01	8,222	--a------	C:\WINDOWS\system32\pmkjjjg.dll
2007-04-27 11:01	8,222	--a------	C:\WINDOWS\system32\gebcdda.dll
2007-04-27 11:01	44	--a------	C:\WINDOWS\sys.bat
2007-04-27 11:01	26,524	--a------	C:\WINDOWS\system32\ghgakw.exe
2007-04-27 11:01	22,712	--a------	C:\WINDOWS\system32\bkxzq.exe
2007-04-27 11:01	17,920	--a------	C:\WINDOWS\system32\ntio256.sys
2007-04-27 11:01	16,721	--a------	C:\WINDOWS\system32\mn.dll
2007-04-27 11:01	15,360	--a------	C:\WINDOWS\system32\protector.exe
2007-04-27 11:01	12,800	--a------	C:\WINDOWS\system32\user_32.dll
2007-04-26 18:19	58,460	--a------	C:\WINDOWS\system32\xjchgu.exe
2007-04-26 18:09	34,549	--a------	C:\WINDOWS\system32\nmbfx32.dll
2007-04-26 18:06	956,193	---hs----	C:\WINDOWS\system32\nqstv.bak1
2007-04-26 18:06	280,628	--a------	C:\WINDOWS\system32\vtsqn.dll
2007-04-26 18:05	8,222	--a------	C:\WINDOWS\system32\mljjhif.dll
2007-04-26 18:05	26,524	--a------	C:\WINDOWS\system32\kiyga.exe
2007-04-26 18:05	22,712	--a------	C:\WINDOWS\system32\cgxtoi.exe
2007-04-26 17:29	34,549	--a------	C:\WINDOWS\system32\sbsqbr32.dll
2007-04-26 17:23	8,222	--a------	C:\WINDOWS\system32\awvvvwt.dll
2007-04-26 17:23	26,524	--a------	C:\WINDOWS\system32\ntrq.exe
2007-04-26 16:03	34,549	--a------	C:\WINDOWS\system32\jrfc32.dll
2007-04-26 16:02	8,222	--a------	C:\WINDOWS\system32\awtsrol.dll
2007-04-26 16:02	26,524	--a------	C:\WINDOWS\system32\wtli.exe
2007-04-26 16:02	22,712	--a------	C:\WINDOWS\system32\qwbre.exe
2007-04-26 15:51	147,968	--a------	C:\WINDOWS\system32\kuq.exe
2007-04-26 15:50	60,320	--ah-----	C:\WINDOWS\system32\sqmk.exe
2007-04-26 15:50	117	--a------	C:\WINDOWS\system32\xwngvgz.bat
2007-04-26 15:49	58,880	--ah-----	C:\WINDOWS\system32\tftemgiz.exe
2007-04-26 15:49	130	--a------	C:\WINDOWS\system32\eofrwchw.bat
2007-04-26 15:47	101,376	--ah-----	C:\WINDOWS\system32\zmle.exe
2007-04-26 15:38	22,712	--a------	C:\WINDOWS\system32\ythcsrn.exe
2007-04-26 15:16	34,549	--a------	C:\WINDOWS\system32\zcnq32.dll
2007-04-26 15:15	8,222	--a------	C:\WINDOWS\system32\gebyxwu.dll
2007-04-26 15:15	24,476	--a------	C:\WINDOWS\system32\qutqykhu.exe
2007-04-26 14:59	8,222	--a------	C:\WINDOWS\system32\sstqpnn.dll
2007-04-26 14:59	6,656	--a------	C:\WINDOWS\system32\koreiwcd.exe
2007-04-26 14:59	24,476	--a------	C:\WINDOWS\system32\yjwbon.exe
2007-04-26 13:58	8,222	--a------	C:\WINDOWS\system32\pmnllmj.dll
2007-04-26 13:58	11,148	---------	C:\WINDOWS\system32\pvoawe.exe
2007-04-26 13:56	524,288	--ah-----	C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-04-26 13:52	107,520	--a------	C:\WINDOWS\system32\iea.dll


----------



## monkeybubbles (Apr 26, 2007)

2007-04-26 13:50	8,222	--a------	C:\WINDOWS\system32\ddcyvtr.dll
2007-04-26 13:01	18,432	--a------	C:\WINDOWS\sysrlb32.exe
2007-04-26 12:44	4	--a------	C:\WINDOWS\system32\stfv.bin
2007-04-26 12:43	12	--a------	C:\WINDOWS\system32\sl.bin
2007-04-26 12:42	8,222	--a------	C:\WINDOWS\system32\awvttsp.dll
2007-04-26 12:40	9,984	--a------	C:\WINDOWS\system32\updatetc.exe
2007-04-26 12:40	9,216	--a------	C:\WINDOWS\system32\180ax.exe
2007-04-26 12:40	8,704	--a------	C:\WINDOWS\7search.dll
2007-04-26 12:40	32,512	--a------	C:\WINDOWS\system32\Bi.dll
2007-04-26 12:40	30,464	--a------	C:\WINDOWS\system32\vxddsk.exe
2007-04-26 12:40	29,952	--a------	C:\WINDOWS\stcloader.exe
2007-04-26 12:40	28,160	--a------	C:\WINDOWS\swin32.dll
2007-04-26 12:40	24,832	--a------	C:\WINDOWS\2020search2.dll
2007-04-26 12:40	24,320	--a------	C:\WINDOWS\system32\WER8274.DLL
2007-04-26 12:40	24,064	--a------	C:\WINDOWS\mspphe.dll
2007-04-26 12:40	23,552	--a------	C:\WINDOWS\system32\SUSP.exe
2007-04-26 12:40	23,040	--a------	C:\WINDOWS\system32\Biprep.exe
2007-04-26 12:40	22,784	--a------	C:\WINDOWS\pbar.dll
2007-04-26 12:40	22,528	--a------	C:\WINDOWS\voiceip.dll
2007-04-26 12:40	22,528	--a------	C:\WINDOWS\bjam.dll
2007-04-26 12:40	22,272	--a------	C:\WINDOWS\flt.dll
2007-04-26 12:40	22,016	--a------	C:\WINDOWS\system32\MSIXU.DLL
2007-04-26 12:40	21,504	--a------	C:\WINDOWS\system32\msnhlp32.dll
2007-04-26 12:40	20,736	--a------	C:\WINDOWS\mssvr.exe
2007-04-26 12:40	20,480	--a------	C:\WINDOWS\system32\satmat.exe
2007-04-26 12:40	20,480	--a------	C:\WINDOWS\cdsm32.dll
2007-04-26 12:40	18,944	--a------	C:\WINDOWS\system32\wml.exe
2007-04-26 12:40	18,432	--a------	C:\WINDOWS\bi.dll
2007-04-26 12:40	17,152	--a------	C:\WINDOWS\2020search.dll
2007-04-26 12:40	16,640	--a------	C:\WINDOWS\saiemod.dll
2007-04-26 12:40	15,872	--a------	C:\WINDOWS\bokja.exe
2007-04-26 12:40	12,288	--a------	C:\WINDOWS\system32\salm.exe
2007-04-26 12:40	12	--a------	C:\WINDOWS\system32\gtv_sd.bin
2007-04-26 12:39	8,222	--a------	C:\WINDOWS\system32\ddcywur.dll
2007-04-26 12:39	34,549	--a------	C:\WINDOWS\system32\tsjpf32.dll
2007-04-26 12:39	132,660	--a------	C:\WINDOWS\system32\tamvqxtw.dll
2007-04-23 17:44	20,480	--a------	C:\WINDOWS\system32\qip.exe
2007-04-23 17:43	23,552	--ah-----	C:\WINDOWS\system32\oayx.exe
2007-04-23 17:43	147,968	--a------	C:\WINDOWS\system32\rku.exe
2007-04-23 17:29	147,968	-r-hs----	C:\WINDOWS\DHCP.EXE
2007-04-23 17:03 d--h-----	C:\Program Files\Common Files\delsim
2007-04-23 16:54	110,592	--a------	C:\WINDOWS\system32\avgfwafu.dll
2007-04-22 14:56	43,435	--a------	C:\WINDOWS\system32\servics7.exe
2007-04-22 14:55	43,435	--a------	C:\WINDOWS\system32\servics3.exe
2007-04-22 14:23 d--------	C:\WINDOWS\system32\bits
2007-04-22 14:20	7,680	---------	C:\WINDOWS\system32\bitsprx2.dll
2007-04-22 14:20	7,168	---------	C:\WINDOWS\system32\bitsprx3.dll
2007-04-22 14:20	331,776	--a------	C:\WINDOWS\system32\winhttp.dll
2007-04-22 14:20	17,408	--a------	C:\WINDOWS\system32\qmgrprxy.dll
2007-04-22 14:20	158,720	---------	C:\WINDOWS\system32\xpob2res.dll
2007-04-22 12:48	147,968	--a------	C:\WINDOWS\system32\sfk.exe
2007-04-21 22:39	121	--a------	C:\WINDOWS\system32\esaxqqvn.bat
2007-04-21 22:23 d--------	C:\WINDOWS\system32\ActiveScan
2007-04-21 22:03	127	--a------	C:\WINDOWS\system32\qrfse.bat
2007-04-21 21:57 d--------	C:\WINDOWS\system32\SoftwareDistribution
2007-04-21 21:52 d--------	C:\WINDOWS\SoftwareDistribution
2007-04-21 21:47	465,176	--a------	C:\WINDOWS\system32\wuapi.dll
2007-04-21 21:47	41,240	--a------	C:\WINDOWS\system32\wups.dll
2007-04-21 21:47	194,328	--a------	C:\WINDOWS\system32\wuaueng1.dll
2007-04-21 21:47	173,536	--a------	C:\WINDOWS\system32\wuweb.dll
2007-04-21 21:47	172,312	--a------	C:\WINDOWS\system32\wuauclt1.exe
2007-04-21 21:47	127,256	--a------	C:\WINDOWS\system32\wucltui.dll
2007-04-21 21:30	163,840	--a------	C:\WINDOWS\system32\igfxres.dll
2007-04-21 21:26 d--------	C:\WINDOWS\Prefetch
2007-04-21 21:11	24,661	--a------	C:\WINDOWS\system32\spxcoins.dll
2007-04-21 21:11	13,312	--a------	C:\WINDOWS\system32\irclass.dll
2007-04-21 21:03 d--------	C:\WINDOWS\setupupd
2007-04-21 20:53 d--------	C:\WINDOWS\setup.pss
2007-04-21 16:07 d--------	C:\DOCUME~1\Owner\APPLIC~1\vlc
2007-04-21 16:01 d--------	C:\Program Files\DivX
2007-04-21 15:58 d--------	C:\Program Files\VideoLAN
2007-04-21 15:38	204,800	--a------	C:\WINDOWS\system32\clcl5.exe
2007-04-20 00:16 d--------	C:\DOCUME~1\Owner\APPLIC~1\Leadertech
2007-04-19 21:57 d--------	C:\DOCUME~1\Owner\APPLIC~1\AdobeUM
2007-04-19 21:57 d--------	C:\DOCUME~1\Owner\APPLIC~1\AdobeAUM
2007-04-19 21:41 d--------	C:\WINDOWS\Downloaded Installations
2007-04-19 20:41 d--------	C:\Program Files\Lavasoft
2007-04-19 20:21 d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
2007-04-17 17:38	20,480	--a------	C:\WINDOWS\system32\wmpui.dll
2007-04-17 17:38	20,480	--a------	C:\WINDOWS\system32\wmpcore.dll
2007-04-17 17:38	20,480	--a------	C:\WINDOWS\system32\wmpcd.dll
2007-04-17 17:36	86,016	--a------	C:\WINDOWS\system32\wmpshell.dll
2007-04-17 17:36	8,192	--a------	C:\WINDOWS\system32\asferror.dll
2007-04-17 17:36	484,352	--a------	C:\WINDOWS\system32\Audiodev.dll
2007-04-17 17:36	3,371,008	--a------	C:\WINDOWS\system32\wmploc.dll
2007-04-17 17:36	282,624	--a------	C:\WINDOWS\system32\wmpdxm.dll
2007-04-17 17:36	189,440	--a------	C:\WINDOWS\system32\wmerror.dll
2007-04-17 17:36	175,104	--a------	C:\WINDOWS\system32\wmpsrcwp.dll
2007-04-17 17:36	135,168	--a------	C:\WINDOWS\system32\wmpasf.dll
2007-04-17 17:36	1,594,880	--a------	C:\WINDOWS\system32\wmpencen.dll
2007-04-17 17:35	66,560	--a------	C:\WINDOWS\system32\wpdmtpus.dll
2007-04-17 17:35	61,952	--a------	C:\WINDOWS\system32\wpdconns.dll
2007-04-17 17:35	47,104	--a------	C:\WINDOWS\system32\uwdf.exe
2007-04-17 17:35	38,912	--a------	C:\WINDOWS\system32\wdfmgr.exe
2007-04-17 17:35	364,784	--a------	C:\WINDOWS\system32\MSSCP.dll
2007-04-17 17:35	331,776	--a------	C:\WINDOWS\system32\wpdmtpdr.dll
2007-04-17 17:35	331,264	--a------	C:\WINDOWS\system32\wpdsp.dll
2007-04-17 17:35	33,792	--a------	C:\WINDOWS\system32\WMDMPS.dll
2007-04-17 17:35	28,160	--a------	C:\WINDOWS\system32\WMDMLOG.dll
2007-04-17 17:35	25,088	--a------	C:\WINDOWS\system32\MsPMSNSv.dll
2007-04-17 17:35	18,944	--a------	C:\WINDOWS\system32\drivers\wpdusb.sys
2007-04-17 17:35	173,568	--a------	C:\WINDOWS\system32\MsPMSP.dll
2007-04-17 17:35	164,864	--a------	C:\WINDOWS\system32\cewmdm.dll
2007-04-17 17:35	15,872	--a------	C:\WINDOWS\system32\wdfapi.dll
2007-04-17 17:35	114,176	--a------	C:\WINDOWS\system32\wpdmtp.dll
2007-04-17 17:34	96,768	--a------	C:\WINDOWS\system32\logagent.exe
2007-04-17 17:34	940,544	--a------	C:\WINDOWS\system32\wmspdmoe.dll
2007-04-17 17:34	895,736	--a------	C:\WINDOWS\system32\wmvdmod.dll
2007-04-17 17:34	774,904	--a------	C:\WINDOWS\system32\wmsdmod.dll
2007-04-17 17:34	716,288	--a------	C:\WINDOWS\system32\wmadmoe.dll
2007-04-17 17:34	6,656	--a------	C:\WINDOWS\system32\laprxy.dll
2007-04-17 17:34	413,944	--a------	C:\WINDOWS\system32\wmspdmod.dll
2007-04-17 17:34	396,528	--a------	C:\WINDOWS\system32\wmadmod.dll
2007-04-17 17:34	335,872	--a------	C:\WINDOWS\system32\WMDRMdev.dll
2007-04-17 17:34	315,904	--a------	C:\WINDOWS\system32\MSWMDM.dll
2007-04-17 17:34	290,816	--a------	C:\WINDOWS\system32\WMDRMNet.dll
2007-04-17 17:34	224,768	--a------	C:\WINDOWS\system32\wmasf.dll
2007-04-17 17:34	221,184	--a------	C:\WINDOWS\system32\qasf.dll
2007-04-17 17:34	150,016	--a------	C:\WINDOWS\system32\wmidx.dll
2007-04-17 17:34	1,512,448	--a------	C:\WINDOWS\system32\WMVADVE.DLL
2007-04-17 17:34	1,218,808	--a------	C:\WINDOWS\system32\wmvadvd.dll
2007-04-17 17:34	1,119,744	--a------	C:\WINDOWS\system32\wmsdmoe2.dll
2007-04-17 17:34	1,027,072	--a------	C:\WINDOWS\system32\wmnetmgr.dll
2007-04-17 17:34	1,003,008	--a------	C:\WINDOWS\system32\wmvdmoe2.dll
2007-04-17 17:34 d--------	C:\WINDOWS\RegisteredPackages
2007-04-16 23:15 d--h-----	C:\WINDOWS\PIF
2007-04-16 23:10	22,112	-ra------	C:\WINDOWS\system32\drivers\COH_Mon.sys
2007-04-16 22:29	48,776	--a------	C:\WINDOWS\system32\S32EVNT1.DLL
2007-04-16 22:29	115,000	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-04-16 22:29 d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-04-16 22:16 d--------	C:\Program Files\Common Files\Symantec Shared
2007-04-16 22:07 d--------	C:\Program Files\PowerISO
2007-04-16 21:46 d--------	C:\Program Files\Microsoft Picture It! 7
2007-04-16 21:14 d--------	C:\Program Files\Canon
2007-04-16 21:06	107,008	--a------	C:\WINDOWS\system32\CNMLM58.DLL
2007-04-16 21:05	73,728	-ra------	C:\WINDOWS\system32\CNMCP58.exe
2007-04-16 21:05	6,656	--a------	C:\WINDOWS\system32\CNMVS58.DLL
2007-04-16 21:05 d--h-----	C:\BJPrinter
2007-04-16 21:05 d--------	C:\WINDOWS\StartHtmico
2007-04-16 21:05 d--------	C:\WINDOWS\I560
2007-04-16 20:30 d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-04-16 20:15 d--------	C:\DOCUME~1\Owner\Contacts
2007-04-16 20:12 d----c---	C:\WINDOWS\system32\DRVSTORE
2007-04-16 20:11 d--------	C:\Program Files\MSN Messenger
2007-04-16 19:52 d--------	C:\DOCUME~1\Owner\APPLIC~1\Lavasoft
2007-04-15 14:01	1,460	--ah-----	C:\WINDOWS\system32\rttae.exe
2007-04-14 21:08 d--------	C:\DOCUME~1\Owner\.housecall6.6
2007-04-14 20:58	671	--a------	C:\WINDOWS\mozver.dat
2007-04-14 20:06 d--hs----	C:\RECYCLER
2007-04-14 19:53	499,712	--a------	C:\WINDOWS\system32\msvcp71.dll
2007-04-14 19:50 d--------	C:\DOCUME~1\Owner\APPLIC~1\Azureus
2007-04-14 19:50 d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
2007-04-14 19:45 d--------	C:\Program Files\Azureus
2007-04-14 19:40	0	--a------	C:\WINDOWS\nsreg.dat
2007-04-14 19:39	5,805,656	--a------	C:\Program Files\Firefox Setup 2.0.0.3.exe
2007-04-14 19:28 d--------	C:\WINDOWS\pss
2007-04-14 19:21	24,064	--a------	C:\WINDOWS\system32\IntelNic.dll
2007-04-14 19:21	154,112	--a------	C:\WINDOWS\system32\drivers\e100b325.sys
2007-04-14 19:21	12,288	--a------	C:\WINDOWS\system32\e100bmsg.dll
2007-04-14 19:21	118,784	--a------	C:\WINDOWS\system32\Prounstl.exe
2007-04-14 19:17	50,048	--a------	C:\WINDOWS\system32\drivers\DMusic.sys
2007-04-14 19:17	5,632	--a------	C:\WINDOWS\system32\drivers\splitter.sys
2007-04-14 19:16	991,232	--a------	C:\WINDOWS\system32\virtear.dll
2007-04-14 19:16	65,536	--a------	C:\WINDOWS\system32\Audio3d.dll
2007-04-14 19:16	49,152	--a------	C:\WINDOWS\system32\DSndUp.exe
2007-04-14 19:16	45,056	--a------	C:\WINDOWS\system32\CleanUp.exe
2007-04-14 19:16	4,096	--a------	C:\WINDOWS\system32\ksuser.dll
2007-04-14 19:16 d--------	C:\WINDOWS\VirtualEar
2007-04-14 19:16 d--------	C:\Program Files\Analog Devices
2007-04-14 19:14 d--------	C:\Program Files\Intel
2007-04-14 19:04	878,651	--a------	C:\WINDOWS\system32\ialmdd5.dll
2007-04-14 19:04	86,016	--a------	C:\WINDOWS\system32\igfxdo.dll
2007-04-14 19:04	804,317	--a------	C:\WINDOWS\system32\drivers\ialmnt5.sys
2007-04-14 19:04	61,440	--a------	C:\WINDOWS\system32\iAlmCoIn_v4020.dll
2007-04-14 19:04	516,096	--a------	C:\WINDOWS\system32\ialmgdev.dll
2007-04-14 19:04	503,808	--a------	C:\WINDOWS\system32\igfxcfg.exe
2007-04-14 19:04	49,152	--a------	C:\WINDOWS\system32\ialmrem.dll
2007-04-14 19:04	45,056	--a------	C:\WINDOWS\system32\igfxdgps.dll
2007-04-14 19:04	37,951	--a------	C:\WINDOWS\system32\ialmrnt5.dll
2007-04-14 19:04	36,864	--a------	C:\WINDOWS\system32\igfxexps.dll
2007-04-14 19:04	348,160	--a------	C:\WINDOWS\system32\igfxsrvc.dll
2007-04-14 19:04	225,280	--a------	C:\WINDOWS\system32\igfxpph.dll
2007-04-14 19:04	225,280	--a------	C:\WINDOWS\system32\igfxeud.dll
2007-04-14 19:04	2,289,664	--a------	C:\WINDOWS\system32\ialmgicd.dll
2007-04-14 19:04	178,779	--a------	C:\WINDOWS\system32\ialmdev5.dll
2007-04-14 19:04	155,648	--a------	C:\WINDOWS\system32\igfxtray.exe
2007-04-14 19:04	151,552	--a------	C:\WINDOWS\system32\igfxdiag.exe
2007-04-14 19:04	139,264	--a------	C:\WINDOWS\system32\igfxdev.dll
2007-04-14 19:04	126,976	--a------	C:\WINDOWS\system32\igfxhk.dll
2007-04-14 19:04	126,976	--a------	C:\WINDOWS\system32\hkcmd.exe
2007-04-14 19:04	118,784	--a------	C:\WINDOWS\system32\hccutils.dll
2007-04-14 19:04	114,688	--a------	C:\WINDOWS\system32\igfxzoom.exe
2007-04-14 19:04	108,092	--a------	C:\WINDOWS\system32\ialmdnt5.dll
2007-04-14 19:04	106,496	--a------	C:\WINDOWS\system32\igfxext.exe
2007-04-14 19:04	1,245,184	--a------	C:\WINDOWS\system32\igfxress.dll
2007-04-14 19:03	765,952	--a------	C:\WINDOWS\system\crlds3d.dll
2007-04-14 19:03	732,928	--a------	C:\WINDOWS\system32\drivers\senfilt.sys
2007-04-14 19:03	311,296	--a------	C:\WINDOWS\system32\Edcrypt.dll
2007-04-14 19:03	260,352	--a------	C:\WINDOWS\system32\drivers\smwdm.sys
2007-04-14 19:03	23,040	--a------	C:\WINDOWS\system32\PostProc.dll
2007-04-14 19:01 d--------	C:\driver
2007-04-14 17:28 d--------	C:\WINDOWS\OPTIONS
2007-04-14 17:27	41,852	--a------	C:\WINDOWS\system32\UpdDrv2K.exe
2007-04-14 17:27 d--------	C:\Program Files\3Com Corporation
2007-04-14 17:26 d--------	C:\Program Files\UIU
2007-04-14 17:24	89,360	--a------	C:\WINDOWS\system32\VB5DB.DLL
2007-04-14 17:24	446,464	-ra------	C:\WINDOWS\system32\hhactivex.dll
2007-04-14 17:24	176,128	--a------	C:\WINDOWS\system32\RcdScan.dll
2007-04-14 17:24	13,632	--a------	C:\WINDOWS\system32\drivers\omci.sys
2007-04-14 17:24 d--h-----	C:\Program Files\InstallShield Installation Information
2007-04-14 17:24 d--------	C:\Program Files\Common Files\InstallShield
2007-04-14 17:21 d--------	C:\DOCUME~1\Owner\APPLIC~1\Share-to-Web Upload Folder
2007-04-14 17:20 d--------	C:\Program Files\Common Files\Hewlett-Packard
2007-04-14 17:19	82,380	--a------	C:\WINDOWS\system32\drivers\AFS2K.SYS
2007-04-14 17:19	450,560	-ra------	C:\WINDOWS\system32\hpgt35.dll
2007-04-14 17:19	262,144	-ra------	C:\WINDOWS\system32\hpgwiamd.dll
2007-04-14 17:19	131,072	-ra------	C:\WINDOWS\system32\hpsjvset.dll
2007-04-14 17:19	13,824	--a------	C:\WINDOWS\system32\drivers\usbscan.sys
2007-04-14 17:19 d--------	C:\Program Files\Hewlett-Packard
2007-04-14 16:42 d--------	C:\WINDOWS\system32\Backup
2007-04-14 16:41 d--------	C:\WINDOWS\SQLHotfix
2007-04-14 16:40	33,340	--a------	C:\WINDOWS\system32\dbmsqlgc.dll
2007-04-14 16:40	306,688	--a------	C:\WINDOWS\IsUninst.exe
2007-04-14 16:40	24,576	--a------	C:\WINDOWS\system32\dbmsgnet.dll
2007-04-14 16:39 d--------	C:\Program Files\Microsoft Visual Studio .NET 2003
2007-04-14 16:39 d--------	C:\Program Files\Common Files\Crystal Decisions
2007-04-14 16:38 d--------	C:\Program Files\Microsoft SQL Server
2007-04-14 16:36 d--------	C:\WINDOWS\system32\URTTemp
2007-04-14 16:26	24,816	--a------	C:\WINDOWS\system32\mdimon.dll
2007-04-14 16:25 d--------	C:\Program Files\Microsoft ActiveSync
2007-04-14 16:24 d--h-----	C:\WINDOWS\ShellNew
2007-04-14 16:21 dr-h-----	C:\MSOCache
2007-04-14 16:15	945,936	--a------	C:\WINDOWS\system32\msjava.dll
2007-04-14 16:15	63,248	--a------	C:\WINDOWS\system32\javaprxy.dll
2007-04-14 16:15	6,550	--a------	C:\WINDOWS\jautoexp.dat
2007-04-14 16:15	49,424	--a------	C:\WINDOWS\system32\clspack.exe
2007-04-14 16:15	46,352	--a------	C:\WINDOWS\setdebug.exe
2007-04-14 16:15	404,752	--a------	C:\WINDOWS\system32\javart.dll
2007-04-14 16:15	313,856	--a------	C:\WINDOWS\system32\dx3j.dll
2007-04-14 16:15	286,992	--a------	C:\WINDOWS\system32\vmhelper.dll
2007-04-14 16:15	262,144	--a------	C:\DOCUME~1\NETWOR~1\NTUSER.DAT
2007-04-14 16:15	237,568	--a------	C:\DOCUME~1\LOCALS~1\NTUSER.DAT
2007-04-14 16:15	21,264	--a------	C:\WINDOWS\system32\msjdbc10.dll
2007-04-14 16:15	187,152	--a------	C:\WINDOWS\system32\javacypt.dll
2007-04-14 16:15	172,304	--a------	C:\WINDOWS\system32\jview.exe
2007-04-14 16:15	171,792	--a------	C:\WINDOWS\system32\wjview.exe
2007-04-14 16:15	171,280	--a------	C:\WINDOWS\system32\jit.dll
2007-04-14 16:15	154,384	--a------	C:\WINDOWS\system32\msawt.dll
2007-04-14 16:15	15,120	--a------	C:\WINDOWS\system32\jdbgmgr.exe
2007-04-14 16:15	139,536	--a------	C:\WINDOWS\system32\javaee.dll
2007-04-14 16:15	113	--a------	C:\WINDOWS\system32\zonedon.reg
2007-04-14 16:15	113	--a------	C:\WINDOWS\system32\zonedoff.reg
2007-04-14 16:15	1,572,864	--a------	C:\DOCUME~1\Owner\NTUSER.DAT
2007-04-14 16:15 d--hs----	C:\WINDOWS\Installer
2007-04-14 16:15 d--hs----	C:\System Volume Information
2007-04-14 16:15 d--------	C:\WINDOWS\LastGood
2007-04-14 16:12	5,473,872	--a------	C:\WINDOWS\system32\MSJAVX86.EXE
2007-04-14 16:12	249,856	---h-----	C:\DOCUME~1\DEFAUL~1\NTUSER.DAT
2007-04-14 16:12 d--------	C:\WINDOWS\system32\xircom
2007-04-14 16:12 d--------	C:\Program Files\microsoft frontpage
2007-04-14 16:12 d--------	C:\DELL
2007-04-14 16:11	112,128	--a------	C:\WINDOWS\system32\mapi32.dll
2007-04-14 16:11	0	-rahs----	C:\MSDOS.SYS
2007-04-14 16:11	0	-rahs----	C:\IO.SYS
2007-04-14 16:11	0	--a------	C:\CONFIG.SYS
2007-04-14 16:11	0	--a------	C:\AUTOEXEC.BAT
2007-04-14 16:11 d--------	C:\WINDOWS\LastGood.Tmp
2007-04-14 16:10 dr-------	C:\WINDOWS\Offline Web Pages
2007-04-14 16:10 d--hs----	C:\DOCUME~1\ALLUSE~1\DRM
2007-04-14 16:10 d---s----	C:\WINDOWS\Downloaded Program Files
2007-04-14 16:10 d--------	C:\WINDOWS\srchasst
2007-04-14 16:09	40,960	--a------	C:\WINDOWS\system32\safrslv.dll
2007-04-14 16:09	39,424	--a------	C:\WINDOWS\system32\safrcdlg.dll
2007-04-14 16:09	361,984	--a------	C:\WINDOWS\system32\qmgr.dll
2007-04-14 16:09	33,280	--a------	C:\WINDOWS\system32\racpldlg.dll
2007-04-14 16:09	26,624	--a------	C:\WINDOWS\system32\safrdm.dll
2007-04-14 16:09	11,264	--a------	C:\WINDOWS\system32\atrace.dll
2007-04-14 16:09 d--------	C:\WINDOWS\system32\Macromed
2007-04-14 16:09 d--------	C:\WINDOWS\system32\DirectX
2007-04-14 16:09 d--------	C:\Program Files\Movie Maker
2007-04-14 16:08	90,624	--a------	C:\WINDOWS\system32\msoert2.dll
2007-04-14 16:08	9,728	--a------	C:\WINDOWS\system32\mstinit.exe
2007-04-14 16:08	77,824	--a------	C:\WINDOWS\system32\isign32.dll
2007-04-14 16:08	73,728	--a------	C:\WINDOWS\system32\ils.dll
2007-04-14 16:08	70,400	--a------	C:\WINDOWS\system32\drivers\sr.sys
2007-04-14 16:08	69,632	--a------	C:\WINDOWS\system32\icwdial.dll
2007-04-14 16:08	65,536	--a------	C:\WINDOWS\system32\msconf.dll
2007-04-14 16:08	64,512	--a------	C:\WINDOWS\system32\acctres.dll
2007-04-14 16:08	61,952	--a------	C:\WINDOWS\system32\srclient.dll
2007-04-14 16:08	61,440	--a------	C:\WINDOWS\system32\icwphbk.dll
2007-04-14 16:08	593,920	--a------	C:\WINDOWS\system32\inetcomm.dll
2007-04-14 16:08	47,616	--a------	C:\WINDOWS\system32\inetres.dll
2007-04-14 16:08	32,768	--a------	C:\WINDOWS\system32\mnmsrvc.exe
2007-04-14 16:08	32,384	--a------	C:\WINDOWS\system32\mnmdd.dll
2007-04-14 16:08	28,672	--a------	C:\WINDOWS\system32\isrdbg32.dll


----------



## monkeybubbles (Apr 26, 2007)

2007-04-14 16:08	266,240	--a------	C:\WINDOWS\system32\inetcfg.dll
2007-04-14 16:08	250,368	--a------	C:\WINDOWS\system32\mstask.dll
2007-04-14 16:08	24,576	--a------	C:\WINDOWS\system32\nmmkcert.dll
2007-04-14 16:08	23,316	--a------	C:\WINDOWS\system32\emptyregdb.dat
2007-04-14 16:08	228,864	--a------	C:\WINDOWS\system32\msoeacct.dll
2007-04-14 16:08	218,624	--a------	C:\WINDOWS\system32\srrstr.dll
2007-04-14 16:08	16,384	--a------	C:\WINDOWS\system32\icfgnt5.dll
2007-04-14 16:08	158,720	--a------	C:\WINDOWS\system32\schedsvc.dll
2007-04-14 16:08	155,136	--a------	C:\WINDOWS\system32\srsvc.dll
2007-04-14 16:08	12,288	--a------	C:\WINDOWS\system32\nmevtmsg.dll
2007-04-14 16:08 d---s----	C:\WINDOWS\Tasks
2007-04-14 16:08 d--------	C:\WINDOWS\system32\Restore
2007-04-14 16:08 d--------	C:\WINDOWS\Registration
2007-04-14 16:08 d--------	C:\WINDOWS\PCHEALTH
2007-04-14 16:08 d--------	C:\Program Files\Common Files\MSSoap
2007-04-14 16:07	73,216	--a------	C:\WINDOWS\system32\avwav.dll
2007-04-14 16:07	5,632	--a------	C:\WINDOWS\system32\write.exe
2007-04-14 16:07	489,984	--a------	C:\WINDOWS\system32\hypertrm.dll
2007-04-14 16:07	44,544	--a------	C:\WINDOWS\system32\hticons.dll
2007-04-14 16:07	35,328	--a------	C:\WINDOWS\system32\winchat.exe
2007-04-14 16:07	339,968	--a------	C:\WINDOWS\system32\mspaint.exe
2007-04-14 16:07	227,840	--a------	C:\WINDOWS\system32\avtapi.dll
2007-04-14 16:07	179,200	--a------	C:\WINDOWS\system32\accwiz.exe
2007-04-14 16:07	16,384	--a------	C:\WINDOWS\system32\avmeter.dll
2007-04-14 16:07	138,752	--a------	C:\WINDOWS\system32\sndvol32.exe
2007-04-14 16:07	124,416	--a------	C:\WINDOWS\system32\sndrec32.exe
2007-04-14 16:07	116,736	--a------	C:\WINDOWS\system32\mplay32.exe
2007-04-14 16:07 d--h-----	C:\Program Files\WindowsUpdate
2007-04-14 16:07 d--------	C:\Program Files\Windows NT
2007-04-14 16:07 d--------	C:\Program Files\Online Services
2007-04-14 16:07 d--------	C:\Program Files\MSN Gaming Zone
2007-04-14 16:07 d--------	C:\Program Files\Messenger
2007-04-14 16:06	98,816	--a------	C:\WINDOWS\system32\clipbrd.exe
2007-04-14 16:06	9,728	--a------	C:\WINDOWS\system32\xolehlp.dll
2007-04-14 16:06	9,728	--a------	C:\WINDOWS\system32\reset.exe
2007-04-14 16:06	88,576	--a------	C:\WINDOWS\system32\tscfgwmi.dll
2007-04-14 16:06	869,376	--a------	C:\WINDOWS\system32\msdtctm.dll
2007-04-14 16:06	85,504	--a------	C:\WINDOWS\system32\catsrvps.dll
2007-04-14 16:06	83,968	--a------	C:\WINDOWS\system32\mtxoci.dll
2007-04-14 16:06	82,432	--a------	C:\WINDOWS\system32\comrepl.dll
2007-04-14 16:06	80,384	--a------	C:\WINDOWS\system32\charmap.exe
2007-04-14 16:06	8,704	--a------	C:\WINDOWS\system32\icaapi.dll
2007-04-14 16:06	73,864	--a------	C:\WINDOWS\system32\rdpwsx.dll
2007-04-14 16:06	61,952	--a------	C:\WINDOWS\system32\rdshost.exe
2007-04-14 16:06	605,696	--a------	C:\WINDOWS\system32\getuname.dll
2007-04-14 16:06	6,144	--a------	C:\WINDOWS\system32\msdtc.exe
2007-04-14 16:06	583,168	--a------	C:\WINDOWS\system32\catsrvut.dll
2007-04-14 16:06	57,344	--a------	C:\WINDOWS\system32\licwmi.dll
2007-04-14 16:06	56,832	--a------	C:\WINDOWS\system32\sol.exe
2007-04-14 16:06	56,832	--a------	C:\WINDOWS\system32\colbact.dll
2007-04-14 16:06	56,320	--a------	C:\WINDOWS\system32\remotepg.dll
2007-04-14 16:06	55,296	--a------	C:\WINDOWS\system32\freecell.exe
2007-04-14 16:06	54,784	--a------	C:\WINDOWS\system32\msdtclog.dll
2007-04-14 16:06	54,272	--a------	C:\WINDOWS\system32\stclient.dll
2007-04-14 16:06	534,016	--a------	C:\WINDOWS\system32\spider.exe
2007-04-14 16:06	53,248	--a------	C:\WINDOWS\system32\servdeps.dll
2007-04-14 16:06	503,296	--a------	C:\WINDOWS\system32\mstscax.dll
2007-04-14 16:06	5,120	--a------	C:\WINDOWS\system32\dcomcnfg.exe
2007-04-14 16:06	495,616	--a------	C:\WINDOWS\system32\comuid.dll
2007-04-14 16:06	468,480	--a------	C:\WINDOWS\system32\clbcatq.dll
2007-04-14 16:06	41,984	--a------	C:\WINDOWS\system32\rdpclip.exe
2007-04-14 16:06	40,448	--a------	C:\WINDOWS\system32\tscupgrd.exe
2007-04-14 16:06	4,096	--a------	C:\WINDOWS\system32\wuauserv.dll
2007-04-14 16:06	4,096	--a------	C:\WINDOWS\system32\rdpcfgex.dll
2007-04-14 16:06	4,096	--a------	C:\WINDOWS\system32\mtxex.dll
2007-04-14 16:06	385,536	--a------	C:\WINDOWS\system32\mstsc.exe
2007-04-14 16:06	37,896	--a------	C:\WINDOWS\system32\drivers\termdd.sys
2007-04-14 16:06	360,960	--a------	C:\WINDOWS\system32\msdtcprx.dll
2007-04-14 16:06	33,792	--a------	C:\WINDOWS\system32\regini.exe
2007-04-14 16:06	32,768	--a------	C:\WINDOWS\system32\cfgbkend.dll
2007-04-14 16:06	25,600	--a------	C:\WINDOWS\system32\comaddin.dll
2007-04-14 16:06	25,088	--a------	C:\WINDOWS\system32\mtxlegih.dll
2007-04-14 16:06	22,016	--a------	C:\WINDOWS\system32\qwinsta.exe
2007-04-14 16:06	215,040	--a------	C:\WINDOWS\system32\catsrv.dll
2007-04-14 16:06	20,992	--a------	C:\WINDOWS\system32\msg.exe
2007-04-14 16:06	20,480	--a------	C:\WINDOWS\system32\mtxdm.dll
2007-04-14 16:06	20,232	--a------	C:\WINDOWS\system32\drivers\tdtcp.sys
2007-04-14 16:06	197,632	-ra------	C:\WINDOWS\system32\termsrv.dll
2007-04-14 16:06	181,632	--a------	C:\WINDOWS\system32\drivers\rdpdr.sys
2007-04-14 16:06	18,432	--a------	C:\WINDOWS\system32\qprocess.exe
2007-04-14 16:06	174,592	--a------	C:\WINDOWS\system32\cmprops.dll
2007-04-14 16:06	16,896	--a------	C:\WINDOWS\system32\tsshutdn.exe
2007-04-14 16:06	16,896	--a------	C:\WINDOWS\system32\qappsrv.exe
2007-04-14 16:06	16,384	--a------	C:\WINDOWS\system32\tskill.exe
2007-04-14 16:06	16,384	--a------	C:\WINDOWS\system32\mmfutil.dll
2007-04-14 16:06	151,040	--a------	C:\WINDOWS\system32\msdtcuiu.dll
2007-04-14 16:06	15,872	--a------	C:\WINDOWS\system32\rwinsta.exe
2007-04-14 16:06	15,872	--a------	C:\WINDOWS\system32\cdmodem.dll
2007-04-14 16:06	15,360	--a------	C:\WINDOWS\system32\logoff.exe
2007-04-14 16:06	147,456	--a------	C:\WINDOWS\system32\comsnap.dll
2007-04-14 16:06	14,848	--a------	C:\WINDOWS\system32\tsdiscon.exe
2007-04-14 16:06	14,848	--a------	C:\WINDOWS\system32\tscon.exe
2007-04-14 16:06	14,848	--a------	C:\WINDOWS\system32\shadow.exe
2007-04-14 16:06	14,848	--a------	C:\WINDOWS\system32\rdpsnd.dll
2007-04-14 16:06	134,656	--a------	C:\WINDOWS\system32\rdchost.dll
2007-04-14 16:06	130,048	--a------	C:\WINDOWS\system32\sessmgr.exe
2007-04-14 16:06	126,976	--a------	C:\WINDOWS\system32\mshearts.exe
2007-04-14 16:06	124,184	--a------	C:\WINDOWS\system32\wuauclt.exe
2007-04-14 16:06	12,288	--a------	C:\WINDOWS\system32\rdsaddin.exe
2007-04-14 16:06	119,808	--a------	C:\WINDOWS\system32\winmine.exe
2007-04-14 16:06	114,688	--a------	C:\WINDOWS\system32\calc.exe
2007-04-14 16:06	11,144	--a------	C:\WINDOWS\system32\drivers\tdpipe.sys
2007-04-14 16:06	107,912	--a------	C:\WINDOWS\system32\drivers\rdpwd.sys
2007-04-14 16:06	100,864	--a------	C:\WINDOWS\system32\clbcatex.dll
2007-04-14 16:06	1,343,768	--a------	C:\WINDOWS\system32\wuaueng.dll
2007-04-14 16:06	1,161	--a------	C:\WINDOWS\system32\usrlogon.cmd
2007-04-14 16:06	1,139,200	--a------	C:\WINDOWS\system32\comsvcs.dll
2007-04-14 16:06 d--------	C:\WINDOWS\system32\MsDtc
2007-04-14 16:06 d--------	C:\WINDOWS\system32\Com
2007-04-14 09:03	3,072	--a------	C:\WINDOWS\system32\drivers\audstub.sys
2007-04-14 09:02	55,808	--a------	C:\WINDOWS\system32\drivers\redbook.sys
2007-04-14 09:01 dr-------	C:\Program Files
2007-04-14 09:01 d--------	C:\Program Files\Common Files\SpeechEngines
2007-04-14 09:01 d--------	C:\Program Files\Common Files\ODBC
2007-04-14 09:00	70,656	--a------	C:\WINDOWS\system32\storprop.dll
2007-04-14 09:00	69,584	--a------	C:\WINDOWS\system\AVICAP.DLL
2007-04-14 09:00	176,157	--a------	C:\WINDOWS\system32\dgrpsetu.dll
2007-04-14 09:00	103,424	--a------	C:\WINDOWS\system32\EqnClass.Dll
2007-04-14 09:00	10,496	--a------	C:\WINDOWS\system32\drivers\irenum.sys
2007-04-14 09:00 dr-------	C:\DOCUME~1\ALLUSE~1\Documents
2007-04-14 09:00 d--------	C:\WINDOWS\system32\CatRoot2
2007-04-14 09:00 d--------	C:\WINDOWS\system32\CatRoot
2007-04-14 09:00 d--------	C:\Documents and Settings
2007-04-14 08:54 dr-hsc---	C:\WINDOWS\system32\dllcache
2007-04-14 08:54 dr--s----	C:\WINDOWS\Fonts
2007-04-14 08:54 dr-------	C:\WINDOWS\Web
2007-04-14 08:54 d--h-----	C:\WINDOWS\inf
2007-04-14 08:54 d--------	C:\WINDOWS\WinSxS
2007-04-14 08:54 d--------	C:\WINDOWS\twain_32
2007-04-14 08:54 d--------	C:\WINDOWS\system32\wins
2007-04-14 08:54 d--------	C:\WINDOWS\system32\wbem
2007-04-14 08:54 d--------	C:\WINDOWS\system32\usmt
2007-04-14 08:54 d--------	C:\WINDOWS\system32\spool
2007-04-14 08:54 d--------	C:\WINDOWS\system32\ShellExt
2007-04-14 08:54 d--------	C:\WINDOWS\system32\Setup
2007-04-14 08:54 d--------	C:\WINDOWS\system32\ras
2007-04-14 08:54 d--------	C:\WINDOWS\system32\oobe
2007-04-14 08:54 d--------	C:\WINDOWS\system32\npp
2007-04-14 08:54 d--------	C:\WINDOWS\system32\mui
2007-04-14 08:54 d--------	C:\WINDOWS\system32\inetsrv
2007-04-14 08:54 d--------	C:\WINDOWS\system32\IME
2007-04-14 08:54 d--------	C:\WINDOWS\system32\icsxml
2007-04-14 08:54 d--------	C:\WINDOWS\system32\ias
2007-04-14 08:54 d--------	C:\WINDOWS\system32\export
2007-04-14 08:54 d--------	C:\WINDOWS\system32\drivers\etc
2007-04-14 08:54 d--------	C:\WINDOWS\system32\drivers\disdn
2007-04-14 08:54 d--------	C:\WINDOWS\system32\drivers
2007-04-14 08:54 d--------	C:\WINDOWS\system32\dhcp
2007-04-14 08:54 d--------	C:\WINDOWS\system32\config
2007-04-14 08:54 d--------	C:\WINDOWS\system32\3com_dmi
2007-04-14 08:54 d--------	C:\WINDOWS\system32\3076
2007-04-14 08:54 d--------	C:\WINDOWS\system32\2052
2007-04-14 08:54 d--------	C:\WINDOWS\system32\1054
2007-04-14 08:54 d--------	C:\WINDOWS\system32\1042
2007-04-14 08:54 d--------	C:\WINDOWS\system32\1041
2007-04-14 08:54 d--------	C:\WINDOWS\system32\1037
2007-04-14 08:54 d--------	C:\WINDOWS\system32\1033
2007-04-14 08:54 d--------	C:\WINDOWS\system32\1031
2007-04-14 08:54 d--------	C:\WINDOWS\system32\1028
2007-04-14 08:54 d--------	C:\WINDOWS\system32\1025
2007-04-14 08:54 d--------	C:\WINDOWS\system32
2007-04-14 08:54 d--------	C:\WINDOWS\system
2007-04-14 08:54 d--------	C:\WINDOWS\security
2007-04-14 08:54 d--------	C:\WINDOWS\Resources
2007-04-14 08:54 d--------	C:\WINDOWS\repair
2007-04-14 08:54 d--------	C:\WINDOWS\mui
2007-04-14 08:54 d--------	C:\WINDOWS\msapps
2007-04-14 08:54 d--------	C:\WINDOWS\msagent
2007-04-14 08:54 d--------	C:\WINDOWS\Media
2007-04-14 08:54 d--------	C:\WINDOWS\ime
2007-04-14 08:54 d--------	C:\WINDOWS\Help
2007-04-14 08:54 d--------	C:\WINDOWS\Driver Cache
2007-04-14 08:54 d--------	C:\WINDOWS\Debug
2007-04-14 08:54 d--------	C:\WINDOWS\Cursors
2007-04-14 08:54 d--------	C:\WINDOWS\Connection Wizard
2007-04-14 08:54 d--------	C:\WINDOWS\Config
2007-04-14 08:54 d--------	C:\WINDOWS\AppPatch
2007-04-14 08:54 d--------	C:\WINDOWS\addins
2007-04-14 08:54 d--------	C:\WINDOWS

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-04-27 12:07	40448	--a------	C:\WINDOWS\system32\ftp.exe
2007-04-27 12:07	16896	--a------	C:\WINDOWS\system32\tftp.exe
2007-04-23 16:46	132608	--a------	C:\WINDOWS\system32\sfc_os.dll
2007-04-14 09:00	62	--ahs----	C:\DOCUME~1\Owner\APPLIC~1\desktop.ini

Reg Loading Points

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}	C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
{B08D32DE-64B2-4137-8345-87293E70D40B}	C:\WINDOWS\System32\iea.dll
{B4409DDA-13BD-4AC7-96F5-54F14E0ED61c}	C:\WINDOWS\System32\augueook.dll [x]
{D46E6398-D6EE-489C-81F3-5A9C7ADBC3C2}	C:\WINDOWS\System32\ddcawuv.dll [x]
{D651AFF4-9590-424d-BD1E-8E33E090DFB3}	C:\WINDOWS\System32\pdwcdasg.dll [x]
{EEFBE5D6-FEFF-4CB4-AA26-6A464090CB89}	C:\WINDOWS\System32\msnhlp32.dll
{F621B5FB-6E1E-4D0E-B88C-34B4775537B5}	C:\WINDOWS\System32\augueook.dll [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"PWRISOVM.EXE"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Microsoft Works Update Detection"="C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe"
"Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"
"RegistryMechanic"=""
"Symantec PIF AlertEng"="\"C:\\Program Files\\Common Files\\Symantec Shared\\PIF\\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\\PIFSvc.exe\" /a /m \"C:\\Program Files\\Common Files\\Symantec Shared\\PIF\\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\\AlertEng.dll\""
"InfoData"="rundll32.exe \"C:\\WINDOWS\\System32\\tamvqxtw.dll\",realset"
"Winamp Media"="C:\\WINDOWS\\System32\\qmedia.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"HijackThis startup scan"="C:\\Documents and Settings\\Owner\\Desktop\\HijackThis.exe /startupscan"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Winamp Media"="C:\\WINDOWS\\System32\\qmedia.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{9DED2B32-743B-47EB-874C-28AECF2A268D}"=""
"{D46E6398-D6EE-489C-81F3-5A9C7ADBC3C2}"=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"CDRecorder036"="{A3BC5E20-0235-1ABF-9CE1-00AA00512036}"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages	REG_MULTI_SZ msv1_0\0\0
Security Packages	REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages	REG_MULTI_SZ scecli\0\0

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced DHTML Enable]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="zcfvog"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ctfmon"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\System32\\ctfmon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hkcmd"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\hkcmd.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="igfxtray"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\igfxtray.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hpgs2wnd"
"hkey"="HKLM"
"command"="C:\\Program Files\\Hewlett-Packard\\HP Share-to-Web\\hpgs2wnd.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="smax4pnp"
"hkey"="HKLM"
"command"="C:\\Program Files\\Analog Devices\\Core\\smax4pnp.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tcpipmon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="tcpipmon"
"hkey"="HKLM"
"command"="tcpipmon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Network Firewall]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="firewall"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService	REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService	REG_MULTI_SZ DnsCache\0\0
rpcss	REG_MULTI_SZ RpcSs\0\0
imgsvc	REG_MULTI_SZ StiSvc\0\0
termsvcs	REG_MULTI_SZ TermService\0\0

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-04-27 12:08:19
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden services ...

HKLM\SYSTEM\CurrentControlSet\Services\NullSvc

HKLM\SYSTEM\CurrentControlSet\Services\OMCIkFwd

HKLM\SYSTEM\CurrentControlSet\Services\oseI

HKLM\SYSTEM\CurrentControlSet\Services\ParVdmr

HKLM\SYSTEM\CurrentControlSet\Services\PCIVdm

HKLM\SYSTEM\CurrentControlSet\Services\PCIIdep

HKLM\SYSTEM\CurrentControlSet\Services\PDRELIE

HKLM\SYSTEM\CurrentControlSet\Services\perc2AME

HKLM\SYSTEM\CurrentControlSet\Services\PerfNetk

HKLM\SYSTEM\CurrentControlSet\Services\PerfOSt

HKLM\SYSTEM\CurrentControlSet\Services\Processorort

HKLM\SYSTEM\CurrentControlSet\Services\PSchedtedStorage

HKLM\SYSTEM\CurrentControlSet\Services\ql1080k

HKLM\SYSTEM\CurrentControlSet\Services\ql12400

HKLM\SYSTEM\CurrentControlSet\Services\RasManp

HKLM\SYSTEM\CurrentControlSet\Services\Rasptioe

HKLM\SYSTEM\CurrentControlSet\Services\Rdbssi

HKLM\SYSTEM\CurrentControlSet\Services\RDPDDD

HKLM\SYSTEM\CurrentControlSet\Services\redbookgr

HKLM\SYSTEM\CurrentControlSet\Services\RpcLocatorstry

HKLM\SYSTEM\CurrentControlSet\Services\RpcSscator

HKLM\SYSTEM\CurrentControlSet\Services\RSVPs

HKLM\SYSTEM\CurrentControlSet\Services\SCDEmuvr

HKLM\SYSTEM\CurrentControlSet\Services\Secdrvle

HKLM\SYSTEM\CurrentControlSet\Services\senfiltn

HKLM\SYSTEM\CurrentControlSet\Services\SENSilt

HKLM\SYSTEM\CurrentControlSet\Services\Serialm

HKLM\SYSTEM\CurrentControlSet\Services\SimbadWDetection

HKLM\SYSTEM\CurrentControlSet\Services\smwdmd

HKLM\SYSTEM\CurrentControlSet\Services\Spoolerr

HKLM\SYSTEM\CurrentControlSet\Services\srLAgent$MICROSOFTBCM

HKLM\SYSTEM\CurrentControlSet\Services\Srvervice

HKLM\SYSTEM\CurrentControlSet\Services\stisvcV

HKLM\SYSTEM\CurrentControlSet\Services\SwPrvi

HKLM\SYSTEM\CurrentControlSet\Services\symc810c Core LC

HKLM\SYSTEM\CurrentControlSet\Services\SYMDNSx

HKLM\SYSTEM\CurrentControlSet\Services\SYMFWent

HKLM\SYSTEM\CurrentControlSet\Services\SYMTDIRV

HKLM\SYSTEM\CurrentControlSet\Services\TapiSrvog

HKLM\SYSTEM\CurrentControlSet\Services\Tcpiprv

HKLM\SYSTEM\CurrentControlSet\Services\TDTCPE

HKLM\SYSTEM\CurrentControlSet\Services\Themesrvice

HKLM\SYSTEM\CurrentControlSet\Services\TosIder

HKLM\SYSTEM\CurrentControlSet\Services\TSDDDs

HKLM\SYSTEM\CurrentControlSet\Services\UdfsD

HKLM\SYSTEM\CurrentControlSet\Services\UPSphost

HKLM\SYSTEM\CurrentControlSet\Services\usbhubp

HKLM\SYSTEM\CurrentControlSet\Services\ViaIdee

HKLM\SYSTEM\CurrentControlSet\Services\VSSSnap

HKLM\SYSTEM\CurrentControlSet\Services\Wanarpe

HKLM\SYSTEM\CurrentControlSet\Services\WDICAp

HKLM\SYSTEM\CurrentControlSet\Services\winmgmtnt

HKLM\SYSTEM\CurrentControlSet\Services\wscsvcrv

HKLM\SYSTEM\CurrentControlSet\Services\WZCSVCrv

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 54
hidden files: 0

********************************************************************

Completion time: 07-04-27 12:08:22 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 07-04-27 12:08


----------



## sjpritch25 (Sep 8, 2005)

We are starting to get your computer clean, however, your computer is heavily infected. So, i would recommend backing up any important data. This is just a precaution.

Please perform a scan with *Kaspersky Webscan Online Virus Scanner*
1. Click the "*Kaspersky Online Scanner*" button (*NOT* "Kaspersky File Scanner").
2. Read the Requirements and Privacy statement, then select "*Accept*".
3. A new window will appear promting you to install an ActiveX component from Kaspersky - "*Do you want to install this software*?".
4. Click "*Yes* or select "*Install*" to download the ActiveX controls that allows ActiveScan to run.
5. When the download is complete it will say ready, click "*Next*".
6. Click "*Scan Settings*" and check the option to use the *Extended Database* if available otherwise Standard).
7. Click "*Scan Options*" and select both "*Scan Archives*" and "*Scan Mail Bases*".
8. Click "*OK*".
9. Under "*Select a target to scan*", click on "*My Computer*".
10. When the scan is complete choose to save the results as "*Save as Text*" named kaspersky.txt to your desktop and post them in your next reply.

Kaspersky does not remove anything but will provide a log of anything it finds. On August 8th, 2006 Kaspersky updated the software used for _Free Online Virus Scanner_. In order to continue using the online scanner you will need to uninstall the old version (if previously used) from your Add/Remove Programs list and then install the latest version. To do this, follow the steps *here* and reboot afterwards if your system does not reboot automatically or it will show '_Kaspersky Online Scanner license key was not found!_


----------



## monkeybubbles (Apr 26, 2007)

Friday, April 27, 2007 3:04:53 PM
Operating System: Microsoft Windows XP Home Edition, (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 27/04/2007
Kaspersky Anti-Virus database records: 304746
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
C:\
D:\
E:\
Scan Statistics
Total number of scanned objects 26080
Number of viruses found 43
Number of infected objects 302
Number of suspicious objects 0
Duration of the scan process 00:26:43

Infected Object Name Virus Name Last Action
C:\an.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\b1m4g5i5w4j4.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temp\0362.exe Infected: Trojan-Proxy.Win32.Small.du skipped
C:\Documents and Settings\Owner\Local Settings\Temp\2712.exe Infected: Trojan-Proxy.Win32.Small.du skipped
C:\Documents and Settings\Owner\Local Settings\Temp\ma1x1dd1.game Infected: not-a-virusorn-Dialer.Win32.GBDialer.i skipped
C:\Documents and Settings\Owner\Local Settings\Temp\winlogon.exe Infected: Trojan-Proxy.Win32.Small.du skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\67Q9ATUV\dqvqhrm[1].txt Infected: Trojan.Win32.Agent.akc skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\FG83YW61\ooixlyb[1].htm Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\FG83YW61\qqrmdlgo[1].htm Infected: Trojan-Proxy.Win32.Dlena.ce skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\GH0JKL4N\tfxddnbby[1].htm Infected: Trojan-Downloader.Win32.Small.cwj skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\Q9SBCDEX\stkck[1].htm Infected: Trojan-Proxy.Win32.Small.du skipped
C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped
C:\gxmjvvbv.exe Infected: Trojan-Downloader.Win32.Small.cwj skipped
C:\igmcxjwe.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\Program Files\Common Files\delsim\del.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\augueook.dll.vir Infected: Packed.Win32.Klone.j skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ddcawuv.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ejprpqwt.dll.vir Infected: not-a-virus:AdWare.Win32.BHO.v skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\eudtqjxi.dll.vir Infected: Packed.Win32.Klone.j skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\evnaydmf.dll.vir Infected: not-a-virus:AdWare.Win32.BHO.v skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\fklzcugw.exe.vir Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\iglgpgxv.dll.vir Infected: Packed.Win32.Klone.j skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\jfaeewks.dll.vir Infected: not-a-virus:AdWare.Win32.BHO.v skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\max1d1641.exe.vir Infected: not-a-virusorn-Dialer.Win32.GBDialer.i skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mcjsdwmt.dll.vir Infected: not-a-virus:AdWare.Win32.BHO.v skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\motsvonw.dll.vir Infected: not-a-virus:AdWare.Win32.BHO.v skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\nnnnmmm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ouxuqikv.dll.vir Infected: not-a-virus:AdWare.Win32.BHO.v skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\owjrojwa.dll.vir Infected: Packed.Win32.Klone.j skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\rpcc.dll.vir Infected: Trojan-Proxy.Win32.Dlena.ce skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ukuiucgq.dll.vir Infected: not-a-virus:AdWare.Win32.BHO.v skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vwyreekt.exe.vir Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\wghyomwq.dll.vir Infected: Packed.Win32.Klone.j skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\yrvurpsh.dll.vir Infected: Packed.Win32.Klone.j skipped
C:\SDFix\backups_old1\gxmjvvbv.exe Infected: Trojan-Downloader.Win32.Small.cwj skipped
C:\SDFix\backups_old1\iexplore.exe Infected: Backdoor.Win32.VanBot.ay skipped
C:\SDFix\backups_old1\max1d1641.exe Infected: not-a-virusorn-Dialer.Win32.GBDialer.i skipped
C:\SDFix\backups_old1\rpcc.dll Infected: Trojan-Proxy.Win32.Dlena.ce skipped
C:\SDFix\backups_old1\tcpipmon.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\SDFix\backups_old1\winIogon.exe Infected: Backdoor.Win32.VanBot.ax skipped
C:\SDFix\backups_old1\winlogon.exe Infected: Trojan-Proxy.Win32.Small.du skipped
C:\SDFix\backups_old4\dllisp.exe Infected: Backdoor.Win32.SdBot.aad skipped
C:\SDFix\backups_old4\explorer.exe Infected: Backdoor.Win32.VanBot.ax skipped
C:\SDFix\backups_old4\gxmjvvbv.exe Infected: Trojan-Downloader.Win32.Small.cwj skipped
C:\SDFix\backups_old4\i Infected: Trojan-Downloader.BAT.Ftp.ab skipped
C:\SDFix\backups_old4\loader.exe Infected: not-virus:Hoax.Win32.Renos.dk skipped
C:\SDFix\backups_old4\max1d1641.exe Infected: not-a-virusorn-Dialer.Win32.GBDialer.i skipped
C:\SDFix\backups_old4\rpcc.dll Infected: Trojan-Proxy.Win32.Dlena.e skipped
C:\SDFix\backups_old4\tcpipmon.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\SDFix\backups_old4\uvnx.exe Infected: Trojan-Downloader.Win32.Agent.axs skipped
C:\SDFix\backups_old4\winIogon.exe Infected: Backdoor.Win32.Rbot.bwk skipped
C:\SDFix\backups_old4\winlogon.exe Infected: Trojan-Proxy.Win32.Small.du skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP5\A0007204.exe Infected: Backdoor.Win32.Agent.act skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP5\A0007217.exe Infected: Backdoor.Win32.Agent.act skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP5\A0007273.exe Infected: Backdoor.Win32.Agent.act skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP5\A0007298.exe Infected: Backdoor.Win32.Agent.act skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP5\A0007394.exe Infected: Backdoor.Win32.Agent.act skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009476.exe Infected: Backdoor.Win32.Agent.act skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009481.exe Infected: Trojan.Win32.VB.azo skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009482.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009483.exe Infected: Backdoor.Win32.SdBot.aad skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009484.exe Infected: not-virus:Hoax.Win32.Renos.dk skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009485.exe Infected: Backdoor.Win32.SdBot.xd skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009486.exe Infected: Net-Worm.Win32.Agent.d skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009487.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009488.exe Infected: Trojan-Downloader.Win32.Small.edb skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009489.exe Infected: Backdoor.Win32.SdBot.aad skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009490.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ih skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009491.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009492.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009493.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ih skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009494.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009495.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009497.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009498.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009499.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009500.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009501.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009502.exe Infected: Trojan-Downloader.Win32.Small.edb skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009503.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009504.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009505.exe Infected: not-virus:Hoax.Win32.Renos.fn skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009506.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009507.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009508.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009509.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009510.dll Infected: Backdoor.Win32.Agent.fo skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009511.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009512.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ih skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009513.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ih skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009514.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009516.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ih skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009517.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009518.exe Infected: Trojan-Downloader.Win32.Small.edb skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009519.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009520.exe Infected: Backdoor.Win32.IRCBot.ye skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009521.exe Infected: not-a-virusorn-Dialer.Win32.GBDialer.i skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009522.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009523.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009524.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009525.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009526.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009527.sys Infected: SpamTool.Win32.Agent.s skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009528.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009529.dll Infected: Backdoor.Win32.Agent.fo skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009530.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ih skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009531.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009532.exe Infected: Trojan-Downloader.Win32.Small.edb skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009533.exe Infected: Net-Worm.Win32.Agent.d skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009535.exe Infected: Backdoor.Win32.PoeBot.c skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009536.dll Infected: Backdoor.Win32.Agent.fo skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009537.exe Infected: Trojan-Downloader.Win32.Small.edb skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009538.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ih skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009539.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ih skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009540.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009541.exe Infected: Backdoor.Win32.SdBot.xd skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009542.exe Infected: Backdoor.Win32.SdBot.xd skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009543.exe Infected: Backdoor.Win32.SdBot.xd skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009544.exe Infected: Trojan-Downloader.Win32.Small.edb skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009545.exe Infected: Backdoor.Win32.VanBot.ax skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009546.exe Infected: Trojan.Win32.Agent.kq skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009547.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009548.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009549.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009551.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009552.exe Infected: Trojan-Downloader.Win32.VB.avl skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009553.dll Infected: Trojan-Downloader.Win32.VB.asx skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009554.exe Infected: Trojan-Downloader.Win32.Agent.axs skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009555.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ih skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009557.exe Infected: Backdoor.Win32.PoeBot.c skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009558.exe Infected: Backdoor.Win32.Rbot.buj skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009559.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ih skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009560.exe Infected: Trojan-Downloader.Win32.Small.edb skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009561.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP6\A0009562.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009592.exe Infected: Backdoor.Win32.VanBot.ax skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009594.exe Infected: Trojan-Downloader.Win32.Small.cwj skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009597.exe Infected: Trojan-Downloader.Win32.Agent.axs skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009598.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009599.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009600.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009603.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009604.exe Infected: not-a-virusialer.Win32.Agent.b skipped


----------



## monkeybubbles (Apr 26, 2007)

C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009612.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009617.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009623.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009624.exe Infected: Trojan-Downloader.Win32.Small.cwj skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009625.exe Infected: Trojan-Downloader.Win32.Agent.axs skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009626.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009634.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009639.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009646.exe Infected: Trojan-Downloader.Win32.Agent.axs skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0009647.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0010628.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0010636.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0010642.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0010646.exe Infected: Trojan-Downloader.Win32.Small.cwj skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0010652.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0011634.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0011639.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0013653.exe Infected: Trojan-Downloader.Win32.Small.cwj skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0013657.exe Infected: Backdoor.Win32.SdBot.aad skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0013658.exe Infected: not-virus:Hoax.Win32.Renos.dk skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0013659.exe Infected: Backdoor.Win32.VanBot.ax skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0013660.exe Infected: not-a-virusorn-Dialer.Win32.GBDialer.i skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0013661.dll Infected: Trojan-Proxy.Win32.Dlena.e skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0013663.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0013664.exe Infected: Trojan-Downloader.Win32.Agent.axs skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0013665.exe Infected: Backdoor.Win32.Rbot.bwk skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017696.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017697.dll Infected: Packed.Win32.Klone.j skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017698.dll Infected: Packed.Win32.Klone.j skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017699.dll Infected: Packed.Win32.Klone.j skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017700.dll Infected: Packed.Win32.Klone.j skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017701.dll Infected: Packed.Win32.Klone.j skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017702.dll Infected: Packed.Win32.Klone.j skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017704.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017705.dll Infected: not-a-virus:AdWare.Win32.BHO.v skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017706.dll Infected: not-a-virus:AdWare.Win32.BHO.v skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017707.dll Infected: not-a-virus:AdWare.Win32.BHO.v skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017708.dll Infected: not-a-virus:AdWare.Win32.BHO.v skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017709.dll Infected: not-a-virus:AdWare.Win32.BHO.v skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017710.dll Infected: not-a-virus:AdWare.Win32.BHO.v skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017711.dll Infected: not-a-virus:AdWare.Win32.BHO.v skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017716.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.il skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017751.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017752.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017756.exe Infected: Trojan-Dropper.Win32.Small.avb skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017757.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017758.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017759.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017760.exe Infected: Trojan-Proxy.Win32.Small.du skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017801.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017806.exe Infected: Trojan-Dropper.Win32.Small.avb skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017808.exe Infected: Trojan-Downloader.Win32.Small.cwj skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017809.exe Infected: Backdoor.Win32.VanBot.ay skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017810.exe Infected: not-a-virusorn-Dialer.Win32.GBDialer.i skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017811.dll Infected: Trojan-Proxy.Win32.Dlena.ce skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017812.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0017813.exe Infected: Backdoor.Win32.VanBot.ax skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0018866.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0018867.exe Infected: Trojan-Downloader.Win32.Small.cwj skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0018868.exe Infected: Trojan-Dropper.Win32.Small.avb skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0018869.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0018870.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0018872.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0018876.exe Infected: Trojan-Dropper.Win32.Small.avb skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0022896.exe Infected: not-a-virusorn-Dialer.Win32.GBDialer.i skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0022897.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0022901.dll Infected: Trojan-Proxy.Win32.Dlena.ce skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0023972.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0023973.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0023977.exe Infected: not-a-virusialer.Win32.Agent.b skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0023984.exe Infected: Trojan-Downloader.Win32.Small.cwj skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0023985.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0023986.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0023987.exe Infected: Backdoor.Win32.PoeBot.c skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\A0023988.dll Infected: Trojan-Proxy.Win32.Dlena.ce skipped
C:\System Volume Information\_restore{FF1DA220-8F5A-4F0A-99F6-8D4D58F7DF55}\RP7\change.log Object is locked skipped
C:\vdspxeje.exe Infected: Trojan-Downloader.Win32.Small.cwj skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\DHCP.EXE Infected: Backdoor.Win32.SdBot.aad skipped
C:\WINDOWS\dllisp.exe Infected: Backdoor.Win32.SdBot.aad skipped
C:\WINDOWS\sysrlb32.exe Infected: Trojan.Win32.VB.azo skipped
C:\WINDOWS\system32\afgeowle.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\awtsrol.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\awvttsp.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\awvvvwt.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\azfaadik.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\bkxzq.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\cgxtoi.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\csrs.exe Infected: Backdoor.Win32.VanBot.ax skipped
C:\WINDOWS\system32\cursb.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\ddcyvtr.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\ddcywur.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\ddcywwt.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\deibgcdw.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\drhyu.exe Infected: Trojan-Downloader.Win32.ConHook.ah skipped
C:\WINDOWS\system32\eehou.exe Infected: Trojan-Downloader.Win32.ConHook.ah skipped
C:\WINDOWS\system32\fgrntpd.exe Infected: Trojan-Downloader.Win32.ConHook.ah skipped
C:\WINDOWS\system32\fhcy.exe Infected: Trojan-Downloader.Win32.ConHook.ah skipped
C:\WINDOWS\system32\fqbkl.exe Infected: Trojan-Downloader.Win32.ConHook.ah skipped
C:\WINDOWS\system32\gebcdda.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\gebyxwu.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\geebaxv.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\ghgakw.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\gvwa.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\hoxn.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\huht.exe Infected: Trojan-Downloader.Win32.ConHook.ah skipped
C:\WINDOWS\system32\i Infected: Trojan-Downloader.BAT.Ftp.ab skipped
C:\WINDOWS\system32\ioiwyjy.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\jkhfeba.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\jkhhfdd.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\jkkljji.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\jrfc32.dll Infected: Backdoor.Win32.Agent.fo skipped
C:\WINDOWS\system32\kfmylalv.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\kiyga.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\kuq.exe Infected: Backdoor.Win32.SdBot.aad skipped
C:\WINDOWS\system32\lssas.exe Infected: Backdoor.Win32.VanBot.ax skipped
C:\WINDOWS\system32\max1d1641.exe Infected: not-a-virusorn-Dialer.Win32.GBDialer.i skipped
C:\WINDOWS\system32\mljgffc.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\mljjhif.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\mljjigd.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\mllmkkh.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\mogwp.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\msnhlp32.dll Infected: Trojan-Downloader.Win32.VB.apq skipped
C:\WINDOWS\system32\niby.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\nmbfx32.dll Infected: Backdoor.Win32.Agent.fo skipped
C:\WINDOWS\system32\ntio256.sys Infected: Rootkit.Win32.Agent.cf skipped
C:\WINDOWS\system32\ntrq.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\omnpcy.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\pmkheba.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\pmkjjjg.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\pmnllmj.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\pmnlmmj.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\protector.exe Infected: Trojan-Proxy.Win32.Wopla.ac skipped
C:\WINDOWS\system32\pvoawe.exe Infected: Trojan-Downloader.Win32.ConHook.ah skipped
C:\WINDOWS\system32\qutqykhu.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\qwbre.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\rku.exe Infected: Backdoor.Win32.SdBot.aad skipped
C:\WINDOWS\system32\rpcc.dll Object is locked skipped
C:\WINDOWS\system32\rvgdgyo.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\sbsqbr32.dll Infected: Backdoor.Win32.Agent.fo skipped
C:\WINDOWS\system32\servics3.exe Infected: Backdoor.Win32.Agent.act skipped
C:\WINDOWS\system32\servics7.exe Infected: Backdoor.Win32.Agent.act skipped
C:\WINDOWS\system32\sfk.exe Infected: Backdoor.Win32.SdBot.aad skipped
C:\WINDOWS\system32\sstqpnn.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\sxtlscb.exe Infected: Trojan-Downloader.Win32.ConHook.ah skipped
C:\WINDOWS\system32\tamvqxtw.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped
C:\WINDOWS\system32\tcpipmon.exe Infected: Trojan-Clicker.Win32.Agent.is skipped
C:\WINDOWS\system32\tftemgiz.exe Infected: Backdoor.Win32.VanBot.ax skipped
C:\WINDOWS\system32\tsjpf32.dll Infected: Backdoor.Win32.Agent.fo skipped
C:\WINDOWS\system32\user_32.dll Infected: Trojan-Downloader.Win32.VB.asx skipped
C:\WINDOWS\system32\vfyjg.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\vgpwol.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\vkkniv.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\vtsqnnk.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\vtutrom.dll Infected: Packed.Win32.Klone.k skipped
C:\WINDOWS\system32\vybqgv.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\winamp.exe Infected: Backdoor.Win32.VanBot.ax skipped
C:\WINDOWS\system32\wtli.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\xjchgu.exe Infected: Backdoor.Win32.VanBot.ax skipped
C:\WINDOWS\system32\yjwbon.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\ythcsrn.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\zcnq32.dll Infected: Backdoor.Win32.Agent.fo skipped
C:\WINDOWS\system32\zmle.exe Infected: Backdoor.Win32.Rbot.bwk skipped
Scan process completed.


----------



## sjpritch25 (Sep 8, 2005)

Please printout my instructions because you will need to close all open programs!!!!! Thanks

In the following quote, please copy (Ctrl+C) and Paste (Ctrl+V) the text in Notepad. Save it as *All Files* and name it *ServicesFix.bat*. Save it to your Desktop.


> @echo off
> sc stop DHCP Clients
> sc delete DHCP Clients
> exit


Doubleclick on *ServicesFix.bat*. It will open and close quickly. That is normal.

========================================

Run HijackThis, and press "Do a System Scan Only". 
1. When the scan is complete place a check mark next to the following entries:
*
O2 - BHO: (no name) - {00000026-8735-428D-B81F-DD098223B25F} - (no file)
O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file)
O2 - BHO: (no name) - {000006b1-19b5-414a-849f-2a3c64ae6939} - (no file)
O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file)
O2 - BHO: (no name) - {2265EED7-6022-4d6c-ADF2-E932FEFD433C} - (no file)
O2 - BHO: (no name) - {30000273-8230-4dd4-be4f-6889d1e74167} - (no file)
O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file)
O2 - BHO: (no name) - {4e7bd74f-2b8d-469e-92c6-ce7eb590a94d} - (no file)
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
O2 - BHO: (no name) - {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file)
O2 - BHO: (no name) - {9DED2B32-743B-47EB-874C-28AECF2A268D} - (no file)
O2 - BHO: IE Assistant - {B08D32DE-64B2-4137-8345-87293E70D40B} - C:\WINDOWS\System32\iea.dll
O2 - BHO: (no name) - {B4409DDA-13BD-4AC7-96F5-54F14E0ED61c} - C:\WINDOWS\System32\augueook.dll (file missing)
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: (no name) - {D46E6398-D6EE-489C-81F3-5A9C7ADBC3C2} - C:\WINDOWS\System32\ddcawuv.dll (file missing)
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\System32\pdwcdasg.dll (file missing)
O2 - BHO: msnhlp32.msn_hlp - {EEFBE5D6-FEFF-4CB4-AA26-6A464090CB89} - C:\WINDOWS\System32\msnhlp32.dll
O2 - BHO: (no name) - {F621B5FB-6E1E-4D0E-B88C-34B4775537B5} - C:\WINDOWS\System32\augueook.dll (file missing)
O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
*
2. After checking these items CLOSE ALL open windows EXCEPT HijackThis and click "Fix Checked."

=================================================

Download *OTMoveIt* by OldTimer and save to your Desktop.
Double-click on *OTMoveIt.exe* to launch the program.
Please copy the file(s)/folder(s) paths listed below - _highlight everything in red and press CTRL+C or right-click and choose *Copy*_.

*C:\an.exe
C:\b1m4g5i5w4j4.exe
C:\Documents and Settings\Owner\Local Settings\Temp\0362.exe
C:\Documents and Settings\Owner\Local Settings\Temp\2712.exe
C:\Documents and Settings\Owner\Local Settings\Temp\winlogon.exe
C:\gxmjvvbv.exe
C:\igmcxjwe.exe
C:\Program Files\Common Files\delsim\del.exe
C:\vdspxeje.exe
C:\WINDOWS\DHCP.EXE
C:\WINDOWS\dllisp.exe
C:\WINDOWS\sysrlb32.exe
C:\WINDOWS\system32\afgeowle.exe
C:\WINDOWS\system32\awtsrol.dll
C:\WINDOWS\system32\awvttsp.dll 
C:\WINDOWS\system32\awvvvwt.dll
C:\WINDOWS\system32\azfaadik.exe
C:\WINDOWS\system32\bkxzq.exe
C:\WINDOWS\system32\cgxtoi.exe
C:\WINDOWS\system32\csrs.exe
C:\WINDOWS\system32\cursb.exe
C:\WINDOWS\system32\ddcyvtr.dll
C:\WINDOWS\system32\ddcywur.dll
C:\WINDOWS\system32\ddcywwt.dll
C:\WINDOWS\system32\deibgcdw.exe
C:\WINDOWS\system32\drhyu.exe
C:\WINDOWS\system32\eehou.exe
C:\WINDOWS\system32\fgrntpd.exe
C:\WINDOWS\system32\fhcy.exe
C:\WINDOWS\system32\fqbkl.exe
C:\WINDOWS\system32\gebcdda.dll
C:\WINDOWS\system32\gebyxwu.dll
C:\WINDOWS\system32\geebaxv.dll 
C:\WINDOWS\system32\ghgakw.exe
C:\WINDOWS\system32\gvwa.exe
C:\WINDOWS\system32\hoxn.exe
C:\WINDOWS\system32\huht.exe
C:\WINDOWS\system32\ioiwyjy.exe
C:\WINDOWS\system32\jkhfeba.dll 
C:\WINDOWS\system32\jkhhfdd.dll
C:\WINDOWS\system32\jkkljji.dll
C:\WINDOWS\system32\jrfc32.dll
C:\WINDOWS\system32\kfmylalv.exe
C:\WINDOWS\system32\kiyga.exe
C:\WINDOWS\system32\kuq.exe
C:\WINDOWS\system32\lssas.exe
C:\WINDOWS\system32\max1d1641.exe
C:\WINDOWS\system32\mljgffc.dll
C:\WINDOWS\system32\mljjhif.dll
C:\WINDOWS\system32\mljjigd.dll
C:\WINDOWS\system32\mllmkkh.dll 
C:\WINDOWS\system32\mogwp.exe
C:\WINDOWS\system32\msnhlp32.dll
C:\WINDOWS\system32\niby.exe
C:\WINDOWS\system32\nmbfx32.dll
C:\WINDOWS\system32\ntio256.sys
C:\WINDOWS\system32\ntrq.exe
C:\WINDOWS\system32\omnpcy.exe
C:\WINDOWS\system32\pmkheba.dll
C:\WINDOWS\system32\pmkjjjg.dll
C:\WINDOWS\system32\pmnllmj.dll
C:\WINDOWS\system32\pmnlmmj.dll
C:\WINDOWS\system32\protector.exe
C:\WINDOWS\system32\pvoawe.exe
C:\WINDOWS\system32\qutqykhu.exe
C:\WINDOWS\system32\qwbre.exe
C:\WINDOWS\system32\rku.exe
C:\WINDOWS\system32\rpcc.dll
C:\WINDOWS\system32\rvgdgyo.exe
C:\WINDOWS\system32\sbsqbr32.dll
C:\WINDOWS\system32\servics3.exe
C:\WINDOWS\system32\servics7.exe
C:\WINDOWS\system32\sfk.exe
C:\WINDOWS\system32\sstqpnn.dll
C:\WINDOWS\system32\sxtlscb.exe
C:\WINDOWS\system32\tamvqxtw.dll
C:\WINDOWS\system32\tcpipmon.exe
C:\WINDOWS\system32\tftemgiz.exe
C:\WINDOWS\system32\tsjpf32.dll
C:\WINDOWS\system32\user_32.dll
C:\WINDOWS\system32\vfyjg.exe
C:\WINDOWS\system32\vgpwol.exe
C:\WINDOWS\system32\vkkniv.exe
C:\WINDOWS\system32\vtsqnnk.dll
C:\WINDOWS\system32\vtutrom.dll 
C:\WINDOWS\system32\vybqgv.exe
C:\WINDOWS\system32\winamp.exe
C:\WINDOWS\system32\wtli.exe
C:\WINDOWS\system32\xjchgu.exe
C:\WINDOWS\system32\yjwbon.exe
C:\WINDOWS\system32\ythcsrn.exe
C:\WINDOWS\system32\zcnq32.dll
C:\WINDOWS\system32\zmle.exe*

Then in OTMoveIt, _right-click in the open text box labeled_ "*Paste List of Files/Folders to be Moved*" _and choose *Paste*_.
Click the red *MoveIt!* button.
The list will be processed and the results for each line will be displayed in the right-hand pane.
Highlight everything in the *Results* window, _press CTRL+C or right-click, choose *Copy*, right-click again_ and *Paste* it in your next reply.
Close the program when done.
_*Important!*_ _If a file or folder cannot be moved immediately you may be asked to reboot your computer in order to finish the move process. If asked to reboot, choose *Yes*._

===============================================

Please download *ATF Cleaner* by Atribune.

*This program is for XP and Windows 2000 only*


Save it to your desktop

Double-click *ATF-Cleaner.exe* to run the program.

Under *Main* choose: *Select All*

Click the *Empty Selected* button.

If you use Firefox browser
Click *Firefox* at the top and choose: *Select All*

Click the *Empty Selected* button.

*NOTE:* If you would like to keep your saved passwords, please click *No* at the prompt.

If you use Opera browser
Click *Opera* at the top and choose: *Select All*

Click the *Empty Selected* button.

*NOTE:* If you would like to keep your saved passwords, please click *No* at the prompt.

Click *Exit* on the Main menu to close the program.

For *Technical Support*, double-click the e-mail address located at the bottom of each menu.

================================================

Download GMER's application from here:
http://www.majorgeeks.com/GMER_d5198.html
Unzip it and start the *GMER.exe*
Click the *Rootkit* tab and click the *Scan* button.
Once done, click the *Copy* button.
This will copy the results to your clipboard.
Paste the results in your next reply.
Warning ! Please, do not select the "Show all" checkbox during the scan.

If you're having problems with running GMER.exe, try it in safe mode.

===============================================

Run GMER again, but click on *<<<* (to expand the scans) and click on *AutoStart*. Click on *Scan* and post the results. Thanks.


----------



## monkeybubbles (Apr 26, 2007)

can i run the hijack this and find the files i need in safemode?


----------



## sjpritch25 (Sep 8, 2005)

yes you can. Can you boot into Normal mode???? If not, please let me know. Thanks.


----------



## monkeybubbles (Apr 26, 2007)

I can't boot in normal mode a blue screen pops up saying that there are infections on my computer and to make it so the computer doesn't get damaged the computer will shut down.


----------



## monkeybubbles (Apr 26, 2007)

C:\an.exe moved successfully.
C:\b1m4g5i5w4j4.exe moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\0362.exe moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\2712.exe moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\winlogon.exe moved successfully.
C:\gxmjvvbv.exe moved successfully.
C:\igmcxjwe.exe moved successfully.
C:\Program Files\Common Files\delsim\del.exe moved successfully.
C:\vdspxeje.exe moved successfully.
C:\WINDOWS\DHCP.EXE moved successfully.
C:\WINDOWS\dllisp.exe moved successfully.
C:\WINDOWS\sysrlb32.exe moved successfully.
C:\WINDOWS\system32\afgeowle.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\awtsrol.dll
C:\WINDOWS\system32\awtsrol.dll NOT unregistered.
C:\WINDOWS\system32\awtsrol.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\awvttsp.dll
C:\WINDOWS\system32\awvttsp.dll NOT unregistered.
C:\WINDOWS\system32\awvttsp.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\awvvvwt.dll
C:\WINDOWS\system32\awvvvwt.dll NOT unregistered.
C:\WINDOWS\system32\awvvvwt.dll moved successfully.
C:\WINDOWS\system32\azfaadik.exe moved successfully.
C:\WINDOWS\system32\bkxzq.exe moved successfully.
C:\WINDOWS\system32\cgxtoi.exe moved successfully.
C:\WINDOWS\system32\csrs.exe moved successfully.
C:\WINDOWS\system32\cursb.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ddcyvtr.dll
C:\WINDOWS\system32\ddcyvtr.dll NOT unregistered.
C:\WINDOWS\system32\ddcyvtr.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ddcywur.dll
C:\WINDOWS\system32\ddcywur.dll NOT unregistered.
C:\WINDOWS\system32\ddcywur.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ddcywwt.dll
C:\WINDOWS\system32\ddcywwt.dll NOT unregistered.
C:\WINDOWS\system32\ddcywwt.dll moved successfully.
C:\WINDOWS\system32\deibgcdw.exe moved successfully.
C:\WINDOWS\system32\drhyu.exe moved successfully.
C:\WINDOWS\system32\eehou.exe moved successfully.
C:\WINDOWS\system32\fgrntpd.exe moved successfully.
C:\WINDOWS\system32\fhcy.exe moved successfully.
C:\WINDOWS\system32\fqbkl.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\gebcdda.dll
C:\WINDOWS\system32\gebcdda.dll NOT unregistered.
C:\WINDOWS\system32\gebcdda.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\gebyxwu.dll
C:\WINDOWS\system32\gebyxwu.dll NOT unregistered.
C:\WINDOWS\system32\gebyxwu.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\geebaxv.dll
C:\WINDOWS\system32\geebaxv.dll NOT unregistered.
C:\WINDOWS\system32\geebaxv.dll moved successfully.
C:\WINDOWS\system32\ghgakw.exe moved successfully.
C:\WINDOWS\system32\gvwa.exe moved successfully.
C:\WINDOWS\system32\hoxn.exe moved successfully.
C:\WINDOWS\system32\huht.exe moved successfully.
C:\WINDOWS\system32\ioiwyjy.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\jkhfeba.dll
C:\WINDOWS\system32\jkhfeba.dll NOT unregistered.
C:\WINDOWS\system32\jkhfeba.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\jkhhfdd.dll
C:\WINDOWS\system32\jkhhfdd.dll NOT unregistered.
C:\WINDOWS\system32\jkhhfdd.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\jkkljji.dll
C:\WINDOWS\system32\jkkljji.dll NOT unregistered.
C:\WINDOWS\system32\jkkljji.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\jrfc32.dll
C:\WINDOWS\system32\jrfc32.dll NOT unregistered.
C:\WINDOWS\system32\jrfc32.dll moved successfully.
C:\WINDOWS\system32\kfmylalv.exe moved successfully.
C:\WINDOWS\system32\kiyga.exe moved successfully.
C:\WINDOWS\system32\kuq.exe moved successfully.
File move failed. C:\WINDOWS\system32\lssas.exe scheduled to be moved on reboot.
C:\WINDOWS\system32\max1d1641.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\mljgffc.dll
C:\WINDOWS\system32\mljgffc.dll NOT unregistered.
C:\WINDOWS\system32\mljgffc.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\mljjhif.dll
C:\WINDOWS\system32\mljjhif.dll NOT unregistered.
C:\WINDOWS\system32\mljjhif.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\mljjigd.dll
C:\WINDOWS\system32\mljjigd.dll NOT unregistered.
C:\WINDOWS\system32\mljjigd.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\mllmkkh.dll
C:\WINDOWS\system32\mllmkkh.dll NOT unregistered.
C:\WINDOWS\system32\mllmkkh.dll moved successfully.
C:\WINDOWS\system32\mogwp.exe moved successfully.
C:\WINDOWS\system32\msnhlp32.dll unregistered successfully.
C:\WINDOWS\system32\msnhlp32.dll moved successfully.
C:\WINDOWS\system32\niby.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\nmbfx32.dll
C:\WINDOWS\system32\nmbfx32.dll NOT unregistered.
C:\WINDOWS\system32\nmbfx32.dll moved successfully.
C:\WINDOWS\system32\ntio256.sys moved successfully.
C:\WINDOWS\system32\ntrq.exe moved successfully.
C:\WINDOWS\system32\omnpcy.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\pmkheba.dll
C:\WINDOWS\system32\pmkheba.dll NOT unregistered.
C:\WINDOWS\system32\pmkheba.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\pmkjjjg.dll
C:\WINDOWS\system32\pmkjjjg.dll NOT unregistered.
C:\WINDOWS\system32\pmkjjjg.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\pmnllmj.dll
C:\WINDOWS\system32\pmnllmj.dll NOT unregistered.
C:\WINDOWS\system32\pmnllmj.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\pmnlmmj.dll
C:\WINDOWS\system32\pmnlmmj.dll NOT unregistered.
C:\WINDOWS\system32\pmnlmmj.dll moved successfully.
C:\WINDOWS\system32\protector.exe moved successfully.
C:\WINDOWS\system32\pvoawe.exe moved successfully.
C:\WINDOWS\system32\qutqykhu.exe moved successfully.
C:\WINDOWS\system32\qwbre.exe moved successfully.
C:\WINDOWS\system32\rku.exe moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\rpcc.dll
C:\WINDOWS\system32\rpcc.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\rpcc.dll scheduled to be moved on reboot.
C:\WINDOWS\system32\rvgdgyo.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\sbsqbr32.dll
C:\WINDOWS\system32\sbsqbr32.dll NOT unregistered.
C:\WINDOWS\system32\sbsqbr32.dll moved successfully.
C:\WINDOWS\system32\servics3.exe moved successfully.
C:\WINDOWS\system32\servics7.exe moved successfully.
C:\WINDOWS\system32\sfk.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\sstqpnn.dll
C:\WINDOWS\system32\sstqpnn.dll NOT unregistered.
C:\WINDOWS\system32\sstqpnn.dll moved successfully.
C:\WINDOWS\system32\sxtlscb.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\tamvqxtw.dll
C:\WINDOWS\system32\tamvqxtw.dll NOT unregistered.
C:\WINDOWS\system32\tamvqxtw.dll moved successfully.
C:\WINDOWS\system32\tcpipmon.exe moved successfully.
C:\WINDOWS\system32\tftemgiz.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\tsjpf32.dll
C:\WINDOWS\system32\tsjpf32.dll NOT unregistered.
C:\WINDOWS\system32\tsjpf32.dll moved successfully.
C:\WINDOWS\system32\user_32.dll unregistered successfully.
C:\WINDOWS\system32\user_32.dll moved successfully.
C:\WINDOWS\system32\vfyjg.exe moved successfully.
C:\WINDOWS\system32\vgpwol.exe moved successfully.
C:\WINDOWS\system32\vkkniv.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\vtsqnnk.dll
C:\WINDOWS\system32\vtsqnnk.dll NOT unregistered.
C:\WINDOWS\system32\vtsqnnk.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\vtutrom.dll
C:\WINDOWS\system32\vtutrom.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\vtutrom.dll scheduled to be moved on reboot.
C:\WINDOWS\system32\vybqgv.exe moved successfully.
C:\WINDOWS\system32\winamp.exe moved successfully.
C:\WINDOWS\system32\wtli.exe moved successfully.
C:\WINDOWS\system32\xjchgu.exe moved successfully.
C:\WINDOWS\system32\yjwbon.exe moved successfully.
C:\WINDOWS\system32\ythcsrn.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\zcnq32.dll
C:\WINDOWS\system32\zcnq32.dll NOT unregistered.
C:\WINDOWS\system32\zcnq32.dll moved successfully.
C:\WINDOWS\system32\zmle.exe moved successfully.

Created on 04/28/2007 15:10:14


----------



## monkeybubbles (Apr 26, 2007)

the gmer doesn't run. i click ok and it closes only and that's in safe mode.


----------



## sjpritch25 (Sep 8, 2005)

Monkeybubbles said:


> the gmer doesn't run. i click ok and it closes only and that's in safe mode.


Did you install GMER in Normal Mode???? Then installer will probably not run in Safe Mode.

Know that we have moved those files, could you try booting into Normal mode. Let me know what happens.


----------



## monkeybubbles (Apr 26, 2007)

I have rebooted my computer in normal mode and i have no icons nothing. just a blank screen with my screen image on it.


----------



## monkeybubbles (Apr 26, 2007)

same with safe mode. now i have nothing but a black screen


----------



## monkeybubbles (Apr 26, 2007)

sorry, ignore last 2 posts. after rebooting a couple times it now works.


----------



## sjpritch25 (Sep 8, 2005)

Okay, please try and run GMER.exe. Post the results. Thanks. hang in there you are doing a great job!!!! :up:


----------



## monkeybubbles (Apr 26, 2007)

do you want two copies of the gmer results one regular then one expanded?


----------



## monkeybubbles (Apr 26, 2007)

my computer keeps on getting shut down my NT Authority system before the gmer finishes.


----------



## sjpritch25 (Sep 8, 2005)

Try running it in Safe Mode.


----------



## monkeybubbles (Apr 26, 2007)

it ran but unfortunately my internet in normal mode would not open and the computer freezes programs when i try to save it in notebook.


----------



## monkeybubbles (Apr 26, 2007)

GMER 1.0.12.12244 - http://www.gmer.net
Rootkit scan 2007-04-29 15:26:51
Windows 5.1.2600 Service Pack 1

---- System - GMER 1.0.12 ----

SSDT 81EC06D8 ZwConnectPort

---- Devices - GMER 1.0.12 ----

Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [F8A3D85A] avgtdi.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_INTERNAL_DEVICE_CONTROL [F8A3D85A] avgtdi.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [F8A3D85A] avgtdi.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [F8A3D85A] avgtdi.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [F8A3D85A] avgtdi.sys
Device \FileSystem\Fastfat \Fat FastIoCheckIfPossible EE5BA9C6
Device \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP EE5A3F94
Device \FileSystem\Fastfat \Fat IRP_MJ_CLOSE EE5A41BD
Device \FileSystem\Fastfat \Fat IRP_MJ_CREATE EE5A4143
Device \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL EE5B5526
Device \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL EE5A66C8
Device \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL EE5A390C
Device \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS EE5B5D7B
Device \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL EE5BE996
Device \FileSystem\Fastfat \Fat IRP_MJ_PNP EE5AD411
Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA EE5B8AC6
Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION EE5A4E1E
Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION EE5A4B3F
Device \FileSystem\Fastfat \Fat IRP_MJ_READ EE5A08A5
Device \FileSystem\Fastfat \Fat IRP_MJ_SET_EA EE5B849A
Device \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION EE5A8081
Device \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION EE5BFCCC
Device \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN EE5BF219
Device \FileSystem\Fastfat \Fat IRP_MJ_WRITE EE5A0627

---- Kernel code sections - GMER 1.0.12 ----

.text ntoskrnl.exe!KeI386Call16BitCStyleFunction + 188 80502604 4 Bytes [ D8, 06, EC, 81 ]
.text ntoskrnl.exe!KeInitializeInterrupt + B67 804DA23C 1 Byte [ 06 ]

---- EOF - GMER 1.0.12 ----


----------



## monkeybubbles (Apr 26, 2007)

GMER 1.0.12.12244 - http://www.gmer.net
Autostart scan 2007-04-29 15:30:21
Windows 5.1.2600 Service Pack 1

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon >>>
@UserinitC:\WINDOWS\System32\userinit.exe,C:\WINDOWS\system32\7.tmp = C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\system32\7.tmp
@ShellExplorer.exe C:\WINDOWS\system32\7.tmp = Explorer.exe C:\WINDOWS\system32\7.tmp

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ >>>
[email protected] = igfxdev.dll
[email protected] = C:\WINDOWS\System32\mlljk.dll
[email protected] = mprhou.dll
[email protected] = C:\WINDOWS\System32\rpcc.dll

HKLM\Software\Microsoft\Windows NT\CurrentVersion\[email protected]_DLLs = c:\windows\system32\sstqrsp.dll

HKLM\SYSTEM\CurrentControlSet\Services\ >>>
Automatic LiveUpdate Scheduler /*Automatic LiveUpdate Scheduler*/@ = "C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" /*file not found*/
Avg7UpdSvc /*AVG7 Update Service*/@ = C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
CLTNetCnService /*Symantec Lic NetConnect service*/@ = "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon
DHCP Clients /*DHCP Clients*/@ = "C:\WINDOWS\DHCP.EXE" /*file not found*/
LiveUpdate Notice Ex /*LiveUpdate Notice Service Ex*/@ = "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon
LiveUpdate Notice Service /*LiveUpdate Notice Service*/@ = "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll"
MSDisk /*Network helper Service*/@ = "C:\WINDOWS\System32\irdvxc.exe" /service
MSSQL$MICROSOFTBCM /*MSSQL$MICROSOFTBCM*/@ = C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe -sMICROSOFTBCM /*file not found*/
MSWindows /*Network Windows Service*/@ = "C:\WINDOWS\System32\urdvxc.exe" /service
PDM /*Windows Protocol Deployment Manager*/@ = C:\WINDOWS\system32\7.tmp
[email protected] = %SystemRoot%\system32\drivers\scsiport.sys
Spooler /*Print Spooler*/@ = %SystemRoot%\system32\spoolsv.exe
Windows DLLISP Service /*Windows DLLISP Service*/@ = "C:\WINDOWS\dllisp.exe" /*file not found*/
winsvcmon /*Windows Service Monitor*/@ = C:\WINDOWS\System32\winsvcmon.exe
wlmsngr /*wlmsngr*/@ = "C:\WINDOWS\wlmsngr.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@SunJavaUpdateSched"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" = "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
@PWRISOVM.EXEC:\Program Files\PowerISO\PWRISOVM.EXE = C:\Program Files\PowerISO\PWRISOVM.EXE
@ccApp"C:\Program Files\Common Files\Symantec Shared\ccApp.exe" = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
@Microsoft Works Update DetectionC:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
@Adobe Photo Downloader"C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" = "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
@AVG7_CCC:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP = C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
@RegistryMechanic /*file not found*/ = /*file not found*/
@Symantec PIF AlertEng"C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" = "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
@InfoDatarundll32.exe "C:\WINDOWS\System32\tamvqxtw.dll",realset = rundll32.exe "C:\WINDOWS\System32\tamvqxtw.dll",realset
@Winamp MediaC:\WINDOWS\System32\qmedia.exe /*file not found*/ = C:\WINDOWS\System32\qmedia.exe /*file not found*/
@Winamp AgentC:\WINDOWS\System32\winamp.exe /*file not found*/ = C:\WINDOWS\System32\winamp.exe /*file not found*/
@Advanced DHTML EnableC:\WINDOWS\System32\mexiomdy.exe = C:\WINDOWS\System32\mexiomdy.exe
@tcpipmontcpipmon.exe = tcpipmon.exe
@Local Security Authority ServiceC:\WINDOWS\System32\lssas.exe /*file not found*/ = C:\WINDOWS\System32\lssas.exe /*file not found*/
@Application Layer Gateway ServiceC:\WINDOWS\System32\algs.exe /*file not found*/ = C:\WINDOWS\System32\algs.exe /*file not found*/
@Client Server Runtime ProcessC:\WINDOWS\System32\csrs.exe /*file not found*/ = C:\WINDOWS\System32\csrs.exe /*file not found*/
@Microsoft Internet ExplorerC:\WINDOWS\System32\iexplore.exe /*file not found*/ = C:\WINDOWS\System32\iexplore.exe /*file not found*/
@Windows Logon ApplicationC:\WINDOWS\System32\winIogon.exe /*file not found*/ = C:\WINDOWS\System32\winIogon.exe /*file not found*/
@KernelFaultCheck%systemroot%\system32\dumprep 0 -k = %systemroot%\system32\dumprep 0 -k
@igfxtrayC:\WINDOWS\System32\igfxtray.exe = C:\WINDOWS\System32\igfxtray.exe
@igfxhkcmdC:\WINDOWS\System32\hkcmd.exe = C:\WINDOWS\System32\hkcmd.exe
@igfxpersC:\WINDOWS\System32\igfxpers.exe = C:\WINDOWS\System32\igfxpers.exe
@ZC:\WINDOWS\System32\zmon.exe = C:\WINDOWS\System32\zmon.exe
@SoundServicerundll32.exe "C:\WINDOWS\qopnmm.dll",setvm = rundll32.exe "C:\WINDOWS\qopnmm.dll",setvm
@Microsoft (R) Windows Protocol Deployment ManagerC:\WINDOWS\system32\7.tmp = C:\WINDOWS\system32\7.tmp

HKCU\Software\Microsoft\Windows\CurrentVersion\[email protected] = "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background /*file not found*/

HKLM\Software\Microsoft\Windows\CurrentVersion\[email protected] = C:\WINDOWS\System32\tsjpf32.dll /*file not found*/

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks >>>
@{9DED2B32-743B-47EB-874C-28AECF2A268D}(null) = 
@{D46E6398-D6EE-489C-81F3-5A9C7ADBC3C2}C:\WINDOWS\System32\ddcawuv.dll /*file not found*/ = C:\WINDOWS\System32\ddcawuv.dll /*file not found*/

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*Display Panning CPL Extension*/deskpan.dll /*file not found*/ = deskpan.dll /*file not found*/
@{BDEADF00-C265-11D0-BCED-00A0C90AB50F} /*Web Folders*/C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
@{00020D75-0000-0000-C000-000000000046} /*Microsoft Office Outlook Desktop Icon Handler*/C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL = C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL
@{0006F045-0000-0000-C000-000000000046} /*Microsoft Office Outlook Custom Icon Handler*/C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL = C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL
@{42042206-2D85-11D3-8CFF-005004838597} /*Microsoft Office HTML Icon Handler*/C:\Program Files\Microsoft Office\OFFICE11\msohev.dll = C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
@{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} /*Messenger Sharing Folders*/C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll = C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll
@{967B2D40-8B7D-4127-9049-61EA0C2C6DCE} /*PowerISO*/C:\Program Files\PowerISO\PWRISOSH.DLL = C:\Program Files\PowerISO\PWRISOSH.DLL
@{E0D79304-84BE-11CE-9641-444553540000} /*WinZip*/C:\PROGRA~1\WINZIP\WZSHLSTB.DLL = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
@{E0D79305-84BE-11CE-9641-444553540000} /*WinZip*/C:\PROGRA~1\WINZIP\WZSHLSTB.DLL = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
@{E0D79306-84BE-11CE-9641-444553540000} /*WinZip*/C:\PROGRA~1\WINZIP\WZSHLSTB.DLL = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
@{E0D79307-84BE-11CE-9641-444553540000} /*WinZip*/C:\PROGRA~1\WINZIP\WZSHLSTB.DLL = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
@{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} /*AVG7 Shell Extension*/C:\Program Files\Grisoft\AVG7\avgse.dll = C:\Program Files\Grisoft\AVG7\avgse.dll
@{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} /*AVG7 Find Extension*/C:\Program Files\Grisoft\AVG7\avgse.dll = C:\Program Files\Grisoft\AVG7\avgse.dll

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>
AVG7 Shell [email protected]{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Program Files\Grisoft\AVG7\avgse.dll
[email protected]{967B2D40-8B7D-4127-9049-61EA0C2C6DCE} = C:\Program Files\PowerISO\PWRISOSH.DLL
[email protected]{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ >>>
[email protected]{967B2D40-8B7D-4127-9049-61EA0C2C6DCE} = C:\Program Files\PowerISO\PWRISOSH.DLL
[email protected]{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ >>>
AVG7 Shell [email protected]{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Program Files\Grisoft\AVG7\avgse.dll
[email protected]{967B2D40-8B7D-4127-9049-61EA0C2C6DCE} = C:\Program Files\PowerISO\PWRISOSH.DLL
[email protected]{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>>
@{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll = C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
@{3DFAB50F-36F7-4812-B653-AB8DBE9FE8EF}C:\WINDOWS\System32\mlljk.dll = C:\WINDOWS\System32\mlljk.dll
@{5c3276f6-4e57-4300-9331-ed56dc3fe7eb}C:\WINDOWS\system32\mprhou.dll = C:\WINDOWS\system32\mprhou.dll
@{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll = C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
@{B08D32DE-64B2-4137-8345-87293E70D40B}C:\WINDOWS\System32\iea.dll = C:\WINDOWS\System32\iea.dll
@{B4409DDA-13BD-4AC7-96F5-54F14E0ED61c}C:\WINDOWS\System32\augueook.dll /*file not found*/ = C:\WINDOWS\System32\augueook.dll /*file not found*/
@{D46E6398-D6EE-489C-81F3-5A9C7ADBC3C2}C:\WINDOWS\System32\ddcawuv.dll /*file not found*/ = C:\WINDOWS\System32\ddcawuv.dll /*file not found*/
@{D651AFF4-9590-424d-BD1E-8E33E090DFB3}C:\WINDOWS\System32\pdwcdasg.dll /*file not found*/ = C:\WINDOWS\System32\pdwcdasg.dll /*file not found*/
@{F621B5FB-6E1E-4D0E-B88C-34B4775537B5}C:\WINDOWS\System32\mlujasnw.dll = C:\WINDOWS\System32\mlujasnw.dll

HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
@Start Pageabout:blank = about:blank
@Local Page%SystemRoot%\system32\blank.htm = %SystemRoot%\system32\blank.htm

HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Start Pagewww.google.ca = www.google.ca
@Local PageC:\WINDOWS\System32\blank.htm = C:\WINDOWS\System32\blank.htm

HKLM\Software\Classes\PROTOCOLS\Filter\text/[email protected] = C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
[email protected] = C:\WINDOWS\System32\msvidctl.dll
[email protected] = C:\WINDOWS\System32\itss.dll
[email protected] = C:\WINDOWS\System32\msvidctl.dll
[email protected] = C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
[email protected] = %SystemRoot%\System32\inetcomm.dll
[email protected] = C:\WINDOWS\System32\itss.dll
[email protected] = C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
[email protected] = C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
[email protected] = C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
[email protected] = C:\WINDOWS\System32\msvidctl.dll
[email protected] = C:\WINDOWS\System32\msdxm.ocx
[email protected] = C:\WINDOWS\System32\wiascr.dll

HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ >>>
[email protected] = C:\WINDOWS\System32\avgfwafu.dll
[email protected] = C:\WINDOWS\System32\avgfwafu.dll
[email protected] = C:\WINDOWS\System32\avgfwafu.dll
[email protected] = C:\WINDOWS\System32\avgfwafu.dll

HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\[email protected] = C:\WINDOWS\System32\avgfwafu.dll

C:\Documents and Settings\All Users\Start Menu\Programs\Startup >>>
Adobe Reader Speed Launch.lnk = Adobe Reader Speed Launch.lnk
Adobe Reader Synchronizer.lnk = Adobe Reader Synchronizer.lnk
WinZip Quick Pick.lnk = WinZip Quick Pick.lnk

---- EOF - GMER 1.0.12 ----


----------



## sjpritch25 (Sep 8, 2005)

Still have a lot of work to do!!!! Please make sure and follow this fix step by step. You might find it easier to printout my instructions, you must have all programs closed. Thanks.

Please download the attached file *monkeybubbles.zip*, Unzip/Extract serviceskill.bat and monkeybubbles.reg to your Desktop. Double-Click on serviceskill.bat and follow the prompts, Double-Click on monkeybubbles.reg and allow it to be merged into Windows Registry.

=====================================


Double-click on *OTMoveIt.exe* to launch the program.
Please copy the file(s)/folder(s) paths listed below - _highlight everything in red and press CTRL+C or right-click and choose *Copy*_.

*C:\WINDOWS\system32\7.tmp
C:\WINDOWS\System32\mlljk.dll
C:\WINDOWS\System32\rpcc.dll
c:\windows\system32\sstqrsp.dll
C:\WINDOWS\wlmsngr.exe
C:\WINDOWS\System32\winsvcmon.exe
C:\WINDOWS\system32\7.tmp
C:\WINDOWS\System32\irdvxc.exe
C:\WINDOWS\System32\mexiomdy.exe
C:\WINDOWS\System32\tamvqxtw.dll
C:\WINDOWS\qopnmm.dll
C:\WINDOWS\System32\zmon.exe
C:\WINDOWS\system32\mprhou.dll
C:\WINDOWS\System32\iea.dll
C:\WINDOWS\System32\mlujasnw.dll*

Then in OTMoveIt, _right-click in the open text box labeled_ "*Paste List of Files/Folders to be Moved*" _and choose *Paste*_.
Click the red *MoveIt!* button.
The list will be processed and the results for each line will be displayed in the right-hand pane.
Highlight everything in the *Results* window, _press CTRL+C or right-click, choose *Copy*, right-click again_ and *Paste* it in your next reply.
Close the program when done.
_*Important!*_ _If a file or folder cannot be moved immediately you may be asked to reboot your computer in order to finish the move process. If asked to reboot, choose *Yes*._

==================================

If not asked to reboot (by OTmoveit), please reboot your computer.

==================================

Please run GMER.exe, click on *AutoStart* and post the results. Also, please post a fresh Hijackthis log. Thanks.


----------



## monkeybubbles (Apr 26, 2007)

after doing the monkeybubblesreg and the servicekillbat. and OTMove it. my internet on that computer no longer works. it says that the server is not found.


----------



## sjpritch25 (Sep 8, 2005)

How do you connect??? DSL, Cable????


----------



## monkeybubbles (Apr 26, 2007)

when i reboot the computer it says can't find C:\WINDOWS\system32/7.tmp


----------



## sjpritch25 (Sep 8, 2005)

Please post a fresh Hijackthis log. Thanks.


----------



## monkeybubbles (Apr 26, 2007)

I connect through cable. and i've been making cd's and sending things back and forth but now i can't do that either.


----------



## sjpritch25 (Sep 8, 2005)

You had a horrible worm infection, do you have a usb drive or floppy to transfer stuff. If so, this program hopefully will restore your Internet.

Download *WinSockFix* from *here* or *here*.
*Backing up the Registry*
1. Double click on *WinsockXPFix.exe* to open.
2. On the Winsock and TCP Repair Utility screen, click "*ReG-Backup*"
3. On the ERDNT Welcome screen, click "*OK*".
4. On the Backup to: screen, click "*OK*".
5. On the Folder does not exist question screen click "*Yes*".
6. You will see a status screen as your registry is being backed up.
7. On the Registry backup is complete! screen, click "*OK*" and you will go back to the main window.

*Resetting the Winsock Stack*
1. On the Winsock and TCP Repair Utility screen, click "*Fix*".
2. On the Apply the VB_Winsock fix? screen click "*Yes*".
3. The screen will display a status message "*repair completed please reboot*."
4. On the Repair Completed screen click "*OK*" to reboot your computer.
5. If your computer was not using DHCP, you will need to reconfigure TCP/IP.
6. You should have connectivity restored.

*Winsock Repair Tutorial*
*Tutorial with graphics*


----------



## monkeybubbles (Apr 26, 2007)

Logfile of HijackThis v1.99.1
Scan saved at 9:44:47 PM, on 29/04/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wpabaln.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\mexe.com
C:\DOCUME~1\Owner\LOCALS~1\Temp\ScanningProcess.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\qomjge.dll",realset
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)


----------



## monkeybubbles (Apr 26, 2007)

my internet still doesn't work.


----------



## sjpritch25 (Sep 8, 2005)

Well, the Hijackthis log looks better. However, looks like the worms are trying to re-install.

Hopefully, you can get this transfered to the infected computer.

*Download and scan with **Sysclean Package*.
1. Create a new folder on drive "C:\" ("C:\New Folder") and rename it *Sysclean*.
2. Place the sysclean.com inside that folder.
3. Then download the latest *Virus Pattern Files  (lptXXX.zip).*
4. Extract the *lptXXX.zip* pattern file into the same folder you created for sysclean.com.
5. Close all open applications and *DISABLE* your current anti-virus software. Some anti-virus programs such as Avast will alert you to a virus attack when running sysclean so it's best to disable them first. *DO NOT perform a scan yet*.
*Reboot your computer in "SAFE MODE" using the F8 *. To do this restart your computer and after hearing your computer beep once during startup [but before the Windows icon appears] press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".
7. Open the Sysclean folder and double-click on *sysclean.com* to run.
8. It will take some time to complete. Be patient and let it clean whatever it finds.
9. Exit when done, reboot normally and re-enable your anti-virus program.

Note: This tool generates a log file (sysclean.log) in the same folder where the scan is completed. When using Sysclean its best to *use the Administrator's account* or an account with Administrative rights otherwise you will not have the rights to scan some locations resulting in Access is denied log entries.


----------



## monkeybubbles (Apr 26, 2007)

i'm not sure if you want this but you didn't say if you wanted me to post the log so here is a new hijack this log and the sysclean log.

Logfile of HijackThis v1.99.1
Scan saved at 9:59:40 PM, on 01/05/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\igfxsrvc.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2265EED7-6022-4d6c-ADF2-E932FEFD433C} - (no file)
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: (no name) - {DC5051EF-AE3D-4E7D-989B-ACF0317C0F0F} - C:\WINDOWS\System32\mlljk.dll (file missing)
O2 - BHO: (no name) - {EEFBE5D6-FEFF-4CB4-AA26-6A464090CB89} - (no file)
O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\qomjge.dll",realset
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc.dll
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)


----------



## monkeybubbles (Apr 26, 2007)

2007-05-01, 21:41:42, Auto-clean mode specified.
2007-05-01, 21:41:42, Running scanner "C:\Sysclean\TSC.BIN"...
2007-05-01, 21:42:24, Scanner "C:\Sysclean\TSC.BIN" has finished running.
2007-05-01, 21:42:24, TSC Log:

2007-05-01, 21:42:55, An error was detected on "C:\System Volume Information\*.*": Access is denied.
2007-05-01, 21:55:32, Files Detected:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 5/1/2007 21:43:13
VSAPI Engine Version : 8.000-1001
VSCANTM Version : 1.1-1001
Virus Pattern Version : 447 (182452 Patterns) (2007/05/01) (444700)
Command Line: C:\Sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Sysclean

C:\Documents and Settings\Owner\Local Settings\Temp\tmp8.tmp.exe [TROJ_DLOADER.NED]
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\0DQFGTIV\agzwfgqatv[1].htm [TROJ_Generic]
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\OR7IRQN8\tfxddnbby[1].htm [TROJ_Generic]
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\T7JRHVFS\agzwfgqatv[1].htm [TROJ_Generic]
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\T7JRHVFS\tfxddnbby[1].htm [TROJ_Generic]
C:\QooBox\Quarantine\C\WINDOWS\200.exe.vir [TROJ_DLOADER.MXF]
C:\SDFix\backups_old4\spoolsvc.exe [TROJ_POEBOT.UW]
C:\WINDOWS\qomjge.dll.mwt [TROJ_KLONE.BX]
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KL6N0P23\zmon[1].exe [WORM_RINBOT.AD]
C:\WINDOWS\system32\ihic.exe [BKDR_VANBOT.FZ]
C:\WINDOWS\system32\qxjq.exe [TROJ_POEBOT.QX]
C:\WINDOWS\system32\sqmk.exe [TROJ_POEBOT.UW]
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\ntio256.sys.mwt [TROJ_WOPLA.BM]
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\zmon.exe [WORM_RINBOT.AD]
27449 files have been read.
27449 files have been checked.
25389 files have been scanned.
76914 files have been scanned. (including files in archived)
14 files containing viruses.
Found 14 viruses totally.
Maybe 0 viruses totally.
Stop At : 5/1/2007 21:55:32
---------*---------*---------*---------*---------*---------*---------*---------*
2007-05-01, 21:55:32, Files Clean:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 5/1/2007 21:43:13
VSAPI Engine Version : 8.000-1001
VSCANTM Version : 1.1-1001
Virus Pattern Version : 447 (182452 Patterns) (2007/05/01) (444700)
Command Line: C:\Sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Sysclean

Success Clean [TROJ_DLOADER.NED]( 1) from C:\Documents and Settings\Owner\Local Settings\Temp\tmp8.tmp.exe
Success Clean [ TROJ_Generic]( 1) from C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\0DQFGTIV\agzwfgqatv[1].htm
Success Clean [ TROJ_Generic]( 1) from C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\OR7IRQN8\tfxddnbby[1].htm
Success Clean [ TROJ_Generic]( 1) from C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\T7JRHVFS\agzwfgqatv[1].htm
Success Clean [ TROJ_Generic]( 1) from C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\T7JRHVFS\tfxddnbby[1].htm
Success Clean [TROJ_DLOADER.MXF]( 1) from C:\QooBox\Quarantine\C\WINDOWS\200.exe.vir
Success Clean [ TROJ_POEBOT.UW]( 1) from C:\SDFix\backups_old4\spoolsvc.exe
Success Clean [ TROJ_KLONE.BX]( 1) from C:\WINDOWS\qomjge.dll.mwt
Success Clean [ WORM_RINBOT.AD]( 1) from C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KL6N0P23\zmon[1].exe
Success Clean [ BKDR_VANBOT.FZ]( 1) from C:\WINDOWS\system32\ihic.exe
Success Clean [ TROJ_POEBOT.QX]( 1) from C:\WINDOWS\system32\qxjq.exe
Success Clean [ TROJ_POEBOT.UW]( 1) from C:\WINDOWS\system32\sqmk.exe
Success Clean [ TROJ_WOPLA.BM]( 1) from C:\_OTMoveIt\MovedFiles\WINDOWS\system32\ntio256.sys.mwt
Success Clean [ WORM_RINBOT.AD]( 1) from C:\_OTMoveIt\MovedFiles\WINDOWS\system32\zmon.exe
27449 files have been read.
27449 files have been checked.
25389 files have been scanned.
76914 files have been scanned. (including files in archived)
14 files containing viruses.
Found 14 viruses totally.
Maybe 0 viruses totally.
Stop At : 5/1/2007 21:55:32	12 minutes 18 seconds (737.88 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*
2007-05-01, 21:55:32, Clean Fail:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 5/1/2007 21:43:13
VSAPI Engine Version : 8.000-1001
VSCANTM Version : 1.1-1001
Virus Pattern Version : 447 (182452 Patterns) (2007/05/01) (444700)
Command Line: C:\Sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Sysclean

27449 files have been read.
27449 files have been checked.
25389 files have been scanned.
76914 files have been scanned. (including files in archived)
14 files containing viruses.
Found 14 viruses totally.
Maybe 0 viruses totally.
Stop At : 5/1/2007 21:55:32	12 minutes 18 seconds (737.88 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*
2007-05-01, 21:55:32, Scanner "C:\Sysclean\VSCANTM.BIN" has finished running.


----------



## sjpritch25 (Sep 8, 2005)

sorry i screwed up. Be back with a post.


----------



## sjpritch25 (Sep 8, 2005)

Okay, i need you to delete *Combofix.exe* from your Desktop. We need to download a fresh copy

Download Combofix and save it to your desktop.
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Note: It is important that it is saved directly to your desktop

Close any open browsers.

Double click on combofix.exe & follow the prompts.
When finished, it shall produce a log for you.

Post the ComboFix.txt in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall


----------



## monkeybubbles (Apr 26, 2007)

when i start my computer in normal mode. i get this window that pops up saying RUNDLL
error loading C:\WINDOWS\qomjge.dll. the specified module could not be found.


----------



## monkeybubbles (Apr 26, 2007)

"Owner" - 07-05-03 18:38:03 Service Pack 1 
ComboFix 07-04-25.4V - Running from: "C:\Documents and Settings\Owner\Desktop\"

((((((((((((((((((((((((((((((( Files Created from 2007-04-03 to 2007-05-03 ))))))))))))))))))))))))))))))))))

2007-05-01 21:18 d--------	C:\Sysclean
2007-04-29 21:52 d--------	C:\DOCUME~1\Owner\APPLIC~1\MSN6
2007-04-29 21:52 d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
2007-04-29 19:46 d-a------	C:\WINDOWS\zts2.exe
2007-04-29 19:46 d-a------	C:\WINDOWS\system32\vcmgcd32.dll
2007-04-29 19:46 d-a------	C:\WINDOWS\system32\iifgfgf.dll
2007-04-29 19:46 d-a------	C:\WINDOWS\rundll16.exe
2007-04-29 19:46 d-a------	C:\WINDOWS\rundl132.dll
2007-04-29 19:46 d-a------	C:\WINDOWS\logo1_.exe
2007-04-29 19:40	134,144	--a------	C:\WINDOWS\R.COM
2007-04-29 19:40	128,512	--a------	C:\WINDOWS\system32\T.COM
2007-04-29 10:09	135,168	--a------	C:\WINDOWS\system32\igfxres.dll
2007-04-29 10:09	127	--a------	C:\WINDOWS\system32\gjqrgymt.bat
2007-04-29 01:04 d--------	C:\WINDOWS\ServicePackFiles
2007-04-29 01:04 d--------	C:\WINDOWS\ehome
2007-04-29 00:41	9,216	--a------	C:\WINDOWS\system32\wuauserv.dll
2007-04-29 00:41	86,528	--a------	C:\WINDOWS\system32\wlnotify.dll
2007-04-29 00:41	86,016	--a------	C:\WINDOWS\system32\xactsrv.dll
2007-04-29 00:41	77,824	--a------	C:\WINDOWS\system32\wmpstub.exe
2007-04-29 00:41	56,832	--a------	C:\WINDOWS\system32\wzcdlg.dll
2007-04-29 00:41	51,200	--a------	C:\WINDOWS\system32\wmerrenu.dll
2007-04-29 00:41	48,128	--a------	C:\WINDOWS\system32\winsta.dll
2007-04-29 00:41	446,464	--a------	C:\WINDOWS\system32\wmvdmoe.dll
2007-04-29 00:41	38,912	--a------	C:\WINDOWS\system32\wsnmp32.dll
2007-04-29 00:41	316,416	--a------	C:\WINDOWS\system32\zipfldr.dll
2007-04-29 00:41	311,327	--a------	C:\WINDOWS\system32\wmv8dmod.dll
2007-04-29 00:41	296,448	--a------	C:\WINDOWS\system32\wmstream.dll
2007-04-29 00:41	264,704	--a------	C:\WINDOWS\system32\wzcsvc.dll
2007-04-29 00:41	247,808	--a------	C:\WINDOWS\system32\wow32.dll
2007-04-29 00:41	23,552	--a------	C:\WINDOWS\system32\wzcsapi.dll
2007-04-29 00:41	172,664	--a------	C:\WINDOWS\system32\xenroll.dll
2007-04-29 00:41	17,408	--a------	C:\WINDOWS\system32\wtsapi32.dll
2007-04-29 00:41	168,448	--a------	C:\WINDOWS\system32\wldap32.dll
2007-04-29 00:41	13,312	--a------	C:\WINDOWS\system32\wship6.dll
2007-04-29 00:41	118,784	--a------	C:\WINDOWS\system32\wmsdmoe.dll
2007-04-29 00:40	98,304	--a------	C:\WINDOWS\system32\oleprn.dll
2007-04-29 00:40	95,744	--a------	C:\WINDOWS\system32\nlhtml.dll
2007-04-29 00:40	94,208	--a------	C:\WINDOWS\system32\odbccp32.dll
2007-04-29 00:40	921,475	---------	C:\WINDOWS\system32\ati3d2ag.dll
2007-04-29 00:40	91,136	--a------	C:\WINDOWS\system32\rastls.dll
2007-04-29 00:40	9,856	---------	C:\WINDOWS\system32\drivers\tunmp.sys
2007-04-29 00:40	891,711	---------	C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-04-29 00:40	88,064	--a------	C:\WINDOWS\system32\tscfgwmi.dll
2007-04-29 00:40	87,304	--a------	C:\WINDOWS\system32\rdpdd.dll
2007-04-29 00:40	844,675	---------	C:\WINDOWS\system32\ati3d1ag.dll
2007-04-29 00:40	82,944	--a------	C:\WINDOWS\system32\smlogsvc.exe
2007-04-29 00:40	82,944	--a------	C:\WINDOWS\system32\psbase.dll
2007-04-29 00:40	81,920	--a------	C:\WINDOWS\system32\trkwks.dll
2007-04-29 00:40	8,192	--a------	C:\WINDOWS\system32\scrnsave.scr
2007-04-29 00:40	75,912	--a------	C:\WINDOWS\system32\rdpwsx.dll
2007-04-29 00:40	74,240	--a------	C:\WINDOWS\system32\rtcshare.exe
2007-04-29 00:40	71,168	--a------	C:\WINDOWS\system32\telnet.exe
2007-04-29 00:40	71,168	--a------	C:\WINDOWS\system32\storprop.dll
2007-04-29 00:40	71,168	--a------	C:\WINDOWS\system32\sdbinst.exe
2007-04-29 00:40	686,080	--a------	C:\WINDOWS\system32\opengl32.dll
2007-04-29 00:40	674,816	--a------	C:\WINDOWS\system32\sxs.dll
2007-04-29 00:40	667,648	--a------	C:\WINDOWS\system32\ss3dfo.scr
2007-04-29 00:40	66,560	--a------	C:\WINDOWS\system32\spoolss.dll
2007-04-29 00:40	66,048	--a------	C:\WINDOWS\system32\sigverif.exe
2007-04-29 00:40	638,976	--a------	C:\WINDOWS\system32\sstext3d.scr
2007-04-29 00:40	63,663	---------	C:\WINDOWS\system32\drivers\atinrvxx.sys
2007-04-29 00:40	63,488	--a------	C:\WINDOWS\system32\srclient.dll
2007-04-29 00:40	62,976	--a------	C:\WINDOWS\system32\shgina.dll
2007-04-29 00:40	61,952	--a------	C:\WINDOWS\system32\webclnt.dll
2007-04-29 00:40	61,952	--a------	C:\WINDOWS\system32\sti.dll
2007-04-29 00:40	61,440	--a------	C:\WINDOWS\system32\odbccu32.dll
2007-04-29 00:40	61,440	--a------	C:\WINDOWS\system32\odbccr32.dll
2007-04-29 00:40	60,416	--a------	C:\WINDOWS\system32\wextract.exe
2007-04-29 00:40	60,416	--a------	C:\WINDOWS\system32\shimeng.dll
2007-04-29 00:40	6,912	---------	C:\WINDOWS\system32\drivers\hidir.sys
2007-04-29 00:40	6,144	--a------	C:\WINDOWS\system32\sensapi.dll
2007-04-29 00:40	58,880	--a------	C:\WINDOWS\system32\pautoenr.dll
2007-04-29 00:40	57,856	--a------	C:\WINDOWS\system32\raschap.dll
2007-04-29 00:40	569,344	--a------	C:\WINDOWS\system32\sspipes.scr
2007-04-29 00:40	56,591	---------	C:\WINDOWS\system32\drivers\atinbtxx.sys
2007-04-29 00:40	56,320	--a------	C:\WINDOWS\system32\remotepg.dll
2007-04-29 00:40	548,864	--a------	C:\WINDOWS\system32\rtcdll.dll
2007-04-29 00:40	534,016	--a------	C:\WINDOWS\system32\spider.exe
2007-04-29 00:40	530,432	--a------	C:\WINDOWS\system32\rpcrt4.dll
2007-04-29 00:40	53,248	--a------	C:\WINDOWS\system32\packager.exe
2007-04-29 00:40	53,248	--a------	C:\WINDOWS\system32\odbcconf.exe
2007-04-29 00:40	52,224	--a------	C:\WINDOWS\system32\secur32.dll
2007-04-29 00:40	511,488	--a------	C:\WINDOWS\system32\qedit.dll
2007-04-29 00:40	5,504	---------	C:\WINDOWS\system32\drivers\smbali.sys
2007-04-29 00:40	5,120	---------	C:\WINDOWS\system32\hccoin.dll
2007-04-29 00:40	49,152	--a------	C:\WINDOWS\system32\npptools.dll
2007-04-29 00:40	48,640	--a------	C:\WINDOWS\system32\vdmredir.dll
2007-04-29 00:40	48,128	--a------	C:\WINDOWS\system32\reg.exe
2007-04-29 00:40	479,261	--a------	C:\WINDOWS\system32\vbscript.dll
2007-04-29 00:40	47,616	--a------	C:\WINDOWS\system32\utilman.exe
2007-04-29 00:40	450,176	---------	C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-04-29 00:40	44,032	--a------	C:\WINDOWS\system32\regapi.dll
2007-04-29 00:40	44,032	--a------	C:\WINDOWS\system32\rdpclip.exe
2007-04-29 00:40	43,008	--a------	C:\WINDOWS\system32\ssdpsrv.dll
2007-04-29 00:40	420,864	--a------	C:\WINDOWS\system32\shimgvw.dll
2007-04-29 00:40	409,088	--a------	C:\WINDOWS\system32\vssapi.dll
2007-04-29 00:40	403,456	---------	C:\WINDOWS\system32\winbrand.dll
2007-04-29 00:40	40,960	--a------	C:\WINDOWS\system32\tscupgrd.exe
2007-04-29 00:40	392,704	--a------	C:\WINDOWS\system32\ntmssvc.dll
2007-04-29 00:40	385,024	--a------	C:\WINDOWS\system32\sqlsrv32.dll
2007-04-29 00:40	384,000	--a------	C:\WINDOWS\system32\themeui.dll
2007-04-29 00:40	38,400	--a------	C:\WINDOWS\system32\ntmsapi.dll
2007-04-29 00:40	38,400	--a------	C:\WINDOWS\system32\ntlanman.dll
2007-04-29 00:40	377,984	---------	C:\WINDOWS\system32\ati2dvaa.dll
2007-04-29 00:40	364,544	--a------	C:\WINDOWS\system32\ssflwbox.scr
2007-04-29 00:40	36,463	---------	C:\WINDOWS\system32\drivers\atintuxx.sys
2007-04-29 00:40	36,352	--a------	C:\WINDOWS\system32\sens.dll
2007-04-29 00:40	357,376	--a------	C:\WINDOWS\system32\qdvd.dll
2007-04-29 00:40	34,735	---------	C:\WINDOWS\system32\drivers\atinxsxx.sys
2007-04-29 00:40	34,304	--a------	C:\WINDOWS\system32\rcimlby.exe
2007-04-29 00:40	339,456	--a------	C:\WINDOWS\system32\usp10.dll
2007-04-29 00:40	334,848	--a------	C:\WINDOWS\system32\smlogcfg.dll
2007-04-29 00:40	33,808	--a------	C:\WINDOWS\system32\ntio.sys
2007-04-29 00:40	33,280	--a------	C:\WINDOWS\system32\shmgrate.exe
2007-04-29 00:40	328,704	--a------	C:\WINDOWS\system32\oakley.dll
2007-04-29 00:40	327,040	---------	C:\WINDOWS\system32\drivers\ati2mtaa.sys
2007-04-29 00:40	32,768	--a------	C:\WINDOWS\system32\odbcad32.exe
2007-04-29 00:40	32,256	--a------	C:\WINDOWS\system32\umandlg.dll
2007-04-29 00:40	31,744	--a------	C:\WINDOWS\system32\pid.dll
2007-04-29 00:40	30,671	---------	C:\WINDOWS\system32\drivers\atinraxx.sys
2007-04-29 00:40	3,584	---------	C:\WINDOWS\system32\dsprpres.dll
2007-04-29 00:40	3,494,303	---------	C:\WINDOWS\system32\nv4_disp.dll
2007-04-29 00:40	3,338	--a------	C:\WINDOWS\system32\redir.exe
2007-04-29 00:40	297,984	--a------	C:\WINDOWS\system32\scesrv.dll
2007-04-29 00:40	29,455	---------	C:\WINDOWS\system32\drivers\atinxbxx.sys
2007-04-29 00:40	27,136	--a------	C:\WINDOWS\system32\ssdpapi.dll
2007-04-29 00:40	266,752	--a------	C:\WINDOWS\winhlp32.exe
2007-04-29 00:40	260,608	--a------	C:\WINDOWS\system32\rpcss.dll
2007-04-29 00:40	26,367	---------	C:\WINDOWS\system32\drivers\atinsnxx.sys
2007-04-29 00:40	254,976	--a------	C:\WINDOWS\system32\pdh.dll
2007-04-29 00:40	251,904	--a------	C:\WINDOWS\system32\strmdll.dll
2007-04-29 00:40	24,576	--a------	C:\WINDOWS\system32\odbcbcp.dll
2007-04-29 00:40	24,576	--a------	C:\WINDOWS\system32\nmmkcert.dll
2007-04-29 00:40	24,064	--a------	C:\WINDOWS\system32\skeys.exe
2007-04-29 00:40	238,080	--a------	C:\WINDOWS\system32\newdev.dll
2007-04-29 00:40	233,984	--a------	C:\WINDOWS\system32\tapisrv.dll
2007-04-29 00:40	231,424	--a------	C:\WINDOWS\system32\upnpui.dll
2007-04-29 00:40	226,304	--a------	C:\WINDOWS\system32\srrstr.dll
2007-04-29 00:40	22,528	--a------	C:\WINDOWS\system32\slayerxp.dll
2007-04-29 00:40	22,528	--a------	C:\WINDOWS\system32\shfolder.dll
2007-04-29 00:40	22,016	--a------	C:\WINDOWS\system32\udhisapi.dll
2007-04-29 00:40	218,112	---------	C:\WINDOWS\system32\sbe.dll
2007-04-29 00:40	212,480	--a------	C:\WINDOWS\system32\osk.exe
2007-04-29 00:40	21,343	---------	C:\WINDOWS\system32\drivers\atinttxx.sys
2007-04-29 00:40	203,264	--a------	C:\WINDOWS\system32\uxtheme.dll
2007-04-29 00:40	202,496	---------	C:\WINDOWS\system32\ati2dvag.dll
2007-04-29 00:40	200,704	--a------	C:\WINDOWS\system32\odbc32.dll
2007-04-29 00:40	200,192	-ra------	C:\WINDOWS\system32\termsrv.dll
2007-04-29 00:40	20,992	--a------	C:\WINDOWS\system32\setup.exe
2007-04-29 00:40	193,536	--a------	C:\WINDOWS\system32\rasppp.dll
2007-04-29 00:40	19,456	--a------	C:\WINDOWS\system32\ssmarque.scr
2007-04-29 00:40	19,328	---------	C:\WINDOWS\system32\drivers\usbehci.sys
2007-04-29 00:40	187,904	---------	C:\WINDOWS\system32\xpsp1res.dll
2007-04-29 00:40	184,832	--a------	C:\WINDOWS\system32\qcap.dll
2007-04-29 00:40	18,944	--a------	C:\WINDOWS\system32\ssbezier.scr
2007-04-29 00:40	18,944	---------	C:\WINDOWS\system32\faxpatch.exe
2007-04-29 00:40	174,592	--a------	C:\WINDOWS\system32\scecli.dll
2007-04-29 00:40	172,032	---------	C:\WINDOWS\system32\mssap.dll
2007-04-29 00:40	171,520	--a------	C:\WINDOWS\system32\winmm.dll
2007-04-29 00:40	171,008	--a------	C:\WINDOWS\system32\sccsccp.dll
2007-04-29 00:40	17,408	--a------	C:\WINDOWS\system32\ssmyst.scr
2007-04-29 00:40	17,408	--a------	C:\WINDOWS\system32\psapi.dll
2007-04-29 00:40	169,984	--a------	C:\WINDOWS\system32\sccbase.dll
2007-04-29 00:40	165,888	--a------	C:\WINDOWS\system32\ntmsdba.dll
2007-04-29 00:40	165,376	--a------	C:\WINDOWS\system32\w32time.dll
2007-04-29 00:40	165,376	--a------	C:\WINDOWS\system32\tapi32.dll
2007-04-29 00:40	164,864	--a------	C:\WINDOWS\system32\upnphost.dll
2007-04-29 00:40	16,896	--a------	C:\WINDOWS\system32\snmpapi.dll
2007-04-29 00:40	16,384	--a------	C:\WINDOWS\system32\watchdog.sys
2007-04-29 00:40	16,384	--a------	C:\WINDOWS\system32\ups.exe
2007-04-29 00:40	16,384	--a------	C:\WINDOWS\system32\ping.exe
2007-04-29 00:40	16,384	--a------	C:\WINDOWS\system32\odbc32gt.dll
2007-04-29 00:40	159,232	--a------	C:\WINDOWS\system32\schedsvc.dll
2007-04-29 00:40	158,720	--a------	C:\WINDOWS\system32\srsvc.dll
2007-04-29 00:40	155,648	---------	C:\WINDOWS\system32\encdec.dll
2007-04-29 00:40	147,456	--a------	C:\WINDOWS\system32\odbctrac.dll
2007-04-29 00:40	14,848	--a------	C:\WINDOWS\system32\rdpsnd.dll
2007-04-29 00:40	137,216	--a------	C:\WINDOWS\system32\ntshrui.dll
2007-04-29 00:40	135,680	--a------	C:\WINDOWS\system32\rdchost.dll
2007-04-29 00:40	134,144	--a------	C:\WINDOWS\regedit.exe
2007-04-29 00:40	133,632	--a------	C:\WINDOWS\system32\rsaenh.dll
2007-04-29 00:40	133,120	--a------	C:\WINDOWS\system32\sfc_os.dll
2007-04-29 00:40	130,560	--a------	C:\WINDOWS\system32\sti_ci.dll
2007-04-29 00:40	13,824	--a------	C:\WINDOWS\system32\rassapi.dll
2007-04-29 00:40	13,312	--a------	C:\WINDOWS\system32\ssstars.scr
2007-04-29 00:40	13,056	---------	C:\WINDOWS\system32\drivers\wacompen.sys
2007-04-29 00:40	128,512	--a------	C:\WINDOWS\system32\taskmgr.exe
2007-04-29 00:40	124,928	--a------	C:\WINDOWS\system32\webvw.dll
2007-04-29 00:40	122,880	--a------	C:\WINDOWS\system32\odbcconf.dll
2007-04-29 00:40	120,320	--a------	C:\WINDOWS\system32\upnp.dll
2007-04-29 00:40	12,800	--a------	C:\WINDOWS\system32\runonce.exe
2007-04-29 00:40	12,288	--a------	C:\WINDOWS\system32\rdsaddin.exe
2007-04-29 00:40	12,288	--a------	C:\WINDOWS\system32\odbcp32r.dll
2007-04-29 00:40	12,288	---------	C:\WINDOWS\system32\encapi.dll
2007-04-29 00:40	12,047	---------	C:\WINDOWS\system32\drivers\atinpdxx.sys
2007-04-29 00:40	119,808	--a------	C:\WINDOWS\system32\wiadss.dll
2007-04-29 00:40	117,760	--a------	C:\WINDOWS\system32\stobject.dll
2007-04-29 00:40	112,128	--a------	C:\WINDOWS\system32\ntmarta.dll
2007-04-29 00:40	110,080	---------	C:\WINDOWS\system32\sbeio.dll
2007-04-29 00:40	11,904	---------	C:\WINDOWS\system32\drivers\mutohpen.sys
2007-04-29 00:40	11,776	--a------	C:\WINDOWS\system32\sigtab.dll
2007-04-29 00:40	11,615	---------	C:\WINDOWS\system32\drivers\atinmdxx.sys
2007-04-29 00:40	109,568	--a------	C:\WINDOWS\system32\offfilt.dll
2007-04-29 00:40	107,008	--a------	C:\WINDOWS\system32\umpnpmgr.dll
2007-04-29 00:40	10,752	--a------	C:\WINDOWS\system32\tracert.exe
2007-04-29 00:40	1,677,312	---------	C:\WINDOWS\system32\wmvcore2.dll
2007-04-29 00:40	1,349,120	--a------	C:\WINDOWS\system32\query.dll
2007-04-29 00:40	1,169,920	--a------	C:\WINDOWS\system32\ole32.dll
2007-04-29 00:40	1,157,632	--a------	C:\WINDOWS\system32\sfcfiles.dll
2007-04-29 00:40	1,142,784	--a------	C:\WINDOWS\system32\quartz.dll
2007-04-29 00:39	98,816	--a------	C:\WINDOWS\system32\clipbrd.exe
2007-04-29 00:39	94,720	--a------	C:\WINDOWS\system32\dmusic.dll
2007-04-29 00:39	91,648	--a------	C:\WINDOWS\system32\iuctl.dll
2007-04-29 00:39	9,728	--a------	C:\WINDOWS\system32\mstinit.exe
2007-04-29 00:39	9,216	--a------	C:\WINDOWS\system32\icaapi.dll
2007-04-29 00:39	9,216	--a------	C:\WINDOWS\system32\dumprep.exe
2007-04-29 00:39	857,600	--a------	C:\WINDOWS\system32\netplwiz.dll
2007-04-29 00:39	82,432	--a------	C:\WINDOWS\system32\fldrclnr.dll
2007-04-29 00:39	81,408	--a------	C:\WINDOWS\system32\msoert2.dll
2007-04-29 00:39	802,304	--a------	C:\WINDOWS\system32\dxmrtp.dll
2007-04-29 00:39	8,832	--a------	C:\WINDOWS\system32\framebuf.dll
2007-04-29 00:39	786,432	--a------	C:\WINDOWS\system32\dxdiag.exe
2007-04-29 00:39	77,312	--a------	C:\WINDOWS\system32\dmscript.dll
2007-04-29 00:39	76,830	--a------	C:\WINDOWS\system32\drmstor.dll
2007-04-29 00:39	76,288	--a------	C:\WINDOWS\system32\dfrgfat.exe
2007-04-29 00:39	73,728	--a------	C:\WINDOWS\system32\ils.dll
2007-04-29 00:39	71,680	--a------	C:\WINDOWS\system32\browsewm.dll
2007-04-29 00:39	70,656	--a------	C:\WINDOWS\system32\defrag.exe
2007-04-29 00:39	70,144	--a------	C:\WINDOWS\system32\cryptdlg.dll
2007-04-29 00:39	7,040	--a------	C:\WINDOWS\system32\kd1394.dll
2007-04-29 00:39	699,392	--a------	C:\WINDOWS\system32\msxml2.dll
2007-04-29 00:39	68,096	--a------	C:\WINDOWS\system32\mscms.dll
2007-04-29 00:39	67,584	--a------	C:\WINDOWS\system32\msctfp.dll
2007-04-29 00:39	66,560	--a------	C:\WINDOWS\system32\faultrep.dll
2007-04-29 00:39	65,536	--a------	C:\WINDOWS\system32\msconf.dll
2007-04-29 00:39	64,512	--a------	C:\WINDOWS\system32\msiexec.exe
2007-04-29 00:39	64,512	--a------	C:\WINDOWS\system32\ciodm.dll
2007-04-29 00:39	61,440	--a------	C:\WINDOWS\system32\dbnetlib.dll
2007-04-29 00:39	602,112	--a------	C:\WINDOWS\system32\drmv2clt.dll
2007-04-29 00:39	60,928	--a------	C:\WINDOWS\system32\ipv6.exe
2007-04-29 00:39	598,016	--a------	C:\WINDOWS\system32\mstscax.dll
2007-04-29 00:39	59,904	--a------	C:\WINDOWS\system32\cabinet.dll
2007-04-29 00:39	59,392	--a------	C:\WINDOWS\system32\iesetup.dll
2007-04-29 00:39	587,776	--a------	C:\WINDOWS\system32\inetcomm.dll
2007-04-29 00:39	584,192	--a------	C:\WINDOWS\system32\netcfgx.dll
2007-04-29 00:39	582,656	--a------	C:\WINDOWS\system32\catsrvut.dll
2007-04-29 00:39	58,368	--a------	C:\WINDOWS\system32\dpvsetup.exe
2007-04-29 00:39	57,856	--a------	C:\WINDOWS\system32\licwmi.dll
2007-04-29 00:39	57,344	--a------	C:\WINDOWS\system32\dmcompos.dll
2007-04-29 00:39	56,320	--a------	C:\WINDOWS\system32\mshtmler.dll
2007-04-29 00:39	56,320	--a------	C:\WINDOWS\system32\dpnhupnp.dll
2007-04-29 00:39	552,991	--a------	C:\WINDOWS\system32\msrepl40.dll
2007-04-29 00:39	55,296	--a------	C:\WINDOWS\system32\digest.dll
2007-04-29 00:39	54,272	--a------	C:\WINDOWS\system32\clusapi.dll
2007-04-29 00:39	53,248	--a------	C:\WINDOWS\system32\cryptsvc.dll
2007-04-29 00:39	512,031	--a------	C:\WINDOWS\system32\msexch40.dll
2007-04-29 00:39	51,712	--a------	C:\WINDOWS\system32\ipconfig.exe
2007-04-29 00:39	504,320	--a------	C:\WINDOWS\system32\logonui.exe
2007-04-29 00:39	498,205	--a------	C:\WINDOWS\system32\dxmasf.dll
2007-04-29 00:39	49,664	--a------	C:\WINDOWS\system32\ixsso.dll
2007-04-29 00:39	49,664	--a------	C:\WINDOWS\system32\dpwsockx.dll
2007-04-29 00:39	49,152	--a------	C:\WINDOWS\system32\eventlog.dll
2007-04-29 00:39	489,984	--a------	C:\WINDOWS\system32\dbghelp.dll
2007-04-29 00:39	471,040	--a------	C:\WINDOWS\system32\cryptui.dll
2007-04-29 00:39	45,568	--a------	C:\WINDOWS\system32\docprop2.dll
2007-04-29 00:39	435,200	--a------	C:\WINDOWS\system32\ipnathlp.dll
2007-04-29 00:39	421,919	--a------	C:\WINDOWS\system32\msrd2x40.dll
2007-04-29 00:39	42,537	--a------	C:\WINDOWS\system32\keyboard.sys
2007-04-29 00:39	42,496	--a------	C:\WINDOWS\system32\ncobjapi.dll
2007-04-29 00:39	41,472	--a------	C:\WINDOWS\system32\cmdl32.exe
2007-04-29 00:39	401,462	--a------	C:\WINDOWS\system32\msvcp60.dll
2007-04-29 00:39	4,608	--a------	C:\WINDOWS\system32\msimg32.dll
2007-04-29 00:39	4,126	--a------	C:\WINDOWS\system32\msdxmlc.dll
2007-04-29 00:39	399,360	--a------	C:\WINDOWS\system32\netlogon.dll
2007-04-29 00:39	39,424	--a------	C:\WINDOWS\system32\net.exe
2007-04-29 00:39	388,608	--a------	C:\WINDOWS\system32\mstsc.exe
2007-04-29 00:39	381,440	--a------	C:\WINDOWS\system32\lmrt.dll
2007-04-29 00:39	380,445	--a------	C:\WINDOWS\system32\expsrv.dll
2007-04-29 00:39	368,710	--a------	C:\WINDOWS\system32\msisam11.dll
2007-04-29 00:39	36,922	--a------	C:\WINDOWS\system32\imeshare.dll
2007-04-29 00:39	359,936	--a------	C:\WINDOWS\system32\msdtcprx.dll
2007-04-29 00:39	35,328	--a------	C:\WINDOWS\system32\dfrgsnap.dll
2007-04-29 00:39	348,195	--a------	C:\WINDOWS\system32\msjetoledb40.dll
2007-04-29 00:39	348,191	--a------	C:\WINDOWS\system32\mspbde40.dll
2007-04-29 00:39	344,095	--a------	C:\WINDOWS\system32\msxbde40.dll
2007-04-29 00:39	339,968	--a------	C:\WINDOWS\system32\mspaint.exe
2007-04-29 00:39	326,656	--a------	C:\WINDOWS\system32\netsetup.exe
2007-04-29 00:39	324,608	--a------	C:\WINDOWS\system32\cmdial32.dll
2007-04-29 00:39	323,072	--a------	C:\WINDOWS\system32\msvcrt.dll
2007-04-29 00:39	32,768	--a------	C:\WINDOWS\system32\cfgbkend.dll
2007-04-29 00:39	32,256	--a------	C:\WINDOWS\system32\mnmdd.dll
2007-04-29 00:39	319,760	--a------	C:\WINDOWS\system32\msnsspc.dll
2007-04-29 00:39	319,519	--a------	C:\WINDOWS\system32\msexcl40.dll
2007-04-29 00:39	318,464	--a------	C:\WINDOWS\system32\ippromon.dll
2007-04-29 00:39	31,744	--a------	C:\WINDOWS\system32\dmloader.dll
2007-04-29 00:39	307,712	--a------	C:\WINDOWS\system32\cscui.dll
2007-04-29 00:39	305,664	--a------	C:\WINDOWS\system32\msihnd.dll
2007-04-29 00:39	30,208	--a------	C:\WINDOWS\system32\imgutil.dll
2007-04-29 00:39	29,696	--a------	C:\WINDOWS\system32\dpnhpast.dll
2007-04-29 00:39	28,672	--a------	C:\WINDOWS\system32\dbnmpntw.dll
2007-04-29 00:39	272,896	--a------	C:\WINDOWS\system32\kerberos.dll
2007-04-29 00:39	27,648	--a------	C:\WINDOWS\system32\pidgen.dll
2007-04-29 00:39	266,752	--a------	C:\WINDOWS\system32\msctf.dll
2007-04-29 00:39	266,240	--a------	C:\WINDOWS\system32\drmclien.dll
2007-04-29 00:39	263,680	--a------	C:\WINDOWS\system32\duser.dll
2007-04-29 00:39	263,168	--a------	C:\WINDOWS\system32\devmgr.dll
2007-04-29 00:39	26,112	--a------	C:\WINDOWS\system32\dmband.dll
2007-04-29 00:39	253,983	--a------	C:\WINDOWS\system32\mstext40.dll
2007-04-29 00:39	253,440	--a------	C:\WINDOWS\system32\ddraw.dll
2007-04-29 00:39	250,368	--a------	C:\WINDOWS\system32\mstask.dll
2007-04-29 00:39	25,600	--a------	C:\WINDOWS\system32\dfsshlex.dll
2007-04-29 00:39	241,725	--a------	C:\WINDOWS\system32\msuni11.dll
2007-04-29 00:39	241,695	--a------	C:\WINDOWS\system32\msjtes40.dll
2007-04-29 00:39	240,640	--a------	C:\WINDOWS\system32\hnetcfg.dll
2007-04-29 00:39	24,576	--a------	C:\WINDOWS\system32\dbmsvinn.dll
2007-04-29 00:39	24,576	--a------	C:\WINDOWS\system32\dbmsrpcn.dll
2007-04-29 00:39	24,576	--a------	C:\WINDOWS\system32\conime.exe
2007-04-29 00:39	238,592	--a------	C:\WINDOWS\system32\compatui.dll
2007-04-29 00:39	236,032	--a------	C:\WINDOWS\system32\icm32.dll
2007-04-29 00:39	233,472	--a------	C:\WINDOWS\system32\mpg4dmod.dll
2007-04-29 00:39	229,888	--a------	C:\WINDOWS\system32\msieftp.dll
2007-04-29 00:39	228,864	--a------	C:\WINDOWS\system32\msoeacct.dll
2007-04-29 00:39	227,840	--a------	C:\WINDOWS\system32\dsquery.dll
2007-04-29 00:39	225,280	--a------	C:\WINDOWS\system32\es.dll
2007-04-29 00:39	22,528	--a------	C:\WINDOWS\system32\mslbui.dll
2007-04-29 00:39	219,648	--a------	C:\WINDOWS\system32\logon.scr
2007-04-29 00:39	213,023	--a------	C:\WINDOWS\system32\msltus40.dll
2007-04-29 00:39	210,944	--a------	C:\WINDOWS\system32\moricons.dll
2007-04-29 00:39	206,336	--a------	C:\WINDOWS\system32\dpvoice.dll
2007-04-29 00:39	20,480	--a------	C:\WINDOWS\system32\hidserv.dll
2007-04-29 00:39	20,480	--a------	C:\WINDOWS\system32\dbmsadsn.dll
2007-04-29 00:39	2,086,400	--a------	C:\WINDOWS\system32\msi.dll
2007-04-29 00:39	196,096	--a------	C:\WINDOWS\system32\mobsync.dll
2007-04-29 00:39	192,512	--a------	C:\WINDOWS\system32\mswebdvd.dll
2007-04-29 00:39	19,456	--a------	C:\WINDOWS\system32\licmgr10.dll
2007-04-29 00:39	19,456	--a------	C:\WINDOWS\system32\fontview.exe
2007-04-29 00:39	19,456	--a------	C:\WINDOWS\system32\ersvc.dll
2007-04-29 00:39	186,880	--a------	C:\WINDOWS\system32\certcli.dll
2007-04-29 00:39	182,784	--a------	C:\WINDOWS\system32\msutb.dll
2007-04-29 00:39	180,224	--a------	C:\WINDOWS\system32\dwwin.exe
2007-04-29 00:39	178,688	--a------	C:\WINDOWS\system32\eudcedit.exe
2007-04-29 00:39	174,592	--a------	C:\WINDOWS\system32\msnetobj.dll
2007-04-29 00:39	172,544	--a------	C:\WINDOWS\system32\dmime.dll
2007-04-29 00:39	168,960	--a------	C:\WINDOWS\system32\dinput8.dll
2007-04-29 00:39	165,376	--a------	C:\WINDOWS\system32\els.dll


----------



## monkeybubbles (Apr 26, 2007)

2007-04-29 00:39	163,840	--a------	C:\WINDOWS\system32\mindex.dll
2007-04-29 00:39	16,384	--a------	C:\WINDOWS\system32\nddenb32.dll
2007-04-29 00:39	16,384	--a------	C:\WINDOWS\system32\ds32gt.dll
2007-04-29 00:39	158,720	--a------	C:\WINDOWS\system32\credui.dll
2007-04-29 00:39	156,672	--a------	C:\WINDOWS\system32\dpnet.dll
2007-04-29 00:39	155,648	--a------	C:\WINDOWS\system32\ipsecsvc.dll
2007-04-29 00:39	154,112	--a------	C:\WINDOWS\system32\netman.dll
2007-04-29 00:39	151,552	--a------	C:\WINDOWS\system32\dinput.dll
2007-04-29 00:39	143,872	--a------	C:\WINDOWS\system32\msimtf.dll
2007-04-29 00:39	135,680	--a------	C:\WINDOWS\system32\dsprop.dll
2007-04-29 00:39	134,144	--a------	C:\WINDOWS\system32\ipv6mon.dll
2007-04-29 00:39	131,072	--a------	C:\WINDOWS\system32\msorcl32.dll
2007-04-29 00:39	13,312	--a------	C:\WINDOWS\system32\ctfmon.exe
2007-04-29 00:39	126,976	--a------	C:\WINDOWS\system32\msdart.dll
2007-04-29 00:39	124,928	--a------	C:\WINDOWS\system32\dssenh.dll
2007-04-29 00:39	123,904	--a------	C:\WINDOWS\system32\imapi.exe
2007-04-29 00:39	12,288	--a------	C:\WINDOWS\system32\mscpx32r.dll
2007-04-29 00:39	116,736	--a------	C:\WINDOWS\system32\mplay32.exe
2007-04-29 00:39	115,200	--a------	C:\WINDOWS\system32\net1.exe
2007-04-29 00:39	115,200	--a------	C:\WINDOWS\system32\dpcdll.dll
2007-04-29 00:39	114,176	--a------	C:\WINDOWS\system32\input.dll
2007-04-29 00:39	113,664	--a------	C:\WINDOWS\system32\msvfw32.dll
2007-04-29 00:39	113,152	--a------	C:\WINDOWS\system32\idq.dll
2007-04-29 00:39	113,152	--a------	C:\WINDOWS\system32\dfrgui.dll
2007-04-29 00:39	110,080	--a------	C:\WINDOWS\system32\dmstyle.dll
2007-04-29 00:39	105,984	--a------	C:\WINDOWS\system32\netdde.exe
2007-04-29 00:39	103,936	--a------	C:\WINDOWS\system32\imm32.dll
2007-04-29 00:39	103,424	--a------	C:\WINDOWS\system32\dgnet.dll
2007-04-29 00:39	10,240	--a------	C:\WINDOWS\system32\msrle32.dll
2007-04-29 00:39	10,240	--a------	C:\WINDOWS\system32\localui.dll
2007-04-29 00:39	1,740	--a------	C:\WINDOWS\system32\dcache.bin
2007-04-29 00:39	1,622,528	--a------	C:\WINDOWS\system32\netshell.dll
2007-04-29 00:39	1,503,262	--a------	C:\WINDOWS\system32\msjet40.dll
2007-04-29 00:39	1,220,608	--a------	C:\WINDOWS\system32\msvidctl.dll
2007-04-29 00:39	1,180,672	--a------	C:\WINDOWS\system32\d3d8.dll
2007-04-29 00:39	1,172,992	--a------	C:\WINDOWS\system32\comsvcs.dll
2007-04-29 00:39	1,128,960	--a------	C:\WINDOWS\system32\mmcndmgr.dll
2007-04-29 00:39	1,122,304	--a------	C:\WINDOWS\system32\msxml3.dll
2007-04-29 00:39	1,004,032	--a------	C:\WINDOWS\explorer.exe
2007-04-29 00:38	76,288	--a------	C:\WINDOWS\system32\avifil32.dll
2007-04-29 00:38	62,976	--a------	C:\WINDOWS\system32\browselc.dll
2007-04-29 00:38	6,656	--a------	C:\WINDOWS\system32\batt.dll
2007-04-29 00:38	49,152	--a------	C:\WINDOWS\system32\browser.dll
2007-04-29 00:37	8,192	--a------	C:\WINDOWS\system32\autolfn.exe
2007-04-29 00:37	74,810	--a------	C:\WINDOWS\system32\atl.dll
2007-04-29 00:37	38,912	--a------	C:\WINDOWS\system32\audiosrv.dll
2007-04-29 00:34	22,528	--a------	C:\WINDOWS\system32\at.exe
2007-04-29 00:34	14,366	--a------	C:\WINDOWS\system32\asfsipc.dll
2007-04-29 00:34	117	--a------	C:\WINDOWS\system32\aaarggp.bat
2007-04-29 00:33	91,648	--a------	C:\WINDOWS\system32\ahui.exe
2007-04-29 00:33	41,984	--a------	C:\WINDOWS\system32\alg.exe
2007-04-29 00:33	32,512	---------	C:\WINDOWS\system32\drivers\amdk7.sys
2007-04-29 00:33	239,616	--a------	C:\WINDOWS\system32\adsnt.dll
2007-04-29 00:33	115,712	--a------	C:\WINDOWS\system32\apphelp.dll
2007-04-29 00:32	62,464	--a------	C:\WINDOWS\system32\adsmsext.dll
2007-04-29 00:32	162,816	--a------	C:\WINDOWS\system32\adsldp.dll
2007-04-29 00:32	139,776	--a------	C:\WINDOWS\system32\adsldpc.dll
2007-04-29 00:30	59,392	--a------	C:\WINDOWS\system32\6to4svc.dll
2007-04-29 00:28	117	--a------	C:\WINDOWS\system32\ffvuhlw.bat
2007-04-29 00:25	24,576	--a------	C:\WINDOWS\system32\xpsp1hfm.exe
2007-04-29 00:25 d--h-c---	C:\WINDOWS\$xpsp1hfm$
2007-04-29 00:25 d-------- C:\WINDOWS\system32\ReinstallBackups
2007-04-29 00:22 d--------	C:\9fdb6525d69c224452fa4
2007-04-28 20:22	126	--a------	C:\WINDOWS\system32\iqny.bat
2007-04-28 20:09	126	--a------	C:\WINDOWS\system32\lahc.bat
2007-04-28 20:08	122	--a------	C:\WINDOWS\system32\mzzdcq.bat
2007-04-28 20:05	124	--a------	C:\WINDOWS\system32\mrfui.bat
2007-04-28 20:03	123	--a------	C:\WINDOWS\system32\yratiea.bat
2007-04-28 19:56	116	--a------	C:\WINDOWS\system32\cckdou.bat
2007-04-28 19:55	116	--a------	C:\WINDOWS\system32\otpzys.bat
2007-04-28 18:09	125	--a------	C:\WINDOWS\system32\fjnsbn.bat
2007-04-28 15:31	24	--a------	C:\WINDOWS\system32\g.bat
2007-04-28 15:02	130	--a------	C:\WINDOWS\system32\hsfbcgbn.bat
2007-04-28 15:02	126	--a------	C:\WINDOWS\system32\nhyv.bat
2007-04-28 15:02	125	--a------	C:\WINDOWS\system32\xcxfiy.bat
2007-04-28 15:02	121	--a------	C:\WINDOWS\system32\phmvyowg.bat
2007-04-28 15:02	117	--a------	C:\WINDOWS\system32\bjlhfhv.bat
2007-04-27 16:02	130	--a------	C:\WINDOWS\system32\sowsrkve.bat
2007-04-27 15:47	124	--a------	C:\WINDOWS\system32\lxtuvkdn.bat
2007-04-27 15:45	121	--a------	C:\WINDOWS\system32\duxdy.bat
2007-04-27 15:41	130	--a------	C:\WINDOWS\system32\gnyntbtu.bat
2007-04-27 15:41	127	--a------	C:\WINDOWS\system32\jrnsa.bat
2007-04-27 14:23 d--------	C:\WINDOWS\system32\Kaspersky Lab
2007-04-27 14:23 d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-04-27 14:09	29,769	--a------	C:\WINDOWS\system32\ddcyw.exe
2007-04-27 14:03 d---s----	C:\DOCUME~1\Owner\UserData
2007-04-27 14:00	6,656	--a------	C:\WINDOWS\system32\qzgm.exe
2007-04-27 14:00	6,656	--a------	C:\WINDOWS\system32\nkprri.exe
2007-04-27 14:00	11,148	--a------	C:\WINDOWS\system32\ufhp.exe
2007-04-27 13:55	6,656	--a------	C:\WINDOWS\system32\ubdlul.exe
2007-04-27 13:55	6,656	--a------	C:\WINDOWS\system32\kxsgyi.exe
2007-04-27 13:54	6,656	--a------	C:\WINDOWS\system32\qgyom.exe
2007-04-27 13:54	6,656	--a------	C:\WINDOWS\system32\eqjfpcz.exe
2007-04-27 13:54	11,148	--a------	C:\WINDOWS\system32\ynjkv.exe
2007-04-27 13:43	6,656	--a------	C:\WINDOWS\system32\qywx.exe
2007-04-27 13:43	11,148	--a------	C:\WINDOWS\system32\qxft.exe
2007-04-27 12:57 d--------	C:\VundoFix Backups
2007-04-27 12:56	0	--a------	C:\WINDOWS\system32\kvh.exe
2007-04-27 12:13	262,144	--a------	C:\DOCUME~1\ALLUSE~1\ntuser.dat
2007-04-27 12:08	49,152	--a------	C:\WINDOWS\nircmd.exe
2007-04-27 11:01	44	--a------	C:\WINDOWS\sys.bat
2007-04-27 11:01	16,721	--a------	C:\WINDOWS\system32\mn.dll
2007-04-26 15:50	117	--a------	C:\WINDOWS\system32\xwngvgz.bat
2007-04-26 15:49	130	--a------	C:\WINDOWS\system32\eofrwchw.bat
2007-04-26 14:59	6,656	--a------	C:\WINDOWS\system32\koreiwcd.exe
2007-04-26 13:56	524,288	--ah-----	C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-04-26 12:44	4	--a------	C:\WINDOWS\system32\stfv.bin
2007-04-26 12:43	12	--a------	C:\WINDOWS\system32\sl.bin
2007-04-26 12:40	30,464	--a------	C:\WINDOWS\system32\vxddsk.exe
2007-04-26 12:40	24,320	--a------	C:\WINDOWS\system32\WER8274.DLL
2007-04-26 12:40	24,064	--a------	C:\WINDOWS\mspphe.dll
2007-04-26 12:40	22,528	--a------	C:\WINDOWS\bjam.dll
2007-04-26 12:40	22,016	--a------	C:\WINDOWS\system32\MSIXU.DLL
2007-04-26 12:40	20,736	--a------	C:\WINDOWS\mssvr.exe
2007-04-26 12:40	20,480	--a------	C:\WINDOWS\system32\satmat.exe
2007-04-26 12:40	20,480	--a------	C:\WINDOWS\cdsm32.dll
2007-04-26 12:40	18,944	--a------	C:\WINDOWS\system32\wml.exe
2007-04-26 12:40	15,872	--a------	C:\WINDOWS\bokja.exe
2007-04-26 12:40	12	--a------	C:\WINDOWS\system32\gtv_sd.bin
2007-04-23 17:44	20,480	--a------	C:\WINDOWS\system32\qip.exe
2007-04-23 17:43	23,552	--ah-----	C:\WINDOWS\system32\oayx.exe
2007-04-23 17:03 d--h-----	C:\Program Files\Common Files\delsim
2007-04-23 16:54	110,592	--a------	C:\WINDOWS\system32\avgfwafu.dll
2007-04-22 14:23 d--------	C:\WINDOWS\system32\bits
2007-04-22 14:20	7,680	---------	C:\WINDOWS\system32\bitsprx2.dll
2007-04-22 14:20	7,168	---------	C:\WINDOWS\system32\bitsprx3.dll
2007-04-22 14:20	331,776	--a------	C:\WINDOWS\system32\winhttp.dll
2007-04-22 14:20	17,408	--a------	C:\WINDOWS\system32\qmgrprxy.dll
2007-04-22 14:20	158,720	---------	C:\WINDOWS\system32\xpob2res.dll
2007-04-21 22:39	121	--a------	C:\WINDOWS\system32\esaxqqvn.bat
2007-04-21 22:23 d--------	C:\WINDOWS\system32\ActiveScan
2007-04-21 22:03	127	--a------	C:\WINDOWS\system32\qrfse.bat
2007-04-21 21:57 d--------	C:\WINDOWS\system32\SoftwareDistribution
2007-04-21 21:52 d--------	C:\WINDOWS\SoftwareDistribution
2007-04-21 21:47	465,176	--a------	C:\WINDOWS\system32\wuapi.dll
2007-04-21 21:47	41,240	--a------	C:\WINDOWS\system32\wups.dll
2007-04-21 21:47	194,328	--a------	C:\WINDOWS\system32\wuaueng1.dll
2007-04-21 21:47	173,536	--a------	C:\WINDOWS\system32\wuweb.dll
2007-04-21 21:47	172,312	--a------	C:\WINDOWS\system32\wuauclt1.exe
2007-04-21 21:47	127,256	--a------	C:\WINDOWS\system32\wucltui.dll
2007-04-21 21:26 d--------	C:\WINDOWS\Prefetch
2007-04-21 21:11	24,661	--a------	C:\WINDOWS\system32\spxcoins.dll
2007-04-21 21:11	13,312	--a------	C:\WINDOWS\system32\irclass.dll
2007-04-21 21:03 d--------	C:\WINDOWS\setupupd
2007-04-21 20:53 d--------	C:\WINDOWS\setup.pss
2007-04-21 16:07 d--------	C:\DOCUME~1\Owner\APPLIC~1\vlc
2007-04-21 16:01 d--------	C:\Program Files\DivX
2007-04-21 15:58 d--------	C:\Program Files\VideoLAN
2007-04-21 15:38	204,800	--a------	C:\WINDOWS\system32\clcl5.exe
2007-04-20 00:16 d--------	C:\DOCUME~1\Owner\APPLIC~1\Leadertech
2007-04-19 21:57 d--------	C:\DOCUME~1\Owner\APPLIC~1\AdobeUM
2007-04-19 21:57 d--------	C:\DOCUME~1\Owner\APPLIC~1\AdobeAUM
2007-04-19 21:41 d--------	C:\WINDOWS\Downloaded Installations
2007-04-19 20:41 d--------	C:\Program Files\Lavasoft
2007-04-19 20:21 d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
2007-04-17 17:38	20,480	--a------	C:\WINDOWS\system32\wmpui.dll
2007-04-17 17:38	20,480	--a------	C:\WINDOWS\system32\wmpcore.dll
2007-04-17 17:38	20,480	--a------	C:\WINDOWS\system32\wmpcd.dll
2007-04-17 17:36	86,016	--a------	C:\WINDOWS\system32\wmpshell.dll
2007-04-17 17:36	8,192	--a------	C:\WINDOWS\system32\asferror.dll
2007-04-17 17:36	484,352	--a------	C:\WINDOWS\system32\Audiodev.dll
2007-04-17 17:36	3,371,008	--a------	C:\WINDOWS\system32\wmploc.dll
2007-04-17 17:36	282,624	--a------	C:\WINDOWS\system32\wmpdxm.dll
2007-04-17 17:36	189,440	--a------	C:\WINDOWS\system32\wmerror.dll
2007-04-17 17:36	175,104	--a------	C:\WINDOWS\system32\wmpsrcwp.dll
2007-04-17 17:36	135,168	--a------	C:\WINDOWS\system32\wmpasf.dll
2007-04-17 17:36	1,594,880	--a------	C:\WINDOWS\system32\wmpencen.dll
2007-04-17 17:35	66,560	--a------	C:\WINDOWS\system32\wpdmtpus.dll
2007-04-17 17:35	61,952	--a------	C:\WINDOWS\system32\wpdconns.dll
2007-04-17 17:35	47,104	--a------	C:\WINDOWS\system32\uwdf.exe
2007-04-17 17:35	38,912	--a------	C:\WINDOWS\system32\wdfmgr.exe
2007-04-17 17:35	364,784	--a------	C:\WINDOWS\system32\MSSCP.dll
2007-04-17 17:35	331,776	--a------	C:\WINDOWS\system32\wpdmtpdr.dll
2007-04-17 17:35	331,264	--a------	C:\WINDOWS\system32\wpdsp.dll
2007-04-17 17:35	33,792	--a------	C:\WINDOWS\system32\WMDMPS.dll
2007-04-17 17:35	28,160	--a------	C:\WINDOWS\system32\WMDMLOG.dll
2007-04-17 17:35	25,088	--a------	C:\WINDOWS\system32\MsPMSNSv.dll
2007-04-17 17:35	18,944	--a------	C:\WINDOWS\system32\drivers\wpdusb.sys
2007-04-17 17:35	173,568	--a------	C:\WINDOWS\system32\MsPMSP.dll
2007-04-17 17:35	164,864	--a------	C:\WINDOWS\system32\cewmdm.dll
2007-04-17 17:35	15,872	--a------	C:\WINDOWS\system32\wdfapi.dll
2007-04-17 17:35	114,176	--a------	C:\WINDOWS\system32\wpdmtp.dll
2007-04-17 17:34	96,768	--a------	C:\WINDOWS\system32\logagent.exe
2007-04-17 17:34 940,544	--a------	C:\WINDOWS\system32\wmspdmoe.dll
2007-04-17 17:34	895,736	--a------	C:\WINDOWS\system32\wmvdmod.dll
2007-04-17 17:34	774,904	--a------	C:\WINDOWS\system32\wmsdmod.dll
2007-04-17 17:34	716,288	--a------	C:\WINDOWS\system32\wmadmoe.dll
2007-04-17 17:34	6,656	--a------	C:\WINDOWS\system32\laprxy.dll
2007-04-17 17:34	413,944	--a------	C:\WINDOWS\system32\wmspdmod.dll
2007-04-17 17:34	396,528	--a------	C:\WINDOWS\system32\wmadmod.dll
2007-04-17 17:34	335,872	--a------	C:\WINDOWS\system32\WMDRMdev.dll
2007-04-17 17:34	315,904	--a------	C:\WINDOWS\system32\MSWMDM.dll
2007-04-17 17:34	290,816	--a------	C:\WINDOWS\system32\WMDRMNet.dll
2007-04-17 17:34	224,768	--a------	C:\WINDOWS\system32\wmasf.dll
2007-04-17 17:34	221,184	--a------	C:\WINDOWS\system32\qasf.dll
2007-04-17 17:34	150,016	--a------	C:\WINDOWS\system32\wmidx.dll
2007-04-17 17:34	1,512,448	--a------	C:\WINDOWS\system32\WMVADVE.DLL
2007-04-17 17:34	1,218,808	--a------	C:\WINDOWS\system32\wmvadvd.dll
2007-04-17 17:34	1,119,744	--a------	C:\WINDOWS\system32\wmsdmoe2.dll
2007-04-17 17:34	1,027,072	--a------	C:\WINDOWS\system32\wmnetmgr.dll
2007-04-17 17:34	1,003,008	--a------	C:\WINDOWS\system32\wmvdmoe2.dll
2007-04-17 17:34 d--------	C:\WINDOWS\RegisteredPackages
2007-04-16 23:15 d--h-----	C:\WINDOWS\PIF
2007-04-16 23:10	22,112	-ra------	C:\WINDOWS\system32\drivers\COH_Mon.sys
2007-04-16 22:29	48,776	--a------	C:\WINDOWS\system32\S32EVNT1.DLL
2007-04-16 22:29	115,000	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-04-16 22:29 d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-04-16 22:16 d--------	C:\Program Files\Common Files\Symantec Shared
2007-04-16 22:07 d--------	C:\Program Files\PowerISO
2007-04-16 21:46 d--------	C:\Program Files\Microsoft Picture It! 7
2007-04-16 21:14 d--------	C:\Program Files\Canon
2007-04-16 21:06	107,008	--a------	C:\WINDOWS\system32\CNMLM58.DLL
2007-04-16 21:05	73,728	-ra------	C:\WINDOWS\system32\CNMCP58.exe
2007-04-16 21:05	6,656	--a------	C:\WINDOWS\system32\CNMVS58.DLL
2007-04-16 21:05 d--h-----	C:\BJPrinter
2007-04-16 21:05 d--------	C:\WINDOWS\StartHtmico
2007-04-16 21:05 d--------	C:\WINDOWS\I560
2007-04-16 20:30 d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-04-16 20:15 d--------	C:\DOCUME~1\Owner\Contacts
2007-04-16 20:12 d----c---	C:\WINDOWS\system32\DRVSTORE
2007-04-16 20:11 d--------	C:\Program Files\MSN Messenger
2007-04-16 19:52 d--------	C:\DOCUME~1\Owner\APPLIC~1\Lavasoft
2007-04-15 14:01	1,460	--ah-----	C:\WINDOWS\system32\rttae.exe
2007-04-14 21:08 d--------	C:\DOCUME~1\Owner\.housecall6.6
2007-04-14 20:58	671	--a------	C:\WINDOWS\mozver.dat
2007-04-14 20:06 d--hs----	C:\RECYCLER
2007-04-14 19:53	499,712	--a------	C:\WINDOWS\system32\msvcp71.dll
2007-04-14 19:50 d--------	C:\DOCUME~1\Owner\APPLIC~1\Azureus
2007-04-14 19:50 d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
2007-04-14 19:45 d--------	C:\Program Files\Azureus
2007-04-14 19:40	0	--a------	C:\WINDOWS\nsreg.dat
2007-04-14 19:39	5,805,656	--a------	C:\Program Files\Firefox Setup 2.0.0.3.exe
2007-04-14 19:28 d--------	C:\WINDOWS\pss
2007-04-14 19:21	24,064	--a------	C:\WINDOWS\system32\IntelNic.dll
2007-04-14 19:21	154,112	--a------	C:\WINDOWS\system32\drivers\e100b325.sys
2007-04-14 19:21	12,288	--a------	C:\WINDOWS\system32\e100bmsg.dll
2007-04-14 19:21	118,784	--a------	C:\WINDOWS\system32\Prounstl.exe
2007-04-14 19:17	50,048	--a------	C:\WINDOWS\system32\drivers\DMusic.sys
2007-04-14 19:17	5,888	--a------	C:\WINDOWS\system32\drivers\splitter.sys
2007-04-14 19:16	991,232	--a------	C:\WINDOWS\system32\virtear.dll
2007-04-14 19:16	65,536	--a------	C:\WINDOWS\system32\Audio3d.dll
2007-04-14 19:16	49,152	--a------	C:\WINDOWS\system32\DSndUp.exe
2007-04-14 19:16	45,056	--a------	C:\WINDOWS\system32\CleanUp.exe
2007-04-14 19:16	4,096	--a------	C:\WINDOWS\system32\ksuser.dll
2007-04-14 19:16 d--------	C:\WINDOWS\VirtualEar
2007-04-14 19:16 d--------	C:\Program Files\Analog Devices
2007-04-14 19:14 d--------	C:\Program Files\Intel
2007-04-14 19:04	61,440	--a------	C:\WINDOWS\system32\iAlmCoIn_v4020.dll
2007-04-14 19:04	516,096	--a------	C:\WINDOWS\system32\ialmgdev.dll
2007-04-14 19:04	2,289,664	--a------	C:\WINDOWS\system32\ialmgicd.dll
2007-04-14 19:03	765,952	--a------	C:\WINDOWS\system\crlds3d.dll
2007-04-14 19:03	732,928	--a------	C:\WINDOWS\system32\drivers\senfilt.sys
2007-04-14 19:03	311,296	--a------	C:\WINDOWS\system32\Edcrypt.dll
2007-04-14 19:03	260,352	--a------	C:\WINDOWS\system32\drivers\smwdm.sys
2007-04-14 19:03	23,040	--a------	C:\WINDOWS\system32\PostProc.dll
2007-04-14 19:01 d--------	C:\driver
2007-04-14 17:28 d--------	C:\WINDOWS\OPTIONS
2007-04-14 17:27	41,852	--a------	C:\WINDOWS\system32\UpdDrv2K.exe
2007-04-14 17:27 d--------	C:\Program Files\3Com Corporation
2007-04-14 17:26 d--------	C:\Program Files\UIU
2007-04-14 17:24	89,360	--a------	C:\WINDOWS\system32\VB5DB.DLL
2007-04-14 17:24	446,464	-ra------	C:\WINDOWS\system32\hhactivex.dll
2007-04-14 17:24	176,128	--a------	C:\WINDOWS\system32\RcdScan.dll
2007-04-14 17:24	13,632	--a------	C:\WINDOWS\system32\drivers\omci.sys
2007-04-14 17:24 d--h-----	C:\Program Files\InstallShield Installation Information
2007-04-14 17:24 d--------	C:\Program Files\Common Files\InstallShield
2007-04-14 17:21 d--------	C:\DOCUME~1\Owner\APPLIC~1\Share-to-Web Upload Folder
2007-04-14 17:20 d--------	C:\Program Files\Common Files\Hewlett-Packard
2007-04-14 17:19	82,380	--a------	C:\WINDOWS\system32\drivers\AFS2K.SYS
2007-04-14 17:19	450,560	-ra------	C:\WINDOWS\system32\hpgt35.dll
2007-04-14 17:19	262,144	-ra------	C:\WINDOWS\system32\hpgwiamd.dll
2007-04-14 17:19	14,208	--a------	C:\WINDOWS\system32\drivers\usbscan.sys
2007-04-14 17:19	131,072	-ra------	C:\WINDOWS\system32\hpsjvset.dll
2007-04-14 17:19 d--------	C:\Program Files\Hewlett-Packard
2007-04-14 16:42 d--------	C:\WINDOWS\system32\Backup
2007-04-14 16:41 d--------	C:\WINDOWS\SQLHotfix
2007-04-14 16:40	33,340	--a------	C:\WINDOWS\system32\dbmsqlgc.dll
2007-04-14 16:40	306,688	--a------	C:\WINDOWS\IsUninst.exe
2007-04-14 16:40	24,576	--a------	C:\WINDOWS\system32\dbmsgnet.dll
2007-04-14 16:39 d--------	C:\Program Files\Microsoft Visual Studio .NET 2003
2007-04-14 16:39 d--------	C:\Program Files\Common Files\Crystal Decisions
2007-04-14 16:38 d--------	C:\Program Files\Microsoft SQL Server
2007-04-14 16:36 d--------	C:\WINDOWS\system32\URTTemp
2007-04-14 16:26	24,816	--a------	C:\WINDOWS\system32\mdimon.dll
2007-04-14 16:25 d--------	C:\Program Files\Microsoft ActiveSync
2007-04-14 16:24 d--h-----	C:\WINDOWS\ShellNew
2007-04-14 16:21 dr-h-----	C:\MSOCache
2007-04-14 16:15	945,936	--a------	C:\WINDOWS\system32\msjava.dll
2007-04-14 16:15	63,248	--a------	C:\WINDOWS\system32\javaprxy.dll
2007-04-14 16:15	6,550	--a------	C:\WINDOWS\jautoexp.dat
2007-04-14 16:15	49,424	--a------	C:\WINDOWS\system32\clspack.exe
2007-04-14 16:15	46,352	--a------	C:\WINDOWS\setdebug.exe
2007-04-14 16:15	404,752	--a------	C:\WINDOWS\system32\javart.dll
2007-04-14 16:15	313,856	--a------	C:\WINDOWS\system32\dx3j.dll
2007-04-14 16:15	286,992	--a------	C:\WINDOWS\system32\vmhelper.dll
2007-04-14 16:15	262,144	--a------	C:\DOCUME~1\NETWOR~1\NTUSER.DAT
2007-04-14 16:15	237,568	--a------	C:\DOCUME~1\LOCALS~1\NTUSER.DAT
2007-04-14 16:15	21,264	--a------	C:\WINDOWS\system32\msjdbc10.dll
2007-04-14 16:15	2,097,152	--a------	C:\DOCUME~1\Owner\NTUSER.DAT
2007-04-14 16:15	187,152	--a------	C:\WINDOWS\system32\javacypt.dll
2007-04-14 16:15	172,304	--a------	C:\WINDOWS\system32\jview.exe
2007-04-14 16:15	171,792	--a------	C:\WINDOWS\system32\wjview.exe
2007-04-14 16:15	171,280	--a------	C:\WINDOWS\system32\jit.dll
2007-04-14 16:15	154,384	--a------	C:\WINDOWS\system32\msawt.dll
2007-04-14 16:15	15,120	--a------	C:\WINDOWS\system32\jdbgmgr.exe
2007-04-14 16:15	139,536	--a------	C:\WINDOWS\system32\javaee.dll
2007-04-14 16:15	113	--a------	C:\WINDOWS\system32\zonedon.reg
2007-04-14 16:15	113	--a------	C:\WINDOWS\system32\zonedoff.reg
2007-04-14 16:15 d--hs----	C:\WINDOWS\Installer
2007-04-14 16:15 d--hs----	C:\System Volume Information
2007-04-14 16:12	5,473,872	--a------	C:\WINDOWS\system32\MSJAVX86.EXE
2007-04-14 16:12	249,856	---h-----	C:\DOCUME~1\DEFAUL~1\NTUSER.DAT
2007-04-14 16:12 d--------	C:\WINDOWS\system32\xircom
2007-04-14 16:12 d--------	C:\Program Files\microsoft frontpage
2007-04-14 16:12 d--------	C:\DELL
2007-04-14 16:11	112,128	--a------	C:\WINDOWS\system32\mapi32.dll
2007-04-14 16:11	0	-rahs----	C:\MSDOS.SYS
2007-04-14 16:11	0	-rahs----	C:\IO.SYS
2007-04-14 16:11	0	--a------	C:\CONFIG.SYS
2007-04-14 16:11	0	---------	C:\AUTOEXEC.BAT
2007-04-14 16:10 dr-------	C:\WINDOWS\Offline Web Pages
2007-04-14 16:10 d--hs----	C:\DOCUME~1\ALLUSE~1\DRM
2007-04-14 16:10 d---s----	C:\WINDOWS\Downloaded Program Files
2007-04-14 16:10 d--------	C:\WINDOWS\srchasst
2007-04-14 16:09	40,960	--a------	C:\WINDOWS\system32\safrslv.dll
2007-04-14 16:09	39,424	--a------	C:\WINDOWS\system32\safrcdlg.dll
2007-04-14 16:09	361,984	--a------	C:\WINDOWS\system32\qmgr.dll
2007-04-14 16:09	33,280	--a------	C:\WINDOWS\system32\racpldlg.dll
2007-04-14 16:09	26,624	--a------	C:\WINDOWS\system32\safrdm.dll
2007-04-14 16:09	11,264	--a------	C:\WINDOWS\system32\atrace.dll
2007-04-14 16:09 d--------	C:\WINDOWS\system32\Macromed
2007-04-14 16:09 d--------	C:\WINDOWS\system32\DirectX
2007-04-14 16:09 d--------	C:\Program Files\Movie Maker
2007-04-14 16:08	77,824	--a------	C:\WINDOWS\system32\isign32.dll
2007-04-14 16:08	69,632	--a------	C:\WINDOWS\system32\icwdial.dll
2007-04-14 16:08	69,248	--a------	C:\WINDOWS\system32\drivers\sr.sys
2007-04-14 16:08	64,512	--a------	C:\WINDOWS\system32\acctres.dll
2007-04-14 16:08	61,440	--a------	C:\WINDOWS\system32\icwphbk.dll
2007-04-14 16:08	47,616	--a------	C:\WINDOWS\system32\inetres.dll
2007-04-14 16:08	32,768	--a------	C:\WINDOWS\system32\mnmsrvc.exe
2007-04-14 16:08	28,672	--a------	C:\WINDOWS\system32\isrdbg32.dll
2007-04-14 16:08	266,240	--a------	C:\WINDOWS\system32\inetcfg.dll
2007-04-14 16:08	23,316	--a------	C:\WINDOWS\system32\emptyregdb.dat
2007-04-14 16:08	16,384	--a------	C:\WINDOWS\system32\icfgnt5.dll
2007-04-14 16:08	12,288	--a------	C:\WINDOWS\system32\nmevtmsg.dll
2007-04-14 16:08 d---s----	C:\WINDOWS\Tasks
2007-04-14 16:08 d--------	C:\WINDOWS\system32\Restore
2007-04-14 16:08 d--------	C:\WINDOWS\Registration
2007-04-14 16:08 d--------	C:\WINDOWS\PCHEALTH
2007-04-14 16:08 d--------	C:\Program Files\Common Files\MSSoap
2007-04-14 16:07	73,216	--a------	C:\WINDOWS\system32\avwav.dll
2007-04-14 16:07	5,632	--a------	C:\WINDOWS\system32\write.exe
2007-04-14 16:07	489,984	--a------	C:\WINDOWS\system32\hypertrm.dll
2007-04-14 16:07	44,544	--a------	C:\WINDOWS\system32\hticons.dll
2007-04-14 16:07	35,328	--a------	C:\WINDOWS\system32\winchat.exe
2007-04-14 16:07	227,840	--a------	C:\WINDOWS\system32\avtapi.dll
2007-04-14 16:07	179,200	--a------	C:\WINDOWS\system32\accwiz.exe
2007-04-14 16:07	16,384	--a------	C:\WINDOWS\system32\avmeter.dll
2007-04-14 16:07	138,752	--a------	C:\WINDOWS\system32\sndvol32.exe
2007-04-14 16:07	124,416	--a------	C:\WINDOWS\system32\sndrec32.exe
2007-04-14 16:07 d--h-----	C:\Program Files\WindowsUpdate
2007-04-14 16:07 d--------	C:\Program Files\Windows NT
2007-04-14 16:07 d--------	C:\Program Files\Online Services
2007-04-14 16:07 d--------	C:\Program Files\MSN Gaming Zone
2007-04-14 16:07 d--------	C:\Program Files\Messenger
2007-04-14 16:06	9,728	--a------	C:\WINDOWS\system32\xolehlp.dll
2007-04-14 16:06	9,728	--a------	C:\WINDOWS\system32\reset.exe
2007-04-14 16:06	869,376	--a------	C:\WINDOWS\system32\msdtctm.dll
2007-04-14 16:06	85,504	--a------	C:\WINDOWS\system32\catsrvps.dll
2007-04-14 16:06	83,968	--a------	C:\WINDOWS\system32\mtxoci.dll
2007-04-14 16:06	82,432	--a------	C:\WINDOWS\system32\comrepl.dll
2007-04-14 16:06	80,384	--a------	C:\WINDOWS\system32\charmap.exe
2007-04-14 16:06	61,952	--a------	C:\WINDOWS\system32\rdshost.exe
2007-04-14 16:06	605,696	--a------	C:\WINDOWS\system32\getuname.dll
2007-04-14 16:06	6,144	--a------	C:\WINDOWS\system32\msdtc.exe
2007-04-14 16:06	56,832	--a------	C:\WINDOWS\system32\sol.exe
2007-04-14 16:06	56,832	--a------	C:\WINDOWS\system32\colbact.dll
2007-04-14 16:06	55,296	--a------	C:\WINDOWS\system32\freecell.exe
2007-04-14 16:06	54,784	--a------	C:\WINDOWS\system32\msdtclog.dll
2007-04-14 16:06	54,272	--a------	C:\WINDOWS\system32\stclient.dll
2007-04-14 16:06	53,248	--a------	C:\WINDOWS\system32\servdeps.dll
2007-04-14 16:06	5,120	--a------	C:\WINDOWS\system32\dcomcnfg.exe
2007-04-14 16:06	495,616	--a------	C:\WINDOWS\system32\comuid.dll
2007-04-14 16:06	468,480	--a------ C:\WINDOWS\system32\clbcatq.dll
2007-04-14 16:06	4,096	--a------	C:\WINDOWS\system32\rdpcfgex.dll
2007-04-14 16:06	4,096	--a------	C:\WINDOWS\system32\mtxex.dll
2007-04-14 16:06	38,024	--a------	C:\WINDOWS\system32\drivers\termdd.sys
2007-04-14 16:06	33,792	--a------	C:\WINDOWS\system32\regini.exe
2007-04-14 16:06	25,600	--a------	C:\WINDOWS\system32\comaddin.dll
2007-04-14 16:06	25,088	--a------	C:\WINDOWS\system32\mtxlegih.dll
2007-04-14 16:06	22,016	--a------	C:\WINDOWS\system32\qwinsta.exe
2007-04-14 16:06	215,040	--a------	C:\WINDOWS\system32\catsrv.dll
2007-04-14 16:06	20,992	--a------	C:\WINDOWS\system32\msg.exe
2007-04-14 16:06	20,480	--a------	C:\WINDOWS\system32\mtxdm.dll
2007-04-14 16:06	20,232	--a------	C:\WINDOWS\system32\drivers\tdtcp.sys
2007-04-14 16:06	182,400	--a------	C:\WINDOWS\system32\drivers\rdpdr.sys
2007-04-14 16:06	18,432	--a------	C:\WINDOWS\system32\qprocess.exe
2007-04-14 16:06	174,592	--a------	C:\WINDOWS\system32\cmprops.dll
2007-04-14 16:06	16,896	--a------	C:\WINDOWS\system32\tsshutdn.exe
2007-04-14 16:06	16,896	--a------	C:\WINDOWS\system32\qappsrv.exe
2007-04-14 16:06	16,384	--a------	C:\WINDOWS\system32\tskill.exe
2007-04-14 16:06	16,384	--a------	C:\WINDOWS\system32\mmfutil.dll
2007-04-14 16:06	151,040	--a------	C:\WINDOWS\system32\msdtcuiu.dll
2007-04-14 16:06	15,872	--a------	C:\WINDOWS\system32\rwinsta.exe
2007-04-14 16:06	15,872	--a------	C:\WINDOWS\system32\cdmodem.dll
2007-04-14 16:06	15,360	--a------	C:\WINDOWS\system32\logoff.exe
2007-04-14 16:06	147,456	--a------	C:\WINDOWS\system32\comsnap.dll
2007-04-14 16:06	14,848	--a------	C:\WINDOWS\system32\tsdiscon.exe
2007-04-14 16:06	14,848	--a------	C:\WINDOWS\system32\tscon.exe
2007-04-14 16:06	14,848	--a------	C:\WINDOWS\system32\shadow.exe
2007-04-14 16:06	129,024	--a------	C:\WINDOWS\system32\sessmgr.exe
2007-04-14 16:06	126,976	--a------	C:\WINDOWS\system32\mshearts.exe
2007-04-14 16:06	124,184	--a------	C:\WINDOWS\system32\wuauclt.exe
2007-04-14 16:06	119,808	--a------	C:\WINDOWS\system32\winmine.exe
2007-04-14 16:06	115,976	--a------	C:\WINDOWS\system32\drivers\rdpwd.sys
2007-04-14 16:06	114,688	--a------	C:\WINDOWS\system32\calc.exe
2007-04-14 16:06	11,144	--a------	C:\WINDOWS\system32\drivers\tdpipe.sys
2007-04-14 16:06	100,864	--a------	C:\WINDOWS\system32\clbcatex.dll
2007-04-14 16:06	1,343,768	--a------	C:\WINDOWS\system32\wuaueng.dll
2007-04-14 16:06	1,161	--a------	C:\WINDOWS\system32\usrlogon.cmd
2007-04-14 16:06 d--------	C:\WINDOWS\system32\MsDtc
2007-04-14 16:06 d--------	C:\WINDOWS\system32\Com
2007-04-14 09:03	3,072	--a------	C:\WINDOWS\system32\drivers\audstub.sys
2007-04-14 09:02	56,576	--a------	C:\WINDOWS\system32\drivers\redbook.sys
2007-04-14 09:01 dr-------	C:\Program Files
2007-04-14 09:01 d--------	C:\Program Files\Common Files\SpeechEngines
2007-04-14 09:01 d--------	C:\Program Files\Common Files\ODBC
2007-04-14 09:00	69,584	--a------	C:\WINDOWS\system\AVICAP.DLL
2007-04-14 09:00	176,157	--a------	C:\WINDOWS\system32\dgrpsetu.dll
2007-04-14 09:00	103,424	--a------	C:\WINDOWS\system32\EqnClass.Dll
2007-04-14 09:00	10,496	--a------	C:\WINDOWS\system32\drivers\irenum.sys
2007-04-14 09:00 dr-------	C:\DOCUME~1\ALLUSE~1\Documents
2007-04-14 09:00 d--------	C:\WINDOWS\system32\CatRoot2
2007-04-14 09:00 d--------	C:\WINDOWS\system32\CatRoot
2007-04-14 09:00 d--------	C:\Documents and Settings
2007-04-14 08:54 dr-hsc---	C:\WINDOWS\system32\dllcache
2007-04-14 08:54 dr--s----	C:\WINDOWS\Fonts
2007-04-14 08:54 dr-------	C:\WINDOWS\Web
2007-04-14 08:54 d--h-----	C:\WINDOWS\inf


----------



## monkeybubbles (Apr 26, 2007)

2007-04-14 08:54 d--------	C:\WINDOWS\WinSxS
2007-04-14 08:54 d--------	C:\WINDOWS\twain_32
2007-04-14 08:54 d--------	C:\WINDOWS\system32\wins
2007-04-14 08:54 d--------	C:\WINDOWS\system32\wbem
2007-04-14 08:54 d--------	C:\WINDOWS\system32\usmt
2007-04-14 08:54 d--------	C:\WINDOWS\system32\spool
2007-04-14 08:54 d--------	C:\WINDOWS\system32\ShellExt
2007-04-14 08:54 d--------	C:\WINDOWS\system32\Setup
2007-04-14 08:54 d--------	C:\WINDOWS\system32\ras
2007-04-14 08:54 d--------	C:\WINDOWS\system32\oobe
2007-04-14 08:54 d--------	C:\WINDOWS\system32\npp
2007-04-14 08:54 d--------	C:\WINDOWS\system32\mui
2007-04-14 08:54 d--------	C:\WINDOWS\system32\inetsrv
2007-04-14 08:54 d--------	C:\WINDOWS\system32\IME
2007-04-14 08:54 d--------	C:\WINDOWS\system32\icsxml
2007-04-14 08:54 d--------	C:\WINDOWS\system32\ias
2007-04-14 08:54 d--------	C:\WINDOWS\system32\export
2007-04-14 08:54 d--------	C:\WINDOWS\system32\drivers\etc
2007-04-14 08:54 d--------	C:\WINDOWS\system32\drivers\disdn
2007-04-14 08:54 d--------	C:\WINDOWS\system32\drivers
2007-04-14 08:54 d--------	C:\WINDOWS\system32\dhcp
2007-04-14 08:54 d--------	C:\WINDOWS\system32\config
2007-04-14 08:54 d--------	C:\WINDOWS\system32\3com_dmi
2007-04-14 08:54 d--------	C:\WINDOWS\system32\3076
2007-04-14 08:54 d--------	C:\WINDOWS\system32\2052
2007-04-14 08:54 d--------	C:\WINDOWS\system32\1054
2007-04-14 08:54 d--------	C:\WINDOWS\system32\1042
2007-04-14 08:54 d--------	C:\WINDOWS\system32\1041
2007-04-14 08:54 d--------	C:\WINDOWS\system32\1037
2007-04-14 08:54 d--------	C:\WINDOWS\system32\1033
2007-04-14 08:54 d--------	C:\WINDOWS\system32\1031
2007-04-14 08:54 d--------	C:\WINDOWS\system32\1028
2007-04-14 08:54 d--------	C:\WINDOWS\system32\1025
2007-04-14 08:54 d--------	C:\WINDOWS\system32
2007-04-14 08:54 d--------	C:\WINDOWS\system
2007-04-14 08:54 d--------	C:\WINDOWS\security
2007-04-14 08:54 d--------	C:\WINDOWS\Resources
2007-04-14 08:54 d--------	C:\WINDOWS\repair
2007-04-14 08:54 d--------	C:\WINDOWS\mui
2007-04-14 08:54 d--------	C:\WINDOWS\msapps
2007-04-14 08:54 d--------	C:\WINDOWS\msagent
2007-04-14 08:54 d--------	C:\WINDOWS\Media
2007-04-14 08:54 d--------	C:\WINDOWS\ime
2007-04-14 08:54 d--------	C:\WINDOWS\Help
2007-04-14 08:54 d--------	C:\WINDOWS\Driver Cache
2007-04-14 08:54 d--------	C:\WINDOWS\Debug
2007-04-14 08:54 d--------	C:\WINDOWS\Cursors
2007-04-14 08:54 d--------	C:\WINDOWS\Connection Wizard
2007-04-14 08:54 d--------	C:\WINDOWS\Config
2007-04-14 08:54 d--------	C:\WINDOWS\AppPatch
2007-04-14 08:54 d--------	C:\WINDOWS\addins
2007-04-14 08:54 d--------	C:\WINDOWS

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-04-28 15:02	16896	--a------	C:\WINDOWS\system32\tftp.exe
2007-04-14 09:00	62	--ahs----	C:\DOCUME~1\Owner\APPLIC~1\desktop.ini

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}	C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
{DC5051EF-AE3D-4E7D-989B-ACF0317C0F0F}	C:\WINDOWS\System32\mlljk.dll [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"PWRISOVM.EXE"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Microsoft Works Update Detection"="C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe"
"Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"
"RegistryMechanic"=""
"Symantec PIF AlertEng"="\"C:\\Program Files\\Common Files\\Symantec Shared\\PIF\\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\\PIFSvc.exe\" /a /m \"C:\\Program Files\\Common Files\\Symantec Shared\\PIF\\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\\AlertEng.dll\""
"InfoData"="rundll32.exe \"C:\\WINDOWS\\qomjge.dll\",realset"
"igfxtray"="C:\\WINDOWS\\System32\\igfxtray.exe"
"igfxhkcmd"="C:\\WINDOWS\\System32\\hkcmd.exe"
"igfxpers"="C:\\WINDOWS\\System32\\igfxpers.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{9DED2B32-743B-47EB-874C-28AECF2A268D}"=""

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages	REG_MULTI_SZ msv1_0\0\0
Security Packages	REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages	REG_MULTI_SZ scecli\0\0

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced DHTML Enable]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="zcfvog"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ctfmon"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\System32\\ctfmon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hkcmd"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\hkcmd.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="igfxtray"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\igfxtray.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hpgs2wnd"
"hkey"="HKLM"
"command"="C:\\Program Files\\Hewlett-Packard\\HP Share-to-Web\\hpgs2wnd.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="smax4pnp"
"hkey"="HKLM"
"command"="C:\\Program Files\\Analog Devices\\Core\\smax4pnp.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tcpipmon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="tcpipmon"
"hkey"="HKLM"
"command"="tcpipmon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Network Firewall]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="firewall"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService	REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService	REG_MULTI_SZ DnsCache\0\0
rpcss	REG_MULTI_SZ RpcSs\0\0
imgsvc	REG_MULTI_SZ StiSvc\0\0
termsvcs	REG_MULTI_SZ TermService\0\0

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-03 18:38:27
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-05-03 18:38:28
C:\ComboFix-quarantined-files.txt ... 07-05-03 18:38
C:\ComboFix2.txt ... 07-05-03 18:36
C:\ComboFix3.txt ... 07-04-27 14:03


----------



## sjpritch25 (Sep 8, 2005)

Run HijackThis, and press "Do a System Scan Only". 
1. When the scan is complete place a check mark next to the following entries:
*
O2 - BHO: (no name) - {2265EED7-6022-4d6c-ADF2-E932FEFD433C} - (no file)
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: (no name) - {DC5051EF-AE3D-4E7D-989B-ACF0317C0F0F} - C:\WINDOWS\System32\mlljk.dll (file missing)
O2 - BHO: (no name) - {EEFBE5D6-FEFF-4CB4-AA26-6A464090CB89} - (no file)
O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\qomjge.dll",realset
*
2. After checking these items CLOSE ALL open windows EXCEPT HijackThis and click "Fix Checked." Then, reboot your computer...

===================================

*Download and scan with* *SUPERAntiSpyware* Free for Home Users
Double-click *SUPERAntiSpyware.exe* and use the default settings for installation.
An icon will be created on your desktop. Double-click that icon to launch the program.
If asked to update the program definitions, click "*Yes*". If not, update the definitions before scanning by selecting "*Check for Updates*". (_If you encounter any problems while downloading the updates, manually download and unzip them from here._)
Under "*Configuration and Preferences*", click the *Preferences* button.
Click the *Scanning Control* tab.
Under *Scanner Options* make sure the following are checked _(leave all others unchecked)_:
_Close browsers before scanning._
_Scan for tracking cookies._
_Terminate memory threats before quarantining._

Click the "*Close*" button to leave the control center screen.
Back on the main screen, under "*Scan for Harmful Software*" click *Scan your computer*.
On the left, make sure you check *C:\Fixed Drive*.
On the right, under "*Complete Scan*", choose *Perform Complete Scan*.
Click "*Next*" to start the scan. Please be patient while it scans your computer.
After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "*OK*".
Make sure everything has a checkmark next to it and click "*Next*".
A notification will appear that "_Quarantine and Removal is Complete_". Click "*OK*" and then click the "*Finish*" button to return to the main menu.
If asked if you want to reboot, click "*Yes*".
To retrieve the removal information after reboot, launch SUPERAntispyware again.
_Click *Preferences*, then click the *Statistics/Logs* tab._
_Under Scanner Logs, double-click *SUPERAntiSpyware Scan Log*._
_If there are several logs, click the current dated log and press *View log*. A text file will open in your default text editor._
_Please copy and paste the Scan Log results in your next reply._

Click *Close* to exit the program.


----------



## monkeybubbles (Apr 26, 2007)

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/06/2007 at 06:20 PM

Application Version : 3.7.1018

Core Rules Database Version : 3228
Trace Rules Database Version: 1239

Scan type : Complete Scan
Total Scan Time : 00:57:14

Memory items scanned : 335
Memory threats detected : 0
Registry items scanned : 6424
Registry threats detected : 13
File items scanned : 32497
File threats detected : 13

Adware.Vundo Variant
HKLM\Software\Classes\CLSID\{1557B435-8242-4686-9AA3-9265BF7525A4}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{9DED2B32-743B-47EB-874C-28AECF2A268D}
HKCR\CLSID\{1557B435-8242-4686-9AA3-9265BF7525A4}
HKCR\CLSID\{1557B435-8242-4686-9AA3-9265BF7525A4}\InprocServer32
HKCR\CLSID\{1557B435-8242-4686-9AA3-9265BF7525A4}\InprocServer32#ThreadingModel

Trojan.Spam-MailJack/KT
HKLM\Software\Classes\CLSID\{A3BC5E20-0235-1ABF-9CE1-00AA00512036}
HKCR\CLSID\{A3BC5E20-0235-1ABF-9CE1-00AA00512036}
HKCR\CLSID\{A3BC5E20-0235-1ABF-9CE1-00AA00512036}
HKCR\CLSID\{A3BC5E20-0235-1ABF-9CE1-00AA00512036}\InprocServer32
HKCR\CLSID\{A3BC5E20-0235-1ABF-9CE1-00AA00512036}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\TSJPF32.DLL

Trojan.Media-Codec
HKCR\BprintingHost.Serv
HKCR\BprintingHost.Serv\CLSID
HKCR\BprintingHost.Serv\CLSID\{38ca2fcd-7d7e-11db-96a0-00e08161165f}

Trojan.Downloader-CREW
C:\RECYCLER\S-1-5-21-1993962763-823518204-839522115-1003\DC1.MWT
C:\RECYCLER\S-1-5-21-1993962763-823518204-839522115-1003\DC10.MWT
C:\RECYCLER\S-1-5-21-1993962763-823518204-839522115-1003\DC2.MWT
C:\RECYCLER\S-1-5-21-1993962763-823518204-839522115-1003\DC3.MWT
C:\RECYCLER\S-1-5-21-1993962763-823518204-839522115-1003\DC5.MWT
C:\RECYCLER\S-1-5-21-1993962763-823518204-839522115-1003\DC9.MWT

Trojan.Downloader-Winlogon/Fake
C:\SDFIX\BACKUPS_OLD1\WINLOGON.EXE
C:\SDFIX\BACKUPS_OLD4\WINLOGON.EXE
C:\_OTMOVEIT\MOVEDFILES\DOCUMENTS AND SETTINGS\OWNER\LOCAL SETTINGS\TEMP\WINLOGON.EXE

Trojan.Downloader-Gen/HardFall
C:\VUNDOFIX BACKUPS\MLLJK.DLL.BAD
C:\VUNDOFIX BACKUPS\VTSQN.DLL.BAD

Adware.Second Thought
C:\WINDOWS\BOKJA.EXE


----------



## sjpritch25 (Sep 8, 2005)

Please post a fresh Hijackthis log. Thanks. How is everything running????


----------



## monkeybubbles (Apr 26, 2007)

my internet still doesn't work. i've talked to my cable people and they say it's a computer specific problem. all it does is say acquiring IP address. but other then my internet not working everything else seems to be running pretty good. I also was able to download the service pack 2 onto my laptop and then move it over onto my desktop now. so now i have it installed.

Logfile of HijackThis v1.99.1
Scan saved at 7:11:32 PM, on 06/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)


----------



## sjpritch25 (Sep 8, 2005)

Right-Click Here the choose "*Save As*" (in IE it's "Save Target As") to download ResetProtocolDefaults.reg by *WinHelp2002*.
Locate *ResetProtocolDefaults.reg*
Right-Click and select: *Meger*.
*Ok* the prompt.


Reboot your computer

Let me know about the internet. Thanks.


----------



## monkeybubbles (Apr 26, 2007)

I added the list to my registry but my internet still doesn't work. it is still acquiring an IP address only.


----------



## sjpritch25 (Sep 8, 2005)

Could you turn your cable modem off, leave it off for a couple minutes, plug it back in. Reboot your computer. Let me know what happens.


----------



## monkeybubbles (Apr 26, 2007)

internet still doesn't work. just keeps trying to acquire an IP address. it also wont allow me to turn my firewall on.


----------



## monkeybubbles (Apr 26, 2007)

i have connected to the internet via my wireless router. but it's not secured. and i don't know what happened to the disk to secure it.


----------



## monkeybubbles (Apr 26, 2007)

my internet worked for all of 10 minutes before it started the acquiring IP address thing again.


----------



## sjpritch25 (Sep 8, 2005)

Double-click on *OTMoveIt.exe* to launch the program.
Please copy the file(s)/folder(s) paths listed below - _highlight everything in red and press CTRL+C or right-click and choose *Copy*_.

*C:\WINDOWS\logo1_.exe
C:\WINDOWS\rundl132.dll
C:\WINDOWS\rundll16.exe
C:\WINDOWS\system32\iifgfgf.dll
C:\WINDOWS\system32\vcmgcd32.dll
C:\WINDOWS\zts2.exe
C:\WINDOWS\system32\gjqrgymt.bat
*

Then in OTMoveIt, _right-click in the open text box labeled_ "*Paste List of Files/Folders to be Moved*" _and choose *Paste*_.
Click the red *MoveIt!* button.
The list will be processed and the results for each line will be displayed in the right-hand pane.
Highlight everything in the *Results* window, _press CTRL+C or right-click, choose *Copy*, right-click again_ and *Paste* it in your next reply.
Close the program when done.
_*Important!*_ _If a file or folder cannot be moved immediately you may be asked to reboot your computer in order to finish the move process. If asked to reboot, choose *Yes*._

=================================

Please post a fresh Hijackthis log.


----------



## monkeybubbles (Apr 26, 2007)

C:\WINDOWS\logo1_.exe moved successfully.
C:\WINDOWS\rundl132.dll moved successfully.
C:\WINDOWS\rundll16.exe moved successfully.
C:\WINDOWS\system32\iifgfgf.dll moved successfully.
File/Folder C:\WINODWS\system 32\vcmgcd32.dll not found.
File/Folder C:\WINODWS\zts2.exe not found.
C:\WINDOWS\system32\gjqrgymt.bat moved successfully.

Created on 05/07/2007 18:06:36

Logfile of HijackThis v1.99.1
Scan saved at 6:08:38 PM, on 07/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.shaw.ca/start/enca/addons/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://start.shaw.ca/start/enca/addons/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.shaw.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.shaw.ca/start/enca/addons/search/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.shaw.ca
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.shaw.ca/start/enca/addons/search/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.shaw.ca/start/enca/addons/search/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by SHAW Internet
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)


----------



## sjpritch25 (Sep 8, 2005)

Lets see if this will fix your internet.

I think the following file may be corrupted.

Please download the file named *Tcpip.zip* from *Here*, Unzip/Extract Tcpip.sys to *C:\WINDOWS\system32\drivers* folder. You may get a promt "File already exits, do you want to replace it" Choose *yes*. Reboot your Computer and let me know if you can get online. Thanks. Also, let me know if your firewall is still not working. Because if we don't get one working you are going to be open for attack again.


----------



## monkeybubbles (Apr 26, 2007)

still no internet still no firewall


----------



## sjpritch25 (Sep 8, 2005)

Please run this to uninstall any leftover stuff
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039

Also, please uninstall AVG and re-download the file and re-install. It very well could of been corrupted by the virus.


----------



## sjpritch25 (Sep 8, 2005)

Also, let try some troubleshooting. 

Enter your *Control Panel* and double-click on *Network Connections*
Then right click on your *Default Connection*
Usually Local Area Connection for Cable and DSL, or AOL Connection
Left click on *Properties*
Double-Click on the *Internet Protocol (TCP/IP)* item
Select the radio dial that says *Obtain DNS Servers Automatically*
Press OK twice to get out of the properties screen
Restart the computer[\list]

Go to *Start*->*Run*->Type *CMD* and click *Ok*. The *MSDOS* Window will be displayed. At the command prompt, type the following and press *Enter* after each line:

*ipconfig /flushdns* (The space between g and / is needed)
*Exit*

Restart the computer.

If that does not resolve the issue and you are running SP2, follow these steps:

*Reset the Internet Protocol (TCP/IP)*

Go to *Start*->*Run*, type *CMD* and click *Ok*. The *MSDOS* window will be displayed. At the prompt type the following and press Enter after each line:

*netsh int ip reset C:\Resetlog.txt
netsh winsock reset catalog
Exit*

Restart the computer.

Go back into the cmd and type the following commands one at a time

regsvr32 netshell.dll
regsvr32 netcfgx.dll
regsvr32 netman.dll

============================================

Download *WinPFind3U.exe* to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.
Open the WinPFind3u folder and double-click on *WinPFind3U.exe* to start the program.
In the *Files Created Within* group click *30 days*
In the *Files Modified Within* group select *30 days*
In the *File String Search* group select *Non-Microsoft*

Now click the *Run Scan* button on the toolbar.
When the scan is complete Notepad will open with the report file loaded in it.
Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
Use the *Add Reply* button and Copy/Paste the information back here. I will review it when it comes in


----------



## monkeybubbles (Apr 26, 2007)

I did everything you said and my internet still doesn't work


----------



## monkeybubbles (Apr 26, 2007)

WinPFind3 logfile created on: 08/05/2007 8:01:18 PM
WinPFind3U by OldTimer - Version 1.0.35	Folder = C:\Documents and Settings\Owner\Desktop\WinPFind3u\
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)
Internet Explorer (Version = 6.0.2900.2180)

509.98 Mb Total Physical Memory | 293.18 Mb Available Physical Memory | 57.49% Memory free
1.22 Gb Paging File | 0.97 Gb Available in Paging File | 79.30% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 34.09 Gb Total Space | 21.73 Gb Free Space | 63.74% Space Free
D: Drive not present or media not loaded
Drive E: | 33.68 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free
F: Drive not present or media not loaded

Computer Name: BUBBLES
Current User Name: Owner
Logged in as Administrator.
Current Boot Mode: Normal

[Processes - Non-Microsoft Only]
apdproxy.exe -> %ProgramFiles%\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe -> Adobe Systems Incorporated [Ver = 3.0.0.49815 | Size = 57344 bytes | Modified Date = 06/06/2005 11:46:24 PM | Attr = ]
avgamsvr.exe -> %ProgramFiles%\Grisoft\AVG7\avgamsvr.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 343552 bytes | Modified Date = 08/05/2007 7:50:36 PM | Attr = ]
avgcc.exe -> %ProgramFiles%\Grisoft\AVG7\avgcc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.418 | Size = 406016 bytes | Modified Date = 08/05/2007 7:50:38 PM | Attr = ]
avgemc.exe -> %ProgramFiles%\Grisoft\AVG7\avgemc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 322560 bytes | Modified Date = 08/05/2007 7:50:38 PM | Attr = ]
avgfwsrv.exe -> %ProgramFiles%\Grisoft\AVG7\avgfwsrv.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 811008 bytes | Modified Date = 08/05/2007 7:50:38 PM | Attr = ]
avgrssvc.exe -> %ProgramFiles%\Grisoft\AVG7\avgrssvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 253952 bytes | Modified Date = 08/05/2007 7:50:36 PM | Attr = ]
avgupsvc.exe -> %ProgramFiles%\Grisoft\AVG7\avgupsvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 49664 bytes | Modified Date = 08/05/2007 7:50:42 PM | Attr = ]
hkcmd.exe -> %System32%\hkcmd.exe -> Intel Corporation [Ver = 3.0.0.4396 | Size = 77824 bytes | Modified Date = 20/09/2005 9:32:24 AM | Attr = ]
igfxpers.exe -> %System32%\igfxpers.exe -> Intel Corporation [Ver = 3.0.0.4396 | Size = 114688 bytes | Modified Date = 20/09/2005 9:36:20 AM | Attr = ]
jusched.exe -> %ProgramFiles%\Java\jre1.6.0_01\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 83608 bytes | Modified Date = 14/03/2007 3:43:44 AM | Attr = ]
pwrisovm.exe -> %ProgramFiles%\PowerISO\PWRISOVM.EXE -> PowerISO Computing, Inc. [Ver = 3, 0, 0, 0 | Size = 184320 bytes | Modified Date = 17/03/2006 7:24:18 PM | Attr = ]
superantispyware.exe -> %ProgramFiles%\SUPERAntiSpyware\SUPERAntiSpyware.exe -> SUPERAntiSpyware.com [Ver = 3, 7, 0, 1018 | Size = 1318128 bytes | Modified Date = 01/05/2007 9:29:58 AM | Attr = ]
winpfind3u.exe -> %UserDesktop%\WinPFind3u\WinPFind3U.exe -> OldTimer Tools [Ver = 1.0.35.0 | Size = 319488 bytes | Modified Date = 06/05/2007 9:38:54 AM | Attr = ]
wkufind.exe -> %CommonProgramFiles%\Microsoft Shared\Works Shared\WkUFind.exe -> Microsoft® Corporation [Ver = 7.00.0724.0 | Size = 28672 bytes | Modified Date = 24/07/2002 9:20:02 PM | Attr = ]
wzqkpick.exe -> %ProgramFiles%\WinZip\WZQKPICK.EXE -> WinZip Computing LP [Ver = 1.0 (32-bit) | Size = 389120 bytes | Modified Date = 21/11/2006 11:00:00 AM | Attr = ]

[Win32 Services - Non-Microsoft Only]
(Avg7Alrt) AVG7 Alert Manager Server [Win32_Own | Auto | Running] -> %ProgramFiles%\Grisoft\AVG7\avgamsvr.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 343552 bytes | Modified Date = 08/05/2007 7:50:36 PM | Attr = ]
(Avg7UpdSvc) AVG7 Update Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Grisoft\AVG7\avgupsvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 49664 bytes | Modified Date = 08/05/2007 7:50:42 PM | Attr = ]
(AvgCoreSvc) AVG7 Resident Shield Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Grisoft\AVG7\avgrssvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 253952 bytes | Modified Date = 08/05/2007 7:50:36 PM | Attr = ]
(AVGEMS) AVG E-mail Scanner [Win32_Own | Auto | Running] -> %ProgramFiles%\Grisoft\AVG7\avgemc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 322560 bytes | Modified Date = 08/05/2007 7:50:38 PM | Attr = ]
(AVGFwSrv) AVG Firewall [Win32_Own | Auto | Running] -> %ProgramFiles%\Grisoft\AVG7\avgfwsrv.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 811008 bytes | Modified Date = 08/05/2007 7:50:38 PM | Attr = ]
(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> %System32%\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 224768 bytes | Modified Date = 04/08/2004 12:56:50 AM | Attr = ]

[Registry - Non-Microsoft Only]
< Run [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Adobe Photo Downloader -> %ProgramFiles%\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe -> Adobe Systems Incorporated [Ver = 3.0.0.49815 | Size = 57344 bytes | Modified Date = 06/06/2005 11:46:24 PM | Attr = ]
AVG7_CC -> %ProgramFiles%\Grisoft\AVG7\avgcc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.418 | Size = 406016 bytes | Modified Date = 08/05/2007 7:50:38 PM | Attr = ]
igfxhkcmd -> %System32%\hkcmd.exe -> Intel Corporation [Ver = 3.0.0.4396 | Size = 77824 bytes | Modified Date = 20/09/2005 9:32:24 AM | Attr = ]
igfxpers -> %System32%\igfxpers.exe -> Intel Corporation [Ver = 3.0.0.4396 | Size = 114688 bytes | Modified Date = 20/09/2005 9:36:20 AM | Attr = ]
igfxtray -> %System32%\igfxtray.exe -> Intel Corporation [Ver = 3.0.0.4396 | Size = 94208 bytes | Modified Date = 20/09/2005 9:35:40 AM | Attr = ]
Microsoft Works Update Detection -> %CommonProgramFiles%\Microsoft Shared\Works Shared\WkUFind.exe -> Microsoft® Corporation [Ver = 7.00.0724.0 | Size = 28672 bytes | Modified Date = 24/07/2002 9:20:02 PM | Attr = ]
PWRISOVM.EXE -> %ProgramFiles%\PowerISO\PWRISOVM.EXE -> PowerISO Computing, Inc. [Ver = 3, 0, 0, 0 | Size = 184320 bytes | Modified Date = 17/03/2006 7:24:18 PM | Attr = ]
RegistryMechanic -> -> File not found
SunJavaUpdateSched -> %ProgramFiles%\Java\jre1.6.0_01\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 83608 bytes | Modified Date = 14/03/2007 3:43:44 AM | Attr = ]
< OptionalComponents [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\
IMAIL -> Installed = 1 -> 
MAPI -> Installed = 1 -> 
MSFS -> Installed = 1 -> 
< Run [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SUPERAntiSpyware -> %ProgramFiles%\SUPERAntiSpyware\SUPERAntiSpyware.exe -> SUPERAntiSpyware.com [Ver = 3, 7, 0, 1018 | Size = 1318128 bytes | Modified Date = 01/05/2007 9:29:58 AM | Attr = ]
< Common Startup > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup
%AllUsersStartup%\Adobe Reader Speed Launch.lnk -> %ProgramFiles%\Adobe\Reader 8.0\Reader\reader_sl.exe -> Adobe Systems Incorporated [Ver = 8.0.0.0 | Size = 40048 bytes | Modified Date = 23/10/2006 1:48:20 AM | Attr = ]
%AllUsersStartup%\Adobe Reader Synchronizer.lnk -> %ProgramFiles%\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe -> [Ver = 8.0.0.0 | Size = 734872 bytes | Modified Date = 23/10/2006 12:01:50 AM | Attr = ]
%AllUsersStartup%\WinZip Quick Pick.lnk -> %ProgramFiles%\WinZip\WZQKPICK.EXE -> WinZip Computing LP [Ver = 1.0 (32-bit) | Size = 389120 bytes | Modified Date = 21/11/2006 11:00:00 AM | Attr = ]
< AppInit_DLLs [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
< ShellExecuteHooks [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} [HKLM] -> %ProgramFiles%\SUPERAntiSpyware\SASSEH.DLL [] -> SuperAdBlocker.com [Ver = 1, 0, 0, 1008 | Size = 77824 bytes | Modified Date = 20/12/2006 1:55:48 PM | Attr = ]
< SecurityProviders [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders
< Winlogon settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
< Winlogon settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
< Winlogon\Notify settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
!SASWinLogon -> %ProgramFiles%\SUPERAntiSpyware\SASWINLO.dll -> SUPERAntiSpyware.com [Ver = 1, 0, 0, 1046 | Size = 294912 bytes | Modified Date = 19/04/2007 1:41:36 PM | Attr = ]
igfxcui -> %System32%\igfxdev.dll -> Intel Corporation [Ver = 3.0.0.4396 | Size = 135168 bytes | Modified Date = 20/09/2005 9:31:28 AM | Attr = ]
< HOSTS File > (736 bytes) -> C:\WINDOWS\System32\drivers\etc\Hosts
127.0.0.1 localhost -> -> 
< Internet Explorer Settings > -> 
HKLM: Main\\Default_Search_URL -> http://www.google.com -> 
HKLM: Search Bar -> http://start.shaw.ca/start/enca/addons/search/ -> 
HKLM: Search Page -> http://www.google.com -> 
HKLM: Start Page -> http://start.shaw.ca -> 
HKLM: CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> 
HKLM: SearchAssistant -> http://start.shaw.ca/start/enca/addons/search/ -> 
HKCU: Local Page -> C:\WINDOWS\system32\blank.htm -> 
HKCU: Search Bar -> http://start.shaw.ca/start/enca/addons/search/ -> 
HKCU: Search Page -> http://start.shaw.ca/start/enca/addons/search/ -> 
HKCU: Start Page -> http://start.shaw.ca -> 
HKCU: SearchAssistant -> http://start.shaw.ca/start/enca/addons/search/ -> 
HKCU: ProxyEnable -> 0 -> 
< Trusted Sites > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
msn.com [ - ] -> -> 
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> %CommonProgramFiles%\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [Adobe PDF Reader Link Helper] -> Adobe Systems Incorporated [Ver = 8.0.0.2006102200 | Size = 62080 bytes | Modified Date = 22/10/2006 11:08:42 PM | Attr = ]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> %ProgramFiles%\Java\jre1.6.0_01\bin\ssv.dll [SSVHelper Class] -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 501400 bytes | Modified Date = 14/03/2007 3:43:40 AM | Attr = ]
< Internet Explorer Bars [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
{32683183-48a0-441b-a342-7c2a440a9478} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
< Internet Explorer Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKLM] -> %ProgramFiles%\Java\jre1.6.0_01\bin\npjpi160_01.dll [MenuText: Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 132760 bytes | Modified Date = 14/03/2007 3:43:42 AM | Attr = ]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKCU] -> %ProgramFiles%\Java\jre1.6.0_01\bin\ssv.dll [MenuText: Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 501400 bytes | Modified Date = 14/03/2007 3:43:40 AM | Attr = ]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} -> Reg Data - Value does not exist [ButtonText: Research] -> File not found
< Internet Explorer Menu Extensions [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\
E&xport to Microsoft Excel -> -> File not found
< User Agent Post Platform [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
SV1 -> -> 
< DNS Name Servers [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\
{75856756-6FAA-4E30-A5FF-80DE2ADDCEBF} -> (Intel(R) PRO/100 VE Network Connection) -> 
{980E1E3E-7B8A-4EE5-9D15-4CA8B462DC8D} -> (Instant Wireless USB Network Adapter ver.2.6) -> 
< Winsock2 Catalogs [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\
Protocol_Catalog9\Catalog_Entries\000000000001 -> %System32%\avgfwafu.dll -> GRISOFT, s.r.o. [Ver = 7.5.0.407 | Size = 110592 bytes | Modified Date = 08/05/2007 7:50:46 PM | Attr = ]
Protocol_Catalog9\Catalog_Entries\000000000002 -> %System32%\avgfwafu.dll -> GRISOFT, s.r.o. [Ver = 7.5.0.407 | Size = 110592 bytes | Modified Date = 08/05/2007 7:50:46 PM | Attr = ]
Protocol_Catalog9\Catalog_Entries\000000000003 -> %System32%\avgfwafu.dll -> GRISOFT, s.r.o. [Ver = 7.5.0.407 | Size = 110592 bytes | Modified Date = 08/05/2007 7:50:46 PM | Attr = ]
Protocol_Catalog9\Catalog_Entries\000000000004 -> %System32%\avgfwafu.dll -> GRISOFT, s.r.o. [Ver = 7.5.0.407 | Size = 110592 bytes | Modified Date = 08/05/2007 7:50:46 PM | Attr = ]
Protocol_Catalog9\Catalog_Entries\000000000005 -> %System32%\avgfwafu.dll -> GRISOFT, s.r.o. [Ver = 7.5.0.407 | Size = 110592 bytes | Modified Date = 08/05/2007 7:50:46 PM | Attr = ]
< Protocol Handlers [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\
ipp -> Reg Data - Key not found -> File not found
msdaipp -> Reg Data - Key not found -> File not found
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\
{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} -> CKAVWebScan Object - CodeBase = http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab -> 
{8AD9C840-044E-11D1-B3E9-00805F499D93} -> Java Plug-in 1.6.0_01 - CodeBase = http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab -> 
{9A9307A0-7DA4-4DAF-B042-5009F29E09E1} -> ActiveScan Installer Class - CodeBase = http://acs.pandasoftware.com/activescan/as5free/asinst.cab -> 
{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} -> Java Plug-in 1.6.0_01 - CodeBase = http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab -> 
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -> Java Plug-in 1.6.0_01 - CodeBase = http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab -> 
{D27CDB6E-AE6D-11CF-96B8-444553540000} -> Shockwave Flash Object - CodeBase = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab -> 
Microsoft XML Parser for Java -> - CodeBase = file://C:\WINDOWS\Java\classes\xmldso.cab ->

[Files/Folders - Created Within 30 days]
23990098.$$$ -> %SystemDrive%\23990098.$$$ -> [Ver = | Size = 0 bytes | Created Date = 29/04/2007 7:28:55 PM | Attr = ]
9fdb6525d69c224452fa4 -> %SystemDrive%\9fdb6525d69c224452fa4 -> [Folder | Created Date = 28/04/2007 11:22:35 PM | Attr = ]
AUTOEXEC.BAT -> %SystemDrive%\AUTOEXEC.BAT -> [Ver = | Size = 0 bytes | Created Date = 14/04/2007 3:11:29 PM | Attr = ]
BJPrinter -> %SystemDrive%\BJPrinter -> [Folder | Created Date = 16/04/2007 8:05:29 PM | Attr = H ]
boot.ini -> %SystemDrive%\boot.ini -> [Ver = | Size = 211 bytes | Created Date = 14/04/2007 7:58:44 AM | Attr = RHS]
CONFIG.SYS -> %SystemDrive%\CONFIG.SYS -> [Ver = | Size = 0 bytes | Created Date = 14/04/2007 3:11:29 PM | Attr = ]
DELL -> %SystemDrive%\DELL -> [Folder | Created Date = 14/04/2007 3:12:10 PM | Attr = ]
Documents and Settings -> %SystemDrive%\Documents and Settings -> [Folder | Created Date = 14/04/2007 8:00:00 AM | Attr = ]
driver -> %SystemDrive%\driver -> [Folder | Created Date = 14/04/2007 6:01:32 PM | Attr = ]
ERDNT -> %SystemDrive%\ERDNT -> [Folder | Created Date = 01/05/2007 2:52:41 PM | Attr = ]
IO.SYS -> %SystemDrive%\IO.SYS -> [Ver = | Size = 0 bytes | Created Date = 14/04/2007 3:11:29 PM | Attr = RHS]
MSDOS.SYS -> %SystemDrive%\MSDOS.SYS -> [Ver = | Size = 0 bytes | Created Date = 14/04/2007 3:11:29 PM | Attr = RHS]
MSOCache -> %SystemDrive%\MSOCache -> [Folder | Created Date = 14/04/2007 3:21:26 PM | Attr = RH ]
Program Files -> %ProgramFiles% -> [Folder | Created Date = 14/04/2007 8:01:00 AM | Attr = R ]
QooBox -> %SystemDrive%\QooBox -> [Folder | Created Date = 27/04/2007 11:06:57 AM | Attr = ]
RECYCLER -> %SystemDrive%\RECYCLER -> [Folder | Created Date = 14/04/2007 7:06:11 PM | Attr = HS]
SDFix -> %SystemDrive%\SDFix -> [Folder | Created Date = 27/04/2007 10:38:37 AM | Attr = ]
Sysclean -> %SystemDrive%\Sysclean -> [Folder | Created Date = 01/05/2007 8:18:47 PM | Attr = ]
System Volume Information -> %SystemDrive%\System Volume Information -> [Folder | Created Date = 28/10/1745 7:54:29 AM | Attr = HS]
temp -> %SystemDrive%\temp -> [Folder | Created Date = 07/05/2007 3:42:39 PM | Attr = ]
VundoFix Backups -> %SystemDrive%\VundoFix Backups -> [Folder | Created Date = 27/04/2007 11:57:08 AM | Attr = ]
WINDOWS -> %SystemRoot% -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
_OTMoveIt -> %SystemDrive%\_OTMoveIt -> [Folder | Created Date = 28/04/2007 2:10:06 PM | Attr = ]
$MSI31Uninstall_KB893803v2$ -> %SystemRoot%\$MSI31Uninstall_KB893803v2$ -> [Folder | Created Date = 16/04/2007 9:11:41 PM | Attr = H ]
$NtServicePackUninstall$ -> %SystemRoot%\$NtServicePackUninstall$ -> [Folder | Created Date = 28/04/2007 11:41:36 PM | Attr = H ]
$NtUninstallKB842773$ -> %SystemRoot%\$NtUninstallKB842773$ -> [Folder | Created Date = 22/04/2007 1:23:21 PM | Attr = H ]
$NtUninstallQ329115$ -> %SystemRoot%\$NtUninstallQ329115$ -> [Folder | Created Date = 29/04/2007 9:11:48 AM | Attr = H ]
$NtUninstallQ329390$ -> %SystemRoot%\$NtUninstallQ329390$ -> [Folder | Created Date = 29/04/2007 9:11:26 AM | Attr = H ]
$xpsp1hfm$ -> %SystemRoot%\$xpsp1hfm$ -> [Folder | Created Date = 28/04/2007 11:25:06 PM | Attr = H ]
001203_.tmp -> %SystemRoot%\001203_.tmp -> [Ver = | Size = 19274 bytes | Created Date = 28/04/2007 11:39:08 PM | Attr = ]
003503_.tmp -> %SystemRoot%\003503_.tmp -> [Ver = | Size = 19528 bytes | Created Date = 06/05/2007 4:53:19 PM | Attr = ]
addins -> %SystemRoot%\addins -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
AppPatch -> %SystemRoot%\AppPatch -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
assembly -> %SystemRoot%\assembly -> [Folder | Created Date = 14/04/2007 3:36:57 PM | Attr = R S]
bjam.dll -> %SystemRoot%\bjam.dll -> [Ver = | Size = 22528 bytes | Created Date = 26/04/2007 11:40:19 AM | Attr = ]


----------



## monkeybubbles (Apr 26, 2007)

[No message]


----------



## monkeybubbles (Apr 26, 2007)

hpsjvset.dll -> %System32%\hpsjvset.dll -> Hewlett-Packard [Ver = 2.8.4.142 | Size = 131072 bytes | Created Date = 14/04/2007 4:19:21 PM | Attr = R ]
hsfbcgbn.bat -> %System32%\hsfbcgbn.bat -> [Ver = | Size = 130 bytes | Created Date = 28/04/2007 2:02:12 PM | Attr = ]
hsfcisp2.dll -> %System32%\hsfcisp2.dll -> Conexant Systems, Inc. [Ver = 7.12.09 | Size = 32285 bytes | Created Date = 06/05/2007 5:04:08 PM | Attr = ]
hticons.dll -> %System32%\hticons.dll -> Hilgraeve, Inc. [Ver = 5.1.2600.0 | Size = 44544 bytes | Created Date = 14/04/2007 3:07:10 PM | Attr = ]
hypertrm.dll -> %System32%\hypertrm.dll -> Hilgraeve, Inc. [Ver = 5.1.2600.2180 | Size = 345088 bytes | Created Date = 14/04/2007 3:07:10 PM | Attr = ]
iAlmCoIn_v4020.dll -> %System32%\iAlmCoIn_v4020.dll -> Intel Corporation [Ver = 1.00.1000.1 | Size = 61440 bytes | Created Date = 14/04/2007 6:04:05 PM | Attr = ]
ialmgdev.dll -> %System32%\ialmgdev.dll -> Intel Corporation [Ver = 6.14.10.4020 | Size = 516096 bytes | Created Date = 14/04/2007 6:04:05 PM | Attr = ]
ialmgicd.dll -> %System32%\ialmgicd.dll -> Intel Corporation [Ver = 6.14.10.4020 | Size = 2289664 bytes | Created Date = 14/04/2007 6:04:05 PM | Attr = ]
ias -> %System32%\ias -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
icsxml -> %System32%\icsxml -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
ideograf.uce -> %System32%\ideograf.uce -> [Ver = | Size = 60458 bytes | Created Date = 14/04/2007 3:06:57 PM | Attr = ]
ieencode.dll -> %System32%\ieencode.dll -> [Ver = | Size = 81920 bytes | Created Date = 06/05/2007 5:04:07 PM | Attr = ]
ieuinit.inf -> %System32%\ieuinit.inf -> [Ver = | Size = 23024 bytes | Created Date = 28/04/2007 11:39:13 PM | Attr = ]
igfxhchs.lhp -> %System32%\igfxhchs.lhp -> [Ver = | Size = 58430 bytes | Created Date = 14/04/2007 6:04:06 PM | Attr = ]
igfxhcht.lhp -> %System32%\igfxhcht.lhp -> [Ver = | Size = 59354 bytes | Created Date = 14/04/2007 6:04:06 PM | Attr = ]
igfxhdeu.lhp -> %System32%\igfxhdeu.lhp -> [Ver = | Size = 62339 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxhenu.lhp -> %System32%\igfxhenu.lhp -> [Ver = | Size = 57801 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxhesp.lhp -> %System32%\igfxhesp.lhp -> [Ver = | Size = 60786 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxhfra.lhp -> %System32%\igfxhfra.lhp -> [Ver = | Size = 62454 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxhita.lhp -> %System32%\igfxhita.lhp -> [Ver = | Size = 59687 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxhjpn.lhp -> %System32%\igfxhjpn.lhp -> [Ver = | Size = 62578 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxhkor.lhp -> %System32%\igfxhkor.lhp -> [Ver = | Size = 66013 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxhptb.lhp -> %System32%\igfxhptb.lhp -> [Ver = | Size = 61839 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxhtha.lhp -> %System32%\igfxhtha.lhp -> [Ver = | Size = 62836 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxres.dll -> %System32%\igfxres.dll -> Intel Corporation [Ver = 3.0.0.4396 | Size = 135168 bytes | Created Date = 29/04/2007 9:09:50 AM | Attr = ]
IME -> %System32%\IME -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
inet.hlp -> %System32%\inet.hlp -> [Ver = | Size = 4665 bytes | Created Date = 26/04/2007 11:40:06 AM | Attr = ]
inetsrv -> %System32%\inetsrv -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
instcat.sql -> %System32%\instcat.sql -> [Ver = | Size = 956990 bytes | Created Date = 28/04/2007 11:39:14 PM | Attr = ]
IntelNic.dll -> %System32%\IntelNic.dll -> Intel Corporation [Ver = 2.05.1 | Size = 24064 bytes | Created Date = 14/04/2007 6:21:25 PM | Attr = ]
iqny.bat -> %System32%\iqny.bat -> [Ver = | Size = 126 bytes | Created Date = 28/04/2007 7:22:21 PM | Attr = ]
isrdbg32.dll -> %System32%\isrdbg32.dll -> Intel Corporation [Ver = 0.0 | Size = 32768 bytes | Created Date = 14/04/2007 3:08:56 PM | Attr = ]
java.exe -> %System32%\java.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 135168 bytes | Created Date = 14/04/2007 8:08:04 PM | Attr = ]
javacpl.cpl -> %System32%\javacpl.cpl -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 69632 bytes | Created Date = 14/04/2007 8:08:04 PM | Attr = ]
javasup.vxd -> %System32%\javasup.vxd -> [Ver = | Size = 7315 bytes | Created Date = 14/04/2007 3:15:45 PM | Attr = ]
javaw.exe -> %System32%\javaw.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 135168 bytes | Created Date = 14/04/2007 8:08:04 PM | Attr = ]
javaws.exe -> %System32%\javaws.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 139264 bytes | Created Date = 14/04/2007 8:08:04 PM | Attr = ]
jmllm.tmp -> %System32%\jmllm.tmp -> [Ver = | Size = 812713 bytes | Created Date = 15/04/2007 12:30:07 PM | Attr = HS]
jrnsa.bat -> %System32%\jrnsa.bat -> [Ver = | Size = 127 bytes | Created Date = 27/04/2007 2:41:58 PM | Attr = ]
kanji_1.uce -> %System32%\kanji_1.uce -> [Ver = | Size = 6948 bytes | Created Date = 14/04/2007 3:06:57 PM | Attr = ]
kanji_2.uce -> %System32%\kanji_2.uce -> [Ver = | Size = 8484 bytes | Created Date = 14/04/2007 3:06:57 PM | Attr = ]
Kaspersky Lab -> %System32%\Kaspersky Lab -> [Folder | Created Date = 27/04/2007 1:23:11 PM | Attr = ]
keyboard.sys -> %System32%\keyboard.sys -> [Ver = | Size = 42537 bytes | Created Date = 28/04/2007 11:39:16 PM | Attr = ]
korean.uce -> %System32%\korean.uce -> [Ver = | Size = 12876 bytes | Created Date = 14/04/2007 3:06:58 PM | Attr = ]
koreiwcd.exe -> %System32%\koreiwcd.exe -> [Ver = | Size = 6656 bytes | Created Date = 26/04/2007 1:59:15 PM | Attr = ]
kvh.exe -> %System32%\kvh.exe -> [Ver = | Size = 0 bytes | Created Date = 27/04/2007 11:56:34 AM | Attr = ]
kxsgyi.exe -> %System32%\kxsgyi.exe -> [Ver = | Size = 6656 bytes | Created Date = 27/04/2007 12:55:07 PM | Attr = ]
l3codeca.acm -> %System32%\l3codeca.acm -> Fraunhofer Institut Integrierte Schaltungen IIS [Ver = 1, 9, 0, 0305 | Size = 290816 bytes | Created Date = 28/04/2007 11:39:17 PM | Attr = ]
l3codecp.acm -> %System32%\l3codecp.acm -> Fraunhofer Institut Integrierte Schaltungen IIS [Ver = 3, 3, 2, 44 | Size = 360448 bytes | Created Date = 17/04/2007 4:36:17 PM | Attr = ]
lahc.bat -> %System32%\lahc.bat -> [Ver = | Size = 126 bytes | Created Date = 28/04/2007 7:09:19 PM | Attr = ]
lclcfg32.ini -> %System32%\lclcfg32.ini -> [Ver = | Size = 0 bytes | Created Date = 26/04/2007 11:43:58 AM | Attr = ]
lfd32.ini -> %System32%\lfd32.ini -> [Ver = | Size = 83 bytes | Created Date = 26/04/2007 11:40:06 AM | Attr = ]
logonui.exe.manifest -> %System32%\logonui.exe.manifest -> [Ver = | Size = 488 bytes | Created Date = 21/04/2007 8:18:06 PM | Attr = RH ]
lxtuvkdn.bat -> %System32%\lxtuvkdn.bat -> [Ver = | Size = 124 bytes | Created Date = 27/04/2007 2:47:56 PM | Attr = ]
Macromed -> %System32%\Macromed -> [Folder | Created Date = 14/04/2007 3:09:57 PM | Attr = ]
mapisvc.inf -> %System32%\mapisvc.inf -> [Ver = | Size = 466 bytes | Created Date = 14/04/2007 3:40:50 PM | Attr = ]
mdmxsdk.dll -> %System32%\mdmxsdk.dll -> Conexant [Ver = 1.0.2.006 | Size = 86016 bytes | Created Date = 06/05/2007 5:04:05 PM | Attr = ]
Microsoft -> %System32%\Microsoft -> [Folder | Created Date = 15/04/2007 12:09:02 PM | Attr = S]
mn.dll -> %System32%\mn.dll -> [Ver = 1, 0, 0, 2 | Size = 16721 bytes | Created Date = 27/04/2007 10:01:39 AM | Attr = ]
moveex.exe -> %System32%\moveex.exe -> [Ver = | Size = 38400 bytes | Created Date = 27/04/2007 11:08:23 AM | Attr = ]
mpeg2data.ax -> %System32%\mpeg2data.ax -> [Ver = | Size = 118272 bytes | Created Date = 06/05/2007 5:04:05 PM | Attr = ]
mpg2splt.ax -> %System32%\mpg2splt.ax -> [Ver = | Size = 148992 bytes | Created Date = 28/04/2007 11:39:29 PM | Attr = ]
mprhou.dns -> %System32%\mprhou.dns -> [Ver = | Size = 163 bytes | Created Date = 28/04/2007 2:33:31 PM | Attr = H ]
mrfui.bat -> %System32%\mrfui.bat -> [Ver = | Size = 124 bytes | Created Date = 28/04/2007 7:05:00 PM | Attr = ]
MsDtc -> %System32%\MsDtc -> [Folder | Created Date = 14/04/2007 3:06:48 PM | Attr = ]
msdtcprf.h -> %System32%\msdtcprf.h -> [Ver = | Size = 768 bytes | Created Date = 14/04/2007 3:06:47 PM | Attr = ]
msdtcprf.ini -> %System32%\msdtcprf.ini -> [Ver = | Size = 1931 bytes | Created Date = 14/04/2007 3:06:47 PM | Attr = ]
msdxm.ocx -> %System32%\msdxm.ocx -> [Ver = | Size = 844314 bytes | Created Date = 28/04/2007 11:39:33 PM | Attr = ]
msdxmlc.dll -> %System32%\msdxmlc.dll -> [Ver = | Size = 4126 bytes | Created Date = 28/04/2007 11:39:33 PM | Attr = ]
MSIXU.DLL -> %System32%\MSIXU.DLL -> [Ver = | Size = 22016 bytes | Created Date = 26/04/2007 11:40:18 AM | Attr = ]
mtxparhd.dll -> %System32%\mtxparhd.dll -> Matrox Graphics Inc. [Ver = 6.13.01.1296 | Size = 1737856 bytes | Created Date = 06/05/2007 5:04:04 PM | Attr = ]
mui -> %System32%\mui -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
mzzdcq.bat -> %System32%\mzzdcq.bat -> [Ver = | Size = 122 bytes | Created Date = 28/04/2007 7:08:09 PM | Attr = ]
ncpa.cpl.manifest -> %System32%\ncpa.cpl.manifest -> [Ver = | Size = 749 bytes | Created Date = 21/04/2007 8:18:00 PM | Attr = RH ]
nhyv.bat -> %System32%\nhyv.bat -> [Ver = | Size = 126 bytes | Created Date = 28/04/2007 2:02:11 PM | Attr = ]
nkprri.exe -> %System32%\nkprri.exe -> [Ver = | Size = 6656 bytes | Created Date = 27/04/2007 1:00:49 PM | Attr = ]
npp -> %System32%\npp -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
nscompat.tlb -> %System32%\nscompat.tlb -> [Ver = | Size = 23392 bytes | Created Date = 17/04/2007 4:36:56 PM | Attr = ]
ntio.sys -> %System32%\ntio.sys -> [Ver = | Size = 33840 bytes | Created Date = 28/04/2007 11:40:08 PM | Attr = ]
nv4_disp.dll -> %System32%\nv4_disp.dll -> NVIDIA Corporation [Ver = 6.14.10.5673 | Size = 4274816 bytes | Created Date = 28/04/2007 11:40:10 PM | Attr = ]
nwc.cpl.manifest -> %System32%\nwc.cpl.manifest -> [Ver = | Size = 749 bytes | Created Date = 14/04/2007 3:10:24 PM | Attr = RH ]
oayx.exe -> %System32%\oayx.exe -> [Ver = | Size = 23552 bytes | Created Date = 23/04/2007 4:43:43 PM | Attr = H ]
odbcconf.rsp -> %System32%\odbcconf.rsp -> [Ver = | Size = 4310 bytes | Created Date = 28/04/2007 11:40:11 PM | Attr = ]
oobe -> %System32%\oobe -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
otpzys.bat -> %System32%\otpzys.bat -> [Ver = | Size = 116 bytes | Created Date = 28/04/2007 6:55:31 PM | Attr = ]
pavas.ico -> %System32%\pavas.ico -> [Ver = | Size = 30590 bytes | Created Date = 21/04/2007 9:24:00 PM | Attr = ]
PerfStringBackup.INI -> %System32%\PerfStringBackup.INI -> [Ver = | Size = 469794 bytes | Created Date = 14/04/2007 8:01:05 AM | Attr = ]
phmvyowg.bat -> %System32%\phmvyowg.bat -> [Ver = | Size = 121 bytes | Created Date = 28/04/2007 2:02:12 PM | Attr = ]
PostProc.dll -> %System32%\PostProc.dll -> Windows (R) 2000 DDK provider [Ver = 5.2.0.7 | Size = 23040 bytes | Created Date = 14/04/2007 6:03:52 PM | Attr = ]
proctexe.ocx -> %System32%\proctexe.ocx -> Intel Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 81920 bytes | Created Date = 28/04/2007 11:40:15 PM | Attr = ]
Prounstl.exe -> %System32%\Prounstl.exe -> Intel Corporation [Ver = 7.0.6 | Size = 118784 bytes | Created Date = 14/04/2007 6:21:25 PM | Attr = ]
qcap.dll -> %System32%\qcap.dll -> [Ver = | Size = 192512 bytes | Created Date = 28/04/2007 11:40:15 PM | Attr = ]
qdvd.dll -> %System32%\qdvd.dll -> [Ver = | Size = 385024 bytes | Created Date = 28/04/2007 11:40:15 PM | Attr = ]
qedit.dll -> %System32%\qedit.dll -> [Ver = | Size = 562176 bytes | Created Date = 28/04/2007 11:40:15 PM | Attr = ]
qgyom.exe -> %System32%\qgyom.exe -> [Ver = | Size = 6656 bytes | Created Date = 27/04/2007 12:54:16 PM | Attr = ]
qip.exe -> %System32%\qip.exe -> [Ver = | Size = 20480 bytes | Created Date = 23/04/2007 4:44:01 PM | Attr = ]
qrfse.bat -> %System32%\qrfse.bat -> [Ver = | Size = 127 bytes | Created Date = 21/04/2007 9:03:29 PM | Attr = ]
quartz.dll -> %System32%\quartz.dll -> [Ver = | Size = 1287680 bytes | Created Date = 28/04/2007 11:40:16 PM | Attr = ]
qxft.exe -> %System32%\qxft.exe -> [Ver = | Size = 11148 bytes | Created Date = 27/04/2007 12:43:39 PM | Attr = ]
qywx.exe -> %System32%\qywx.exe -> [Ver = | Size = 6656 bytes | Created Date = 27/04/2007 12:43:39 PM | Attr = ]
qzgm.exe -> %System32%\qzgm.exe -> [Ver = | Size = 6656 bytes | Created Date = 27/04/2007 1:00:49 PM | Attr = ]
ras -> %System32%\ras -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
RcdScan.dll -> %System32%\RcdScan.dll -> Dell Computer Corporation [Ver = 1.20.00.00 | Size = 176128 bytes | Created Date = 14/04/2007 4:24:54 PM | Attr = ]
redir.exe -> %System32%\redir.exe -> [Ver = | Size = 3338 bytes | Created Date = 28/04/2007 11:40:18 PM | Attr = ]
ReinstallBackups -> %System32%\ReinstallBackups -> [Folder | Created Date = 28/04/2007 11:25:20 PM | Attr = ]
Restore -> %System32%\Restore -> [Folder | Created Date = 14/04/2007 3:08:58 PM | Attr = ]
rttae.exe -> %System32%\rttae.exe -> [Ver = | Size = 1460 bytes | Created Date = 15/04/2007 1:01:49 PM | Attr = H ]
s3gnb.dll -> %System32%\s3gnb.dll -> S3 Graphics, Inc. [Ver = 6.14.10.0012-13.94.12 | Size = 397056 bytes | Created Date = 06/05/2007 5:04:01 PM | Attr = ]
sapi.cpl.manifest -> %System32%\sapi.cpl.manifest -> [Ver = | Size = 749 bytes | Created Date = 21/04/2007 8:18:00 PM | Attr = RH ]
satmat.exe -> %System32%\satmat.exe -> [Ver = | Size = 20480 bytes | Created Date = 26/04/2007 11:40:24 AM | Attr = ]
sbe.dll -> %System32%\sbe.dll -> [Ver = | Size = 270848 bytes | Created Date = 28/04/2007 11:40:02 PM | Attr = ]
Setup -> %System32%\Setup -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
SetupBD.din -> %System32%\SetupBD.din -> [Ver = | Size = 1902 bytes | Created Date = 14/04/2007 6:03:53 PM | Attr = ]
ShellExt -> %System32%\ShellExt -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
shiftjis.uce -> %System32%\shiftjis.uce -> [Ver = | Size = 16740 bytes | Created Date = 14/04/2007 3:06:58 PM | Attr = ]
sl.bin -> %System32%\sl.bin -> [Ver = | Size = 12 bytes | Created Date = 26/04/2007 11:43:35 AM | Attr = ]
slcoinst.dll -> %System32%\slcoinst.dll -> Smart Link [Ver = 3.80.01MC15 | Size = 73832 bytes | Created Date = 06/05/2007 5:04:01 PM | Attr = ]
slextspk.dll -> %System32%\slextspk.dll -> Smart Link [Ver = 3.80.01MC15 | Size = 286792 bytes | Created Date = 06/05/2007 5:04:01 PM | Attr = ]
slgen.dll -> %System32%\slgen.dll -> Smart Link [Ver = 3.80.01MC15 | Size = 188508 bytes | Created Date = 06/05/2007 5:04:01 PM | Attr = ]
slrundll.exe -> %System32%\slrundll.exe -> Smart Link [Ver = 3.80.01MC15 | Size = 32866 bytes | Created Date = 06/05/2007 5:04:01 PM | Attr = ]
slserv.exe -> %System32%\slserv.exe -> Smart Link [Ver = 3.80.01MC15 | Size = 73796 bytes | Created Date = 06/05/2007 5:04:01 PM | Attr = ]
sl_anet.acm -> %System32%\sl_anet.acm -> Sipro Lab Telecom Inc. [Ver = 3.02 | Size = 86016 bytes | Created Date = 28/04/2007 11:40:24 PM | Attr = ]
SoftwareDistribution -> %System32%\SoftwareDistribution -> [Folder | Created Date = 21/04/2007 8:57:24 PM | Attr = ]
sowsrkve.bat -> %System32%\sowsrkve.bat -> [Ver = | Size = 130 bytes | Created Date = 27/04/2007 3:02:30 PM | Attr = ]
spool -> %System32%\spool -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
spupdsvc.inf -> %System32%\spupdsvc.inf -> [Ver = | Size = 2694 bytes | Created Date = 06/05/2007 5:12:34 PM | Attr = ]
spxcoins.dll -> %System32%\spxcoins.dll -> Perle Systems Ltd. [Ver = 1.0.0.0007 | Size = 24661 bytes | Created Date = 21/04/2007 8:11:10 PM | Attr = ]
ssa3d30.ocx -> %System32%\ssa3d30.ocx -> Sheridan Software Systems, Inc. [Ver = 3.00.0034 | Size = 328480 bytes | Created Date = 14/04/2007 4:24:54 PM | Attr = ]
stfv.bin -> %System32%\stfv.bin -> [Ver = | Size = 4 bytes | Created Date = 26/04/2007 11:44:00 AM | Attr = ]
subrange.uce -> %System32%\subrange.uce -> [Ver = | Size = 93702 bytes | Created Date = 14/04/2007 3:06:58 PM | Attr = ]
swreg.exe -> %System32%\swreg.exe -> SteelWerX [Ver = 2.0.1.6 | Size = 428032 bytes | Created Date = 27/04/2007 11:08:23 AM | Attr = ]
swsc.exe -> %System32%\swsc.exe -> SteelWerX [Ver = 2.0.0.0 | Size = 370688 bytes | Created Date = 27/04/2007 11:08:23 AM | Attr = ]
swxcacls.exe -> %System32%\swxcacls.exe -> SteelWerX [Ver = 1.0.1.1 | Size = 212480 bytes | Created Date = 27/04/2007 11:08:23 AM | Attr = ]
tslabels.h -> %System32%\tslabels.h -> [Ver = | Size = 3286 bytes | Created Date = 14/04/2007 3:06:51 PM | Attr = ]
tslabels.ini -> %System32%\tslabels.ini -> [Ver = | Size = 13223 bytes | Created Date = 14/04/2007 3:06:51 PM | Attr = ]
ubdlul.exe -> %System32%\ubdlul.exe -> [Ver = | Size = 6656 bytes | Created Date = 27/04/2007 12:55:08 PM | Attr = ]
ufhp.exe -> %System32%\ufhp.exe -> [Ver = | Size = 11148 bytes | Created Date = 27/04/2007 1:00:49 PM | Attr = ]
Uninstall.ico -> %System32%\Uninstall.ico -> [Ver = | Size = 2550 bytes | Created Date = 21/04/2007 9:24:01 PM | Attr = ]
UpdDrv2K.exe -> %System32%\UpdDrv2K.exe -> 3Com Corporation [Ver = 1.0.0.0 | Size = 41852 bytes | Created Date = 14/04/2007 4:27:57 PM | Attr = ]
URTTemp -> %System32%\URTTemp -> [Folder | Created Date = 14/04/2007 3:36:57 PM | Attr = ]
usmt -> %System32%\usmt -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]


----------



## monkeybubbles (Apr 26, 2007)

usrlogon.cmd -> %System32%\usrlogon.cmd -> [Ver = | Size = 1161 bytes | Created Date = 14/04/2007 3:06:51 PM | Attr = ]
vcmgcd32.dll -> %System32%\vcmgcd32.dll -> [Folder | Created Date = 29/04/2007 6:46:34 PM | Attr = ]
vfind.exe -> %System32%\vfind.exe -> [Ver = | Size = 49152 bytes | Created Date = 27/04/2007 11:08:23 AM | Attr = ]
virtear.dll -> %System32%\virtear.dll -> Sensaura [Ver = 1, 0, 0, 6 | Size = 991232 bytes | Created Date = 14/04/2007 6:16:41 PM | Attr = ]
vxddsk.exe -> %System32%\vxddsk.exe -> [Ver = | Size = 30464 bytes | Created Date = 26/04/2007 11:40:24 AM | Attr = ]
wbem -> %System32%\wbem -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
webfldrs.msi -> %System32%\webfldrs.msi -> [Ver = | Size = 1326080 bytes | Created Date = 28/04/2007 11:40:55 PM | Attr = ]
WER8274.DLL -> %System32%\WER8274.DLL -> [Ver = | Size = 24320 bytes | Created Date = 26/04/2007 11:40:18 AM | Attr = ]
WindowsLogon.manifest -> %System32%\WindowsLogon.manifest -> [Ver = | Size = 488 bytes | Created Date = 14/04/2007 3:10:30 PM | Attr = RH ]
wins -> %System32%\wins -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
wmimgmt.msc -> %System32%\wmimgmt.msc -> [Ver = | Size = 63488 bytes | Created Date = 14/04/2007 3:06:34 PM | Attr = ]
wml.exe -> %System32%\wml.exe -> [Ver = | Size = 18944 bytes | Created Date = 26/04/2007 11:40:24 AM | Attr = ]
wmpscheme.xml -> %System32%\wmpscheme.xml -> [Ver = | Size = 25065 bytes | Created Date = 14/04/2007 3:11:27 PM | Attr = ]
wpa.bak -> %System32%\wpa.bak -> [Ver = | Size = 2422 bytes | Created Date = 07/05/2007 4:23:53 PM | Attr = ]
wtxqvmat.ini -> %System32%\wtxqvmat.ini -> [Ver = | Size = 1543 bytes | Created Date = 26/04/2007 11:39:50 AM | Attr = HS]
wuaucpl.cpl.manifest -> %System32%\wuaucpl.cpl.manifest -> [Ver = | Size = 749 bytes | Created Date = 21/04/2007 8:18:00 PM | Attr = RH ]
xcxfiy.bat -> %System32%\xcxfiy.bat -> [Ver = | Size = 125 bytes | Created Date = 28/04/2007 2:02:10 PM | Attr = ]
xircom -> %System32%\xircom -> [Folder | Created Date = 14/04/2007 3:12:14 PM | Attr = ]
xwngvgz.bat -> %System32%\xwngvgz.bat -> [Ver = | Size = 117 bytes | Created Date = 26/04/2007 2:50:43 PM | Attr = ]
ynjkv.exe -> %System32%\ynjkv.exe -> [Ver = | Size = 11148 bytes | Created Date = 27/04/2007 12:54:16 PM | Attr = ]
yratiea.bat -> %System32%\yratiea.bat -> [Ver = | Size = 123 bytes | Created Date = 28/04/2007 7:03:48 PM | Attr = ]
zonedoff.reg -> %System32%\zonedoff.reg -> [Ver = | Size = 113 bytes | Created Date = 14/04/2007 3:15:41 PM | Attr = ]
zonedon.reg -> %System32%\zonedon.reg -> [Ver = | Size = 113 bytes | Created Date = 14/04/2007 3:15:41 PM | Attr = ]
cap7146.sys -> %System32%\dllcache\cap7146.sys -> Philips Semiconductors GmbH [Ver = 1.00 (XPClient.010817-1148) | Size = 54528 bytes | Created Date = 21/04/2007 8:22:09 PM | Attr = ]
dgrpsetu.dll -> %System32%\dllcache\dgrpsetu.dll -> Digi International, Inc. [Ver = 2.3.7 | Size = 176157 bytes | Created Date = 14/04/2007 8:00:42 AM | Attr = ]
eqnclass.dll -> %System32%\dllcache\eqnclass.dll -> Equinox Systems Inc. [Ver = 5.0u(58) | Size = 103424 bytes | Created Date = 14/04/2007 8:00:42 AM | Attr = ]
esucmd.dll -> %System32%\dllcache\esucmd.dll -> SEIKO EPSON CORP. [Ver = 1.00 | Size = 31744 bytes | Created Date = 21/04/2007 8:22:30 PM | Attr = ]
esuimgd.dll -> %System32%\dllcache\esuimgd.dll -> SEIKO EPSON CORP. [Ver = 1.00 | Size = 57856 bytes | Created Date = 21/04/2007 8:22:30 PM | Attr = ]
esunid.dll -> %System32%\dllcache\esunid.dll -> SEIKO EPSON CORP. [Ver = 1.00 | Size = 45056 bytes | Created Date = 21/04/2007 8:22:30 PM | Attr = ]
hanja.lex -> %System32%\dllcache\hanja.lex -> [Ver = | Size = 108827 bytes | Created Date = 21/04/2007 8:22:37 PM | Attr = ]
HPCRDP.CAT -> %System32%\dllcache\HPCRDP.CAT -> [Ver = | Size = 13472 bytes | Created Date = 21/04/2007 8:10:57 PM | Attr = ]
htrn_jis.dll -> %System32%\dllcache\htrn_jis.dll -> Hilgraeve, Inc. [Ver = 5.1.2600.0 | Size = 13312 bytes | Created Date = 14/04/2007 3:07:09 PM | Attr = ]


----------



## monkeybubbles (Apr 26, 2007)

hwxjpn.dll -> %System32%\dllcache\hwxjpn.dll -> [Ver = | Size = 13463552 bytes | Created Date = 21/04/2007 8:22:42 PM | Attr = ]
IASNT4.CAT -> %System32%\dllcache\IASNT4.CAT -> [Ver = | Size = 8574 bytes | Created Date = 21/04/2007 8:10:57 PM | Attr = ]
imekr.lex -> %System32%\dllcache\imekr.lex -> [Ver = | Size = 134339 bytes | Created Date = 21/04/2007 8:22:52 PM | Attr = ]
korwbrkr.lex -> %System32%\dllcache\korwbrkr.lex -> [Ver = | Size = 1158818 bytes | Created Date = 21/04/2007 8:23:05 PM | Attr = ]
ltts1033.lxa -> %System32%\dllcache\ltts1033.lxa -> [Ver = | Size = 643717 bytes | Created Date = 14/04/2007 8:01:01 AM | Attr = ]
MAPIMIG.CAT -> %System32%\dllcache\MAPIMIG.CAT -> [Ver = | Size = 399645 bytes | Created Date = 21/04/2007 8:10:57 PM | Attr = ]
MW770.CAT -> %System32%\dllcache\MW770.CAT -> [Ver = | Size = 37484 bytes | Created Date = 21/04/2007 8:10:57 PM | Attr = ]
nls302en.lex -> %System32%\dllcache\nls302en.lex -> [Ver = | Size = 4399505 bytes | Created Date = 14/04/2007 3:10:07 PM | Attr = ]
NT5IIS.CAT -> %System32%\dllcache\NT5IIS.CAT -> [Ver = | Size = 797189 bytes | Created Date = 21/04/2007 8:10:57 PM | Attr = ]
OEMBIOS.CAT -> %System32%\dllcache\OEMBIOS.CAT -> [Ver = | Size = 7046 bytes | Created Date = 21/04/2007 8:10:57 PM | Attr = ]
r1033tts.lxa -> %System32%\dllcache\r1033tts.lxa -> [Ver = | Size = 605050 bytes | Created Date = 14/04/2007 8:01:02 AM | Attr = ]
rw330ext.dll -> %System32%\dllcache\rw330ext.dll -> Ricoh Co., Ltd. [Ver = 5, 0, 2419, 1 | Size = 26624 bytes | Created Date = 21/04/2007 8:23:44 PM | Attr = ]
rwia001.dll -> %System32%\dllcache\rwia001.dll -> Ricoh Co., Ltd. [Ver = 5, 0, 2419, 1 | Size = 79872 bytes | Created Date = 21/04/2007 8:23:44 PM | Attr = ]
rwia330.dll -> %System32%\dllcache\rwia330.dll -> Ricoh Co., Ltd. [Ver = 5, 0, 2419, 1 | Size = 79872 bytes | Created Date = 21/04/2007 8:23:44 PM | Attr = ]
sam.sdf -> %System32%\dllcache\sam.sdf -> [Ver = | Size = 888 bytes | Created Date = 14/04/2007 8:01:03 AM | Attr = ]
sam.spd -> %System32%\dllcache\sam.spd -> [Ver = | Size = 1685606 bytes | Created Date = 14/04/2007 8:01:03 AM | Attr = ]
spxcoins.dll -> %System32%\dllcache\spxcoins.dll -> Perle Systems Ltd. [Ver = 1.0.0.0007 | Size = 24661 bytes | Created Date = 21/04/2007 8:11:10 PM | Attr = ]
srframe.mmf -> %System32%\dllcache\srframe.mmf -> [Ver = | Size = 984 bytes | Created Date = 14/04/2007 3:08:59 PM | Attr = ]
adv01nt5.dll -> %System32%\drivers\adv01nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 4255 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
adv02nt5.dll -> %System32%\drivers\adv02nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 3967 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
adv05nt5.dll -> %System32%\drivers\adv05nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 3615 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
adv07nt5.dll -> %System32%\drivers\adv07nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 3647 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
adv08nt5.dll -> %System32%\drivers\adv08nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 3135 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
adv09nt5.dll -> %System32%\drivers\adv09nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 3711 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
adv11nt5.dll -> %System32%\drivers\adv11nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 3775 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
AFS2K.SYS -> %System32%\drivers\AFS2K.SYS -> Oak Technology Inc. [Ver = 3.1.21.1103 | Size = 35840 bytes | Created Date = 14/04/2007 4:19:55 PM | Attr = ]
amdagp.sys -> %System32%\drivers\amdagp.sys -> Advanced Micro Devices, Inc. [Ver = 5.00 (xpsp_sp2_rtm.040803-2158) | Size = 43008 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
ati1btxx.sys -> %System32%\drivers\ati1btxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 56623 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
ati1mdxx.sys -> %System32%\drivers\ati1mdxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 11615 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
ati1pdxx.sys -> %System32%\drivers\ati1pdxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 12047 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
ati1raxx.sys -> %System32%\drivers\ati1raxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 30671 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
ati1rvxx.sys -> %System32%\drivers\ati1rvxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 63663 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
ati1snxx.sys -> %System32%\drivers\ati1snxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 26367 bytes | Created Date = 06/05/2007 5:04:18 PM | Attr = ]
ati1ttxx.sys -> %System32%\drivers\ati1ttxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 21343 bytes | Created Date = 06/05/2007 5:04:18 PM | Attr = ]
ati1tuxx.sys -> %System32%\drivers\ati1tuxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 36463 bytes | Created Date = 06/05/2007 5:04:18 PM | Attr = ]
ati1xbxx.sys -> %System32%\drivers\ati1xbxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 29455 bytes | Created Date = 06/05/2007 5:04:18 PM | Attr = ]
ati1xsxx.sys -> %System32%\drivers\ati1xsxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 34735 bytes | Created Date = 06/05/2007 5:04:18 PM | Attr = ]
ati2mtaa.sys -> %System32%\drivers\ati2mtaa.sys -> ATI Technologies Inc. [Ver = 6.13.10.5019 | Size = 327040 bytes | Created Date = 28/04/2007 11:40:00 PM | Attr = ]
ati2mtag.sys -> %System32%\drivers\ati2mtag.sys -> ATI Technologies Inc. [Ver = 6.14.10.6462 | Size = 701440 bytes | Created Date = 28/04/2007 11:40:00 PM | Attr = ]
atinbtxx.sys -> %System32%\drivers\atinbtxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 57856 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atinmdxx.sys -> %System32%\drivers\atinmdxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 13824 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atinpdxx.sys -> %System32%\drivers\atinpdxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 14336 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atinraxx.sys -> %System32%\drivers\atinraxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 52224 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atinrvxx.sys -> %System32%\drivers\atinrvxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 104960 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atinsnxx.sys -> %System32%\drivers\atinsnxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 28672 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atinttxx.sys -> %System32%\drivers\atinttxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 13824 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atintuxx.sys -> %System32%\drivers\atintuxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 73216 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atinxbxx.sys -> %System32%\drivers\atinxbxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 31744 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atinxsxx.sys -> %System32%\drivers\atinxsxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 63488 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
ativmc20.cod -> %System32%\drivers\ativmc20.cod -> [Ver = | Size = 64352 bytes | Created Date = 06/05/2007 5:04:17 PM | Attr = ]
atv01nt5.dll -> %System32%\drivers\atv01nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 21183 bytes | Created Date = 06/05/2007 5:04:17 PM | Attr = ]
atv02nt5.dll -> %System32%\drivers\atv02nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 11359 bytes | Created Date = 06/05/2007 5:04:17 PM | Attr = ]
atv04nt5.dll -> %System32%\drivers\atv04nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 25471 bytes | Created Date = 06/05/2007 5:04:17 PM | Attr = ]
atv06nt5.dll -> %System32%\drivers\atv06nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 14143 bytes | Created Date = 06/05/2007 5:04:17 PM | Attr = ]
atv10nt5.dll -> %System32%\drivers\atv10nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 17279 bytes | Created Date = 06/05/2007 5:04:17 PM | Attr = ]
avg7core.sys -> %System32%\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 816672 bytes | Created Date = 08/05/2007 6:50:41 PM | Attr = ]
avg7rsw.sys -> %System32%\drivers\avg7rsw.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,340 | Size = 4224 bytes | Created Date = 23/04/2007 3:54:41 PM | Attr = ]
avg7rsxp.sys -> %System32%\drivers\avg7rsxp.sys -> GRISOFT, s.r.o. [Ver = 7,1,0,398 | Size = 28416 bytes | Created Date = 23/04/2007 3:54:41 PM | Attr = ]
avgclean.sys -> %System32%\drivers\avgclean.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Created Date = 08/05/2007 6:50:45 PM | Attr = ]
avgmfx86.sys -> %System32%\drivers\avgmfx86.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.416 | Size = 18240 bytes | Created Date = 08/05/2007 6:50:41 PM | Attr = ]
avgtdi.sys -> %System32%\drivers\avgtdi.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,346 | Size = 4960 bytes | Created Date = 08/05/2007 6:50:42 PM | Attr = ]
ch7xxnt5.dll -> %System32%\drivers\ch7xxnt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 15423 bytes | Created Date = 06/05/2007 5:04:16 PM | Attr = ]
COH_Mon.cat -> %System32%\drivers\COH_Mon.cat -> [Ver = | Size = 10592 bytes | Created Date = 16/04/2007 10:10:00 PM | Attr = R ]
COH_Mon.inf -> %System32%\drivers\COH_Mon.inf -> [Ver = | Size = 679 bytes | Created Date = 16/04/2007 10:10:00 PM | Attr = R ]
COH_Mon.sys -> %System32%\drivers\COH_Mon.sys -> Symantec Corporation [Ver = 6,1,1,4 | Size = 22112 bytes | Created Date = 16/04/2007 10:10:00 PM | Attr = R ]
cxthsfs2.cty -> %System32%\drivers\cxthsfs2.cty -> [Ver = | Size = 129045 bytes | Created Date = 06/05/2007 5:04:16 PM | Attr = ]
disdn -> %System32%\drivers\disdn -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
e100b325.sys -> %System32%\drivers\e100b325.sys -> Intel Corporation [Ver = 7.1.12.0 built by: WinDDK | Size = 154112 bytes | Created Date = 14/04/2007 6:21:25 PM | Attr = ]
etc -> %System32%\drivers\etc -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
gmer.sys -> %System32%\drivers\gmer.sys -> GMER [Ver = 1, 0, 12, 3868 | Size = 69905 bytes | Created Date = 28/04/2007 2:26:36 PM | Attr = ]
hsfbs2s2.sys -> %System32%\drivers\hsfbs2s2.sys -> Conexant Systems, Inc. [Ver = 7.12.09 | Size = 220032 bytes | Created Date = 06/05/2007 5:04:16 PM | Attr = ]
hsfcxts2.sys -> %System32%\drivers\hsfcxts2.sys -> Conexant Systems, Inc. [Ver = 7.12.09 built by: WinDDK | Size = 685056 bytes | Created Date = 06/05/2007 5:04:15 PM | Attr = ]
hsfdpsp2.sys -> %System32%\drivers\hsfdpsp2.sys -> Conexant Systems, Inc. [Ver = 7.12.09 | Size = 1041536 bytes | Created Date = 06/05/2007 5:04:15 PM | Attr = ]
mdmxsdk.sys -> %System32%\drivers\mdmxsdk.sys -> Conexant [Ver = 1.0.2.006 | Size = 11868 bytes | Created Date = 06/05/2007 5:04:15 PM | Attr = ]
mtlmnt5.sys -> %System32%\drivers\mtlmnt5.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 126686 bytes | Created Date = 06/05/2007 5:04:15 PM | Attr = ]
mtlstrm.sys -> %System32%\drivers\mtlstrm.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 1309184 bytes | Created Date = 06/05/2007 5:04:14 PM | Attr = ]
mtxparhm.sys -> %System32%\drivers\mtxparhm.sys -> Matrox Graphics Inc. [Ver = 6.13.01.1296 | Size = 452736 bytes | Created Date = 06/05/2007 5:04:14 PM | Attr = ]
netusbxp.sys -> %System32%\drivers\netusbxp.sys -> The LinkSys Group, Inc. [Ver = 1.02.02.0066 built by: WinDDK | Size = 72576 bytes | Created Date = 07/05/2007 3:29:24 PM | Attr = R ]
netwlan5.img -> %System32%\drivers\netwlan5.img -> [Ver = | Size = 67866 bytes | Created Date = 28/04/2007 11:40:00 PM | Attr = ]
ntmtlfax.sys -> %System32%\drivers\ntmtlfax.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 180360 bytes | Created Date = 06/05/2007 5:04:14 PM | Attr = ]
nv4_mini.sys -> %System32%\drivers\nv4_mini.sys -> NVIDIA Corporation [Ver = 6.14.10.5673 | Size = 1897408 bytes | Created Date = 28/04/2007 11:40:10 PM | Attr = ]
omci.sys -> %System32%\drivers\omci.sys -> Dell Computer Corporation [Ver = 6, 1, 0, 242 | Size = 13632 bytes | Created Date = 14/04/2007 4:24:52 PM | Attr = ]
recagent.sys -> %System32%\drivers\recagent.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 13776 bytes | Created Date = 06/05/2007 5:04:13 PM | Attr = ]
s3gnbm.sys -> %System32%\drivers\s3gnbm.sys -> S3 Graphics, Inc. [Ver = 6.14.10.0012-13.94.12 | Size = 166912 bytes | Created Date = 06/05/2007 5:04:13 PM | Attr = ]
senfilt.sys -> %System32%\drivers\senfilt.sys -> Creative Technology Ltd. [Ver = 5.10.00.3614 | Size = 732928 bytes | Created Date = 14/04/2007 6:03:52 PM | Attr = ]
siint5.dll -> %System32%\drivers\siint5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 3901 bytes | Created Date = 06/05/2007 5:04:13 PM | Attr = ]
sisagp.sys -> %System32%\drivers\sisagp.sys -> Silicon Integrated Systems Corporation [Ver = 5.12.01.2010 (xpsp_sp2_rtm.040803-2158) | Size = 41088 bytes | Created Date = 06/05/2007 5:04:13 PM | Attr = ]
slnt7554.sys -> %System32%\drivers\slnt7554.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 129535 bytes | Created Date = 06/05/2007 5:04:13 PM | Attr = ]
slntamr.sys -> %System32%\drivers\slntamr.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 404990 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
slnthal.sys -> %System32%\drivers\slnthal.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 95424 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
slwdmsup.sys -> %System32%\drivers\slwdmsup.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 13240 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
smwdm.sys -> %System32%\drivers\smwdm.sys -> Analog Devices, Inc. [Ver = 5.12.01.5246 | Size = 260352 bytes | Created Date = 14/04/2007 6:03:52 PM | Attr = ]
SYMEVENT.CAT -> %System32%\drivers\SYMEVENT.CAT -> [Ver = | Size = 8014 bytes | Created Date = 16/04/2007 9:42:01 PM | Attr = ]
SYMEVENT.INF -> %System32%\drivers\SYMEVENT.INF -> [Ver = | Size = 806 bytes | Created Date = 16/04/2007 9:42:01 PM | Attr = ]
vchnt5.dll -> %System32%\drivers\vchnt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 11325 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
wadv07nt.sys -> %System32%\drivers\wadv07nt.sys -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 11807 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
wadv08nt.sys -> %System32%\drivers\wadv08nt.sys -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 11295 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
wadv09nt.sys -> %System32%\drivers\wadv09nt.sys -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 11871 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
wadv11nt.sys -> %System32%\drivers\wadv11nt.sys -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 11935 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
watv06nt.sys -> %System32%\drivers\watv06nt.sys -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 22271 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
watv10nt.sys -> %System32%\drivers\watv10nt.sys -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 25471 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
hosts.msn -> %System32%\drivers\etc\hosts.msn -> [Ver = | Size = 734 bytes | Created Date = 23/04/2007 4:03:44 PM | Attr = ]

[Files/Folders - Modified Within 30 days]
23990098.$$$ -> %SystemDrive%\23990098.$$$ -> [Ver = | Size = 0 bytes | Modified Date = 29/04/2007 10:35:46 PM | Attr = ]
9fdb6525d69c224452fa4 -> %SystemDrive%\9fdb6525d69c224452fa4 -> [Folder | Modified Date = 29/04/2007 7:50:46 PM | Attr = ]
AUTOEXEC.BAT -> %SystemDrive%\AUTOEXEC.BAT -> [Ver = | Size = 0 bytes | Modified Date = 14/04/2007 4:11:30 PM | Attr = ]
BJPrinter -> %SystemDrive%\BJPrinter -> [Folder | Modified Date = 16/04/2007 9:05:30 PM | Attr = H ]
boot.ini -> %SystemDrive%\boot.ini -> [Ver = | Size = 211 bytes | Modified Date = 06/05/2007 6:08:50 PM | Attr = RHS]
CONFIG.SYS -> %SystemDrive%\CONFIG.SYS -> [Ver = | Size = 0 bytes | Modified Date = 14/04/2007 4:11:30 PM | Attr = ]
DELL -> %SystemDrive%\DELL -> [Folder | Modified Date = 29/04/2007 7:51:24 PM | Attr = ]
Documents and Settings -> %SystemDrive%\Documents and Settings -> [Folder | Modified Date = 08/05/2007 7:50:26 PM | Attr = ]
driver -> %SystemDrive%\driver -> [Folder | Modified Date = 14/04/2007 7:01:40 PM | Attr = ]
ERDNT -> %SystemDrive%\ERDNT -> [Folder | Modified Date = 01/05/2007 3:53:10 PM | Attr = ]


----------



## monkeybubbles (Apr 26, 2007)

IO.SYS -> %SystemDrive%\IO.SYS -> [Ver = | Size = 0 bytes | Modified Date = 14/04/2007 4:11:30 PM | Attr = RHS]
MSDOS.SYS -> %SystemDrive%\MSDOS.SYS -> [Ver = | Size = 0 bytes | Modified Date = 14/04/2007 4:11:30 PM | Attr = RHS]
MSOCache -> %SystemDrive%\MSOCache -> [Folder | Modified Date = 14/04/2007 4:21:28 PM | Attr = RH ]
NTDETECT.COM -> %SystemDrive%\NTDETECT.COM -> [Ver = | Size = 47564 bytes | Modified Date = 06/05/2007 5:54:24 PM | Attr = RHS]
Program Files -> %ProgramFiles% -> [Folder | Modified Date = 08/05/2007 7:50:36 PM | Attr = R ]
QooBox -> %SystemDrive%\QooBox -> [Folder | Modified Date = 27/04/2007 12:06:58 PM | Attr = ]
RECYCLER -> %SystemDrive%\RECYCLER -> [Folder | Modified Date = 14/04/2007 8:06:12 PM | Attr = HS]
SDFix -> %SystemDrive%\SDFix -> [Folder | Modified Date = 29/04/2007 8:08:04 PM | Attr = ]
Sysclean -> %SystemDrive%\Sysclean -> [Folder | Modified Date = 01/05/2007 9:58:12 PM | Attr = ]
System Volume Information -> %SystemDrive%\System Volume Information -> [Folder | Modified Date = 06/05/2007 6:23:14 PM | Attr = HS]
temp -> %SystemDrive%\temp -> [Folder | Modified Date = 07/05/2007 5:14:04 PM | Attr = ]
VundoFix Backups -> %SystemDrive%\VundoFix Backups -> [Folder | Modified Date = 01/05/2007 4:23:42 PM | Attr = ]
WINDOWS -> %SystemRoot% -> [Folder | Modified Date = 08/05/2007 7:50:28 PM | Attr = ]
_OTMoveIt -> %SystemDrive%\_OTMoveIt -> [Folder | Modified Date = 28/04/2007 3:10:08 PM | Attr = ]
$MSI31Uninstall_KB893803v2$ -> %SystemRoot%\$MSI31Uninstall_KB893803v2$ -> [Folder | Modified Date = 16/04/2007 10:11:54 PM | Attr = H ]
$NtServicePackUninstall$ -> %SystemRoot%\$NtServicePackUninstall$ -> [Folder | Modified Date = 06/05/2007 5:52:32 PM | Attr = H ]
$NtUninstallKB842773$ -> %SystemRoot%\$NtUninstallKB842773$ -> [Folder | Modified Date = 22/04/2007 2:23:24 PM | Attr = H ]
$NtUninstallQ329115$ -> %SystemRoot%\$NtUninstallQ329115$ -> [Folder | Modified Date = 29/04/2007 10:11:50 AM | Attr = H ]
$NtUninstallQ329390$ -> %SystemRoot%\$NtUninstallQ329390$ -> [Folder | Modified Date = 29/04/2007 10:11:30 AM | Attr = H ]
$xpsp1hfm$ -> %SystemRoot%\$xpsp1hfm$ -> [Folder | Modified Date = 29/04/2007 12:25:08 AM | Attr = H ]
addins -> %SystemRoot%\addins -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
AppPatch -> %SystemRoot%\AppPatch -> [Folder | Modified Date = 06/05/2007 6:23:08 PM | Attr = ]
assembly -> %SystemRoot%\assembly -> [Folder | Modified Date = 14/04/2007 4:37:38 PM | Attr = R S]
bjam.dll -> %SystemRoot%\bjam.dll -> [Ver = | Size = 22528 bytes | Modified Date = 26/04/2007 12:40:20 PM | Attr = ]
bootstat.dat -> %SystemRoot%\bootstat.dat -> [Ver = | Size = 2048 bytes | Modified Date = 08/05/2007 7:52:48 PM | Attr = S]
catchme.exe -> %SystemRoot%\catchme.exe -> [Ver = | Size = 86528 bytes | Modified Date = 21/04/2007 3:52:22 AM | Attr = ]
cdsm32.dll -> %SystemRoot%\cdsm32.dll -> [Ver = | Size = 20480 bytes | Modified Date = 26/04/2007 12:40:22 PM | Attr = ]
Config -> %SystemRoot%\Config -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
Connection Wizard -> %SystemRoot%\Connection Wizard -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
control.ini -> %SystemRoot%\control.ini -> [Ver = | Size = 0 bytes | Modified Date = 14/04/2007 4:11:30 PM | Attr = ]
Cursors -> %SystemRoot%\Cursors -> [Folder | Modified Date = 14/04/2007 4:07:20 PM | Attr = ]
Debug -> %SystemRoot%\Debug -> [Folder | Modified Date = 06/05/2007 6:23:46 PM | Attr = ]
didduid.ini -> %SystemRoot%\didduid.ini -> [Ver = | Size = 12800 bytes | Modified Date = 26/04/2007 12:40:18 PM | Attr = ]
Downloaded Installations -> %SystemRoot%\Downloaded Installations -> [Folder | Modified Date = 19/04/2007 9:41:50 PM | Attr = ]
Downloaded Program Files -> %SystemRoot%\Downloaded Program Files -> [Folder | Modified Date = 27/04/2007 2:23:14 PM | Attr = S]
Driver Cache -> %SystemRoot%\Driver Cache -> [Folder | Modified Date = 21/04/2007 2:05:30 PM | Attr = ]
egjmoq.ini -> %SystemRoot%\egjmoq.ini -> [Ver = | Size = 1063295 bytes | Modified Date = 29/04/2007 7:07:02 PM | Attr = HS]
ehome -> %SystemRoot%\ehome -> [Folder | Modified Date = 06/05/2007 5:54:22 PM | Attr = ]
Fonts -> %SystemRoot%\Fonts -> [Folder | Modified Date = 06/05/2007 6:23:08 PM | Attr = R S]
gmer.dll -> %SystemRoot%\gmer.dll -> [Ver = 1, 0, 12, 12244 | Size = 573503 bytes | Modified Date = 28/04/2007 3:26:38 PM | Attr = ]
gmer.exe -> %SystemRoot%\gmer.exe -> [Ver = 1, 0, 12, 12244 | Size = 577536 bytes | Modified Date = 12/04/2007 5:04:36 PM | Attr = ]
gmer.ini -> %SystemRoot%\gmer.ini -> [Ver = | Size = 250 bytes | Modified Date = 29/04/2007 6:08:24 PM | Attr = ]
gmer_uninstall.cmd -> %SystemRoot%\gmer_uninstall.cmd -> [Ver = | Size = 80 bytes | Modified Date = 28/04/2007 3:26:38 PM | Attr = ]
Help -> %SystemRoot%\Help -> [Folder | Modified Date = 06/05/2007 6:04:32 PM | Attr = ]
I560 -> %SystemRoot%\I560 -> [Folder | Modified Date = 16/04/2007 9:05:12 PM | Attr = ]
ime -> %SystemRoot%\ime -> [Folder | Modified Date = 06/05/2007 6:04:28 PM | Attr = ]
imon.cfg -> %SystemRoot%\imon.cfg -> [Ver = | Size = 118 bytes | Modified Date = 26/04/2007 1:50:22 PM | Attr = ]
imsins.BAK -> %SystemRoot%\imsins.BAK -> [Ver = | Size = 1374 bytes | Modified Date = 29/04/2007 10:12:10 AM | Attr = ]
inf -> %SystemRoot%\inf -> [Folder | Modified Date = 07/05/2007 5:12:12 PM | Attr = H ]
Installer -> %SystemRoot%\Installer -> [Folder | Modified Date = 08/05/2007 7:47:48 PM | Attr = HS]
java -> %SystemRoot%\java -> [Folder | Modified Date = 14/04/2007 4:15:46 PM | Attr = ]
Lic.xxx -> %SystemRoot%\Lic.xxx -> [Ver = | Size = 26 bytes | Modified Date = 29/04/2007 9:07:44 PM | Attr = ]
Media -> %SystemRoot%\Media -> [Folder | Modified Date = 06/05/2007 6:03:54 PM | Attr = ]
MEMORY.DMP -> %SystemRoot%\MEMORY.DMP -> [Ver = | Size = 534831104 bytes | Modified Date = 28/04/2007 3:05:06 PM | Attr = ]
Microsoft.NET -> %SystemRoot%\Microsoft.NET -> [Folder | Modified Date = 14/04/2007 4:36:58 PM | Attr = ]
Minidump -> %SystemRoot%\Minidump -> [Folder | Modified Date = 27/04/2007 11:03:06 AM | Attr = ]
mozver.dat -> %SystemRoot%\mozver.dat -> [Ver = | Size = 671 bytes | Modified Date = 14/04/2007 9:08:16 PM | Attr = ]
msagent -> %SystemRoot%\msagent -> [Folder | Modified Date = 06/05/2007 5:58:22 PM | Attr = ]
msapps -> %SystemRoot%\msapps -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
mspphe.dll -> %SystemRoot%\mspphe.dll -> [Ver = | Size = 24064 bytes | Modified Date = 26/04/2007 12:40:22 PM | Attr = ]
mssvr.exe -> %SystemRoot%\mssvr.exe -> [Ver = | Size = 20736 bytes | Modified Date = 26/04/2007 12:40:22 PM | Attr = ]
mui -> %SystemRoot%\mui -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
nsreg.dat -> %SystemRoot%\nsreg.dat -> [Ver = | Size = 0 bytes | Modified Date = 14/04/2007 7:40:34 PM | Attr = ]
ODBC.INI -> %SystemRoot%\ODBC.INI -> [Ver = | Size = 376 bytes | Modified Date = 14/04/2007 4:31:36 PM | Attr = ]
ODBCINST.INI -> %SystemRoot%\ODBCINST.INI -> [Ver = | Size = 4161 bytes | Modified Date = 21/04/2007 9:19:18 PM | Attr = ]
Offline Web Pages -> %SystemRoot%\Offline Web Pages -> [Folder | Modified Date = 14/04/2007 4:10:32 PM | Attr = R ]
OPTIONS -> %SystemRoot%\OPTIONS -> [Folder | Modified Date = 14/04/2007 5:28:04 PM | Attr = ]
PCHEALTH -> %SystemRoot%\PCHEALTH -> [Folder | Modified Date = 14/04/2007 4:22:40 PM | Attr = ]
peernet -> %SystemRoot%\peernet -> [Folder | Modified Date = 06/05/2007 6:03:56 PM | Attr = ]
PIF -> %SystemRoot%\PIF -> [Folder | Modified Date = 16/04/2007 11:15:44 PM | Attr = H ]
Prefetch -> %SystemRoot%\Prefetch -> [Folder | Modified Date = 08/05/2007 8:01:02 PM | Attr = ]
provisioning -> %SystemRoot%\provisioning -> [Folder | Modified Date = 06/05/2007 6:03:54 PM | Attr = ]
pss -> %SystemRoot%\pss -> [Folder | Modified Date = 14/04/2007 7:29:26 PM | Attr = ]
REGBK00.ZIP -> %SystemRoot%\REGBK00.ZIP -> [Ver = | Size = 4653828 bytes | Modified Date = 29/04/2007 7:42:46 PM | Attr = ]
RegisteredPackages -> %SystemRoot%\RegisteredPackages -> [Folder | Modified Date = 17/04/2007 5:38:46 PM | Attr = ]
Registration -> %SystemRoot%\Registration -> [Folder | Modified Date = 21/04/2007 9:30:52 PM | Attr = ]
REGLOCS.OLD -> %SystemRoot%\REGLOCS.OLD -> [Ver = | Size = 8192 bytes | Modified Date = 14/04/2007 4:15:06 PM | Attr = ]
repair -> %SystemRoot%\repair -> [Folder | Modified Date = 14/04/2007 4:12:14 PM | Attr = ]
Resources -> %SystemRoot%\Resources -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
security -> %SystemRoot%\security -> [Folder | Modified Date = 06/05/2007 6:27:42 PM | Attr = ]
ServicePackFiles -> %SystemRoot%\ServicePackFiles -> [Folder | Modified Date = 29/04/2007 1:04:06 AM | Attr = ]
setup.pss -> %SystemRoot%\setup.pss -> [Folder | Modified Date = 21/04/2007 8:53:28 PM | Attr = ]
setupapi.old -> %SystemRoot%\setupapi.old -> [Ver = | Size = 429426 bytes | Modified Date = 21/04/2007 8:52:58 PM | Attr = ]
setupupd -> %SystemRoot%\setupupd -> [Folder | Modified Date = 21/04/2007 9:03:58 PM | Attr = ]
ShellNew -> %SystemRoot%\ShellNew -> [Folder | Modified Date = 14/04/2007 4:25:30 PM | Attr = H ]
SoftwareDistribution -> %SystemRoot%\SoftwareDistribution -> [Folder | Modified Date = 22/04/2007 12:33:44 PM | Attr = ]
SQLHotfix -> %SystemRoot%\SQLHotfix -> [Folder | Modified Date = 14/04/2007 4:45:26 PM | Attr = ]
srchasst -> %SystemRoot%\srchasst -> [Folder | Modified Date = 06/05/2007 5:58:18 PM | Attr = ]
StartHtmico -> %SystemRoot%\StartHtmico -> [Folder | Modified Date = 16/04/2007 9:05:02 PM | Attr = ]
Sun -> %SystemRoot%\Sun -> [Folder | Modified Date = 14/04/2007 9:08:26 PM | Attr = ]
sys.bat -> %SystemRoot%\sys.bat -> [Ver = | Size = 44 bytes | Modified Date = 27/04/2007 11:01:40 AM | Attr = ]
system -> %SystemRoot%\system -> [Folder | Modified Date = 08/05/2007 7:50:28 PM | Attr = ]
system.ini -> %SystemRoot%\system.ini -> [Ver = | Size = 227 bytes | Modified Date = 21/04/2007 9:11:16 PM | Attr = ]
system32 -> %System32% -> [Folder | Modified Date = 08/05/2007 7:50:46 PM | Attr = ]
Tasks -> %SystemRoot%\Tasks -> [Folder | Modified Date = 17/04/2007 4:56:00 PM | Attr = S]
temp -> %SystemRoot%\temp -> [Folder | Modified Date = 08/05/2007 7:55:14 PM | Attr = ]
twain_32 -> %SystemRoot%\twain_32 -> [Folder | Modified Date = 21/04/2007 2:08:30 PM | Attr = ]
vb.ini -> %SystemRoot%\vb.ini -> [Ver = | Size = 36 bytes | Modified Date = 14/04/2007 4:08:18 PM | Attr = ]
vbaddin.ini -> %SystemRoot%\vbaddin.ini -> [Ver = | Size = 37 bytes | Modified Date = 14/04/2007 4:08:18 PM | Attr = ]
VirtualEar -> %SystemRoot%\VirtualEar -> [Folder | Modified Date = 14/04/2007 7:16:44 PM | Attr = ]
Web -> %SystemRoot%\Web -> [Folder | Modified Date = 06/05/2007 5:54:46 PM | Attr = R ]
win.ini -> %SystemRoot%\win.ini -> [Ver = | Size = 628 bytes | Modified Date = 26/04/2007 6:09:12 PM | Attr = ]
WindowsShell.Manifest -> %SystemRoot%\WindowsShell.Manifest ->  [Ver = | Size = 749 bytes | Modified Date = 21/04/2007 9:18:02 PM | Attr = RH ]
WinSxS -> %SystemRoot%\WinSxS -> [Folder | Modified Date = 06/05/2007 6:04:40 PM | Attr = ]
WMSysPr9.prx -> %SystemRoot%\WMSysPr9.prx -> [Ver = | Size = 316640 bytes | Modified Date = 06/05/2007 6:08:02 PM | Attr = ]
WMSysPrx.prx -> %SystemRoot%\WMSysPrx.prx -> [Ver = | Size = 299552 bytes | Modified Date = 21/04/2007 9:19:26 PM | Attr = ]
zts2.exe -> %SystemRoot%\zts2.exe -> [Folder | Modified Date = 29/04/2007 7:46:36 PM | Attr = ]
_isenv31.ini -> %SystemRoot%\_isenv31.ini -> [Ver = | Size = 1099 bytes | Modified Date = 16/04/2007 9:17:48 PM | Attr = ]
SA.DAT -> %SystemRoot%\tasks\SA.DAT -> [Ver = | Size = 6 bytes | Modified Date = 08/05/2007 7:52:50 PM | Attr = H ]
$winnt$.inf -> %System32%\$winnt$.inf -> [Ver = | Size = 14659 bytes | Modified Date = 21/04/2007 9:25:10 PM | Attr = ]
1025 -> %System32%\1025 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
1028 -> %System32%\1028 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
1031 -> %System32%\1031 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
1033 -> %System32%\1033 -> [Folder | Modified Date = 21/04/2007 2:07:26 PM | Attr = ]
1037 -> %System32%\1037 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
1041 -> %System32%\1041 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
1042 -> %System32%\1042 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
1054 -> %System32%\1054 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
2052 -> %System32%\2052 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
3076 -> %System32%\3076 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]


----------



## monkeybubbles (Apr 26, 2007)

3com_dmi -> %System32%\3com_dmi -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
aaarggp.bat -> %System32%\aaarggp.bat -> [Ver = | Size = 117 bytes | Modified Date = 29/04/2007 12:34:40 AM | Attr = ]
ActiveScan -> %System32%\ActiveScan -> [Folder | Modified Date = 21/04/2007 10:24:30 PM | Attr = ]
amcompat.tlb -> %System32%\amcompat.tlb -> [Ver = | Size = 16832 bytes | Modified Date = 21/04/2007 9:19:26 PM | Attr = ]
avgfwafu.dll -> %System32%\avgfwafu.dll -> GRISOFT, s.r.o. [Ver = 7.5.0.407 | Size = 110592 bytes | Modified Date = 08/05/2007 7:50:46 PM | Attr = ]
Backup -> %System32%\Backup -> [Folder | Modified Date = 14/04/2007 4:42:02 PM | Attr = ]
bits -> %System32%\bits -> [Folder | Modified Date = 22/04/2007 2:23:34 PM | Attr = ]
bjlhfhv.bat -> %System32%\bjlhfhv.bat -> [Ver = | Size = 117 bytes | Modified Date = 28/04/2007 3:02:12 PM | Attr = ]
CatRoot -> %System32%\CatRoot -> [Folder | Modified Date = 06/05/2007 6:13:10 PM | Attr = ]
CatRoot2 -> %System32%\CatRoot2 -> [Folder | Modified Date = 08/05/2007 7:21:14 PM | Attr = ]
cckdou.bat -> %System32%\cckdou.bat -> [Ver = | Size = 116 bytes | Modified Date = 28/04/2007 7:56:48 PM | Attr = ]
cdplayer.exe.manifest -> %System32%\cdplayer.exe.manifest -> [Ver = | Size = 749 bytes | Modified Date = 21/04/2007 9:18:02 PM | Attr = RH ]
clcl5.exe -> %System32%\clcl5.exe -> [Ver = | Size = 204800 bytes | Modified Date = 21/04/2007 3:38:12 PM | Attr = ]
Com -> %System32%\Com -> [Folder | Modified Date = 06/05/2007 5:58:06 PM | Attr = ]
config -> %System32%\config -> [Folder | Modified Date = 23/04/2007 5:42:58 PM | Attr = ]
CONFIG.NT -> %System32%\CONFIG.NT -> [Ver = | Size = 2577 bytes | Modified Date = 14/04/2007 4:11:32 PM | Attr = ]
ddcyw.exe -> %System32%\ddcyw.exe -> [Ver = | Size = 29769 bytes | Modified Date = 27/04/2007 2:09:06 PM | Attr = ]
dhcp -> %System32%\dhcp -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
DirectX -> %System32%\DirectX -> [Folder | Modified Date = 14/04/2007 4:10:00 PM | Attr = ]
dllcache -> %System32%\dllcache -> [Folder | Modified Date = 07/05/2007 7:49:46 PM | Attr = RHS]
dpvltxhh.ini -> %System32%\dpvltxhh.ini -> [Ver = | Size = 1622957 bytes | Modified Date = 17/04/2007 5:23:04 PM | Attr = HS]
drivers -> %System32%\drivers -> [Folder | Modified Date = 08/05/2007 7:50:48 PM | Attr = ]
DRVSTORE -> %System32%\DRVSTORE -> [Folder | Modified Date = 16/04/2007 8:13:00 PM | Attr = ]
duxdy.bat -> %System32%\duxdy.bat -> [Ver = | Size = 121 bytes | Modified Date = 27/04/2007 3:45:04 PM | Attr = ]
emptyregdb.dat -> %System32%\emptyregdb.dat -> [Ver = | Size = 23316 bytes | Modified Date = 21/04/2007 9:17:34 PM | Attr = ]
eofrwchw.bat -> %System32%\eofrwchw.bat -> [Ver = | Size = 130 bytes | Modified Date = 26/04/2007 3:49:54 PM | Attr = ]
eqjfpcz.exe -> %System32%\eqjfpcz.exe -> [Ver = | Size = 6656 bytes | Modified Date = 27/04/2007 1:54:16 PM | Attr = ]
esaxqqvn.bat -> %System32%\esaxqqvn.bat -> [Ver = | Size = 121 bytes | Modified Date = 21/04/2007 10:39:28 PM | Attr = ]
export -> %System32%\export -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
ffvuhlw.bat -> %System32%\ffvuhlw.bat -> [Ver = | Size = 117 bytes | Modified Date = 29/04/2007 12:28:14 AM | Attr = ]
fjnsbn.bat -> %System32%\fjnsbn.bat -> [Ver = | Size = 125 bytes | Modified Date = 28/04/2007 6:09:04 PM | Attr = ]
FNTCACHE.DAT -> %System32%\FNTCACHE.DAT -> [Ver = | Size = 243128 bytes | Modified Date = 06/05/2007 6:23:12 PM | Attr = ]
fuamfu32.ini -> %System32%\fuamfu32.ini -> [Ver = | Size = 4 bytes | Modified Date = 26/04/2007 12:40:06 PM | Attr = ]
g.bat -> %System32%\g.bat -> [Ver = | Size = 24 bytes | Modified Date = 28/04/2007 3:31:10 PM | Attr = ]
g.ftp -> %System32%\g.ftp -> [Ver = | Size = 53 bytes | Modified Date = 28/04/2007 3:31:10 PM | Attr = ]
gnyntbtu.bat -> %System32%\gnyntbtu.bat -> [Ver = | Size = 130 bytes | Modified Date = 27/04/2007 3:42:00 PM | Attr = ]
gtv_sd.bin -> %System32%\gtv_sd.bin -> [Ver = | Size = 12 bytes | Modified Date = 26/04/2007 12:40:12 PM | Attr = ]
Help.ico -> %System32%\Help.ico -> [Ver = | Size = 1406 bytes | Modified Date = 21/04/2007 10:24:02 PM | Attr = ]
hsfbcgbn.bat -> %System32%\hsfbcgbn.bat -> [Ver = | Size = 130 bytes | Modified Date = 28/04/2007 3:02:14 PM | Attr = ]
ias -> %System32%\ias -> [Folder | Modified Date = 21/04/2007 9:18:58 PM | Attr = ]
icsxml -> %System32%\icsxml -> [Folder | Modified Date = 21/04/2007 2:08:08 PM | Attr = ]
IME -> %System32%\IME -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
inet.hlp -> %System32%\inet.hlp -> [Ver = | Size = 4665 bytes | Modified Date = 26/04/2007 12:40:08 PM | Attr = ]
inetsrv -> %System32%\inetsrv -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
iqny.bat -> %System32%\iqny.bat -> [Ver = | Size = 126 bytes | Modified Date = 28/04/2007 8:22:22 PM | Attr = ]
jmllm.tmp -> %System32%\jmllm.tmp -> [Ver = | Size = 812713 bytes | Modified Date = 15/04/2007 1:32:10 PM | Attr = HS]
jrnsa.bat -> %System32%\jrnsa.bat -> [Ver = | Size = 127 bytes | Modified Date = 27/04/2007 3:42:00 PM | Attr = ]
Kaspersky Lab -> %System32%\Kaspersky Lab -> [Folder | Modified Date = 27/04/2007 2:23:12 PM | Attr = ]
koreiwcd.exe -> %System32%\koreiwcd.exe -> [Ver = | Size = 6656 bytes | Modified Date = 26/04/2007 2:59:16 PM | Attr = ]
kvh.exe -> %System32%\kvh.exe -> [Ver = | Size = 0 bytes | Modified Date = 27/04/2007 12:56:36 PM | Attr = ]
kxsgyi.exe -> %System32%\kxsgyi.exe -> [Ver = | Size = 6656 bytes | Modified Date = 27/04/2007 1:55:08 PM | Attr = ]
lahc.bat -> %System32%\lahc.bat -> [Ver = | Size = 126 bytes | Modified Date = 28/04/2007 8:09:20 PM | Attr = ]
lclcfg32.ini -> %System32%\lclcfg32.ini -> [Ver = | Size = 0 bytes | Modified Date = 26/04/2007 2:47:52 PM | Attr = ]
lfd32.ini -> %System32%\lfd32.ini -> [Ver = | Size = 83 bytes | Modified Date = 26/04/2007 12:40:08 PM | Attr = ]
logonui.exe.manifest -> %System32%\logonui.exe.manifest -> [Ver = | Size = 488 bytes | Modified Date = 21/04/2007 9:18:08 PM | Attr = RH ]
lxtuvkdn.bat -> %System32%\lxtuvkdn.bat -> [Ver = | Size = 124 bytes | Modified Date = 27/04/2007 3:47:58 PM | Attr = ]
Macromed -> %System32%\Macromed -> [Folder | Modified Date = 14/04/2007 4:09:58 PM | Attr = ]
mapisvc.inf -> %System32%\mapisvc.inf -> [Ver = | Size = 466 bytes | Modified Date = 14/04/2007 4:40:52 PM | Attr = ]
Microsoft -> %System32%\Microsoft -> [Folder | Modified Date = 27/04/2007 12:47:42 PM | Attr = S]
mn.dll -> %System32%\mn.dll -> [Ver = 1, 0, 0, 2 | Size = 16721 bytes | Modified Date = 27/04/2007 11:01:40 AM | Attr = ]
mprhou.dns -> %System32%\mprhou.dns -> [Ver = | Size = 163 bytes | Modified Date = 29/04/2007 6:05:52 PM | Attr = H ]
mrfui.bat -> %System32%\mrfui.bat -> [Ver = | Size = 124 bytes | Modified Date = 28/04/2007 8:05:02 PM | Attr = ]
MsDtc -> %System32%\MsDtc -> [Folder | Modified Date = 14/04/2007 4:08:14 PM | Attr = ]
MSIXU.DLL -> %System32%\MSIXU.DLL -> [Ver = | Size = 22016 bytes | Modified Date = 26/04/2007 12:40:20 PM | Attr = ]
mui -> %System32%\mui -> [Folder | Modified Date = 06/05/2007 6:04:30 PM | Attr = ]
mzzdcq.bat -> %System32%\mzzdcq.bat -> [Ver = | Size = 122 bytes | Modified Date = 28/04/2007 8:08:10 PM | Attr = ]
ncpa.cpl.manifest -> %System32%\ncpa.cpl.manifest -> [Ver = | Size = 749 bytes | Modified Date = 21/04/2007 9:18:02 PM | Attr = RH ]
nhyv.bat -> %System32%\nhyv.bat -> [Ver = | Size = 126 bytes | Modified Date = 28/04/2007 3:02:12 PM | Attr = ]
nkprri.exe -> %System32%\nkprri.exe -> [Ver = | Size = 6656 bytes | Modified Date = 27/04/2007 2:00:50 PM | Attr = ]
npp -> %System32%\npp -> [Folder | Modified Date = 06/05/2007 5:58:22 PM | Attr = ]
nscompat.tlb -> %System32%\nscompat.tlb -> [Ver = | Size = 23392 bytes | Modified Date = 21/04/2007 9:19:26 PM | Attr = ]
nwc.cpl.manifest -> %System32%\nwc.cpl.manifest -> [Ver = | Size = 749 bytes | Modified Date = 21/04/2007 9:18:02 PM | Attr = RH ]
oayx.exe -> %System32%\oayx.exe -> [Ver = | Size = 23552 bytes | Modified Date = 23/04/2007 5:44:12 PM | Attr = H ]
oobe -> %System32%\oobe -> [Folder | Modified Date = 06/05/2007 6:04:32 PM | Attr = ]
otpzys.bat -> %System32%\otpzys.bat -> [Ver = | Size = 116 bytes | Modified Date = 28/04/2007 7:55:32 PM | Attr = ]
pavas.ico -> %System32%\pavas.ico -> [Ver = | Size = 30590 bytes | Modified Date = 21/04/2007 10:24:02 PM | Attr = ]
perfc009.dat -> %System32%\perfc009.dat -> [Ver = | Size = 61258 bytes | Modified Date = 06/05/2007 6:26:16 PM | Attr = ]
perfh009.dat -> %System32%\perfh009.dat -> [Ver = | Size = 401084 bytes | Modified Date = 06/05/2007 6:26:16 PM | Attr = ]
PerfStringBackup.INI -> %System32%\PerfStringBackup.INI -> [Ver = | Size = 469794 bytes | Modified Date = 06/05/2007 6:26:16 PM | Attr = ]
phmvyowg.bat -> %System32%\phmvyowg.bat -> [Ver = | Size = 121 bytes | Modified Date = 28/04/2007 3:02:14 PM | Attr = ]
qgyom.exe -> %System32%\qgyom.exe -> [Ver = | Size = 6656 bytes | Modified Date = 27/04/2007 1:54:18 PM | Attr = ]
qip.exe -> %System32%\qip.exe -> [Ver = | Size = 20480 bytes | Modified Date = 23/04/2007 5:44:30 PM | Attr = ]
qrfse.bat -> %System32%\qrfse.bat -> [Ver = | Size = 127 bytes | Modified Date = 21/04/2007 10:03:30 PM | Attr = ]
qxft.exe -> %System32%\qxft.exe -> [Ver = | Size = 11148 bytes | Modified Date = 27/04/2007 1:43:40 PM | Attr = ]
qywx.exe -> %System32%\qywx.exe -> [Ver = | Size = 6656 bytes | Modified Date = 27/04/2007 1:43:40 PM | Attr = ]
qzgm.exe -> %System32%\qzgm.exe -> [Ver = | Size = 6656 bytes | Modified Date = 27/04/2007 2:00:50 PM | Attr = ]
ras -> %System32%\ras -> [Folder | Modified Date = 14/04/2007 8:57:50 AM | Attr = ]
ReinstallBackups -> %System32%\ReinstallBackups -> [Folder | Modified Date = 06/05/2007 5:53:14 PM | Attr = ]
Restore -> %System32%\Restore -> [Folder | Modified Date = 06/05/2007 5:58:22 PM | Attr = ]
rttae.exe -> %System32%\rttae.exe -> [Ver = | Size = 1460 bytes | Modified Date = 15/04/2007 2:03:22 PM | Attr = H ]
sapi.cpl.manifest -> %System32%\sapi.cpl.manifest -> [Ver = | Size = 749 bytes | Modified Date = 21/04/2007 9:18:02 PM | Attr = RH ]
satmat.exe -> %System32%\satmat.exe -> [Ver = | Size = 20480 bytes | Modified Date = 26/04/2007 12:40:26 PM | Attr = ]
Setup -> %System32%\Setup -> [Folder | Modified Date = 06/05/2007 6:04:28 PM | Attr = ]
ShellExt -> %System32%\ShellExt -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
sl.bin -> %System32%\sl.bin -> [Ver = | Size = 12 bytes | Modified Date = 26/04/2007 12:44:00 PM | Attr = ]
SoftwareDistribution -> %System32%\SoftwareDistribution -> [Folder | Modified Date = 21/04/2007 9:57:26 PM | Attr = ]
sowsrkve.bat -> %System32%\sowsrkve.bat -> [Ver = | Size = 130 bytes | Modified Date = 27/04/2007 4:02:32 PM | Attr = ]
spool -> %System32%\spool -> [Folder | Modified Date = 14/04/2007 4:06:10 PM | Attr = ]
spupdsvc.inf -> %System32%\spupdsvc.inf -> [Ver = | Size = 2694 bytes | Modified Date = 06/05/2007 6:12:36 PM | Attr = ]
stfv.bin -> %System32%\stfv.bin -> [Ver = | Size = 4 bytes | Modified Date = 27/04/2007 1:12:38 PM | Attr = ]
tftp.exe -> %System32%\tftp.exe -> [Ver = | Size = 16896 bytes | Modified Date = 28/04/2007 3:02:10 PM | Attr = ]
ubdlul.exe -> %System32%\ubdlul.exe -> [Ver = | Size = 6656 bytes | Modified Date = 27/04/2007 1:55:10 PM | Attr = ]
ufhp.exe -> %System32%\ufhp.exe -> [Ver = | Size = 11148 bytes | Modified Date = 27/04/2007 2:00:50 PM | Attr = ]
Uninstall.ico -> %System32%\Uninstall.ico -> [Ver = | Size = 2550 bytes | Modified Date = 21/04/2007 10:24:02 PM | Attr = ]
URTTemp -> %System32%\URTTemp -> [Folder | Modified Date = 14/04/2007 4:37:06 PM | Attr = ]
usmt -> %System32%\usmt -> [Folder | Modified Date = 06/05/2007 5:57:14 PM | Attr = ]
vcmgcd32.dll -> %System32%\vcmgcd32.dll -> [Folder | Modified Date = 29/04/2007 7:46:36 PM | Attr = ]
vxddsk.exe -> %System32%\vxddsk.exe -> [Ver = | Size = 30464 bytes | Modified Date = 26/04/2007 12:40:26 PM | Attr = ]
wbem -> %System32%\wbem -> [Folder | Modified Date = 06/05/2007 6:23:54 PM | Attr = ]
WER8274.DLL -> %System32%\WER8274.DLL -> [Ver = | Size = 24320 bytes | Modified Date = 26/04/2007 12:40:20 PM | Attr = ]
WindowsLogon.manifest -> %System32%\WindowsLogon.manifest -> [Ver = | Size = 488 bytes | Modified Date = 21/04/2007 9:18:08 PM | Attr = RH ]
wins -> %System32%\wins -> [Folder | Modified Date = 29/04/2007 8:28:56 PM | Attr = ]
wml.exe -> %System32%\wml.exe -> [Ver = | Size = 18944 bytes | Modified Date = 26/04/2007 12:40:26 PM | Attr = ]
wmpscheme.xml -> %System32%\wmpscheme.xml -> [Ver = | Size = 25065 bytes | Modified Date = 21/04/2007 9:19:30 PM | Attr = ]
wpa.bak -> %System32%\wpa.bak -> [Ver = | Size = 2422 bytes | Modified Date = 07/05/2007 5:23:54 PM | Attr = ]
wpa.dbl -> %System32%\wpa.dbl -> [Ver = | Size = 2422 bytes | Modified Date = 08/05/2007 7:27:40 PM | Attr = ]
wtxqvmat.ini -> %System32%\wtxqvmat.ini -> [Ver = | Size = 1543 bytes | Modified Date = 28/04/2007 3:02:02 PM | Attr = HS]
wuaucpl.cpl.manifest -> %System32%\wuaucpl.cpl.manifest -> [Ver = | Size = 749 bytes | Modified Date = 21/04/2007 9:18:02 PM | Attr = RH ]
xcxfiy.bat -> %System32%\xcxfiy.bat -> [Ver = | Size = 125 bytes | Modified Date = 28/04/2007 3:02:12 PM | Attr = ]
xircom -> %System32%\xircom -> [Folder | Modified Date = 14/04/2007 4:12:16 PM | Attr = ]
xwngvgz.bat -> %System32%\xwngvgz.bat -> [Ver = | Size = 117 bytes | Modified Date = 26/04/2007 3:50:44 PM | Attr = ]
ynjkv.exe -> %System32%\ynjkv.exe -> [Ver = | Size = 11148 bytes | Modified Date = 27/04/2007 1:54:18 PM | Attr = ]
yratiea.bat -> %System32%\yratiea.bat -> [Ver = | Size = 123 bytes | Modified Date = 28/04/2007 8:03:50 PM | Attr = ]
tftp.exe -> %System32%\dllcache\tftp.exe -> [Ver = | Size = 16896 bytes | Modified Date = 28/04/2007 3:02:10 PM | Attr = ]
avg7core.sys -> %System32%\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 816672 bytes | Modified Date = 08/05/2007 7:50:42 PM | Attr = ]
avg7rsw.sys -> %System32%\drivers\avg7rsw.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,340 | Size = 4224 bytes | Modified Date = 23/04/2007 4:54:42 PM | Attr = ]
avg7rsxp.sys -> %System32%\drivers\avg7rsxp.sys -> GRISOFT, s.r.o. [Ver = 7,1,0,398 | Size = 28416 bytes | Modified Date = 08/05/2007 7:50:42 PM | Attr = ]
avgclean.sys -> %System32%\drivers\avgclean.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Modified Date = 08/05/2007 7:50:46 PM | Attr = ]
avgmfx86.sys -> %System32%\drivers\avgmfx86.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.416 | Size = 18240 bytes | Modified Date = 08/05/2007 7:50:42 PM | Attr = ]
avgtdi.sys -> %System32%\drivers\avgtdi.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,346 | Size = 4960 bytes | Modified Date = 08/05/2007 7:50:44 PM | Attr = ]
disdn -> %System32%\drivers\disdn -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
etc -> %System32%\drivers\etc -> [Folder | Modified Date = 01/05/2007 3:53:40 PM | Attr = ]
gmer.sys -> %System32%\drivers\gmer.sys -> GMER [Ver = 1, 0, 12, 3868 | Size = 69905 bytes | Modified Date = 28/04/2007 3:26:38 PM | Attr = ]
SYMEVENT.CAT -> %System32%\drivers\SYMEVENT.CAT -> [Ver = | Size = 8014 bytes | Modified Date = 16/04/2007 10:42:02 PM | Attr = ]
SYMEVENT.INF -> %System32%\drivers\SYMEVENT.INF -> [Ver = | Size = 806 bytes | Modified Date = 16/04/2007 10:42:02 PM | Attr = ]
hosts.bak -> %System32%\drivers\etc\hosts.bak -> [Ver = | Size = 27 bytes | Modified Date = 27/04/2007 2:00:42 PM | Attr = ]

[File String Scan - Non-Microsoft Only]
File scan skipped for file %SystemRoot%\MEMORY.DMP -> File size too big (534831104 bytes) -> 
aspack , -> %System32%\clcl5.exe -> [Ver = | Size = 204800 bytes | Modified Date = 21/04/2007 3:38:12 PM | Attr = ]
MZKERNEL32.DLL , -> %System32%\ddcyw.exe -> [Ver = | Size = 29769 bytes | Modified Date = 27/04/2007 2:09:06 PM | Attr = ]
PEC2 , -> %System32%\dfrg.msc -> [Ver = | Size = 41397 bytes | Modified Date = 18/08/2001 5:00:00 AM | Attr = ]
PEC2 , PECompact2 , -> %System32%\DivX.dll -> DivXNetworks [Ver = 6,0,0,1571 | Size = 692736 bytes | Modified Date = 09/08/2005 3:14:00 PM | Attr = ]
UPX! , UPX0 , -> %System32%\eqjfpcz.exe -> [Ver = | Size = 6656 bytes | Modified Date = 27/04/2007 1:54:16 PM | Attr = ]
UPX! , UPX0 , -> %System32%\koreiwcd.exe -> [Ver = | Size = 6656 bytes | Modified Date = 26/04/2007 2:59:16 PM | Attr = ]
UPX! , UPX0 , -> %System32%\kxsgyi.exe -> [Ver = | Size = 6656 bytes | Modified Date = 27/04/2007 1:55:08 PM | Attr = ]
UpackByDwing , MZKERNEL32.DLL , -> %System32%\mn.dll -> [Ver = 1, 0, 0, 2 | Size = 16721 bytes | Modified Date = 27/04/2007 11:01:40 AM | Attr = ]
UPX! , UPX0 , -> %System32%\qywx.exe -> [Ver = | Size = 6656 bytes | Modified Date = 27/04/2007 1:43:40 PM | Attr = ]
UPX! , UPX0 , -> %System32%\qzgm.exe -> [Ver = | Size = 6656 bytes | Modified Date = 27/04/2007 2:00:50 PM | Attr = ]
UPX! , UPX0 , -> %System32%\ubdlul.exe -> [Ver = | Size = 6656 bytes | Modified Date = 27/04/2007 1:55:10 PM | Attr = ]
winsync , -> %System32%\wbdbase.deu -> [Ver = | Size = 1309184 bytes | Modified Date = 18/08/2001 5:00:00 AM | Attr = ]
WSUD , UPX0 , -> %System32%\dllcache\hwxjpn.dll -> [Ver = | Size = 13463552 bytes | Modified Date = 18/08/2001 5:00:00 AM | Attr = ]
UPX! , FSG! , PEC2 , aspack , -> %System32%\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 816672 bytes | Modified Date = 08/05/2007 7:50:42 PM | Attr = ]
PTech , -> %System32%\drivers\mtlstrm.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 1309184 bytes | Modified Date = 03/08/2004 10:41:38 PM | Attr = ]

< End of report >


----------



## sjpritch25 (Sep 8, 2005)

Please close all open programs because this could affect the fix. Thanks.

Start *WinPFind3U*. Copy/Paste the information in the Quotebox below into the pane where it says *"Paste fix here"* and then click the Run Fix button.



> [Unregister Dlls]
> [Files/Folders - Created Within 30 days]
> NY -> jmllm.tmp -> %System32%\jmllm.tmp
> NY -> jrnsa.bat -> %System32%\jrnsa.bat
> ...


The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. CLick the Ok button and Notepad will open with a log of actions taken during the fix. *Post that information back here along with a new WinPFind3u scan and a Hijackthis log, separately *(the Hijackthis can be pasted on the reply).

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

================================

Do you have a Windows XP Cd????


----------



## monkeybubbles (Apr 26, 2007)

[Files/Folders - Created Within 30 days]
C:\WINDOWS\SYSTEM32\jmllm.tmp moved successfully.
C:\WINDOWS\SYSTEM32\jrnsa.bat moved successfully.
[Files/Folders - Modified Within 30 days]
LoadLibrary failed for C:\WINDOWS\mspphe.dll
C:\WINDOWS\mspphe.dll NOT unregistered.
C:\WINDOWS\mspphe.dll moved successfully.
C:\WINDOWS\mssvr.exe moved successfully.
C:\WINDOWS\zts2.exe moved successfully.
C:\WINDOWS\SYSTEM32\cckdou.bat moved successfully.
C:\WINDOWS\SYSTEM32\ddcyw.exe moved successfully.
C:\WINDOWS\SYSTEM32\dpvltxhh.ini moved successfully.
C:\WINDOWS\SYSTEM32\duxdy.bat moved successfully.
C:\WINDOWS\SYSTEM32\eqjfpcz.exe moved successfully.
C:\WINDOWS\SYSTEM32\ffvuhlw.bat moved successfully.
C:\WINDOWS\SYSTEM32\gnyntbtu.bat moved successfully.
C:\WINDOWS\SYSTEM32\hsfbcgbn.bat moved successfully.
C:\WINDOWS\SYSTEM32\iqny.bat moved successfully.
File C:\WINDOWS\SYSTEM32\jmllm.tmp not found!
C:\WINDOWS\SYSTEM32\koreiwcd.exe moved successfully.
C:\WINDOWS\SYSTEM32\kvh.exe moved successfully.
C:\WINDOWS\SYSTEM32\kxsgyi.exe moved successfully.
C:\WINDOWS\SYSTEM32\lahc.bat moved successfully.
C:\WINDOWS\SYSTEM32\lxtuvkdn.bat moved successfully.
C:\WINDOWS\SYSTEM32\mrfui.bat moved successfully.
C:\WINDOWS\SYSTEM32\mzzdcq.bat moved successfully.
C:\WINDOWS\SYSTEM32\nhyv.bat moved successfully.
C:\WINDOWS\SYSTEM32\nkprri.exe moved successfully.
C:\WINDOWS\SYSTEM32\oayx.exe moved successfully.
C:\WINDOWS\SYSTEM32\otpzys.bat moved successfully.
C:\WINDOWS\SYSTEM32\phmvyowg.bat moved successfully.
C:\WINDOWS\SYSTEM32\qgyom.exe moved successfully.
C:\WINDOWS\SYSTEM32\qip.exe moved successfully.
C:\WINDOWS\SYSTEM32\qrfse.bat moved successfully.
C:\WINDOWS\SYSTEM32\qxft.exe moved successfully.
C:\WINDOWS\SYSTEM32\qywx.exe moved successfully.
C:\WINDOWS\SYSTEM32\qzgm.exe moved successfully.
C:\WINDOWS\SYSTEM32\rttae.exe moved successfully.
C:\WINDOWS\SYSTEM32\satmat.exe moved successfully.
C:\WINDOWS\SYSTEM32\sowsrkve.bat moved successfully.
C:\WINDOWS\SYSTEM32\tftp.exe moved successfully.
C:\WINDOWS\SYSTEM32\ubdlul.exe moved successfully.
C:\WINDOWS\SYSTEM32\ufhp.exe moved successfully.
C:\WINDOWS\SYSTEM32\vcmgcd32.dll moved successfully.
C:\WINDOWS\SYSTEM32\vxddsk.exe moved successfully.
C:\WINDOWS\SYSTEM32\xcxfiy.bat moved successfully.
C:\WINDOWS\SYSTEM32\xwngvgz.bat moved successfully.
C:\WINDOWS\SYSTEM32\ynjkv.exe moved successfully.
C:\WINDOWS\SYSTEM32\yratiea.bat moved successfully.
[Empty Temp Folders]
C:\DOCUME~1\Owner\LOCALS~1\Temp\ -> emptied.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\ -> emptied
RecycleBin -> emptied.
< End of log >
Created on 05/10/2007 19:36:37


----------



## monkeybubbles (Apr 26, 2007)

Logfile of HijackThis v1.99.1
Scan saved at 7:51:40 PM, on 10/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.shaw.ca/start/enca/addons/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://start.shaw.ca/start/enca/addons/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.shaw.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.shaw.ca/start/enca/addons/search/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.shaw.ca
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.shaw.ca/start/enca/addons/search/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.shaw.ca/start/enca/addons/search/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by SHAW Internet
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe


----------



## monkeybubbles (Apr 26, 2007)

WinPFind3 logfile created on: 10/05/2007 7:40:26 PM
WinPFind3U by OldTimer - Version 1.0.35	Folder = C:\Documents and Settings\Owner\Desktop\WinPFind3u\
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)
Internet Explorer (Version = 6.0.2900.2180)

509.98 Mb Total Physical Memory | 259.28 Mb Available Physical Memory | 50.84% Memory free
1.22 Gb Paging File | 0.95 Gb Available in Paging File | 78.23% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 34.09 Gb Total Space | 21.77 Gb Free Space | 63.86% Space Free
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded

Computer Name: BUBBLES
Current User Name: Owner
Logged in as Administrator.
Current Boot Mode: Normal

[Processes - Non-Microsoft Only]
apdproxy.exe -> %ProgramFiles%\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe -> Adobe Systems Incorporated [Ver = 3.0.0.49815 | Size = 57344 bytes | Modified Date = 06/06/2005 11:46:24 PM | Attr = ]
avgamsvr.exe -> %ProgramFiles%\Grisoft\AVG7\avgamsvr.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 343552 bytes | Modified Date = 08/05/2007 7:50:36 PM | Attr = ]
avgcc.exe -> %ProgramFiles%\Grisoft\AVG7\avgcc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.418 | Size = 406016 bytes | Modified Date = 08/05/2007 7:50:38 PM | Attr = ]
avgemc.exe -> %ProgramFiles%\Grisoft\AVG7\avgemc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 322560 bytes | Modified Date = 08/05/2007 7:50:38 PM | Attr = ]
avgfwsrv.exe -> %ProgramFiles%\Grisoft\AVG7\avgfwsrv.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 811008 bytes | Modified Date = 08/05/2007 7:50:38 PM | Attr = ]
avgrssvc.exe -> %ProgramFiles%\Grisoft\AVG7\avgrssvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 253952 bytes | Modified Date = 08/05/2007 7:50:36 PM | Attr = ]
avgupsvc.exe -> %ProgramFiles%\Grisoft\AVG7\avgupsvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 49664 bytes | Modified Date = 08/05/2007 7:50:42 PM | Attr = ]
hkcmd.exe -> %System32%\hkcmd.exe -> Intel Corporation [Ver = 3.0.0.4396 | Size = 77824 bytes | Modified Date = 20/09/2005 9:32:24 AM | Attr = ]
igfxpers.exe -> %System32%\igfxpers.exe -> Intel Corporation [Ver = 3.0.0.4396 | Size = 114688 bytes | Modified Date = 20/09/2005 9:36:20 AM | Attr = ]
jusched.exe -> %ProgramFiles%\Java\jre1.6.0_01\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 83608 bytes | Modified Date = 14/03/2007 3:43:44 AM | Attr = ]
pwrisovm.exe -> %ProgramFiles%\PowerISO\PWRISOVM.EXE -> PowerISO Computing, Inc. [Ver = 3, 0, 0, 0 | Size = 184320 bytes | Modified Date = 17/03/2006 7:24:18 PM | Attr = ]
reader_sl.exe -> %ProgramFiles%\Adobe\Reader 8.0\Reader\reader_sl.exe -> Adobe Systems Incorporated [Ver = 8.0.0.0 | Size = 40048 bytes | Modified Date = 23/10/2006 1:48:20 AM | Attr = ]
superantispyware.exe -> %ProgramFiles%\SUPERAntiSpyware\SUPERAntiSpyware.exe -> SUPERAntiSpyware.com [Ver = 3, 7, 0, 1018 | Size = 1318128 bytes | Modified Date = 01/05/2007 9:29:58 AM | Attr = ]
winpfind3u.exe -> %UserDesktop%\WinPFind3u\WinPFind3U.exe -> OldTimer Tools [Ver = 1.0.35.0 | Size = 319488 bytes | Modified Date = 06/05/2007 9:38:54 AM | Attr = ]
wkufind.exe -> %CommonProgramFiles%\Microsoft Shared\Works Shared\WkUFind.exe -> Microsoft® Corporation [Ver = 7.00.0724.0 | Size = 28672 bytes | Modified Date = 24/07/2002 9:20:02 PM | Attr = ]
wzqkpick.exe -> %ProgramFiles%\WinZip\WZQKPICK.EXE -> WinZip Computing LP [Ver = 1.0 (32-bit) | Size = 389120 bytes | Modified Date = 21/11/2006 11:00:00 AM | Attr = ]

[Win32 Services - Non-Microsoft Only]
(Avg7Alrt) AVG7 Alert Manager Server [Win32_Own | Auto | Running] -> %ProgramFiles%\Grisoft\AVG7\avgamsvr.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 343552 bytes | Modified Date = 08/05/2007 7:50:36 PM | Attr = ]
(Avg7UpdSvc) AVG7 Update Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Grisoft\AVG7\avgupsvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 49664 bytes | Modified Date = 08/05/2007 7:50:42 PM | Attr = ]
(AvgCoreSvc) AVG7 Resident Shield Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Grisoft\AVG7\avgrssvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 253952 bytes | Modified Date = 08/05/2007 7:50:36 PM | Attr = ]
(AVGEMS) AVG E-mail Scanner [Win32_Own | Auto | Running] -> %ProgramFiles%\Grisoft\AVG7\avgemc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 322560 bytes | Modified Date = 08/05/2007 7:50:38 PM | Attr = ]
(AVGFwSrv) AVG Firewall [Win32_Own | Auto | Running] -> %ProgramFiles%\Grisoft\AVG7\avgfwsrv.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 811008 bytes | Modified Date = 08/05/2007 7:50:38 PM | Attr = ]
(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> %System32%\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 224768 bytes | Modified Date = 04/08/2004 12:56:50 AM | Attr = ]

[Registry - Non-Microsoft Only]
< Run [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Adobe Photo Downloader -> %ProgramFiles%\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe -> Adobe Systems Incorporated [Ver = 3.0.0.49815 | Size = 57344 bytes | Modified Date = 06/06/2005 11:46:24 PM | Attr = ]
AVG7_CC -> %ProgramFiles%\Grisoft\AVG7\avgcc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.418 | Size = 406016 bytes | Modified Date = 08/05/2007 7:50:38 PM | Attr = ]
igfxhkcmd -> %System32%\hkcmd.exe -> Intel Corporation [Ver = 3.0.0.4396 | Size = 77824 bytes | Modified Date = 20/09/2005 9:32:24 AM | Attr = ]
igfxpers -> %System32%\igfxpers.exe -> Intel Corporation [Ver = 3.0.0.4396 | Size = 114688 bytes | Modified Date = 20/09/2005 9:36:20 AM | Attr = ]
igfxtray -> %System32%\igfxtray.exe -> Intel Corporation [Ver = 3.0.0.4396 | Size = 94208 bytes | Modified Date = 20/09/2005 9:35:40 AM | Attr = ]
Microsoft Works Update Detection -> %CommonProgramFiles%\Microsoft Shared\Works Shared\WkUFind.exe -> Microsoft® Corporation [Ver = 7.00.0724.0 | Size = 28672 bytes | Modified Date = 24/07/2002 9:20:02 PM | Attr = ]
PWRISOVM.EXE -> %ProgramFiles%\PowerISO\PWRISOVM.EXE -> PowerISO Computing, Inc. [Ver = 3, 0, 0, 0 | Size = 184320 bytes | Modified Date = 17/03/2006 7:24:18 PM | Attr = ]
RegistryMechanic -> -> File not found
SunJavaUpdateSched -> %ProgramFiles%\Java\jre1.6.0_01\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 83608 bytes | Modified Date = 14/03/2007 3:43:44 AM | Attr = ]
< OptionalComponents [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\
IMAIL -> Installed = 1 -> 
MAPI -> Installed = 1 -> 
MSFS -> Installed = 1 -> 
< Run [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SUPERAntiSpyware -> %ProgramFiles%\SUPERAntiSpyware\SUPERAntiSpyware.exe -> SUPERAntiSpyware.com [Ver = 3, 7, 0, 1018 | Size = 1318128 bytes | Modified Date = 01/05/2007 9:29:58 AM | Attr = ]
< Common Startup > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup
%AllUsersStartup%\Adobe Reader Speed Launch.lnk -> %ProgramFiles%\Adobe\Reader 8.0\Reader\reader_sl.exe -> Adobe Systems Incorporated [Ver = 8.0.0.0 | Size = 40048 bytes | Modified Date = 23/10/2006 1:48:20 AM | Attr = ]
%AllUsersStartup%\Adobe Reader Synchronizer.lnk -> %ProgramFiles%\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe -> [Ver = 8.0.0.0 | Size = 734872 bytes | Modified Date = 23/10/2006 12:01:50 AM | Attr = ]
%AllUsersStartup%\WinZip Quick Pick.lnk -> %ProgramFiles%\WinZip\WZQKPICK.EXE -> WinZip Computing LP [Ver = 1.0 (32-bit) | Size = 389120 bytes | Modified Date = 21/11/2006 11:00:00 AM | Attr = ]
< AppInit_DLLs [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
< ShellExecuteHooks [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} [HKLM] -> %ProgramFiles%\SUPERAntiSpyware\SASSEH.DLL [] -> SuperAdBlocker.com [Ver = 1, 0, 0, 1008 | Size = 77824 bytes | Modified Date = 20/12/2006 1:55:48 PM | Attr = ]
< SecurityProviders [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders
< Winlogon settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
< Winlogon settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
< Winlogon\Notify settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
!SASWinLogon -> %ProgramFiles%\SUPERAntiSpyware\SASWINLO.dll -> SUPERAntiSpyware.com [Ver = 1, 0, 0, 1046 | Size = 294912 bytes | Modified Date = 19/04/2007 1:41:36 PM | Attr = ]
igfxcui -> %System32%\igfxdev.dll -> Intel Corporation [Ver = 3.0.0.4396 | Size = 135168 bytes | Modified Date = 20/09/2005 9:31:28 AM | Attr = ]
< HOSTS File > (736 bytes) -> C:\WINDOWS\System32\drivers\etc\Hosts
127.0.0.1 localhost -> -> 
< Internet Explorer Settings > -> 
HKLM: Main\\Default_Search_URL -> http://www.google.com -> 
HKLM: Search Bar -> http://start.shaw.ca/start/enca/addons/search/ -> 
HKLM: Search Page -> http://www.google.com -> 
HKLM: Start Page -> http://start.shaw.ca -> 
HKLM: CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> 
HKLM: SearchAssistant -> http://start.shaw.ca/start/enca/addons/search/ -> 
HKCU: Local Page -> C:\WINDOWS\system32\blank.htm -> 
HKCU: Search Bar -> http://start.shaw.ca/start/enca/addons/search/ -> 
HKCU: Search Page -> http://start.shaw.ca/start/enca/addons/search/ -> 
HKCU: Start Page -> http://start.shaw.ca -> 
HKCU: SearchAssistant -> http://start.shaw.ca/start/enca/addons/search/ -> 
HKCU: ProxyEnable -> 0 -> 
< Trusted Sites > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
msn.com [ - ] -> -> 
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> %CommonProgramFiles%\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [Adobe PDF Reader Link Helper] -> Adobe Systems Incorporated [Ver = 8.0.0.2006102200 | Size = 62080 bytes | Modified Date = 22/10/2006 11:08:42 PM | Attr = ]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> %ProgramFiles%\Java\jre1.6.0_01\bin\ssv.dll [SSVHelper Class] -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 501400 bytes | Modified Date = 14/03/2007 3:43:40 AM | Attr = ]
< Internet Explorer Bars [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
{32683183-48a0-441b-a342-7c2a440a9478} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
< Internet Explorer Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKLM] -> %ProgramFiles%\Java\jre1.6.0_01\bin\npjpi160_01.dll [MenuText: Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 132760 bytes | Modified Date = 14/03/2007 3:43:42 AM | Attr = ]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKCU] -> %ProgramFiles%\Java\jre1.6.0_01\bin\ssv.dll [MenuText: Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 501400 bytes | Modified Date = 14/03/2007 3:43:40 AM | Attr = ]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} -> Reg Data - Value does not exist [ButtonText: Research] -> File not found
< Internet Explorer Menu Extensions [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\
E&xport to Microsoft Excel -> -> File not found
< User Agent Post Platform [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
SV1 -> -> 
< DNS Name Servers [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\
{75856756-6FAA-4E30-A5FF-80DE2ADDCEBF} -> (Intel(R) PRO/100 VE Network Connection) -> 
{980E1E3E-7B8A-4EE5-9D15-4CA8B462DC8D} -> (Instant Wireless USB Network Adapter ver.2.6) -> 
< Winsock2 Catalogs [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\
Protocol_Catalog9\Catalog_Entries\000000000001 -> %System32%\avgfwafu.dll -> GRISOFT, s.r.o. [Ver = 7.5.0.407 | Size = 110592 bytes | Modified Date = 08/05/2007 7:50:46 PM | Attr = ]
Protocol_Catalog9\Catalog_Entries\000000000002 -> %System32%\avgfwafu.dll -> GRISOFT, s.r.o. [Ver = 7.5.0.407 | Size = 110592 bytes | Modified Date = 08/05/2007 7:50:46 PM | Attr = ]
Protocol_Catalog9\Catalog_Entries\000000000003 -> %System32%\avgfwafu.dll -> GRISOFT, s.r.o. [Ver = 7.5.0.407 | Size = 110592 bytes | Modified Date = 08/05/2007 7:50:46 PM | Attr = ]
Protocol_Catalog9\Catalog_Entries\000000000004 -> %System32%\avgfwafu.dll -> GRISOFT, s.r.o. [Ver = 7.5.0.407 | Size = 110592 bytes | Modified Date = 08/05/2007 7:50:46 PM | Attr = ]
Protocol_Catalog9\Catalog_Entries\000000000005 -> %System32%\avgfwafu.dll -> GRISOFT, s.r.o. [Ver = 7.5.0.407 | Size = 110592 bytes | Modified Date = 08/05/2007 7:50:46 PM | Attr = ]
< Protocol Handlers [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\
ipp -> Reg Data - Key not found -> File not found


----------



## monkeybubbles (Apr 26, 2007)

msdaipp -> Reg Data - Key not found -> File not found
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\
{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} -> CKAVWebScan Object - CodeBase = http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab -> 
{8AD9C840-044E-11D1-B3E9-00805F499D93} -> Java Plug-in 1.6.0_01 - CodeBase = http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab -> 
{9A9307A0-7DA4-4DAF-B042-5009F29E09E1} -> ActiveScan Installer Class - CodeBase = http://acs.pandasoftware.com/activescan/as5free/asinst.cab -> 
{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} -> Java Plug-in 1.6.0_01 - CodeBase = http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab -> 
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -> Java Plug-in 1.6.0_01 - CodeBase = http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab -> 
{D27CDB6E-AE6D-11CF-96B8-444553540000} -> Shockwave Flash Object - CodeBase = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab -> 
Microsoft XML Parser for Java -> - CodeBase = file://C:\WINDOWS\Java\classes\xmldso.cab ->

[Files/Folders - Created Within 30 days]
23990098.$$$ -> %SystemDrive%\23990098.$$$ -> [Ver = | Size = 0 bytes | Created Date = 29/04/2007 7:28:55 PM | Attr = ]
9fdb6525d69c224452fa4 -> %SystemDrive%\9fdb6525d69c224452fa4 -> [Folder | Created Date = 28/04/2007 11:22:35 PM | Attr = ]
AUTOEXEC.BAT -> %SystemDrive%\AUTOEXEC.BAT -> [Ver = | Size = 0 bytes | Created Date = 14/04/2007 3:11:29 PM | Attr = ]
BJPrinter -> %SystemDrive%\BJPrinter -> [Folder | Created Date = 16/04/2007 8:05:29 PM | Attr = H ]
boot.ini -> %SystemDrive%\boot.ini -> [Ver = | Size = 211 bytes | Created Date = 14/04/2007 7:58:44 AM | Attr = RHS]
CONFIG.SYS -> %SystemDrive%\CONFIG.SYS -> [Ver = | Size = 0 bytes | Created Date = 14/04/2007 3:11:29 PM | Attr = ]
DELL -> %SystemDrive%\DELL -> [Folder | Created Date = 14/04/2007 3:12:10 PM | Attr = ]
Documents and Settings -> %SystemDrive%\Documents and Settings -> [Folder | Created Date = 14/04/2007 8:00:00 AM | Attr = ]
driver -> %SystemDrive%\driver -> [Folder | Created Date = 14/04/2007 6:01:32 PM | Attr = ]
ERDNT -> %SystemDrive%\ERDNT -> [Folder | Created Date = 01/05/2007 2:52:41 PM | Attr = ]
IO.SYS -> %SystemDrive%\IO.SYS -> [Ver = | Size = 0 bytes | Created Date = 14/04/2007 3:11:29 PM | Attr = RHS]
MSDOS.SYS -> %SystemDrive%\MSDOS.SYS -> [Ver = | Size = 0 bytes | Created Date = 14/04/2007 3:11:29 PM | Attr = RHS]
MSOCache -> %SystemDrive%\MSOCache -> [Folder | Created Date = 14/04/2007 3:21:26 PM | Attr = RH ]
Program Files -> %ProgramFiles% -> [Folder | Created Date = 14/04/2007 8:01:00 AM | Attr = R ]
QooBox -> %SystemDrive%\QooBox -> [Folder | Created Date = 27/04/2007 11:06:57 AM | Attr = ]
RECYCLER -> %SystemDrive%\RECYCLER -> [Folder | Created Date = 14/04/2007 7:06:11 PM | Attr = HS]
SDFix -> %SystemDrive%\SDFix -> [Folder | Created Date = 27/04/2007 10:38:37 AM | Attr = ]
Sysclean -> %SystemDrive%\Sysclean -> [Folder | Created Date = 01/05/2007 8:18:47 PM | Attr = ]
System Volume Information -> %SystemDrive%\System Volume Information -> [Folder | Created Date = 01/01/1746 2:25:04 PM | Attr = HS]
temp -> %SystemDrive%\temp -> [Folder | Created Date = 07/05/2007 3:42:39 PM | Attr = ]
VundoFix Backups -> %SystemDrive%\VundoFix Backups -> [Folder | Created Date = 27/04/2007 11:57:08 AM | Attr = ]
WINDOWS -> %SystemRoot% -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
_OTMoveIt -> %SystemDrive%\_OTMoveIt -> [Folder | Created Date = 28/04/2007 2:10:06 PM | Attr = ]
$MSI31Uninstall_KB893803v2$ -> %SystemRoot%\$MSI31Uninstall_KB893803v2$ -> [Folder | Created Date = 16/04/2007 9:11:41 PM | Attr = H ]
$NtServicePackUninstall$ -> %SystemRoot%\$NtServicePackUninstall$ -> [Folder | Created Date = 28/04/2007 11:41:36 PM | Attr = H ]
$NtUninstallKB842773$ -> %SystemRoot%\$NtUninstallKB842773$ -> [Folder | Created Date = 22/04/2007 1:23:21 PM | Attr = H ]
$NtUninstallQ329115$ -> %SystemRoot%\$NtUninstallQ329115$ -> [Folder | Created Date = 29/04/2007 9:11:48 AM | Attr = H ]
$NtUninstallQ329390$ -> %SystemRoot%\$NtUninstallQ329390$ -> [Folder | Created Date = 29/04/2007 9:11:26 AM | Attr = H ]
$xpsp1hfm$ -> %SystemRoot%\$xpsp1hfm$ -> [Folder | Created Date = 28/04/2007 11:25:06 PM | Attr = H ]
001203_.tmp -> %SystemRoot%\001203_.tmp -> [Ver = | Size = 19274 bytes | Created Date = 28/04/2007 11:39:08 PM | Attr = ]
003503_.tmp -> %SystemRoot%\003503_.tmp -> [Ver = | Size = 19528 bytes | Created Date = 06/05/2007 4:53:19 PM | Attr = ]
addins -> %SystemRoot%\addins -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
AppPatch -> %SystemRoot%\AppPatch -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
assembly -> %SystemRoot%\assembly -> [Folder | Created Date = 14/04/2007 3:36:57 PM | Attr = R S]
bjam.dll -> %SystemRoot%\bjam.dll -> [Ver = | Size = 22528 bytes | Created Date = 26/04/2007 11:40:19 AM | Attr = ]
Blue Lace 16.bmp -> %SystemRoot%\Blue Lace 16.bmp -> [Ver = | Size = 1272 bytes | Created Date = 14/04/2007 3:06:59 PM | Attr = ]
bootstat.dat -> %SystemRoot%\bootstat.dat -> [Ver = | Size = 2048 bytes | Created Date = 14/04/2007 3:14:05 PM | Attr = S]
catchme.exe -> %SystemRoot%\catchme.exe -> [Ver = | Size = 86528 bytes | Created Date = 27/04/2007 11:08:23 AM | Attr = ]
cdsm32.dll -> %SystemRoot%\cdsm32.dll -> [Ver = | Size = 20480 bytes | Created Date = 26/04/2007 11:40:21 AM | Attr = ]
Coffee Bean.bmp -> %SystemRoot%\Coffee Bean.bmp -> [Ver = | Size = 17062 bytes | Created Date = 14/04/2007 3:06:59 PM | Attr = ]
Config -> %SystemRoot%\Config -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
Connection Wizard -> %SystemRoot%\Connection Wizard -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
control.ini -> %SystemRoot%\control.ini -> [Ver = | Size = 0 bytes | Created Date = 14/04/2007 3:11:29 PM | Attr = ]
Cursors -> %SystemRoot%\Cursors -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
Debug -> %SystemRoot%\Debug -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
desktop.ini -> %SystemRoot%\desktop.ini -> [Ver = | Size = 2 bytes | Created Date = 14/04/2007 3:09:07 PM | Attr = ]
didduid.ini -> %SystemRoot%\didduid.ini -> [Ver = | Size = 12800 bytes | Created Date = 26/04/2007 11:40:17 AM | Attr = ]
Downloaded Installations -> %SystemRoot%\Downloaded Installations -> [Folder | Created Date = 19/04/2007 8:41:49 PM | Attr = ]
Downloaded Program Files -> %SystemRoot%\Downloaded Program Files -> [Folder | Created Date = 14/04/2007 3:10:31 PM | Attr = S]
Driver Cache -> %SystemRoot%\Driver Cache -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
egjmoq.ini -> %SystemRoot%\egjmoq.ini -> [Ver = | Size = 1063295 bytes | Created Date = 29/04/2007 2:30:33 PM | Attr = HS]
ehome -> %SystemRoot%\ehome -> [Folder | Created Date = 29/04/2007 12:04:04 AM | Attr = ]
FeatherTexture.bmp -> %SystemRoot%\FeatherTexture.bmp -> [Ver = | Size = 16730 bytes | Created Date = 14/04/2007 3:06:59 PM | Attr = ]
Fonts -> %SystemRoot%\Fonts -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = R S]
gmer.dll -> %SystemRoot%\gmer.dll -> [Ver = 1, 0, 12, 12244 | Size = 573503 bytes | Created Date = 28/04/2007 2:26:36 PM | Attr = ]
gmer.exe -> %SystemRoot%\gmer.exe -> [Ver = 1, 0, 12, 12244 | Size = 577536 bytes | Created Date = 28/04/2007 2:26:35 PM | Attr = ]
gmer.ini -> %SystemRoot%\gmer.ini -> [Ver = | Size = 250 bytes | Created Date = 28/04/2007 2:26:40 PM | Attr = ]
gmer_uninstall.cmd -> %SystemRoot%\gmer_uninstall.cmd -> [Ver = | Size = 80 bytes | Created Date = 28/04/2007 2:26:36 PM | Attr = ]
Gone Fishing.bmp -> %SystemRoot%\Gone Fishing.bmp -> [Ver = | Size = 17336 bytes | Created Date = 14/04/2007 3:06:59 PM | Attr = ]
Greenstone.bmp -> %SystemRoot%\Greenstone.bmp -> [Ver = | Size = 26582 bytes | Created Date = 14/04/2007 3:06:59 PM | Attr = ]
Help -> %SystemRoot%\Help -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
I560 -> %SystemRoot%\I560 -> [Folder | Created Date = 16/04/2007 8:05:01 PM | Attr = ]
ime -> %SystemRoot%\ime -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
imon.cfg -> %SystemRoot%\imon.cfg -> [Ver = | Size = 118 bytes | Created Date = 26/04/2007 12:50:21 PM | Attr = ]
imsins.BAK -> %SystemRoot%\imsins.BAK -> [Ver = | Size = 1374 bytes | Created Date = 14/04/2007 8:01:08 AM | Attr = ]
inf -> %SystemRoot%\inf -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = H ]
Installer -> %SystemRoot%\Installer -> [Folder | Created Date = 14/04/2007 3:15:58 PM | Attr = HS]
IsUninst.exe -> %SystemRoot%\IsUninst.exe -> InstallShield Software Corporation [Ver = 5, 51, 138, 0 | Size = 306688 bytes | Created Date = 14/04/2007 3:40:37 PM | Attr = ]
jautoexp.dat -> %SystemRoot%\jautoexp.dat -> [Ver = | Size = 6550 bytes | Created Date = 14/04/2007 3:15:45 PM | Attr = ]
java -> %SystemRoot%\java -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
Lic.xxx -> %SystemRoot%\Lic.xxx -> [Ver = | Size = 26 bytes | Created Date = 29/04/2007 6:40:47 PM | Attr = ]
Media -> %SystemRoot%\Media -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
MEMORY.DMP -> %SystemRoot%\MEMORY.DMP -> [Ver = | Size = 534831104 bytes | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
Microsoft.NET -> %SystemRoot%\Microsoft.NET -> [Folder | Created Date = 14/04/2007 3:36:57 PM | Attr = ]
Minidump -> %SystemRoot%\Minidump -> [Folder | Created Date = 27/04/2007 10:03:05 AM | Attr = ]
mozver.dat -> %SystemRoot%\mozver.dat -> [Ver = | Size = 671 bytes | Created Date = 14/04/2007 7:58:11 PM | Attr = ]
msagent -> %SystemRoot%\msagent -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
msapps -> %SystemRoot%\msapps -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
mui -> %SystemRoot%\mui -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
nircmd.exe -> %SystemRoot%\nircmd.exe -> NirSoft [Ver = 1.85 | Size = 49152 bytes | Created Date = 27/04/2007 11:08:23 AM | Attr = ]
nsreg.dat -> %SystemRoot%\nsreg.dat -> [Ver = | Size = 0 bytes | Created Date = 14/04/2007 6:40:33 PM | Attr = ]
ODBC.INI -> %SystemRoot%\ODBC.INI -> [Ver = | Size = 376 bytes | Created Date = 14/04/2007 3:26:20 PM | Attr = ]
ODBCINST.INI -> %SystemRoot%\ODBCINST.INI -> [Ver = | Size = 4161 bytes | Created Date = 14/04/2007 8:01:05 AM | Attr = ]
Offline Web Pages -> %SystemRoot%\Offline Web Pages -> [Folder | Created Date = 14/04/2007 3:10:31 PM | Attr = R ]
OPTIONS -> %SystemRoot%\OPTIONS -> [Folder | Created Date = 14/04/2007 4:28:03 PM | Attr = ]
PCHEALTH -> %SystemRoot%\PCHEALTH -> [Folder | Created Date = 14/04/2007 3:08:51 PM | Attr = ]
peernet -> %SystemRoot%\peernet -> [Folder | Created Date = 06/05/2007 5:03:54 PM | Attr = ]
PIF -> %SystemRoot%\PIF -> [Folder | Created Date = 16/04/2007 10:15:42 PM | Attr = H ]
Prairie Wind.bmp -> %SystemRoot%\Prairie Wind.bmp -> [Ver = | Size = 65954 bytes | Created Date = 14/04/2007 3:07:00 PM | Attr = ]
Prefetch -> %SystemRoot%\Prefetch -> [Folder | Created Date = 06/05/2007 5:23:36 PM | Attr = ]
provisioning -> %SystemRoot%\provisioning -> [Folder | Created Date = 06/05/2007 5:03:52 PM | Attr = ]
pss -> %SystemRoot%\pss -> [Folder | Created Date = 14/04/2007 6:28:10 PM | Attr = ]
REGBK00.ZIP -> %SystemRoot%\REGBK00.ZIP -> [Ver = | Size = 4653828 bytes | Created Date = 29/04/2007 6:42:08 PM | Attr = ]
RegisteredPackages -> %SystemRoot%\RegisteredPackages -> [Folder | Created Date = 17/04/2007 4:34:08 PM | Attr = ]
Registration -> %SystemRoot%\Registration -> [Folder | Created Date = 14/04/2007 3:08:13 PM | Attr = ]
REGLOCS.OLD -> %SystemRoot%\REGLOCS.OLD -> [Ver = | Size = 8192 bytes | Created Date = 14/04/2007 3:15:04 PM | Attr = ]
repair -> %SystemRoot%\repair -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
Resources -> %SystemRoot%\Resources -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
Rhododendron.bmp -> %SystemRoot%\Rhododendron.bmp -> [Ver = | Size = 17362 bytes | Created Date = 14/04/2007 3:07:00 PM | Attr = ]
River Sumida.bmp -> %SystemRoot%\River Sumida.bmp -> [Ver = | Size = 26680 bytes | Created Date = 14/04/2007 3:07:00 PM | Attr = ]
Santa Fe Stucco.bmp -> %SystemRoot%\Santa Fe Stucco.bmp -> [Ver = | Size = 65832 bytes | Created Date = 14/04/2007 3:07:01 PM | Attr = ]
security -> %SystemRoot%\security -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
ServicePackFiles -> %SystemRoot%\ServicePackFiles -> [Folder | Created Date = 29/04/2007 12:04:04 AM | Attr = ]
SET1B.tmp -> %SystemRoot%\SET1B.tmp -> [Ver = | Size = 122896 bytes | Created Date = 14/04/2007 8:00:30 AM | Attr = R ]
SET2D.tmp -> %SystemRoot%\SET2D.tmp -> [Ver = | Size = 1085913 bytes | Created Date = 21/04/2007 8:10:52 PM | Attr = R ]
SET3.tmp -> %SystemRoot%\SET3.tmp -> [Ver = | Size = 1085913 bytes | Created Date = 14/04/2007 8:00:24 AM | Attr = R ]
SET39.tmp -> %SystemRoot%\SET39.tmp -> [Ver = | Size = 13608 bytes | Created Date = 21/04/2007 8:10:54 PM | Attr = R ]
SET4B.tmp -> %SystemRoot%\SET4B.tmp -> [Ver = | Size = 7046 bytes | Created Date = 21/04/2007 8:10:54 PM | Attr = R ]
SET5B.tmp -> %SystemRoot%\SET5B.tmp -> [Ver = | Size = 122896 bytes | Created Date = 21/04/2007 8:10:58 PM | Attr = R ]
SET7.tmp -> %SystemRoot%\SET7.tmp -> [Ver = | Size = 13608 bytes | Created Date = 14/04/2007 8:00:27 AM | Attr = R ]
SETD.tmp -> %SystemRoot%\SETD.tmp -> [Ver = | Size = 7046 bytes | Created Date = 14/04/2007 8:00:28 AM | Attr = R ]
setup.pss -> %SystemRoot%\setup.pss -> [Folder | Created Date = 21/04/2007 7:53:26 PM | Attr = ]
setupapi.old -> %SystemRoot%\setupapi.old -> [Ver = | Size = 429426 bytes | Created Date = 14/04/2007 8:00:13 AM | Attr = ]
setupupd -> %SystemRoot%\setupupd -> [Folder | Created Date = 21/04/2007 8:03:36 PM | Attr = ]
ShellNew -> %SystemRoot%\ShellNew -> [Folder | Created Date = 14/04/2007 3:24:58 PM | Attr = H ]
slrundll.exe -> %SystemRoot%\slrundll.exe -> Smart Link [Ver = 3.80.01MC15 | Size = 32866 bytes | Created Date = 06/05/2007 5:03:58 PM | Attr = ]
Soap Bubbles.bmp -> %SystemRoot%\Soap Bubbles.bmp -> [Ver = | Size = 65978 bytes | Created Date = 14/04/2007 3:06:59 PM | Attr = ]
SoftwareDistribution -> %SystemRoot%\SoftwareDistribution -> [Folder | Created Date = 21/04/2007 8:52:49 PM | Attr = ]
SQLHotfix -> %SystemRoot%\SQLHotfix -> [Folder | Created Date = 14/04/2007 3:41:40 PM | Attr = ]
srchasst -> %SystemRoot%\srchasst -> [Folder | Created Date = 14/04/2007 3:10:06 PM | Attr = ]
StartHtmico -> %SystemRoot%\StartHtmico -> [Folder | Created Date = 16/04/2007 8:05:01 PM | Attr = ]
Sun -> %SystemRoot%\Sun -> [Folder | Created Date = 14/04/2007 8:08:24 PM | Attr = ]
sys.bat -> %SystemRoot%\sys.bat -> [Ver = | Size = 44 bytes | Created Date = 27/04/2007 10:01:38 AM | Attr = ]
system -> %SystemRoot%\system -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
system32 -> %System32% -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
Tasks -> %SystemRoot%\Tasks -> [Folder | Created Date = 14/04/2007 3:08:40 PM | Attr = S]
temp -> %SystemRoot%\temp -> [Folder | Created Date = 27/04/2007 1:03:08 PM | Attr = ]
twain_32 -> %SystemRoot%\twain_32 -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
vb.ini -> %SystemRoot%\vb.ini -> [Ver = | Size = 36 bytes | Created Date = 14/04/2007 3:08:17 PM | Attr = ]
vbaddin.ini -> %SystemRoot%\vbaddin.ini -> [Ver = | Size = 37 bytes | Created Date = 14/04/2007 3:08:17 PM | Attr = ]
VirtualEar -> %SystemRoot%\VirtualEar -> [Folder | Created Date = 14/04/2007 6:16:41 PM | Attr = ]
Web -> %SystemRoot%\Web -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = R ]
WindowsShell.Manifest -> %SystemRoot%\WindowsShell.Manifest -> [Ver = | Size = 749 bytes | Created Date = 21/04/2007 8:18:00 PM | Attr = RH ]
winnt.bmp -> %SystemRoot%\winnt.bmp -> [Ver = | Size = 48680 bytes | Created Date = 14/04/2007 3:09:07 PM | Attr = HS]
winnt256.bmp -> %SystemRoot%\winnt256.bmp -> [Ver = | Size = 48680 bytes | Created Date = 14/04/2007 3:09:07 PM | Attr = HS]
WinSxS -> %SystemRoot%\WinSxS -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
WMSysPr9.prx -> %SystemRoot%\WMSysPr9.prx -> [Ver = | Size = 316640 bytes | Created Date = 17/04/2007 4:34:55 PM | Attr = ]
WMSysPrx.prx -> %SystemRoot%\WMSysPrx.prx -> [Ver = | Size = 299552 bytes | Created Date = 14/04/2007 3:11:25 PM | Attr = ]
Zapotec.bmp -> %SystemRoot%\Zapotec.bmp -> [Ver = | Size = 9522 bytes | Created Date = 14/04/2007 3:07:01 PM | Attr = ]
_isenv31.ini -> %SystemRoot%\_isenv31.ini -> [Ver = | Size = 1099 bytes | Created Date = 16/04/2007 8:17:46 PM | Attr = ]
desktop.ini -> %SystemRoot%\tasks\desktop.ini -> [Ver = | Size = 65 bytes | Created Date = 14/04/2007 3:08:41 PM | Attr = RH ]
SA.DAT -> %SystemRoot%\tasks\SA.DAT -> [Ver = | Size = 6 bytes | Created Date = 14/04/2007 3:11:18 PM | Attr = H ]
$winnt$.inf -> %System32%\$winnt$.inf -> [Ver = | Size = 14659 bytes | Created Date = 14/04/2007 7:58:42 AM | Attr = ]
1025 -> %System32%\1025 -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
1028 -> %System32%\1028 -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
1031 -> %System32%\1031 -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
1033 -> %System32%\1033 -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
1037 -> %System32%\1037 -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
1041 -> %System32%\1041 -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
1042 -> %System32%\1042 -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
1054 -> %System32%\1054 -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
2052 -> %System32%\2052 -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
3076 -> %System32%\3076 -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
3com_dmi -> %System32%\3com_dmi -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
aaarggp.bat -> %System32%\aaarggp.bat -> [Ver = | Size = 117 bytes | Created Date = 28/04/2007 11:34:38 PM | Attr = ]
ActiveScan -> %System32%\ActiveScan -> [Folder | Created Date = 21/04/2007 9:23:56 PM | Attr = ]
amcompat.tlb -> %System32%\amcompat.tlb -> [Ver = | Size = 16832 bytes | Created Date = 17/04/2007 4:36:56 PM | Attr = ]
ati2cqag.dll -> %System32%\ati2cqag.dll -> ATI Technologies Inc. [Ver = 6.14.10.0233 | Size = 229376 bytes | Created Date = 06/05/2007 5:04:11 PM | Attr = ]
ati2dvaa.dll -> %System32%\ati2dvaa.dll -> ATI Technologies Inc. [Ver = 6.13.10.5019 | Size = 377984 bytes | Created Date = 28/04/2007 11:40:00 PM | Attr = ]
ati2dvag.dll -> %System32%\ati2dvag.dll -> ATI Technologies Inc. [Ver = 6.14.10.6462 | Size = 201728 bytes | Created Date = 28/04/2007 11:40:00 PM | Attr = ]
ati3d1ag.dll -> %System32%\ati3d1ag.dll -> ATI Technologies Inc. [Ver = 6.14.10.4071 | Size = 870784 bytes | Created Date = 28/04/2007 11:40:00 PM | Attr = ]
ati3d2ag.dll -> %System32%\ati3d2ag.dll -> ATI Technologies Inc. [Ver = 6.14.10.4071 | Size = 1057760 bytes | Created Date = 28/04/2007 11:40:00 PM | Attr = ]
ati3duag.dll -> %System32%\ati3duag.dll -> ATI Technologies Inc. [Ver = 6.14.10.0231 | Size = 1888992 bytes | Created Date = 06/05/2007 5:04:10 PM | Attr = ]
ativdaxx.ax -> %System32%\ativdaxx.ax -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 9728 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
ativmvxx.ax -> %System32%\ativmvxx.ax -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 23040 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
ativtmxx.dll -> %System32%\ativtmxx.dll -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 32768 bytes | Created Date = 06/05/2007 5:04:10 PM | Attr = ]
ativvaxx.dll -> %System32%\ativvaxx.dll -> ATI Technologies Inc. [Ver = 6.14.01.0009 | Size = 516768 bytes | Created Date = 06/05/2007 5:04:10 PM | Attr = ]
Audio3d.dll -> %System32%\Audio3d.dll -> Sensaura Ltd [Ver = 4.12.01.2009 | Size = 65536 bytes | Created Date = 14/04/2007 6:16:41 PM | Attr = ]
AUTOEXEC.NT -> %System32%\AUTOEXEC.NT -> [Ver = | Size = 1688 bytes | Created Date = 14/04/2007 8:00:38 AM | Attr = ]
avgfwafu.dll -> %System32%\avgfwafu.dll -> GRISOFT, s.r.o. [Ver = 7.5.0.407 | Size = 110592 bytes | Created Date = 08/05/2007 6:50:45 PM | Attr = ]
Backup -> %System32%\Backup -> [Folder | Created Date = 14/04/2007 3:42:00 PM | Attr = ]
bits -> %System32%\bits -> [Folder | Created Date = 22/04/2007 1:23:29 PM | Attr = ]
bjlhfhv.bat -> %System32%\bjlhfhv.bat -> [Ver = | Size = 117 bytes | Created Date = 28/04/2007 2:02:11 PM | Attr = ]
bopomofo.uce -> %System32%\bopomofo.uce -> [Ver = | Size = 22984 bytes | Created Date = 14/04/2007 3:06:57 PM | Attr = ]
CatRoot -> %System32%\CatRoot -> [Folder | Created Date = 14/04/2007 8:00:19 AM | Attr = ]
CatRoot2 -> %System32%\CatRoot2 -> [Folder | Created Date = 14/04/2007 8:00:19 AM | Attr = ]
cdplayer.exe.manifest -> %System32%\cdplayer.exe.manifest -> [Ver = | Size = 749 bytes | Created Date = 14/04/2007 3:10:24 PM | Attr = RH ]
clcl5.exe -> %System32%\clcl5.exe -> [Ver = | Size = 204800 bytes | Created Date = 21/04/2007 2:38:10 PM | Attr = ]
CleanUp.exe -> %System32%\CleanUp.exe -> adi [Ver = 1, 0, 0, 2 | Size = 45056 bytes | Created Date = 14/04/2007 6:16:40 PM | Attr = ]
cmglue.vxd -> %System32%\cmglue.vxd -> [Ver = | Size = 6184 bytes | Created Date = 16/04/2007 8:06:55 PM | Attr = R ]
CNMCP58.exe -> %System32%\CNMCP58.exe -> CANON INC. [Ver = 1.71.2.0 | Size = 73728 bytes | Created Date = 16/04/2007 8:05:45 PM | Attr = R ]
CNMLM58.DLL -> %System32%\CNMLM58.DLL -> CANON INC. [Ver = 1.73.2.0 | Size = 107008 bytes | Created Date = 16/04/2007 8:06:05 PM | Attr = ]
CNMVS58.DLL -> %System32%\CNMVS58.DLL -> [Ver = | Size = 6656 bytes | Created Date = 16/04/2007 8:05:34 PM | Attr = ]
Com -> %System32%\Com -> [Folder | Created Date = 14/04/2007 3:06:45 PM | Attr = ]
compatui.dll -> %System32%\compatui.dll -> [Ver = 1, 0, 0, 1 | Size = 252928 bytes | Created Date = 28/04/2007 11:39:03 PM | Attr = ]
config -> %System32%\config -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
CONFIG.NT -> %System32%\CONFIG.NT -> [Ver = | Size = 2577 bytes | Created Date = 14/04/2007 3:11:29 PM | Attr = ]
CONFIG.TMP -> %System32%\CONFIG.TMP -> [Ver = | Size = 2577 bytes | Created Date = 14/04/2007 8:00:38 AM | Attr = ]
c_20127.nls -> %System32%\c_20127.nls -> [Ver = | Size = 66082 bytes | Created Date = 14/04/2007 8:00:43 AM | Attr = ]
C_28594.NLS -> %System32%\C_28594.NLS -> [Ver = | Size = 66082 bytes | Created Date = 14/04/2007 8:00:48 AM | Attr = ]
C_28595.NLS -> %System32%\C_28595.NLS -> [Ver = | Size = 66082 bytes | Created Date = 14/04/2007 8:00:52 AM | Attr = ]
C_28597.NLS -> %System32%\C_28597.NLS -> [Ver = | Size = 66082 bytes | Created Date = 14/04/2007 8:00:50 AM | Attr = ]
c_28599.nls -> %System32%\c_28599.nls -> [Ver = | Size = 66082 bytes | Created Date = 14/04/2007 8:00:57 AM | Attr = ]
c_28603.nls -> %System32%\c_28603.nls -> [Ver = | Size = 66082 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
dcache.bin -> %System32%\dcache.bin -> [Ver = | Size = 1788 bytes | Created Date = 28/04/2007 11:39:04 PM | Attr = ]


----------



## monkeybubbles (Apr 26, 2007)

defrag.exe -> %System32%\defrag.exe -> Microsoft Corp. and Executive Software International, Inc. [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 25088 bytes | Created Date = 28/04/2007 11:39:05 PM | Attr = ]
desktop.ini -> %System32%\desktop.ini -> [Ver = | Size = 2 bytes | Created Date = 14/04/2007 3:09:07 PM | Attr = ]
dfrgfat.exe -> %System32%\dfrgfat.exe -> Microsoft Corp. and Executive Software International, Inc. [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 82432 bytes | Created Date = 28/04/2007 11:39:05 PM | Attr = ]
dfrgntfs.exe -> %System32%\dfrgntfs.exe -> Microsoft Corp. and Executive Software International, Inc. [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 104960 bytes | Created Date = 28/04/2007 11:39:05 PM | Attr = ]
dfrgsnap.dll -> %System32%\dfrgsnap.dll -> Microsoft Corp. and Executive Software International, Inc. [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 38912 bytes | Created Date = 28/04/2007 11:39:05 PM | Attr = ]
dfrgui.dll -> %System32%\dfrgui.dll -> Microsoft Corp. and Executive Software International, Inc. [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 123904 bytes | Created Date = 28/04/2007 11:39:05 PM | Attr = ]
dgnet.dll -> %System32%\dgnet.dll -> Microsoft [Ver = 1, 0, 0, 1 | Size = 111104 bytes | Created Date = 28/04/2007 11:39:05 PM | Attr = ]
dgrpsetu.dll -> %System32%\dgrpsetu.dll -> Digi International, Inc. [Ver = 2.3.7 | Size = 176157 bytes | Created Date = 14/04/2007 8:00:42 AM | Attr = ]
dhcp -> %System32%\dhcp -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
DirectX -> %System32%\DirectX -> [Folder | Created Date = 14/04/2007 3:09:58 PM | Attr = ]
dllcache -> %System32%\dllcache -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = RHS]
drivers -> %System32%\drivers -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
DRVSTORE -> %System32%\DRVSTORE -> [Folder | Created Date = 16/04/2007 7:12:59 PM | Attr = ]
DSndUp.exe -> %System32%\DSndUp.exe -> Analog Devices Inc. [Ver = 1, 0, 0, 13 | Size = 49152 bytes | Created Date = 14/04/2007 6:16:40 PM | Attr = ]
dxmasf.dll -> %System32%\dxmasf.dll -> [Ver = | Size = 498205 bytes | Created Date = 28/04/2007 11:39:07 PM | Attr = ]
e100b325.din -> %System32%\e100b325.din -> [Ver = | Size = 5110 bytes | Created Date = 14/04/2007 6:21:25 PM | Attr = ]
e100bmsg.dll -> %System32%\e100bmsg.dll -> [Ver = | Size = 12288 bytes | Created Date = 14/04/2007 6:21:25 PM | Attr = ]
Edcrypt.dll -> %System32%\Edcrypt.dll -> Analog Devices Incorporated [Ver = 1.0.0.8 | Size = 311296 bytes | Created Date = 14/04/2007 6:03:52 PM | Attr = ]
emptyregdb.dat -> %System32%\emptyregdb.dat -> [Ver = | Size = 23316 bytes | Created Date = 14/04/2007 3:08:28 PM | Attr = ]
encdec.dll -> %System32%\encdec.dll -> [Ver = | Size = 186368 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
eofrwchw.bat -> %System32%\eofrwchw.bat -> [Ver = | Size = 130 bytes | Created Date = 26/04/2007 2:49:53 PM | Attr = ]
EqnClass.Dll -> %System32%\EqnClass.Dll -> Equinox Systems Inc. [Ver = 5.0u(58) | Size = 103424 bytes | Created Date = 14/04/2007 8:00:42 AM | Attr = ]
esaxqqvn.bat -> %System32%\esaxqqvn.bat -> [Ver = | Size = 121 bytes | Created Date = 21/04/2007 9:39:27 PM | Attr = ]
export -> %System32%\export -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
fjnsbn.bat -> %System32%\fjnsbn.bat -> [Ver = | Size = 125 bytes | Created Date = 28/04/2007 5:09:03 PM | Attr = ]
FNTCACHE.DAT -> %System32%\FNTCACHE.DAT -> [Ver = | Size = 243128 bytes | Created Date = 14/04/2007 8:00:00 AM | Attr = ]
fuamfu32.ini -> %System32%\fuamfu32.ini -> [Ver = | Size = 4 bytes | Created Date = 26/04/2007 11:40:05 AM | Attr = ]
g.bat -> %System32%\g.bat -> [Ver = | Size = 24 bytes | Created Date = 28/04/2007 2:31:09 PM | Attr = ]
g.ftp -> %System32%\g.ftp -> [Ver = | Size = 53 bytes | Created Date = 28/04/2007 2:31:09 PM | Attr = ]
gb2312.uce -> %System32%\gb2312.uce -> [Ver = | Size = 24006 bytes | Created Date = 14/04/2007 3:06:57 PM | Attr = ]
gtv_sd.bin -> %System32%\gtv_sd.bin -> [Ver = | Size = 12 bytes | Created Date = 26/04/2007 11:40:06 AM | Attr = ]
Help.ico -> %System32%\Help.ico -> [Ver = | Size = 1406 bytes | Created Date = 21/04/2007 9:24:01 PM | Attr = ]
hhactivex.dll -> %System32%\hhactivex.dll -> Blue Sky Software Corporation. [Ver = 8.00.125 | Size = 446464 bytes | Created Date = 14/04/2007 4:24:54 PM | Attr = R ]
homepage.inf -> %System32%\homepage.inf -> [Ver = | Size = 929 bytes | Created Date = 28/04/2007 11:39:11 PM | Attr = ]
hpgt35.dll -> %System32%\hpgt35.dll -> Hewlett-Packard [Ver = 1.0.2.148 | Size = 450560 bytes | Created Date = 14/04/2007 4:19:21 PM | Attr = R ]
hpgwiamd.dll -> %System32%\hpgwiamd.dll -> Hewlett-Packard [Ver = 3.2.1.148 | Size = 262144 bytes | Created Date = 14/04/2007 4:19:21 PM | Attr = R ]
hpsjvset.dll -> %System32%\hpsjvset.dll -> Hewlett-Packard [Ver = 2.8.4.142 | Size = 131072 bytes | Created Date = 14/04/2007 4:19:21 PM | Attr = R ]
hsfcisp2.dll -> %System32%\hsfcisp2.dll -> Conexant Systems, Inc. [Ver = 7.12.09 | Size = 32285 bytes | Created Date = 06/05/2007 5:04:08 PM | Attr = ]
hticons.dll -> %System32%\hticons.dll -> Hilgraeve, Inc. [Ver = 5.1.2600.0 | Size = 44544 bytes | Created Date = 14/04/2007 3:07:10 PM | Attr = ]
hypertrm.dll -> %System32%\hypertrm.dll -> Hilgraeve, Inc. [Ver = 5.1.2600.2180 | Size = 345088 bytes | Created Date = 14/04/2007 3:07:10 PM | Attr = ]
iAlmCoIn_v4020.dll -> %System32%\iAlmCoIn_v4020.dll -> Intel Corporation [Ver = 1.00.1000.1 | Size = 61440 bytes | Created Date = 14/04/2007 6:04:05 PM | Attr = ]
ialmgdev.dll -> %System32%\ialmgdev.dll -> Intel Corporation [Ver = 6.14.10.4020 | Size = 516096 bytes | Created Date = 14/04/2007 6:04:05 PM | Attr = ]
ialmgicd.dll -> %System32%\ialmgicd.dll -> Intel Corporation [Ver = 6.14.10.4020 | Size = 2289664 bytes | Created Date = 14/04/2007 6:04:05 PM | Attr = ]
ias -> %System32%\ias -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
icsxml -> %System32%\icsxml -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
ideograf.uce -> %System32%\ideograf.uce -> [Ver = | Size = 60458 bytes | Created Date = 14/04/2007 3:06:57 PM | Attr = ]
ieencode.dll -> %System32%\ieencode.dll -> [Ver = | Size = 81920 bytes | Created Date = 06/05/2007 5:04:07 PM | Attr = ]
ieuinit.inf -> %System32%\ieuinit.inf -> [Ver = | Size = 23024 bytes | Created Date = 28/04/2007 11:39:13 PM | Attr = ]
igfxhchs.lhp -> %System32%\igfxhchs.lhp -> [Ver = | Size = 58430 bytes | Created Date = 14/04/2007 6:04:06 PM | Attr = ]
igfxhcht.lhp -> %System32%\igfxhcht.lhp -> [Ver = | Size = 59354 bytes | Created Date = 14/04/2007 6:04:06 PM | Attr = ]
igfxhdeu.lhp -> %System32%\igfxhdeu.lhp -> [Ver = | Size = 62339 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxhenu.lhp -> %System32%\igfxhenu.lhp -> [Ver = | Size = 57801 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxhesp.lhp -> %System32%\igfxhesp.lhp -> [Ver = | Size = 60786 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxhfra.lhp -> %System32%\igfxhfra.lhp -> [Ver = | Size = 62454 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxhita.lhp -> %System32%\igfxhita.lhp -> [Ver = | Size = 59687 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxhjpn.lhp -> %System32%\igfxhjpn.lhp -> [Ver = | Size = 62578 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxhkor.lhp -> %System32%\igfxhkor.lhp -> [Ver = | Size = 66013 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxhptb.lhp -> %System32%\igfxhptb.lhp -> [Ver = | Size = 61839 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxhtha.lhp -> %System32%\igfxhtha.lhp -> [Ver = | Size = 62836 bytes | Created Date = 14/04/2007 6:04:07 PM | Attr = ]
igfxres.dll -> %System32%\igfxres.dll -> Intel Corporation [Ver = 3.0.0.4396 | Size = 135168 bytes | Created Date = 29/04/2007 9:09:50 AM | Attr = ]
IME -> %System32%\IME -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
inet.hlp -> %System32%\inet.hlp -> [Ver = | Size = 4665 bytes | Created Date = 26/04/2007 11:40:06 AM | Attr = ]
inetsrv -> %System32%\inetsrv -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
instcat.sql -> %System32%\instcat.sql -> [Ver = | Size = 956990 bytes | Created Date = 28/04/2007 11:39:14 PM | Attr = ]
IntelNic.dll -> %System32%\IntelNic.dll -> Intel Corporation [Ver = 2.05.1 | Size = 24064 bytes | Created Date = 14/04/2007 6:21:25 PM | Attr = ]
isrdbg32.dll -> %System32%\isrdbg32.dll -> Intel Corporation [Ver = 0.0 | Size = 32768 bytes | Created Date = 14/04/2007 3:08:56 PM | Attr = ]
java.exe -> %System32%\java.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 135168 bytes | Created Date = 14/04/2007 8:08:04 PM | Attr = ]
javacpl.cpl -> %System32%\javacpl.cpl -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 69632 bytes | Created Date = 14/04/2007 8:08:04 PM | Attr = ]
javasup.vxd -> %System32%\javasup.vxd -> [Ver = | Size = 7315 bytes | Created Date = 14/04/2007 3:15:45 PM | Attr = ]
javaw.exe -> %System32%\javaw.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 135168 bytes | Created Date = 14/04/2007 8:08:04 PM | Attr = ]
javaws.exe -> %System32%\javaws.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 139264 bytes | Created Date = 14/04/2007 8:08:04 PM | Attr = ]
kanji_1.uce -> %System32%\kanji_1.uce -> [Ver = | Size = 6948 bytes | Created Date = 14/04/2007 3:06:57 PM | Attr = ]
kanji_2.uce -> %System32%\kanji_2.uce -> [Ver = | Size = 8484 bytes | Created Date = 14/04/2007 3:06:57 PM | Attr = ]
Kaspersky Lab -> %System32%\Kaspersky Lab -> [Folder | Created Date = 27/04/2007 1:23:11 PM | Attr = ]
keyboard.sys -> %System32%\keyboard.sys -> [Ver = | Size = 42537 bytes | Created Date = 28/04/2007 11:39:16 PM | Attr = ]
korean.uce -> %System32%\korean.uce -> [Ver = | Size = 12876 bytes | Created Date = 14/04/2007 3:06:58 PM | Attr = ]
l3codeca.acm -> %System32%\l3codeca.acm -> Fraunhofer Institut Integrierte Schaltungen IIS [Ver = 1, 9, 0, 0305 | Size = 290816 bytes | Created Date = 28/04/2007 11:39:17 PM | Attr = ]
l3codecp.acm -> %System32%\l3codecp.acm -> Fraunhofer Institut Integrierte Schaltungen IIS [Ver = 3, 3, 2, 44 | Size = 360448 bytes | Created Date = 17/04/2007 4:36:17 PM | Attr = ]
lclcfg32.ini -> %System32%\lclcfg32.ini -> [Ver = | Size = 0 bytes | Created Date = 26/04/2007 11:43:58 AM | Attr = ]
lfd32.ini -> %System32%\lfd32.ini -> [Ver = | Size = 83 bytes | Created Date = 26/04/2007 11:40:06 AM | Attr = ]
logonui.exe.manifest -> %System32%\logonui.exe.manifest -> [Ver = | Size = 488 bytes | Created Date = 21/04/2007 8:18:06 PM | Attr = RH ]
Macromed -> %System32%\Macromed -> [Folder | Created Date = 14/04/2007 3:09:57 PM | Attr = ]
mapisvc.inf -> %System32%\mapisvc.inf -> [Ver = | Size = 466 bytes | Created Date = 14/04/2007 3:40:50 PM | Attr = ]
mdmxsdk.dll -> %System32%\mdmxsdk.dll -> Conexant [Ver = 1.0.2.006 | Size = 86016 bytes | Created Date = 06/05/2007 5:04:05 PM | Attr = ]
Microsoft -> %System32%\Microsoft -> [Folder | Created Date = 15/04/2007 12:09:02 PM | Attr = S]
mn.dll -> %System32%\mn.dll -> [Ver = 1, 0, 0, 2 | Size = 16721 bytes | Created Date = 27/04/2007 10:01:39 AM | Attr = ]
moveex.exe -> %System32%\moveex.exe -> [Ver = | Size = 38400 bytes | Created Date = 27/04/2007 11:08:23 AM | Attr = ]
mpeg2data.ax -> %System32%\mpeg2data.ax -> [Ver = | Size = 118272 bytes | Created Date = 06/05/2007 5:04:05 PM | Attr = ]
mpg2splt.ax -> %System32%\mpg2splt.ax -> [Ver = | Size = 148992 bytes | Created Date = 28/04/2007 11:39:29 PM | Attr = ]
mprhou.dns -> %System32%\mprhou.dns -> [Ver = | Size = 163 bytes | Created Date = 28/04/2007 2:33:31 PM | Attr = H ]
MsDtc -> %System32%\MsDtc -> [Folder | Created Date = 14/04/2007 3:06:48 PM | Attr = ]
msdtcprf.h -> %System32%\msdtcprf.h -> [Ver = | Size = 768 bytes | Created Date = 14/04/2007 3:06:47 PM | Attr = ]
msdtcprf.ini -> %System32%\msdtcprf.ini -> [Ver = | Size = 1931 bytes | Created Date = 14/04/2007 3:06:47 PM | Attr = ]
msdxm.ocx -> %System32%\msdxm.ocx -> [Ver = | Size = 844314 bytes | Created Date = 28/04/2007 11:39:33 PM | Attr = ]
msdxmlc.dll -> %System32%\msdxmlc.dll -> [Ver = | Size = 4126 bytes | Created Date = 28/04/2007 11:39:33 PM | Attr = ]
MSIXU.DLL -> %System32%\MSIXU.DLL -> [Ver = | Size = 22016 bytes | Created Date = 26/04/2007 11:40:18 AM | Attr = ]
mtxparhd.dll -> %System32%\mtxparhd.dll -> Matrox Graphics Inc. [Ver = 6.13.01.1296 | Size = 1737856 bytes | Created Date = 06/05/2007 5:04:04 PM | Attr = ]
mui -> %System32%\mui -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
ncpa.cpl.manifest -> %System32%\ncpa.cpl.manifest -> [Ver = | Size = 749 bytes | Created Date = 21/04/2007 8:18:00 PM | Attr = RH ]
npp -> %System32%\npp -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
nscompat.tlb -> %System32%\nscompat.tlb -> [Ver = | Size = 23392 bytes | Created Date = 17/04/2007 4:36:56 PM | Attr = ]
ntio.sys -> %System32%\ntio.sys -> [Ver = | Size = 33840 bytes | Created Date = 28/04/2007 11:40:08 PM | Attr = ]
nv4_disp.dll -> %System32%\nv4_disp.dll -> NVIDIA Corporation [Ver = 6.14.10.5673 | Size = 4274816 bytes | Created Date = 28/04/2007 11:40:10 PM | Attr = ]
nwc.cpl.manifest -> %System32%\nwc.cpl.manifest -> [Ver = | Size = 749 bytes | Created Date = 14/04/2007 3:10:24 PM | Attr = RH ]
odbcconf.rsp -> %System32%\odbcconf.rsp -> [Ver = | Size = 4310 bytes | Created Date = 28/04/2007 11:40:11 PM | Attr = ]
oobe -> %System32%\oobe -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
pavas.ico -> %System32%\pavas.ico -> [Ver = | Size = 30590 bytes | Created Date = 21/04/2007 9:24:00 PM | Attr = ]
PerfStringBackup.INI -> %System32%\PerfStringBackup.INI -> [Ver = | Size = 469794 bytes | Created Date = 14/04/2007 8:01:05 AM | Attr = ]
PostProc.dll -> %System32%\PostProc.dll -> Windows (R) 2000 DDK provider [Ver = 5.2.0.7 | Size = 23040 bytes | Created Date = 14/04/2007 6:03:52 PM | Attr = ]
proctexe.ocx -> %System32%\proctexe.ocx -> Intel Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 81920 bytes | Created Date = 28/04/2007 11:40:15 PM | Attr = ]
Prounstl.exe -> %System32%\Prounstl.exe -> Intel Corporation [Ver = 7.0.6 | Size = 118784 bytes | Created Date = 14/04/2007 6:21:25 PM | Attr = ]
qcap.dll -> %System32%\qcap.dll -> [Ver = | Size = 192512 bytes | Created Date = 28/04/2007 11:40:15 PM | Attr = ]
qdvd.dll -> %System32%\qdvd.dll -> [Ver = | Size = 385024 bytes | Created Date = 28/04/2007 11:40:15 PM | Attr = ]
qedit.dll -> %System32%\qedit.dll -> [Ver = | Size = 562176 bytes | Created Date = 28/04/2007 11:40:15 PM | Attr = ]
quartz.dll -> %System32%\quartz.dll -> [Ver = | Size = 1287680 bytes | Created Date = 28/04/2007 11:40:16 PM | Attr = ]
ras -> %System32%\ras -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
RcdScan.dll -> %System32%\RcdScan.dll -> Dell Computer Corporation [Ver = 1.20.00.00 | Size = 176128 bytes | Created Date = 14/04/2007 4:24:54 PM | Attr = ]
redir.exe -> %System32%\redir.exe -> [Ver = | Size = 3338 bytes | Created Date = 28/04/2007 11:40:18 PM | Attr = ]
ReinstallBackups -> %System32%\ReinstallBackups -> [Folder | Created Date = 28/04/2007 11:25:20 PM | Attr = ]
Restore -> %System32%\Restore -> [Folder | Created Date = 14/04/2007 3:08:58 PM | Attr = ]
s3gnb.dll -> %System32%\s3gnb.dll -> S3 Graphics, Inc. [Ver = 6.14.10.0012-13.94.12 | Size = 397056 bytes | Created Date = 06/05/2007 5:04:01 PM | Attr = ]
sapi.cpl.manifest -> %System32%\sapi.cpl.manifest -> [Ver = | Size = 749 bytes | Created Date = 21/04/2007 8:18:00 PM | Attr = RH ]
sbe.dll -> %System32%\sbe.dll -> [Ver = | Size = 270848 bytes | Created Date = 28/04/2007 11:40:02 PM | Attr = ]
Setup -> %System32%\Setup -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
SetupBD.din -> %System32%\SetupBD.din -> [Ver = | Size = 1902 bytes | Created Date = 14/04/2007 6:03:53 PM | Attr = ]
ShellExt -> %System32%\ShellExt -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
shiftjis.uce -> %System32%\shiftjis.uce -> [Ver = | Size = 16740 bytes | Created Date = 14/04/2007 3:06:58 PM | Attr = ]
sl.bin -> %System32%\sl.bin -> [Ver = | Size = 12 bytes | Created Date = 26/04/2007 11:43:35 AM | Attr = ]
slcoinst.dll -> %System32%\slcoinst.dll -> Smart Link [Ver = 3.80.01MC15 | Size = 73832 bytes | Created Date = 06/05/2007 5:04:01 PM | Attr = ]
slextspk.dll -> %System32%\slextspk.dll -> Smart Link [Ver = 3.80.01MC15 | Size = 286792 bytes | Created Date = 06/05/2007 5:04:01 PM | Attr = ]
slgen.dll -> %System32%\slgen.dll -> Smart Link [Ver = 3.80.01MC15 | Size = 188508 bytes | Created Date = 06/05/2007 5:04:01 PM | Attr = ]
slrundll.exe -> %System32%\slrundll.exe -> Smart Link [Ver = 3.80.01MC15 | Size = 32866 bytes | Created Date = 06/05/2007 5:04:01 PM | Attr = ]
slserv.exe -> %System32%\slserv.exe -> Smart Link [Ver = 3.80.01MC15 | Size = 73796 bytes | Created Date = 06/05/2007 5:04:01 PM | Attr = ]
sl_anet.acm -> %System32%\sl_anet.acm -> Sipro Lab Telecom Inc. [Ver = 3.02 | Size = 86016 bytes | Created Date = 28/04/2007 11:40:24 PM | Attr = ]
SoftwareDistribution -> %System32%\SoftwareDistribution -> [Folder | Created Date = 21/04/2007 8:57:24 PM | Attr = ]
spool -> %System32%\spool -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
spupdsvc.inf -> %System32%\spupdsvc.inf -> [Ver = | Size = 2694 bytes | Created Date = 06/05/2007 5:12:34 PM | Attr = ]
spxcoins.dll -> %System32%\spxcoins.dll -> Perle Systems Ltd. [Ver = 1.0.0.0007 | Size = 24661 bytes | Created Date = 21/04/2007 8:11:10 PM | Attr = ]
ssa3d30.ocx -> %System32%\ssa3d30.ocx -> Sheridan Software Systems, Inc. [Ver = 3.00.0034 | Size = 328480 bytes | Created Date = 14/04/2007 4:24:54 PM | Attr = ]
stfv.bin -> %System32%\stfv.bin -> [Ver = | Size = 4 bytes | Created Date = 26/04/2007 11:44:00 AM | Attr = ]
subrange.uce -> %System32%\subrange.uce -> [Ver = | Size = 93702 bytes | Created Date = 14/04/2007 3:06:58 PM | Attr = ]
swreg.exe -> %System32%\swreg.exe -> SteelWerX [Ver = 2.0.1.6 | Size = 428032 bytes | Created Date = 27/04/2007 11:08:23 AM | Attr = ]
swsc.exe -> %System32%\swsc.exe -> SteelWerX [Ver = 2.0.0.0 | Size = 370688 bytes | Created Date = 27/04/2007 11:08:23 AM | Attr = ]
swxcacls.exe -> %System32%\swxcacls.exe -> SteelWerX [Ver = 1.0.1.1 | Size = 212480 bytes | Created Date = 27/04/2007 11:08:23 AM | Attr = ]
tslabels.h -> %System32%\tslabels.h -> [Ver = | Size = 3286 bytes | Created Date = 14/04/2007 3:06:51 PM | Attr = ]
tslabels.ini -> %System32%\tslabels.ini -> [Ver = | Size = 13223 bytes | Created Date = 14/04/2007 3:06:51 PM | Attr = ]
Uninstall.ico -> %System32%\Uninstall.ico -> [Ver = | Size = 2550 bytes | Created Date = 21/04/2007 9:24:01 PM | Attr = ]
UpdDrv2K.exe -> %System32%\UpdDrv2K.exe -> 3Com Corporation [Ver = 1.0.0.0 | Size = 41852 bytes | Created Date = 14/04/2007 4:27:57 PM | Attr = ]
URTTemp -> %System32%\URTTemp -> [Folder | Created Date = 14/04/2007 3:36:57 PM | Attr = ]
usmt -> %System32%\usmt -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]


----------



## monkeybubbles (Apr 26, 2007)

usrlogon.cmd -> %System32%\usrlogon.cmd -> [Ver = | Size = 1161 bytes | Created Date = 14/04/2007 3:06:51 PM | Attr = ]
vfind.exe -> %System32%\vfind.exe -> [Ver = | Size = 49152 bytes | Created Date = 27/04/2007 11:08:23 AM | Attr = ]
virtear.dll -> %System32%\virtear.dll -> Sensaura [Ver = 1, 0, 0, 6 | Size = 991232 bytes | Created Date = 14/04/2007 6:16:41 PM | Attr = ]
wbem -> %System32%\wbem -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
webfldrs.msi -> %System32%\webfldrs.msi -> [Ver = | Size = 1326080 bytes | Created Date = 28/04/2007 11:40:55 PM | Attr = ]
WER8274.DLL -> %System32%\WER8274.DLL -> [Ver = | Size = 24320 bytes | Created Date = 26/04/2007 11:40:18 AM | Attr = ]
WindowsLogon.manifest -> %System32%\WindowsLogon.manifest -> [Ver = | Size = 488 bytes | Created Date = 14/04/2007 3:10:30 PM | Attr = RH ]
wins -> %System32%\wins -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
wmimgmt.msc -> %System32%\wmimgmt.msc -> [Ver = | Size = 63488 bytes | Created Date = 14/04/2007 3:06:34 PM | Attr = ]
wml.exe -> %System32%\wml.exe -> [Ver = | Size = 18944 bytes | Created Date = 26/04/2007 11:40:24 AM | Attr = ]
wmpscheme.xml -> %System32%\wmpscheme.xml -> [Ver = | Size = 25065 bytes | Created Date = 14/04/2007 3:11:27 PM | Attr = ]
wpa.bak -> %System32%\wpa.bak -> [Ver = | Size = 2422 bytes | Created Date = 07/05/2007 4:23:53 PM | Attr = ]
wtxqvmat.ini -> %System32%\wtxqvmat.ini -> [Ver = | Size = 1543 bytes | Created Date = 26/04/2007 11:39:50 AM | Attr = HS]
wuaucpl.cpl.manifest -> %System32%\wuaucpl.cpl.manifest -> [Ver = | Size = 749 bytes | Created Date = 21/04/2007 8:18:00 PM | Attr = RH ]
xircom -> %System32%\xircom -> [Folder | Created Date = 14/04/2007 3:12:14 PM | Attr = ]
zonedoff.reg -> %System32%\zonedoff.reg -> [Ver = | Size = 113 bytes | Created Date = 14/04/2007 3:15:41 PM | Attr = ]
zonedon.reg -> %System32%\zonedon.reg -> [Ver = | Size = 113 bytes | Created Date = 14/04/2007 3:15:41 PM | Attr = ]
cap7146.sys -> %System32%\dllcache\cap7146.sys -> Philips Semiconductors GmbH [Ver = 1.00 (XPClient.010817-1148) | Size = 54528 bytes | Created Date = 21/04/2007 8:22:09 PM | Attr = ]
dgrpsetu.dll -> %System32%\dllcache\dgrpsetu.dll -> Digi International, Inc. [Ver = 2.3.7 | Size = 176157 bytes | Created Date = 14/04/2007 8:00:42 AM | Attr = ]
eqnclass.dll -> %System32%\dllcache\eqnclass.dll -> Equinox Systems Inc. [Ver = 5.0u(58) | Size = 103424 bytes | Created Date = 14/04/2007 8:00:42 AM | Attr = ]
esucmd.dll -> %System32%\dllcache\esucmd.dll -> SEIKO EPSON CORP. [Ver = 1.00 | Size = 31744 bytes | Created Date = 21/04/2007 8:22:30 PM | Attr = ]
esuimgd.dll -> %System32%\dllcache\esuimgd.dll -> SEIKO EPSON CORP. [Ver = 1.00 | Size = 57856 bytes | Created Date = 21/04/2007 8:22:30 PM | Attr = ]
esunid.dll -> %System32%\dllcache\esunid.dll -> SEIKO EPSON CORP. [Ver = 1.00 | Size = 45056 bytes | Created Date = 21/04/2007 8:22:30 PM | Attr = ]
hanja.lex -> %System32%\dllcache\hanja.lex -> [Ver = | Size = 108827 bytes | Created Date = 21/04/2007 8:22:37 PM | Attr = ]
HPCRDP.CAT -> %System32%\dllcache\HPCRDP.CAT -> [Ver = | Size = 13472 bytes | Created Date = 21/04/2007 8:10:57 PM | Attr = ]
htrn_jis.dll -> %System32%\dllcache\htrn_jis.dll -> Hilgraeve, Inc. [Ver = 5.1.2600.0 | Size = 13312 bytes | Created Date = 14/04/2007 3:07:09 PM | Attr = ]
hwxjpn.dll -> %System32%\dllcache\hwxjpn.dll -> [Ver = | Size = 13463552 bytes | Created Date = 21/04/2007 8:22:42 PM | Attr = ]
IASNT4.CAT -> %System32%\dllcache\IASNT4.CAT -> [Ver = | Size = 8574 bytes | Created Date = 21/04/2007 8:10:57 PM | Attr = ]
imekr.lex -> %System32%\dllcache\imekr.lex -> [Ver = | Size = 134339 bytes | Created Date = 21/04/2007 8:22:52 PM | Attr = ]
korwbrkr.lex -> %System32%\dllcache\korwbrkr.lex -> [Ver = | Size = 1158818 bytes | Created Date = 21/04/2007 8:23:05 PM | Attr = ]
ltts1033.lxa -> %System32%\dllcache\ltts1033.lxa -> [Ver = | Size = 643717 bytes | Created Date = 14/04/2007 8:01:01 AM | Attr = ]
MAPIMIG.CAT -> %System32%\dllcache\MAPIMIG.CAT -> [Ver = | Size = 399645 bytes | Created Date = 21/04/2007 8:10:57 PM | Attr = ]
MW770.CAT -> %System32%\dllcache\MW770.CAT -> [Ver = | Size = 37484 bytes | Created Date = 21/04/2007 8:10:57 PM | Attr = ]
nls302en.lex -> %System32%\dllcache\nls302en.lex -> [Ver = | Size = 4399505 bytes | Created Date = 14/04/2007 3:10:07 PM | Attr = ]
NT5IIS.CAT -> %System32%\dllcache\NT5IIS.CAT -> [Ver = | Size = 797189 bytes | Created Date = 21/04/2007 8:10:57 PM | Attr = ]
OEMBIOS.CAT -> %System32%\dllcache\OEMBIOS.CAT -> [Ver = | Size = 7046 bytes | Created Date = 21/04/2007 8:10:57 PM | Attr = ]
r1033tts.lxa -> %System32%\dllcache\r1033tts.lxa -> [Ver = | Size = 605050 bytes | Created Date = 14/04/2007 8:01:02 AM | Attr = ]
rw330ext.dll -> %System32%\dllcache\rw330ext.dll -> Ricoh Co., Ltd. [Ver = 5, 0, 2419, 1 | Size = 26624 bytes | Created Date = 21/04/2007 8:23:44 PM | Attr = ]
rwia001.dll -> %System32%\dllcache\rwia001.dll -> Ricoh Co., Ltd. [Ver = 5, 0, 2419, 1 | Size = 79872 bytes | Created Date = 21/04/2007 8:23:44 PM | Attr = ]
rwia330.dll -> %System32%\dllcache\rwia330.dll -> Ricoh Co., Ltd. [Ver = 5, 0, 2419, 1 | Size = 79872 bytes | Created Date = 21/04/2007 8:23:44 PM | Attr = ]
sam.sdf -> %System32%\dllcache\sam.sdf -> [Ver = | Size = 888 bytes | Created Date = 14/04/2007 8:01:03 AM | Attr = ]
sam.spd -> %System32%\dllcache\sam.spd -> [Ver = | Size = 1685606 bytes | Created Date = 14/04/2007 8:01:03 AM | Attr = ]
spxcoins.dll -> %System32%\dllcache\spxcoins.dll -> Perle Systems Ltd. [Ver = 1.0.0.0007 | Size = 24661 bytes | Created Date = 21/04/2007 8:11:10 PM | Attr = ]
srframe.mmf -> %System32%\dllcache\srframe.mmf -> [Ver = | Size = 984 bytes | Created Date = 14/04/2007 3:08:59 PM | Attr = ]
adv01nt5.dll -> %System32%\drivers\adv01nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 4255 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
adv02nt5.dll -> %System32%\drivers\adv02nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 3967 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
adv05nt5.dll -> %System32%\drivers\adv05nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 3615 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
adv07nt5.dll -> %System32%\drivers\adv07nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 3647 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
adv08nt5.dll -> %System32%\drivers\adv08nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 3135 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
adv09nt5.dll -> %System32%\drivers\adv09nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 3711 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
adv11nt5.dll -> %System32%\drivers\adv11nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 3775 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
AFS2K.SYS -> %System32%\drivers\AFS2K.SYS -> Oak Technology Inc. [Ver = 3.1.21.1103 | Size = 35840 bytes | Created Date = 14/04/2007 4:19:55 PM | Attr = ]
amdagp.sys -> %System32%\drivers\amdagp.sys -> Advanced Micro Devices, Inc. [Ver = 5.00 (xpsp_sp2_rtm.040803-2158) | Size = 43008 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
ati1btxx.sys -> %System32%\drivers\ati1btxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 56623 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
ati1mdxx.sys -> %System32%\drivers\ati1mdxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 11615 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
ati1pdxx.sys -> %System32%\drivers\ati1pdxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 12047 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
ati1raxx.sys -> %System32%\drivers\ati1raxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 30671 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
ati1rvxx.sys -> %System32%\drivers\ati1rvxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 63663 bytes | Created Date = 06/05/2007 5:04:19 PM | Attr = ]
ati1snxx.sys -> %System32%\drivers\ati1snxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 26367 bytes | Created Date = 06/05/2007 5:04:18 PM | Attr = ]
ati1ttxx.sys -> %System32%\drivers\ati1ttxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 21343 bytes | Created Date = 06/05/2007 5:04:18 PM | Attr = ]
ati1tuxx.sys -> %System32%\drivers\ati1tuxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 36463 bytes | Created Date = 06/05/2007 5:04:18 PM | Attr = ]
ati1xbxx.sys -> %System32%\drivers\ati1xbxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 29455 bytes | Created Date = 06/05/2007 5:04:18 PM | Attr = ]
ati1xsxx.sys -> %System32%\drivers\ati1xsxx.sys -> ATI Technologies Inc. [Ver = 6.13.10.6131 | Size = 34735 bytes | Created Date = 06/05/2007 5:04:18 PM | Attr = ]
ati2mtaa.sys -> %System32%\drivers\ati2mtaa.sys -> ATI Technologies Inc. [Ver = 6.13.10.5019 | Size = 327040 bytes | Created Date = 28/04/2007 11:40:00 PM | Attr = ]
ati2mtag.sys -> %System32%\drivers\ati2mtag.sys -> ATI Technologies Inc. [Ver = 6.14.10.6462 | Size = 701440 bytes | Created Date = 28/04/2007 11:40:00 PM | Attr = ]
atinbtxx.sys -> %System32%\drivers\atinbtxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 57856 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atinmdxx.sys -> %System32%\drivers\atinmdxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 13824 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atinpdxx.sys -> %System32%\drivers\atinpdxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 14336 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atinraxx.sys -> %System32%\drivers\atinraxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 52224 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atinrvxx.sys -> %System32%\drivers\atinrvxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 104960 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atinsnxx.sys -> %System32%\drivers\atinsnxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 28672 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atinttxx.sys -> %System32%\drivers\atinttxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 13824 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atintuxx.sys -> %System32%\drivers\atintuxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 73216 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atinxbxx.sys -> %System32%\drivers\atinxbxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 31744 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
atinxsxx.sys -> %System32%\drivers\atinxsxx.sys -> ATI Technologies Inc. [Ver = 6.14.10.6238 | Size = 63488 bytes | Created Date = 28/04/2007 11:40:01 PM | Attr = ]
ativmc20.cod -> %System32%\drivers\ativmc20.cod -> [Ver = | Size = 64352 bytes | Created Date = 06/05/2007 5:04:17 PM | Attr = ]
atv01nt5.dll -> %System32%\drivers\atv01nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 21183 bytes | Created Date = 06/05/2007 5:04:17 PM | Attr = ]
atv02nt5.dll -> %System32%\drivers\atv02nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 11359 bytes | Created Date = 06/05/2007 5:04:17 PM | Attr = ]
atv04nt5.dll -> %System32%\drivers\atv04nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 25471 bytes | Created Date = 06/05/2007 5:04:17 PM | Attr = ]
atv06nt5.dll -> %System32%\drivers\atv06nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 14143 bytes | Created Date = 06/05/2007 5:04:17 PM | Attr = ]
atv10nt5.dll -> %System32%\drivers\atv10nt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 17279 bytes | Created Date = 06/05/2007 5:04:17 PM | Attr = ]
avg7core.sys -> %System32%\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 816672 bytes | Created Date = 08/05/2007 6:50:41 PM | Attr = ]
avg7rsw.sys -> %System32%\drivers\avg7rsw.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,340 | Size = 4224 bytes | Created Date = 23/04/2007 3:54:41 PM | Attr = ]
avg7rsxp.sys -> %System32%\drivers\avg7rsxp.sys -> GRISOFT, s.r.o. [Ver = 7,1,0,398 | Size = 28416 bytes | Created Date = 23/04/2007 3:54:41 PM | Attr = ]
avgclean.sys -> %System32%\drivers\avgclean.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Created Date = 08/05/2007 6:50:45 PM | Attr = ]
avgmfx86.sys -> %System32%\drivers\avgmfx86.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.416 | Size = 18240 bytes | Created Date = 08/05/2007 6:50:41 PM | Attr = ]
avgtdi.sys -> %System32%\drivers\avgtdi.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,346 | Size = 4960 bytes | Created Date = 08/05/2007 6:50:42 PM | Attr = ]
ch7xxnt5.dll -> %System32%\drivers\ch7xxnt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 15423 bytes | Created Date = 06/05/2007 5:04:16 PM | Attr = ]
COH_Mon.cat -> %System32%\drivers\COH_Mon.cat -> [Ver = | Size = 10592 bytes | Created Date = 16/04/2007 10:10:00 PM | Attr = R ]
COH_Mon.inf -> %System32%\drivers\COH_Mon.inf -> [Ver = | Size = 679 bytes | Created Date = 16/04/2007 10:10:00 PM | Attr = R ]
COH_Mon.sys -> %System32%\drivers\COH_Mon.sys -> Symantec Corporation [Ver = 6,1,1,4 | Size = 22112 bytes | Created Date = 16/04/2007 10:10:00 PM | Attr = R ]
cxthsfs2.cty -> %System32%\drivers\cxthsfs2.cty -> [Ver = | Size = 129045 bytes | Created Date = 06/05/2007 5:04:16 PM | Attr = ]
disdn -> %System32%\drivers\disdn -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
e100b325.sys -> %System32%\drivers\e100b325.sys -> Intel Corporation [Ver = 7.1.12.0 built by: WinDDK | Size = 154112 bytes | Created Date = 14/04/2007 6:21:25 PM | Attr = ]
etc -> %System32%\drivers\etc -> [Folder | Created Date = 14/04/2007 7:54:56 AM | Attr = ]
gmer.sys -> %System32%\drivers\gmer.sys -> GMER [Ver = 1, 0, 12, 3868 | Size = 69905 bytes | Created Date = 28/04/2007 2:26:36 PM | Attr = ]
hsfbs2s2.sys -> %System32%\drivers\hsfbs2s2.sys -> Conexant Systems, Inc. [Ver = 7.12.09 | Size = 220032 bytes | Created Date = 06/05/2007 5:04:16 PM | Attr = ]
hsfcxts2.sys -> %System32%\drivers\hsfcxts2.sys -> Conexant Systems, Inc. [Ver = 7.12.09 built by: WinDDK | Size = 685056 bytes | Created Date = 06/05/2007 5:04:15 PM | Attr = ]
hsfdpsp2.sys -> %System32%\drivers\hsfdpsp2.sys -> Conexant Systems, Inc. [Ver = 7.12.09 | Size = 1041536 bytes | Created Date = 06/05/2007 5:04:15 PM | Attr = ]
mdmxsdk.sys -> %System32%\drivers\mdmxsdk.sys -> Conexant [Ver = 1.0.2.006 | Size = 11868 bytes | Created Date = 06/05/2007 5:04:15 PM | Attr = ]
mtlmnt5.sys -> %System32%\drivers\mtlmnt5.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 126686 bytes | Created Date = 06/05/2007 5:04:15 PM | Attr = ]
mtlstrm.sys -> %System32%\drivers\mtlstrm.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 1309184 bytes | Created Date = 06/05/2007 5:04:14 PM | Attr = ]
mtxparhm.sys -> %System32%\drivers\mtxparhm.sys -> Matrox Graphics Inc. [Ver = 6.13.01.1296 | Size = 452736 bytes | Created Date = 06/05/2007 5:04:14 PM | Attr = ]
netusbxp.sys -> %System32%\drivers\netusbxp.sys -> The LinkSys Group, Inc. [Ver = 1.02.02.0066 built by: WinDDK | Size = 72576 bytes | Created Date = 07/05/2007 3:29:24 PM | Attr = R ]
netwlan5.img -> %System32%\drivers\netwlan5.img -> [Ver = | Size = 67866 bytes | Created Date = 28/04/2007 11:40:00 PM | Attr = ]
ntmtlfax.sys -> %System32%\drivers\ntmtlfax.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 180360 bytes | Created Date = 06/05/2007 5:04:14 PM | Attr = ]
nv4_mini.sys -> %System32%\drivers\nv4_mini.sys -> NVIDIA Corporation [Ver = 6.14.10.5673 | Size = 1897408 bytes | Created Date = 28/04/2007 11:40:10 PM | Attr = ]
omci.sys -> %System32%\drivers\omci.sys -> Dell Computer Corporation [Ver = 6, 1, 0, 242 | Size = 13632 bytes | Created Date = 14/04/2007 4:24:52 PM | Attr = ]
recagent.sys -> %System32%\drivers\recagent.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 13776 bytes | Created Date = 06/05/2007 5:04:13 PM | Attr = ]
s3gnbm.sys -> %System32%\drivers\s3gnbm.sys -> S3 Graphics, Inc. [Ver = 6.14.10.0012-13.94.12 | Size = 166912 bytes | Created Date = 06/05/2007 5:04:13 PM | Attr = ]
senfilt.sys -> %System32%\drivers\senfilt.sys -> Creative Technology Ltd. [Ver = 5.10.00.3614 | Size = 732928 bytes | Created Date = 14/04/2007 6:03:52 PM | Attr = ]
siint5.dll -> %System32%\drivers\siint5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 3901 bytes | Created Date = 06/05/2007 5:04:13 PM | Attr = ]
sisagp.sys -> %System32%\drivers\sisagp.sys -> Silicon Integrated Systems Corporation [Ver = 5.12.01.2010 (xpsp_sp2_rtm.040803-2158) | Size = 41088 bytes | Created Date = 06/05/2007 5:04:13 PM | Attr = ]
slnt7554.sys -> %System32%\drivers\slnt7554.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 129535 bytes | Created Date = 06/05/2007 5:04:13 PM | Attr = ]
slntamr.sys -> %System32%\drivers\slntamr.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 404990 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
slnthal.sys -> %System32%\drivers\slnthal.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 95424 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
slwdmsup.sys -> %System32%\drivers\slwdmsup.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 13240 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
smwdm.sys -> %System32%\drivers\smwdm.sys -> Analog Devices, Inc. [Ver = 5.12.01.5246 | Size = 260352 bytes | Created Date = 14/04/2007 6:03:52 PM | Attr = ]
SYMEVENT.CAT -> %System32%\drivers\SYMEVENT.CAT -> [Ver = | Size = 8014 bytes | Created Date = 16/04/2007 9:42:01 PM | Attr = ]
SYMEVENT.INF -> %System32%\drivers\SYMEVENT.INF -> [Ver = | Size = 806 bytes | Created Date = 16/04/2007 9:42:01 PM | Attr = ]
vchnt5.dll -> %System32%\drivers\vchnt5.dll -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 11325 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
wadv07nt.sys -> %System32%\drivers\wadv07nt.sys -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 11807 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
wadv08nt.sys -> %System32%\drivers\wadv08nt.sys -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 11295 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
wadv09nt.sys -> %System32%\drivers\wadv09nt.sys -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 11871 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
wadv11nt.sys -> %System32%\drivers\wadv11nt.sys -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 11935 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
watv06nt.sys -> %System32%\drivers\watv06nt.sys -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 22271 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
watv10nt.sys -> %System32%\drivers\watv10nt.sys -> Intel(R) Corporation [Ver = 6.13.01.3198 | Size = 25471 bytes | Created Date = 06/05/2007 5:04:12 PM | Attr = ]
hosts.msn -> %System32%\drivers\etc\hosts.msn -> [Ver = | Size = 734 bytes | Created Date = 23/04/2007 4:03:44 PM | Attr = ]


----------



## monkeybubbles (Apr 26, 2007)

[Files/Folders - Modified Within 30 days]
23990098.$$$ -> %SystemDrive%\23990098.$$$ -> [Ver = | Size = 0 bytes | Modified Date = 29/04/2007 10:35:46 PM | Attr = ]
9fdb6525d69c224452fa4 -> %SystemDrive%\9fdb6525d69c224452fa4 -> [Folder | Modified Date = 29/04/2007 7:50:46 PM | Attr = ]
AUTOEXEC.BAT -> %SystemDrive%\AUTOEXEC.BAT -> [Ver = | Size = 0 bytes | Modified Date = 14/04/2007 4:11:30 PM | Attr = ]
BJPrinter -> %SystemDrive%\BJPrinter -> [Folder | Modified Date = 16/04/2007 9:05:30 PM | Attr = H ]
boot.ini -> %SystemDrive%\boot.ini -> [Ver = | Size = 211 bytes | Modified Date = 06/05/2007 6:08:50 PM | Attr = RHS]
CONFIG.SYS -> %SystemDrive%\CONFIG.SYS -> [Ver = | Size = 0 bytes | Modified Date = 14/04/2007 4:11:30 PM | Attr = ]
DELL -> %SystemDrive%\DELL -> [Folder | Modified Date = 29/04/2007 7:51:24 PM | Attr = ]
Documents and Settings -> %SystemDrive%\Documents and Settings -> [Folder | Modified Date = 08/05/2007 7:50:26 PM | Attr = ]
driver -> %SystemDrive%\driver -> [Folder | Modified Date = 14/04/2007 7:01:40 PM | Attr = ]
ERDNT -> %SystemDrive%\ERDNT -> [Folder | Modified Date = 01/05/2007 3:53:10 PM | Attr = ]
IO.SYS -> %SystemDrive%\IO.SYS -> [Ver = | Size = 0 bytes | Modified Date = 14/04/2007 4:11:30 PM | Attr = RHS]
MSDOS.SYS -> %SystemDrive%\MSDOS.SYS -> [Ver = | Size = 0 bytes | Modified Date = 14/04/2007 4:11:30 PM | Attr = RHS]
MSOCache -> %SystemDrive%\MSOCache -> [Folder | Modified Date = 14/04/2007 4:21:28 PM | Attr = RH ]
NTDETECT.COM -> %SystemDrive%\NTDETECT.COM -> [Ver = | Size = 47564 bytes | Modified Date = 06/05/2007 5:54:24 PM | Attr = RHS]
Program Files -> %ProgramFiles% -> [Folder | Modified Date = 08/05/2007 7:50:36 PM | Attr = R ]
QooBox -> %SystemDrive%\QooBox -> [Folder | Modified Date = 27/04/2007 12:06:58 PM | Attr = ]
RECYCLER -> %SystemDrive%\RECYCLER -> [Folder | Modified Date = 14/04/2007 8:06:12 PM | Attr = HS]
SDFix -> %SystemDrive%\SDFix -> [Folder | Modified Date = 29/04/2007 8:08:04 PM | Attr = ]
Sysclean -> %SystemDrive%\Sysclean -> [Folder | Modified Date = 01/05/2007 9:58:12 PM | Attr = ]
System Volume Information -> %SystemDrive%\System Volume Information -> [Folder | Modified Date = 06/05/2007 6:23:14 PM | Attr = HS]
temp -> %SystemDrive%\temp -> [Folder | Modified Date = 07/05/2007 5:14:04 PM | Attr = ]
VundoFix Backups -> %SystemDrive%\VundoFix Backups -> [Folder | Modified Date = 01/05/2007 4:23:42 PM | Attr = ]
WINDOWS -> %SystemRoot% -> [Folder | Modified Date = 10/05/2007 7:36:34 PM | Attr = ]
_OTMoveIt -> %SystemDrive%\_OTMoveIt -> [Folder | Modified Date = 28/04/2007 3:10:08 PM | Attr = ]
$MSI31Uninstall_KB893803v2$ -> %SystemRoot%\$MSI31Uninstall_KB893803v2$ -> [Folder | Modified Date = 16/04/2007 10:11:54 PM | Attr = H ]
$NtServicePackUninstall$ -> %SystemRoot%\$NtServicePackUninstall$ -> [Folder | Modified Date = 06/05/2007 5:52:32 PM | Attr = H ]
$NtUninstallKB842773$ -> %SystemRoot%\$NtUninstallKB842773$ -> [Folder | Modified Date = 22/04/2007 2:23:24 PM | Attr = H ]
$NtUninstallQ329115$ -> %SystemRoot%\$NtUninstallQ329115$ -> [Folder | Modified Date = 29/04/2007 10:11:50 AM | Attr = H ]
$NtUninstallQ329390$ -> %SystemRoot%\$NtUninstallQ329390$ -> [Folder | Modified Date = 29/04/2007 10:11:30 AM | Attr = H ]
$xpsp1hfm$ -> %SystemRoot%\$xpsp1hfm$ -> [Folder | Modified Date = 29/04/2007 12:25:08 AM | Attr = H ]
addins -> %SystemRoot%\addins -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
AppPatch -> %SystemRoot%\AppPatch -> [Folder | Modified Date = 06/05/2007 6:23:08 PM | Attr = ]
assembly -> %SystemRoot%\assembly -> [Folder | Modified Date = 14/04/2007 4:37:38 PM | Attr = R S]
bjam.dll -> %SystemRoot%\bjam.dll -> [Ver = | Size = 22528 bytes | Modified Date = 26/04/2007 12:40:20 PM | Attr = ]
bootstat.dat -> %SystemRoot%\bootstat.dat -> [Ver = | Size = 2048 bytes | Modified Date = 10/05/2007 7:37:46 PM | Attr = S]
catchme.exe -> %SystemRoot%\catchme.exe -> [Ver = | Size = 86528 bytes | Modified Date = 21/04/2007 3:52:22 AM | Attr = ]
cdsm32.dll -> %SystemRoot%\cdsm32.dll -> [Ver = | Size = 20480 bytes | Modified Date = 26/04/2007 12:40:22 PM | Attr = ]
Config -> %SystemRoot%\Config -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
Connection Wizard -> %SystemRoot%\Connection Wizard -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
control.ini -> %SystemRoot%\control.ini -> [Ver = | Size = 0 bytes | Modified Date = 14/04/2007 4:11:30 PM | Attr = ]
Cursors -> %SystemRoot%\Cursors -> [Folder | Modified Date = 14/04/2007 4:07:20 PM | Attr = ]
Debug -> %SystemRoot%\Debug -> [Folder | Modified Date = 06/05/2007 6:23:46 PM | Attr = ]
didduid.ini -> %SystemRoot%\didduid.ini -> [Ver = | Size = 12800 bytes | Modified Date = 26/04/2007 12:40:18 PM | Attr = ]
Downloaded Installations -> %SystemRoot%\Downloaded Installations -> [Folder | Modified Date = 19/04/2007 9:41:50 PM | Attr = ]
Downloaded Program Files -> %SystemRoot%\Downloaded Program Files -> [Folder | Modified Date = 27/04/2007 2:23:14 PM | Attr = S]
Driver Cache -> %SystemRoot%\Driver Cache -> [Folder | Modified Date = 21/04/2007 2:05:30 PM | Attr = ]
egjmoq.ini -> %SystemRoot%\egjmoq.ini -> [Ver = | Size = 1063295 bytes | Modified Date = 29/04/2007 7:07:02 PM | Attr = HS]
ehome -> %SystemRoot%\ehome -> [Folder | Modified Date = 06/05/2007 5:54:22 PM | Attr = ]
Fonts -> %SystemRoot%\Fonts -> [Folder | Modified Date = 06/05/2007 6:23:08 PM | Attr = R S]
gmer.dll -> %SystemRoot%\gmer.dll -> [Ver = 1, 0, 12, 12244 | Size = 573503 bytes | Modified Date = 28/04/2007 3:26:38 PM | Attr = ]
gmer.exe -> %SystemRoot%\gmer.exe -> [Ver = 1, 0, 12, 12244 | Size = 577536 bytes | Modified Date = 12/04/2007 5:04:36 PM | Attr = ]
gmer.ini -> %SystemRoot%\gmer.ini -> [Ver = | Size = 250 bytes | Modified Date = 29/04/2007 6:08:24 PM | Attr = ]
gmer_uninstall.cmd -> %SystemRoot%\gmer_uninstall.cmd -> [Ver = | Size = 80 bytes | Modified Date = 28/04/2007 3:26:38 PM | Attr = ]
Help -> %SystemRoot%\Help -> [Folder | Modified Date = 06/05/2007 6:04:32 PM | Attr = ]
I560 -> %SystemRoot%\I560 -> [Folder | Modified Date = 16/04/2007 9:05:12 PM | Attr = ]
ime -> %SystemRoot%\ime -> [Folder | Modified Date = 06/05/2007 6:04:28 PM | Attr = ]
imon.cfg -> %SystemRoot%\imon.cfg -> [Ver = | Size = 118 bytes | Modified Date = 26/04/2007 1:50:22 PM | Attr = ]
imsins.BAK -> %SystemRoot%\imsins.BAK -> [Ver = | Size = 1374 bytes | Modified Date = 29/04/2007 10:12:10 AM | Attr = ]
inf -> %SystemRoot%\inf -> [Folder | Modified Date = 08/05/2007 8:17:14 PM | Attr = H ]
Installer -> %SystemRoot%\Installer -> [Folder | Modified Date = 08/05/2007 7:47:48 PM | Attr = HS]
java -> %SystemRoot%\java -> [Folder | Modified Date = 14/04/2007 4:15:46 PM | Attr = ]
Lic.xxx -> %SystemRoot%\Lic.xxx -> [Ver = | Size = 26 bytes | Modified Date = 29/04/2007 9:07:44 PM | Attr = ]
Media -> %SystemRoot%\Media -> [Folder | Modified Date = 06/05/2007 6:03:54 PM | Attr = ]
MEMORY.DMP -> %SystemRoot%\MEMORY.DMP -> [Ver = | Size = 534831104 bytes | Modified Date = 28/04/2007 3:05:06 PM | Attr = ]
Microsoft.NET -> %SystemRoot%\Microsoft.NET -> [Folder | Modified Date = 14/04/2007 4:36:58 PM | Attr = ]
Minidump -> %SystemRoot%\Minidump -> [Folder | Modified Date = 27/04/2007 11:03:06 AM | Attr = ]
mozver.dat -> %SystemRoot%\mozver.dat -> [Ver = | Size = 671 bytes | Modified Date = 14/04/2007 9:08:16 PM | Attr = ]
msagent -> %SystemRoot%\msagent -> [Folder | Modified Date = 06/05/2007 5:58:22 PM | Attr = ]
msapps -> %SystemRoot%\msapps -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
mui -> %SystemRoot%\mui -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
nsreg.dat -> %SystemRoot%\nsreg.dat -> [Ver = | Size = 0 bytes | Modified Date = 14/04/2007 7:40:34 PM | Attr = ]
ODBC.INI -> %SystemRoot%\ODBC.INI -> [Ver = | Size = 376 bytes | Modified Date = 14/04/2007 4:31:36 PM | Attr = ]
ODBCINST.INI -> %SystemRoot%\ODBCINST.INI -> [Ver = | Size = 4161 bytes | Modified Date = 21/04/2007 9:19:18 PM | Attr = ]
Offline Web Pages -> %SystemRoot%\Offline Web Pages -> [Folder | Modified Date = 14/04/2007 4:10:32 PM | Attr = R ]
OPTIONS -> %SystemRoot%\OPTIONS -> [Folder | Modified Date = 14/04/2007 5:28:04 PM | Attr = ]
PCHEALTH -> %SystemRoot%\PCHEALTH -> [Folder | Modified Date = 14/04/2007 4:22:40 PM | Attr = ]
peernet -> %SystemRoot%\peernet -> [Folder | Modified Date = 06/05/2007 6:03:56 PM | Attr = ]
PIF -> %SystemRoot%\PIF -> [Folder | Modified Date = 16/04/2007 11:15:44 PM | Attr = H ]
Prefetch -> %SystemRoot%\Prefetch -> [Folder | Modified Date = 08/05/2007 9:56:02 PM | Attr = ]
provisioning -> %SystemRoot%\provisioning -> [Folder | Modified Date = 06/05/2007 6:03:54 PM | Attr = ]
pss -> %SystemRoot%\pss -> [Folder | Modified Date = 14/04/2007 7:29:26 PM | Attr = ]
REGBK00.ZIP -> %SystemRoot%\REGBK00.ZIP -> [Ver = | Size = 4653828 bytes | Modified Date = 29/04/2007 7:42:46 PM | Attr = ]
RegisteredPackages -> %SystemRoot%\RegisteredPackages -> [Folder | Modified Date = 17/04/2007 5:38:46 PM | Attr = ]
Registration -> %SystemRoot%\Registration -> [Folder | Modified Date = 21/04/2007 9:30:52 PM | Attr = ]
REGLOCS.OLD -> %SystemRoot%\REGLOCS.OLD -> [Ver = | Size = 8192 bytes | Modified Date = 14/04/2007 4:15:06 PM | Attr = ]
repair -> %SystemRoot%\repair -> [Folder | Modified Date = 14/04/2007 4:12:14 PM | Attr = ]
Resources -> %SystemRoot%\Resources -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
security -> %SystemRoot%\security -> [Folder | Modified Date = 06/05/2007 6:27:42 PM | Attr = ]
ServicePackFiles -> %SystemRoot%\ServicePackFiles -> [Folder | Modified Date = 29/04/2007 1:04:06 AM | Attr = ]
setup.pss -> %SystemRoot%\setup.pss -> [Folder | Modified Date = 21/04/2007 8:53:28 PM | Attr = ]
setupapi.old -> %SystemRoot%\setupapi.old -> [Ver = | Size = 429426 bytes | Modified Date = 21/04/2007 8:52:58 PM | Attr = ]
setupupd -> %SystemRoot%\setupupd -> [Folder | Modified Date = 21/04/2007 9:03:58 PM | Attr = ]
ShellNew -> %SystemRoot%\ShellNew -> [Folder | Modified Date = 14/04/2007 4:25:30 PM | Attr = H ]
SoftwareDistribution -> %SystemRoot%\SoftwareDistribution -> [Folder | Modified Date = 22/04/2007 12:33:44 PM | Attr = ]
SQLHotfix -> %SystemRoot%\SQLHotfix -> [Folder | Modified Date = 14/04/2007 4:45:26 PM | Attr = ]
srchasst -> %SystemRoot%\srchasst -> [Folder | Modified Date = 06/05/2007 5:58:18 PM | Attr = ]
StartHtmico -> %SystemRoot%\StartHtmico -> [Folder | Modified Date = 16/04/2007 9:05:02 PM | Attr = ]
Sun -> %SystemRoot%\Sun -> [Folder | Modified Date = 14/04/2007 9:08:26 PM | Attr = ]
sys.bat -> %SystemRoot%\sys.bat -> [Ver = | Size = 44 bytes | Modified Date = 27/04/2007 11:01:40 AM | Attr = ]
system -> %SystemRoot%\system -> [Folder | Modified Date = 08/05/2007 7:50:28 PM | Attr = ]
system.ini -> %SystemRoot%\system.ini -> [Ver = | Size = 227 bytes | Modified Date = 21/04/2007 9:11:16 PM | Attr = ]
system32 -> %System32% -> [Folder | Modified Date = 10/05/2007 7:36:38 PM | Attr = ]
Tasks -> %SystemRoot%\Tasks -> [Folder | Modified Date = 17/04/2007 4:56:00 PM | Attr = S]
temp -> %SystemRoot%\temp -> [Folder | Modified Date = 10/05/2007 7:38:02 PM | Attr = ]
twain_32 -> %SystemRoot%\twain_32 -> [Folder | Modified Date = 21/04/2007 2:08:30 PM | Attr = ]
vb.ini -> %SystemRoot%\vb.ini -> [Ver = | Size = 36 bytes | Modified Date = 14/04/2007 4:08:18 PM | Attr = ]
vbaddin.ini -> %SystemRoot%\vbaddin.ini -> [Ver = | Size = 37 bytes | Modified Date = 14/04/2007 4:08:18 PM | Attr = ]
VirtualEar -> %SystemRoot%\VirtualEar -> [Folder | Modified Date = 14/04/2007 7:16:44 PM | Attr = ]
Web -> %SystemRoot%\Web -> [Folder | Modified Date = 06/05/2007 5:54:46 PM | Attr = R ]
win.ini -> %SystemRoot%\win.ini -> [Ver = | Size = 628 bytes | Modified Date = 26/04/2007 6:09:12 PM | Attr = ]
WindowsShell.Manifest -> %SystemRoot%\WindowsShell.Manifest -> [Ver = | Size = 749 bytes | Modified Date = 21/04/2007 9:18:02 PM | Attr = RH ]
WinSxS -> %SystemRoot%\WinSxS -> [Folder | Modified Date = 06/05/2007 6:04:40 PM | Attr = ]
WMSysPr9.prx -> %SystemRoot%\WMSysPr9.prx -> [Ver = | Size = 316640 bytes | Modified Date = 06/05/2007 6:08:02 PM | Attr = ]
WMSysPrx.prx -> %SystemRoot%\WMSysPrx.prx -> [Ver = | Size = 299552 bytes | Modified Date = 21/04/2007 9:19:26 PM | Attr = ]
_isenv31.ini -> %SystemRoot%\_isenv31.ini -> [Ver = | Size = 1099 bytes | Modified Date = 16/04/2007 9:17:48 PM | Attr = ]
SA.DAT -> %SystemRoot%\tasks\SA.DAT -> [Ver = | Size = 6 bytes | Modified Date = 10/05/2007 7:37:48 PM | Attr = H ]
$winnt$.inf -> %System32%\$winnt$.inf -> [Ver = | Size = 14659 bytes | Modified Date = 21/04/2007 9:25:10 PM | Attr = ]
1025 -> %System32%\1025 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
1028 -> %System32%\1028 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
1031 -> %System32%\1031 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
1033 -> %System32%\1033 -> [Folder | Modified Date = 21/04/2007 2:07:26 PM | Attr = ]
1037 -> %System32%\1037 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
1041 -> %System32%\1041 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
1042 -> %System32%\1042 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
1054 -> %System32%\1054 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
2052 -> %System32%\2052 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
3076 -> %System32%\3076 -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
3com_dmi -> %System32%\3com_dmi -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
aaarggp.bat -> %System32%\aaarggp.bat -> [Ver = | Size = 117 bytes | Modified Date = 29/04/2007 12:34:40 AM | Attr = ]
ActiveScan -> %System32%\ActiveScan -> [Folder | Modified Date = 21/04/2007 10:24:30 PM | Attr = ]
amcompat.tlb -> %System32%\amcompat.tlb -> [Ver = | Size = 16832 bytes | Modified Date = 21/04/2007 9:19:26 PM | Attr = ]
avgfwafu.dll -> %System32%\avgfwafu.dll -> GRISOFT, s.r.o. [Ver = 7.5.0.407 | Size = 110592 bytes | Modified Date = 08/05/2007 7:50:46 PM | Attr = ]
Backup -> %System32%\Backup -> [Folder | Modified Date = 14/04/2007 4:42:02 PM | Attr = ]
bits -> %System32%\bits -> [Folder | Modified Date = 22/04/2007 2:23:34 PM | Attr = ]
bjlhfhv.bat -> %System32%\bjlhfhv.bat -> [Ver = | Size = 117 bytes | Modified Date = 28/04/2007 3:02:12 PM | Attr = ]
CatRoot -> %System32%\CatRoot -> [Folder | Modified Date = 06/05/2007 6:13:10 PM | Attr = ]
CatRoot2 -> %System32%\CatRoot2 -> [Folder | Modified Date = 10/05/2007 7:36:38 PM | Attr = ]
cdplayer.exe.manifest -> %System32%\cdplayer.exe.manifest -> [Ver = | Size = 749 bytes | Modified Date = 21/04/2007 9:18:02 PM | Attr = RH ]
clcl5.exe -> %System32%\clcl5.exe -> [Ver = | Size = 204800 bytes | Modified Date = 21/04/2007 3:38:12 PM | Attr = ]
Com -> %System32%\Com -> [Folder | Modified Date = 06/05/2007 5:58:06 PM | Attr = ]
config -> %System32%\config -> [Folder | Modified Date = 23/04/2007 5:42:58 PM | Attr = ]
CONFIG.NT -> %System32%\CONFIG.NT -> [Ver = | Size = 2577 bytes | Modified Date = 14/04/2007 4:11:32 PM | Attr = ]
dhcp -> %System32%\dhcp -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
DirectX -> %System32%\DirectX -> [Folder | Modified Date = 14/04/2007 4:10:00 PM | Attr = ]
dllcache -> %System32%\dllcache -> [Folder | Modified Date = 08/05/2007 8:17:24 PM | Attr = RHS]
drivers -> %System32%\drivers -> [Folder | Modified Date = 08/05/2007 8:17:18 PM | Attr = ]
DRVSTORE -> %System32%\DRVSTORE -> [Folder | Modified Date = 16/04/2007 8:13:00 PM | Attr = ]
emptyregdb.dat -> %System32%\emptyregdb.dat -> [Ver = | Size = 23316 bytes | Modified Date = 21/04/2007 9:17:34 PM | Attr = ]
eofrwchw.bat -> %System32%\eofrwchw.bat -> [Ver = | Size = 130 bytes | Modified Date = 26/04/2007 3:49:54 PM | Attr = ]
esaxqqvn.bat -> %System32%\esaxqqvn.bat -> [Ver = | Size = 121 bytes | Modified Date = 21/04/2007 10:39:28 PM | Attr = ]
export -> %System32%\export -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
fjnsbn.bat -> %System32%\fjnsbn.bat -> [Ver = | Size = 125 bytes | Modified Date = 28/04/2007 6:09:04 PM | Attr = ]
FNTCACHE.DAT -> %System32%\FNTCACHE.DAT -> [Ver = | Size = 243128 bytes | Modified Date = 06/05/2007 6:23:12 PM | Attr = ]
fuamfu32.ini -> %System32%\fuamfu32.ini -> [Ver = | Size = 4 bytes | Modified Date = 26/04/2007 12:40:06 PM | Attr = ]
g.bat -> %System32%\g.bat -> [Ver = | Size = 24 bytes | Modified Date = 28/04/2007 3:31:10 PM | Attr = ]
g.ftp -> %System32%\g.ftp -> [Ver = | Size = 53 bytes | Modified Date = 28/04/2007 3:31:10 PM | Attr = ]
gtv_sd.bin -> %System32%\gtv_sd.bin ->  [Ver = | Size = 12 bytes | Modified Date = 26/04/2007 12:40:12 PM | Attr = ]
Help.ico -> %System32%\Help.ico -> [Ver = | Size = 1406 bytes | Modified Date = 21/04/2007 10:24:02 PM | Attr = ]
ias -> %System32%\ias -> [Folder | Modified Date = 21/04/2007 9:18:58 PM | Attr = ]
icsxml -> %System32%\icsxml -> [Folder | Modified Date = 21/04/2007 2:08:08 PM | Attr = ]
IME -> %System32%\IME -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
inet.hlp -> %System32%\inet.hlp -> [Ver = | Size = 4665 bytes | Modified Date = 26/04/2007 12:40:08 PM | Attr = ]
inetsrv -> %System32%\inetsrv -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
Kaspersky Lab -> %System32%\Kaspersky Lab -> [Folder | Modified Date = 27/04/2007 2:23:12 PM | Attr = ]
lclcfg32.ini -> %System32%\lclcfg32.ini -> [Ver = | Size = 0 bytes | Modified Date = 26/04/2007 2:47:52 PM | Attr = ]
lfd32.ini -> %System32%\lfd32.ini -> [Ver = | Size = 83 bytes | Modified Date = 26/04/2007 12:40:08 PM | Attr = ]
logonui.exe.manifest -> %System32%\logonui.exe.manifest -> [Ver = | Size = 488 bytes | Modified Date = 21/04/2007 9:18:08 PM | Attr = RH ]
Macromed -> %System32%\Macromed -> [Folder | Modified Date = 14/04/2007 4:09:58 PM | Attr = ]
mapisvc.inf -> %System32%\mapisvc.inf -> [Ver = | Size = 466 bytes | Modified Date = 14/04/2007 4:40:52 PM | Attr = ]
Microsoft -> %System32%\Microsoft -> [Folder | Modified Date = 27/04/2007 12:47:42 PM | Attr = S]
mn.dll -> %System32%\mn.dll -> [Ver = 1, 0, 0, 2 | Size = 16721 bytes | Modified Date = 27/04/2007 11:01:40 AM | Attr = ]
mprhou.dns -> %System32%\mprhou.dns -> [Ver = | Size = 163 bytes | Modified Date = 29/04/2007 6:05:52 PM | Attr = H ]
MsDtc -> %System32%\MsDtc -> [Folder | Modified Date = 14/04/2007 4:08:14 PM | Attr = ]
MSIXU.DLL -> %System32%\MSIXU.DLL -> [Ver = | Size = 22016 bytes | Modified Date = 26/04/2007 12:40:20 PM | Attr = ]
mui -> %System32%\mui -> [Folder | Modified Date = 06/05/2007 6:04:30 PM | Attr = ]
ncpa.cpl.manifest -> %System32%\ncpa.cpl.manifest -> [Ver = | Size = 749 bytes | Modified Date = 21/04/2007 9:18:02 PM | Attr = RH ]
npp -> %System32%\npp -> [Folder | Modified Date = 06/05/2007 5:58:22 PM | Attr = ]
nscompat.tlb -> %System32%\nscompat.tlb -> [Ver = | Size = 23392 bytes | Modified Date = 21/04/2007 9:19:26 PM | Attr = ]
nwc.cpl.manifest -> %System32%\nwc.cpl.manifest -> [Ver = | Size = 749 bytes | Modified Date = 21/04/2007 9:18:02 PM | Attr = RH ]
oobe -> %System32%\oobe -> [Folder | Modified Date = 06/05/2007 6:04:32 PM | Attr = ]
pavas.ico -> %System32%\pavas.ico -> [Ver = | Size = 30590 bytes | Modified Date = 21/04/2007 10:24:02 PM | Attr = ]
perfc009.dat -> %System32%\perfc009.dat -> [Ver = | Size = 61258 bytes | Modified Date = 06/05/2007 6:26:16 PM | Attr = ]
perfh009.dat -> %System32%\perfh009.dat -> [Ver = | Size = 401084 bytes | Modified Date = 06/05/2007 6:26:16 PM | Attr = ]
PerfStringBackup.INI -> %System32%\PerfStringBackup.INI -> [Ver = | Size = 469794 bytes | Modified Date = 06/05/2007 6:26:16 PM | Attr = ]
ras -> %System32%\ras -> [Folder | Modified Date = 14/04/2007 8:57:50 AM | Attr = ]
ReinstallBackups -> %System32%\ReinstallBackups -> [Folder | Modified Date = 06/05/2007 5:53:14 PM | Attr = ]
Restore -> %System32%\Restore -> [Folder | Modified Date = 06/05/2007 5:58:22 PM | Attr = ]
sapi.cpl.manifest -> %System32%\sapi.cpl.manifest -> [Ver = | Size = 749 bytes | Modified Date = 21/04/2007 9:18:02 PM | Attr = RH ]
Setup -> %System32%\Setup -> [Folder | Modified Date = 06/05/2007 6:04:28 PM | Attr = ]
ShellExt -> %System32%\ShellExt -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
sl.bin -> %System32%\sl.bin -> [Ver = | Size = 12 bytes | Modified Date = 26/04/2007 12:44:00 PM | Attr = ]
SoftwareDistribution -> %System32%\SoftwareDistribution -> [Folder | Modified Date = 21/04/2007 9:57:26 PM | Attr = ]
spool -> %System32%\spool -> [Folder | Modified Date = 14/04/2007 4:06:10 PM | Attr = ]
spupdsvc.inf -> %System32%\spupdsvc.inf -> [Ver = | Size = 2694 bytes | Modified Date = 06/05/2007 6:12:36 PM | Attr = ]
stfv.bin -> %System32%\stfv.bin -> [Ver = | Size = 4 bytes | Modified Date = 27/04/2007 1:12:38 PM | Attr = ]
Uninstall.ico -> %System32%\Uninstall.ico -> [Ver = | Size = 2550 bytes | Modified Date = 21/04/2007 10:24:02 PM | Attr = ]
URTTemp -> %System32%\URTTemp -> [Folder | Modified Date = 14/04/2007 4:37:06 PM | Attr = ]
usmt -> %System32%\usmt -> [Folder | Modified Date = 06/05/2007 5:57:14 PM | Attr = ]
wbem -> %System32%\wbem -> [Folder | Modified Date = 06/05/2007 6:23:54 PM | Attr = ]
WER8274.DLL -> %System32%\WER8274.DLL -> [Ver = | Size = 24320 bytes | Modified Date = 26/04/2007 12:40:20 PM | Attr = ]
WindowsLogon.manifest -> %System32%\WindowsLogon.manifest -> [Ver = | Size = 488 bytes | Modified Date = 21/04/2007 9:18:08 PM | Attr = RH ]
wins -> %System32%\wins -> [Folder | Modified Date = 29/04/2007 8:28:56 PM | Attr = ]
wml.exe -> %System32%\wml.exe -> [Ver = | Size = 18944 bytes | Modified Date = 26/04/2007 12:40:26 PM | Attr = ]
wmpscheme.xml -> %System32%\wmpscheme.xml -> [Ver = | Size = 25065 bytes | Modified Date = 21/04/2007 9:19:30 PM | Attr = ]
wpa.bak -> %System32%\wpa.bak -> [Ver = | Size = 2422 bytes | Modified Date = 07/05/2007 5:23:54 PM | Attr = ]
wpa.dbl -> %System32%\wpa.dbl -> [Ver = | Size = 2422 bytes | Modified Date = 10/05/2007 7:38:08 PM | Attr = ]
wtxqvmat.ini -> %System32%\wtxqvmat.ini -> [Ver = | Size = 1543 bytes | Modified Date = 28/04/2007 3:02:02 PM | Attr = HS]
wuaucpl.cpl.manifest -> %System32%\wuaucpl.cpl.manifest -> [Ver = | Size = 749 bytes | Modified Date = 21/04/2007 9:18:02 PM | Attr = RH ]
xircom -> %System32%\xircom -> [Folder | Modified Date = 14/04/2007 4:12:16 PM | Attr = ]
tftp.exe -> %System32%\dllcache\tftp.exe -> [Ver = | Size = 16896 bytes | Modified Date = 28/04/2007 3:02:10 PM | Attr = ]
avg7core.sys -> %System32%\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 816672 bytes | Modified Date = 08/05/2007 7:50:42 PM | Attr = ]
avg7rsw.sys -> %System32%\drivers\avg7rsw.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,340 | Size = 4224 bytes | Modified Date = 23/04/2007 4:54:42 PM | Attr = ]
avg7rsxp.sys -> %System32%\drivers\avg7rsxp.sys -> GRISOFT, s.r.o. [Ver = 7,1,0,398 | Size = 28416 bytes | Modified Date = 08/05/2007 7:50:42 PM | Attr = ]
avgclean.sys -> %System32%\drivers\avgclean.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Modified Date = 08/05/2007 7:50:46 PM | Attr = ]
avgmfx86.sys -> %System32%\drivers\avgmfx86.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.416 | Size = 18240 bytes | Modified Date = 08/05/2007 7:50:42 PM | Attr = ]
avgtdi.sys -> %System32%\drivers\avgtdi.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,346 | Size = 4960 bytes | Modified Date = 08/05/2007 7:50:44 PM | Attr = ]
disdn -> %System32%\drivers\disdn -> [Folder | Modified Date = 14/04/2007 8:54:58 AM | Attr = ]
etc -> %System32%\drivers\etc -> [Folder | Modified Date = 01/05/2007 3:53:40 PM | Attr = ]
gmer.sys -> %System32%\drivers\gmer.sys -> GMER [Ver = 1, 0, 12, 3868 | Size = 69905 bytes | Modified Date = 28/04/2007 3:26:38 PM | Attr = ]
SYMEVENT.CAT -> %System32%\drivers\SYMEVENT.CAT -> [Ver = | Size = 8014 bytes | Modified Date = 16/04/2007 10:42:02 PM | Attr = ]
SYMEVENT.INF -> %System32%\drivers\SYMEVENT.INF -> [Ver = | Size = 806 bytes | Modified Date = 16/04/2007 10:42:02 PM | Attr = ]
hosts.bak -> %System32%\drivers\etc\hosts.bak -> [Ver = | Size = 27 bytes | Modified Date = 27/04/2007 2:00:42 PM | Attr = ]

[File String Scan - Non-Microsoft Only]
File scan skipped for file %SystemRoot%\MEMORY.DMP -> File size too big (534831104 bytes) -> 
aspack , -> %System32%\clcl5.exe -> [Ver = | Size = 204800 bytes | Modified Date = 21/04/2007 3:38:12 PM | Attr = ]
PEC2 , -> %System32%\dfrg.msc -> [Ver = | Size = 41397 bytes | Modified Date = 18/08/2001 5:00:00 AM | Attr = ]
PEC2 , PECompact2 , -> %System32%\DivX.dll -> DivXNetworks [Ver = 6,0,0,1571 | Size = 692736 bytes | Modified Date = 09/08/2005 3:14:00 PM | Attr = ]
UpackByDwing , MZKERNEL32.DLL , -> %System32%\mn.dll -> [Ver = 1, 0, 0, 2 | Size = 16721 bytes | Modified Date = 27/04/2007 11:01:40 AM | Attr = ]
winsync , -> %System32%\wbdbase.deu -> [Ver = | Size = 1309184 bytes | Modified Date = 18/08/2001 5:00:00 AM | Attr = ]
WSUD , UPX0 , -> %System32%\dllcache\hwxjpn.dll -> [Ver = | Size = 13463552 bytes | Modified Date = 18/08/2001 5:00:00 AM | Attr = ]
UPX! , FSG! , PEC2 , aspack , -> %System32%\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.429 | Size = 816672 bytes | Modified Date = 08/05/2007 7:50:42 PM | Attr = ]
PTech , -> %System32%\drivers\mtlstrm.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 1309184 bytes | Modified Date = 03/08/2004 10:41:38 PM | Attr = ]

< End of report >


----------



## monkeybubbles (Apr 26, 2007)

some good news. i do have a firewall up and running now. but my internet still doesn't work.


----------



## monkeybubbles (Apr 26, 2007)

Bump


----------



## sjpritch25 (Sep 8, 2005)

You may need your Windows XP Disc

Step 1: Delete the corrupted registry keys

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Modify the registry at your own risk.

1. Click Start, and then click Run.
2. In the Open box, type regedit, and then click OK.
3. In Registry Editor, locate the following keys, right-click each key, and then click Delete:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2

4. When you are prompted to confirm the deletion, click Yes.

Note Restart the computer after you delete the Winsock keys. Doing so causes the Windows XP operating system to create new shell entries for those two keys. If you do not restart the computer after you delete the Winsock keys, the next step does not work correctly.

Step 2: Install TCP/IP

1. Right-click the network connection, and then click Properties.
2. Click Install.
3. Click Protocol, and then click Add.
4. Click Have Disk.
5. Type C:\Windows\inf, and then click OK.
6. On the list of available protocols, click Internet Protocol (TCP/IP), and then click OK.

If Internet Protocol (TCP/IP) does not appear, follow these steps:

a. Click Start, and then click Search.
b. In the Search Companion pane, click More advanced options.
c. Click to select the following three check boxes: Search system folders
 Search hidden files and folders
 Search subfolders

d. In the All or part of the file name box, type nettcpip.inf, and then click Search.
e. In the results pane, right-click Nettcpip.inf, and then click Install.

7. Restart the computer.

*Remove network adapter(s) in Device Manager:*

a. Right-click My Computer, click Properties, click the Hardware tab, and then click Device Manager.
b. To see the list of installed network adapters, double-click Network adapter(s), and then click Remove.
c. Restart the computer, and then let the system automatically detect and install the network adapter drivers.

Note This step detects and corrects corrupted registry entries on network adapter bindings. Perform this step if all other troubleshooting steps do not resolve your issue. Always perform this step before you decide to manually remove a network adapter card.


----------



## monkeybubbles (Apr 26, 2007)

my internet works now  
thanks


----------



## monkeybubbles (Apr 26, 2007)

my firewall doesn't work. it's been turned off. and i'm getting a generic host process for Win32 services.


----------



## sjpritch25 (Sep 8, 2005)

Download this tool to your desktop:
http://www.uploads.ejvindh.net/rootchk.exe
Run the program. After a short time a logfile will turn up. Copy the contents of the log into the thread.

Notice: Some security-programs prevent the creation of dummy drivers with certain names. This may cause false positives. If the log of rootchk contains a lot of hidden drivers, you may want to turn of your security programs while rootchk is scanning (you should then unhook your network connection as well)


----------



## monkeybubbles (Apr 26, 2007)

********************************* ROOTCHK-(21-05-07)-LOG, by ejvindh
23/05/2007 15:29:47.68

Driver nm (visible) is present. Run COMBOFIX by sUBs.

********************************* ROOTCHK-LOG-end

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-23 15:29:48
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


----------



## sjpritch25 (Sep 8, 2005)

If you still have Combofix.exe on your Desktop, please delete it. You are still infected and we need to download a fresh Copy.

Download Combofix and save it to your desktop.
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Note: It is important that it is saved directly to your desktop

Close any open browsers.

Double click on combofix.exe & follow the prompts.
When finished, it shall produce a log for you.

Post the ComboFix.txt in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall


----------



## monkeybubbles (Apr 26, 2007)

"Owner" - 2007-05-26 17:28:14 Service Pack 2 
ComboFix 07-05.26.3.V - Running from: "C:\Documents and Settings\Owner\Desktop\"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

"C:\WINDOWS\system32\clcl5.exe"

((((((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\LEGACY_NTIO256
-------\nm

((((((((((((((((((((((((((((((( Files Created from 2007-04-26 to 2007-05-26 ))))))))))))))))))))))))))))))))))

2007-05-22 21:06 d--h-----	C:\WINDOWS\$hf_mig$
2007-05-22 21:06 d--------	C:\WINDOWS\system32\PreInstall
2007-05-22 21:05	9,216	--a------	C:\WINDOWS\system32\avgwlntf.dll
2007-05-08 19:50	110,592	--a------	C:\WINDOWS\system32\avgfwafu.dll
2007-05-07 17:14 d--------	C:\temp\Shaw
2007-05-07 16:42 d--------	C:\temp
2007-05-07 16:39 d--------	C:\Program Files\shaw
2007-05-07 16:29	72,576	-ra------	C:\WINDOWS\system32\drivers\netusbxp.sys
2007-05-06 18:23 d--------	C:\WINDOWS\Prefetch
2007-05-06 18:08	221,184	--a------	C:\WINDOWS\system32\wmpns.dll
2007-05-06 18:04	95,424	---------	C:\WINDOWS\system32\drivers\slnthal.sys
2007-05-06 18:04	9,216	---------	C:\WINDOWS\system32\proxycfg.exe
2007-05-06 18:04	88,064	---------	C:\WINDOWS\system32\p2pnetsh.dll
2007-05-06 18:04	86,016	---------	C:\WINDOWS\system32\p2pgasvc.dll
2007-05-06 18:04	86,016	---------	C:\WINDOWS\system32\mdmxsdk.dll
2007-05-06 18:04	81,920	---------	C:\WINDOWS\system32\ieencode.dll
2007-05-06 18:04	8,192	---------	C:\WINDOWS\system32\smbinst.exe
2007-05-06 18:04	78,464	---------	C:\WINDOWS\system32\drivers\usbvideo.sys
2007-05-06 18:04	75,776	---------	C:\WINDOWS\system32\strmfilt.dll
2007-05-06 18:04	73,832	---------	C:\WINDOWS\system32\slcoinst.dll
2007-05-06 18:04	73,796	---------	C:\WINDOWS\system32\slserv.exe
2007-05-06 18:04	71,680	---------	C:\WINDOWS\system32\blastcln.exe
2007-05-06 18:04	7,680	---------	C:\WINDOWS\system32\kbdsmsno.dll
2007-05-06 18:04	7,680	---------	C:\WINDOWS\system32\kbdsmsfi.dll
2007-05-06 18:04	7,168	---------	C:\WINDOWS\system32\kbdukx.dll
2007-05-06 18:04	7,168	---------	C:\WINDOWS\system32\kbdno1.dll
2007-05-06 18:04	7,168	---------	C:\WINDOWS\system32\kbdfi1.dll
2007-05-06 18:04	685,056	---------	C:\WINDOWS\system32\drivers\hsfcxts2.sys
2007-05-06 18:04	67,584	---------	C:\WINDOWS\system32\drivers\sdbus.sys
2007-05-06 18:04	63,663	---------	C:\WINDOWS\system32\drivers\ati1rvxx.sys
2007-05-06 18:04	60,416	---------	C:\WINDOWS\system32\fwcfg.dll
2007-05-06 18:04	6,656	---------	C:\WINDOWS\system32\kbdinmal.dll
2007-05-06 18:04	6,656	---------	C:\WINDOWS\system32\kbdinben.dll
2007-05-06 18:04	6,144	---------	C:\WINDOWS\system32\kbdmlt48.dll
2007-05-06 18:04	6,144	---------	C:\WINDOWS\system32\kbdmlt47.dll
2007-05-06 18:04	6,144	---------	C:\WINDOWS\system32\kbdinbe1.dll
2007-05-06 18:04	59,648	---------	C:\WINDOWS\system32\drivers\rfcomm.sys
2007-05-06 18:04	59,392	---------	C:\WINDOWS\system32\logman.exe
2007-05-06 18:04	56,623	---------	C:\WINDOWS\system32\drivers\ati1btxx.sys
2007-05-06 18:04	526,848	---------	C:\WINDOWS\system32\p2psvc.dll
2007-05-06 18:04	516,768	---------	C:\WINDOWS\system32\ativvaxx.dll
2007-05-06 18:04	50,688	---------	C:\WINDOWS\system32\btpanui.dll
2007-05-06 18:04	5,632	---------	C:\WINDOWS\system32\kbdmaori.dll
2007-05-06 18:04	49,152	---------	C:\WINDOWS\system32\powercfg.exe
2007-05-06 18:04	48,640	---------	C:\WINDOWS\system32\pnrpnsp.dll
2007-05-06 18:04	46,464	---------	C:\WINDOWS\system32\drivers\gagp30kx.sys
2007-05-06 18:04	452,736	---------	C:\WINDOWS\system32\drivers\mtxparhm.sys
2007-05-06 18:04	44,928	---------	C:\WINDOWS\system32\drivers\agpcpq.sys
2007-05-06 18:04	44,672	---------	C:\WINDOWS\system32\drivers\uagp35.sys
2007-05-06 18:04	44,032	---------	C:\WINDOWS\system32\twext.dll
2007-05-06 18:04	43,008	---------	C:\WINDOWS\system32\drivers\amdagp.sys
2007-05-06 18:04	42,752	---------	C:\WINDOWS\system32\drivers\alim1541.sys
2007-05-06 18:04	42,368	---------	C:\WINDOWS\system32\drivers\agp440.sys
2007-05-06 18:04	42,240	---------	C:\WINDOWS\system32\drivers\viaagp.sys
2007-05-06 18:04	41,088	---------	C:\WINDOWS\system32\drivers\sisagp.sys
2007-05-06 18:04	404,990	---------	C:\WINDOWS\system32\drivers\slntamr.sys
2007-05-06 18:04	4,255	---------	C:\WINDOWS\system32\drivers\adv01nt5.dll
2007-05-06 18:04	397,056	---------	C:\WINDOWS\system32\s3gnb.dll
2007-05-06 18:04	384,512	---------	C:\WINDOWS\system32\mp4sdmod.dll
2007-05-06 18:04	38,016	---------	C:\WINDOWS\system32\drivers\bthmodem.sys
2007-05-06 18:04	36,463	---------	C:\WINDOWS\system32\drivers\ati1tuxx.sys
2007-05-06 18:04	36,096	---------	C:\WINDOWS\system32\drivers\intelppm.sys
2007-05-06 18:04	35,456	---------	C:\WINDOWS\system32\drivers\bthprint.sys
2007-05-06 18:04	34,735	---------	C:\WINDOWS\system32\drivers\ati1xsxx.sys
2007-05-06 18:04	32,866	---------	C:\WINDOWS\system32\slrundll.exe
2007-05-06 18:04	32,768	---------	C:\WINDOWS\system32\ativtmxx.dll
2007-05-06 18:04	32,285	---------	C:\WINDOWS\system32\hsfcisp2.dll
2007-05-06 18:04	312,320	---------	C:\WINDOWS\system32\p2pgraph.dll
2007-05-06 18:04	310,272	---------	C:\WINDOWS\system32\mp43dmod.dll
2007-05-06 18:04	30,671	---------	C:\WINDOWS\system32\drivers\ati1raxx.sys
2007-05-06 18:04	30,208	---------	C:\WINDOWS\system32\bthserv.dll
2007-05-06 18:04	30,080	---------	C:\WINDOWS\system32\drivers\rndismpx.sys
2007-05-06 18:04	3,967	---------	C:\WINDOWS\system32\drivers\adv02nt5.dll
2007-05-06 18:04	3,901	---------	C:\WINDOWS\system32\drivers\siint5.dll
2007-05-06 18:04	3,775	---------	C:\WINDOWS\system32\drivers\adv11nt5.dll
2007-05-06 18:04	3,711	---------	C:\WINDOWS\system32\drivers\adv09nt5.dll
2007-05-06 18:04	3,647	---------	C:\WINDOWS\system32\drivers\adv07nt5.dll
2007-05-06 18:04	3,615	---------	C:\WINDOWS\system32\drivers\adv05nt5.dll
2007-05-06 18:04	3,135	---------	C:\WINDOWS\system32\drivers\adv08nt5.dll
2007-05-06 18:04	29,455	---------	C:\WINDOWS\system32\drivers\ati1xbxx.sys
2007-05-06 18:04	29,184	---------	C:\WINDOWS\system32\sdhcinst.dll
2007-05-06 18:04	29,056	---------	C:\WINDOWS\system32\drivers\ip6fw.sys
2007-05-06 18:04	286,792	---------	C:\WINDOWS\system32\slextspk.dll
2007-05-06 18:04	274,304	---------	C:\WINDOWS\system32\drivers\bthport.sys
2007-05-06 18:04	263,040	---------	C:\WINDOWS\system32\drivers\http.sys
2007-05-06 18:04	26,367	---------	C:\WINDOWS\system32\drivers\ati1snxx.sys
2007-05-06 18:04	25,600	---------	C:\WINDOWS\system32\drivers\hidbth.sys
2007-05-06 18:04	25,471	---------	C:\WINDOWS\system32\drivers\watv10nt.sys
2007-05-06 18:04	25,471	---------	C:\WINDOWS\system32\drivers\atv04nt5.dll
2007-05-06 18:04	24,576	---------	C:\WINDOWS\system32\httpapi.dll
2007-05-06 18:04	229,376	---------	C:\WINDOWS\system32\ati2cqag.dll
2007-05-06 18:04	220,032	---------	C:\WINDOWS\system32\drivers\hsfbs2s2.sys
2007-05-06 18:04	22,528	---------	C:\WINDOWS\system32\fltmc.exe
2007-05-06 18:04	22,271	---------	C:\WINDOWS\system32\drivers\watv06nt.sys
2007-05-06 18:04	21,343	---------	C:\WINDOWS\system32\drivers\ati1ttxx.sys
2007-05-06 18:04	21,183	---------	C:\WINDOWS\system32\drivers\atv01nt5.dll
2007-05-06 18:04	20,992	---------	C:\WINDOWS\system32\bthci.dll
2007-05-06 18:04	2,113,536	---------	C:\WINDOWS\system32\dxdiagn.dll
2007-05-06 18:04	193,024	---------	C:\WINDOWS\system32\fsquirt.exe
2007-05-06 18:04	188,508	---------	C:\WINDOWS\system32\slgen.dll
2007-05-06 18:04	180,360	---------	C:\WINDOWS\system32\drivers\ntmtlfax.sys
2007-05-06 18:04	18,944	---------	C:\WINDOWS\system32\drivers\bthusb.sys
2007-05-06 18:04	17,408	---------	C:\WINDOWS\system32\winshfhc.dll
2007-05-06 18:04	17,279	---------	C:\WINDOWS\system32\drivers\atv10nt5.dll
2007-05-06 18:04	17,024	---------	C:\WINDOWS\system32\drivers\bthenum.sys
2007-05-06 18:04	166,912	---------	C:\WINDOWS\system32\drivers\s3gnbm.sys
2007-05-06 18:04	16,896	---------	C:\WINDOWS\system32\fltlib.dll
2007-05-06 18:04	15,872	---------	C:\WINDOWS\system32\w3ssl.dll
2007-05-06 18:04	15,488	---------	C:\WINDOWS\system32\drivers\mssmbios.sys
2007-05-06 18:04	15,423	---------	C:\WINDOWS\system32\drivers\ch7xxnt5.dll
2007-05-06 18:04	14,336	---------	C:\WINDOWS\system32\auditusr.exe
2007-05-06 18:04	14,143	---------	C:\WINDOWS\system32\drivers\atv06nt5.dll
2007-05-06 18:04	13,824	---------	C:\WINDOWS\system32\cmsetacl.dll
2007-05-06 18:04	13,776	---------	C:\WINDOWS\system32\drivers\recagent.sys
2007-05-06 18:04	13,240	---------	C:\WINDOWS\system32\drivers\slwdmsup.sys
2007-05-06 18:04	129,535	---------	C:\WINDOWS\system32\drivers\slnt7554.sys
2007-05-06 18:04	126,686	---------	C:\WINDOWS\system32\drivers\mtlmnt5.sys
2007-05-06 18:04	124,800	---------	C:\WINDOWS\system32\drivers\fltmgr.sys
2007-05-06 18:04	12,672	---------	C:\WINDOWS\system32\drivers\usb8023x.sys
2007-05-06 18:04	12,047	---------	C:\WINDOWS\system32\drivers\ati1pdxx.sys
2007-05-06 18:04	118,784	---------	C:\WINDOWS\system32\msdadiag.dll
2007-05-06 18:04	116,224	---------	C:\WINDOWS\system32\p2p.dll
2007-05-06 18:04	11,935	---------	C:\WINDOWS\system32\drivers\wadv11nt.sys
2007-05-06 18:04	11,871	---------	C:\WINDOWS\system32\drivers\wadv09nt.sys
2007-05-06 18:04	11,868	---------	C:\WINDOWS\system32\drivers\mdmxsdk.sys
2007-05-06 18:04	11,807	---------	C:\WINDOWS\system32\drivers\wadv07nt.sys
2007-05-06 18:04	11,615	---------	C:\WINDOWS\system32\drivers\ati1mdxx.sys
2007-05-06 18:04	11,359	---------	C:\WINDOWS\system32\drivers\atv02nt5.dll
2007-05-06 18:04	11,325	---------	C:\WINDOWS\system32\drivers\vchnt5.dll
2007-05-06 18:04	11,295	---------	C:\WINDOWS\system32\drivers\wadv08nt.sys
2007-05-06 18:04	11,136	---------	C:\WINDOWS\system32\drivers\sffdisk.sys
2007-05-06 18:04	100,992	---------	C:\WINDOWS\system32\drivers\bthpan.sys
2007-05-06 18:04	10,240	---------	C:\WINDOWS\system32\drivers\sffp_sd.sys
2007-05-06 18:04	1,888,992	---------	C:\WINDOWS\system32\ati3duag.dll
2007-05-06 18:04	1,737,856	---------	C:\WINDOWS\system32\mtxparhd.dll
2007-05-06 18:04	1,689,088	---------	C:\WINDOWS\system32\d3d9.dll
2007-05-06 18:04	1,309,184	---------	C:\WINDOWS\system32\drivers\mtlstrm.sys
2007-05-06 18:04	1,041,536	---------	C:\WINDOWS\system32\drivers\hsfdpsp2.sys
2007-05-06 18:03	81,408	---------	C:\WINDOWS\system32\wscsvc.dll
2007-05-06 18:03	50,176	---------	C:\WINDOWS\system32\xmlprovi.dll
2007-05-06 18:03	32,866	---------	C:\WINDOWS\slrundll.exe
2007-05-06 18:03	13,824	---------	C:\WINDOWS\system32\wscntfy.exe
2007-05-06 18:03	129,536	---------	C:\WINDOWS\system32\xmlprov.dll
2007-05-06 18:03	108,032	---------	C:\WINDOWS\system32\wshbth.dll
2007-05-06 18:03 d--------	C:\WINDOWS\provisioning


----------



## monkeybubbles (Apr 26, 2007)

2007-05-06 18:03 d--------	C:\WINDOWS\peernet
2007-05-06 17:54	2,897,920	---------	C:\WINDOWS\system32\xpsp2res.dll
2007-05-06 17:52	22,752	--a------	C:\WINDOWS\system32\spupdsvc.exe
2007-05-06 16:53 d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-05-06 16:52 d--------	C:\Program Files\SUPERAntiSpyware
2007-05-06 16:52 d--------	C:\Program Files\Common Files\Wise Installation Wizard
2007-05-06 16:52 d--------	C:\DOCUME~1\Owner\APPLIC~1\SUPERAntiSpyware.com
2007-05-01 21:18 d--------	C:\Sysclean
2007-04-29 21:52 d--------	C:\DOCUME~1\Owner\APPLIC~1\MSN6
2007-04-29 21:52 d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
2007-04-29 19:40	134,144	--a------	C:\WINDOWS\R.COM
2007-04-29 19:40	128,512	--a------	C:\WINDOWS\system32\T.COM
2007-04-29 10:09	135,168	--a------	C:\WINDOWS\system32\igfxres.dll
2007-04-29 01:04 d--------	C:\WINDOWS\ServicePackFiles
2007-04-29 01:04 d--------	C:\WINDOWS\ehome
2007-04-29 00:41	92,672	--a------	C:\WINDOWS\system32\wlnotify.dll
2007-04-29 00:41	91,648	--a------	C:\WINDOWS\system32\xactsrv.dll
2007-04-29 00:41	77,824	--a------	C:\WINDOWS\system32\wmpstub.exe
2007-04-29 00:41	6,656	--a------	C:\WINDOWS\system32\wuauserv.dll
2007-04-29 00:41	53,760	--a------	C:\WINDOWS\system32\winsta.dll
2007-04-29 00:41	51,712	--a------	C:\WINDOWS\system32\wzcsapi.dll
2007-04-29 00:41	51,200	--a------	C:\WINDOWS\system32\wmerrenu.dll
2007-04-29 00:41	446,464	--a------	C:\WINDOWS\system32\wmvdmoe.dll
2007-04-29 00:41	42,496	--a------	C:\WINDOWS\system32\wsnmp32.dll
2007-04-29 00:41	378,368	--a------	C:\WINDOWS\system32\wzcdlg.dll
2007-04-29 00:41	359,936	--a------	C:\WINDOWS\system32\wzcsvc.dll
2007-04-29 00:41	337,920	--a------	C:\WINDOWS\system32\zipfldr.dll
2007-04-29 00:41	311,327	--a------	C:\WINDOWS\system32\wmv8dmod.dll
2007-04-29 00:41	303,616	--a------	C:\WINDOWS\system32\wmstream.dll
2007-04-29 00:41	264,192	--a------	C:\WINDOWS\system32\wow32.dll
2007-04-29 00:41	18,432	--a------	C:\WINDOWS\system32\wtsapi32.dll
2007-04-29 00:41	174,200	--a------	C:\WINDOWS\system32\xenroll.dll
2007-04-29 00:41	172,032	--a------	C:\WINDOWS\system32\wldap32.dll
2007-04-29 00:41	14,336	--a------	C:\WINDOWS\system32\wship6.dll
2007-04-29 00:41	115,200	--a------	C:\WINDOWS\system32\wmsdmoe.dll
2007-04-29 00:40	96,768	--a------	C:\WINDOWS\system32\psbase.dll
2007-04-29 00:40	937,984	---------	C:\WINDOWS\system32\winbrand.dll
2007-04-29 00:40	93,696	--a------	C:\WINDOWS\system32\tscfgwmi.dll
2007-04-29 00:40	92,168	--a------	C:\WINDOWS\system32\rdpdd.dll
2007-04-29 00:40	90,624	--a------	C:\WINDOWS\system32\trkwks.dll
2007-04-29 00:40	9,216	--a------	C:\WINDOWS\system32\scrnsave.scr
2007-04-29 00:40	89,600	--a------	C:\WINDOWS\system32\smlogsvc.exe
2007-04-29 00:40	870,784	---------	C:\WINDOWS\system32\ati3d1ag.dll
2007-04-29 00:40	87,176	--a------	C:\WINDOWS\system32\rdpwsx.dll
2007-04-29 00:40	77,312	--a------	C:\WINDOWS\system32\sdbinst.exe
2007-04-29 00:40	77,312	--a------	C:\WINDOWS\system32\rtcshare.exe
2007-04-29 00:40	75,264	--a------	C:\WINDOWS\system32\telnet.exe
2007-04-29 00:40	74,752	--a------	C:\WINDOWS\system32\storprop.dll
2007-04-29 00:40	74,752	--a------	C:\WINDOWS\system32\spoolss.dll
2007-04-29 00:40	73,216	---------	C:\WINDOWS\system32\drivers\atintuxx.sys
2007-04-29 00:40	713,728	--a------	C:\WINDOWS\system32\opengl32.dll
2007-04-29 00:40	713,216	--a------	C:\WINDOWS\system32\sxs.dll
2007-04-29 00:40	71,680	--a------	C:\WINDOWS\system32\ssdpsrv.dll
2007-04-29 00:40	704,512	--a------	C:\WINDOWS\system32\ss3dfo.scr
2007-04-29 00:40	701,440	---------	C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-04-29 00:40	70,144	--a------	C:\WINDOWS\system32\sigverif.exe
2007-04-29 00:40	7,168	---------	C:\WINDOWS\system32\hccoin.dll
2007-04-29 00:40	69,632	--a------	C:\WINDOWS\system32\raschap.dll
2007-04-29 00:40	69,632	--a------	C:\WINDOWS\system32\odbcconf.exe
2007-04-29 00:40	68,096	--a------	C:\WINDOWS\system32\shgina.dll
2007-04-29 00:40	679,936	--a------	C:\WINDOWS\system32\sstext3d.scr
2007-04-29 00:40	67,584	--a------	C:\WINDOWS\system32\webclnt.dll
2007-04-29 00:40	67,584	--a------	C:\WINDOWS\system32\sti.dll
2007-04-29 00:40	67,584	--a------	C:\WINDOWS\system32\srclient.dll
2007-04-29 00:40	65,536	--a------	C:\WINDOWS\system32\wextract.exe
2007-04-29 00:40	65,536	--a------	C:\WINDOWS\system32\shimeng.dll
2007-04-29 00:40	65,536	--a------	C:\WINDOWS\system32\odbccu32.dll
2007-04-29 00:40	65,536	--a------	C:\WINDOWS\system32\odbccr32.dll
2007-04-29 00:40	63,488	---------	C:\WINDOWS\system32\drivers\atinxsxx.sys
2007-04-29 00:40	62,976	--a------	C:\WINDOWS\system32\pautoenr.dll
2007-04-29 00:40	62,464	--a------	C:\WINDOWS\system32\rdpclip.exe
2007-04-29 00:40	610,304	--a------	C:\WINDOWS\system32\sspipes.scr
2007-04-29 00:40	60,416	--a------	C:\WINDOWS\system32\remotepg.dll
2007-04-29 00:40	6,656	--a------	C:\WINDOWS\system32\sensapi.dll
2007-04-29 00:40	6,016	---------	C:\WINDOWS\system32\drivers\smbali.sys
2007-04-29 00:40	581,120	--a------	C:\WINDOWS\system32\rpcrt4.dll
2007-04-29 00:40	58,368	--a------	C:\WINDOWS\system32\packager.exe
2007-04-29 00:40	57,856	---------	C:\WINDOWS\system32\drivers\atinbtxx.sys
2007-04-29 00:40	562,176	--a------	C:\WINDOWS\system32\qedit.dll
2007-04-29 00:40	55,808	--a------	C:\WINDOWS\system32\secur32.dll
2007-04-29 00:40	54,784	--a------	C:\WINDOWS\system32\npptools.dll
2007-04-29 00:40	538,624	--a------	C:\WINDOWS\system32\spider.exe
2007-04-29 00:40	52,224	---------	C:\WINDOWS\system32\drivers\atinraxx.sys
2007-04-29 00:40	51,712	--a------	C:\WINDOWS\system32\vdmredir.dll
2007-04-29 00:40	50,176	--a------	C:\WINDOWS\system32\utilman.exe
2007-04-29 00:40	50,176	--a------	C:\WINDOWS\system32\reg.exe
2007-04-29 00:40	49,664	--a------	C:\WINDOWS\system32\regapi.dll
2007-04-29 00:40	442,368	--a------	C:\WINDOWS\system32\sqlsrv32.dll
2007-04-29 00:40	44,544	--a------	C:\WINDOWS\system32\tscupgrd.exe
2007-04-29 00:40	438,272	--a------	C:\WINDOWS\system32\shimgvw.dll
2007-04-29 00:40	435,200	--a------	C:\WINDOWS\system32\ntmssvc.dll
2007-04-29 00:40	430,592	--a------	C:\WINDOWS\system32\vssapi.dll
2007-04-29 00:40	43,520	--a------	C:\WINDOWS\system32\ntlanman.dll
2007-04-29 00:40	42,496	--a------	C:\WINDOWS\system32\shmgrate.exe
2007-04-29 00:40	417,792	--a------	C:\WINDOWS\system32\vbscript.dll
2007-04-29 00:40	406,528	--a------	C:\WINDOWS\system32\usp10.dll
2007-04-29 00:40	40,960	--a------	C:\WINDOWS\system32\ntmsapi.dll
2007-04-29 00:40	4,274,816	---------	C:\WINDOWS\system32\nv4_disp.dll
2007-04-29 00:40	4,096	---------	C:\WINDOWS\system32\dsprpres.dll
2007-04-29 00:40	395,776	--a------	C:\WINDOWS\system32\rpcss.dll
2007-04-29 00:40	393,216	--a------	C:\WINDOWS\system32\ssflwbox.scr
2007-04-29 00:40	385,536	--a------	C:\WINDOWS\system32\themeui.dll
2007-04-29 00:40	385,024	--a------	C:\WINDOWS\system32\qdvd.dll
2007-04-29 00:40	38,912	--a------	C:\WINDOWS\system32\sens.dll
2007-04-29 00:40	377,984	---------	C:\WINDOWS\system32\ati2dvaa.dll
2007-04-29 00:40	363,008	--a------	C:\WINDOWS\system32\smlogcfg.dll
2007-04-29 00:40	35,840	--a------	C:\WINDOWS\system32\umandlg.dll
2007-04-29 00:40	35,840	--a------	C:\WINDOWS\system32\rcimlby.exe
2007-04-29 00:40	35,328	--a------	C:\WINDOWS\system32\pid.dll
2007-04-29 00:40	34,816	--a------	C:\WINDOWS\system32\ssdpapi.dll
2007-04-29 00:40	33,840	--a------	C:\WINDOWS\system32\ntio.sys
2007-04-29 00:40	327,040	---------	C:\WINDOWS\system32\drivers\ati2mtaa.sys
2007-04-29 00:40	32,768	--a------	C:\WINDOWS\system32\odbcad32.exe
2007-04-29 00:40	313,856	--a------	C:\WINDOWS\system32\scesrv.dll
2007-04-29 00:40	31,744	---------	C:\WINDOWS\system32\drivers\atinxbxx.sys
2007-04-29 00:40	3,338	--a------	C:\WINDOWS\system32\redir.exe
2007-04-29 00:40	295,424	-ra------	C:\WINDOWS\system32\termsrv.dll
2007-04-29 00:40	283,648	--a------	C:\WINDOWS\winhlp32.exe
2007-04-29 00:40	283,648	--a------	C:\WINDOWS\system32\pdh.dll
2007-04-29 00:40	28,672	--a------	C:\WINDOWS\system32\nmmkcert.dll
2007-04-29 00:40	28,672	---------	C:\WINDOWS\system32\drivers\atinsnxx.sys
2007-04-29 00:40	270,848	---------	C:\WINDOWS\system32\sbe.dll
2007-04-29 00:40	266,752	--a------	C:\WINDOWS\system32\oakley.dll
2007-04-29 00:40	26,624	---------	C:\WINDOWS\system32\drivers\usbehci.sys
2007-04-29 00:40	26,112	--a------	C:\WINDOWS\system32\skeys.exe
2007-04-29 00:40	25,600	--a------	C:\WINDOWS\system32\udhisapi.dll
2007-04-29 00:40	25,088	--a------	C:\WINDOWS\system32\slayerxp.dll
2007-04-29 00:40	25,088	--a------	C:\WINDOWS\system32\shfolder.dll
2007-04-29 00:40	249,856	--a------	C:\WINDOWS\system32\odbc32.dll
2007-04-29 00:40	248,832	--a------	C:\WINDOWS\system32\newdev.dll
2007-04-29 00:40	246,302	--a------	C:\WINDOWS\system32\strmdll.dll
2007-04-29 00:40	246,272	--a------	C:\WINDOWS\system32\tapisrv.dll
2007-04-29 00:40	24,576	--a------	C:\WINDOWS\system32\odbcbcp.dll
2007-04-29 00:40	239,616	--a------	C:\WINDOWS\system32\upnpui.dll
2007-04-29 00:40	239,104	--a------	C:\WINDOWS\system32\srrstr.dll
2007-04-29 00:40	23,040	--a------	C:\WINDOWS\system32\setup.exe
2007-04-29 00:40	23,040	--a------	C:\WINDOWS\system32\psapi.dll
2007-04-29 00:40	218,624	--a------	C:\WINDOWS\system32\uxtheme.dll
2007-04-29 00:40	215,552	--a------	C:\WINDOWS\system32\osk.exe
2007-04-29 00:40	206,336	--a------	C:\WINDOWS\system32\rasppp.dll
2007-04-29 00:40	201,728	---------	C:\WINDOWS\system32\ati2dvag.dll
2007-04-29 00:40	20,992	--a------	C:\WINDOWS\system32\ssmarque.scr
2007-04-29 00:40	20,992	---------	C:\WINDOWS\system32\faxpatch.exe
2007-04-29 00:40	20,480	---------	C:\WINDOWS\system32\encapi.dll
2007-04-29 00:40	192,512	--a------	C:\WINDOWS\system32\qcap.dll
2007-04-29 00:40	190,976	--a------	C:\WINDOWS\system32\schedsvc.dll
2007-04-29 00:40	19,968	--a------	C:\WINDOWS\system32\ssbezier.scr
2007-04-29 00:40	19,968	--a------	C:\WINDOWS\system32\rdpsnd.dll
2007-04-29 00:40	187,392	--a------	C:\WINDOWS\system32\xpsp1res.dll
2007-04-29 00:40	186,368	---------	C:\WINDOWS\system32\encdec.dll
2007-04-29 00:40	185,344	--a------	C:\WINDOWS\system32\upnphost.dll
2007-04-29 00:40	181,760	--a------	C:\WINDOWS\system32\tapi32.dll
2007-04-29 00:40	180,224	--a------	C:\WINDOWS\system32\scecli.dll
2007-04-29 00:40	18,944	--a------	C:\WINDOWS\system32\ssmyst.scr
2007-04-29 00:40	18,944	--a------	C:\WINDOWS\system32\snmpapi.dll
2007-04-29 00:40	18,432	--a------	C:\WINDOWS\system32\ups.exe
2007-04-29 00:40	179,712	--a------	C:\WINDOWS\system32\ntmsdba.dll
2007-04-29 00:40	176,128	--a------	C:\WINDOWS\system32\winmm.dll
2007-04-29 00:40	174,592	--a------	C:\WINDOWS\system32\w32time.dll
2007-04-29 00:40	171,008	--a------	C:\WINDOWS\system32\sccsccp.dll
2007-04-29 00:40	170,496	--a------	C:\WINDOWS\system32\srsvc.dll
2007-04-29 00:40	17,920	--a------	C:\WINDOWS\system32\ping.exe
2007-04-29 00:40	17,664	--a------	C:\WINDOWS\system32\watchdog.sys
2007-04-29 00:40	169,984	--a------	C:\WINDOWS\system32\sccbase.dll
2007-04-29 00:40	16,896	--a------	C:\WINDOWS\system32\rassapi.dll
2007-04-29 00:40	16,384	--a------	C:\WINDOWS\system32\odbc32gt.dll
2007-04-29 00:40	159,232	---------	C:\WINDOWS\system32\sbeio.dll
2007-04-29 00:40	152,576	--a------	C:\WINDOWS\system32\rsaenh.dll
2007-04-29 00:40	15,104	---------	C:\WINDOWS\system32\drivers\hidir.sys
2007-04-29 00:40	147,968	--a------	C:\WINDOWS\system32\rdchost.dll
2007-04-29 00:40	147,456	--a------	C:\WINDOWS\system32\odbctrac.dll
2007-04-29 00:40	146,432	--a------	C:\WINDOWS\regedit.exe


----------



## monkeybubbles (Apr 26, 2007)

2007-04-29 00:40	143,872	--a------	C:\WINDOWS\system32\ntshrui.dll
2007-04-29 00:40	140,288	--a------	C:\WINDOWS\system32\sfc_os.dll
2007-04-29 00:40	14,336	--a------	C:\WINDOWS\system32\ssstars.scr
2007-04-29 00:40	14,336	--a------	C:\WINDOWS\system32\runonce.exe
2007-04-29 00:40	14,336	---------	C:\WINDOWS\system32\drivers\atinpdxx.sys
2007-04-29 00:40	136,704	--a------	C:\WINDOWS\system32\sti_ci.dll
2007-04-29 00:40	135,680	--a------	C:\WINDOWS\system32\webvw.dll
2007-04-29 00:40	135,680	--a------	C:\WINDOWS\system32\taskmgr.exe
2007-04-29 00:40	135,168	--a------	C:\WINDOWS\system32\odbcconf.dll
2007-04-29 00:40	134,656	---------	C:\WINDOWS\system32\mssap.dll
2007-04-29 00:40	132,608	--a------	C:\WINDOWS\system32\upnp.dll
2007-04-29 00:40	13,824	--a------	C:\WINDOWS\system32\rdsaddin.exe
2007-04-29 00:40	13,824	---------	C:\WINDOWS\system32\drivers\atinttxx.sys
2007-04-29 00:40	13,824	---------	C:\WINDOWS\system32\drivers\atinmdxx.sys
2007-04-29 00:40	13,568	---------	C:\WINDOWS\system32\drivers\wacompen.sys
2007-04-29 00:40	13,312	--a------	C:\WINDOWS\system32\sigtab.dll
2007-04-29 00:40	124,416	--a------	C:\WINDOWS\system32\wiadss.dll
2007-04-29 00:40	121,856	--a------	C:\WINDOWS\system32\stobject.dll
2007-04-29 00:40	120,832	--a------	C:\WINDOWS\system32\offfilt.dll
2007-04-29 00:40	12,672	---------	C:\WINDOWS\system32\drivers\mutohpen.sys
2007-04-29 00:40	12,416	---------	C:\WINDOWS\system32\drivers\tunmp.sys
2007-04-29 00:40	12,288	--a------	C:\WINDOWS\system32\tracert.exe
2007-04-29 00:40	12,288	--a------	C:\WINDOWS\system32\odbcp32r.dll
2007-04-29 00:40	118,784	--a------	C:\WINDOWS\system32\ntmarta.dll
2007-04-29 00:40	118,272	--a------	C:\WINDOWS\system32\umpnpmgr.dll
2007-04-29 00:40	112,128	--a------	C:\WINDOWS\system32\rastls.dll
2007-04-29 00:40	107,008	--a------	C:\WINDOWS\system32\oleprn.dll
2007-04-29 00:40	106,496	--a------	C:\WINDOWS\system32\odbccp32.dll
2007-04-29 00:40	104,960	---------	C:\WINDOWS\system32\drivers\atinrvxx.sys
2007-04-29 00:40	103,936	--a------	C:\WINDOWS\system32\nlhtml.dll
2007-04-29 00:40	1,897,408	---------	C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-04-29 00:40	1,677,312	---------	C:\WINDOWS\system32\wmvcore2.dll
2007-04-29 00:40	1,580,544	--a------	C:\WINDOWS\system32\sfcfiles.dll
2007-04-29 00:40	1,435,648	--a------	C:\WINDOWS\system32\query.dll
2007-04-29 00:40	1,287,680	--a------	C:\WINDOWS\system32\quartz.dll
2007-04-29 00:40	1,281,536	--a------	C:\WINDOWS\system32\ole32.dll
2007-04-29 00:40	1,057,760	---------	C:\WINDOWS\system32\ati3d2ag.dll
2007-04-29 00:39	97,280	--a------	C:\WINDOWS\system32\dpcdll.dll
2007-04-29 00:39	9,344	--a------	C:\WINDOWS\system32\framebuf.dll
2007-04-29 00:39	875,008	--a------	C:\WINDOWS\system32\netplwiz.dll
2007-04-29 00:39	87,552	--a------	C:\WINDOWS\system32\fldrclnr.dll
2007-04-29 00:39	87,040	--a------	C:\WINDOWS\system32\drmstor.dll
2007-04-29 00:39	83,456	--a------	C:\WINDOWS\system32\dpvsetup.exe
2007-04-29 00:39	82,432	--a------	C:\WINDOWS\system32\dmscript.dll
2007-04-29 00:39	82,432	--a------	C:\WINDOWS\system32\dfrgfat.exe
2007-04-29 00:39	81,920	--a------	C:\WINDOWS\system32\ils.dll
2007-04-29 00:39	80,384	--a------	C:\WINDOWS\system32\faultrep.dll
2007-04-29 00:39	78,848	--a------	C:\WINDOWS\system32\msiexec.exe
2007-04-29 00:39	78,336	--a------	C:\WINDOWS\system32\browsewm.dll
2007-04-29 00:39	74,752	--a------	C:\WINDOWS\system32\cryptdlg.dll
2007-04-29 00:39	73,728	--a------	C:\WINDOWS\system32\mscms.dll
2007-04-29 00:39	701,440	--a------	C:\WINDOWS\system32\msxml2.dll
2007-04-29 00:39	7,424	--a------	C:\WINDOWS\system32\kd1394.dll
2007-04-29 00:39	695,296	--a------	C:\WINDOWS\system32\drmv2clt.dll
2007-04-29 00:39	69,632	--a------	C:\WINDOWS\system32\msconf.dll
2007-04-29 00:39	69,120	--a------	C:\WINDOWS\system32\msctfp.dll
2007-04-29 00:39	69,120	--a------	C:\WINDOWS\system32\ciodm.dll
2007-04-29 00:39	68,608	--a------	C:\WINDOWS\system32\digest.dll
2007-04-29 00:39	678,400	--a------	C:\WINDOWS\system32\inetcomm.dll
2007-04-29 00:39	655,360	--a------	C:\WINDOWS\system32\mstscax.dll
2007-04-29 00:39	640,000	--a------	C:\WINDOWS\system32\dbghelp.dll
2007-04-29 00:39	628,224	--a------	C:\WINDOWS\system32\catsrvut.dll
2007-04-29 00:39	622,080	--a------	C:\WINDOWS\system32\netcfgx.dll
2007-04-29 00:39	62,976	--a------	C:\WINDOWS\system32\iesetup.dll
2007-04-29 00:39	61,440	--a------	C:\WINDOWS\system32\dmcompos.dll
2007-04-29 00:39	60,928	--a------	C:\WINDOWS\system32\dpnhupnp.dll
2007-04-29 00:39	60,416	--a------	C:\WINDOWS\system32\cryptsvc.dll
2007-04-29 00:39	59,904	--a------	C:\WINDOWS\system32\ipv6mon.dll
2007-04-29 00:39	59,904	--a------	C:\WINDOWS\system32\cabinet.dll
2007-04-29 00:39	58,880	--a------	C:\WINDOWS\system32\licwmi.dll
2007-04-29 00:39	57,856	--a------	C:\WINDOWS\system32\clusapi.dll
2007-04-29 00:39	57,344	--a------	C:\WINDOWS\system32\dpwsockx.dll
2007-04-29 00:39	56,832	--a------	C:\WINDOWS\system32\mshtmler.dll
2007-04-29 00:39	552,989	--a------	C:\WINDOWS\system32\msrepl40.dll
2007-04-29 00:39	55,808	--a------	C:\WINDOWS\system32\ipconfig.exe
2007-04-29 00:39	55,808	--a------	C:\WINDOWS\system32\eventlog.dll
2007-04-29 00:39	54,272	--a------	C:\WINDOWS\system32\ixsso.dll
2007-04-29 00:39	53,248	--a------	C:\WINDOWS\system32\ipv6.exe
2007-04-29 00:39	514,560	--a------	C:\WINDOWS\system32\logonui.exe
2007-04-29 00:39	512,512	--a------	C:\WINDOWS\system32\cryptui.dll
2007-04-29 00:39	512,029	--a------	C:\WINDOWS\system32\msexch40.dll
2007-04-29 00:39	498,205	--a------	C:\WINDOWS\system32\dxmasf.dll
2007-04-29 00:39	48,128	--a------	C:\WINDOWS\system32\docprop2.dll
2007-04-29 00:39	47,104	--a------	C:\WINDOWS\system32\cmdl32.exe
2007-04-29 00:39	425,472	--a------	C:\WINDOWS\system32\msdtcprx.dll
2007-04-29 00:39	421,919	--a------	C:\WINDOWS\system32\msrd2x40.dll
2007-04-29 00:39	42,537	--a------	C:\WINDOWS\system32\keyboard.sys
2007-04-29 00:39	42,496	--a------	C:\WINDOWS\system32\net.exe
2007-04-29 00:39	413,696	--a------	C:\WINDOWS\system32\msvcp60.dll
2007-04-29 00:39	407,552	--a------	C:\WINDOWS\system32\mstsc.exe
2007-04-29 00:39	407,040	--a------	C:\WINDOWS\system32\netlogon.dll
2007-04-29 00:39	4,608	--a------	C:\WINDOWS\system32\msimg32.dll
2007-04-29 00:39	4,126	--a------	C:\WINDOWS\system32\msdxmlc.dll
2007-04-29 00:39	399,872	--a------	C:\WINDOWS\system32\lmrt.dll
2007-04-29 00:39	380,957	--a------	C:\WINDOWS\system32\expsrv.dll
2007-04-29 00:39	38,912	--a------	C:\WINDOWS\system32\dfrgsnap.dll
2007-04-29 00:39	38,912	--a------	C:\WINDOWS\system32\cfgbkend.dll
2007-04-29 00:39	375,296	--a------	C:\WINDOWS\system32\dpnet.dll
2007-04-29 00:39	368,710	--a------	C:\WINDOWS\system32\msisam11.dll
2007-04-29 00:39	36,921	--a------	C:\WINDOWS\system32\imeshare.dll
2007-04-29 00:39	36,352	--a------	C:\WINDOWS\system32\ncobjapi.dll
2007-04-29 00:39	358,976	--a------	C:\WINDOWS\system32\msjetoledb40.dll
2007-04-29 00:39	35,840	--a------	C:\WINDOWS\system32\imgutil.dll
2007-04-29 00:39	35,840	--a------	C:\WINDOWS\system32\dmloader.dll
2007-04-29 00:39	35,328	--a------	C:\WINDOWS\system32\dpnhpast.dll
2007-04-29 00:39	348,189	--a------	C:\WINDOWS\system32\msxbde40.dll
2007-04-29 00:39	348,189	--a------	C:\WINDOWS\system32\mspbde40.dll
2007-04-29 00:39	344,064	--a------	C:\WINDOWS\system32\hnetcfg.dll
2007-04-29 00:39	343,040	--a------	C:\WINDOWS\system32\msvcrt.dll
2007-04-29 00:39	343,040	--a------	C:\WINDOWS\system32\mspaint.exe
2007-04-29 00:39	343,040	--a------	C:\WINDOWS\system32\cmdial32.dll
2007-04-29 00:39	34,560	--a------	C:\WINDOWS\system32\mnmdd.dll
2007-04-29 00:39	331,264	--a------	C:\WINDOWS\system32\ipnathlp.dll
2007-04-29 00:39	330,752	--a------	C:\WINDOWS\system32\ippromon.dll
2007-04-29 00:39	329,728	--a------	C:\WINDOWS\system32\netsetup.exe
2007-04-29 00:39	326,656	--a------	C:\WINDOWS\system32\cscui.dll
2007-04-29 00:39	319,517	--a------	C:\WINDOWS\system32\msexcl40.dll
2007-04-29 00:39	304,128	--a------	C:\WINDOWS\system32\duser.dll
2007-04-29 00:39	299,520	--a------	C:\WINDOWS\system32\drmclien.dll
2007-04-29 00:39	294,400	--a------	C:\WINDOWS\system32\msctf.dll
2007-04-29 00:39	294,400	--a------	C:\WINDOWS\system32\kerberos.dll
2007-04-29 00:39	290,816	--a------	C:\WINDOWS\system32\msnsspc.dll
2007-04-29 00:39	282,624	--a------	C:\WINDOWS\system32\devmgr.dll
2007-04-29 00:39	28,672	--a------	C:\WINDOWS\system32\dmband.dll
2007-04-29 00:39	28,672	--a------	C:\WINDOWS\system32\dfsshlex.dll
2007-04-29 00:39	28,672	--a------	C:\WINDOWS\system32\dbnmpntw.dll
2007-04-29 00:39	274,944	--a------	C:\WINDOWS\system32\mstask.dll
2007-04-29 00:39	271,360	--a------	C:\WINDOWS\system32\msihnd.dll
2007-04-29 00:39	27,648	--a------	C:\WINDOWS\system32\conime.exe
2007-04-29 00:39	266,240	--a------	C:\WINDOWS\system32\ddraw.dll
2007-04-29 00:39	259,072	--a------	C:\WINDOWS\system32\msnetobj.dll
2007-04-29 00:39	258,077	--a------	C:\WINDOWS\system32\mstext40.dll
2007-04-29 00:39	253,952	--a------	C:\WINDOWS\system32\icm32.dll
2007-04-29 00:39	252,928	--a------	C:\WINDOWS\system32\msoeacct.dll
2007-04-29 00:39	252,928	--a------	C:\WINDOWS\system32\compatui.dll
2007-04-29 00:39	25,088	--a------	C:\WINDOWS\system32\mslbui.dll
2007-04-29 00:39	25,088	--a------	C:\WINDOWS\system32\defrag.exe
2007-04-29 00:39	248,832	--a------	C:\WINDOWS\system32\msieftp.dll
2007-04-29 00:39	243,200	--a------	C:\WINDOWS\system32\es.dll
2007-04-29 00:39	241,725	--a------	C:\WINDOWS\system32\msuni11.dll
2007-04-29 00:39	241,693	--a------	C:\WINDOWS\system32\msjtes40.dll
2007-04-29 00:39	240,640	--a------	C:\WINDOWS\system32\mpg4dmod.dll
2007-04-29 00:39	24,576	--a------	C:\WINDOWS\system32\dbmsvinn.dll
2007-04-29 00:39	24,576	--a------	C:\WINDOWS\system32\dbmsrpcn.dll
2007-04-29 00:39	24,064	--a------	C:\WINDOWS\system32\pidgen.dll
2007-04-29 00:39	239,104	--a------	C:\WINDOWS\system32\dsquery.dll
2007-04-29 00:39	23,040	--a------	C:\WINDOWS\system32\ersvc.dll
2007-04-29 00:39	220,672	--a------	C:\WINDOWS\system32\logon.scr
2007-04-29 00:39	22,016	--a------	C:\WINDOWS\system32\licmgr10.dll
2007-04-29 00:39	216,064	--a------	C:\WINDOWS\system32\moricons.dll
2007-04-29 00:39	213,023	--a------	C:\WINDOWS\system32\msltus40.dll
2007-04-29 00:39	212,480	--a------	C:\WINDOWS\system32\dpvoice.dll
2007-04-29 00:39	21,504	--a------	C:\WINDOWS\system32\hidserv.dll
2007-04-29 00:39	207,360	--a------	C:\WINDOWS\system32\mobsync.dll
2007-04-29 00:39	204,288	--a------	C:\WINDOWS\system32\mswebdvd.dll
2007-04-29 00:39	20,992	--a------	C:\WINDOWS\system32\fontview.exe
2007-04-29 00:39	20,480	--a------	C:\WINDOWS\system32\dbmsadsn.dll
2007-04-29 00:39	2,890,240	--a------	C:\WINDOWS\system32\msi.dll
2007-04-29 00:39	198,144	--a------	C:\WINDOWS\system32\netman.dll
2007-04-29 00:39	195,072	--a------	C:\WINDOWS\system32\msutb.dll
2007-04-29 00:39	194,560	--a------	C:\WINDOWS\system32\certcli.dll
2007-04-29 00:39	193,024	--a------	C:\WINDOWS\system32\eudcedit.exe
2007-04-29 00:39	183,296	--a------	C:\WINDOWS\system32\els.dll
2007-04-29 00:39	182,784	--a------	C:\WINDOWS\system32\ipsecsvc.dll
2007-04-29 00:39	181,760	--a------	C:\WINDOWS\system32\dinput8.dll
2007-04-29 00:39	181,248	--a------	C:\WINDOWS\system32\dmime.dll
2007-04-29 00:39	180,224	--a------	C:\WINDOWS\system32\dwwin.exe
2007-04-29 00:39	18,944	--a------	C:\WINDOWS\system32\nddenb32.dll
2007-04-29 00:39	163,840	--a------	C:\WINDOWS\system32\mindex.dll
2007-04-29 00:39	163,840	--a------	C:\WINDOWS\system32\credui.dll
2007-04-29 00:39	16,384	--a------	C:\WINDOWS\system32\ds32gt.dll
2007-04-29 00:39	159,232	--a------	C:\WINDOWS\system32\msimtf.dll
2007-04-29 00:39	159,232	--a------	C:\WINDOWS\system32\dinput.dll
2007-04-29 00:39	151,552	--a------	C:\WINDOWS\system32\msdart.dll
2007-04-29 00:39	150,016	--a------	C:\WINDOWS\system32\imapi.exe
2007-04-29 00:39	15,360	--a------	C:\WINDOWS\system32\ctfmon.exe
2007-04-29 00:39	143,360	--a------	C:\WINDOWS\system32\msorcl32.dll
2007-04-29 00:39	142,336	--a------	C:\WINDOWS\system32\dsprop.dll
2007-04-29 00:39	137,216	--a------	C:\WINDOWS\system32\dssenh.dll
2007-04-29 00:39	124,928	--a------	C:\WINDOWS\system32\net1.exe
2007-04-29 00:39	123,904	--a------	C:\WINDOWS\system32\dfrgui.dll
2007-04-29 00:39	123,392	--a------	C:\WINDOWS\system32\mplay32.exe
2007-04-29 00:39	123,392	--a------	C:\WINDOWS\system32\input.dll
2007-04-29 00:39	120,832	--a------	C:\WINDOWS\system32\msvfw32.dll
2007-04-29 00:39	120,832	--a------	C:\WINDOWS\system32\idq.dll
2007-04-29 00:39	12,288	--a------	C:\WINDOWS\system32\mstinit.exe
2007-04-29 00:39	12,288	--a------	C:\WINDOWS\system32\mscpx32r.dll
2007-04-29 00:39	111,104	--a------	C:\WINDOWS\system32\netdde.exe
2007-04-29 00:39	111,104	--a------	C:\WINDOWS\system32\dgnet.dll
2007-04-29 00:39	110,592	--a------	C:\WINDOWS\system32\dbnetlib.dll
2007-04-29 00:39	110,080	--a------	C:\WINDOWS\system32\imm32.dll
2007-04-29 00:39	11,776	--a------	C:\WINDOWS\system32\localui.dll
2007-04-29 00:39	11,264	--a------	C:\WINDOWS\system32\msrle32.dll
2007-04-29 00:39	11,264	--a------	C:\WINDOWS\system32\icaapi.dll
2007-04-29 00:39	105,984	--a------	C:\WINDOWS\system32\msoert2.dll
2007-04-29 00:39	105,984	--a------	C:\WINDOWS\system32\dmstyle.dll
2007-04-29 00:39	104,448	--a------	C:\WINDOWS\system32\dmusic.dll
2007-04-29 00:39	102,912	--a------	C:\WINDOWS\system32\clipbrd.exe
2007-04-29 00:39	10,752	--a------	C:\WINDOWS\system32\dumprep.exe
2007-04-29 00:39	1,788	--a------	C:\WINDOWS\system32\dcache.bin
2007-04-29 00:39	1,708,032	--a------	C:\WINDOWS\system32\netshell.dll
2007-04-29 00:39	1,507,356	--a------	C:\WINDOWS\system32\msjet40.dll
2007-04-29 00:39	1,428,480	--a------	C:\WINDOWS\system32\msvidctl.dll
2007-04-29 00:39	1,298,432	--a------	C:\WINDOWS\system32\dxdiag.exe
2007-04-29 00:39	1,251,840	--a------	C:\WINDOWS\system32\comsvcs.dll
2007-04-29 00:39	1,236,480	--a------	C:\WINDOWS\system32\msxml3.dll
2007-04-29 00:39	1,192,960	--a------	C:\WINDOWS\system32\mmcndmgr.dll
2007-04-29 00:39	1,179,648	--a------	C:\WINDOWS\system32\d3d8.dll
2007-04-29 00:39	1,032,192	--a------	C:\WINDOWS\explorer.exe
2007-04-29 00:38	84,992	--a------	C:\WINDOWS\system32\avifil32.dll
2007-04-29 00:38	8,704	--a------	C:\WINDOWS\system32\batt.dll
2007-04-29 00:38	77,312	--a------	C:\WINDOWS\system32\browser.dll
2007-04-29 00:38	63,488	--a------	C:\WINDOWS\system32\browselc.dll
2007-04-29 00:37	58,880	--a------	C:\WINDOWS\system32\atl.dll
2007-04-29 00:37	42,496	--a------	C:\WINDOWS\system32\audiosrv.dll
2007-04-29 00:37 11,264	--a------	C:\WINDOWS\system32\autolfn.exe
2007-04-29 00:34	25,088	--a------	C:\WINDOWS\system32\at.exe
2007-04-29 00:34	117	--a------	C:\WINDOWS\system32\aaarggp.bat
2007-04-29 00:33	98,304	--a------	C:\WINDOWS\system32\ahui.exe
2007-04-29 00:33	44,544	--a------	C:\WINDOWS\system32\alg.exe
2007-04-29 00:33	37,376	---------	C:\WINDOWS\system32\drivers\amdk7.sys
2007-04-29 00:33	263,680	--a------	C:\WINDOWS\system32\adsnt.dll
2007-04-29 00:33	126,976	--a------	C:\WINDOWS\system32\apphelp.dll
2007-04-29 00:32	68,096	--a------	C:\WINDOWS\system32\adsmsext.dll
2007-04-29 00:32	175,616	--a------	C:\WINDOWS\system32\adsldp.dll
2007-04-29 00:32	143,360	--a------	C:\WINDOWS\system32\adsldpc.dll
2007-04-29 00:30	100,352	--a------	C:\WINDOWS\system32\6to4svc.dll
2007-04-29 00:25	24,576	--a------	C:\WINDOWS\system32\xpsp1hfm.exe
2007-04-29 00:25 d--h-c---	C:\WINDOWS\$xpsp1hfm$
2007-04-29 00:25 d--------	C:\WINDOWS\system32\ReinstallBackups
2007-04-29 00:22 d--------	C:\9fdb6525d69c224452fa4
2007-04-28 18:09	125	--a------	C:\WINDOWS\system32\fjnsbn.bat
2007-04-28 15:31	24	--a------	C:\WINDOWS\system32\g.bat
2007-04-28 15:02	117	--a------	C:\WINDOWS\system32\bjlhfhv.bat
2007-04-27 14:23 d--------	C:\WINDOWS\system32\Kaspersky Lab
2007-04-27 14:23 d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-04-27 14:03 d---s----	C:\Documents and Settings\Owner\UserData
2007-04-27 14:03 d---s----	C:\DOCUME~1\Owner\UserData
2007-04-27 12:57 d--------	C:\VundoFix Backups
2007-04-27 12:13	262,144	--a------	C:\DOCUME~1\ALLUSE~1\ntuser.dat
2007-04-27 12:08	49,152	--a------	C:\WINDOWS\nircmd.exe
2007-04-27 11:01	44	--a------	C:\WINDOWS\sys.bat
2007-04-27 11:01	16,721	--a------	C:\WINDOWS\system32\mn.dll
2007-04-26 15:49	130	--a------	C:\WINDOWS\system32\eofrwchw.bat
2007-04-26 13:56	516,096	--a------	C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-04-26 12:44	4	--a------	C:\WINDOWS\system32\stfv.bin
2007-04-26 12:43	12	--a------	C:\WINDOWS\system32\sl.bin
2007-04-26 12:40	24,320	--a------	C:\WINDOWS\system32\WER8274.DLL
2007-04-26 12:40	22,528	--a------	C:\WINDOWS\bjam.dll
2007-04-26 12:40	22,016	--a------	C:\WINDOWS\system32\MSIXU.DLL
2007-04-26 12:40	20,480	--a------	C:\WINDOWS\cdsm32.dll
2007-04-26 12:40	18,944	--a------	C:\WINDOWS\system32\wml.exe
2007-04-26 12:40	12	--a------	C:\WINDOWS\system32\gtv_sd.bin


----------



## monkeybubbles (Apr 26, 2007)

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-09 02:48:28	--------	d-----w	C:\Program Files\Common Files\Symantec Shared
2007-05-07 01:04:33	--------	d-----w	C:\Program Files\Messenger
2007-05-07 01:03:56	--------	d-----w	C:\Program Files\Movie Maker
2007-05-07 00:57:54	--------	d-----w	C:\Program Files\Windows NT
2007-04-30 02:59:04	--------	d--h--w	C:\Program Files\Common Files\delsim
2007-04-27 18:36:45	--------	d-----w	C:\Program Files\Azureus
2007-04-23 23:55:26	--------	d-----w	C:\DOCUME~1\Owner\APPLIC~1\Azureus
2007-04-22 05:39:27	121	----a-w	C:\WINDOWS\system32\esaxqqvn.bat
2007-04-22 04:52:08	--------	d--h--w	C:\Program Files\WindowsUpdate
2007-04-22 04:17:32	23,316	----a-w	C:\WINDOWS\system32\emptyregdb.dat
2007-04-21 23:07:54	--------	d-----w	C:\DOCUME~1\Owner\APPLIC~1\vlc
2007-04-21 23:02:07	--------	d-----w	C:\Program Files\DivX
2007-04-21 22:58:18	--------	d-----w	C:\Program Files\VideoLAN
2007-04-20 07:16:45	--------	d-----w	C:\DOCUME~1\Owner\APPLIC~1\Leadertech
2007-04-20 04:57:43	--------	d-----w	C:\DOCUME~1\Owner\APPLIC~1\AdobeAUM
2007-04-20 04:57:41	--------	d-----w	C:\DOCUME~1\Owner\APPLIC~1\AdobeUM
2007-04-20 03:41:29	--------	d-----w	C:\Program Files\Lavasoft
2007-04-17 05:07:18	--------	d-----w	C:\Program Files\PowerISO
2007-04-17 04:47:41	--------	d-----w	C:\Program Files\Microsoft Picture It! 7
2007-04-17 04:17:32	--------	d-----w	C:\Program Files\Canon
2007-04-17 03:11:40	--------	d-----w	C:\Program Files\MSN Messenger
2007-04-17 02:52:04	--------	d-----w	C:\DOCUME~1\Owner\APPLIC~1\Lavasoft
2007-04-15 04:08:15	671	----a-w	C:\WINDOWS\mozver.dat
2007-04-15 02:53:22	499,712	----a-w	C:\WINDOWS\system32\msvcp71.dll
2007-04-15 02:40:33	0	----a-w	C:\WINDOWS\nsreg.dat
2007-04-15 02:39:45	5,805,656	----a-w	C:\Program Files\Firefox Setup 2.0.0.3.exe
2007-04-15 02:16:40	--------	d--h--w	C:\Program Files\InstallShield Installation Information
2007-04-15 02:16:40	--------	d-----w	C:\Program Files\Analog Devices
2007-04-15 02:16:28	--------	d-----w	C:\Program Files\Common Files\InstallShield
2007-04-15 02:14:53	--------	d-----w	C:\Program Files\Intel
2007-04-15 00:28:16	--------	d-----w	C:\Program Files\UIU
2007-04-15 00:28:09	--------	d-----w	C:\Program Files\3Com Corporation
2007-04-15 00:21:01	--------	d-----w	C:\DOCUME~1\Owner\APPLIC~1\Share-to-Web Upload Folder
2007-04-15 00:20:57	--------	d-----w	C:\Program Files\Hewlett-Packard
2007-04-15 00:20:52	--------	d-----w	C:\Program Files\Common Files\Hewlett-Packard
2007-04-14 23:39:56	--------	d-----w	C:\Program Files\Microsoft Visual Studio .NET 2003
2007-04-14 23:39:41	--------	d-----w	C:\Program Files\Common Files\Crystal Decisions
2007-04-14 23:38:43	--------	d-----w	C:\Program Files\Microsoft SQL Server
2007-04-14 23:25:29	--------	d-----w	C:\Program Files\Microsoft ActiveSync
2007-04-14 23:12:14	--------	d-----w	C:\Program Files\microsoft frontpage
2007-04-14 23:11:29	0	--sha-r	C:\MSDOS.SYS
2007-04-14 23:11:29	0	--sha-r	C:\IO.SYS
2007-04-14 23:11:29	0	----a-w	C:\CONFIG.SYS
2007-04-14 23:11:29	0	------w	C:\AUTOEXEC.BAT
2007-04-14 23:10:19	--------	d-----w	C:\Program Files\Online Services
2007-04-14 23:08:35	--------	d-----w	C:\Program Files\Common Files\MSSoap
2007-04-14 23:07:24	--------	d-----w	C:\Program Files\MSN Gaming Zone
2007-04-14 16:01:05	--------	d-----w	C:\Program Files\Common Files\ODBC
2007-04-14 16:01:01	--------	d-----w	C:\Program Files\Common Files\SpeechEngines

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 23:08]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2006-03-17 19:24]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-24 21:20]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
"RegistryMechanic"="" []
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-05-22 21:05]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-05-01 09:29]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"="C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 13:55]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced DHTML Enable]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\System32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINDOWS\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINDOWS\System32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
C:\Program Files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tcpipmon]
tcpipmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Network Firewall]

********************************************************************

catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-26 17:38:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

********************************************************************

Completion time: 2007-05-26 17:41:42 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-05-26 17:40
C:\ComboFix2.txt ... 2007-05-03 18:38
C:\ComboFix3.txt ... 2007-05-03 18:36

--- E O F ---


----------



## sjpritch25 (Sep 8, 2005)

Please perform a scan with *Kaspersky Webscan Online Virus Scanner*
1. Click the "*Kaspersky Online Scanner*" button (*NOT* "Kaspersky File Scanner").
2. Read the Requirements and Privacy statement, then select "*Accept*".
3. A new window will appear promting you to install an ActiveX component from Kaspersky - "*Do you want to install this software*?".
4. Click "*Yes* or select "*Install*" to download the ActiveX controls that allows ActiveScan to run.
5. When the download is complete it will say ready, click "*Next*".
6. Click "*Scan Settings*" and check the option to use the *Extended Database* if available otherwise Standard).
7. Click "*Scan Options*" and select both "*Scan Archives*" and "*Scan Mail Bases*".
8. Click "*OK*".
9. Under "*Select a target to scan*", click on "*My Computer*".
10. When the scan is complete choose to save the results as "*Save as Text*" named kaspersky.txt to your desktop and post them in your next reply.

Kaspersky does not remove anything but will provide a log of anything it finds. On August 8th, 2006 Kaspersky updated the software used for _Free Online Virus Scanner_. In order to continue using the online scanner you will need to uninstall the old version (if previously used) from your Add/Remove Programs list and then install the latest version. To do this, follow the steps *here* and reboot afterwards if your system does not reboot automatically or it will show '_Kaspersky Online Scanner license key was not found!_


----------



## monkeybubbles (Apr 26, 2007)

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, May 27, 2007 11:43:41 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 27/05/2007
Kaspersky Anti-Virus database records: 330586
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 30618
Number of viruses found: 1
Number of infected objects: 1 / 0
Number of suspicious objects: 0
Duration of the scan process: 00:47:02

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Avg7\Log\emc.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\AvgFwLog.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\AvgFwLog.log.lck	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Cookies\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG	Object is locked	skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG	Object is locked	skipped
C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.LOG	Object is locked	skipped
C:\Documents and Settings\Owner\Cookies\index.dat	Object is locked	skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\Owner\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\Owner\ntuser.dat.LOG	Object is locked	skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\master.mdf	Object is locked	skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\mastlog.ldf	Object is locked	skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\model.mdf	Object is locked	skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\modellog.ldf	Object is locked	skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\tempdb.mdf	Object is locked	skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\templog.ldf	Object is locked	skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\LOG\ERRORLOG	Object is locked	skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\clcl5.exe.vir	Infected: Trojan-Downloader.Win32.Agent.es	skipped
C:\System Volume Information\MountPointManagerRemoteDatabase	Object is locked	skipped
C:\WINDOWS\Debug\PASSWD.LOG	Object is locked	skipped
C:\WINDOWS\Sti_Trace.log	Object is locked	skipped
C:\WINDOWS\system32\config\AppEvent.Evt	Object is locked	skipped
C:\WINDOWS\system32\config\default	Object is locked	skipped
C:\WINDOWS\system32\config\default.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\SAM	Object is locked	skipped
C:\WINDOWS\system32\config\SAM.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\SecEvent.Evt	Object is locked	skipped
C:\WINDOWS\system32\config\SECURITY	Object is locked	skipped
C:\WINDOWS\system32\config\SECURITY.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\software	Object is locked	skipped
C:\WINDOWS\system32\config\software.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\SysEvent.Evt	Object is locked	skipped
C:\WINDOWS\system32\config\system	Object is locked	skipped
C:\WINDOWS\system32\config\system.LOG	Object is locked	skipped
C:\WINDOWS\system32\mn.dll	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP	Object is locked	skipped
C:\WINDOWS\temp\Perflib_Perfdata_664.dat	Object is locked	skipped
C:\WINDOWS\wiadebug.log	Object is locked	skipped
C:\WINDOWS\wiaservc.log	Object is locked	skipped
C:\WINDOWS\WindowsUpdate.log	Object is locked	skipped
C:\_OTMoveIt\MovedFiles\Documents and Settings\Owner\Local Settings\Temp\0362.exe	Object is locked	skipped
C:\_OTMoveIt\MovedFiles\Documents and Settings\Owner\Local Settings\Temp\2712.exe	Object is locked	skipped

Scan process completed.


----------



## sjpritch25 (Sep 8, 2005)

How is everything running????


----------



## monkeybubbles (Apr 26, 2007)

it seems to be pretty good. but still no firewall


----------



## sjpritch25 (Sep 8, 2005)

Do you mean AVG is disabled??? Please be more specific. Thanks.


----------



## monkeybubbles (Apr 26, 2007)

the AVG is disabled and so is my windows firewall. when i try to turn on my AVG one it says there's a pop up that says an error occured. and when i try to turn on my windows firewall everything is stuck i can't change any of my settings.


----------



## sjpritch25 (Sep 8, 2005)

Please download the attached file named *sharedaccess.zip*, Unzip/Extract sharedaccess.reg to your Desktop. Double-click on sharedaccess.reg and allow it to be merged into Windows Registry.
Please go to *Start*-->*Run*-->In the space provided, type *cmd*. Windows Command prompt will appear, type the following command and press *Enter*


> netsh firewall reset



Open *Windows Firewall control Panel and enable it.
[*]Please reboot your computer and let me know if its working. Thanks*


----------



## monkeybubbles (Apr 26, 2007)

so far it is working well.


----------



## sjpritch25 (Sep 8, 2005)

Post a fresh Hijackthis log. Thanks.


----------



## monkeybubbles (Apr 26, 2007)

Logfile of HijackThis v1.99.1
Scan saved at 8:01:40 PM, on 31/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by SHAW Internet
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe


----------



## monkeybubbles (Apr 26, 2007)

I'm also still getting a lil pop up that says my firewall has been turned off but when I go to the security centre and check it says it's on.


----------



## sjpritch25 (Sep 8, 2005)

Does this say it at bootup or all the time???


----------



## monkeybubbles (Apr 26, 2007)

all the time. it just pops up. and it doesn't look like a popup that belongs to any of the programs i have.


----------



## sjpritch25 (Sep 8, 2005)

Windows Firewall or AVG???


----------



## monkeybubbles (Apr 26, 2007)

it turns off AVG but my windows firewall says firewall is still working.


----------



## sjpritch25 (Sep 8, 2005)

You don't need two firewalls running, so turn off Windows Firewall and see if AVG will work. If not, then disable AVG and turn Windows Firewall back on. Let me know if that works. :up:


----------



## monkeybubbles (Apr 26, 2007)

I tried to disable my windows firewall but it wouldn't let me. I says that it is turned off and won't let me turn it on. but when you just go to the security centre it says that it is on but it's actually not. and my AVG wont turn on.


----------



## sjpritch25 (Sep 8, 2005)

Please post a fresh Hijackthis log. Thanks.


----------



## monkeybubbles (Apr 26, 2007)

Logfile of HijackThis v1.99.1
Scan saved at 1:41:54 PM, on 03/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Documents and Settings\Owner\Desktop\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by SHAW Internet
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe


----------



## sjpritch25 (Sep 8, 2005)

About Windows Firewall, i know Zonealarm automatically turns off Windows Firewall. So AVG might do the same. Since you still can't get AVG to run, i would try to re-install it. Let me know if that works.


----------



## monkeybubbles (Apr 26, 2007)

could it be because i have superantispyware on there running too?


----------



## monkeybubbles (Apr 26, 2007)

when i uninstalled avg and then tried to turn on windowns firewall it still wouldn't turn on. i've reinstalled avg and it says that it's running.


----------



## sjpritch25 (Sep 8, 2005)

Okay, let me know if AVG's firewall becomes disabled.


----------



## monkeybubbles (Apr 26, 2007)

so far everything has been working well. Thanks for everything


----------



## sjpritch25 (Sep 8, 2005)

Your Welcome

Now that your system is clean you should *SET A NEW RESTORE POINT* *to prevent future reinfection from the old restore point AFTER cleaning your system of any malware infection*. Any trojans or spyware you picked up could have been saved in System Restore and are waiting to re-infect you. Since System Restore is a protected directory, your tools can not access it to delete files, trapping viruses inside. Setting a new restore point should be done to prevent any future reinfection from the old restore point and enable your computer to "roll-back" in case there is a future problem.

To *SET A NEW RESTORE POINT*:
1. Go to *Start* > *Programs* > *Accessories* > *System Tools* and click "*System Restore*".
2. Choose the radio button marked "*Create a Restore Point*" on the first screen then click "*Next*". Give the R.P. a name then click "*Create*". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
3. Then go to *Start* > *Run* and type: *Cleanmgr*
4. Click "*OK*".
5. Click the "*More Options*" Tab.
6. Click "*Clean Up*" in the System Restore section to remove all previous restore points except the newly created one.

Graphics for doing this are in the following links if you need them.
*How to Create a Restore Point*.
*How to use Cleanmgr*.

======================================

Here is some useful information on keeping your computer clean:
Most important thing is to make sure Windows is kept up to date with the latest patches and updates from Windows Update.
If you don't have a *Firewall* installed, please choose from the following:
*ZoneAlarm Free*
*Kerio Personal Firewall*

If you don't have a *Anti-Virus* installed, please download the following free program:
*AntiVir Personal Edition*

Here are two great Preventive programs:
SpywareBlaster protects you from malicious ActiveX controls and cookies. Make sure and check for updates twice a month.
IESpyads adds a long list of bad sites to your Restricted sites in *Internet Explorer* and protects against drive by downloads.

Surf Safe with McAfee's SiteAdisor. SiteAdisor will work with *Internet Explorer* and *Mozilla Firefox*. SiteAdisor is a browser plugin that assigns a safety rating to domains listed in your search engine. SiteAdvisor uses the following color codes to indicate the safety level of each site.
Red for *Warning*
Yellow for *Use Caution*
Green for *Safe*
Grey for *Unknown*

Here are the link to install SiteAdisor in Internet Explorer and Firefox
Anti-Spyware Programs I Recommend:
Lavasoft's Ad-Aware SE Personal
SuperAnti-Spyware

For Even More Information On Securing Your Computer read *Tony Klein's* So How Did I Get Infected In The First Place]


----------



## monkeybubbles (Apr 26, 2007)

thanks again i'll be getting those programs for sure. take care


----------

