 Spyware/Malware/Trojan??? |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Want a New HP LaserJet MFP? Trade in your old printer and receive $1,000 in savings!
Trade in your old printer and receive up to $1,000 in saving on a new HP LaserJet Multifunction Printer. Click here for savings!
Forum Guidelines
Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.
Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help DO NOT RUN ComboFix unless requested to. Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log. When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc. Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  |
 Dec 1 2009, 09:25 PM
Post
#16
|
|
|
Member  Group: Members Posts: 30 Joined: 16-November 09 From: California Member No.: 403,570  |
[2000/09/18 15:50:28 | 00,202,752 | ---- | M] () -- C:\WINDOWS\System32\zlib.dll [2000/08/31 07:00:00 | 00,212,480 | ---- | M] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2000/08/31 07:00:00 | 00,161,792 | ---- | M] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2000/08/31 07:00:00 | 00,136,704 | ---- | M] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2000/08/31 07:00:00 | 00,098,816 | ---- | M] () -- C:\WINDOWS\sed.exe [2000/08/31 07:00:00 | 00,089,504 | ---- | M] (Smallfrogs Studio) -- C:\WINDOWS\fdsv.exe [2000/08/31 07:00:00 | 00,080,412 | ---- | M] () -- C:\WINDOWS\grep.exe [2000/08/31 07:00:00 | 00,068,096 | ---- | M] () -- C:\WINDOWS\zip.exe [2000/08/31 07:00:00 | 00,049,152 | ---- | M] () -- C:\WINDOWS\VFIND.exe [2000/08/31 07:00:00 | 00,029,696 | ---- | M] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2000/05/23 21:45:58 | 00,118,784 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MSSTDFMT.DLL [2000/05/22 15:58:12 | 00,244,416 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msflxgrd.ocx [2000/05/22 15:58:00 | 00,608,448 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\comctl32.ocx [2000/05/21 23:00:00 | 00,203,976 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\RICHTX32.OCX [2000/05/11 13:06:20 | 00,397,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MSRDO20.DLL [2000/04/03 17:52:54 | 00,151,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\RDOCURS.DLL [2000/03/31 17:12:30 | 00,009,488 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\setupdd.dll [1999/11/24 17:40:50 | 00,040,960 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\VBAME.DLL [1999/10/17 19:01:42 | 01,129,232 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\FM20.DLL [1999/10/17 19:01:16 | 00,026,384 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\FM20ENU.DLL [1999/05/07 00:00:00 | 00,140,288 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\Comdlg32.ocx [1999/03/25 20:00:00 | 00,101,888 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\Vb6stkit.dll [1999/01/05 16:30:02 | 00,225,280 | ---- | M] (VideoSoft) -- C:\WINDOWS\System32\VSFLEX3.OCX [1998/10/29 15:45:06 | 00,306,688 | ---- | M] (InstallShield Software Corporation) -- C:\WINDOWS\IsUninst.exe [1998/08/09 10:07:34 | 00,094,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MSSTKPRP.DLL [1998/07/04 11:54:44 | 00,046,592 | ---- | M] (Mark Pierce) -- C:\WINDOWS\System32\Dox.ocx [1998/06/17 18:08:32 | 00,053,248 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MFC42ENU.DLL [1998/03/24 20:54:08 | 00,015,872 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\SCP32.DLL [1998/03/24 12:44:06 | 00,024,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\VBAEND32.OLB [1998/03/24 12:44:06 | 00,024,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\VBAEN32.OLB [1998/02/06 22:37:32 | 00,299,520 | ---- | M] (InstallShield Corporation, Inc.) -- C:\WINDOWS\uninst.exe [1996/12/03 13:50:14 | 00,037,376 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\VEN2232.OLB [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\Documents and Settings\Anna\My Documents\*.tmp files -> C:\Documents and Settings\Anna\My Documents\*.tmp -> ] ========== Files Created - No Company Name ========== [2099/01/01 12:00:00 | 00,011,168 | -H-- | C] () -- C:\WINDOWS\System32\tanokiso [2009/11/29 17:32:27 | 00,524,800 | ---- | C] () -- C:\Documents and Settings\Anna\Desktop\dds.dds.scr [2009/11/20 14:01:05 | 00,288,876 | ---- | C] () -- C:\Documents and Settings\Anna\My Documents\bookmarks-2009-11-20.json [2009/11/11 01:02:55 | 06,373,376 | ---- | C] () -- C:\Documents and Settings\Anna\ntuser.dat [2009/11/04 01:19:31 | 00,001,393 | ---- | C] () -- C:\WINDOWS\imsins.BAK [2009/11/03 00:07:21 | 00,105,984 | ---- | C] () -- C:\Documents and Settings\Anna\My Documents\Towel It Off.doc [2009/11/02 17:03:23 | 01,094,021 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\dvdshrink32setup1.zip [2009/10/23 09:21:01 | 00,101,376 | ---- | C] () -- C:\Documents and Settings\Anna\Desktop\Cracking WPA.doc [2009/10/21 13:55:10 | 00,544,112 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\iavifw.avm [2009/10/21 13:55:10 | 00,113,461 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\iavichjw.avm [2009/10/21 12:14:42 | 00,024,064 | ---- | C] () -- C:\Documents and Settings\Anna\My Documents\Cake in a Cup.doc [2009/10/20 23:10:05 | 00,056,832 | ---- | C] () -- C:\Documents and Settings\Anna\My Documents\Whoa reading list.doc [2009/10/19 18:01:17 | 00,001,458 | ---- | C] () -- C:\Documents and Settings\Anna\Desktop\Lock.lnk [2009/10/19 15:41:38 | 00,000,028 | ---- | C] () -- C:\WINDOWS\System32\mcheck.mhf [2009/10/19 15:12:51 | 00,000,566 | ---- | C] () -- C:\WINDOWS\eReg.dat [2009/10/13 14:15:00 | 00,061,440 | ---- | C] () -- C:\Documents and Settings\Anna\My Documents\Club Songs.doc [2009/10/02 15:46:43 | 00,000,058 | ---- | C] () -- C:\WINDOWS\wf4.dat [2009/10/02 15:46:43 | 00,000,002 | ---- | C] () -- C:\WINDOWS\wf3.dat [2009/10/02 15:46:33 | 00,000,036 | ---- | C] () -- C:\WINDOWS\System32\skynet.dat [2009/10/02 15:46:33 | 00,000,009 | ---- | C] () -- C:\WINDOWS\System32\nuar.old [2009/10/02 15:46:32 | 00,545,280 | ---- | C] () -- C:\WINDOWS\System32\pump.exe [2009/10/02 15:46:32 | 00,000,087 | ---- | C] () -- C:\WINDOWS\System32\wwp.htm [2009/09/29 21:19:11 | 00,010,752 | ---- | C] () -- C:\Documents and Settings\Anna\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009/09/23 21:34:38 | 00,000,715 | ---- | C] () -- C:\Documents and Settings\Anna\Desktop\hott notes 4.lnk [2009/09/07 20:27:36 | 00,030,125 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\BuybackLabel.pdf [2009/09/07 20:27:36 | 00,029,738 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\USPSReturnLabel.pdf [2009/09/07 20:27:36 | 00,025,600 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\Firstclassbooks.doc [2009/09/06 16:25:32 | 00,000,162 | -H-- | C] () -- C:\Documents and Settings\Anna\My Documents\~$pt stuff.doc [2009/09/04 11:18:54 | 00,223,128 | ---- | C] () -- C:\WINDOWS\System32\drivers\dtscsi.sys [2009/09/04 11:10:29 | 00,664,064 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009/09/04 11:10:29 | 00,096,256 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd6013.sys [2009/09/03 10:13:29 | 00,016,486 | R--- | C] () -- C:\WINDOWS\System32\drivers\sktsio9x.vxd [2009/09/03 10:13:29 | 00,005,787 | R--- | C] () -- C:\WINDOWS\System32\drivers\SCTB.VXD [2009/09/03 10:13:29 | 00,000,208 | R--- | C] () -- C:\WINDOWS\System32\drivers\vssver.scc [2009/09/03 10:13:28 | 00,014,380 | R--- | C] () -- C:\WINDOWS\System32\drivers\OXSER.VXD [2009/09/03 10:12:40 | 00,013,304 | ---- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys [2009/09/03 10:12:39 | 00,011,860 | ---- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys [2009/08/19 21:03:49 | 00,006,144 | ---- | C] () -- C:\WINDOWS\System32\ff_acm.acm [2009/08/18 20:27:01 | 00,001,466 | ---- | C] () -- C:\Documents and Settings\Anna\My Documents\DivX Movies.lnk [2009/07/21 20:35:11 | 00,081,920 | R--- | C] () -- C:\WINDOWS\System32\srctrl.dll [2009/07/13 21:27:25 | 00,000,085 | ---- | C] () -- C:\WINDOWS\System32\geyekruearlfmo.dat [2009/07/13 21:26:57 | 01,110,399 | ---- | C] () -- C:\WINDOWS\System32\UACttqfqjdaifxbgpulk.db [2009/06/01 12:56:19 | 00,000,034 | ---- | C] () -- C:\Documents and Settings\Anna\Application Data\pcouffin.log [2009/06/01 12:55:54 | 00,087,608 | ---- | C] () -- C:\Documents and Settings\Anna\Application Data\inst.exe [2009/06/01 12:55:54 | 00,007,887 | ---- | C] () -- C:\Documents and Settings\Anna\Application Data\pcouffin.cat [2009/06/01 12:55:54 | 00,001,144 | ---- | C] () -- C:\Documents and Settings\Anna\Application Data\pcouffin.inf [2009/05/27 17:55:22 | 00,000,310 | ---- | C] () -- C:\WINDOWS\tasks\GlaryInitialize.job [2009/05/24 22:52:37 | 00,000,163 | ---- | C] () -- C:\Documents and Settings\Anna\webct_upload_applet.properties [2009/05/22 14:13:06 | 00,087,552 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll [2009/05/15 10:33:46 | 01,578,030 | -H-- | C] () -- C:\Documents and Settings\Anna\Local Settings\Application Data\IconCache.db [2009/05/13 20:12:09 | 00,000,125 | ---- | C] () -- C:\Documents and Settings\Anna\default.pls [2009/05/13 20:08:10 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009/05/13 20:08:06 | 00,000,414 | ---- | C] () -- C:\WINDOWS\System32\lame_acm.xml [2009/05/13 20:08:04 | 00,159,744 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009/05/13 20:08:03 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009/05/13 20:07:58 | 00,057,344 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009/05/13 20:07:58 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009/05/13 17:22:39 | 00,000,420 | -H-- | C] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{63756D05-40CA-4EEA-9053-5048F843C105}.job [2009/03/30 18:11:48 | 00,052,408 | ---- | C] () -- C:\Documents and Settings\Anna\Local Settings\Application Data\GDIPFONTCACHEV1.DAT [2009/03/30 18:08:46 | 00,002,137 | ---- | C] () -- C:\Documents and Settings\Anna\Desktop\iTunes.lnk [2009/03/30 18:04:24 | 00,000,284 | ---- | C] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2009/03/28 15:55:56 | 00,052,408 | ---- | C] () -- C:\Documents and Settings\Anna\Application Data\GDIPFONTCACHEV1.DAT [2009/03/24 21:32:13 | 00,000,104 | ---- | C] () -- C:\Documents and Settings\Anna\Desktop\Shortcut to My Network Places.lnk [2009/03/24 21:01:19 | 00,000,338 | ---- | C] () -- C:\Documents and Settings\Anna\Desktop\Shortcut to My Documents.lnk [2009/03/24 21:01:00 | 00,000,104 | ---- | C] () -- C:\Documents and Settings\Anna\Desktop\My Computer.lnk [2009/03/24 20:58:09 | 00,000,178 | -HS- | C] () -- C:\Documents and Settings\Anna\ntuser.ini [2009/03/24 20:58:08 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\Anna\Application Data\desktop.ini [2009/03/24 20:58:06 | 06,291,456 | -H-- | C] () -- C:\Documents and Settings\Anna\NTUSER.DAT.gbck [2009/03/17 20:14:48 | 00,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2009/03/17 20:14:48 | 00,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2009/03/17 20:14:48 | 00,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2009/03/17 20:14:48 | 00,049,152 | ---- | C] () -- C:\WINDOWS\VFIND.exe [2009/03/09 15:58:49 | 00,001,172 | ---- | C] () -- C:\WINDOWS\mozver.dat [2009/02/16 11:35:32 | 46,003,765 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm [2009/02/16 11:35:32 | 06,061,540 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\avi7.avg [2009/02/16 11:35:32 | 00,492,629 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\miniavi.avg [2009/02/16 11:35:32 | 00,108,263 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg [2009/02/16 10:48:59 | 00,002,390 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\LuUninstall.LiveUpdate [2009/02/12 21:20:42 | 00,005,630 | ---- | C] () -- C:\WINDOWS\System32\IE8Eula.rtf [2009/01/21 23:07:02 | 00,000,000 | ---- | C] () -- C:\WINDOWS\LM.INI [2009/01/07 17:20:36 | 00,066,384 | ---- | C] () -- C:\WINDOWS\System32\normnfkc.nls [2009/01/07 17:20:36 | 00,060,294 | ---- | C] () -- C:\WINDOWS\System32\normnfkd.nls [2009/01/07 17:20:36 | 00,059,342 | ---- | C] () -- C:\WINDOWS\System32\normidna.nls [2009/01/07 17:20:36 | 00,045,794 | ---- | C] () -- C:\WINDOWS\System32\normnfc.nls [2009/01/07 17:20:36 | 00,039,284 | ---- | C] () -- C:\WINDOWS\System32\normnfd.nls [2009/01/07 17:20:20 | 00,008,798 | ---- | C] () -- C:\WINDOWS\System32\icrav03.rat [2009/01/07 17:20:20 | 00,001,988 | ---- | C] () -- C:\WINDOWS\System32\ticrf.rat [2008/06/03 20:30:04 | 00,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2008/06/03 13:35:16 | 00,000,433 | ---- | C] () -- C:\WINDOWS\System32\drivers\etc\hosts.ics [2008/06/03 12:27:39 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\swunilog.ini [2008/04/29 13:42:24 | 00,503,808 | ---- | C] () -- C:\WINDOWS\System32\ICCProfiles.dll [2008/02/26 09:24:03 | 00,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI [2008/02/09 22:44:56 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2008/02/09 15:42:38 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2008/02/09 15:41:52 | 00,001,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk [2008/02/09 13:40:10 | 00,013,646 | ---- | C] () -- C:\WINDOWS\System32\wpa.bak [2008/02/09 13:33:48 | 00,000,006 | -H-- | C] () -- C:\WINDOWS\tasks\SA.DAT [2008/02/09 13:33:27 | 00,008,192 | ---- | C] () -- C:\WINDOWS\REGLOCS.OLD [2008/02/09 13:32:30 | 00,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2008/02/09 13:32:15 | 00,028,288 | ---- | C] () -- C:\WINDOWS\System32\dllcache\xjis.nls [2008/02/09 13:31:33 | 00,083,748 | ---- | C] () -- C:\WINDOWS\System32\dllcache\prcp.nls [2008/02/09 13:31:33 | 00,083,748 | ---- | C] () -- C:\WINDOWS\System32\dllcache\prc.nls [2008/02/09 13:31:31 | 00,175,104 | ---- | C] () -- C:\WINDOWS\System32\dllcache\pintlcsa.dll [2008/02/09 13:31:06 | 00,047,066 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ksc.nls [2008/02/09 13:31:05 | 01,158,818 | ---- | C] () -- C:\WINDOWS\System32\dllcache\korwbrkr.lex [2008/02/09 13:30:56 | 00,059,392 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imscinst.exe [2008/02/09 13:30:55 | 00,196,665 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imjpinst.exe [2008/02/09 13:30:53 | 00,134,339 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imekr.lex [2008/02/09 13:30:42 | 13,463,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hwxjpn.dll [2008/02/09 13:30:36 | 00,108,827 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hanja.lex [2008/02/09 13:30:30 | 00,094,208 | ---- | C] () -- C:\WINDOWS\System32\dllcache\fpencode.dll [2008/02/09 13:30:14 | 00,173,568 | ---- | C] () -- C:\WINDOWS\System32\dllcache\chtskf.dll [2008/02/09 13:30:09 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_864.nls [2008/02/09 13:30:09 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_862.nls [2008/02/09 13:30:09 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_858.nls [2008/02/09 13:30:09 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_720.nls [2008/02/09 13:30:09 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_870.nls [2008/02/09 13:30:08 | 00,177,698 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20949.nls [2008/02/09 13:30:08 | 00,173,602 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20936.nls [2008/02/09 13:30:08 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_708.nls [2008/02/09 13:30:08 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28596.nls [2008/02/09 13:30:08 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_21027.nls [2008/02/09 13:30:08 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_21025.nls [2008/02/09 13:30:07 | 00,180,770 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20932.nls [2008/02/09 13:30:07 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20924.nls [2008/02/09 13:30:07 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20880.nls [2008/02/09 13:30:07 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20871.nls [2008/02/09 13:30:07 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20838.nls [2008/02/09 13:30:07 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20833.nls [2008/02/09 13:30:07 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20424.nls [2008/02/09 13:30:07 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20423.nls [2008/02/09 13:30:06 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20420.nls [2008/02/09 13:30:06 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20297.nls [2008/02/09 13:30:06 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20290.nls [2008/02/09 13:30:06 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20285.nls [2008/02/09 13:30:06 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20284.nls [2008/02/09 13:30:06 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20280.nls [2008/02/09 13:30:06 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20278.nls [2008/02/09 13:30:06 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20277.nls [2008/02/09 13:30:06 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20273.nls [2008/02/09 13:30:05 | 00,187,938 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20005.nls [2008/02/09 13:30:05 | 00,185,378 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20003.nls [2008/02/09 13:30:05 | 00,180,258 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20004.nls [2008/02/09 13:30:05 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20269.nls [2008/02/09 13:30:05 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20108.nls [2008/02/09 13:30:05 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20107.nls [2008/02/09 13:30:05 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20106.nls [2008/02/09 13:30:05 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20105.nls [2008/02/09 13:30:04 | 00,189,986 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1361.nls [2008/02/09 13:30:04 | 00,186,402 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20001.nls [2008/02/09 13:30:04 | 00,180,258 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20000.nls [2008/02/09 13:30:04 | 00,173,602 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20002.nls [2008/02/09 13:30:04 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1149.nls [2008/02/09 13:30:04 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1148.nls [2008/02/09 13:30:03 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1147.nls [2008/02/09 13:30:03 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1146.nls [2008/02/09 13:30:03 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1145.nls [2008/02/09 13:30:03 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1144.nls [2008/02/09 13:30:03 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1143.nls [2008/02/09 13:30:03 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1142.nls [2008/02/09 13:30:03 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1141.nls [2008/02/09 13:30:03 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1140.nls [2008/02/09 13:30:03 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1047.nls [2008/02/09 13:30:02 | 00,195,618 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10002.nls [2008/02/09 13:30:02 | 00,177,698 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10003.nls [2008/02/09 13:30:02 | 00,173,602 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10008.nls [2008/02/09 13:30:02 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10021.nls [2008/02/09 13:30:02 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10005.nls [2008/02/09 13:30:02 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10004.nls [2008/02/09 13:30:01 | 00,162,850 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10001.nls [2008/02/09 13:30:01 | 00,082,172 | ---- | C] () -- C:\WINDOWS\System32\dllcache\bopomofo.nls [2008/02/09 13:30:00 | 00,066,728 | ---- | C] () -- C:\WINDOWS\System32\dllcache\big5.nls [2008/02/09 13:28:51 | 00,002,577 | ---- | C] () -- C:\WINDOWS\System32\CONFIG.NT [2008/02/09 13:28:51 | 00,000,000 | RHS- | C] () -- C:\MSDOS.SYS [2008/02/09 13:28:51 | 00,000,000 | RHS- | C] () -- C:\IO.SYS [2008/02/09 13:28:51 | 00,000,000 | ---- | C] () -- C:\CONFIG.SYS [2008/02/09 13:28:51 | 00,000,000 | ---- | C] () -- C:\AUTOEXEC.BAT [2008/02/09 13:28:41 | 00,023,392 | ---- | C] () -- C:\WINDOWS\System32\nscompat.tlb [2008/02/09 13:28:41 | 00,016,832 | ---- | C] () -- C:\WINDOWS\System32\amcompat.tlb [2008/02/09 13:28:39 | 00,316,640 | ---- | C] () -- C:\WINDOWS\WMSysPr9.prx [2008/02/09 13:27:25 | 00,000,488 | RH-- | C] () -- C:\WINDOWS\System32\WindowsLogon.manifest [2008/02/09 13:27:25 | 00,000,488 | RH-- | C] () -- C:\WINDOWS\System32\logonui.exe.manifest [2008/02/09 13:27:18 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\System32\wuaucpl.cpl.manifest [2008/02/09 13:27:18 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\WindowsShell.Manifest [2008/02/09 13:27:18 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\System32\sapi.cpl.manifest [2008/02/09 13:27:18 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\System32\nwc.cpl.manifest [2008/02/09 13:27:18 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\System32\cdplayer.exe.manifest [2008/02/09 13:27:17 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\System32\ncpa.cpl.manifest [2008/02/09 13:26:57 | 04,399,505 | ---- | C] () -- C:\WINDOWS\System32\dllcache\nls302en.lex [2008/02/09 13:26:27 | 00,048,680 | -HS- | C] () -- C:\WINDOWS\winnt256.bmp [2008/02/09 13:26:27 | 00,048,680 | -HS- | C] () -- C:\WINDOWS\winnt.bmp [2008/02/09 13:26:21 | 00,000,984 | ---- | C] () -- C:\WINDOWS\System32\dllcache\srframe.mmf [2008/02/09 13:26:09 | 00,004,639 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mplayer2.exe [2008/02/09 13:25:58 | 00,376,320 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msinfo.dll [2008/02/09 13:25:06 | 00,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2008/02/09 13:24:12 | 00,065,954 | ---- | C] () -- C:\WINDOWS\Prairie Wind.bmp [2008/02/09 13:24:12 | 00,065,832 | ---- | C] () -- C:\WINDOWS\Santa Fe Stucco.bmp [2008/02/09 13:24:12 | 00,026,680 | ---- | C] () -- C:\WINDOWS\River Sumida.bmp [2008/02/09 13:24:12 | 00,026,582 | ---- | C] () -- C:\WINDOWS\Greenstone.bmp [2008/02/09 13:24:12 | 00,017,362 | ---- | C] () -- C:\WINDOWS\Rhododendron.bmp [2008/02/09 13:24:12 | 00,017,336 | ---- | C] () -- C:\WINDOWS\Gone Fishing.bmp [2008/02/09 13:24:12 | 00,016,730 | ---- | C] () -- C:\WINDOWS\FeatherTexture.bmp [2008/02/09 13:24:12 | 00,009,522 | ---- | C] () -- C:\WINDOWS\Zapotec.bmp [2008/02/09 13:24:11 | 00,093,702 | ---- | C] () -- C:\WINDOWS\System32\subrange.uce [2008/02/09 13:24:11 | 00,065,978 | ---- | C] () -- C:\WINDOWS\Soap Bubbles.bmp [2008/02/09 13:24:11 | 00,060,458 | ---- | C] () -- C:\WINDOWS\System32\ideograf.uce [2008/02/09 13:24:11 | 00,017,062 | ---- | C] () -- C:\WINDOWS\Coffee Bean.bmp [2008/02/09 13:24:11 | 00,016,740 | ---- | C] () -- C:\WINDOWS\System32\shiftjis.uce [2008/02/09 13:24:11 | 00,012,876 | ---- | C] () -- C:\WINDOWS\System32\korean.uce [2008/02/09 13:24:11 | 00,008,484 | ---- | C] () -- C:\WINDOWS\System32\kanji_2.uce [2008/02/09 13:24:11 | 00,006,948 | ---- | C] () -- C:\WINDOWS\System32\kanji_1.uce [2008/02/09 13:24:11 | 00,001,272 | ---- | C] () -- C:\WINDOWS\Blue Lace 16.bmp [2008/02/09 13:24:10 | 00,024,006 | ---- | C] () -- C:\WINDOWS\System32\gb2312.uce [2008/02/09 13:24:10 | 00,022,984 | ---- | C] () -- C:\WINDOWS\System32\bopomofo.uce [2008/02/09 13:24:09 | 00,003,286 | ---- | C] () -- C:\WINDOWS\System32\tslabels.h [2008/02/09 13:24:09 | 00,001,161 | ---- | C] () -- C:\WINDOWS\System32\usrlogon.cmd [2008/02/09 13:24:08 | 00,000,768 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.h [2008/02/09 13:24:01 | 00,063,488 | ---- | C] () -- C:\WINDOWS\System32\wmimgmt.msc [2008/02/09 05:17:03 | 01,685,606 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sam.spd [2008/02/09 05:17:03 | 00,000,888 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sam.sdf [2008/02/09 05:17:02 | 00,643,717 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ltts1033.lxa [2008/02/09 05:17:02 | 00,605,050 | ---- | C] () -- C:\WINDOWS\System32\dllcache\r1033tts.lxa [2008/02/09 05:17:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28603.nls [2008/02/09 05:17:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_28603.nls [2008/02/09 05:16:58 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_857.nls [2008/02/09 05:16:58 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_857.nls [2008/02/09 05:16:58 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28599.nls [2008/02/09 05:16:58 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_28599.nls [2008/02/09 05:16:58 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10081.nls [2008/02/09 05:16:58 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10081.nls [2008/02/09 05:16:56 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28595.nls [2008/02/09 05:16:56 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\C_28595.NLS [2008/02/09 05:16:56 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10017.nls [2008/02/09 05:16:56 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10017.nls [2008/02/09 05:16:56 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10007.nls [2008/02/09 05:16:56 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10007.nls [2008/02/09 05:16:54 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_869.nls [2008/02/09 05:16:54 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_869.nls [2008/02/09 05:16:54 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_737.nls [2008/02/09 05:16:54 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_737.nls [2008/02/09 05:16:54 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_875.nls [2008/02/09 05:16:54 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_875.nls [2008/02/09 05:16:54 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28597.nls [2008/02/09 05:16:54 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\C_28597.NLS [2008/02/09 05:16:54 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10006.nls [2008/02/09 05:16:54 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10006.nls [2008/02/09 05:16:53 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_866.nls [2008/02/09 05:16:53 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_866.nls [2008/02/09 05:16:53 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_855.nls [2008/02/09 05:16:53 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_855.nls [2008/02/09 05:16:53 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28594.nls [2008/02/09 05:16:53 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\C_28594.NLS [2008/02/09 05:16:51 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_852.nls [2008/02/09 05:16:51 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_852.nls [2008/02/09 05:16:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10082.nls [2008/02/09 05:16:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10082.nls [2008/02/09 05:16:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10029.nls [2008/02/09 05:16:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10029.nls [2008/02/09 05:16:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10010.nls [2008/02/09 05:16:51 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10010.nls [2008/02/09 05:16:49 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20127.nls [2008/02/09 05:16:49 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_20127.nls [2008/02/09 05:16:46 | 00,001,688 | ---- | C] () -- C:\WINDOWS\System32\AUTOEXEC.NT [2008/02/09 05:16:34 | 00,141,702 | ---- | C] () -- C:\WINDOWS\System32\dllcache\netfx.cat [2008/02/09 05:16:34 | 00,031,965 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mediactr.cat [2008/02/09 05:16:34 | 00,024,209 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn7.cat [2008/02/09 05:16:34 | 00,011,651 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn9.cat [2008/02/09 05:16:34 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini [2008/02/09 05:16:33 | 01,089,601 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ntprint.cat [2008/02/09 05:16:33 | 00,797,189 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5IIS.CAT [2008/02/09 05:16:33 | 00,399,645 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MAPIMIG.CAT [2008/02/09 05:16:33 | 00,110,116 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tabletpc.cat [2008/02/09 05:16:33 | 00,037,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MW770.CAT [2008/02/09 05:16:33 | 00,031,281 | ---- | C] () -- C:\WINDOWS\System32\dllcache\FP4.CAT [2008/02/09 05:16:33 | 00,013,753 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IMS.CAT [2008/02/09 05:16:33 | 00,013,472 | ---- | C] () -- C:\WINDOWS\System32\dllcache\HPCRDP.CAT [2008/02/09 05:16:33 | 00,009,581 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSMSGS.CAT [2008/02/09 05:16:33 | 00,008,574 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IASNT4.CAT [2008/02/09 05:16:33 | 00,007,382 | ---- | C] () -- C:\WINDOWS\System32\dllcache\OEMBIOS.CAT [2008/02/09 05:16:33 | 00,007,334 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmerrenu.cat [2008/02/09 05:16:33 | 00,007,245 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSTSWEB.CAT [2008/02/09 05:16:32 | 02,012,670 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5.CAT [2008/02/09 05:16:32 | 01,042,903 | ---- | C] () -- C:\WINDOWS\System32\dllcache\SP2.CAT [2008/02/09 05:16:32 | 00,504,678 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5INF.CAT [2008/02/09 05:15:48 | 00,219,248 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2008/02/09 05:14:56 | 00,000,281 | RHS- | C] () -- C:\boot.ini [2008/02/09 05:14:52 | 00,000,261 | ---- | C] () -- C:\WINDOWS\System32\$winnt$.inf [2006/06/29 13:58:52 | 00,030,808 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont [2006/06/29 13:53:56 | 00,026,489 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont [2006/06/14 01:00:45 | 00,082,944 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wdmaud.sys [2006/06/14 00:47:46 | 00,006,400 | ---- | C] () -- C:\WINDOWS\System32\dllcache\splitter.sys [2006/06/14 00:47:45 | 00,172,416 | ---- | C] () -- C:\WINDOWS\System32\dllcache\kmixer.sys [2006/04/18 14:39:28 | 00,029,779 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont [2006/04/18 14:39:28 | 00,026,040 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont [2006/02/28 04:00:00 | 13,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2006/02/28 04:00:00 | 13,107,200 | ---- | C] () -- C:\WINDOWS\System32\dllcache\oembios.bin [2006/02/28 04:00:00 | 03,440,660 | ---- | C] () -- C:\WINDOWS\System32\drivers\gm.dls [2006/02/28 04:00:00 | 03,440,660 | ---- | C] () -- C:\WINDOWS\System32\dllcache\gm.dls [2006/02/28 04:00:00 | 01,326,080 | ---- | C] () -- C:\WINDOWS\System32\webfldrs.msi [2006/02/28 04:00:00 | 01,309,184 | ---- | C] () -- C:\WINDOWS\System32\wbdbase.deu [2006/02/28 04:00:00 | 01,290,752 | ---- | C] () -- C:\WINDOWS\System32\dllcache\quartz.dll [2006/02/28 04:00:00 | 01,193,414 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sysmain.sdb [2006/02/28 04:00:00 | 01,095,680 | ---- | C] () -- C:\WINDOWS\System32\wbdbase.nld [2006/02/28 04:00:00 | 00,957,440 | ---- | C] () -- C:\WINDOWS\System32\wbdbase.enu [2006/02/28 04:00:00 | 00,956,990 | ---- | C] () -- C:\WINDOWS\System32\instcat.sql [2006/02/28 04:00:00 | 00,937,984 | ---- | C] () -- C:\WINDOWS\System32\wbdbase.sve [2006/02/28 04:00:00 | 00,867,840 | ---- | C] () -- C:\WINDOWS\System32\wbdbase.ita [2006/02/28 04:00:00 | 00,844,314 | ---- | C] () -- C:\WINDOWS\System32\msdxm.ocx [2006/02/28 04:00:00 | 00,844,314 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msdxm.ocx [2006/02/28 04:00:00 | 00,786,944 | ---- | C] () -- C:\WINDOWS\System32\wbdbase.fra [2006/02/28 04:00:00 | 00,759,966 | ---- | C] () -- C:\WINDOWS\System32\dllcache\apph_sp.sdb [2006/02/28 04:00:00 | 00,750,080 | ---- | C] () -- C:\WINDOWS\System32\wbdbase.esn [2006/02/28 04:00:00 | 00,733,696 | ---- | C] () -- C:\WINDOWS\System32\dllcache\qedwipes.dll [2006/02/28 04:00:00 | 00,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2006/02/28 04:00:00 | 00,673,088 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mlang.dat [2006/02/28 04:00:00 | 00,562,176 | ---- | C] () -- C:\WINDOWS\System32\dllcache\qedit.dll [2006/02/28 04:00:00 | 00,498,742 | ---- | C] () -- C:\WINDOWS\System32\dllcache\dxmasf.dll [2006/02/28 04:00:00 | 00,460,728 | ---- | C] () -- C:\WINDOWS\System32\dllcache\micross.ttf [2006/02/28 04:00:00 | 00,432,924 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2006/02/28 04:00:00 | 00,385,024 | ---- | C] () -- C:\WINDOWS\System32\dllcache\qdvd.dll [2006/02/28 04:00:00 | 00,383,140 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tahoma.ttf [2006/02/28 04:00:00 | 00,355,436 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tahomabd.ttf [2006/02/28 04:00:00 | 00,355,112 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msjetol1.dll [2006/02/28 04:00:00 | 00,279,040 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tshoot.dll [2006/02/28 04:00:00 | 00,279,040 | ---- | C] () -- C:\WINDOWS\System32\dllcache\qdv.dll [2006/02/28 04:00:00 | 00,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2006/02/28 04:00:00 | 00,270,848 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sbe.dll [2006/02/28 04:00:00 | 00,262,148 | ---- | C] () -- C:\WINDOWS\System32\sortkey.nls [2006/02/28 04:00:00 | 00,262,148 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sortkey.nls [2006/02/28 04:00:00 | 00,252,928 | ---- | C] () -- C:\WINDOWS\System32\dllcache\compatui.dll [2006/02/28 04:00:00 | 00,250,032 | RHS- | C] () -- C:\ntldr [2006/02/28 04:00:00 | 00,249,270 | ---- | C] () -- C:\WINDOWS\System32\locale.nls [2006/02/28 04:00:00 | 00,249,270 | ---- | C] () -- C:\WINDOWS\System32\dllcache\locale.nls [2006/02/28 04:00:00 | 00,240,120 | ---- | C] () -- C:\WINDOWS\System32\setup.bmp [2006/02/28 04:00:00 | 00,239,616 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wstrendr.ax [2006/02/28 04:00:00 | 00,239,616 | ---- | C] () -- C:\WINDOWS\System32\wstrenderer.ax [2006/02/28 04:00:00 | 00,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2006/02/28 04:00:00 | 00,216,862 | ---- | C] () -- C:\WINDOWS\System32\dllcache\apphelp.sdb [2006/02/28 04:00:00 | 00,198,736 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msimain.sdb [2006/02/28 04:00:00 | 00,196,642 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_950.nls [2006/02/28 04:00:00 | 00,196,642 | ---- | C] () -- C:\WINDOWS\System32\c_950.nls [2006/02/28 04:00:00 | 00,196,642 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_949.nls [2006/02/28 04:00:00 | 00,196,642 | ---- | C] () -- C:\WINDOWS\System32\c_949.nls [2006/02/28 04:00:00 | 00,196,642 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_936.nls [2006/02/28 04:00:00 | 00,196,642 | ---- | C] () -- C:\WINDOWS\System32\c_936.nls [2006/02/28 04:00:00 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\dllcache\qcap.dll [2006/02/28 04:00:00 | 00,186,368 | ---- | C] () -- C:\WINDOWS\System32\dllcache\encdec.dll [2006/02/28 04:00:00 | 00,167,219 | ---- | C] () -- C:\WINDOWS\System32\pagefileconfig.vbs [2006/02/28 04:00:00 | 00,167,219 | ---- | C] () -- C:\WINDOWS\System32\dllcache\pagefile.vbs [2006/02/28 04:00:00 | 00,164,352 | ---- | C] () -- C:\WINDOWS\System32\wstpager.ax [2006/02/28 04:00:00 | 00,164,352 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wstpager.ax [2006/02/28 04:00:00 | 00,162,850 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_932.nls [2006/02/28 04:00:00 | 00,162,850 | ---- | C] () -- C:\WINDOWS\System32\c_932.nls [2006/02/28 04:00:00 | 00,152,844 | ---- | C] () -- C:\WINDOWS\System32\dllcache\framdit.ttf [2006/02/28 04:00:00 | 00,149,848 | ---- | C] () -- C:\WINDOWS\System32\noise.deu [2006/02/28 04:00:00 | 00,148,992 | ---- | C] () -- C:\WINDOWS\System32\mpg2splt.ax [2006/02/28 04:00:00 | 00,148,992 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mpg2splt.ax [2006/02/28 04:00:00 | 00,139,810 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20261.nls [2006/02/28 04:00:00 | 00,139,810 | ---- | C] () -- C:\WINDOWS\System32\c_20261.nls [2006/02/28 04:00:00 | 00,135,984 | ---- | C] () -- C:\WINDOWS\System32\dllcache\framd.ttf [2006/02/28 04:00:00 | 00,127,213 | ---- | C] () -- C:\WINDOWS\System32\ega.cpi [2006/02/28 04:00:00 | 00,118,272 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mpg2data.ax [2006/02/28 04:00:00 | 00,118,272 | ---- | C] () -- C:\WINDOWS\System32\mpeg2data.ax [2006/02/28 04:00:00 | 00,102,446 | ---- | C] () -- C:\WINDOWS\System32\net.hlp [2006/02/28 04:00:00 | 00,097,965 | ---- | C] () -- C:\WINDOWS\System32\dllcache\evtquery.vbs [2006/02/28 04:00:00 | 00,097,965 | ---- | C] () -- C:\WINDOWS\System32\eventquery.vbs [2006/02/28 04:00:00 | 00,089,588 | ---- | C] () -- C:\WINDOWS\System32\unicode.nls [2006/02/28 04:00:00 | 00,089,588 | ---- | C] () -- C:\WINDOWS\System32\dllcache\unicode.nls [2006/02/28 04:00:00 | 00,082,944 | ---- | C] () -- C:\WINDOWS\clock.avi [2006/02/28 04:00:00 | 00,079,996 | ---- | C] () -- C:\WINDOWS\System32\dllcache\apps.chm [2006/02/28 04:00:00 | 00,071,859 | ---- | C] () -- C:\WINDOWS\System32\cliconf.chm [2006/02/28 04:00:00 | 00,070,656 | ---- | C] () -- C:\WINDOWS\System32\dllcache\amstream.dll [2006/02/28 04:00:00 | 00,069,886 | ---- | C] () -- C:\WINDOWS\System32\edit.com [2006/02/28 04:00:00 | 00,067,714 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2006/02/28 04:00:00 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_874.nls [2006/02/28 04:00:00 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_874.nls [2006/02/28 04:00:00 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_865.nls [2006/02/28 04:00:00 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_865.nls [2006/02/28 04:00:00 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_863.nls [2006/02/28 04:00:00 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_863.nls [2006/02/28 04:00:00 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_861.nls [2006/02/28 04:00:00 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_861.nls [2006/02/28 04:00:00 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_860.nls [2006/02/28 04:00:00 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_860.nls [2006/02/28 04:00:00 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_850.nls [2006/02/28 04:00:00 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_850.nls [2006/02/28 04:00:00 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_775.nls [2006/02/28 04:00:00 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_775.nls [2006/02/28 04:00:00 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_437.nls [2006/02/28 04:00:00 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_437.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_500.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_500.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28605.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_28605.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28598.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_28598.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28593.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_28593.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28592.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_28592.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28591.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_28591.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_21866.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_21866.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20905.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_20905.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20866.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_20866.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1258.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_1258.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1257.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_1257.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1256.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_1256.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1255.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_1255.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1254.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_1254.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1253.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_1253.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1252.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_1252.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1251.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_1251.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1250.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_1250.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1026.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_1026.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10079.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10079.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10000.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10000.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_037.nls [2006/02/28 04:00:00 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_037.nls [2006/02/28 04:00:00 | 00,065,489 | ---- | C] () -- C:\WINDOWS\System32\wbcache.sve [2006/02/28 04:00:00 | 00,065,489 | ---- | C] () -- C:\WINDOWS\System32\wbcache.nld [2006/02/28 04:00:00 | 00,065,489 | ---- | C] () -- C:\WINDOWS\System32\wbcache.ita [2006/02/28 04:00:00 | 00,065,489 | ---- | C] () -- C:\WINDOWS\System32\wbcache.fra [2006/02/28 04:00:00 | 00,065,489 | ---- | C] () -- C:\WINDOWS\System32\wbcache.esn [2006/02/28 04:00:00 | 00,065,489 | ---- | C] () -- C:\WINDOWS\System32\wbcache.enu [2006/02/28 04:00:00 | 00,065,489 | ---- | C] () -- C:\WINDOWS\System32\wbcache.deu [2006/02/28 04:00:00 | 00,061,172 | ---- | C] () -- C:\WINDOWS\System32\cmmgr32.hlp [2006/02/28 04:00:00 | 00,059,904 | ---- | C] () -- C:\WINDOWS\System32\dllcache\devenum.dll [2006/02/28 04:00:00 | 00,059,167 | ---- | C] () -- C:\WINDOWS\System\setup.inf [2006/02/28 04:00:00 | 00,058,273 | R--- | C] () -- C:\WINDOWS\System32\perfmon.msc [2006/02/28 04:00:00 | 00,057,667 | ---- | C] () -- C:\WINDOWS\System32\ieuinit.inf [2006/02/28 04:00:00 | 00,056,678 | ---- | C] () -- C:\WINDOWS\System32\eventvwr.msc [2006/02/28 04:00:00 | 00,053,840 | ---- | C] () -- C:\WINDOWS\System32\dosx.exe [2006/02/28 04:00:00 | 00,053,840 | ---- | C] () -- C:\WINDOWS\System32\dllcache\dosx.exe [2006/02/28 04:00:00 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\vbicodec.ax [2006/02/28 04:00:00 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\dllcache\vbicodec.ax [2006/02/28 04:00:00 | 00,050,620 | ---- | C] () -- C:\WINDOWS\System32\command.com [2006/02/28 04:00:00 | 00,049,196 | ---- | C] () -- C:\WINDOWS\System32\noise.fra [2006/02/28 04:00:00 | 00,048,794 | ---- | C] () -- C:\WINDOWS\System32\ntimage.gif [2006/02/28 04:00:00 | 00,047,564 | RHS- | C] () -- C:\NTDETECT.COM [2006/02/28 04:00:00 | 00,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2006/02/28 04:00:00 | 00,046,133 | ---- | C] () -- C:\WINDOWS\System32\sqlsodbc.chm [2006/02/28 04:00:00 | 00,044,451 | R--- | C] () -- C:\WINDOWS\System32\rsop.msc [2006/02/28 04:00:00 | 00,042,809 | ---- | C] () -- C:\WINDOWS\System32\dllcache\key01.sys [2006/02/28 04:00:00 | 00,042,537 | ---- | C] () -- C:\WINDOWS\System32\dllcache\keyboard.sys [2006/02/28 04:00:00 | 00,042,339 | ---- | C] () -- C:\WINDOWS\System32\certmgr.msc [2006/02/28 04:00:00 | 00,042,166 | ---- | C] () -- C:\WINDOWS\System32\lusrmgr.msc [2006/02/28 04:00:00 | 00,041,762 | ---- | C] () -- C:\WINDOWS\System32\ciadv.msc [2006/02/28 04:00:00 | 00,041,397 | ---- | C] () -- C:\WINDOWS\System32\dfrg.msc [2006/02/28 04:00:00 | 00,040,505 | ---- | C] () -- C:\WINDOWS\System32\cmdlib.wsc [2006/02/28 04:00:00 | 00,040,448 | ---- | C] () -- C:\WINDOWS\System32\wiasf.ax [2006/02/28 04:00:00 | 00,040,448 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wiasf.ax [2006/02/28 04:00:00 | 00,039,274 | ---- | C] () -- C:\WINDOWS\System32\mem.exe [2006/02/28 04:00:00 | 00,039,274 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mem.exe [2006/02/28 04:00:00 | 00,038,302 | ---- | C] () -- C:\WINDOWS\System32\compmgmt.msc [2006/02/28 04:00:00 | 00,036,364 | ---- | C] () -- C:\WINDOWS\System32\secpol.msc [2006/02/28 04:00:00 | 00,035,755 | ---- | C] () -- C:\WINDOWS\System32\prncnfg.vbs [2006/02/28 04:00:00 | 00,035,755 | ---- | C] () -- C:\WINDOWS\System32\dllcache\prncnfg.vbs [2006/02/28 04:00:00 | 00,035,648 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ntio411.sys [2006/02/28 04:00:00 | 00,035,424 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ntio412.sys [2006/02/28 04:00:00 | 00,035,328 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mciqtz32.dll [2006/02/28 04:00:00 | 00,034,871 | ---- | C] () -- C:\WINDOWS\System32\gpedit.msc [2006/02/28 04:00:00 | 00,034,816 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sniffpol.dll [2006/02/28 04:00:00 | 00,034,560 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ntio804.sys [2006/02/28 04:00:00 | 00,034,560 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ntio404.sys [2006/02/28 04:00:00 | 00,033,840 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ntio.sys [2006/02/28 04:00:00 | 00,033,673 | ---- | C] () -- C:\WINDOWS\System32\diskmgmt.msc [2006/02/28 04:00:00 | 00,033,464 | ---- | C] () -- C:\WINDOWS\System32\services.msc [2006/02/28 04:00:00 | 00,033,280 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sstub.dll [2006/02/28 04:00:00 | 00,033,079 | ---- | C] () -- C:\WINDOWS\System32\devmgmt.msc [2006/02/28 04:00:00 | 00,032,968 | ---- | C] () -- C:\WINDOWS\System32\ntmsoprq.msc [2006/02/28 04:00:00 | 00,032,760 | ---- | C] () -- C:\WINDOWS\System32\fsmgmt.msc [2006/02/28 04:00:00 | 00,032,674 | ---- | C] () -- C:\WINDOWS\System32\winhelp.hlp [2006/02/28 04:00:00 | 00,032,546 | ---- | C] () -- C:\WINDOWS\System32\prnmngr.vbs [2006/02/28 04:00:00 | 00,032,546 | ---- | C] () -- C:\WINDOWS\System32\dllcache\prnmngr.vbs [2006/02/28 04:00:00 | 00,029,454 | ---- | C] () -- C:\WINDOWS\System32\prnport.vbs [2006/02/28 04:00:00 | 00,029,454 | ---- | C] () -- C:\WINDOWS\System32\dllcache\prnport.vbs [2006/02/28 04:00:00 | 00,029,370 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ntdos411.sys [2006/02/28 04:00:00 | 00,029,274 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ntdos412.sys [2006/02/28 04:00:00 | 00,029,146 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ntdos804.sys [2006/02/28 04:00:00 | 00,029,146 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ntdos404.sys [2006/02/28 04:00:00 | 00,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2006/02/28 04:00:00 | 00,028,420 | ---- | C] () -- C:\WINDOWS\System32\bios1.rom [2006/02/28 04:00:00 | 00,027,866 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ntdos.sys [2006/02/28 04:00:00 | 00,027,097 | ---- | C] () -- C:\WINDOWS\System32\dllcache\country.sys [2006/02/28 04:00:00 | 00,026,209 | ---- | C] () -- C:\WINDOWS\System32\ntmsmgr.msc [2006/02/28 04:00:00 | 00,025,415 | ---- | C] () -- C:\WINDOWS\System32\prndrvr.vbs [2006/02/28 04:00:00 | 00,025,415 | ---- | C] () -- C:\WINDOWS\System32\dllcache\prndrvr.vbs [2006/02/28 04:00:00 | 00,024,772 | ---- | C] () -- C:\WINDOWS\System32\geo.nls [2006/02/28 04:00:00 | 00,024,772 | ---- | C] () -- C:\WINDOWS\System32\dllcache\geo.nls [2006/02/28 04:00:00 | 00,024,124 | ---- | C] () -- C:\WINDOWS\System32\dllcache\marlett.ttf [2006/02/28 04:00:00 | 00,022,040 | ---- | C] () -- C:\WINDOWS\System32\sorttbls.nls [2006/02/28 04:00:00 | 00,022,040 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sorttbls.nls [2006/02/28 04:00:00 | 00,021,527 | ---- | C] () -- C:\WINDOWS\System32\prnjobs.vbs [2006/02/28 04:00:00 | 00,021,527 | ---- | C] () -- C:\WINDOWS\System32\dllcache\prnjobs.vbs [2006/02/28 04:00:00 | 00,021,232 | ---- | C] () -- C:\WINDOWS\System32\graphics.pro [2006/02/28 04:00:00 | 00,020,634 | ---- | C] () -- C:\WINDOWS\System32\dllcache\debug.exe [2006/02/28 04:00:00 | 00,020,634 | ---- | C] () -- C:\WINDOWS\System32\debug.exe [2006/02/28 04:00:00 | 00,019,694 | ---- | C] () -- C:\WINDOWS\System32\graphics.com [2006/02/28 04:00:00 | 00,019,684 | ---- | C] () -- C:\WINDOWS\System32\noise.esn [2006/02/28 04:00:00 | 00,019,618 | ---- | C] () -- C:\WINDOWS\System32\noise.ita [2006/02/28 04:00:00 | 00,018,832 | ---- | C] () -- C:\WINDOWS\System32\v7vga.rom [2006/02/28 04:00:00 | 00,015,860 | ---- | C] () -- C:\WINDOWS\System32\prnqctl.vbs [2006/02/28 04:00:00 | 00,015,860 | ---- | C] () -- C:\WINDOWS\System32\dllcache\prnqctl.vbs [2006/02/28 04:00:00 | 00,015,360 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tsd32.dll [2006/02/28 04:00:00 | 00,014,710 | ---- | C] () -- C:\WINDOWS\System32\kb16.com [2006/02/28 04:00:00 | 00,014,336 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msdmo.dll [2006/02/28 04:00:00 | 00,013,730 | ---- | C] () -- C:\WINDOWS\System32\noise.sve [2006/02/28 04:00:00 | 00,013,646 | ---- | C] () -- C:\WINDOWS\System32\wpa.dbl [2006/02/28 04:00:00 | 00,013,312 | ---- | C] () -- C:\WINDOWS\System32\dllcache\win87em.dll [2006/02/28 04:00:00 | 00,013,256 | ---- | C] () -- C:\WINDOWS\System32\noise.nld [2006/02/28 04:00:00 | 00,012,642 | ---- | C] () -- C:\WINDOWS\System32\edlin.exe [2006/02/28 04:00:00 | 00,012,642 | ---- | C] () -- C:\WINDOWS\System32\dllcache\edlin.exe [2006/02/28 04:00:00 | 00,012,498 | ---- | C] () -- C:\WINDOWS\System32\dllcache\append.exe [2006/02/28 04:00:00 | 00,012,498 | ---- | C] () -- C:\WINDOWS\System32\append.exe [2006/02/28 04:00:00 | 00,011,753 | ---- | C] () -- C:\WINDOWS\System32\setver.exe [2006/02/28 04:00:00 | 00,010,790 | ---- | C] () -- C:\WINDOWS\System32\edit.hlp [2006/02/28 04:00:00 | 00,010,240 | ---- | C] () -- C:\WINDOWS\System32\dllcache\scriptpw.dll [2006/02/28 04:00:00 | 00,009,424 | ---- | C] () -- C:\WINDOWS\System32\dllcache\drvmain.sdb [2006/02/28 04:00:00 | 00,009,029 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ansi.sys [2006/02/28 04:00:00 | 00,008,424 | ---- | C] () -- C:\WINDOWS\System32\exe2bin.exe [2006/02/28 04:00:00 | 00,008,424 | ---- | C] () -- C:\WINDOWS\System32\dllcache\exe2bin.exe [2006/02/28 04:00:00 | 00,008,386 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ctype.nls [2006/02/28 04:00:00 | 00,008,386 | ---- | C] () -- C:\WINDOWS\System32\ctype.nls [2006/02/28 04:00:00 | 00,008,191 | ---- | C] () -- C:\WINDOWS\System32\bios4.rom [2006/02/28 04:00:00 | 00,007,208 | ---- | C] () -- C:\WINDOWS\System32\secupd.sig [2006/02/28 04:00:00 | 00,007,208 | ---- | C] () -- C:\WINDOWS\System32\dllcache\secupd.sig [2006/02/28 04:00:00 | 00,007,116 | ---- | C] () -- C:\WINDOWS\System32\drivers\etc\services [2006/02/28 04:00:00 | 00,007,052 | ---- | C] () -- C:\WINDOWS\System32\nlsfunc.exe [2006/02/28 04:00:00 | 00,007,052 | ---- | C] () -- C:\WINDOWS\System32\dllcache\nlsfunc.exe [2006/02/28 04:00:00 | 00,007,046 | ---- | C] () -- C:\WINDOWS\System32\l_intl.nls [2006/02/28 04:00:00 | 00,007,046 | ---- | C] () -- C:\WINDOWS\System32\dllcache\l_intl.nls [2006/02/28 04:00:00 | 00,006,761 | ---- | C] () -- C:\WINDOWS\System32\oembios.sig [2006/02/28 04:00:00 | 00,006,761 | ---- | C] () -- C:\WINDOWS\System32\dllcache\oembios.sig [2006/02/28 04:00:00 | 00,006,708 | ---- | C] () -- C:\WINDOWS\System32\esentprf.hxx [2006/02/28 04:00:00 | 00,004,768 | ---- | C] () -- C:\WINDOWS\System32\dllcache\himem.sys [2006/02/28 04:00:00 | 00,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2006/02/28 04:00:00 | 00,004,569 | ---- | C] () -- C:\WINDOWS\System32\dllcache\secupd.dat [2006/02/28 04:00:00 | 00,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2006/02/28 04:00:00 | 00,004,461 | ---- | C] () -- C:\WINDOWS\System32\dllcache\oembios.dat [2006/02/28 04:00:00 | 00,004,310 | ---- | C] () -- C:\WINDOWS\System32\odbcconf.rsp [2006/02/28 04:00:00 | 00,004,310 | ---- | C] () -- C:\WINDOWS\System32\dllcache\odbcconf.rsp [2006/02/28 04:00:00 | 00,004,126 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msdxmlc.dll [2006/02/28 04:00:00 | 00,004,096 | ---- | C] () -- C:\WINDOWS\System32\wdl.trm [2006/02/28 04:00:00 | 00,003,708 | ---- | C] () -- C:\WINDOWS\System32\pubprn.vbs [2006/02/28 04:00:00 | 00,003,708 | ---- | C] () -- C:\WINDOWS\System32\dllcache\pubprn.vbs [2006/02/28 04:00:00 | 00,003,683 | ---- | C] () -- C:\WINDOWS\System32\drivers\etc\lmhosts.sam [2006/02/28 04:00:00 | 00,003,577 | ---- | C] () -- C:\WINDOWS\System32\sysprtj.sep [2006/02/28 04:00:00 | 00,003,338 | ---- | C] () -- C:\WINDOWS\System32\redir.exe [2006/02/28 04:00:00 | 00,003,338 | ---- | C] () -- C:\WINDOWS\System32\dllcache\redir.exe [2006/02/28 04:00:00 | 00,003,252 | ---- | C] () -- C:\WINDOWS\System32\nw16.exe [2006/02/28 04:00:00 | 00,003,252 | ---- | C] () -- C:\WINDOWS\System32\dllcache\nw16.exe [2006/02/28 04:00:00 | 00,003,214 | ---- | C] () -- C:\WINDOWS\System32\sysprint.sep [2006/02/28 04:00:00 | 00,003,178 | ---- | C] () -- C:\WINDOWS\System32\rsvpcnts.h [2006/02/28 04:00:00 | 00,003,167 | ---- | C] () -- C:\WINDOWS\System32\rsaci.rat [2006/02/28 04:00:00 | 00,003,010 | ---- | C] () -- C:\WINDOWS\System32\pschdcnt.h [2006/02/28 04:00:00 | 00,002,755 | ---- | C] () -- C:\WINDOWS\System32\mqprfsym.h [2006/02/28 04:00:00 | 00,002,233 | ---- | C] () -- C:\WINDOWS\System32\dllcache\12520850.cpx [2006/02/28 04:00:00 | 00,002,233 | ---- | C] () -- C:\WINDOWS\System32\12520850.cpx [2006/02/28 04:00:00 | 00,002,151 | ---- | C] () -- C:\WINDOWS\System32\dllcache\12520437.cpx [2006/02/28 04:00:00 | 00,002,151 | ---- | C] () -- C:\WINDOWS\System32\12520437.cpx [2006/02/28 04:00:00 | 00,001,818 | ---- | C] () -- C:\WINDOWS\System32\rasctrnm.h [2006/02/28 04:00:00 | 00,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin [2006/02/28 04:00:00 | 00,001,696 | ---- | C] () -- C:\WINDOWS\System32\noise.cht [2006/02/28 04:00:00 | 00,001,696 | ---- | C] () -- C:\WINDOWS\System32\noise.chs [2006/02/28 04:00:00 | 00,001,492 | ---- | C] () -- C:\WINDOWS\System32\mmdriver.inf [2006/02/28 04:00:00 | 00,001,131 | ---- | C] () -- C:\WINDOWS\System32\loadfix.com [2006/02/28 04:00:00 | 00,001,129 | ---- | C] () -- C:\WINDOWS\System32\vwipxspx.exe [2006/02/28 04:00:00 | 00,001,129 | ---- | C] () -- C:\WINDOWS\System32\dllcache\vwipxspx.exe [2006/02/28 04:00:00 | 00,000,929 | ---- | C] () -- C:\WINDOWS\System32\homepage.inf [2006/02/28 04:00:00 | 00,000,882 | ---- | C] () -- C:\WINDOWS\System32\share.exe [2006/02/28 04:00:00 | 00,000,882 | ---- | C] () -- C:\WINDOWS\System32\dllcache\share.exe [2006/02/28 04:00:00 | 00,000,882 | ---- | C] () -- C:\WINDOWS\System32\fastopen.exe [2006/02/28 04:00:00 | 00,000,882 | ---- | C] () -- C:\WINDOWS\System32\dllcache\fastopen.exe [2006/02/28 04:00:00 | 00,000,862 | ---- | C] () -- C:\WINDOWS\System32\termcap [2006/02/28 04:00:00 | 00,000,817 | ---- | C] () -- C:\WINDOWS\System32\mscdexnt.exe [2006/02/28 04:00:00 | 00,000,817 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mscdexnt.exe [2006/02/28 04:00:00 | 00,000,799 | ---- | C] () -- C:\WINDOWS\System32\drivers\etc\protocol [2006/02/28 04:00:00 | 00,000,751 | ---- | C] () -- C:\WINDOWS\System32\noise.enu [2006/02/28 04:00:00 | 00,000,751 | ---- | C] () -- C:\WINDOWS\System32\noise.eng [2006/02/28 04:00:00 | 00,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2006/02/28 04:00:00 | 00,000,707 | ---- | C] () -- C:\WINDOWS\_default.pif [2006/02/28 04:00:00 | 00,000,697 | ---- | C] () -- C:\WINDOWS\System32\noise.tha [2006/02/28 04:00:00 | 00,000,487 | ---- | C] () -- C:\WINDOWS\System32\login.cmd [2006/02/28 04:00:00 | 00,000,435 | ---- | C] () -- C:\WINDOWS\System32\perfwci.h [2006/02/28 04:00:00 | 00,000,427 | ---- | C] () -- C:\WINDOWS\System32\perfci.h [2006/02/28 04:00:00 | 00,000,407 | ---- | C] () -- C:\WINDOWS\System32\drivers\etc\networks [2006/02/28 04:00:00 | 00,000,168 | ---- | C] () -- C:\WINDOWS\System32\l_except.nls [2006/02/28 04:00:00 | 00,000,168 | ---- | C] () -- C:\WINDOWS\System32\dllcache\l_except.nls [2006/02/28 04:00:00 | 00,000,140 | ---- | C] () -- C:\WINDOWS\System32\perffilt.h [2006/02/28 04:00:00 | 00,000,114 | ---- | C] () -- C:\WINDOWS\System32\pcl.sep [2006/02/28 04:00:00 | 00,000,081 | ---- | C] () -- C:\WINDOWS\System32\dsound.vxd [2006/02/28 04:00:00 | 00,000,080 | ---- | C] () -- C:\WINDOWS\explorer.scf [2006/02/28 04:00:00 | 00,000,075 | ---- | C] () -- C:\WINDOWS\System32\View Channels.scf [2006/02/28 04:00:00 | 00,000,064 | ---- | C] () -- C:\WINDOWS\System32\cmos.ram [2006/02/28 04:00:00 | 00,000,051 | ---- | C] () -- C:\WINDOWS\System32\pscript.sep [2005/09/15 13:35:46 | 00,000,050 | ---- | C] () -- C:\WINDOWS\UNNeroMediaHome.cfg [2005/08/30 20:37:52 | 00,000,050 | ---- | C] () -- C:\WINDOWS\UNNeroVision.cfg [2005/08/30 20:37:04 | 00,000,050 | ---- | C] () -- C:\WINDOWS\UNNeroShowTime.cfg [2005/08/30 20:36:38 | 00,000,050 | ---- | C] () -- C:\WINDOWS\UNRecode.cfg [2005/03/17 11:29:58 | 00,081,342 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat [2005/01/28 12:12:44 | 00,009,684 | ---- | C] () -- C:\WINDOWS\System32\atifglpf.xml [2005/01/27 20:00:00 | 00,005,933 | ---- | C] () -- C:\WINDOWS\System32\ntelcool.vxd [2005/01/27 20:00:00 | 00,005,933 | ---- | C] () -- C:\WINDOWS\System32\amdcool.vxd [2004/12/17 07:29:42 | 00,005,110 | ---- | C] () -- C:\WINDOWS\System32\e100b325.din [2003/07/03 01:25:00 | 00,073,782 | ---- | C] () -- C:\WINDOWS\System32\ibmpmsvc.exe [2003/06/24 14:43:48 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll [2001/08/17 14:36:42 | 00,055,296 | ---- | C] () -- C:\WINDOWS\System32\dvdplay.exe [2001/04/23 00:07:28 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\mtstack.exe [2000/09/18 15:50:28 | 00,202,752 | ---- | C] () -- C:\WINDOWS\System32\zlib.dll < End of report > |
 |
 
|
|
Dec 1 2009, 09:27 PM
Post
#17
|
|
|
Member Group: Members Posts: 30 Joined: 16-November 09 From: California Member No.: 403,570 |
OTL Extras Logfile
OTL Extras logfile created on: 12/1/2009 1:42:22 PM - Run 1 OTL by OldTimer - Version 3.1.11.4 Folder = C:\Documents and Settings\Anna\Desktop Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 510.98 Mb Total Physical Memory | 67.05 Mb Available Physical Memory | 13.12% Memory free 1.45 Gb Paging File | 1.02 Gb Available in Paging File | 70.90% Paging File free Paging file location(s): C:\pagefile.sys 1000 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 93.16 Gb Total Space | 23.66 Gb Free Space | 25.39% Space Free | Partition Type: NTFS Drive D: | 1.59 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: BABYDOG Current User Name: Anna Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) .vbs [@ = Reg Error: Key error.] -- Reg Error: Key error. File not found [HKEY_USERS\S-1-5-21-1801674531-152049171-1060284298-1004\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation) http [open] -- Reg Error: Key error. https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "AntiVirusOverride" = 1 "FirewallOverride" = 0 "UpdatesDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002 "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 "3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DoNotAllowExceptions" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 "3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009 "80:TCP" = 80:TCP:*:Enabled:@xpsp2res.dll,-22004 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\MegaSquirt\MS Download 2.00\gms2dl.exe" = C:\Program Files\MegaSquirt\MS Download 2.00\gms2dl.exe:*:Enabled:gms2dl -- () "C:\Documents and Settings\owner\Desktop\Megasquirt\MS Download 2.00\gms2dl.exe" = C:\Documents and Settings\owner\Desktop\Megasquirt\MS Download 2.00\gms2dl.exe:*:Enabled:gms2dl -- () "C:\Program Files\AVG\AVG8\avgemc.exe" = C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe -- File not found "C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe -- File not found "C:\Program Files\AVG\AVG8\avgnsx.exe" = C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe -- File not found "C:\Program Files\AVG\AVG8\avgtray.exe" = C:\Program Files\AVG\AVG8\avgtray.exe:*:Enabled:avgtray -- File not found "C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation) "C:\WINDOWS\system32\usmt\migwiz.exe" = C:\WINDOWS\system32\usmt\migwiz.exe:*:Enabled:Files and Settings Transfer Wizard -- (Microsoft Corporation) "C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour -- (Apple Inc.) "C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.) "C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.) "C:\Program Files\DNA\btdna.exe" = C:\Program Files\DNA\btdna.exe:*:Enabled:DNA -- (BitTorrent, Inc.) "C:\Program Files\Flock\flock.exe" = C:\Program Files\Flock\flock.exe:*:Enabled:Flock -- File not found "C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe" = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil -- (IVT Corporation) "C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- File not found "C:\Program Files\eMule\emule.exe" = C:\Program Files\eMule\emule.exe:*:Enabled:eMule -- (http://www.emule-project.net) "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe" = C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Crawler Spyware Terminator -- File not found "C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java™ Platform SE binary -- (Sun Microsystems, Inc.) "C:\Program Files\AVG\AVG9\avgam.exe" = C:\Program Files\AVG\AVG9\avgam.exe:*:Enabled:avgam.exe -- (AVG Technologies CZ, s.r.o.) "C:\Program Files\AVG\AVG9\avgdiagex.exe" = C:\Program Files\AVG\AVG9\avgdiagex.exe:*:Enabled:avgdiagex.exe -- (AVG Technologies CZ, s.r.o.) "C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.) "C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe -- (AVG Technologies CZ, s.r.o.) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour "{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in "{162B71B8-8464-4680-A086-601D555B331D}" = Apple Mobile Device Support "{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86 "{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime "{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 17 "{2F9704CD-1E8E-4C78-9BAC-D1205645EA4B}" = AirplanePDQ "{342126E1-173C-4585-BFBE-3EBDD20E3E9E}" = Mobipocket Reader 6.2 "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{5783F2D7-0101-0409-0000-0060B0CE6BBA}" = AutoCAD 2002 "{5DF68560-292A-11D5-99D1-00010256D40E}" = DV Studio3 "{6304CCF6-3343-4DA5-96B6-84B3A644B93B}" = USB Driver for Panasonic DVC "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD "{6891401F-695B-447F-B3E3-3FDEDA952DC6}" = ReaderWorks Standard "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762 "{82427977-8776-4087-90CA-9F65174D3C4D}" = Nokia Connectivity Cable Driver "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{8803FCD6-F5BA-475F-A71B-D83D8E31F251}" = Nitro PDF Professional "{90110409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system "{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.0 beta 1 "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{AAF4238F-7C29-451D-9925-C753271A5728}" = Microsoft Visual C++ Run Time Lib Setup "{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2 "{B0E39CCD-9CAD-4C82-A6C6-2D61C12409DA}" = MegaLogViewer "{B6F7DBE7-2FE2-458F-A738-B10832746036}" = Microsoft Reader "{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player "{B7CB0BF3-791E-44D3-9F04-786E36D51C9D}" = PC Connectivity Solution "{B9F499B8-D1F0-42FC-84BE-CC552123CCCB}" = BlueSoleil "{BDC88E5A-F47B-4314-AB38-994592E32C95}" = 802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.00 "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver "{C26B06A9-27BB-45B0-9873-9C623EC2BA38}" = iTunes "{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem Driver "{CB8251EE-C86B-410D-83B2-1E28E9DE2C2B}" = LG GSM PC Components "{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{F63C7908-08EA-46F5-9EDF-DFF9FD231033}" = Nero 7 Essentials "{FA61D601-A0FC-48BD-AE7A-54946BCD7FB6}_is1" = BitPim 1.0.6 "010 Editor v3_is1" = 010 Editor 3.0.5 "504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0) "ABC Amber LIT Converter" = ABC Amber LIT Converter "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Agere Systems Soft Modem" = Agere Systems AC'97 Modem "ATI Display Driver" = ATI Display Driver "AVG9Uninstall" = AVG 9.0 "BitTorrent" = BitTorrent "CCleaner" = CCleaner "CloneDVDmobile" = CloneDVDmobile "ConvertLIT Graphical User Interface" = ConvertLIT Graphical User Interface 2.0 "DVD Shrink_is1" = DVD Shrink 3.2 "DVDFab 6_is1" = DVDFab 6.2.0.5 (11/11/2009) "Dyno2000 Version 3.10" = Dyno2000 Version 3.10 "eMule" = eMule "Glary Utilities_is1" = Glary Utilities 2.13.0.686 "GMailFS" = GMail Drive Shell Extension "HijackThis" = HijackThis 2.0.2 "hott notes 4" = hott notes 4 "ie8" = Windows Internet Explorer 8 "InstallShield_{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in "InstallShield_{6304CCF6-3343-4DA5-96B6-84B3A644B93B}" = USB Driver for Panasonic DVC "InstallShield_{BDC88E5A-F47B-4314-AB38-994592E32C95}" = 802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.00 "KLiteCodecPack_is1" = K-Lite Codec Pack 4.8.0 (Full) "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "MegaTune_is1" = uninstall "MegaTune225P1 installer tweaked by DIYAutoTune.com_is1" = MegaTune225P1 installer tweaked by DIYAutoTune.com "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Mozilla Firefox (3.5.5)" = Mozilla Firefox (3.5.5) "MS-I/II Download 2.00_is1" = MS-I/II Download Utility 2.00 "Power Management Driver" = ThinkPad Power Management Driver "PROSet" = Intel® PRO Network Connections Drivers "ReadManiac_is1" = ReadManiac 2.5.2 "RealPlayer 6.0" = RealPlayer "ST6UNST #1" = Easy DOCViewer 2.0 "SynTPDeinstKey" = ThinkPad UltraNav Driver "SystemRequirementsLab" = System Requirements Lab "Tomb Raider: Anniversary" = Tomb Raider: Anniversary 1.0 "Tomb Raider: Legend" = Tomb Raider: Legend 1.0 "VLC media player" = VLC media player 0.9.9 "WIC" = Windows Imaging Component "Windows Media Format Runtime" = Windows Media Format Runtime "Wondershare Video Converter Platinum_is1" = Wondershare Video Converter Platinum(Build 4.0.2.57) ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-1801674531-152049171-1060284298-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "BitTorrent DNA" = DNA ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 11/30/2009 6:25:49 PM | Computer Name = BABYDOG | Source = crypt32 | ID = 131080 Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired. Error - 11/30/2009 6:25:59 PM | Computer Name = BABYDOG | Source = crypt32 | ID = 131080 Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The specified server cannot perform the requested operation. Error - 11/30/2009 6:26:04 PM | Computer Name = BABYDOG | Source = crypt32 | ID = 131080 Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The specified server cannot perform the requested operation. Error - 11/30/2009 8:33:57 PM | Computer Name = BABYDOG | Source = Userenv | ID = 1507 Description = This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ). Error - 11/30/2009 8:44:50 PM | Computer Name = BABYDOG | Source = Userenv | ID = 1507 Description = This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ). Error - 12/1/2009 12:24:30 AM | Computer Name = BABYDOG | Source = crypt32 | ID = 131080 Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved Error - 12/1/2009 12:24:31 AM | Computer Name = BABYDOG | Source = Userenv | ID = 1507 Description = This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ). Error - 12/1/2009 1:19:15 AM | Computer Name = BABYDOG | Source = Userenv | ID = 1507 Description = This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ). Error - 12/1/2009 1:46:06 AM | Computer Name = BABYDOG | Source = Userenv | ID = 1507 Description = This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ). Error - 12/1/2009 5:37:22 PM | Computer Name = BABYDOG | Source = Userenv | ID = 1507 Description = This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ). [ Application Events ] Error - 11/30/2009 6:25:49 PM | Computer Name = BABYDOG | Source = crypt32 | ID = 131080 Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired. Error - 11/30/2009 6:25:59 PM | Computer Name = BABYDOG | Source = crypt32 | ID = 131080 Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The specified server cannot perform the requested operation. Error - 11/30/2009 6:26:04 PM | Computer Name = BABYDOG | Source = crypt32 | ID = 131080 Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The specified server cannot perform the requested operation. Error - 11/30/2009 8:33:57 PM | Computer Name = BABYDOG | Source = Userenv | ID = 1507 Description = This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ). Error - 11/30/2009 8:44:50 PM | Computer Name = BABYDOG | Source = Userenv | ID = 1507 Description = This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ). Error - 12/1/2009 12:24:30 AM | Computer Name = BABYDOG | Source = crypt32 | ID = 131080 Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved Error - 12/1/2009 12:24:31 AM | Computer Name = BABYDOG | Source = Userenv | ID = 1507 Description = This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ). Error - 12/1/2009 1:19:15 AM | Computer Name = BABYDOG | Source = Userenv | ID = 1507 Description = This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ). Error - 12/1/2009 1:46:06 AM | Computer Name = BABYDOG | Source = Userenv | ID = 1507 Description = This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ). Error - 12/1/2009 5:37:22 PM | Computer Name = BABYDOG | Source = Userenv | ID = 1507 Description = This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ). [ System Events ] Error - 11/29/2009 9:23:09 PM | Computer Name = BABYDOG | Source = Dhcp | ID = 1002 Description = The IP address lease 192.168.1.100 for the Network Card with network address 00032F37D35C has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). Error - 11/30/2009 4:15:20 AM | Computer Name = BABYDOG | Source = Dhcp | ID = 1002 Description = The IP address lease 192.168.1.100 for the Network Card with network address 00032F37D35C has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). Error - 11/30/2009 4:50:18 AM | Computer Name = BABYDOG | Source = Dhcp | ID = 1002 Description = The IP address lease 192.168.1.100 for the Network Card with network address 00032F37D35C has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). Error - 11/30/2009 4:33:02 PM | Computer Name = BABYDOG | Source = Dhcp | ID = 1001 Description = Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 00032F37D35C. The following error occurred: %%1223. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. Error - 11/30/2009 4:47:56 PM | Computer Name = BABYDOG | Source = Dhcp | ID = 1002 Description = The IP address lease 192.168.1.101 for the Network Card with network address 00032F37D35C has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). Error - 11/30/2009 5:36:09 PM | Computer Name = BABYDOG | Source = Dhcp | ID = 1002 Description = The IP address lease 192.168.1.100 for the Network Card with network address 00032F37D35C has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). Error - 12/1/2009 2:05:32 AM | Computer Name = BABYDOG | Source = Dhcp | ID = 1002 Description = The IP address lease 192.168.1.102 for the Network Card with network address E02D261B7069 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). Error - 12/1/2009 2:51:54 AM | Computer Name = BABYDOG | Source = Dhcp | ID = 1002 Description = The IP address lease 192.168.1.102 for the Network Card with network address E02D261B7069 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). Error - 12/1/2009 2:51:54 AM | Computer Name = BABYDOG | Source = ipnathlp | ID = 32003 Description = The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code. Error - 12/1/2009 5:37:24 PM | Computer Name = BABYDOG | Source = Dhcp | ID = 1002 Description = The IP address lease 192.168.1.103 for the Network Card with network address 00032F37D35C has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). < End of report > |
|
|
|
|
Dec 2 2009, 01:25 PM
Post
#18
|
|
 Mr.Mechanic Group: Malware Response Team Posts: 20,994 Joined: 3-May 08 From: Saarland,Germany Member No.: 206,858 |
Hello, anna22
Welcome to the Bleeping Computer Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems. If you do not make a reply in 5 days, we will have to close your topic. You may want to keep the link to this topic in your favourites. Alternatively, you can click the  button at the top bar of this topic and Track this Topic. The topics you are tracking can be found here.Please take note of some guidelines for this fix:
Please download GMER from one of the following locations and save it to your desktop:
-------------------- regards,
schrauber   If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you! Unavailable as from friday 20th august If I have helped you then please consider donating to continue the fight against malware  |
|
|
|
button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
|
Dec 2 2009, 09:24 PM
Post
#19
|
|
|
Member Group: Members Posts: 30 Joined: 16-November 09 From: California Member No.: 403,570 |
Thomas,
Here is my GMER Logfile. Thanks, Anna GMER 1.0.15.15252 - http://www.gmer.net Rootkit scan 2009-12-02 18:13:03 Windows 5.1.2600 Service Pack 2 Running: iy6b182k.exe; Driver: C:\DOCUME~1\Anna\LOCALS~1\Temp\pxddqpow.sys ---- System - GMER 1.0.15 ---- SSDT sptd.sys ZwCreateKey [0xF85A2AC8] SSDT sptd.sys ZwEnumerateKey [0xF85A2C22] SSDT sptd.sys ZwEnumerateValueKey [0xF85A2F9A] SSDT sptd.sys ZwOpenKey [0xF85A298E] SSDT \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies ) ZwOpenProcess [0xF8972470] SSDT sptd.sys ZwQueryKey [0xF85A3064] SSDT sptd.sys ZwQueryValueKey [0xF85A2EFC] SSDT sptd.sys ZwSetValueKey [0xF85A30EC] SSDT \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies ) ZwTerminateProcess [0xF8972520] SSDT \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies ) ZwTerminateThread [0xF89725C0] SSDT \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies ) ZwWriteVirtualMemory [0xF8972660] ---- Kernel code sections - GMER 1.0.15 ---- ? C:\WINDOWS\system32\drivers\sptd.sys The process cannot access the file because it is being used by another process. ? C:\WINDOWS\System32\Drivers\SPTD6013.SYS The process cannot access the file because it is being used by another process. .text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 F78EE4F0 16 Bytes [42, C2, CF, B0, E3, F7, 25, ...] .text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 + 11 F78EE501 31 Bytes [D0, 8E, F7, E5, B6, 9C, 8B, ...] ? C:\WINDOWS\System32\Drivers\dtscsi.sys The process cannot access the file because it is being used by another process. ---- Kernel IAT/EAT - GMER 1.0.15 ---- IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F85AB89E] sptd.sys IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F85C1D86] sptd.sys IAT ftdisk.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [F85ABE24] sptd.sys IAT ftdisk.sys[ntoskrnl.exe!IoGetDeviceObjectPointer] [F85ABD28] sptd.sys IAT ftdisk.sys[ntoskrnl.exe!IofCallDriver] [F85ABEF4] sptd.sys IAT PartMgr.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F85C11AE] sptd.sys IAT PartMgr.sys[ntoskrnl.exe!IoDetachDevice] [F85ABA5A] sptd.sys IAT atapi.sys[ntoskrnl.exe!IofCompleteRequest] [F85C104A] sptd.sys IAT atapi.sys[ntoskrnl.exe!IoConnectInterrupt] [F85AB8F2] sptd.sys IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F859EAD2] sptd.sys IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F859EC0E] sptd.sys IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F859EB96] sptd.sys IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F859F76C] sptd.sys IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F859F642] sptd.sys IAT disk.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F85C1E4A] sptd.sys IAT \WINDOWS\system32\DRIVERS\CLASSPNP.SYS[ntoskrnl.exe!IoDetachDevice] [F85B08C6] sptd.sys IAT \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!IofCompleteRequest] [F85C104A] sptd.sys IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F85C1056] sptd.sys IAT \SystemRoot\system32\DRIVERS\cdrom.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F85C1E4A] sptd.sys IAT \SystemRoot\system32\DRIVERS\rdbss.sys[ntoskrnl.exe!IofCallDriver] [F85ABCC6] sptd.sys IAT \SystemRoot\system32\DRIVERS\mrxsmb.sys[ntoskrnl.exe!IofCallDriver] [F85ABCC6] sptd.sys ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs 8339F808 AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.sys (IDS Application Activity Monitor Filter Driver./AVG Technologies ) AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 mouclass.sys (Mouse Class Driver/Microsoft Corporation) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) Device \Driver\Ftdisk \Device\HarddiskVolume1 8339FEB0 Device \Driver\00000162 \Device\00000071 sptd.sys Device \Driver\Cdrom \Device\CdRom0 8316DCB0 Device \FileSystem\Rdbss \Device\FsWrap 8323CEB0 Device \Driver\Cdrom \Device\CdRom1 8316DCB0 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [F84FC2F0] atapi.sys[unknown section] {MOV EAX, 0x8339fb98; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf85b2e12; RET } Device \Driver\atapi \Device\Ide\IdePort0 [F84FC2F0] atapi.sys[unknown section] {MOV EAX, 0x8339fb98; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf85b2e12; RET } Device \Driver\atapi \Device\Ide\IdePort1 [F84FC2F0] atapi.sys[unknown section] {MOV EAX, 0x8339fb98; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf85b2e12; RET } Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e [F84FC2F0] atapi.sys[unknown section] {MOV EAX, 0x8339fb98; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf85b2e12; RET } Device \Driver\NetBT \Device\NetBt_Wins_Export 83234EB0 Device \Driver\NetBT \Device\NetbiosSmb 83234EB0 AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) Device \Driver\Disk \Device\Harddisk0\DR0 8339FA40 AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 831B8E20 Device \FileSystem\MRxSmb \Device\LanmanRedirector 831B8E20 Device \FileSystem\Npfs \Device\NamedPipe 8300DEB0 Device \Driver\Ftdisk \Device\FtControl 8339FEB0 Device \FileSystem\Msfs \Device\Mailslot 82FB6850 Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target0Lun0 83053988 Device \Driver\dtscsi \Device\Scsi\dtscsi1 83053988 Device \FileSystem\Cdfs \Cdfs 82FD5EB0 ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x76 0xA1 0x5E 0xEE ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\ Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x81 0xD8 0x3B 0x40 ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x0A 0x98 0xE0 0xB0 ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x8B 0xC3 0x1F 0xB2 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xE3 0xC4 0x06 0x1A ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x29 0x9B 0x7E 0xA3 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x56 0x5C 0x88 0xD8 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x8B 0xC3 0x1F 0xB2 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xE3 0xC4 0x06 0x1A ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\ Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x29 0x9B 0x7E 0xA3 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x56 0x5C 0x88 0xD8 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x8B 0xC3 0x1F 0xB2 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s0 -318782262 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 -803742414 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 1621485671 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x76 0xA1 0x5E 0xEE ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x81 0xD8 0x3B 0x40 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x0A 0x98 0xE0 0xB0 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x8B 0xC3 0x1F 0xB2 ... Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL@Installed 1 Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL@ Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI@Installed 1 Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI@NoChange 1 Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI@ Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS@Installed 1 Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS@ ---- EOF - GMER 1.0.15 ---- |
|
|
|
|
Dec 3 2009, 01:48 PM
Post
#20
|
|
|
Mr.Mechanic Group: Malware Response Team Posts: 20,994 Joined: 3-May 08 From: Saarland,Germany Member No.: 206,858 |
Hi,
Step 1 Please download DeFogger to your desktop. Double click DeFogger to run the tool.
Do not re-enable these drivers until otherwise instructed. Step 2 Please go here and have a look how you can disable your security software. Download Combofix from any of the links below but rename it to <schrauber> before saving it to your desktop. Link 1 Link 2 -------------------------------------------------------------------- Double click on the renamed Combofix.exe & follow the prompts.
 Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply. This tool is not a toy and not for everyday use. ComboFix SHOULD NOT be used unless requested by a forum helper If you need help, see this link: http://www.bleepingcomputer.com/combofix/how-to-use-combofix -------------------- regards,
schrauber If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you! Unavailable as from friday 20th august If I have helped you then please consider donating to continue the fight against malware |
|
|
|
|
Dec 3 2009, 06:18 PM
Post
#21
|
|
|
Member Group: Members Posts: 30 Joined: 16-November 09 From: California Member No.: 403,570 |
Hi, I ran Combofix and then I ran Superantispyware. I posted both logs here. Superantispyware still says that I have 40 Adware.Vundo Variant/Rel on my computer. After looking at the Combofix log I noticed that it says that the registry entry that the adware is in is locked. I was going to post the Combofix log but it dissapeared from my desktop after I restarted my computer after running Superantispyware.
_______________________________________________________________________________________________ SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 12/03/2009 at 02:21 PM Application Version : 4.25.1014 Core Rules Database Version : 4332 Trace Rules Database Version: 2186 Scan type : Quick Scan Total Scan Time : 00:26:59 Memory items scanned : 438 Memory threats detected : 0 Registry items scanned : 416 Registry threats detected : 40 File items scanned : 6176 File threats detected : 0 Adware.Vundo Variant/Rel HKLM\SOFTWARE\Microsoft\MS Optimization HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\ad.trg HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\ad.trg#LU HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\ad.trg#CT HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\ad.trg#LT HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\filehippo HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\filehippo#LU HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\filehippo#CT HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\filehippo#LT HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\http://forums.majorgeeks.com/showthread.php%3Ft%3D74078 HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\mgtools.exe HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\mgtools.exe#LU HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\mgtools.exe#CT HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\mgtools.exe#LT HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\ncis HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\ncis#LU HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\ncis#CT HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\ncis#LT HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\sidereel HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\sidereel#LU HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\sidereel#CT HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\sidereel#LT HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\super+antispyware+free+edition HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\super+antispyware+free+edition#LU HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\super+antispyware+free+edition#CT HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\super+antispyware+free+edition#LT HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\the%2Bnumber%2Bone%2Bladies%2Bdetective%2Bagency HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\tvshack HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\tvshack#LU HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\tvshack#CT HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\tvshack#LT HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\watch+ncis%2C+probie+online HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\watch+ncis%2C+probie+online#LU HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\watch+ncis%2C+probie+online#CT HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\watch+ncis%2C+probie+online#LT HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\yieldmanager HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\yieldmanager#LU HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\yieldmanager#CT HKLM\SOFTWARE\Microsoft\MS Optimization\JKWL\yieldmanager#LT |
|
|
|
|
Dec 4 2009, 01:56 PM
Post
#22
|
|
|
Mr.Mechanic Group: Malware Response Team Posts: 20,994 Joined: 3-May 08 From: Saarland,Germany Member No.: 206,858 |
Hi,
Please have a look if you can find C:\Combofix.txt and post back with the content of the logfile. -------------------- regards,
schrauber If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you! Unavailable as from friday 20th august If I have helped you then please consider donating to continue the fight against malware |
|
|
|
|
Dec 4 2009, 05:12 PM
Post
#23
|
|
|
Member Group: Members Posts: 30 Joined: 16-November 09 From: California Member No.: 403,570 |
It was right were you said, I had forgotten to look there...here it is.
ComboFix 09-12-02.08 - Anna 12/03/2009 13:05.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.110 [GMT -8:00] Running from: c:\documents and settings\Anna\Desktop\schrauber.exe AV: AVG Internet Security Network Edition *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Anna\Application Data\inst.exe c:\windows\system32\geyekruearlfmo.dat c:\windows\system32\images c:\windows\system32\images\i1.gif c:\windows\system32\images\i2.gif c:\windows\system32\images\i3.gif c:\windows\system32\images\j1.gif c:\windows\system32\images\j2.gif c:\windows\system32\images\j3.gif c:\windows\system32\images\jj1.gif c:\windows\system32\images\jj2.gif c:\windows\system32\images\jj3.gif c:\windows\system32\images\l1.gif c:\windows\system32\images\l2.gif c:\windows\system32\images\l3.gif c:\windows\system32\images\pix.gif c:\windows\system32\images\t1.gif c:\windows\system32\images\t2.gif c:\windows\system32\images\up1.gif c:\windows\system32\images\up2.gif c:\windows\system32\images\w1.gif c:\windows\system32\images\w11.gif c:\windows\system32\images\w2.gif c:\windows\system32\images\w3.gif c:\windows\system32\images\w3.jpg c:\windows\system32\images\wt1.gif c:\windows\system32\images\wt2.gif c:\windows\system32\images\wt3.gif c:\windows\system32\nuar.old c:\windows\system32\pump.exe c:\windows\system32\skynet.dat c:\windows\system32\UACttqfqjdaifxbgpulk.db c:\windows\wf3.dat c:\windows\wf4.dat . ((((((((((((((((((((((((( Files Created from 2009-11-03 to 2009-12-03 ))))))))))))))))))))))))))))))) . 2009-11-30 22:30 . 2009-11-30 22:44 -------- d-----w- c:\documents and settings\Anna\Application Data\BitTorrent 2009-11-30 22:29 . 2009-11-30 22:30 -------- d-----w- c:\program files\BitTorrent 2009-11-29 21:38 . 2009-11-29 21:38 -------- d-----w- c:\windows\system32\wbem\Repository 2009-11-28 21:37 . 2009-11-30 22:24 -------- d-----w- c:\program files\DVDFab 6 2009-11-28 21:11 . 2009-11-30 22:21 -------- d-----w- c:\program files\DVD Shrink 2009-11-27 03:56 . 2009-11-29 21:36 -------- d-----w- c:\program files\Xvid 2009-11-27 03:55 . 2009-11-29 21:36 -------- d-----w- c:\program files\ffdshow 2009-11-27 03:54 . 2009-11-29 21:36 -------- d-----w- c:\program files\AviSynth 2.5 2009-11-27 03:53 . 2009-11-29 21:36 -------- d-----w- c:\program files\Avi2Dvd 2009-11-23 22:22 . 2009-11-23 22:22 152576 ----a-w- c:\documents and settings\Anna\Application Data\Sun\Java\jre1.6.0_17\lzma.dll 2009-11-23 21:59 . 2009-11-23 21:59 79488 ----a-w- c:\documents and settings\Anna\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll 2009-11-19 20:50 . 2009-11-19 20:50 -------- d-----w- c:\documents and settings\All Users\Application Data\SlySoft 2009-11-19 20:50 . 2009-11-19 20:50 -------- d-----w- c:\program files\SlySoft 2009-11-19 09:01 . 2009-11-19 09:01 -------- d-----w- c:\documents and settings\Anna\Application Data\AVG9 2009-11-16 07:56 . 2009-11-16 07:56 -------- d-----w- c:\documents and settings\Anna\Application Data\Autodesk 2009-11-16 04:05 . 2009-08-07 03:23 215920 ----a-w- c:\windows\system32\muweb.dll 2009-11-16 04:05 . 2009-08-07 03:23 274288 ----a-w- c:\windows\system32\mucltui.dll 2009-11-15 08:31 . 2009-11-11 02:29 4026136 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgui.exe 2009-11-15 08:31 . 2009-11-11 02:28 2016536 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtray.exe 2009-11-15 08:31 . 2009-11-11 02:28 1257240 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgfrw.exe 2009-11-15 08:31 . 2009-11-15 08:25 3963648 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll 2009-11-15 08:31 . 2009-11-15 08:24 497944 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgchjwx.dll 2009-11-15 06:27 . 2009-11-15 06:27 -------- d-----w- c:\program files\Eidos 2009-11-14 23:13 . 2009-11-14 23:14 -------- d-----w- c:\documents and settings\Anna\Application Data\Any DVD Converter Professional 2009-11-12 03:52 . 2009-11-15 06:24 -------- d-----w- c:\program files\Microsoft Silverlight 2009-11-09 20:16 . 2009-11-09 20:15 613656 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgiproxy.exe 2009-11-08 07:00 . 2009-12-03 00:33 -------- d-----w- C:\temp 2009-11-08 06:55 . 2009-11-08 07:28 -------- d-----w- c:\program files\ConvertLIT GUI 2009-11-07 04:38 . 2009-11-07 04:38 -------- d-----w- c:\documents and settings\Anna\Application Data\CyberLink . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-12-03 21:26 . 2009-05-09 22:42 -------- d-----w- c:\program files\DNA 2009-12-03 21:26 . 2009-05-09 22:42 -------- d-----w- c:\documents and settings\Anna\Application Data\DNA 2009-12-02 02:38 . 2009-09-23 22:22 -------- d-----w- c:\program files\eMule 2009-12-02 01:34 . 2009-10-04 23:57 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Nitro PDF 2009-11-30 22:26 . 2009-06-01 20:55 -------- d-----w- c:\documents and settings\Anna\Application Data\Vso 2009-11-30 22:25 . 2009-06-01 20:55 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys 2009-11-30 22:25 . 2009-06-01 20:55 47360 ----a-w- c:\documents and settings\Anna\Application Data\pcouffin.sys 2009-11-30 22:25 . 2009-06-01 20:55 47360 ----a-w- c:\documents and settings\Anna\Application Data\pcouffin.sys 2009-11-30 01:06 . 2009-04-10 03:49 117760 ----a-w- c:\documents and settings\Anna\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2009-11-28 21:11 . 2008-09-17 22:02 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink 2009-11-26 08:55 . 2009-10-02 20:55 -------- d-----w- c:\documents and settings\Anna\Application Data\Nitro PDF 2009-11-24 23:12 . 2009-10-23 17:35 -------- d-----w- c:\program files\DAEMON Tools 2009-11-23 22:26 . 2009-05-14 01:39 -------- d-----w- c:\program files\Java 2009-11-22 07:31 . 2009-10-16 21:54 -------- d-----w- c:\program files\010 Editor v3 2009-11-16 07:17 . 2009-10-06 07:41 -------- d-----w- c:\program files\Crawler 2009-11-11 22:36 . 2009-03-31 02:04 -------- d-----w- c:\program files\Apple Software Update 2009-11-11 02:27 . 2009-02-16 19:35 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2009-11-11 02:18 . 2009-10-23 20:53 877848 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe 2009-11-11 02:18 . 2009-10-23 20:53 1657112 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll 2009-11-08 07:28 . 2009-08-21 05:43 -------- d-----w- c:\program files\ABC Amber LIT Converter 2009-11-06 02:44 . 2009-11-02 04:44 -------- d-----w- c:\documents and settings\Anyone Else\Application Data\CyberLink 2009-11-04 22:09 . 2009-10-19 23:12 566 ----a-w- c:\windows\eReg.dat 2009-10-31 23:27 . 2009-10-31 23:27 -------- d-----w- c:\program files\ReadManiac 2009-10-30 01:40 . 2009-10-30 01:40 -------- d-----w- c:\program files\Panasonic 2009-10-30 01:40 . 2008-02-09 23:37 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-10-23 20:55 . 2009-02-16 19:35 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-10-23 20:55 . 2009-10-21 21:55 25608 ----a-w- c:\windows\system32\drivers\AVGIDSxx.sys 2009-10-23 20:55 . 2009-10-21 21:26 50968 ----a-w- c:\windows\system32\avgfwdx.dll 2009-10-23 20:55 . 2009-10-21 21:26 30104 ----a-w- c:\windows\system32\drivers\avgfwdx.sys 2009-10-23 20:54 . 2009-10-21 21:55 161800 ----a-w- c:\windows\system32\drivers\avgrkx86.sys 2009-10-23 17:35 . 2009-09-04 19:18 223128 ----a-w- c:\windows\system32\drivers\dtscsi.sys 2009-10-21 21:55 . 2009-02-16 19:35 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-10-21 21:55 . 2009-02-16 19:35 12464 ----a-w- c:\windows\system32\avgrsstx.dll 2009-10-21 21:52 . 2009-02-16 19:35 -------- d-----w- c:\program files\AVG 2009-10-21 21:52 . 2009-10-21 21:52 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9 2009-10-17 19:30 . 2009-10-17 19:30 -------- d-----w- c:\documents and settings\Anyone Else\Application Data\Malwarebytes 2009-10-17 17:49 . 2009-10-17 17:49 -------- d-----w- c:\documents and settings\Administrator\Application Data\Spyware Terminator 2009-10-17 17:46 . 2009-10-09 03:27 -------- d-----w- c:\documents and settings\owner\Application Data\Spyware Terminator 2009-10-11 12:17 . 2009-05-14 01:40 411368 ----a-w- c:\windows\system32\deploytk.dll 2009-10-09 03:20 . 2009-10-07 01:08 -------- d-----w- c:\documents and settings\Anyone Else\Application Data\Spyware Terminator 2009-10-08 07:49 . 2009-10-08 05:32 -------- d-----w- c:\documents and settings\Anna\Application Data\Mobipocket 2009-10-08 05:32 . 2009-10-08 05:32 50008 ----a-r- c:\documents and settings\Anna\Application Data\Microsoft\Installer\{342126E1-173C-4585-BFBE-3EBDD20E3E9E}\_6FEFF9B68218417F98F549.exe 2009-10-08 05:31 . 2009-10-08 05:31 -------- d-----w- c:\program files\Mobipocket.com 2009-10-07 04:30 . 2008-07-17 15:53 -------- d-----w- c:\program files\AirplanePDQ 2009-10-07 04:25 . 2009-10-07 04:25 286720 ------w- c:\windows\Setup1.exe 2009-10-07 04:25 . 2009-10-07 04:25 73216 ----a-w- c:\windows\ST6UNST.EXE 2009-10-06 21:26 . 2009-10-06 21:26 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar 2009-10-06 21:13 . 2008-07-17 15:47 -------- d-----w- c:\program files\Common Files\Wextech Shared 2009-10-06 03:32 . 2009-09-13 00:38 -------- d-----w- c:\documents and settings\Anna\Application Data\LimeWire 2009-10-05 21:14 . 2009-10-05 21:13 -------- d-----w- c:\program files\OverDrive ReaderWorks 2009-10-05 21:13 . 2009-10-05 21:13 2998 ----a-r- c:\documents and settings\Anna\Application Data\Microsoft\Installer\{6891401F-695B-447F-B3E3-3FDEDA952DC6}\_2a6418cf.exe 2009-10-05 21:12 . 2009-10-05 21:12 -------- d-----w- c:\program files\Common Files\OverDrive Shared 2009-09-11 14:33 . 2006-02-28 12:00 133632 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-08 21:38 . 2009-09-08 21:38 207872 ----a-w- c:\documents and settings\Anna\Application Data\SystemRequirementsLab\SRLProxy_srl_4.dll 2009-09-08 21:38 . 2009-09-08 21:38 207872 ----a-w- c:\documents and settings\Anna\Application Data\SystemRequirementsLab\SRLProxy_srl_3.dll 2009-09-08 21:38 . 2009-09-08 21:38 207872 ----a-w- c:\documents and settings\Anna\Application Data\SystemRequirementsLab\SRLProxy_srl_2.dll 2009-09-08 21:38 . 2009-09-08 21:38 207872 ----a-w- c:\documents and settings\Anna\Application Data\SystemRequirementsLab\SRLProxy_srl_1.dll 2009-09-05 01:58 . 2009-09-05 01:58 488968 ----a-w- c:\documents and settings\Anna\Application Data\Real\Update\setup\setup.exe 2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll 2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-09-18 1115392] [HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}] 2009-09-18 19:28 1115392 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-09-18 1115392] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-09-18 1115392] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-24 143360] "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-06 323392] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2007-08-11 110592] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-08-11 512000] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-13 342312] "AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2009-11-15 2020120] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280] "AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2003-06-27 88363] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoChangeAnimation"= 0 (0x0) "NoStrCmpLogical"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 0 (0x0) "NoStrCmpLogical"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 18:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-10-21 21:55 12464 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" "QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\MegaSquirt\\MS Download 2.00\\gms2dl.exe"= "c:\\Documents and Settings\\owner\\Desktop\\Megasquirt\\MS Download 2.00\\gms2dl.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\WINDOWS\\system32\\usmt\\migwiz.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\BitTorrent\\bittorrent.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "c:\\Program Files\\Java\\jre6\\bin\\java.exe"= "c:\\Program Files\\AVG\\AVG9\\avgam.exe"= "c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"= "c:\\Program Files\\AVG\\AVG9\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [10/21/2009 1:55 PM 25608] R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [10/21/2009 1:55 PM 161800] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/16/2009 11:35 AM 333192] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/16/2009 11:35 AM 360584] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2009 10:43 AM 8944] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/17/2009 10:43 AM 55024] R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [10/21/2009 1:53 PM 285392] R2 avgfws9;AVG Firewall;c:\program files\AVG\AVG9\avgfws9.exe [11/10/2009 6:21 PM 2304192] R2 AVGIDSAgent;AVG9IDSAgent;c:\program files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe [10/23/2009 12:55 PM 5832712] R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [10/21/2009 1:26 PM 30104] R3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys [10/21/2009 1:53 PM 122376] R3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys [10/21/2009 1:53 PM 30216] R3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys [10/21/2009 1:53 PM 25736] R3 SIS163u;SiS 163 usb Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [10/1/2004 9:14 AM 162304] S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [10/21/2009 1:26 PM 30104] S3 LucentSoftModem;Lucent Technologies Soft Modem;c:\windows\system32\drivers\LTSM.sys [2/9/2008 5:18 AM 802683] S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/17/2009 10:43 AM 7408] S3 SISNPF;SIS Netgroup Packet Filter;c:\windows\system32\drivers\SISNPF.SYS [9/30/2004 8:34 PM 74240] S4 NitroDriverReadSpool;NitroPDFDriverCreatorReadSpool;c:\program files\Nitro PDF\Professional\NitroPDFDriverService.exe [6/23/2009 10:55 AM 188736] S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [9/4/2009 11:10 AM 664064] . Contents of the 'Scheduled Tasks' folder 2009-11-18 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34] 2009-12-03 c:\windows\Tasks\GlaryInitialize.job - c:\program files\Glary Utilities\initialize.exe [2009-05-28 18:50] 2009-12-03 c:\windows\Tasks\User_Feed_Synchronization-{63756D05-40CA-4EEA-9053-5048F843C105}.job - c:\windows\system32\msfeedssync.exe [2009-03-08 11:31] . . ------- Supplementary Scan ------- . uStart Page = hxxp://yosemite.blackboard.com/webct/urw/lc4130001.tp0/logout.dowebct?insId=4130001&insName=Yosemite%20Community%20College%20District&glcid=URN:X-WEBCT-VISTA-V1:4ba12095-0a40-0158-01be-8e0667621702 uInternet Connection Wizard,ShellNext = hxxp://www.avg.com/ww.special-toolbar-first-run-tlbrf uInternet Settings,ProxyOverride = *.local FF - ProfilePath - c:\documents and settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.fantasticfiction.co.uk/ FF - prefs.js: network.proxy.type - 4 FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- pref(dom.disable_open_during_load, true);c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); . - - - - ORPHANS REMOVED - - - - Toolbar-Locked - (no file) AddRemove-RealJukebox 1.0 - c:\program files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 AddRemove-RealPlayer 6.0 - c:\program files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-12-03 13:26 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1801674531-152049171-1060284298-1004\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) [HKEY_LOCAL_MACHINE\software\Microsoft\MS Optimization\JKWL] @DACL=(02 0000) [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] @DACL=(02 0000) "Installed"="1" @="" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] @DACL=(02 0000) "Installed"="1" "NoChange"="1" @="" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] @DACL=(02 0000) "Installed"="1" @="" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(996) c:\program files\SUPERAntiSpyware\SASWINLO.dll c:\windows\system32\WININET.dll c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(3452) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ibmpmsvc.exe c:\windows\system32\Ati2evxx.exe c:\program files\AVG\AVG9\avgchsvx.exe c:\program files\AVG\AVG9\avgrsx.exe c:\program files\AVG\AVG9\avgcsrvx.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\windows\system32\ASTSRV.EXE c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\wdfmgr.exe c:\program files\AVG\AVG9\avgnsx.exe c:\program files\AVG\AVG9\avgcsrvx.exe c:\windows\system32\Ati2evxx.exe c:\windows\system32\wscntfy.exe c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe c:\program files\AVG\AVG9\Identity Protection\agent\bin\avgidsmonitor.exe c:\program files\iPod\bin\iPodService.exe c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe . ************************************************************************** . Completion time: 2009-12-03 13:37 - machine was rebooted ComboFix-quarantined-files.txt 2009-12-03 21:37 Pre-Run: 16,506,277,888 bytes free Post-Run: 16,470,208,512 bytes free Current=4 Default=4 Failed=3 LastKnownGood=1 Sets=,1,2,3,4 - - End Of File - - C14FA9F74532661D0EBBD39B019573BF |
|
|
|
|
Dec 5 2009, 04:21 AM
Post
#24
|
|
|
Mr.Mechanic Group: Malware Response Team Posts: 20,994 Joined: 3-May 08 From: Saarland,Germany Member No.: 206,858 |
Hi,
Your log(s) show that you are using so called peer-to-peer or file-sharing programmes (in your case Bittorrent and DNA). These programmes allow to share files between users as the name(s) suggest. In today's world the cyber crime has come to an enormous dimension and any means is used to infect personal computers to make use of their stored data or machine power for further propagation of the malware files. A popular means is the use of file-sharing tools as a tremendous amount of prospective victims can be reached through it. It is therefore possible to be infected by downloading manipulated files via peer-to-peer tools and thus suggested to be used with intense care. Some further readings on this subject, along the included links, are as follows: "File-Sharing, otherwise known as Peer To Peer" and "Risks of File-Sharing Technology." It is also important to note that sharing entertainment files and proprietary software infringes the copyright laws in many countries over the world and you are putting yourself at risk of being indicted through organisations watching over the rights of the authors of such files (i.e. the RIAA for music files, or the MPAA for movie files in the USA) or the authors of the files themselves. Naturally there are also legal ways to use these services, such as downloading Linux distributions or office suites such as "Open Office." Please download Malwarebytes Anti-Malware and save it to your desktop. alternate download link 1 alternate download link 2 MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
Please post back with a fresh OTL logfile and tell me how your system is running. -------------------- regards,
schrauber If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you! Unavailable as from friday 20th august If I have helped you then please consider donating to continue the fight against malware |
|
|
|
|
Dec 8 2009, 01:22 AM
Post
#25
|
|
|
Member Group: Members Posts: 30 Joined: 16-November 09 From: California Member No.: 403,570 |
Malwarebytes hasn't found any malware. Here's my log...
Malwarebytes' Anti-Malware 1.39 Database version: 2421 Windows 5.1.2600 Service Pack 2 12/7/2009 3:00:08 PM mbam-log-2009-12-07 (15-00-08).txt Scan type: Quick Scan Objects scanned: 105388 Time elapsed: 11 minute(s), 30 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) OTL logfile created on: 12/7/2009 10:08:32 PM - Run 3 OTL by OldTimer - Version 3.1.11.4 Folder = C:\Documents and Settings\Anna\My Documents\Computer Security Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 510.98 Mb Total Physical Memory | 192.88 Mb Available Physical Memory | 37.75% Memory free 1.45 Gb Paging File | 0.95 Gb Available in Paging File | 65.57% Paging File free Paging file location(s): C:\pagefile.sys 1000 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 93.16 Gb Total Space | 14.24 Gb Free Space | 15.29% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: BABYDOG Current User Name: Anna Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Processes (SafeList) ========== PRC - [2009/12/01 13:41:27 | 00,535,552 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Anna\My Documents\Computer Security\OTL.exe PRC - [2009/11/15 00:26:26 | 02,020,120 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe PRC - [2009/11/15 00:25:31 | 00,600,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe PRC - [2009/11/10 18:21:49 | 02,304,192 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgfws9.exe PRC - [2009/11/06 20:30:24 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009/11/06 15:34:34 | 00,323,392 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\DNA\btdna.exe PRC - [2009/10/23 12:55:15 | 05,832,712 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe PRC - [2009/10/23 12:55:15 | 00,592,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSMonitor.exe PRC - [2009/10/23 12:54:57 | 01,055,000 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe PRC - [2009/10/23 12:54:47 | 00,827,160 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgam.exe PRC - [2009/10/21 13:54:22 | 00,502,040 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe PRC - [2009/10/21 13:54:17 | 00,702,744 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe PRC - [2009/10/21 13:53:27 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe PRC - [2009/10/11 04:17:36 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe PRC - [2009/10/11 04:17:35 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2009/06/23 10:54:18 | 00,061,760 | ---- | M] (Nalpeiron Ltd.) -- C:\WINDOWS\system32\ASTSRV.EXE PRC - [2009/05/14 13:03:21 | 00,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe PRC - [2009/03/12 19:56:58 | 00,342,312 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe PRC - [2009/03/12 19:56:52 | 00,656,168 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe PRC - [2009/03/05 23:04:30 | 00,132,424 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe PRC - [2008/12/12 10:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe PRC - [2007/08/11 01:30:40 | 00,110,592 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe PRC - [2007/08/11 01:30:12 | 00,512,000 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe PRC - [2007/06/13 02:23:07 | 01,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007/05/11 02:06:38 | 00,341,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe PRC - [2006/12/23 18:05:20 | 00,143,360 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe PRC - [2006/12/23 18:04:42 | 00,905,216 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe PRC - [2006/12/23 17:54:04 | 00,262,144 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe PRC - [2005/11/11 01:33:00 | 00,073,782 | ---- | M] () -- C:\WINDOWS\system32\ibmpmsvc.exe PRC - [2005/04/06 15:03:28 | 00,110,592 | ---- | M] () -- C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe PRC - [2005/03/22 19:55:02 | 00,360,448 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe PRC - [2004/09/27 13:54:32 | 00,040,960 | ---- | M] () -- C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.00\SiSWLSvc.exe PRC - [2003/06/27 08:53:32 | 00,088,363 | ---- | M] (Agere Systems) -- C:\WINDOWS\AGRSMMSG.exe ========== Modules (SafeList) ========== MOD - [2009/12/01 13:41:27 | 00,535,552 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Anna\My Documents\Computer Security\OTL.exe MOD - [2007/08/11 01:30:34 | 00,065,536 | ---- | M] (Synaptics, Inc.) -- C:\WINDOWS\system32\SynTPFcs.dll MOD - [2006/08/25 07:45:55 | 01,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - [2009/11/10 18:21:49 | 02,304,192 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgfws9.exe -- (avgfws9) SRV - [2009/10/23 12:55:15 | 05,832,712 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent) SRV - [2009/10/21 13:53:27 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd) SRV - [2009/10/11 04:17:35 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2009/06/23 10:55:24 | 00,188,736 | ---- | M] (Nitro PDF Software) -- C:\Program Files\Nitro PDF\Professional\NitroPDFDriverService.exe -- (NitroDriverReadSpool) SRV - [2009/06/23 10:54:18 | 00,061,760 | ---- | M] (Nalpeiron Ltd.) -- C:\WINDOWS\system32\ASTSRV.EXE -- (astcc) SRV - [2009/03/12 19:56:52 | 00,656,168 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service) SRV - [2009/03/05 23:04:30 | 00,132,424 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2009/03/04 10:25:12 | 00,621,056 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2008/12/12 10:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service) SRV - [2006/12/23 17:54:04 | 00,262,144 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService) SRV - [2005/11/11 01:33:00 | 00,073,782 | ---- | M] () -- C:\WINDOWS\system32\ibmpmsvc.exe -- (IBMPMSVC) SRV - [2005/05/20 09:37:12 | 00,081,920 | ---- | M] (Hewlett-Packard Company) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE -- (HP Port Resolver) SRV - [2005/04/06 15:03:28 | 00,110,592 | ---- | M] () -- C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe -- (BlueSoleil Hid Service) SRV - [2005/03/22 19:55:02 | 00,360,448 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller) SRV - [2004/10/22 02:24:18 | 00,073,728 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT) SRV - [2004/10/16 04:31:06 | 00,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE -- (HP Status Server) SRV - [2004/09/27 13:54:32 | 00,040,960 | ---- | M] () -- C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.00\SiSWLSvc.exe -- (SiSWLSvc) SRV - [2004/08/03 16:56:44 | 00,027,136 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\irmon.dll -- (Irmon) ========== Driver Services (SafeList) ========== DRV - [2009/11/30 14:25:26 | 00,047,360 | ---- | M] (VSO Software) -- C:\WINDOWS\system32\drivers\pcouffin.sys -- (pcouffin) DRV - [2009/11/10 18:27:16 | 00,360,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX) DRV - [2009/10/23 12:55:25 | 00,028,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86) DRV - [2009/10/23 12:55:19 | 00,025,736 | ---- | M] (AVG Technologies ) -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys -- (AVGIDSShimxpx) DRV - [2009/10/23 12:55:19 | 00,025,608 | ---- | M] (AVG Technologies ) -- C:\WINDOWS\System32\Drivers\AVGIDSxx.sys -- (AVGIDSErHrxpx) DRV - [2009/10/23 12:55:18 | 00,122,376 | ---- | M] (AVG Technologies ) -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys -- (AVGIDSDriverxpx) DRV - [2009/10/23 12:55:18 | 00,030,216 | ---- | M] (AVG Technologies ) -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys -- (AVGIDSFilterxpx) DRV - [2009/10/23 12:55:10 | 00,030,104 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\system32\drivers\avgfwdx.sys -- (Avgfwfd) DRV - [2009/10/23 12:55:10 | 00,030,104 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\system32\drivers\avgfwdx.sys -- (Avgfwdx) DRV - [2009/10/23 12:54:48 | 00,161,800 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\Drivers\avgrkx86.sys -- (AvgRkx86) DRV - [2009/10/23 09:35:45 | 00,223,128 | ---- | M] (DT Soft Ltd.) -- C:\WINDOWS\System32\Drivers\dtscsi.sys -- (dtscsi) DRV - [2009/10/21 13:55:34 | 00,333,192 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86) DRV - [2009/09/04 11:10:29 | 00,664,064 | ---- | M] (Duplex Secure Ltd.) -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd) DRV - [2009/02/17 10:43:30 | 00,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM) DRV - [2009/02/17 10:43:28 | 00,055,024 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL) DRV - [2009/02/17 10:43:28 | 00,008,944 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV) DRV - [2009/01/15 11:19:36 | 00,023,848 | ---- | M] (GEAR Software Inc.) -- C:\WINDOWS\system32\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV - [2008/08/26 09:26:12 | 00,018,816 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2007/11/13 02:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) DRV - [2007/08/11 01:25:28 | 00,177,664 | ---- | M] (Synaptics, Inc.) -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP) DRV - [2007/03/30 08:14:04 | 00,032,256 | ---- | M] (SlySoft Inc.) -- C:\WINDOWS\system32\drivers\maplom.sys -- (Maplom) DRV - [2006/02/28 04:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) DRV - [2006/02/28 04:00:00 | 00,005,888 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\rootmdm.sys -- (ROOTMODEM) DRV - [2005/11/11 01:33:00 | 00,010,112 | ---- | M] (Lenovo.) -- C:\WINDOWS\system32\drivers\ibmpmdrv.sys -- (IBMPMDRV) DRV - [2005/06/24 17:36:16 | 00,039,036 | ---- | M] (LG Electronics Inc.) -- C:\WINDOWS\system32\drivers\lgusbmodem.sys -- (USBModem) DRV - [2005/05/31 14:40:20 | 00,020,480 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\drivers\blueletaudio.sys -- (BlueletAudio) DRV - [2005/05/31 08:42:28 | 00,023,000 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\drivers\btcusb.sys -- (Btcsrusb) DRV - [2005/05/26 10:01:36 | 00,038,144 | ---- | M] (LG Electronics Inc.) -- C:\WINDOWS\system32\drivers\lgusbdiag.sys -- (UsbDiag) DRV - [2005/05/26 10:01:18 | 00,021,344 | ---- | M] (LG Electronics Inc.) -- C:\WINDOWS\system32\drivers\lgusbbus.sys -- (usbbus) DRV - [2005/04/30 13:50:20 | 00,011,860 | ---- | M] () -- C:\WINDOWS\system32\drivers\vbtenum.sys -- (BTHidEnum) DRV - [2005/04/30 13:50:10 | 00,028,271 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\Drivers\BTHidMgr.sys -- (BTHidMgr) DRV - [2005/04/30 13:48:58 | 00,010,804 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\drivers\BtNetDrv.sys -- (BT) DRV - [2005/03/25 16:18:48 | 00,082,148 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\drivers\VcommMgr.sys -- (VcommMgr) DRV - [2005/03/22 20:00:58 | 01,034,752 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2005/03/04 09:10:38 | 00,157,696 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\drivers\e100b325.sys -- (E100B) Intel® DRV - [2004/10/19 12:37:38 | 00,061,312 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\drivers\VComm.sys -- (VComm) DRV - [2004/09/30 20:34:30 | 00,074,240 | ---- | M] (Politecnico di Torino) -- C:\WINDOWS\system32\drivers\SISNPF.SYS -- (SISNPF) DRV - [2004/09/30 18:14:34 | 00,162,304 | R--- | M] (SiS Corporation) -- C:\WINDOWS\system32\drivers\sis163u.sys -- (SIS163u) DRV - [2004/08/03 15:00:52 | 00,028,672 | ---- | M] (National Semiconductor Corporation) -- C:\WINDOWS\system32\drivers\nscirda.sys -- (NSCIRDA) DRV - [2003/10/16 01:07:38 | 00,012,288 | ---- | M] (Matsubleepa Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\drivers\mtdv2ku2.sys -- (MTDVC2) DRV - [2003/10/11 16:39:52 | 00,011,648 | ---- | M] (Matsubleepa Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\drivers\mtdv2ks2.sys -- (MTDVC2_ENUM) DRV - [2003/09/23 06:42:34 | 00,007,296 | ---- | M] (GARMIN Corp.) -- C:\WINDOWS\system32\drivers\grmnusb.sys -- (grmnusb) DRV - [2003/06/27 08:53:44 | 01,196,352 | ---- | M] (Agere Systems) -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2001/08/17 05:28:10 | 00,802,683 | ---- | M] (Lucent Technologies) -- C:\WINDOWS\system32\drivers\LTSM.sys -- (LucentSoftModem) DRV - [2001/08/17 04:20:04 | 00,096,256 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\drivers\ac97intc.sys -- (ac97intc) Intel® 82801 Audio Driver Install Service (WDM) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://yosemite.blackboard.com/webct/urw/l...be-8e0667621702 IE - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () IE - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\S-1-5-21-1801674531-152049171-1060284298-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\S-1-5-21-1801674531-152049171-1060284298-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://www.fantasticfiction.co.uk/" FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.701 FF - prefs.js..extensions.enabledItems: avg@igeared:2.710.016.005 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.6.5 FF - prefs.js..extensions.enabledItems: foxyproxy@eric.h.jung:2.16.1 FF - prefs.js..extensions.enabledItems: illimitux@illimitux.net:3.4 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..network.proxy.http: "132.213.9.222" FF - prefs.js..network.proxy.http_port: 80 FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2009/11/10 19:40:58 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009/05/14 13:04:05 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2009/11/05 18:44:26 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Flock 2.0\extensions\\Components: C:\Program Files\Flock\components FF - HKLM\software\mozilla\Flock 2.0\extensions\\Plugins: C:\Program Files\Flock\plugins FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/11/06 20:31:04 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/11/06 20:31:04 | 00,000,000 | ---D | M] [2009/09/12 16:41:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Extensions [2009/05/11 22:23:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Extensions\{a463f10c-3994-11da-9945-000d60ca027b} [2009/09/12 16:41:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Extensions\mozswing@mozswing.org [2009/12/07 22:01:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions [2009/11/05 18:44:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions\{B9C8BE50-7105-4ec6-8FB4-4935C0671648} [2009/12/03 20:23:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2009/11/29 13:38:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}(2) [2009/08/30 18:33:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2009/11/29 13:37:59 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions\{D2A6A719-7CBC-4594-85FD-C36AD881424F}(2) [2009/12/04 22:46:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions\foxyproxy@eric.h.jung [2009/11/24 21:02:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions\illimitux@illimitux.net [2009/05/24 15:27:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions\moveplayer@movenetworks.com [2009/09/22 22:21:19 | 00,002,424 | ---- | M] () -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\searchplugins\goodreads.xml [2009/12/06 21:43:44 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2008/09/03 16:11:24 | 00,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll [2009/05/08 11:49:00 | 00,221,184 | ---- | M] (CNN) -- C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll [2009/08/25 08:32:38 | 00,001,340 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml O1 HOSTS File: (27 bytes) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () O2 - BHO: (Catcher Class) - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dll (Moyea Software Co., Ltd.) O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () O3 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found. O3 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found. O3 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AGRSMMSG] C:\WINDOWS\AGRSMMSG.exe (Agere Systems) O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.) O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004..\Run: [BitTorrent DNA] C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeAnimation = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStrCmpLogical = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MemCheckBoxInRunDlg = 0 O7 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStrCmpLogical = 0 O7 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx (AcDcToday Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} file://C:\Program Files\AutoCAD 2002\InstBanr.ocx (NOXLATE-BANR) O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} file://C:\Program Files\AutoCAD 2002\InstFred.ocx (InstaFred) O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa...ash/swflash.cab (Shockwave Flash Object) O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} file://C:\Program Files\AutoCAD 2002\AcPreview.ocx (AcPreview Control) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 69.45.176.5 64.13.46.12 O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.) O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008/02/09 13:28:51 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (*) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2009/12/05 15:22:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\My Documents\Downloaded FLV [2009/12/05 15:08:53 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\DVD Flick [2009/12/05 15:01:36 | 00,040,960 | ---- | C] (vbAccelerator) -- C:\WINDOWS\System32\ssubtmr6.dll [2009/12/05 15:01:35 | 00,036,864 | ---- | C] (Robdogg Inc.) -- C:\WINDOWS\System32\trayicon_handler.ocx [2009/12/05 15:01:33 | 00,662,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mscomct2.ocx [2009/12/05 15:01:33 | 00,164,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comct232.ocx [2009/12/05 15:01:33 | 00,028,672 | ---- | C] (-) -- C:\WINDOWS\System32\mousewheel.ocx [2009/12/05 15:01:32 | 00,000,000 | ---D | C] -- C:\Program Files\DVD Flick [2009/12/05 13:45:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\Machete [2009/12/05 13:44:40 | 00,000,000 | ---D | C] -- C:\Program Files\MacheteSoft [2009/12/05 01:40:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\Moyea [2009/12/05 01:40:27 | 00,000,000 | ---D | C] -- C:\Program Files\Moyea [2009/12/04 23:27:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\DonationCoder [2009/12/04 23:25:15 | 00,000,000 | ---D | C] -- C:\Program Files\URLSnooper2 [2009/12/03 19:10:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\ALLCapture [2009/12/03 13:00:21 | 00,000,000 | ---D | C] -- C:\schrauber [2009/12/03 12:59:06 | 00,000,000 | ---D | C] -- C:\Qoobox [2009/12/02 21:12:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\My Documents\My eBooks [2009/11/30 14:30:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\BitTorrent [2009/11/30 14:29:56 | 00,000,000 | ---D | C] -- C:\Program Files\BitTorrent [2009/11/30 14:25:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\My Documents\PcSetup [2009/11/28 13:37:37 | 00,000,000 | ---D | C] -- C:\Program Files\DVDFab 6 [2009/11/28 13:11:41 | 00,000,000 | ---D | C] -- C:\Program Files\DVD Shrink [2009/11/26 19:56:56 | 00,000,000 | ---D | C] -- C:\Program Files\Xvid [2009/11/26 19:55:54 | 00,000,000 | ---D | C] -- C:\Program Files\ffdshow [2009/11/26 19:54:34 | 00,000,000 | ---D | C] -- C:\Program Files\AviSynth 2.5 [2009/11/26 19:53:01 | 00,000,000 | ---D | C] -- C:\Program Files\Avi2Dvd [2009/11/23 14:26:35 | 00,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2009/11/23 14:26:35 | 00,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2009/11/23 14:26:35 | 00,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2009/11/19 12:50:58 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SlySoft [2009/11/19 12:50:13 | 00,000,000 | ---D | C] -- C:\Program Files\SlySoft [2009/11/19 01:01:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\AVG9 [2009/11/15 23:56:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\Autodesk [2009/11/15 20:05:01 | 00,274,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll [2009/11/15 12:19:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\My Documents\Movies to burn [2009/11/14 22:27:37 | 00,000,000 | ---D | C] -- C:\Program Files\Eidos [2009/11/14 22:23:21 | 00,000,000 | ---D | C] -- C:\Config.Msi [2009/11/14 16:47:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\My Documents\Playlists [2009/11/14 15:13:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\Any DVD Converter Professional [2009/11/12 15:25:15 | 00,016,736 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll.mui [2009/11/11 19:52:59 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2009/11/07 23:50:29 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\Anna\Recent [2009/11/07 23:00:19 | 00,000,000 | ---D | C] -- C:\temp [2009/11/07 22:55:26 | 00,000,000 | ---D | C] -- C:\Program Files\ConvertLIT GUI [2009/06/01 12:55:54 | 00,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Anna\Application Data\pcouffin.sys [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\Documents and Settings\Anna\My Documents\*.tmp files -> C:\Documents and Settings\Anna\My Documents\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2009/12/07 16:05:17 | 00,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{63756D05-40CA-4EEA-9053-5048F843C105}.job [2009/12/07 15:20:54 | 00,000,310 | ---- | M] () -- C:\WINDOWS\tasks\GlaryInitialize.job [2009/12/07 15:20:30 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009/12/07 15:20:23 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009/12/07 13:47:36 | 46,334,996 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm [2009/12/07 13:45:36 | 00,116,698 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg [2009/12/07 04:20:15 | 06,373,376 | ---- | M] () -- C:\Documents and Settings\Anna\ntuser.dat [2009/12/07 04:19:42 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\Anna\ntuser.ini [2009/12/06 13:54:10 | 00,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009/12/05 21:00:30 | 00,039,278 | ---- | M] () -- C:\Documents and Settings\Anna\Desktop\M,M,A.jpg [2009/12/05 20:33:52 | 07,752,239 | ---- | M] () -- C:\Documents and Settings\Anna\Desktop\ong - Jon Chu_s LXD_ Legion of Extraordinary Dancers Trailer.mp4 [2009/12/05 20:30:57 | 24,356,909 | ---- | M] () -- C:\Documents and Settings\Anna\Desktop\Chu _amp; The League of Extraordinary Dancers - YouTube Live.mp4 [2009/12/05 14:21:28 | 00,000,666 | ---- | M] () -- C:\Documents and Settings\Anna\Desktop\Avi2Dvd.lnk [2009/12/05 13:46:36 | 00,002,343 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Machete.lnk [2009/12/05 00:00:12 | 51,116,792 | ---- | M] () -- C:\Documents and Settings\Anna\Desktop\S6E10.flv [2009/12/04 23:27:23 | 00,000,046 | ---- | M] () -- C:\WINDOWS\System32\DonationCoder_urlsnooper_InstallInfo.dat [2009/12/04 23:26:00 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\-1 [2009/12/04 13:56:44 | 00,546,935 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\iavifw.avm [2009/12/03 13:27:11 | 00,000,332 | ---- | M] () -- C:\WINDOWS\system.ini [2009/12/03 13:26:37 | 00,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2009/12/03 12:44:30 | 00,000,020 | ---- | M] () -- C:\Documents and Settings\Anna\defogger_reenable [2009/12/02 15:39:18 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\Anna\Desktop\iTunes.lnk [2009/12/02 02:14:05 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2009/11/30 14:25:27 | 00,007,887 | ---- | M] () -- C:\Documents and Settings\Anna\Application Data\pcouffin.cat [2009/11/30 14:25:26 | 00,047,360 | ---- | M] (VSO Software) -- C:\WINDOWS\System32\drivers\pcouffin.sys [2009/11/30 14:25:26 | 00,047,360 | ---- | M] (VSO Software) -- C:\Documents and Settings\Anna\Application Data\pcouffin.sys [2009/11/30 14:25:26 | 00,001,144 | ---- | M] () -- C:\Documents and Settings\Anna\Application Data\pcouffin.inf [2009/11/20 14:01:06 | 00,288,876 | ---- | M] () -- C:\Documents and Settings\Anna\My Documents\bookmarks-2009-11-20.json [2009/11/18 12:45:48 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2009/11/15 19:56:15 | 00,219,248 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009/11/14 01:47:57 | 00,260,608 | ---- | M] () -- C:\WINDOWS\PEV.exe [2009/11/10 18:27:16 | 00,360,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys [2009/11/08 13:25:18 | 00,508,956 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009/11/08 13:25:18 | 00,432,924 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009/11/08 13:25:18 | 00,067,714 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\Documents and Settings\Anna\My Documents\*.tmp files -> C:\Documents and Settings\Anna\My Documents\*.tmp -> ] ========== Files Created - No Company Name ========== [2099/01/01 12:00:00 | 00,011,168 | -H-- | C] () -- C:\WINDOWS\System32\tanokiso [2009/12/05 21:00:29 | 00,039,278 | ---- | C] () -- C:\Documents and Settings\Anna\Desktop\M,M,A.jpg [2009/12/05 20:30:48 | 07,752,239 | ---- | C] () -- C:\Documents and Settings\Anna\Desktop\ong - Jon Chu_s LXD_ Legion of Extraordinary Dancers Trailer.mp4 [2009/12/05 20:16:56 | 24,356,909 | ---- | C] () -- C:\Documents and Settings\Anna\Desktop\Chu _amp; The League of Extraordinary Dancers - YouTube Live.mp4 [2009/12/05 14:53:54 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\xvid.ax [2009/12/05 14:21:28 | 00,000,666 | ---- | C] () -- C:\Documents and Settings\Anna\Desktop\Avi2Dvd.lnk [2009/12/05 13:44:48 | 00,002,343 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Machete.lnk [2009/12/04 23:35:05 | 51,116,792 | ---- | C] () -- C:\Documents and Settings\Anna\Desktop\S6E10.flv [2009/12/04 23:27:22 | 00,000,046 | ---- | C] () -- C:\WINDOWS\System32\DonationCoder_urlsnooper_InstallInfo.dat [2009/12/04 23:26:00 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\-1 [2009/12/03 13:01:30 | 00,260,608 | ---- | C] () -- C:\WINDOWS\PEV.exe [2009/12/03 13:01:30 | 00,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe [2009/12/03 12:43:34 | 00,000,020 | ---- | C] () -- C:\Documents and Settings\Anna\defogger_reenable [2009/11/20 14:01:05 | 00,288,876 | ---- | C] () -- C:\Documents and Settings\Anna\My Documents\bookmarks-2009-11-20.json [2009/11/11 01:02:55 | 06,373,376 | ---- | C] () -- C:\Documents and Settings\Anna\ntuser.dat [2009/09/29 21:19:11 | 00,010,752 | ---- | C] () -- C:\Documents and Settings\Anna\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009/09/03 10:12:40 | 00,013,304 | ---- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys [2009/09/03 10:12:39 | 00,011,860 | ---- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys [2009/07/21 20:35:11 | 00,081,920 | R--- | C] () -- C:\WINDOWS\System32\srctrl.dll [2009/06/01 12:56:19 | 00,000,034 | ---- | C] () -- C:\Documents and Settings\Anna\Application Data\pcouffin.log [2009/06/01 12:55:54 | 00,007,887 | ---- | C] () -- C:\Documents and Settings\Anna\Application Data\pcouffin.cat [2009/06/01 12:55:54 | 00,001,144 | ---- | C] () -- C:\Documents and Settings\Anna\Application Data\pcouffin.inf [2009/05/22 14:13:06 | 00,087,552 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll [2009/05/13 20:08:10 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009/05/13 20:08:04 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009/05/13 20:08:03 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009/05/13 20:07:58 | 00,084,480 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009/05/13 20:07:58 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009/02/16 10:48:59 | 00,002,390 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\LuUninstall.LiveUpdate [2009/01/21 23:07:02 | 00,000,000 | ---- | C] () -- C:\WINDOWS\LM.INI [2008/06/03 12:27:39 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\swunilog.ini [2008/04/29 13:42:24 | 00,503,808 | ---- | C] () -- C:\WINDOWS\System32\ICCProfiles.dll [2008/02/26 09:24:03 | 00,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI [2008/02/09 22:44:56 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2008/02/09 15:42:38 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2003/06/24 14:43:48 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll [2000/09/18 15:50:28 | 00,202,752 | ---- | C] () -- C:\WINDOWS\System32\zlib.dll < End of report > |
|
|
|
|
Dec 8 2009, 02:47 PM
Post
#26
|
|
|
Mr.Mechanic Group: Malware Response Team Posts: 20,994 Joined: 3-May 08 From: Saarland,Germany Member No.: 206,858 |
Hi,
How is it running right now? I'd like us to scan your machine with ESET OnlineScan
-------------------- regards,
schrauber If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you! Unavailable as from friday 20th august If I have helped you then please consider donating to continue the fight against malware |
|
|
|
button.
to download the ESET Smart Installer. Save it to your desktop.
icon on your desktop.
button.
, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
button.
|
Dec 9 2009, 10:24 PM
Post
#27
|
|
|
Member Group: Members Posts: 30 Joined: 16-November 09 From: California Member No.: 403,570 |
ESET Online Scanner didn't find any threats so there was no logfile. Do you think that means that Superantispyware is messing up and telling me I have adware on my computer that isn't there? Or is it the only program that can scan the locked registry entry?
My computer seems to be running fine. Thanks, Anna |
|
|
|
|
Dec 10 2009, 03:24 PM
Post
#28
|
|
|
Mr.Mechanic Group: Malware Response Team Posts: 20,994 Joined: 3-May 08 From: Saarland,Germany Member No.: 206,858 |
Hi,
Do Superantispyware still found some threats? Please post back with a fresh OTL logfile. -------------------- regards,
schrauber If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you! Unavailable as from friday 20th august If I have helped you then please consider donating to continue the fight against malware |
|
|
|
|
Dec 11 2009, 01:28 AM
Post
#29
|
|
|
Member Group: Members Posts: 30 Joined: 16-November 09 From: California Member No.: 403,570 |
Yes, Superantispyware still says my computer has 40 problems, even after I've asked it to delete them and restarted the computer.
Here is my latest OTL logfile. Thanks OTL logfile created on: 12/10/2009 10:11:18 PM - Run 5 OTL by OldTimer - Version 3.1.11.4 Folder = C:\Documents and Settings\Anna\Desktop Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 510.98 Mb Total Physical Memory | 136.87 Mb Available Physical Memory | 26.79% Memory free 1.45 Gb Paging File | 0.73 Gb Available in Paging File | 50.38% Paging File free Paging file location(s): C:\pagefile.sys 1000 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 93.16 Gb Total Space | 10.86 Gb Free Space | 11.66% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: BABYDOG Current User Name: Anna Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Processes (SafeList) ========== PRC - [2009/12/10 13:36:46 | 02,033,432 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe PRC - [2009/12/10 13:36:25 | 00,503,576 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe PRC - [2009/12/10 13:36:20 | 00,600,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe PRC - [2009/12/10 13:34:40 | 02,303,680 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgfws9.exe PRC - [2009/12/01 13:41:27 | 00,535,552 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Anna\desktop\OTL.exe PRC - [2009/11/20 14:37:16 | 00,654,128 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\BitTorrent\bittorrent.exe PRC - [2009/11/06 20:30:24 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009/11/06 15:34:34 | 00,323,392 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\DNA\btdna.exe PRC - [2009/10/23 12:55:15 | 05,832,712 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe PRC - [2009/10/23 12:55:15 | 00,592,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSMonitor.exe PRC - [2009/10/23 12:54:57 | 01,055,000 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe PRC - [2009/10/23 12:54:47 | 00,827,160 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgam.exe PRC - [2009/10/21 13:54:17 | 00,702,744 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe PRC - [2009/10/21 13:53:27 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe PRC - [2009/10/11 04:17:36 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe PRC - [2009/10/11 04:17:35 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2009/06/23 10:54:18 | 00,061,760 | ---- | M] (Nalpeiron Ltd.) -- C:\WINDOWS\system32\ASTSRV.EXE PRC - [2009/05/14 13:03:21 | 00,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe PRC - [2009/03/12 19:56:58 | 00,342,312 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe PRC - [2009/03/12 19:56:54 | 13,498,664 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunes.exe PRC - [2009/03/12 19:56:52 | 00,656,168 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe PRC - [2009/03/05 23:04:30 | 00,132,424 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe PRC - [2009/02/17 10:43:26 | 01,830,128 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe PRC - [2008/12/12 10:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe PRC - [2007/08/11 01:30:40 | 00,110,592 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe PRC - [2007/08/11 01:30:12 | 00,512,000 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe PRC - [2007/06/13 02:23:07 | 01,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007/01/30 00:39:34 | 01,432,064 | ---- | M] (Phoenix Labs) -- C:\Program Files\PeerGuardian2\pg2.exe PRC - [2006/12/23 18:05:20 | 00,143,360 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe PRC - [2006/12/23 18:04:42 | 00,905,216 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe PRC - [2006/12/23 17:54:04 | 00,262,144 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe PRC - [2005/11/11 01:33:00 | 00,073,782 | ---- | M] () -- C:\WINDOWS\system32\ibmpmsvc.exe PRC - [2005/04/06 15:03:28 | 00,110,592 | ---- | M] () -- C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe PRC - [2005/03/22 19:55:02 | 00,360,448 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe PRC - [2004/09/27 13:54:32 | 00,040,960 | ---- | M] () -- C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.00\SiSWLSvc.exe PRC - [2003/06/27 08:53:32 | 00,088,363 | ---- | M] (Agere Systems) -- C:\WINDOWS\AGRSMMSG.exe ========== Modules (SafeList) ========== MOD - [2009/12/01 13:41:27 | 00,535,552 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Anna\desktop\OTL.exe MOD - [2007/08/11 01:30:34 | 00,065,536 | ---- | M] (Synaptics, Inc.) -- C:\WINDOWS\system32\SynTPFcs.dll MOD - [2006/08/25 07:45:55 | 01,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - [2009/12/10 13:34:40 | 02,303,680 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgfws9.exe -- (avgfws9) SRV - [2009/10/23 12:55:15 | 05,832,712 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent) SRV - [2009/10/21 13:53:27 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd) SRV - [2009/10/11 04:17:35 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2009/06/23 10:55:24 | 00,188,736 | ---- | M] (Nitro PDF Software) -- C:\Program Files\Nitro PDF\Professional\NitroPDFDriverService.exe -- (NitroDriverReadSpool) SRV - [2009/06/23 10:54:18 | 00,061,760 | ---- | M] (Nalpeiron Ltd.) -- C:\WINDOWS\system32\ASTSRV.EXE -- (astcc) SRV - [2009/03/12 19:56:52 | 00,656,168 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service) SRV - [2009/03/05 23:04:30 | 00,132,424 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2009/03/04 10:25:12 | 00,621,056 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2008/12/12 10:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service) SRV - [2006/12/23 17:54:04 | 00,262,144 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService) SRV - [2005/11/11 01:33:00 | 00,073,782 | ---- | M] () -- C:\WINDOWS\system32\ibmpmsvc.exe -- (IBMPMSVC) SRV - [2005/05/20 09:37:12 | 00,081,920 | ---- | M] (Hewlett-Packard Company) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE -- (HP Port Resolver) SRV - [2005/04/06 15:03:28 | 00,110,592 | ---- | M] () -- C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe -- (BlueSoleil Hid Service) SRV - [2005/03/22 19:55:02 | 00,360,448 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller) SRV - [2004/10/22 02:24:18 | 00,073,728 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT) SRV - [2004/10/16 04:31:06 | 00,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE -- (HP Status Server) SRV - [2004/09/27 13:54:32 | 00,040,960 | ---- | M] () -- C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.00\SiSWLSvc.exe -- (SiSWLSvc) SRV - [2004/08/03 16:56:44 | 00,027,136 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\irmon.dll -- (Irmon) ========== Driver Services (SafeList) ========== DRV - [2009/11/30 14:25:26 | 00,047,360 | ---- | M] (VSO Software) -- C:\WINDOWS\system32\drivers\pcouffin.sys -- (pcouffin) DRV - [2009/11/10 18:27:16 | 00,360,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX) DRV - [2009/10/23 12:55:25 | 00,028,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86) DRV - [2009/10/23 12:55:19 | 00,025,736 | ---- | M] (AVG Technologies ) -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys -- (AVGIDSShimxpx) DRV - [2009/10/23 12:55:19 | 00,025,608 | ---- | M] (AVG Technologies ) -- C:\WINDOWS\System32\Drivers\AVGIDSxx.sys -- (AVGIDSErHrxpx) DRV - [2009/10/23 12:55:18 | 00,122,376 | ---- | M] (AVG Technologies ) -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys -- (AVGIDSDriverxpx) DRV - [2009/10/23 12:55:18 | 00,030,216 | ---- | M] (AVG Technologies ) -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys -- (AVGIDSFilterxpx) DRV - [2009/10/23 12:55:10 | 00,030,104 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\system32\drivers\avgfwdx.sys -- (Avgfwfd) DRV - [2009/10/23 12:55:10 | 00,030,104 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\system32\drivers\avgfwdx.sys -- (Avgfwdx) DRV - [2009/10/23 12:54:48 | 00,161,800 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\Drivers\avgrkx86.sys -- (AvgRkx86) DRV - [2009/10/23 09:35:45 | 00,223,128 | ---- | M] (DT Soft Ltd.) -- C:\WINDOWS\System32\Drivers\dtscsi.sys -- (dtscsi) DRV - [2009/10/21 13:55:34 | 00,333,192 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86) DRV - [2009/09/04 11:10:29 | 00,664,064 | ---- | M] (Duplex Secure Ltd.) -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd) DRV - [2009/02/17 10:43:30 | 00,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM) DRV - [2009/02/17 10:43:28 | 00,055,024 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL) DRV - [2009/02/17 10:43:28 | 00,008,944 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV) DRV - [2009/01/15 11:19:36 | 00,023,848 | ---- | M] (GEAR Software Inc.) -- C:\WINDOWS\system32\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV - [2008/08/26 09:26:12 | 00,018,816 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2007/11/13 02:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) DRV - [2007/08/11 01:25:28 | 00,177,664 | ---- | M] (Synaptics, Inc.) -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP) DRV - [2007/03/30 08:14:04 | 00,032,256 | ---- | M] (SlySoft Inc.) -- C:\WINDOWS\system32\drivers\maplom.sys -- (Maplom) DRV - [2007/01/30 00:16:42 | 00,006,144 | ---- | M] () -- C:\Program Files\PeerGuardian2\pgfilter.sys -- (pgfilter) DRV - [2006/02/28 04:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) DRV - [2006/02/28 04:00:00 | 00,005,888 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\rootmdm.sys -- (ROOTMODEM) DRV - [2005/11/11 01:33:00 | 00,010,112 | ---- | M] (Lenovo.) -- C:\WINDOWS\system32\drivers\ibmpmdrv.sys -- (IBMPMDRV) DRV - [2005/06/24 17:36:16 | 00,039,036 | ---- | M] (LG Electronics Inc.) -- C:\WINDOWS\system32\drivers\lgusbmodem.sys -- (USBModem) DRV - [2005/05/31 14:40:20 | 00,020,480 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\drivers\blueletaudio.sys -- (BlueletAudio) DRV - [2005/05/31 08:42:28 | 00,023,000 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\drivers\btcusb.sys -- (Btcsrusb) DRV - [2005/05/26 10:01:36 | 00,038,144 | ---- | M] (LG Electronics Inc.) -- C:\WINDOWS\system32\drivers\lgusbdiag.sys -- (UsbDiag) DRV - [2005/05/26 10:01:18 | 00,021,344 | ---- | M] (LG Electronics Inc.) -- C:\WINDOWS\system32\drivers\lgusbbus.sys -- (usbbus) DRV - [2005/04/30 13:50:20 | 00,011,860 | ---- | M] () -- C:\WINDOWS\system32\drivers\vbtenum.sys -- (BTHidEnum) DRV - [2005/04/30 13:50:10 | 00,028,271 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\Drivers\BTHidMgr.sys -- (BTHidMgr) DRV - [2005/04/30 13:48:58 | 00,010,804 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\drivers\BtNetDrv.sys -- (BT) DRV - [2005/03/25 16:18:48 | 00,082,148 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\drivers\VcommMgr.sys -- (VcommMgr) DRV - [2005/03/22 20:00:58 | 01,034,752 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2005/03/04 09:10:38 | 00,157,696 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\drivers\e100b325.sys -- (E100B) Intel® DRV - [2004/10/19 12:37:38 | 00,061,312 | ---- | M] (IVT Corporation) -- C:\WINDOWS\system32\drivers\VComm.sys -- (VComm) DRV - [2004/09/30 20:34:30 | 00,074,240 | ---- | M] (Politecnico di Torino) -- C:\WINDOWS\system32\drivers\SISNPF.SYS -- (SISNPF) DRV - [2004/09/30 18:14:34 | 00,162,304 | R--- | M] (SiS Corporation) -- C:\WINDOWS\system32\drivers\sis163u.sys -- (SIS163u) DRV - [2004/08/03 15:00:52 | 00,028,672 | ---- | M] (National Semiconductor Corporation) -- C:\WINDOWS\system32\drivers\nscirda.sys -- (NSCIRDA) DRV - [2003/10/16 01:07:38 | 00,012,288 | ---- | M] (Matsubleepa Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\drivers\mtdv2ku2.sys -- (MTDVC2) DRV - [2003/10/11 16:39:52 | 00,011,648 | ---- | M] (Matsubleepa Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\drivers\mtdv2ks2.sys -- (MTDVC2_ENUM) DRV - [2003/09/23 06:42:34 | 00,007,296 | ---- | M] (GARMIN Corp.) -- C:\WINDOWS\system32\drivers\grmnusb.sys -- (grmnusb) DRV - [2003/06/27 08:53:44 | 01,196,352 | ---- | M] (Agere Systems) -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2001/08/17 05:28:10 | 00,802,683 | ---- | M] (Lucent Technologies) -- C:\WINDOWS\system32\drivers\LTSM.sys -- (LucentSoftModem) DRV - [2001/08/17 04:20:04 | 00,096,256 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\drivers\ac97intc.sys -- (ac97intc) Intel® 82801 Audio Driver Install Service (WDM) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://yosemite.blackboard.com/webct/urw/l...be-8e0667621702 IE - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () IE - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\S-1-5-21-1801674531-152049171-1060284298-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\S-1-5-21-1801674531-152049171-1060284298-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://www.fantasticfiction.co.uk/" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1 FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.716 FF - prefs.js..extensions.enabledItems: avg@igeared:2.710.016.005 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.6.5 FF - prefs.js..extensions.enabledItems: foxyproxy@eric.h.jung:2.16.1 FF - prefs.js..extensions.enabledItems: illimitux@illimitux.net:3.4 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..network.proxy.http: "132.213.9.222" FF - prefs.js..network.proxy.http_port: 80 FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2009/12/10 13:41:07 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009/05/14 13:04:05 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2009/11/05 18:44:26 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Flock 2.0\extensions\\Components: C:\Program Files\Flock\components FF - HKLM\software\mozilla\Flock 2.0\extensions\\Plugins: C:\Program Files\Flock\plugins FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/11/06 20:31:04 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/11/06 20:31:04 | 00,000,000 | ---D | M] [2009/09/12 16:41:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Extensions [2009/05/11 22:23:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Extensions\{a463f10c-3994-11da-9945-000d60ca027b} [2009/09/12 16:41:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Extensions\mozswing@mozswing.org [2009/12/08 23:28:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions [2009/11/05 18:44:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions\{B9C8BE50-7105-4ec6-8FB4-4935C0671648} [2009/12/03 20:23:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2009/11/29 13:38:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}(2) [2009/08/30 18:33:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2009/11/29 13:37:59 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions\{D2A6A719-7CBC-4594-85FD-C36AD881424F}(2) [2009/12/04 22:46:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions\foxyproxy@eric.h.jung [2009/11/24 21:02:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions\illimitux@illimitux.net [2009/05/24 15:27:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\extensions\moveplayer@movenetworks.com [2009/09/22 22:21:19 | 00,002,424 | ---- | M] () -- C:\Documents and Settings\Anna\Application Data\Mozilla\Firefox\Profiles\ek5f38qi.default\searchplugins\goodreads.xml [2009/12/09 23:40:50 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2008/09/03 16:11:24 | 00,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll [2009/05/08 11:49:00 | 00,221,184 | ---- | M] (CNN) -- C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll [2009/08/25 08:32:38 | 00,001,340 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml O1 HOSTS File: (27 bytes) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () O3 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found. O3 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found. O3 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AGRSMMSG] C:\WINDOWS\AGRSMMSG.exe (Agere Systems) O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.) O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004..\Run: [BitTorrent DNA] C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeAnimation = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStrCmpLogical = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MemCheckBoxInRunDlg = 0 O7 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStrCmpLogical = 0 O7 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-1801674531-152049171-1060284298-1004_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx (AcDcToday Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} file://C:\Program Files\AutoCAD 2002\InstBanr.ocx (NOXLATE-BANR) O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} file://C:\Program Files\AutoCAD 2002\InstFred.ocx (InstaFred) O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa...ash/swflash.cab (Shockwave Flash Object) O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} file://C:\Program Files\AutoCAD 2002\AcPreview.ocx (AcPreview Control) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 69.45.176.5 64.13.46.12 O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.) O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008/02/09 13:28:51 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (*) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2009/12/09 16:18:18 | 00,000,000 | ---D | C] -- C:\Program Files\PeerGuardian2 [2009/12/09 14:02:02 | 00,000,000 | ---D | C] -- C:\Program Files\ESET [2009/12/08 14:06:08 | 00,000,000 | ---D | C] -- C:\Program Files\ABC Amber Sony Converter [2009/12/05 15:08:53 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\DVD Flick [2009/12/05 15:01:36 | 00,040,960 | ---- | C] (vbAccelerator) -- C:\WINDOWS\System32\ssubtmr6.dll [2009/12/05 15:01:35 | 00,036,864 | ---- | C] (Robdogg Inc.) -- C:\WINDOWS\System32\trayicon_handler.ocx [2009/12/05 15:01:33 | 00,662,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mscomct2.ocx [2009/12/05 15:01:33 | 00,164,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comct232.ocx [2009/12/05 15:01:33 | 00,028,672 | ---- | C] (-) -- C:\WINDOWS\System32\mousewheel.ocx [2009/12/05 15:01:32 | 00,000,000 | ---D | C] -- C:\Program Files\DVD Flick [2009/12/05 13:45:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\Machete [2009/12/05 01:40:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\Moyea [2009/12/05 01:40:27 | 00,000,000 | ---D | C] -- C:\Program Files\Moyea [2009/12/04 23:27:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\DonationCoder [2009/12/04 23:25:15 | 00,000,000 | ---D | C] -- C:\Program Files\URLSnooper2 [2009/12/03 19:10:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\ALLCapture [2009/12/03 13:00:21 | 00,000,000 | ---D | C] -- C:\schrauber [2009/12/03 12:59:06 | 00,000,000 | ---D | C] -- C:\Qoobox [2009/12/02 21:12:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\My Documents\My eBooks [2009/12/01 13:41:09 | 00,535,552 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Anna\Desktop\OTL.exe [2009/11/30 14:30:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\BitTorrent [2009/11/30 14:29:56 | 00,000,000 | ---D | C] -- C:\Program Files\BitTorrent [2009/11/30 14:25:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\My Documents\PcSetup [2009/11/28 13:37:37 | 00,000,000 | ---D | C] -- C:\Program Files\DVDFab 6 [2009/11/28 13:11:41 | 00,000,000 | ---D | C] -- C:\Program Files\DVD Shrink [2009/11/26 19:56:56 | 00,000,000 | ---D | C] -- C:\Program Files\Xvid [2009/11/26 19:55:54 | 00,000,000 | ---D | C] -- C:\Program Files\ffdshow [2009/11/26 19:54:34 | 00,000,000 | ---D | C] -- C:\Program Files\AviSynth 2.5 [2009/11/26 19:53:01 | 00,000,000 | ---D | C] -- C:\Program Files\Avi2Dvd [2009/11/23 14:26:35 | 00,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2009/11/23 14:26:35 | 00,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2009/11/23 14:26:35 | 00,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2009/11/19 12:50:58 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SlySoft [2009/11/19 12:50:13 | 00,000,000 | ---D | C] -- C:\Program Files\SlySoft [2009/11/19 01:01:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\AVG9 [2009/11/15 23:56:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\Autodesk [2009/11/15 20:05:01 | 00,274,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll [2009/11/15 12:19:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\My Documents\Movies to burn [2009/11/14 22:27:37 | 00,000,000 | ---D | C] -- C:\Program Files\Eidos [2009/11/14 22:23:21 | 00,000,000 | ---D | C] -- C:\Config.Msi [2009/11/14 16:47:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\My Documents\Playlists [2009/11/14 15:13:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Anna\Application Data\Any DVD Converter Professional [2009/11/12 15:25:15 | 00,016,736 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll.mui [2009/11/11 19:52:59 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2009/06/01 12:55:54 | 00,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Anna\Application Data\pcouffin.sys [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\Documents and Settings\Anna\My Documents\*.tmp files -> C:\Documents and Settings\Anna\My Documents\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2009/12/10 21:47:41 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\Anna\Desktop\iTunes.lnk [2009/12/10 19:35:41 | 00,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{63756D05-40CA-4EEA-9053-5048F843C105}.job [2009/12/10 18:29:29 | 00,508,956 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009/12/10 18:29:29 | 00,432,924 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009/12/10 18:29:29 | 00,067,714 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2009/12/10 18:25:41 | 00,000,310 | ---- | M] () -- C:\WINDOWS\tasks\GlaryInitialize.job [2009/12/10 18:24:36 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009/12/10 18:24:30 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009/12/10 18:21:18 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\Anna\ntuser.ini [2009/12/10 17:38:17 | 00,385,024 | ---- | M] () -- C:\Documents and Settings\Anna\Desktop\Codes.doc [2009/12/10 14:30:06 | 00,012,288 | ---- | M] () -- C:\Documents and Settings\Anna\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009/12/10 13:51:52 | 00,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2009/12/10 13:23:41 | 46,449,860 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm [2009/12/10 13:20:31 | 00,122,916 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg [2009/12/10 13:16:53 | 00,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009/12/09 20:05:12 | 00,052,736 | ---- | M] () -- C:\Documents and Settings\Anna\Desktop\Chart.doc [2009/12/09 16:18:36 | 00,000,624 | ---- | M] () -- C:\Documents and Settings\Anna\Desktop\PeerGuardian.lnk [2009/12/09 02:47:16 | 06,373,376 | ---- | M] () -- C:\Documents and Settings\Anna\ntuser.dat [2009/12/08 22:49:40 | 00,000,162 | -H-- | M] () -- C:\Documents and Settings\Anna\Desktop\~$Chart.doc [2009/12/05 14:21:28 | 00,000,666 | ---- | M] () -- C:\Documents and Settings\Anna\Desktop\Avi2Dvd.lnk [2009/12/04 23:27:23 | 00,000,046 | ---- | M] () -- C:\WINDOWS\System32\DonationCoder_urlsnooper_InstallInfo.dat [2009/12/04 23:26:00 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\-1 [2009/12/04 13:56:44 | 00,546,935 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\iavifw.avm [2009/12/03 13:27:11 | 00,000,332 | ---- | M] () -- C:\WINDOWS\system.ini [2009/12/03 13:26:37 | 00,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2009/12/03 12:44:30 | 00,000,020 | ---- | M] () -- C:\Documents and Settings\Anna\defogger_reenable [2009/12/01 13:41:27 | 00,535,552 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Anna\Desktop\OTL.exe [2009/11/30 14:25:27 | 00,007,887 | ---- | M] () -- C:\Documents and Settings\Anna\Application Data\pcouffin.cat [2009/11/30 14:25:26 | 00,047,360 | ---- | M] (VSO Software) -- C:\WINDOWS\System32\drivers\pcouffin.sys [2009/11/30 14:25:26 | 00,047,360 | ---- | M] (VSO Software) -- C:\Documents and Settings\Anna\Application Data\pcouffin.sys [2009/11/30 14:25:26 | 00,001,144 | ---- | M] () -- C:\Documents and Settings\Anna\Application Data\pcouffin.inf [2009/11/20 14:01:06 | 00,288,876 | ---- | M] () -- C:\Documents and Settings\Anna\My Documents\bookmarks-2009-11-20.json [2009/11/18 12:45:48 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2009/11/15 19:56:15 | 00,219,248 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009/11/14 01:47:57 | 00,260,608 | ---- | M] () -- C:\WINDOWS\PEV.exe [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\Documents and Settings\Anna\My Documents\*.tmp files -> C:\Documents and Settings\Anna\My Documents\*.tmp -> ] ========== Files Created - No Company Name ========== [2099/01/01 12:00:00 | 00,011,168 | -H-- | C] () -- C:\WINDOWS\System32\tanokiso [2009/12/10 17:37:06 | 00,385,024 | ---- | C] () -- C:\Documents and Settings\Anna\Desktop\Codes.doc [2009/12/09 16:18:36 | 00,000,624 | ---- | C] () -- C:\Documents and Settings\Anna\Desktop\PeerGuardian.lnk [2009/12/08 22:49:40 | 00,000,162 | -H-- | C] () -- C:\Documents and Settings\Anna\Desktop\~$Chart.doc [2009/12/08 22:49:39 | 00,052,736 | ---- | C] () -- C:\Documents and Settings\Anna\Desktop\Chart.doc [2009/12/05 14:53:54 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\xvid.ax [2009/12/05 14:21:28 | 00,000,666 | ---- | C] () -- C:\Documents and Settings\Anna\Desktop\Avi2Dvd.lnk [2009/12/04 23:27:22 | 00,000,046 | ---- | C] () -- C:\WINDOWS\System32\DonationCoder_urlsnooper_InstallInfo.dat [2009/12/04 23:26:00 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\-1 [2009/12/03 13:01:30 | 00,260,608 | ---- | C] () -- C:\WINDOWS\PEV.exe [2009/12/03 13:01:30 | 00,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe [2009/12/03 12:43:34 | 00,000,020 | ---- | C] () -- C:\Documents and Settings\Anna\defogger_reenable [2009/11/20 14:01:05 | 00,288,876 | ---- | C] () -- C:\Documents and Settings\Anna\My Documents\bookmarks-2009-11-20.json [2009/11/11 01:02:55 | 06,373,376 | ---- | C] () -- C:\Documents and Settings\Anna\ntuser.dat [2009/09/29 21:19:11 | 00,012,288 | ---- | C] () -- C:\Documents and Settings\Anna\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009/09/03 10:12:40 | 00,013,304 | ---- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys [2009/09/03 10:12:39 | 00,011,860 | ---- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys [2009/07/21 20:35:11 | 00,081,920 | R--- | C] () -- C:\WINDOWS\System32\srctrl.dll [2009/06/01 12:56:19 | 00,000,034 | ---- | C] () -- C:\Documents and Settings\Anna\Application Data\pcouffin.log [2009/06/01 12:55:54 | 00,007,887 | ---- | C] () -- C:\Documents and Settings\Anna\Application Data\pcouffin.cat [2009/06/01 12:55:54 | 00,001,144 | ---- | C] () -- C:\Documents and Settings\Anna\Application Data\pcouffin.inf [2009/05/22 14:13:06 | 00,087,552 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll [2009/05/13 20:08:10 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009/05/13 20:08:04 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009/05/13 20:08:03 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009/05/13 20:07:58 | 00,084,480 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009/05/13 20:07:58 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009/02/16 10:48:59 | 00,002,390 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\LuUninstall.LiveUpdate [2009/01/21 23:07:02 | 00,000,000 | ---- | C] () -- C:\WINDOWS\LM.INI [2008/06/03 12:27:39 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\swunilog.ini [2008/04/29 13:42:24 | 00,503,808 | ---- | C] () -- C:\WINDOWS\System32\ICCProfiles.dll [2008/02/26 09:24:03 | 00,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI [2008/02/09 22:44:56 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2008/02/09 15:42:38 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2003/06/24 14:43:48 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll [2000/09/18 15:50:28 | 00,202,752 | ---- | C] () -- C:\WINDOWS\System32\zlib.dll < End of report > |
|
|
|
|
Dec 11 2009, 01:41 PM
Post
#30
|
|
|
Mr.Mechanic Group: Malware Response Team Posts: 20,994 Joined: 3-May 08 From: Saarland,Germany Member No.: 206,858 |
Can you please post a logfile from Superantispyware?
-------------------- regards,
schrauber If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you! Unavailable as from friday 20th august If I have helped you then please consider donating to continue the fight against malware |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 6th September 2010 - 04:29 AM |
© 2003-2010 All Rights Reserved Bleeping Computer LLC.