# Alureon.H Removal



## HoserIN (May 27, 2010)

Hello, 

I have recently discovered that I have the Alureon.h virus and MSE seems to remove it every night when the scan runs. Obviously this is not taking care of the issue. I have seen many other people with the same issue and was wondering if I could get a little help with mine. 

Thank you in advance,
Jose


----------



## Rorschach112 (Oct 12, 2008)

Download *TDSSKiller* and save it to your Desktop.


Extract the file and run it.
Once completed it will create a log in your *C:\* drive
Please post the contents of that log


----------



## HoserIN (May 27, 2010)

18:06:59:453 3636 TDSS rootkit removing tool 2.3.1.0 May 25 2010 12:52:14
18:06:59:453 3636 ================================================================================
18:06:59:453 3636 SystemInfo:

18:06:59:453 3636 OS Version: 5.1.2600 ServicePack: 2.0
18:06:59:453 3636 Product type: Workstation
18:06:59:453 3636 ComputerName: DESKTOPSANCHEZ
18:06:59:453 3636 UserName: Jose Sanchez II
18:06:59:453 3636 Windows directory: C:\WINDOWS
18:06:59:453 3636 Processor architecture: Intel x86
18:06:59:453 3636 Number of processors: 4
18:06:59:453 3636 Page size: 0x1000
18:06:59:453 3636 Boot type: Normal boot
18:06:59:453 3636 ================================================================================
18:06:59:859 3636 Initialize success
18:06:59:859 3636 
18:06:59:859 3636 Scanning Services ...
18:07:00:437 3636 Raw services enum returned 354 services
18:07:00:453 3636 
18:07:00:453 3636 Scanning Drivers ...
18:07:03:218 3636 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
18:07:03:281 3636 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
18:07:03:343 3636 adfs (73685e15ef8b0bd9c30f1af413f13d49) C:\WINDOWS\system32\drivers\adfs.sys
18:07:03:421 3636 aec (841f385c6cfaf66b58fbd898722bb4f0) C:\WINDOWS\system32\drivers\aec.sys
18:07:03:437 3636 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys
18:07:03:515 3636 AnyDVD (b8f9d3ae038810c6ea08e123cada765e) C:\WINDOWS\system32\Drivers\AnyDVD.sys
18:07:03:625 3636 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
18:07:03:640 3636 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
18:07:03:750 3636 ati2mtag (81c3e6674d0609aa84c07681bca252de) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
18:07:03:812 3636 AtiHdmiService (eaece4a0d90d6e1fbe068cce9efd73a0) C:\WINDOWS\system32\drivers\AtiHdmi.sys
18:07:03:859 3636 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
18:07:03:953 3636 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
18:07:03:968 3636 AvgLdx86 (9c0a7e6d3cb9a8a7ad4e4575d9a42e94) C:\WINDOWS\system32\Drivers\avgldx86.sys
18:07:04:031 3636 AvgMfx86 (f9caeec3ff1545991f490264429724c5) C:\WINDOWS\system32\Drivers\avgmfx86.sys
18:07:04:046 3636 AvgTdiX (cf9ac576490bb6c547cd16ef0b782358) C:\WINDOWS\system32\Drivers\avgtdix.sys
18:07:04:109 3636 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
18:07:04:328 3636 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
18:07:04:359 3636 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
18:07:04:437 3636 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
18:07:04:468 3636 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
18:07:04:593 3636 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
18:07:04:687 3636 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
18:07:04:750 3636 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
18:07:04:781 3636 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys
18:07:04:781 3636 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
18:07:04:828 3636 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
18:07:04:859 3636 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
18:07:04:921 3636 e1express (34aaa3b298a852b3663e6e0d94d12945) C:\WINDOWS\system32\DRIVERS\e1e5132.sys
18:07:04:937 3636 ElbyCDIO (44996a2addd2db7454f2ca40b67d8941) C:\WINDOWS\system32\Drivers\ElbyCDIO.sys
18:07:05:000 3636 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
18:07:05:000 3636 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
18:07:05:015 3636 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
18:07:05:062 3636 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\drivers\Flpydisk.sys
18:07:05:156 3636 FltMgr (54fd90f0038f07920cb9fb6591bde82f) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
18:07:05:156 3636 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
18:07:05:171 3636 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
18:07:05:234 3636 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
18:07:05:296 3636 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
18:07:05:359 3636 HDAudBus (3fcc124b6e08ee0e9351f717dd136939) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
18:07:05:359 3636 hidusb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
18:07:05:437 3636 HPZid412 (863cc3a82c63c9f60acf2e85d5310620) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
18:07:05:437 3636 HPZipr12 (08cb72e95dd75b61f2966b311d0e4366) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
18:07:05:437 3636 HPZius12 (ca990306ed4ef732af9695bff24fc96f) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
18:07:05:578 3636 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
18:07:05:640 3636 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\drivers\i8042prt.sys
18:07:05:718 3636 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
18:07:05:875 3636 IntcAzAudAddService (d9be52660d8f0bbf28a8ffd1d1bbd6fb) C:\WINDOWS\system32\drivers\RtkHDAud.sys
18:07:06:046 3636 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS\system32\DRIVERS\intelppm.sys
18:07:06:093 3636 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
18:07:06:109 3636 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
18:07:06:125 3636 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
18:07:06:171 3636 IpNat (b5a8e215ac29d24d60b4d1250ef05ace) C:\WINDOWS\system32\DRIVERS\ipnat.sys
18:07:06:171 3636 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
18:07:06:218 3636 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
18:07:06:250 3636 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
18:07:06:312 3636 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
18:07:06:375 3636 kbdhid (e182fa8e49e8ee41b4adc53093f3c7e6) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
18:07:06:421 3636 klmd23 (0b06b0a25e08df0d536402bce3bde61e) C:\WINDOWS\system32\drivers\klmd.sys
18:07:06:500 3636 kmixer (d93cad07c5683db066b0b2d2d3790ead) C:\WINDOWS\system32\drivers\kmixer.sys
18:07:06:562 3636 KSecDD (674d3e5a593475915dc6643317192403) C:\WINDOWS\system32\drivers\KSecDD.sys
18:07:06:578 3636 Lbd (419590ebe7855215bb157ea0cf0d0531) C:\WINDOWS\system32\DRIVERS\Lbd.sys
18:07:06:718 3636 LMIInfo (4f69faaabb7db0d43e327c0b6aab40fc) C:\Program Files\LogMeIn\x86\RaInfo.sys
18:07:06:781 3636 lmimirr (4477689e2d8ae6b78ba34c9af4cc1ed1) C:\WINDOWS\system32\DRIVERS\lmimirr.sys
18:07:06:812 3636 LMIRfsDriver (3faa563ddf853320f90259d455a01d79) C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
18:07:06:828 3636 LVUSBSta (f7e15f2fe7790733df86e95a76556389) C:\WINDOWS\system32\drivers\LVUSBSta.sys
18:07:06:937 3636 LVUVC (92d03dc19eae9d0a86735705e374fdad) C:\WINDOWS\system32\DRIVERS\lvuvc.sys
18:07:07:015 3636 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
18:07:07:062 3636 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
18:07:07:140 3636 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
18:07:07:156 3636 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
18:07:07:218 3636 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
18:07:07:218 3636 MpFilter (dfa1cd670ea50a21c87c92c727c50950) C:\WINDOWS\system32\DRIVERS\MpFilter.sys
18:07:07:234 3636 MRxDAV (46edcc8f2db2f322c24f48785cb46366) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
18:07:07:296 3636 MRxSmb (fb6c89bb3ce282b08bdb1e3c179e1c39) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
18:07:07:296 3636 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
18:07:07:343 3636 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
18:07:07:375 3636 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
18:07:07:390 3636 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
18:07:07:421 3636 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
18:07:07:453 3636 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys
18:07:07:453 3636 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
18:07:07:484 3636 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
18:07:07:531 3636 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
18:07:07:562 3636 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
18:07:07:609 3636 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
18:07:07:671 3636 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
18:07:07:703 3636 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
18:07:07:750 3636 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
18:07:07:796 3636 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
18:07:07:812 3636 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
18:07:07:828 3636 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
18:07:07:875 3636 Ntfs (b78be402c3f63dd55521f73876951cdd) C:\WINDOWS\system32\drivers\Ntfs.sys
18:07:07:937 3636 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
18:07:07:984 3636 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
18:07:07:984 3636 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
18:07:08:015 3636 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\drivers\Parport.sys
18:07:08:046 3636 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
18:07:08:078 3636 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
18:07:08:078 3636 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
18:07:08:078 3636 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
18:07:08:109 3636 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys
18:07:08:171 3636 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
18:07:08:171 3636 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
18:07:08:203 3636 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
18:07:08:218 3636 PxHelp20 (03e0fe281823ba64b3782f5b38950e73) C:\WINDOWS\system32\Drivers\PxHelp20.sys
18:07:08:265 3636 radpms (6394b4274de7749d05e4385dcdd1ef2b) C:\WINDOWS\system32\DRIVERS\radpms.sys
18:07:08:281 3636 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
18:07:08:343 3636 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
18:07:08:343 3636 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
18:07:08:343 3636 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
18:07:08:359 3636 Rdbss (29d66245adba878fff574cd66abd2884) C:\WINDOWS\system32\DRIVERS\rdbss.sys
18:07:08:375 3636 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
18:07:08:437 3636 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
18:07:08:781 3636 RDPWD (d4f5643d7714ef499ae9527fdcd50894) C:\WINDOWS\system32\drivers\RDPWD.sys
18:07:08:953 3636 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
18:07:08:984 3636 Secdrv (d26e26ea516450af9d072635c60387f4) C:\WINDOWS\system32\DRIVERS\secdrv.sys
18:07:09:015 3636 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\drivers\Serial.sys
18:07:09:031 3636 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
18:07:09:078 3636 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys
18:07:09:375 3636 SNP2STD (12b50a28214fcbd68ec2cd73a29336cc) C:\WINDOWS\system32\DRIVERS\snp2sxp.sys
18:07:09:640 3636 splitter (8e186b8f23295d1e42c573b82b80d548) C:\WINDOWS\system32\drivers\splitter.sys
18:07:09:703 3636 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
18:07:09:765 3636 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
18:07:09:812 3636 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
18:07:09:843 3636 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
18:07:09:859 3636 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
18:07:09:875 3636 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
18:07:09:921 3636 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
18:07:09:984 3636 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
18:07:10:062 3636 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
18:07:10:109 3636 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
18:07:10:171 3636 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
18:07:10:203 3636 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys
18:07:10:250 3636 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys
18:07:10:265 3636 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
18:07:10:328 3636 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
18:07:10:328 3636 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
18:07:10:390 3636 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
18:07:10:437 3636 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
18:07:10:437 3636 usbstor (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
18:07:10:453 3636 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
18:07:10:484 3636 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
18:07:10:562 3636 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
18:07:10:578 3636 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
18:07:10:640 3636 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\Drivers\wdf01000.sys
18:07:10:703 3636 wdmaud (2797f33ebf50466020c430ee4f037933) C:\WINDOWS\system32\drivers\wdmaud.sys
18:07:10:703 3636 WinUSB (fd600b032e741eb6aab509fc630f7c42) C:\WINDOWS\system32\DRIVERS\WinUSB.sys
18:07:10:781 3636 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
18:07:10:812 3636 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
18:07:10:812 3636 WudfPf (6ff66513d372d479ef1810223c8d20ce) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
18:07:10:828 3636 WudfRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
18:07:10:828 3636 
18:07:10:828 3636 Completed
18:07:10:828 3636 
18:07:10:828 3636 Results:
18:07:10:828 3636 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
18:07:10:828 3636 File objects infected / cured / cured on reboot: 0 / 0 / 0
18:07:10:828 3636 
18:07:10:828 3636 KLMD(ARK) unloaded successfully


----------



## Rorschach112 (Oct 12, 2008)

Download ComboFix here :

*Link 1*
*Link 2*

** IMPORTANT !!! Save ComboFix.exe to your Desktop*


Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Here is a guide on how to disable them

*Click me*

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.








Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:










Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the *C:\ComboFix.txt* log in your next reply.


----------



## HoserIN (May 27, 2010)

ComboFix 10-05-28.02 - Jose Sanchez II 05/28/2010 18:21:34.2.4 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3326.1428 [GMT -4:00]
Running from: c:\documents and settings\Jose Sanchez II\My Documents\Downloads\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\{78620589-BCF7-438C-9797-313C65CFAD32}
c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\{78620589-BCF7-438C-9797-313C65CFAD32}\chrome\content\_cfg.js
c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\{78620589-BCF7-438C-9797-313C65CFAD32}\chrome\content\overlay.xul
c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\{78620589-BCF7-438C-9797-313C65CFAD32}\install.rdf

.
((((((((((((((((((((((((( Files Created from 2010-04-28 to 2010-05-28 )))))))))))))))))))))))))))))))
.

2010-05-26 00:32 . 2010-05-26 00:32 503808 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-5f40f164-n\msvcp71.dll
2010-05-26 00:32 . 2010-05-26 00:32 348160 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-5f40f164-n\msvcr71.dll
2010-05-26 00:32 . 2010-05-26 00:32 499712 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-5f40f164-n\jmc.dll
2010-05-26 00:28 . 2010-05-26 11:50 15944 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-05-26 00:28 . 2010-05-26 00:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro
2010-05-26 00:28 . 2010-05-26 00:28 -------- d-----w- c:\program files\Hitman Pro 3.5
2010-05-26 00:22 . 2010-05-26 00:24 -------- d-----w- c:\documents and settings\Jose Sanchez II\Application Data\QuickScan
2010-05-22 23:51 . 2010-05-28 19:47 0 ----a-w- c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\prvlcl.dat
2010-05-22 23:02 . 2010-05-22 23:02 -------- d-----w- C:\$AVG
2010-05-22 22:59 . 2010-05-22 22:59 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-05-21 22:44 . 2009-05-07 07:04 157712 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-05-21 22:26 . 2010-05-21 22:26 -------- d-----w- c:\windows\system32\wbem\Repository
2010-05-17 22:47 . 2010-05-17 22:47 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee
2010-05-12 14:04 . 2010-05-12 14:04 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-05-12 14:04 . 2010-05-12 14:04 1924976 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2010-05-12 14:04 . 2010-05-12 14:04 1025992 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\SecurityScan_Release.exe
2010-05-12 14:04 . 2010-05-12 14:04 -------- d-----w- c:\program files\NOS
2010-05-12 14:04 . 2010-03-29 12:53 32576 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\Firefox\Profiles\7e9y8ptm.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-05-12 14:04 . 2010-03-29 12:53 29984 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\Firefox\Profiles\7e9y8ptm.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-05-07 19:23 . 2010-05-07 19:23 -------- d-----w- c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\Temp
2010-05-04 21:14 . 2010-05-04 21:14 -------- d-----w- c:\documents and settings\Jose Sanchez II\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2010-05-04 21:12 . 2010-05-04 21:12 -------- d-----w- c:\program files\Foxonic Lite

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-28 22:16 . 2009-03-10 00:57 -------- d-----w- c:\documents and settings\Jose Sanchez II\Application Data\DNA
2010-05-28 18:59 . 2009-04-06 22:34 -------- d-----w- c:\program files\LogMeIn
2010-05-27 11:15 . 2009-11-23 00:33 -------- d-----w- c:\documents and settings\Jose Sanchez II\Application Data\Skype
2010-05-27 11:13 . 2009-03-10 00:57 -------- d-----w- c:\program files\DNA
2010-05-27 11:11 . 2009-02-24 04:45 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2010-05-26 16:30 . 2009-09-01 01:29 -------- d-----w- c:\program files\SugarSync
2010-05-25 23:32 . 2010-03-18 23:22 4337344 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-05-23 07:08 . 2009-03-01 01:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-05-22 23:02 . 2010-04-27 18:17 -------- d-----w- c:\program files\AVG
2010-05-22 23:01 . 2009-02-24 05:00 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-05-22 23:01 . 2009-02-24 05:00 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-05-22 23:01 . 2009-02-24 05:00 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-05-22 23:01 . 2009-02-24 05:00 29512 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-05-19 21:08 . 2008-08-14 11:57 73312 ----a-w- c:\windows\system32\drivers\adfs.sys
2010-05-18 22:34 . 2009-10-30 19:47 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-05-12 14:10 . 2009-03-15 17:08 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-05-12 14:07 . 2009-02-24 04:28 -------- d-----w- c:\program files\Common Files\Adobe
2010-05-06 14:36 . 2009-11-01 01:29 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-04-30 20:53 . 2009-09-19 04:09 -------- d-----w- c:\program files\Common Files\Device
2010-04-28 13:16 . 2009-02-24 04:39 -------- d-----w- c:\program files\Paltalk Messenger
2010-04-27 18:21 . 2010-04-27 17:59 0 ----a-w- c:\windows\system32\drivers\ktqzmsue.sys
2010-04-27 18:02 . 2010-04-27 18:02 30784 ----a-w- c:\windows\system32\drivers\rzxosaax.sys
2010-04-21 04:28 . 2010-04-21 04:28 120 ----a-w- c:\windows\Fcodu.dat
2010-04-21 04:28 . 2010-04-21 04:28 0 ----a-w- c:\windows\Qxafoziqipuzimo.bin
2010-04-21 04:27 . 2010-04-21 04:27 20 ----a-w- c:\windows\system32\config\systemprofile\Application Data\kcmdte.dat
2010-04-21 04:08 . 2010-04-21 04:08 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-04-19 18:59 . 2010-04-19 18:59 255472 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\plugins\npgoogletalk.dll
2010-04-12 20:08 . 2009-11-23 00:35 -------- d-----w- c:\documents and settings\Jose Sanchez II\Application Data\skypePM
2010-04-06 22:25 . 2010-02-20 23:50 -------- d-----w- c:\program files\SlySoft
2010-03-31 14:38 . 2010-03-31 14:37 -------- d-----w- c:\documents and settings\All Users\Application Data\SSScanAppDataDir
2010-03-31 14:37 . 2010-03-31 14:37 -------- d-----w- c:\documents and settings\All Users\Application Data\MSScanAppDataDir
2010-03-30 19:47 . 2010-03-30 19:47 -------- d-----w- c:\program files\Common Files\snp2std
2010-03-30 19:47 . 2009-02-24 04:01 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-30 19:47 . 2010-03-30 19:47 -------- d-----w- c:\documents and settings\Jose Sanchez II\Application Data\InstallShield
2010-03-26 22:56 . 2010-03-26 22:56 1956656 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2010-03-24 18:17 . 2010-03-24 08:04 952768 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\6720\AdobeARM.exe
2010-03-24 18:17 . 2010-03-24 08:04 70584 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\6720\AdobeExtractFiles.dll
2010-03-24 18:17 . 2010-03-24 08:04 326056 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\6720\ReaderUpdater.exe
2010-03-24 18:17 . 2010-03-24 08:04 326056 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\6720\AcrobatUpdater.exe
2010-03-17 02:01 . 2010-03-17 02:01 79488 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-17 01:47 . 2009-05-09 16:09 68840 ----a-w- c:\documents and settings\Eric Williams\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-12 02:36 . 2009-02-24 06:15 68840 ----a-w- c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-11 12:38 . 2006-02-28 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2010-03-11 12:38 . 2006-02-28 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-03-11 12:38 . 2006-02-28 12:00 17408 ------w- c:\windows\system32\corpol.dll
2010-03-09 11:09 . 2006-02-28 12:00 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-03-03 22:16 . 2010-03-05 04:28 3862528 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\Firefox\Profiles\7e9y8ptm.default\extensions\[email protected]\plugins\npRACtrl.dll
2010-03-02 02:34 . 2009-05-10 16:39 15688 ----a-w- c:\windows\system32\lsdelete.exe
2010-02-28 13:43 . 2010-01-16 19:31 38784 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
.

((((((((((((((((((((((((((((( [email protected]_00.41.41 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-27 11:14 . 2010-05-27 11:14 16384 c:\windows\Temp\Perflib_Perfdata_e10.dat
+ 2010-05-27 11:12 . 2010-05-27 11:12 16384 c:\windows\Temp\Perflib_Perfdata_484.dat
- 2009-02-24 06:10 . 2010-01-23 08:11 46080 c:\windows\system32\tzchange.exe
+ 2009-02-24 06:10 . 2010-04-21 13:28 46080 c:\windows\system32\tzchange.exe
- 2010-03-17 00:43 . 2009-05-26 11:40 17272 c:\windows\system32\spmsg.dll
+ 2010-03-17 00:43 . 2009-05-26 09:01 17272 c:\windows\system32\spmsg.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 44544 c:\windows\system32\pngfilt.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 44544 c:\windows\system32\pngfilt.dll
- 2007-08-13 22:54 . 2010-01-05 10:00 52224 c:\windows\system32\msfeedsbs.dll
+ 2007-08-13 22:54 . 2010-03-11 12:38 52224 c:\windows\system32\msfeedsbs.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 27648 c:\windows\system32\jsproxy.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 27648 c:\windows\system32\jsproxy.dll
- 2007-08-13 22:39 . 2009-12-31 15:33 13824 c:\windows\system32\ieudinit.exe
+ 2007-08-13 22:39 . 2010-03-10 13:18 13824 c:\windows\system32\ieudinit.exe
- 2006-02-28 12:00 . 2010-01-05 10:00 44544 c:\windows\system32\iernonce.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 44544 c:\windows\system32\iernonce.dll
+ 2006-02-28 12:00 . 2010-03-10 13:18 70656 c:\windows\system32\ie4uinit.exe
- 2006-02-28 12:00 . 2009-12-31 15:33 70656 c:\windows\system32\ie4uinit.exe
- 2007-08-13 22:36 . 2010-01-05 10:00 63488 c:\windows\system32\icardie.dll
+ 2007-08-13 22:36 . 2010-03-11 12:38 63488 c:\windows\system32\icardie.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 44544 c:\windows\system32\dllcache\pngfilt.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 44544 c:\windows\system32\dllcache\pngfilt.dll
- 2010-03-26 21:02 . 2010-01-05 10:00 52224 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2010-03-26 21:02 . 2010-03-11 12:38 52224 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 27648 c:\windows\system32\dllcache\jsproxy.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 27648 c:\windows\system32\dllcache\jsproxy.dll
+ 2010-03-26 21:02 . 2010-03-10 13:18 13824 c:\windows\system32\dllcache\ieudinit.exe
- 2010-03-26 21:02 . 2009-12-31 15:33 13824 c:\windows\system32\dllcache\ieudinit.exe
+ 2006-02-28 12:00 . 2010-03-11 12:38 44544 c:\windows\system32\dllcache\iernonce.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 44544 c:\windows\system32\dllcache\iernonce.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 78336 c:\windows\system32\dllcache\ieencode.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 78336 c:\windows\system32\dllcache\ieencode.dll
+ 2006-02-28 12:00 . 2010-03-10 13:18 70656 c:\windows\system32\dllcache\ie4uinit.exe
- 2006-02-28 12:00 . 2009-12-31 15:33 70656 c:\windows\system32\dllcache\ie4uinit.exe
+ 2010-03-26 21:02 . 2010-03-11 12:38 63488 c:\windows\system32\dllcache\icardie.dll
- 2010-03-26 21:02 . 2010-01-05 10:00 63488 c:\windows\system32\dllcache\icardie.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 17408 c:\windows\system32\dllcache\corpol.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 17408 c:\windows\system32\dllcache\corpol.dll
+ 2006-02-28 12:00 . 2010-01-13 14:10 85504 c:\windows\system32\dllcache\cabview.dll
+ 2006-02-28 12:00 . 2010-01-13 14:10 85504 c:\windows\system32\cabview.dll
- 2009-03-01 01:55 . 2010-03-10 08:09 35088 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
+ 2009-03-01 01:55 . 2010-05-23 07:08 35088 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
+ 2009-03-01 01:55 . 2010-05-23 07:08 18704 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
- 2009-03-01 01:55 . 2010-03-10 08:09 18704 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-03-01 01:55 . 2010-05-23 07:08 20240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
- 2009-03-01 01:55 . 2010-03-10 08:09 20240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
+ 2009-07-15 12:01 . 2009-07-15 12:01 81920 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Rebex.Net.ProxySocket.dll
+ 2009-07-15 12:15 . 2009-07-15 12:15 25472 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Preview.HostedIE6Shim.dll
+ 2009-07-15 12:01 . 2009-07-15 12:01 23552 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.pipstwo.exe
+ 2009-07-15 12:01 . 2009-07-15 12:01 23552 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.pipsone.exe
+ 2009-07-15 12:01 . 2009-07-15 12:01 52736 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.PageAnalysis.Sdk.dll
+ 2009-07-15 12:15 . 2009-07-15 12:15 51064 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.PageAnalysis.Preview.Firefox3Native.dll
+ 2009-07-15 12:15 . 2009-07-15 12:15 51576 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.PageAnalysis.Preview.Firefox35Native.dll
+ 2009-07-15 12:01 . 2009-07-15 12:01 49152 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.PageAnalysis.Preview.Firefox.dll
+ 2009-07-15 12:01 . 2009-07-15 12:01 92672 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.PageAnalysis.Preview.dll
+ 2009-07-15 12:01 . 2009-07-15 12:01 99328 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.PageAnalysis.Core.dll
+ 2009-07-15 12:15 . 2009-07-15 12:15 31560 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.MsoStyle.dll
+ 2010-03-19 00:01 . 2010-03-19 00:01 81920 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Microsoft.Vbe.Interop.dll
+ 2010-03-19 00:01 . 2010-03-19 00:01 65536 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Microsoft.Expression.Web.Interop.ProtocolsInternal.dll
+ 2009-07-15 12:01 . 2009-07-15 12:01 45056 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Microsoft.Expression.SourceControl.TFS.dll
+ 2009-07-15 12:01 . 2009-07-15 12:01 68608 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.External.dll
+ 2009-07-15 12:01 . 2009-07-15 12:01 90112 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Expression.DevServer.exe
+ 2010-03-19 00:01 . 2010-03-19 00:01 86016 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Expression.DevHost.dll
+ 2008-10-25 13:18 . 2008-10-25 13:18 72568 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6425\ONFILTER.DLL
+ 2008-10-25 13:18 . 2008-10-25 13:18 98696 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6425\ONENOTEM.EXE
+ 2010-05-23 07:00 . 2010-01-05 10:00 44544 c:\windows\ie7updates\KB980182-IE7\pngfilt.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 52224 c:\windows\ie7updates\KB980182-IE7\msfeedsbs.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 27648 c:\windows\ie7updates\KB980182-IE7\jsproxy.dll
+ 2010-05-23 07:00 . 2009-12-31 15:33 13824 c:\windows\ie7updates\KB980182-IE7\ieudinit.exe
+ 2010-05-23 07:00 . 2010-01-05 10:00 44544 c:\windows\ie7updates\KB980182-IE7\iernonce.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 78336 c:\windows\ie7updates\KB980182-IE7\ieencode.dll
+ 2010-05-23 07:00 . 2009-12-31 15:33 70656 c:\windows\ie7updates\KB980182-IE7\ie4uinit.exe
+ 2010-05-23 07:00 . 2010-01-05 10:00 63488 c:\windows\ie7updates\KB980182-IE7\icardie.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 17408 c:\windows\ie7updates\KB980182-IE7\corpol.dll
+ 2010-05-23 07:07 . 2010-05-23 07:07 30720 c:\windows\assembly\NativeImages_v2.0.50727_32\SuperPreview\00bf963879a7350a487e815b76b549ea\SuperPreview.ni.exe
+ 2010-05-23 07:07 . 2010-05-23 07:07 14848 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\f15e6d7ab940230b08f612b735b39c21\Microsoft.Expression.Web.PageAnalysis.Preview.resources.ni.dll
+ 2010-05-23 07:07 . 2010-05-23 07:07 13824 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\cb72bfdc2626fba7a7f666e817d58f2b\Microsoft.Expression.Web.PageAnalysis.Preview.Firefox.resources.ni.dll
+ 2010-05-23 07:06 . 2010-05-23 07:06 29696 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\bd2e47da60d98622c7bcad9b386c3b61\Microsoft.Expression.Web.Shell.Contracts.ni.dll
+ 2010-05-23 07:07 . 2010-05-23 07:07 68096 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\9c4d4063026e172ab5eb3035926ce86b\Microsoft.Expression.SourceControl.TFS.ni.dll
+ 2010-05-23 07:07 . 2010-05-23 07:07 13312 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\83d7356b5a2210c650ddbb8b604720ed\Microsoft.Expression.Web.PageAnalysis.Sdk.resources.ni.dll
+ 2010-05-23 07:07 . 2010-05-23 07:07 13824 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\82fb34fc1cc3c6619d9b9ccb789ce50c\Microsoft.Expression.Web.PageAnalysis.Preview.InternetExplorer.resources.ni.dll
+ 2010-05-23 07:07 . 2010-05-23 07:07 14848 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\187be10503a19a017f8a91d449322ae2\Microsoft.Expression.Web.External.resources.ni.dll
+ 2010-05-23 07:06 . 2010-05-23 07:06 14336 c:\windows\assembly\NativeImages_v2.0.50727_32\Extensibility\e454233968700c36c55e7939d4c91f2f\Extensibility.ni.dll
+ 2010-05-23 07:05 . 2010-05-23 07:05 30720 c:\windows\assembly\NativeImages_v2.0.50727_32\ExpressionWeb\03bfdc781190fa6b59c78d0e6bac23f5\ExpressionWeb.ni.exe
- 2010-03-19 00:01 . 2010-03-19 00:01 81920 c:\windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\3.0.0.0__31bf3856ad364e35\Microsoft.Vbe.Interop.dll
+ 2010-05-23 07:03 . 2010-05-23 07:03 81920 c:\windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\3.0.0.0__31bf3856ad364e35\Microsoft.Vbe.Interop.dll
+ 2010-05-23 07:03 . 2010-05-23 07:03 65536 c:\windows\assembly\GAC_32\Microsoft.Expression.Web.Interop.ProtocolsInternal\3.0.0.4000__31bf3856ad364e35\Microsoft.Expression.Web.Interop.ProtocolsInternal.dll
+ 2010-05-23 07:03 . 2010-05-23 07:03 86016 c:\windows\assembly\GAC_32\Expression.DevHost\3.0.0.4000__31bf3856ad364e35\Expression.DevHost.dll
+ 2009-11-01 08:05 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB971961\update\spcustom.dll
+ 2009-11-01 08:05 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB971961\spmsg.dll
+ 2010-05-23 07:03 . 2010-05-23 07:03 4096 c:\windows\assembly\GAC_32\Expression.DevHost.resources\3.0.0.4000_en_31bf3856ad364e35\Expression.DevHost.resources.dll
- 2009-03-01 01:54 . 2009-03-01 01:54 4608 c:\windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\extensibility.dll
+ 2010-05-23 07:03 . 2010-05-23 07:03 4608 c:\windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\Extensibility.dll
+ 2006-10-19 01:47 . 2008-06-24 22:12 295936 c:\windows\system32\wmpeffects.dll
- 2006-10-19 01:47 . 2006-10-19 01:47 295936 c:\windows\system32\wmpeffects.dll
+ 2006-02-28 12:00 . 2009-07-14 03:43 286208 c:\windows\system32\wmpdxm.dll
+ 2006-02-28 12:00 . 2009-12-24 07:05 177664 c:\windows\system32\wintrust.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 233472 c:\windows\system32\webcheck.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 233472 c:\windows\system32\webcheck.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 105984 c:\windows\system32\url.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 105984 c:\windows\system32\url.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 102912 c:\windows\system32\occache.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 102912 c:\windows\system32\occache.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 671232 c:\windows\system32\mstime.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 671232 c:\windows\system32\mstime.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 193024 c:\windows\system32\msrating.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 193024 c:\windows\system32\msrating.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 477696 c:\windows\system32\mshtmled.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 477696  c:\windows\system32\mshtmled.dll
- 2007-08-13 22:54 . 2010-01-05 10:00 459264 c:\windows\system32\msfeeds.dll
+ 2007-08-13 22:54 . 2010-03-11 12:38 459264 c:\windows\system32\msfeeds.dll
+ 2006-02-28 12:00 . 2009-08-13 15:16 512000 c:\windows\system32\jscript.dll
+ 2009-02-24 03:41 . 2010-01-29 15:08 683520 c:\windows\system32\inetcomm.dll
- 2009-02-24 03:41 . 2008-04-11 18:50 683520 c:\windows\system32\inetcomm.dll
+ 2007-08-13 22:34 . 2010-03-11 12:38 268288 c:\windows\system32\iertutil.dll
- 2007-08-13 22:34 . 2010-01-05 10:00 268288 c:\windows\system32\iertutil.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 192512 c:\windows\system32\iepeers.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 192512 c:\windows\system32\iepeers.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 385024 c:\windows\system32\iedkcs32.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 385024 c:\windows\system32\iedkcs32.dll
+ 2007-07-11 16:27 . 2010-03-11 12:38 380928 c:\windows\system32\ieapfltr.dll
- 2007-07-11 16:27 . 2010-01-05 10:00 380928 c:\windows\system32\ieapfltr.dll
- 2006-02-28 12:00 . 2009-12-18 13:04 161792 c:\windows\system32\ieakui.dll
+ 2006-02-28 12:00 . 2010-02-23 05:18 161792 c:\windows\system32\ieakui.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 230400 c:\windows\system32\ieaksie.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 230400 c:\windows\system32\ieaksie.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 153088 c:\windows\system32\ieakeng.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 153088 c:\windows\system32\ieakeng.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 133120 c:\windows\system32\extmgr.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 133120 c:\windows\system32\extmgr.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 214528 c:\windows\system32\dxtrans.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 214528 c:\windows\system32\dxtrans.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 347136 c:\windows\system32\dxtmsft.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 347136 c:\windows\system32\dxtmsft.dll
+ 2006-02-28 12:00 . 2010-02-11 12:01 226880 c:\windows\system32\drivers\tcpip6.sys
+ 2006-02-28 12:00 . 2010-02-24 12:31 454016 c:\windows\system32\drivers\mrxsmb.sys
+ 2006-02-28 12:00 . 2009-07-14 03:43 286208 c:\windows\system32\dllcache\wmpdxm.dll
+ 2006-02-28 12:00 . 2009-12-24 07:05 177664 c:\windows\system32\dllcache\wintrust.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 832512 c:\windows\system32\dllcache\wininet.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 832512 c:\windows\system32\dllcache\wininet.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 233472 c:\windows\system32\dllcache\webcheck.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 233472 c:\windows\system32\dllcache\webcheck.dll
+ 2009-02-24 03:42 . 2008-05-27 17:23 765952 c:\windows\system32\dllcache\vgx.dll
- 2009-02-24 03:42 . 2007-08-13 22:54 765952 c:\windows\system32\dllcache\VGX.dll
+ 2006-02-28 12:00 . 2010-03-09 11:09 430080 c:\windows\system32\dllcache\vbscript.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 105984 c:\windows\system32\dllcache\url.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 105984 c:\windows\system32\dllcache\url.dll
+ 2006-02-28 12:00 . 2007-06-27 02:10 317440 c:\windows\system32\dllcache\unregmp2.exe
+ 2006-02-28 12:00 . 2010-02-11 12:01 226880 c:\windows\system32\dllcache\tcpip6.sys
- 2006-02-28 12:00 . 2010-01-05 10:00 102912 c:\windows\system32\dllcache\occache.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 102912 c:\windows\system32\dllcache\occache.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 671232 c:\windows\system32\dllcache\mstime.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 671232 c:\windows\system32\dllcache\mstime.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 193024 c:\windows\system32\dllcache\msrating.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 193024 c:\windows\system32\dllcache\msrating.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 477696 c:\windows\system32\dllcache\mshtmled.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 477696 c:\windows\system32\dllcache\mshtmled.dll
- 2010-03-26 21:02 . 2010-01-05 10:00 459264 c:\windows\system32\dllcache\msfeeds.dll
+ 2010-03-26 21:02 . 2010-03-11 12:38 459264 c:\windows\system32\dllcache\msfeeds.dll
+ 2009-02-25 01:48 . 2010-02-24 12:31 454016 c:\windows\system32\dllcache\mrxsmb.sys
+ 2006-02-28 12:00 . 2009-08-13 15:16 512000 c:\windows\system32\dllcache\jscript.dll
+ 2009-02-24 03:41 . 2010-01-29 15:08 683520 c:\windows\system32\dllcache\inetcomm.dll
- 2009-02-24 03:41 . 2008-04-11 18:50 683520 c:\windows\system32\dllcache\inetcomm.dll
- 2009-02-24 03:41 . 2009-12-18 13:05 634648 c:\windows\system32\dllcache\iexplore.exe
+ 2009-02-24 03:41 . 2010-02-23 05:20 634648 c:\windows\system32\dllcache\iexplore.exe
+ 2010-03-26 21:02 . 2010-03-11 12:38 268288 c:\windows\system32\dllcache\iertutil.dll
- 2010-03-26 21:02 . 2010-01-05 10:00 268288 c:\windows\system32\dllcache\iertutil.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 192512 c:\windows\system32\dllcache\iepeers.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 192512 c:\windows\system32\dllcache\iepeers.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 385024 c:\windows\system32\dllcache\iedkcs32.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 385024 c:\windows\system32\dllcache\iedkcs32.dll
+ 2010-03-26 21:02 . 2010-03-11 12:38 380928 c:\windows\system32\dllcache\ieapfltr.dll
- 2010-03-26 21:02 . 2010-01-05 10:00 380928 c:\windows\system32\dllcache\ieapfltr.dll
- 2006-02-28 12:00 . 2009-12-18 13:04 161792 c:\windows\system32\dllcache\ieakui.dll
+ 2006-02-28 12:00 . 2010-02-23 05:18 161792 c:\windows\system32\dllcache\ieakui.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 230400 c:\windows\system32\dllcache\ieaksie.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 230400 c:\windows\system32\dllcache\ieaksie.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 153088 c:\windows\system32\dllcache\ieakeng.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 153088 c:\windows\system32\dllcache\ieakeng.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 133120 c:\windows\system32\dllcache\extmgr.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 133120 c:\windows\system32\dllcache\extmgr.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 214528 c:\windows\system32\dllcache\dxtrans.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 214528 c:\windows\system32\dllcache\dxtrans.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 347136 c:\windows\system32\dllcache\dxtmsft.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 347136 c:\windows\system32\dllcache\dxtmsft.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 124928 c:\windows\system32\dllcache\advpack.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 124928 c:\windows\system32\dllcache\advpack.dll
+ 2006-02-28 12:00 . 2010-02-12 04:47 100864 c:\windows\system32\dllcache\6to4svc.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 124928 c:\windows\system32\advpack.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 124928 c:\windows\system32\advpack.dll
+ 2006-02-28 12:00 . 2010-02-12 04:47 100864 c:\windows\system32\6to4svc.dll
- 2009-03-01 01:55 . 2010-03-10 08:09 888080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-03-01 01:55 . 2010-05-23 07:08 888080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
- 2009-03-01 01:55 . 2010-03-10 08:09 272648 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
+ 2009-03-01 01:55 . 2010-05-23 07:08 272648 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
+ 2009-03-01 01:55 . 2010-05-23 07:08 922384 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
- 2009-03-01 01:55 . 2010-03-10 08:09 922384 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
+ 2009-03-01 01:55 . 2010-05-23 07:08 845584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
- 2009-03-01 01:55 . 2010-03-10 08:09 845584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
+ 2009-03-01 01:55 . 2010-05-23 07:08 217864 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
- 2009-03-01 01:55 . 2010-03-10 08:09 217864 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
- 2009-03-01 01:55 . 2010-03-10 08:09 184080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
+ 2009-03-01 01:55 . 2010-05-23 07:08 184080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
- 2009-03-01 01:55 . 2010-03-10 08:09 159504 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
+ 2009-03-01 01:55 . 2010-05-23 07:08 159504 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
+ 2009-07-15 12:01 . 2009-07-15 12:01 253952 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Rebex.Security.dll
+ 2009-07-15 12:01 . 2009-07-15 12:01 118784 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Rebex.Net.Ssh.dll
+ 2009-07-15 12:01 . 2009-07-15 12:01 151552 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Rebex.Net.Sftp.dll
+ 2009-07-15 12:01 . 2009-07-15 12:01 118784 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Rebex.Net.SecureSocket.dll
+ 2009-07-15 12:01 . 2009-07-15 12:01 192512 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Rebex.Net.Ftp.dll
+ 2009-07-15 12:01 . 2009-07-15 12:01 116224 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.PageAnalysis.Preview.InternetExplorer.dll
+ 2009-07-15 12:01 . 2009-07-15 12:01 300032 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.PageAnalysis.Preview.Controls.dll
+ 2010-03-19 00:01 . 2010-03-19 00:01 401408 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.office.dll
+ 2009-07-15 12:15 . 2009-07-15 12:15 734544 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.msptls.dll
+ 2009-07-15 12:15 . 2009-07-15 12:15 727896 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.msproof6.dll
+ 2009-07-15 12:14 . 2009-07-15 12:14 782680 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.msimport.exe
+ 2009-07-15 12:01 . 2009-07-15 12:01 491520 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Microsoft.Web.Design.Client.dll
+ 2009-07-15 12:01 . 2009-07-15 12:01 237568 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Microsoft.Web.Authoring.dll
+ 2009-07-15 12:01 . 2009-07-15 12:01 434176 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Microsoft.Expression.Web.dll
+ 2010-03-19 00:01 . 2010-03-19 00:01 151552 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Microsoft.Expression.Interop.WebDesignerInternal.dll
+ 2010-03-19 00:01 . 2010-03-19 00:01 167936 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Microsoft.Expression.Interop.WebDesigner.dll
+ 2009-07-15 12:14 . 2009-07-15 12:14 448344 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.jscript.dll
+ 2009-07-15 12:14 . 2009-07-15 12:14 163144 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.HtmlChecker.dll
+ 2009-07-15 12:14 . 2009-07-15 12:14 446784 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.fpnse.dll
+ 2009-07-15 12:01 . 2009-07-15 12:01 372736 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\Microsoft.Expression.Importers.Psd.dll
+ 2008-10-25 12:52 . 2008-10-25 12:52 664968 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6425\ONBTTNOL.DLL
+ 2008-10-25 12:52 . 2008-10-25 12:52 604056 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6425\ONBTTNIE.DLL
+ 2006-02-28 12:00 . 2007-06-27 02:10 317440 c:\windows\inf\unregmp2.exe
+ 2010-05-23 07:00 . 2010-01-05 10:00 832512 c:\windows\ie7updates\KB980182-IE7\wininet.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 233472 c:\windows\ie7updates\KB980182-IE7\webcheck.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 105984 c:\windows\ie7updates\KB980182-IE7\url.dll
+ 2010-05-23 07:00 . 2009-05-26 11:40 382840 c:\windows\ie7updates\KB980182-IE7\spuninst\updspapi.dll
+ 2010-05-23 07:00 . 2009-05-26 11:40 231288 c:\windows\ie7updates\KB980182-IE7\spuninst\spuninst.exe
+ 2010-05-23 07:00 . 2010-01-05 10:00 102912 c:\windows\ie7updates\KB980182-IE7\occache.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 671232 c:\windows\ie7updates\KB980182-IE7\mstime.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 193024 c:\windows\ie7updates\KB980182-IE7\msrating.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 477696 c:\windows\ie7updates\KB980182-IE7\mshtmled.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 459264 c:\windows\ie7updates\KB980182-IE7\msfeeds.dll
+ 2010-05-23 07:00 . 2009-12-18 13:05 634648 c:\windows\ie7updates\KB980182-IE7\iexplore.exe
+ 2010-05-23 07:00 . 2010-01-05 10:00 268288 c:\windows\ie7updates\KB980182-IE7\iertutil.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 192512 c:\windows\ie7updates\KB980182-IE7\iepeers.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 385024 c:\windows\ie7updates\KB980182-IE7\iedkcs32.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 380928 c:\windows\ie7updates\KB980182-IE7\ieapfltr.dll
+ 2010-05-23 07:00 . 2009-12-18 13:04 161792 c:\windows\ie7updates\KB980182-IE7\ieakui.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 230400 c:\windows\ie7updates\KB980182-IE7\ieaksie.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 153088 c:\windows\ie7updates\KB980182-IE7\ieakeng.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 133120 c:\windows\ie7updates\KB980182-IE7\extmgr.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 214528 c:\windows\ie7updates\KB980182-IE7\dxtrans.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 347136 c:\windows\ie7updates\KB980182-IE7\dxtmsft.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 124928 c:\windows\ie7updates\KB980182-IE7\advpack.dll
+ 2010-05-23 07:07 . 2007-08-13 22:54 765952 c:\windows\ie7updates\KB938127-v2-IE7\vgx.dll
+ 2010-05-23 07:07 . 2007-03-06 01:23 371424 c:\windows\ie7updates\KB938127-v2-IE7\spuninst\updspapi.dll
+ 2010-05-23 07:07 . 2007-03-06 01:22 213216 c:\windows\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe
+ 2009-02-25 01:48 . 2010-02-24 12:31 454016 c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2010-05-23 07:05 . 2010-05-23 07:05 417792 c:\windows\assembly\NativeImages_v2.0.50727_32\Webber\fa5a9fa1963ae42609dae3f49ef4a7a4\Webber.ni.dll
+ 2010-05-23 07:05 . 2010-05-23 07:05 910336 c:\windows\assembly\NativeImages_v2.0.50727_32\office\3fb34f6c1d3a1284cc19b41fbddedd47\office.ni.dll
+ 2010-05-23 07:06 . 2010-05-23 07:06 712192 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Web.Autho#\37a55fac35d7020536e861be60edd259\Microsoft.Web.Authoring.ni.dll
+ 2010-05-23 07:07 . 2010-05-23 07:07 648192 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\e3347ea4ac7f7c0256b2ade2f46cc2ec\Microsoft.Expression.Web.SimpleShell.resources.ni.dll
+ 2010-05-23 07:05 . 2010-05-23 07:05 411648 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\c89a6885be55006d7dd71a374c8db64b\Microsoft.Expression.Interop.WebDesigner.ni.dll
+ 2010-05-23 07:05 . 2010-05-23 07:05 144384 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\b99cdb5f5447b82f2d0a1bca9e3de542\Microsoft.Expression.Web.Interop.ProtocolsInternal.ni.dll
+ 2010-05-23 07:05 . 2010-05-23 07:05 396800 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\b7734650a6228e0ef488295b1f987ae2\Microsoft.Expression.Web.PageAnalysis.Core.ni.dll
+ 2010-05-23 07:06 . 2010-05-23 07:06 297472 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\aec3e2837d610444d023fdb4415d7dc3\Microsoft.Expression.Web.PageAnalysis.Preview.ni.dll
+ 2010-05-23 07:05 . 2010-05-23 07:05 332288 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\aa5ee06030601bcec8f75b2cc2978dd6\Microsoft.Expression.Interop.WebDesignerInternal.ni.dll
+ 2010-05-23 07:05 . 2010-05-23 07:05 266240 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\99497d05ab52b893f4c71aeff8bdfe85\Microsoft.Expression.Web.External.ni.dll
+ 2010-05-23 07:06 . 2010-05-23 07:06 145408 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\91c39378aef6dc2ae0df94188f63f337\Microsoft.Expression.Web.PageAnalysis.Sdk.ni.dll
+ 2010-05-23 07:07 . 2010-05-23 07:07 160256 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\2b6fe6931f367913a15a8eb0a3da14f3\Microsoft.Expression.Web.SimpleShell.ni.dll
+ 2010-05-23 07:04 . 2010-05-23 07:04 207360 c:\windows\assembly\NativeImages_v2.0.50727_32\Expression.DevServer\1efae0c0283db9d79f429908054d9dff\Expression.DevServer.ni.exe
+ 2010-05-23 07:04 . 2010-05-23 07:04 161280 c:\windows\assembly\NativeImages_v2.0.50727_32\Expression.DevHost\447afdcd1b3bb3056237b4a2b9638f2b\Expression.DevHost.ni.dll
+ 2010-05-23 07:03 . 2010-05-23 07:03 401408 c:\windows\assembly\GAC_MSIL\office\3.0.0.0__31bf3856ad364e35\office.dll
- 2010-03-19 00:01 . 2010-03-19 00:01 401408 c:\windows\assembly\GAC_MSIL\office\3.0.0.0__31bf3856ad364e35\office.dll
- 2010-03-19 00:01 . 2010-03-19 00:01 151552 c:\windows\assembly\GAC_MSIL\Microsoft.Expression.Interop.WebDesignerInternal\3.0.0.0__31bf3856ad364e35\Microsoft.Expression.Interop.WebDesignerInternal.dll
+ 2010-05-23 07:03 . 2010-05-23 07:03 151552 c:\windows\assembly\GAC_MSIL\Microsoft.Expression.Interop.WebDesignerInternal\3.0.0.0__31bf3856ad364e35\Microsoft.Expression.Interop.WebDesignerInternal.dll
+ 2010-05-23 07:03 . 2010-05-23 07:03 167936 c:\windows\assembly\GAC_MSIL\Microsoft.Expression.Interop.WebDesigner\3.0.0.0__31bf3856ad364e35\Microsoft.Expression.Interop.WebDesigner.dll
- 2010-03-19 00:01 . 2010-03-19 00:01 167936 c:\windows\assembly\GAC_MSIL\Microsoft.Expression.Interop.WebDesigner\3.0.0.0__31bf3856ad364e35\Microsoft.Expression.Interop.WebDesigner.dll
+ 2009-11-01 08:05 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB971961\update\updspapi.dll
+ 2009-11-01 08:05 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB971961\update\update.exe
+ 2009-11-01 08:05 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB971961\spuninst.exe
+ 2010-05-23 05:20 . 2009-08-13 15:02 512000 c:\windows\$hf_mig$\KB971961\SP3QFE\jscript.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 1168384 c:\windows\system32\urlmon.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 1168384 c:\windows\system32\urlmon.dll
+ 2006-02-28 12:00 . 2010-02-16 13:17 2137088 c:\windows\system32\ntoskrnl.exe
+ 2004-08-03 22:59 . 2010-02-16 12:39 2016768 c:\windows\system32\ntkrnlpa.exe
+ 2006-02-28 12:00 . 2010-03-11 12:38 3599872 c:\windows\system32\mshtml.dll
+ 2007-08-13 22:54 . 2010-03-11 12:38 6067200 c:\windows\system32\ieframe.dll
- 2007-08-13 22:54 . 2010-01-05 10:00 6067200 c:\windows\system32\ieframe.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 1168384 c:\windows\system32\dllcache\urlmon.dll
- 2006-02-28 12:00 . 2010-01-05 10:00 1168384 c:\windows\system32\dllcache\urlmon.dll
+ 2009-02-25 01:48 . 2010-02-16 13:19 2181376 c:\windows\system32\dllcache\ntoskrnl.exe
+ 2009-02-25 01:48 . 2010-02-16 12:39 2016768 c:\windows\system32\dllcache\ntkrpamp.exe
+ 2009-02-25 01:48 . 2010-02-16 12:39 2058368 c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2009-02-25 01:48 . 2010-02-16 13:17 2137088 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2009-02-24 03:41 . 2010-01-29 15:08 1315840 c:\windows\system32\dllcache\msoe.dll
+ 2006-02-28 12:00 . 2010-03-11 12:38 3599872 c:\windows\system32\dllcache\mshtml.dll
+ 2010-03-26 21:02 . 2010-03-11 12:38 6067200 c:\windows\system32\dllcache\ieframe.dll
- 2010-03-26 21:02 . 2010-01-05 10:00 6067200 c:\windows\system32\dllcache\ieframe.dll
+ 2010-02-21 05:03 . 2010-02-21 05:03 4472832 c:\windows\Installer\1565613.msp
+ 2009-10-16 11:08 . 2009-10-16 11:08 2237952 c:\windows\Installer\15655f6.msp
+ 2009-11-11 15:42 . 2009-11-11 15:42 8372224 c:\windows\Installer\15655dd.msp
+ 2010-02-21 05:02 . 2010-02-21 05:02 4195840 c:\windows\Installer\1565503.msp
+ 2010-04-09 19:21 . 2010-04-09 19:21 5025792 c:\windows\Installer\15654ec.msp
- 2009-03-01 01:55 . 2010-03-10 08:09 1172240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-03-01 01:55 . 2010-05-23 07:08 1172240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-03-01 01:55 . 2010-05-23 07:08 1165584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
- 2009-03-01 01:55 . 2010-03-10 08:09 1165584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
+ 2009-07-15 12:02 . 2009-07-15 12:02 6981632 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Webber.dll
+ 2009-07-15 12:15 . 2009-07-15 12:15 1117016 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.RichEd20.dll
+ 2009-07-15 12:01 . 2009-07-15 12:01 2514432 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Protocols.dll
+ 2009-07-15 12:14 . 2009-07-15 12:14 6097224 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.msores.dll
+ 2010-03-19 00:01 . 2010-03-19 00:01 1990656 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Microsoft.Expression.Interop.WebDesignerPage.dll
+ 2009-07-15 12:14 . 2009-07-15 12:14 4306256 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.fpcutl.dll
+ 2009-07-15 12:14 . 2009-07-15 12:14 2051400 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.fpacutl.dll
+ 2008-08-26 03:50 . 2008-08-26 03:50 2585592 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6425\VBE6.DLL
+ 2009-03-06 09:00 . 2009-03-06 09:00 6596472 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6425\ONMAIN.DLL
+ 2008-11-10 15:49 . 2008-11-10 15:49 1165680 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6425\ONLIBS.DLL
+ 2008-11-25 03:16 . 2008-11-25 03:16 1020776 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6425\ONENOTE.EXE
+ 2010-05-23 07:00 . 2010-01-05 10:00 1168384 c:\windows\ie7updates\KB980182-IE7\urlmon.dll
+ 2010-05-23 07:00 . 2010-01-05 19:30 3599360 c:\windows\ie7updates\KB980182-IE7\mshtml.dll
+ 2010-05-23 07:00 . 2010-01-05 10:00 6067200 c:\windows\ie7updates\KB980182-IE7\ieframe.dll
+ 2009-02-25 01:48 . 2010-02-16 13:19 2181376 c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2009-02-25 01:48 . 2010-02-16 12:39 2016768 c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2009-02-25 01:48 . 2010-02-16 12:39 2058368 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2009-02-25 01:48 . 2010-02-16 13:17 2137088 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2010-05-23 07:06 . 2010-05-23 07:06 1381376 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Web.Desig#\990758895a4da0d506b2cc770ff940ca\Microsoft.Web.Design.Client.ni.dll
+ 2010-05-23 07:07 . 2010-05-23 07:07 1849856 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\d8e066c3873cddb21623e03c1f6de6b4\Microsoft.Expression.Web.PageAnalysis.Preview.Controls.resources.ni.dll
+ 2010-05-23 07:05 . 2010-05-23 07:05 3594752 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\a176e0f22a73d0fe1e05d95af751aab7\Microsoft.Expression.Web.Framework.ni.dll
+ 2010-05-23 07:05 . 2010-05-23 07:05 1207808 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\954f7d9349c196ac24ddde0f38352660\Microsoft.Expression.Web.PageAnalysis.Preview.Controls.ni.dll
+ 2010-05-23 07:05 . 2010-05-23 07:05 1546240 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\8d4efefa5d38957edb3714e10bbfc247\Microsoft.Expression.Web.ni.dll
+ 2010-05-23 07:06 . 2010-05-23 07:06 1104896 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\8a1aa6b72cdb01cdee4ed31584d716f8\Microsoft.Expression.Importers.Psd.ni.dll
+ 2010-05-23 07:05 . 2010-05-23 07:05 4568064 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Expressio#\532fb616e39cce3fe213bca410861d00\Microsoft.Expression.Interop.WebDesignerPage.ni.dll
+ 2010-05-23 07:03 . 2010-05-23 07:03 1990656 c:\windows\assembly\GAC_MSIL\Microsoft.Expression.Interop.WebDesignerPage\3.0.0.0__31bf3856ad364e35\Microsoft.Expression.Interop.WebDesignerPage.dll
- 2010-03-19 00:01 . 2010-03-19 00:01 1990656 c:\windows\assembly\GAC_MSIL\Microsoft.Expression.Interop.WebDesignerPage\3.0.0.0__31bf3856ad364e35\Microsoft.Expression.Interop.WebDesignerPage.dll
+ 2006-02-28 12:00 . 2009-07-14 03:43 10841088 c:\windows\system32\wmp.dll
+ 2009-02-25 05:56 . 2010-04-30 15:51 32058312 c:\windows\system32\MRT.exe
+ 2006-02-28 12:00 . 2009-07-14 03:43 10841088 c:\windows\system32\dllcache\wmp.dll
+ 2010-03-22 20:03 . 2010-03-22 20:03 11732992 c:\windows\Installer\156562a.msp
+ 2009-07-15 12:14 . 2009-07-15 12:14 13374784 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.Mso.dll
+ 2009-07-15 12:14 . 2009-07-15 12:14 11887960 c:\windows\Installer\$PatchCache$\Managed\909FCB567FA610B4E83B17C32E78D38C\3.0.1762\xWeb.fpeditax.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncBackedUp]
@="{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}"
[HKEY_CLASSES_ROOT\CLSID\{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}]
2010-05-05 18:36 151552 ----a-w- c:\program files\SugarSync\SugarSyncShellExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncPending]
@="{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}"
[HKEY_CLASSES_ROOT\CLSID\{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}]
2010-05-05 18:36 151552 ----a-w- c:\program files\SugarSync\SugarSyncShellExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncRoot]
@="{A759AFF6-5851-457D-A540-F4ECED148351}"
[HKEY_CLASSES_ROOT\CLSID\{A759AFF6-5851-457D-A540-F4ECED148351}]
2010-05-05 18:36 151552 ----a-w- c:\program files\SugarSync\SugarSyncShellExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncShared]
@="{1574C9EF-7D58-488F-B358-8B78C1538F51}"
[HKEY_CLASSES_ROOT\CLSID\{1574C9EF-7D58-488F-B358-8B78C1538F51}]
2010-05-05 18:36 151552 ----a-w- c:\program files\SugarSync\SugarSyncShellExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-10-06 323392]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-18 4363504]
"Mikogo"="c:\documents and settings\Jose Sanchez II\Application Data\Mikogo\Mikogo-Host.exe" [2009-10-24 1277224]
"SugarSync"="c:\program files\SugarSync\SugarSyncManager.exe" [2010-05-05 13705216]
"Desktop Software"="c:\program files\Common Files\SupportSoft\bin\bcont.exe" [2009-04-24 1025320]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"AnyDVD"="c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe" [2009-12-28 3214272]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"Google Update"="c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-05-07 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-09-02 16851456]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-02 524632]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-04 61440]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-07-24 63048]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-09 305440]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2010-05-19 611712]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-31 149280]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-02-21 1093208]
"FixCamera"="c:\windows\FixCamera.exe" [2007-07-11 20480]
"tsnp2std"="c:\windows\tsnp2std.exe" [2007-05-12 270336]
"snp2std"="c:\windows\vsnp2std.exe" [2007-09-28 344064]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"HitmanPro35"="c:\program files\Hitman Pro 3.5\HitmanPro35(2).exe" [2010-05-26 5937984]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WUAppSetup"="c:\program files\Common Files\logishrd\WUApp32.exe" [2007-05-12 441120]

c:\documents and settings\Brad Stepp\Start Menu\Programs\Startup\
MPK.exe [2009-4-30 1022976]

c:\documents and settings\Jose Sanchez II\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-2-24 113664]
hp psc 1000 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-4-6 147456]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
Microsoft Broadband Networking.lnk - c:\windows\Installer\{8CC15633-2327-43F4-BA85-B83FDB4B59BE}\_18be6784.exe [2009-4-8 25214]
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2010-4-23 12649736]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-05-22 23:01 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-10-02 02:52 87352 ----a-w- c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNUtil.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNTray.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNCfg.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNUpdate.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\Jose Sanchez II\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2/24/2009 1:34 AM 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/24/2009 1:00 AM 216200]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/24/2009 1:00 AM 242896]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [5/22/2010 7:00 PM 308064]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 5:34 PM 1029456]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [7/24/2008 6:46 PM 12856]
R3 radpms;Driver for RADPMS Device;c:\windows\system32\drivers\radpms.sys [7/24/2008 6:45 PM 12192]
S3 B-Service;B-Service;c:\documents and settings\Jose Sanchez II\Application Data\Mikogo\B-Service.exe [9/10/2009 8:09 PM 185640]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - KLMD23
*Deregistered* - klmd23

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-05-25 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 02:34]

2009-10-21 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8248039139.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 04:52]

2010-05-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1343024091-162531612-839522115-1003Core.job
- c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-07 19:23]

2010-05-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1343024091-162531612-839522115-1003UA.job
- c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-07 19:23]

2010-05-28 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-12-09 23:02]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10591&gct=&gc=1&q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\Firefox\Profiles\7e9y8ptm.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - component: c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\Firefox\Profiles\7e9y8ptm.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components\FoxyTunes.dll
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\Firefox\Profiles\7e9y8ptm.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\Firefox\Profiles\7e9y8ptm.default\extensions\[email protected]\plugins\npRACtrl.dll
FF - plugin: c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-28 18:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(760)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LMIinit.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\system32\LMIRfsClientNP.dll
.
Completion time: 2010-05-28 18:26:36
ComboFix-quarantined-files.txt 2010-05-28 22:26
ComboFix2.txt 2010-05-23 00:43

Pre-Run: 350,494,597,120 bytes free
Post-Run: 350,468,722,688 bytes free

- - End Of File - - 1215150BE21C569F6349D5836DC0E40B


----------



## Rorschach112 (Oct 12, 2008)

why did you run combofix twice ? Post the log from C:\qoobox\combofix.txt

then do this

Open *notepad* and copy/paste the text in the quotebox below into it:



> http://forums.techguy.org/virus-other-malware-removal/925459-alureon-h-removal.html
> 
> Collect::
> c:\windows\system32\drivers\ktqzmsue.sys
> ...


Save this as *CFScript.txt*










Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

***Note** *

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
Ensure you are connected to the internet and click OK on the message box.

Please visit this *site* and follow the instructions for uploading the *file*.


----------



## HoserIN (May 27, 2010)

ComboFix 10-05-28.02 - Jose Sanchez II 05/28/2010 18:51:10.3.4 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3326.1716 [GMT -4:00]
Running from: c:\documents and settings\Jose Sanchez II\My Documents\Downloads\ComboFix.exe
Command switches used :: c:\documents and settings\Jose Sanchez II\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

file zipped: c:\windows\Fcodu.dat
file zipped: c:\windows\Qxafoziqipuzimo.bin
file zipped: c:\windows\system32\config\systemprofile\Application Data\kcmdte.dat
file zipped: c:\windows\system32\drivers\ktqzmsue.sys
file zipped: c:\windows\system32\drivers\rzxosaax.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Fcodu.dat
c:\windows\Qxafoziqipuzimo.bin
c:\windows\system32\config\systemprofile\Application Data\kcmdte.dat
c:\windows\system32\drivers\ktqzmsue.sys
c:\windows\system32\drivers\rzxosaax.sys

.
((((((((((((((((((((((((( Files Created from 2010-04-28 to 2010-05-28 )))))))))))))))))))))))))))))))
.

2010-05-26 00:32 . 2010-05-26 00:32 503808 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-5f40f164-n\msvcp71.dll
2010-05-26 00:32 . 2010-05-26 00:32 348160 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-5f40f164-n\msvcr71.dll
2010-05-26 00:32 . 2010-05-26 00:32 499712 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-5f40f164-n\jmc.dll
2010-05-26 00:28 . 2010-05-26 11:50 15944 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-05-26 00:28 . 2010-05-26 00:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro
2010-05-26 00:28 . 2010-05-26 00:28 -------- d-----w- c:\program files\Hitman Pro 3.5
2010-05-26 00:22 . 2010-05-26 00:24 -------- d-----w- c:\documents and settings\Jose Sanchez II\Application Data\QuickScan
2010-05-22 23:51 . 2010-05-28 19:47 0 ----a-w- c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\prvlcl.dat
2010-05-22 23:02 . 2010-05-22 23:02 -------- d-----w- C:\$AVG
2010-05-22 22:59 . 2010-05-22 22:59 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-05-21 22:44 . 2009-05-07 07:04 157712 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-05-21 22:26 . 2010-05-21 22:26 -------- d-----w- c:\windows\system32\wbem\Repository
2010-05-17 22:47 . 2010-05-17 22:47 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee
2010-05-12 14:04 . 2010-05-12 14:04 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-05-12 14:04 . 2010-05-12 14:04 1924976 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2010-05-12 14:04 . 2010-05-12 14:04 1025992 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\SecurityScan_Release.exe
2010-05-12 14:04 . 2010-05-12 14:04 -------- d-----w- c:\program files\NOS
2010-05-12 14:04 . 2010-03-29 12:53 32576 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\Firefox\Profiles\7e9y8ptm.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-05-12 14:04 . 2010-03-29 12:53 29984 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\Firefox\Profiles\7e9y8ptm.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-05-07 19:23 . 2010-05-07 19:23 -------- d-----w- c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\Temp
2010-05-04 21:14 . 2010-05-04 21:14 -------- d-----w- c:\documents and settings\Jose Sanchez II\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2010-05-04 21:12 . 2010-05-04 21:12 -------- d-----w- c:\program files\Foxonic Lite

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-28 22:46 . 2009-03-10 00:57 -------- d-----w- c:\documents and settings\Jose Sanchez II\Application Data\DNA
2010-05-28 18:59 . 2009-04-06 22:34 -------- d-----w- c:\program files\LogMeIn
2010-05-27 11:15 . 2009-11-23 00:33 -------- d-----w- c:\documents and settings\Jose Sanchez II\Application Data\Skype
2010-05-27 11:13 . 2009-03-10 00:57 -------- d-----w- c:\program files\DNA
2010-05-27 11:11 . 2009-02-24 04:45 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2010-05-26 16:30 . 2009-09-01 01:29 -------- d-----w- c:\program files\SugarSync
2010-05-25 23:32 . 2010-03-18 23:22 4337344 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-05-23 07:08 . 2009-03-01 01:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-05-22 23:02 . 2010-04-27 18:17 -------- d-----w- c:\program files\AVG
2010-05-22 23:01 . 2009-02-24 05:00 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-05-22 23:01 . 2009-02-24 05:00 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-05-22 23:01 . 2009-02-24 05:00 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-05-22 23:01 . 2009-02-24 05:00 29512 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-05-19 21:08 . 2008-08-14 11:57 73312 ----a-w- c:\windows\system32\drivers\adfs.sys
2010-05-18 22:34 . 2009-10-30 19:47 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-05-12 14:10 . 2009-03-15 17:08 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-05-12 14:07 . 2009-02-24 04:28 -------- d-----w- c:\program files\Common Files\Adobe
2010-05-06 14:36 . 2009-11-01 01:29 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-04-30 20:53 . 2009-09-19 04:09 -------- d-----w- c:\program files\Common Files\Device
2010-04-28 13:16 . 2009-02-24 04:39 -------- d-----w- c:\program files\Paltalk Messenger
2010-04-21 04:08 . 2010-04-21 04:08 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-04-19 18:59 . 2010-04-19 18:59 255472 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\plugins\npgoogletalk.dll
2010-04-12 20:08 . 2009-11-23 00:35 -------- d-----w- c:\documents and settings\Jose Sanchez II\Application Data\skypePM
2010-04-06 22:25 . 2010-02-20 23:50 -------- d-----w- c:\program files\SlySoft
2010-03-31 14:38 . 2010-03-31 14:37 -------- d-----w- c:\documents and settings\All Users\Application Data\SSScanAppDataDir
2010-03-31 14:37 . 2010-03-31 14:37 -------- d-----w- c:\documents and settings\All Users\Application Data\MSScanAppDataDir
2010-03-30 19:47 . 2010-03-30 19:47 -------- d-----w- c:\program files\Common Files\snp2std
2010-03-30 19:47 . 2009-02-24 04:01 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-30 19:47 . 2010-03-30 19:47 -------- d-----w- c:\documents and settings\Jose Sanchez II\Application Data\InstallShield
2010-03-26 22:56 . 2010-03-26 22:56 1956656 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2010-03-24 18:17 . 2010-03-24 08:04 952768 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\6720\AdobeARM.exe
2010-03-24 18:17 . 2010-03-24 08:04 70584 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\6720\AdobeExtractFiles.dll
2010-03-24 18:17 . 2010-03-24 08:04 326056 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\6720\ReaderUpdater.exe
2010-03-24 18:17 . 2010-03-24 08:04 326056 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\6720\AcrobatUpdater.exe
2010-03-17 02:01 . 2010-03-17 02:01 79488 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-17 01:47 . 2009-05-09 16:09 68840 ----a-w- c:\documents and settings\Eric Williams\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-12 02:36 . 2009-02-24 06:15 68840 ----a-w- c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-11 12:38 . 2006-02-28 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2010-03-11 12:38 . 2006-02-28 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-03-11 12:38 . 2006-02-28 12:00 17408 ------w- c:\windows\system32\corpol.dll
2010-03-09 11:09 . 2006-02-28 12:00 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-03-03 22:16 . 2010-03-05 04:28 3862528 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\Firefox\Profiles\7e9y8ptm.default\extensions\[email protected]\plugins\npRACtrl.dll
2010-03-02 02:34 . 2009-05-10 16:39 15688 ----a-w- c:\windows\system32\lsdelete.exe
2010-02-28 13:43 . 2010-01-16 19:31 38784 ----a-w- c:\documents and settings\Jose Sanchez II\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncBackedUp]
@="{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}"
[HKEY_CLASSES_ROOT\CLSID\{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}]
2010-05-05 18:36 151552 ----a-w- c:\program files\SugarSync\SugarSyncShellExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncPending]
@="{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}"
[HKEY_CLASSES_ROOT\CLSID\{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}]
2010-05-05 18:36 151552 ----a-w- c:\program files\SugarSync\SugarSyncShellExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncRoot]
@="{A759AFF6-5851-457D-A540-F4ECED148351}"
[HKEY_CLASSES_ROOT\CLSID\{A759AFF6-5851-457D-A540-F4ECED148351}]
2010-05-05 18:36 151552 ----a-w- c:\program files\SugarSync\SugarSyncShellExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncShared]
@="{1574C9EF-7D58-488F-B358-8B78C1538F51}"
[HKEY_CLASSES_ROOT\CLSID\{1574C9EF-7D58-488F-B358-8B78C1538F51}]
2010-05-05 18:36 151552 ----a-w- c:\program files\SugarSync\SugarSyncShellExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-10-06 323392]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-18 4363504]
"Mikogo"="c:\documents and settings\Jose Sanchez II\Application Data\Mikogo\Mikogo-Host.exe" [2009-10-24 1277224]
"SugarSync"="c:\program files\SugarSync\SugarSyncManager.exe" [2010-05-05 13705216]
"Desktop Software"="c:\program files\Common Files\SupportSoft\bin\bcont.exe" [2009-04-24 1025320]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"AnyDVD"="c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe" [2009-12-28 3214272]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"Google Update"="c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-05-07 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-09-02 16851456]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-02 524632]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-04 61440]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-07-24 63048]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-09 305440]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2010-05-19 611712]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-31 149280]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-02-21 1093208]
"FixCamera"="c:\windows\FixCamera.exe" [2007-07-11 20480]
"tsnp2std"="c:\windows\tsnp2std.exe" [2007-05-12 270336]
"snp2std"="c:\windows\vsnp2std.exe" [2007-09-28 344064]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"HitmanPro35"="c:\program files\Hitman Pro 3.5\HitmanPro35(2).exe" [2010-05-26 5937984]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WUAppSetup"="c:\program files\Common Files\logishrd\WUApp32.exe" [2007-05-12 441120]

c:\documents and settings\Brad Stepp\Start Menu\Programs\Startup\
MPK.exe [2009-4-30 1022976]

c:\documents and settings\Jose Sanchez II\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-2-24 113664]
hp psc 1000 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-4-6 147456]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
Microsoft Broadband Networking.lnk - c:\windows\Installer\{8CC15633-2327-43F4-BA85-B83FDB4B59BE}\_18be6784.exe [2009-4-8 25214]
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2010-4-23 12649736]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-05-22 23:01 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-10-02 02:52 87352 ----a-w- c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNUtil.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNTray.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNCfg.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNUpdate.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\Jose Sanchez II\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2/24/2009 1:34 AM 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/24/2009 1:00 AM 216200]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/24/2009 1:00 AM 242896]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [5/22/2010 7:00 PM 308064]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 5:34 PM 1029456]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [7/24/2008 6:46 PM 12856]
R3 radpms;Driver for RADPMS Device;c:\windows\system32\drivers\radpms.sys [7/24/2008 6:45 PM 12192]
S3 B-Service;B-Service;c:\documents and settings\Jose Sanchez II\Application Data\Mikogo\B-Service.exe [9/10/2009 8:09 PM 185640]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - KLMD23
*Deregistered* - klmd23

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-05-25 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 02:34]

2009-10-21 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8248039139.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 04:52]

2010-05-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1343024091-162531612-839522115-1003Core.job
- c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-07 19:23]

2010-05-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1343024091-162531612-839522115-1003UA.job
- c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-07 19:23]

2010-05-28 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-12-09 23:02]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10591&gct=&gc=1&q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\Firefox\Profiles\7e9y8ptm.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - component: c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\Firefox\Profiles\7e9y8ptm.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components\FoxyTunes.dll
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\Firefox\Profiles\7e9y8ptm.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\Firefox\Profiles\7e9y8ptm.default\extensions\[email protected]\plugins\npRACtrl.dll
FF - plugin: c:\documents and settings\Jose Sanchez II\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\Jose Sanchez II\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-28 18:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(760)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LMIinit.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\system32\LMIRfsClientNP.dll
.
Completion time: 2010-05-28 18:54:12
ComboFix-quarantined-files.txt 2010-05-28 22:54
ComboFix2.txt 2010-05-28 22:26
ComboFix3.txt 2010-05-23 00:43

Pre-Run: 350,528,385,024 bytes free
Post-Run: 350,511,841,280 bytes free

- - End Of File - - D2B1B4C2A0409A169D47156E864F5044
Upload was successful


----------



## Rorschach112 (Oct 12, 2008)

Download *TFC* to your desktop

Open the file and close any other windows.
It *will close all programs itself* when run, make sure to let it run uninterrupted.
Click the Start button to begin the process. The program should not take long to finish its job
Once its finished it should *reboot your machine*, if not, do this yourself to ensure a complete clean

Please download Malwarebytes' Anti-Malware from *Here*

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to *Update Malwarebytes' Anti-Malware* and *Launch Malwarebytes' Anti-Malware*, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "*Perform Quick Scan*", then click *Scan*. 
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that *everything is checked*, and click *Remove Selected*.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.
Extra Note:
*If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.*

Go to *Kaspersky website* and perform an online antivirus scan.


Read through the requirements and privacy statement and click on *Accept* button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click *Run*.
When the downloads have finished, click on *Settings*.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the *Save* button:
Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases

Click on *My Computer* under *Scan*.
Once the scan is complete, it will display the results. Click on *View Scan Report*.
You will see a list of infected items there. Click on *Save Report As...*.
Save this report to a convenient place. Change the *Files of type* to *Text file (.txt)* before clicking on the *Save* button. Then post it here.


----------



## HoserIN (May 27, 2010)

Sorry for the delay. I have been away the past few days. Thanks for your continued help. Here are the logs you have requested:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4161

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

6/1/2010 10:10:50 AM
mbam-log-2010-06-01 (10-10-50).txt

Scan type: Quick scan
Objects scanned: 148290
Time elapsed: 8 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

--------------Kaspersky----------------

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Tuesday, June 1, 2010
Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Tuesday, June 01, 2010 13:42:08
Records in database: 4194892
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
F:\
G:\

Scan statistics:
Objects scanned: 109127
Threats found: 3
Infected objects found: 4
Suspicious objects found: 0
Scan duration: 03:18:30

File name / Threat / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\mouclass.sys.vir Infected: Rootkit.Win32.TDSS.ap 1
C:\System Volume Information\_restore{4E65318A-AB5D-4B5D-B48A-54B6AB5EAEB3}\RP609\A0170367.exe Infected: not-a-virus:Monitor.Win32.KGBSpy.ij 1
C:\System Volume Information\_restore{4E65318A-AB5D-4B5D-B48A-54B6AB5EAEB3}\RP609\A0170492.sys Infected: Rootkit.Win32.TDSS.ap 1
C:\System Volume Information\_restore{4E65318A-AB5D-4B5D-B48A-54B6AB5EAEB3}\RP619\A0172621.exe Infected: Trojan-Downloader.Win32.FraudLoad.xazq 1

Selected area has been scanned.


----------



## Rorschach112 (Oct 12, 2008)

Your logs are clean

*Follow these steps to uninstall Combofix and tools used in the removal of malware*

*Uninstall ComboFix*

Remove Combofix now that we're done with it.

Please press the *Windows Key* and *R* on your keyboard. This will bring up the Run... command.
Now type in *Combofix /Uninstall* in the runbox and click *OK*. (Notice the space between the "x" and "/")








Please follow the prompts to uninstall Combofix.
You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.


Download *OTC* to your desktop and run it
Click Yes to beginning the Cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.


Please read my guide on how to *prevent malware* and about *safe computing* *here*
Thank you for your patience, and performing all of the procedures requested.


----------

