Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Hijackthis Log - Pop-ups Driving Me Mad!


  • Please log in to reply
12 replies to this topic

#1 ZenDavis

ZenDavis

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:10:35 PM

Posted 11 April 2008 - 12:40 PM

So for some reason I've been getting pop-ups since yesterday on IE although I primarily use Firefox. I've run AVG Anti-Virus, AVG Anti-Spyware, Spybot, and Adaware and they don't seem to go away. Any help? Thanks!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:39:18 PM, on 4/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\svchost.exe
G:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
G:\PROGRA~1\Grisoft\AVG7\avgcc.exe
G:\WINDOWS\system32\ctfmon.exe
G:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
G:\Program Files\Winamp\winamp.exe
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
G:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
G:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
G:\PROGRA~1\Grisoft\AVG7\avgemc.exe
G:\WINDOWS\system32\nvsvc32.exe
G:\PROGRA~1\Grisoft\AVG7\avgw.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\wscntfy.exe
G:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Aware2007.exe
G:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
G:\Program Files\Mozilla Firefox\firefox.exe
G:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {12649DC4-0104-2E8D-0A15-5C00BFB1DBC1} - G:\WINDOWS\system32\nkpvgcys.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {7FD8463B-44F3-4310-A435-1BDAB56FA09B} - G:\WINDOWS\system32\iifgGyWm.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - G:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE G:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] G:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] G:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] G:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\j2re1.4.1_05\bin\npjpi141_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\j2re1.4.1_05\bin\npjpi141_05.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - G:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - G:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O20 - Winlogon Notify: urqPjJDV - urqPjJDV.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - G:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NMIndexingService - Nero AG - G:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5723 bytes

BC AdBot (Login to Remove)

 


m

#2 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:03:35 AM

Posted 11 April 2008 - 01:10 PM

Hello there and welcome to Bleeping Computer's security forum.
My name is David, I will be helping you with your log today.

It is a good idea to print off these instructions. There is a possibility some of the instructions will need to be carried out where internet access is not available. It is important that you complete the instructions in the right order, and that you don't miss out any steps.

I see you are running Teatimer.
I suggest you to disable it because it can interfere with the changes you'll make on your system.
When everything is done and your log is clean again, you can enable it again.
If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.
How to disable TeaTimer during HijackThis Cleanup
Then, Download ResetTeaTimer.bat.
Double click ResetTeaTimer.bat to remove all entries set by TeaTimer.

Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following if still present:

O2 - BHO: (no name) - {12649DC4-0104-2E8D-0A15-5C00BFB1DBC1} - G:\WINDOWS\system32\nkpvgcys.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {7FD8463B-44F3-4310-A435-1BDAB56FA09B} - G:\WINDOWS\system32\iifgGyWm.dll (file missing)
O20 - Winlogon Notify: urqPjJDV - urqPjJDV.dll (file missing)

Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!

I want you to clean your cache and cookies from your internet explorer.
There are a few infected files which need to be removed from your system.

° Close all instances of Internet Explorer .
° Go to your control panel and open "Internet Options".
° Click on the "General" tab.
° Click the "Delete Cookies" button, then the "Delete Files" button.
° If prompted, place a tick in the "Delete all offline content" box and click OK.

Also, please clean other Temporary files and Empty the Recycle Bin

° Go to start and click on the "run" button.
° Type the following in the box --> cleanmgr and click ok.
° Let it scan your system for files to remove.
° Make sure only Temporary Files, Temporary Internet Files, and Recycle Bin are checked.
° Press OK to remove them.

Please download Combofix to your desktop.
Doubleclick combofix.exe to launch the application.

Follow the prompts that will be displayed on the screen.
Don't click on the window while the fix is running, because that will cause your system to hang.
When finished, it should produce a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.

#3 ZenDavis

ZenDavis
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:10:35 PM

Posted 11 April 2008 - 07:18 PM

Thank you for the help David.

Here is what I have for Combo Fix -

ComboFix 08-04-11.1 - Owner 2008-04-11 20:07:47.2 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1620 [GMT -4:00]
Running from: G:\Documents and Settings\Owner\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-03-12 to 2008-04-12 )))))))))))))))))))))))))))))))
.

2008-04-11 02:27 . 2008-04-11 02:27 <DIR> d-------- G:\Documents and Settings\Owner\Application Data\Grisoft
2008-04-11 01:45 . 2008-04-11 01:45 <DIR> d-------- G:\Program Files\Spybot - Search & Destroy
2008-04-11 01:45 . 2008-04-11 13:43 <DIR> d-------- G:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-11 01:39 . 2008-04-11 01:45 <DIR> d-------- G:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-11 01:39 . 2007-05-30 08:10 10,872 --a------ G:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-10 19:13 . 2008-04-10 19:13 <DIR> d-------- G:\Program Files\Lavasoft
2008-04-10 19:13 . 2008-04-10 19:14 <DIR> d-------- G:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-10 19:12 . 2008-04-10 19:12 <DIR> d-------- G:\Program Files\Common Files\Wise Installation Wizard
2008-04-10 17:50 . 2008-04-11 19:57 <DIR> d-------- G:\Documents and Settings\Owner\Application Data\AVG7
2008-04-10 17:43 . 2008-04-10 17:43 <DIR> d-------- G:\Documents and Settings\LocalService\Application Data\AVG7
2008-04-10 17:43 . 2008-04-11 01:44 <DIR> d-------- G:\Documents and Settings\All Users\Application Data\avg7
2008-04-10 17:22 . 2008-04-11 00:08 <DIR> d--hs---- G:\WINDOWS\T3duZXI
2008-04-10 17:22 . 2008-04-10 18:21 <DIR> d-------- G:\WINDOWS\system32\pinz1
2008-04-10 17:22 . 2008-04-10 17:22 <DIR> d-------- G:\WINDOWS\system32\IDE2
2008-04-10 17:22 . 2008-04-10 18:21 <DIR> d-------- G:\WINDOWS\system32\ExTmp
2008-04-10 17:22 . 2008-04-10 18:21 <DIR> d-------- G:\WINDOWS\system32\bharebio01
2008-04-10 17:22 . 2008-04-11 00:08 <DIR> d-------- G:\Program Files\AntiSpywareMaster
2008-04-09 13:20 . 2008-04-10 00:11 <DIR> d-------- G:\Program Files\mIRC
2008-04-09 13:20 . 2008-04-10 03:22 <DIR> d-------- G:\Documents and Settings\Owner\Application Data\mIRC
2008-04-09 04:24 . 2008-02-20 01:19 147,968 --a------ G:\WINDOWS\system32\dllcache\dnsapi.dll
2008-04-09 04:24 . 2008-02-20 14:49 45,568 --a------ G:\WINDOWS\system32\dllcache\dnsrslvr.dll
2008-04-08 16:36 . 2008-04-08 16:52 134 --a------ G:\WINDOWS\kaillera.ini
2008-04-07 00:39 . 1999-12-17 10:13 86,016 --a------ G:\WINDOWS\unvise32.exe
2008-04-07 00:38 . 2008-04-07 00:38 <DIR> d-------- G:\Program Files\Counter-Strike
2008-04-07 00:25 . 2008-04-07 00:25 <DIR> d-------- G:\Program Files\Mplayer
2008-04-07 00:24 . 2008-04-07 22:54 <DIR> d-------- G:\Program Files\Quake III Arena
2008-04-07 00:24 . 2008-04-07 00:25 871 --a------ G:\WINDOWS\QIII.INI
2008-04-06 12:35 . 2008-04-11 13:48 54,156 --ah----- G:\WINDOWS\QTFont.qfn
2008-04-06 12:35 . 2008-04-06 12:35 1,409 --a------ G:\WINDOWS\QTFont.for
2008-04-06 00:38 . 2008-04-06 00:38 <DIR> d-------- G:\Program Files\CDisplay
2008-04-02 10:42 . 2008-04-03 11:50 38 --a------ G:\WINDOWS\avisplitter.INI
2008-03-28 19:30 . 2008-03-28 19:49 <DIR> d-------- G:\Documents and Settings\Owner\Application Data\FileZilla
2008-03-28 19:28 . 2008-03-28 19:28 <DIR> d-------- G:\Program Files\FileZilla FTP Client
2008-03-27 21:38 . 2008-04-05 22:09 <DIR> d-------- G:\Program Files\Windows Live Safety Center
2008-03-27 21:01 . 2008-03-27 21:01 <DIR> d-------- G:\Program Files\Windows Live Toolbar
2008-03-27 21:01 . 2008-03-27 21:01 <DIR> d-------- G:\Program Files\Windows Live Favorites
2008-03-27 21:01 . 2008-04-07 22:51 <DIR> d-------- G:\Documents and Settings\Owner\Contacts
2008-03-27 20:59 . 2008-03-27 21:01 <DIR> d-------- G:\Program Files\Windows Live
2008-03-27 20:59 . 2008-03-27 21:00 <DIR> d--hsc--- G:\Program Files\Common Files\WindowsLiveInstaller
2008-03-27 20:59 . 2008-03-27 20:59 <DIR> d-------- G:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-26 13:19 . 2008-03-26 13:19 <DIR> d-------- G:\Documents and Settings\Owner\Application Data\acccore
2008-03-26 13:15 . 2008-03-26 13:19 <DIR> d-------- G:\Program Files\AIM6
2008-03-23 12:58 . 2008-03-23 12:58 <DIR> d-------- G:\Program Files\QuickTime

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-11 04:08 --------- d-----w G:\Program Files\GameSpy Arcade
2008-04-11 01:58 --------- d-----w G:\Documents and Settings\Owner\Application Data\uTorrent
2008-04-09 17:40 --------- d-----w G:\Program Files\DivX
2008-03-28 01:54 --------- d-----w G:\Program Files\K-Lite Codec Pack
2008-03-26 17:16 --------- d-----w G:\Documents and Settings\All Users\Application Data\Viewpoint
2008-03-26 17:15 --------- d-----w G:\Program Files\Common Files\AOL
2008-03-25 17:36 --------- d-----w G:\Program Files\Safari
2008-03-25 17:18 --------- d-----w G:\Program Files\uTorrent
2008-03-23 17:00 --------- d-----w G:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-23 04:26 --------- d-----w G:\Documents and Settings\Owner\Application Data\Winamp
2008-03-22 22:30 2,085,376 ----a-w G:\WINDOWS\system32\x264vfw.dll
2008-03-21 20:30 200,704 ----a-w G:\WINDOWS\system32\ssldivx.dll
2008-03-21 20:30 1,044,480 ----a-w G:\WINDOWS\system32\libdivx.dll
2008-03-19 09:40 1,845,888 ----a-w G:\WINDOWS\system32\win32k.sys
2008-03-19 09:40 1,845,888 ----a-w G:\WINDOWS\system32\dllcache\win32k.sys
2008-03-04 16:33 7,680 ----a-w G:\WINDOWS\system32\ff_vfw.dll
2008-03-01 22:36 3,591,680 ----a-w G:\WINDOWS\system32\dllcache\mshtml.dll
2008-02-29 08:55 70,656 ----a-w G:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-02-29 08:55 625,664 ----a-w G:\WINDOWS\system32\dllcache\iexplore.exe
2008-02-23 05:24 --------- d-----w G:\Program Files\ImgBurn
2008-02-22 10:00 13,824 ----a-w G:\WINDOWS\system32\dllcache\ieudinit.exe
2008-02-20 18:49 45,568 ----a-w G:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 16:07 --------- d-----w G:\Documents and Settings\Owner\Application Data\Apple Computer
2008-02-20 16:05 --------- d-----w G:\Program Files\Bonjour
2008-02-20 06:52 282,624 ----a-w G:\WINDOWS\system32\gdi32.dll
2008-02-20 06:52 282,624 ----a-w G:\WINDOWS\system32\dllcache\gdi32.dll
2008-02-17 01:50 --------- d-----w G:\Program Files\FLV to AVI MPEG WMV 3GP MP4 iPod Converter
2008-02-17 01:46 --------- d-----w G:\Documents and Settings\Owner\Application Data\Vso
2008-02-15 05:44 161,792 ----a-w G:\WINDOWS\system32\dllcache\ieakui.dll
2008-02-13 19:37 --------- d-----w G:\Documents and Settings\Owner\Application Data\Creative
2008-01-15 16:15 47,360 ----a-w G:\Documents and Settings\Owner\Application Data\pcouffin.sys
.

((((((((((((((((((((((((((((( snapshot@2008-04-11_14.36.22.81 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-11 23:21:06 16,384 ----atw G:\WINDOWS\TEMP\Perflib_Perfdata_24c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{12649DC4-0104-2E8D-0A15-5C00BFB1DBC1}]
G:\WINDOWS\system32\nkpvgcys.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SpybotDeletingB3480"="command /c del G:\WINDOWS\system32\drivers\core.cache.dsk" [ ]
"SpybotDeletingD2406"="cmd /c del G:\WINDOWS\system32\drivers\core.cache.dsk" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25 6731312]
"MSConfig"="G:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.exe" [2007-02-20 02:43 169984]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="G:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-11 01:45 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2008-03-01 09:06 124928 G:\WINDOWS\system32\advpack.dll]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKLM\~\startupfolder\G:^Documents and Settings^Owner^Start Menu^Programs^Startup^DW_Start.lnk]
path=G:\Documents and Settings\Owner\Start Menu\Programs\Startup\DW_Start.lnk
backup=G:\WINDOWS\pss\DW_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
--a------ 2007-06-11 05:25 6731312 G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage]
G:\Program Files\AdVantage\AdVantage.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
--a------ 2001-12-18 18:45 53248 G:\Program Files\AIM95\aim.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
--a------ 2008-03-06 16:50 50528 G:\Program Files\AIM6\aim6.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2005-05-03 20:43 69632 G:\WINDOWS\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
--a------ 2008-04-11 01:45 579072 G:\PROGRA~1\Grisoft\AVG7\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
G:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-12 02:00 15360 G:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2007-12-15 06:02 482760 G:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Fljcpj]
G:\Documents and Settings\Owner\My Documents\A?pPatch\r?gedit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2005-09-24 01:08 49152 G:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 G:\Program Files\Windows Live\Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
G:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 16:57 153136 G:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-12-05 02:41 8523776 G:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-12-05 02:41 81920 G:\WINDOWS\system32\NvMcTray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-12-05 02:41 1626112 G:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Prdr]
G:\WINDOWS\MANTEC~1\dvdplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 2007-01-20 03:09 200704 G:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-31 23:13 385024 G:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 2007-10-16 20:30 16855552 G:\WINDOWS\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1]
G:\WINDOWS\mrofinu572.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-01-28 11:43 2097488 G:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ToolBoxFX]
--a------ 2005-11-21 16:55 45056 G:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
G:\WINDOWS\system32\dumprep 0 -u

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VistaDrive]
--a------ 2006-10-05 22:56 280779 G:\WINDOWS\VistaDrive\VistaDrive.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
G:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{AD-D3-34-4A-DW}]
G:\WINDOWS\system32\pinz1\cegmgr76.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NBService"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"Viewpoint Manager Service"=2 (0x2)
"usnjsvc"=3 (0x3)
"Bonjour Service"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"G:\\Program Files\\uTorrent\\uTorrent.exe"=
"G:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"G:\\Program Files\\AIM6\\aim6.exe"=
"G:\\Program Files\\AIM95\\aim.exe"=
"G:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"G:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"G:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"G:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"G:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"G:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"G:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

R3 HPFXBULK;HPFXBULK;G:\WINDOWS\system32\drivers\hpfxbulk.sys [2005-09-20 06:22]
S4 Viewpoint Manager Service;Viewpoint Manager Service;"G:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-03-21 11:04:02 G:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- G:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-11 20:09:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-11 20:09:34
ComboFix-quarantined-files.txt 2008-04-12 00:09:24
ComboFix2.txt 2008-04-11 18:36:37
Pre-Run: 19,977,416,704 bytes free
Post-Run: 19,967,254,528 bytes free
.
2008-04-10 07:01:32 --- E O F ---

________________

And here is what I have for HijackThis -

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:10:25 PM, on 4/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Safe mode

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\ctfmon.exe
G:\WINDOWS\explorer.exe
G:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {12649DC4-0104-2E8D-0A15-5C00BFB1DBC1} - G:\WINDOWS\system32\nkpvgcys.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - G:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [MSConfig] G:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\RunOnce: [SpybotDeletingB3480] command /c del "G:\WINDOWS\system32\drivers\core.cache.dsk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2406] cmd /c del "G:\WINDOWS\system32\drivers\core.cache.dsk"
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\j2re1.4.1_05\bin\npjpi141_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\j2re1.4.1_05\bin\npjpi141_05.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - G:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - G:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - G:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NMIndexingService - Nero AG - G:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4333 bytes


Thank you for your help. Let me know if it looks clean now.

#4 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:03:35 AM

Posted 12 April 2008 - 06:16 AM

Good work!
Again, it is a good idea to print off these instructions.

Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following if still present:

O2 - BHO: (no name) - {12649DC4-0104-2E8D-0A15-5C00BFB1DBC1} - G:\WINDOWS\system32\nkpvgcys.dll (file missing)
O4 - HKCU\..\RunOnce: [SpybotDeletingB3480] command /c del "G:\WINDOWS\system32\drivers\core.cache.dsk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2406] cmd /c del "G:\WINDOWS\system32\drivers\core.cache.dsk"

Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!

Please open notepad and and copy and paste next bold in it:
(don't forget to copy and paste REGEDIT4)

REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{AD-D3-34-4A-DW}]

Save this as "fix.reg" Choose to save as *all files and place it on your desktop.
It should look like this: Posted Image
Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok.

Now reboot into Safe Mode.
This can be done tapping the F8 key as soon as you start your computer
You will be brought to a menu where you can choose to boot into safe mode.
Make sure you choose the option without networking support.

Using Windows Explorer, please locate the following files/folders, and delete them if still present:

G:\WINDOWS\T3duZXI <--folder
G:\WINDOWS\system32\pinz1 <--folder
G:\WINDOWS\system32\IDE2 <--folder
G:\WINDOWS\system32\ExTmp <--folder
G:\WINDOWS\system32\bharebio01 <--folder
G:\Program Files\AntiSpywareMaster <--folder
G:\WINDOWS\unvise32.exe
G:\WINDOWS\system32\drivers\core.cache.dsk

Reboot back into normal mode.

Please perform this online scan: Kaspersky Webscan
Note that this scanner will only work on Internet Explorer, so please use this browser for the scan.
Read the Requirements and Privacy statement, then select "Accept"
A dialogue box will appearing asking "Do you want to install this software?" Name: kavwebscan_unicode.cab
Select "Install" to download the ActiveX controls that allows ActiveScan to run.

When the download is complete it will say ready, click "Next"
Select a target to scan: Click on "My Computer"
When the scan is complete choose to save the results as "Save as Text"
Post the Kaspersky scan results in your next reply, along with a new Hijackthis log.

Edited by D-Trojanator, 12 April 2008 - 06:16 AM.


#5 ZenDavis

ZenDavis
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:10:35 PM

Posted 25 April 2008 - 09:58 AM

I had a previous topic but I've been out of time and my family has been using the computer and things have gotten worse. I've ran AVG and managed to located some viruses. Ran HijackThis and ComboFix and here are the logs.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:56:14 AM, on 4/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\svchost.exe
G:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
G:\WINDOWS\system32\spoolsv.exe
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
G:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
G:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
G:\PROGRA~1\Grisoft\AVG7\avgemc.exe
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
G:\WINDOWS\system32\nvsvc32.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\ctfmon.exe
G:\WINDOWS\system32\wscntfy.exe
G:\WINDOWS\explorer.exe
G:\WINDOWS\system32\notepad.exe
G:\Program Files\Safari\Safari.exe
G:\Program Files\Winamp\winamp.exe
G:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - G:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AntiSpywareMaster] G:\Program Files\AntiSpywareMaster\asm.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE G:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] G:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\j2re1.4.1_05\bin\npjpi141_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\j2re1.4.1_05\bin\npjpi141_05.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - G:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - G:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O20 - Winlogon Notify: wvUkhFWO - wvUkhFWO.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - G:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NMIndexingService - Nero AG - G:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4891 bytes

ComboFix 08-04-22.5 - Owner 2008-04-25 10:39:27.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1529 [GMT -4:00]
Running from: G:\Documents and Settings\Owner\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

G:\Program Files\AntiSpywareMaster
G:\WINDOWS\pskt.ini
G:\WINDOWS\system32\opnOfDUo.dll
G:\WINDOWS\system32\oUDfOnpo.ini
G:\WINDOWS\system32\oUDfOnpo.ini2
G:\WINDOWS\system32\pac.txt
G:\WINDOWS\system32\wvUkhFWO.dll
G:\WINDOWS\system32\xlhpmjmg.dll
G:\WINDOWS\system32\xxyyaASJ.dll

.
((((((((((((((((((((((((( Files Created from 2008-03-25 to 2008-04-25 )))))))))))))))))))))))))))))))
.

2008-04-24 23:50 . 2008-04-24 23:50 <DIR> d-------- G:\Program Files\Trend Micro
2008-04-24 20:50 . 2008-04-24 20:50 <DIR> d-------- G:\WINDOWS\system32\LogFiles
2008-04-24 20:19 . 2008-04-25 10:35 109,794 --a------ G:\WINDOWS\BM9f52abb0.xml
2008-04-24 20:13 . 2008-04-24 22:29 <DIR> d-------- G:\WINDOWS\system32\pnVes01
2008-04-24 01:02 . 1997-09-03 17:30 279,040 --a------ G:\WINDOWS\system32\VCT32150.dll
2008-04-24 01:01 . 2008-04-24 01:01 <DIR> d-------- G:\Program Files\Red Storm Entertainment
2008-04-22 12:32 . 2008-04-22 18:08 <DIR> d-------- G:\Program Files\Team Fortress 2
2008-04-20 21:20 . 2008-04-20 21:20 <DIR> d-------- G:\Program Files\Sierra
2008-04-20 21:04 . 2008-04-20 21:04 <DIR> d-------- G:\Documents and Settings\Owner\Application Data\Codemasters
2008-04-20 21:04 . 2008-04-20 21:04 107,888 --a------ G:\WINDOWS\system32\CmdLineExt.dll
2008-04-20 21:03 . 2007-05-16 16:45 3,497,832 --a------ G:\WINDOWS\system32\d3dx9_34.dll
2008-04-20 21:03 . 2007-03-12 16:42 3,495,784 --a------ G:\WINDOWS\system32\d3dx9_33.dll
2008-04-20 21:03 . 2007-05-16 16:45 1,124,720 --a------ G:\WINDOWS\system32\D3DCompiler_34.dll
2008-04-20 21:03 . 2007-03-12 16:42 1,123,696 --a------ G:\WINDOWS\system32\D3DCompiler_33.dll
2008-04-20 21:03 . 2007-05-16 16:45 443,752 --a------ G:\WINDOWS\system32\d3dx10_34.dll
2008-04-20 21:03 . 2007-03-15 16:57 443,752 --a------ G:\WINDOWS\system32\d3dx10_33.dll
2008-04-20 21:03 . 2007-05-31 19:30 266,088 --a------ G:\WINDOWS\system32\xactengine2_8.dll
2008-04-20 21:03 . 2007-04-04 18:55 261,480 --a------ G:\WINDOWS\system32\xactengine2_7.dll
2008-04-20 21:03 . 2007-05-31 19:29 18,280 --a------ G:\WINDOWS\system32\x3daudio1_2.dll
2008-04-20 21:02 . 2008-04-20 21:02 <DIR> d-------- G:\WINDOWS\system32\AGEIA
2008-04-20 21:02 . 2008-04-20 21:02 <DIR> d-------- G:\Program Files\AGEIA Technologies
2008-04-19 19:31 . 2008-04-19 19:31 <DIR> d-------- G:\Documents and Settings\Owner\Application Data\SystemRequirementsLab
2008-04-18 23:49 . 2008-04-25 10:42 <DIR> d-------- G:\Program Files\PeerGuardian2
2008-04-18 21:44 . 2008-04-18 21:46 <DIR> d-------- G:\Program Files\sXe Injected
2008-04-18 20:06 . 2008-04-24 17:01 <DIR> d-------- G:\Program Files\Steam
2008-04-17 20:29 . 2008-04-17 20:29 <DIR> d-------- G:\Program Files\Valve
2008-04-13 16:51 . 2008-04-14 01:23 <DIR> d-------- G:\Program Files\Day of Defeat
2008-04-13 16:49 . 2001-07-13 13:56 14,976 --a------ G:\WINDOWS\system32\drivers\SBKUPNT.SYS
2008-04-13 16:49 . 1997-02-08 17:11 13,312 --a------ G:\WINDOWS\system32\DEVLOAD.EXE
2008-04-13 16:49 . 2005-11-26 19:45 2,799 --a------ G:\WINDOWS\SKLANG.INI
2008-04-11 21:03 . 2008-04-11 21:03 <DIR> d-------- G:\Temp
2008-04-11 21:03 . 2008-04-11 21:03 <DIR> d-------- G:\Saves
2008-04-11 21:03 . 2008-04-11 21:03 <DIR> d-------- G:\Program Files\Datel
2008-04-11 21:02 . 2008-04-11 21:02 <DIR> d-------- G:\WINDOWS\system32\xircom
2008-04-11 21:02 . 2008-04-11 21:02 <DIR> d-------- G:\WINDOWS\system32\npp
2008-04-11 21:02 . 2008-04-11 21:02 <DIR> d-------- G:\WINDOWS\srchasst
2008-04-11 21:02 . 2008-04-11 21:02 <DIR> d-------- G:\Program Files\microsoft frontpage
2008-04-11 21:02 . 2008-04-11 21:02 <DIR> d-------- G:\Documents and Settings\Owner\WINDOWS
2008-04-11 02:27 . 2008-04-11 02:27 <DIR> d-------- G:\Documents and Settings\Owner\Application Data\Grisoft
2008-04-11 01:45 . 2008-04-11 01:45 <DIR> d-------- G:\Program Files\Spybot - Search & Destroy
2008-04-11 01:45 . 2008-04-11 13:43 <DIR> d-------- G:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-11 01:39 . 2008-04-11 01:45 <DIR> d-------- G:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-11 01:39 . 2007-05-30 08:10 10,872 --a------ G:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-10 19:13 . 2008-04-10 19:13 <DIR> d-------- G:\Program Files\Lavasoft
2008-04-10 19:13 . 2008-04-10 19:14 <DIR> d-------- G:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-10 19:12 . 2008-04-20 21:02 <DIR> d-------- G:\Program Files\Common Files\Wise Installation Wizard
2008-04-10 17:50 . 2008-04-24 22:39 <DIR> d-------- G:\Documents and Settings\Owner\Application Data\AVG7
2008-04-10 17:50 . 2008-04-24 22:29 <DIR> dr-h----- G:\$VAULT$.AVG
2008-04-10 17:43 . 2008-04-10 17:43 <DIR> d-------- G:\Documents and Settings\LocalService\Application Data\AVG7
2008-04-10 17:43 . 2008-04-11 01:44 <DIR> d-------- G:\Documents and Settings\All Users\Application Data\avg7
2008-04-10 17:22 . 2008-04-11 00:08 <DIR> d--hs---- G:\WINDOWS\T3duZXI
2008-04-10 17:22 . 2008-04-10 18:21 <DIR> d-------- G:\WINDOWS\system32\pinz1
2008-04-10 17:22 . 2008-04-24 22:29 <DIR> d-------- G:\WINDOWS\system32\IDE2
2008-04-10 17:22 . 2008-04-10 18:21 <DIR> d-------- G:\WINDOWS\system32\ExTmp
2008-04-10 17:22 . 2008-04-10 18:21 <DIR> d-------- G:\WINDOWS\system32\bharebio01
2008-04-09 13:20 . 2008-04-10 00:11 <DIR> d-------- G:\Program Files\mIRC
2008-04-09 13:20 . 2008-04-10 03:22 <DIR> d-------- G:\Documents and Settings\Owner\Application Data\mIRC
2008-04-09 04:24 . 2008-02-20 01:19 147,968 --a------ G:\WINDOWS\system32\dllcache\dnsapi.dll
2008-04-09 04:24 . 2008-02-20 14:49 45,568 --a------ G:\WINDOWS\system32\dllcache\dnsrslvr.dll
2008-04-08 16:36 . 2008-04-08 16:52 134 --a------ G:\WINDOWS\kaillera.ini
2008-04-07 00:39 . 1999-12-17 10:13 86,016 --a------ G:\WINDOWS\unvise32.exe
2008-04-07 00:38 . 2008-04-07 00:38 <DIR> d-------- G:\Program Files\Counter-Strike
2008-04-07 00:25 . 2008-04-07 00:25 <DIR> d-------- G:\Program Files\Mplayer
2008-04-07 00:24 . 2008-04-07 22:54 <DIR> d-------- G:\Program Files\Quake III Arena
2008-04-07 00:24 . 2008-04-07 00:25 871 --a------ G:\WINDOWS\QIII.INI
2008-04-06 12:35 . 2008-04-24 22:43 54,156 --ah----- G:\WINDOWS\QTFont.qfn
2008-04-06 12:35 . 2008-04-06 12:35 1,409 --a------ G:\WINDOWS\QTFont.for
2008-04-06 00:38 . 2008-04-06 00:38 <DIR> d-------- G:\Program Files\CDisplay
2008-04-02 10:42 . 2008-04-03 11:50 38 --a------ G:\WINDOWS\avisplitter.INI
2008-03-28 19:30 . 2008-03-28 19:49 <DIR> d-------- G:\Documents and Settings\Owner\Application Data\FileZilla
2008-03-28 19:28 . 2008-03-28 19:28 <DIR> d-------- G:\Program Files\FileZilla FTP Client
2008-03-27 21:38 . 2008-04-24 23:15 <DIR> d-------- G:\Program Files\Windows Live Safety Center
2008-03-27 21:01 . 2008-03-27 21:01 <DIR> d-------- G:\Program Files\Windows Live Toolbar
2008-03-27 21:01 . 2008-03-27 21:01 <DIR> d-------- G:\Program Files\Windows Live Favorites
2008-03-27 21:01 . 2008-04-07 22:51 <DIR> d-------- G:\Documents and Settings\Owner\Contacts
2008-03-27 20:59 . 2008-03-27 21:01 <DIR> d-------- G:\Program Files\Windows Live
2008-03-27 20:59 . 2008-03-27 21:00 <DIR> d--hsc--- G:\Program Files\Common Files\WindowsLiveInstaller
2008-03-27 20:59 . 2008-03-27 20:59 <DIR> d-------- G:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-26 13:19 . 2008-03-26 13:19 <DIR> d-------- G:\Documents and Settings\Owner\Application Data\acccore
2008-03-26 13:15 . 2008-03-26 13:19 <DIR> d-------- G:\Program Files\AIM6

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-25 14:42 --------- d-----w G:\Documents and Settings\Owner\Application Data\uTorrent
2008-04-25 00:23 --------- d-----w G:\Program Files\GameSpy Arcade
2008-04-21 23:53 --------- d--h--w G:\Program Files\InstallShield Installation Information
2008-04-18 18:27 --------- d-----w G:\Program Files\Safari
2008-04-09 17:40 --------- d-----w G:\Program Files\DivX
2008-03-28 01:54 --------- d-----w G:\Program Files\K-Lite Codec Pack
2008-03-26 17:16 --------- d-----w G:\Documents and Settings\All Users\Application Data\Viewpoint
2008-03-26 17:15 --------- d-----w G:\Program Files\Common Files\AOL
2008-03-25 17:18 --------- d-----w G:\Program Files\uTorrent
2008-03-23 17:00 --------- d-----w G:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-23 16:58 --------- d-----w G:\Program Files\QuickTime
2008-03-23 04:26 --------- d-----w G:\Documents and Settings\Owner\Application Data\Winamp
2008-03-22 22:30 2,085,376 ----a-w G:\WINDOWS\system32\x264vfw.dll
2008-03-21 20:30 200,704 ----a-w G:\WINDOWS\system32\ssldivx.dll
2008-03-21 20:30 1,044,480 ----a-w G:\WINDOWS\system32\libdivx.dll
2008-03-19 09:40 1,845,888 ----a-w G:\WINDOWS\system32\win32k.sys
2008-03-19 09:40 1,845,888 ----a-w G:\WINDOWS\system32\dllcache\win32k.sys
2008-03-04 16:33 7,680 ----a-w G:\WINDOWS\system32\ff_vfw.dll
2008-03-01 22:36 3,591,680 ----a-w G:\WINDOWS\system32\dllcache\mshtml.dll
2008-02-29 08:55 70,656 ----a-w G:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-02-29 08:55 625,664 ----a-w G:\WINDOWS\system32\dllcache\iexplore.exe
2008-02-22 10:00 13,824 ----a-w G:\WINDOWS\system32\dllcache\ieudinit.exe
2008-02-20 18:49 45,568 ----a-w G:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 06:52 282,624 ----a-w G:\WINDOWS\system32\gdi32.dll
2008-02-20 06:52 282,624 ----a-w G:\WINDOWS\system32\dllcache\gdi32.dll
2008-02-15 05:44 161,792 ----a-w G:\WINDOWS\system32\dllcache\ieakui.dll
2008-01-15 16:15 47,360 ----a-w G:\Documents and Settings\Owner\Application Data\pcouffin.sys
.

((((((((((((((((((((((((((((( snapshot@2008-04-11_14.36.22.81 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-11 18:23:05 13,936 ----a-w G:\WINDOWS\aim95\ailearaqoe\urlcache\cookie.dat
+ 2008-04-24 20:48:38 13,936 ----a-w G:\WINDOWS\aim95\ailearaqoe\urlcache\cookie.dat
+ 2008-04-13 17:03:38 1,668 ----a-w G:\WINDOWS\aim95\bonesbarkley\urlcache\cookie.dat
+ 2008-04-21 23:58:56 53,248 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2008-04-21 23:58:56 12,800 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
+ 2008-04-21 23:58:56 473,600 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
+ 2008-04-21 01:03:25 2,676,224 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-04-21 01:03:26 2,846,720 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-04-21 01:03:27 563,712 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-04-21 01:03:27 567,296 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-04-21 01:03:28 576,000 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-04-21 23:58:57 577,024 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-04-21 01:03:29 577,536 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-04-21 01:03:29 577,536 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-04-21 01:03:30 578,560 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-04-21 01:03:32 578,560 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-04-21 23:58:57 145,920 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
+ 2008-04-21 23:58:57 159,232 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
+ 2008-04-21 23:58:57 364,544 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
+ 2008-04-21 23:58:58 178,176 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
+ 2008-04-21 23:58:55 223,232 ----a-w G:\WINDOWS\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
- 2007-11-19 00:25:01 68,608 ----a-w G:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2008-04-12 17:13:32 69,120 ----a-w G:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2007-11-19 00:25:04 72,192 ----a-w G:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2008-04-12 17:13:37 72,192 ----a-w G:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2007-11-19 00:25:05 4,308,992 ----a-w G:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2008-04-12 17:13:09 4,444,160 ----a-w G:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
- 2007-11-19 00:25:06 482,304 ----a-w G:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2008-04-12 17:13:38 483,840 ----a-w G:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
- 2007-11-19 00:25:03 2,902,016 ----a-w G:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2008-04-12 17:13:27 3,036,160 ----a-w G:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- 2007-11-19 00:24:59 258,048 ----a-w G:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2008-04-12 17:13:40 258,048 ----a-w G:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2007-11-19 00:24:59 114,176 ----a-w G:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2008-04-12 17:13:40 113,664 ----a-w G:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
- 2007-11-19 00:25:07 260,096 ----a-w G:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2008-04-12 17:13:37 261,120 ----a-w G:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2007-11-19 00:25:01 5,156,864 ----a-w G:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2008-04-12 17:13:23 5,431,296 ----a-w G:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- 2007-11-19 00:25:00 10,752 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2008-04-12 17:13:30 10,752 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2007-11-19 00:24:58 507,904 ----a-w G:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2008-04-12 17:13:24 507,904 ----a-w G:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2007-11-19 00:24:59 13,312 ----a-w G:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2008-04-12 17:13:32 13,312 ----a-w G:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2007-11-19 00:25:04 8,192 ----a-w G:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2008-04-12 17:13:34 8,192 ----a-w G:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
- 2007-11-19 00:25:04 36,864 ----a-w G:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2008-04-12 17:13:35 77,824 ----a-w G:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2007-11-19 00:25:04 5,632 ----a-w G:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2008-04-12 17:13:35 6,656 ----a-w G:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2007-11-19 00:25:00 413,696 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2008-04-12 17:13:41 348,160 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
- 2007-11-19 00:25:00 36,864 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2008-04-12 17:13:41 36,864 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2007-11-19 00:25:00 647,168 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2008-04-12 17:13:42 655,360 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
- 2007-11-19 00:25:00 73,728 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2008-04-12 17:13:42 77,824 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
- 2007-11-19 00:24:59 749,568 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2008-04-12 17:13:36 749,568 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- 2007-11-19 00:25:08 110,592 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2008-04-12 17:13:34 110,592 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
- 2007-11-19 00:25:08 372,736 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
+ 2008-04-12 17:13:34 372,736 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2007-11-19 00:24:58 28,672 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2008-04-12 17:13:38 28,672 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2007-11-19 00:25:08 667,648 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2008-04-12 17:13:33 671,744 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2007-11-19 00:25:08 5,632 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2008-04-12 17:13:19 5,632 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2007-11-19 00:24:58 12,800 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2008-04-12 17:13:40 12,800 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2007-11-19 00:24:58 32,768 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2008-04-12 17:13:33 32,768 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2007-11-19 00:24:58 7,168 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2008-04-12 17:13:33 7,168 ----a-w G:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2007-11-19 00:25:06 110,592 ----a-w G:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2008-04-12 17:13:36 110,592 ----a-w G:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2007-11-19 00:25:01 81,920 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2008-04-12 17:13:36 81,920 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2007-11-19 00:25:07 413,696 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2008-04-12 17:13:26 425,984 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
- 2007-11-19 00:25:06 716,800 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2008-04-12 17:13:27 741,376 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2007-11-19 00:24:59 888,832 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2008-04-12 17:13:28 933,888 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2007-11-19 00:25:03 5,001,216 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2008-04-12 17:13:43 5,070,848 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
- 2007-11-19 00:25:01 188,416 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2008-04-12 17:13:42 188,416 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
- 2007-11-19 00:25:01 397,312 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2008-04-12 17:13:31 401,408 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2007-11-19 00:25:01 81,920 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2008-04-12 17:13:39 81,920 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2007-11-19 00:25:07 577,536 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2008-04-12 17:13:20 630,784 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2007-11-19 00:25:06 372,736 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2008-04-12 17:13:40 372,736 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
- 2007-11-19 00:25:07 258,048 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2008-04-12 17:13:39 258,048 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2007-11-19 00:25:06 299,008 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2008-04-12 17:13:38 299,008 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2007-11-19 00:25:06 131,072 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2008-04-12 17:13:37 131,072 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2007-11-19 00:25:00 258,048 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2008-04-12 17:13:21 258,048 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
- 2007-11-19 00:25:01 114,688 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2008-04-12 17:13:22 114,688 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2007-11-19 00:25:07 835,584 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2008-04-12 17:13:29 884,736 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2007-11-19 00:25:02 86,016 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2008-04-12 17:13:30 90,112 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2007-11-19 00:25:02 823,296 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2008-04-12 17:13:29 839,680 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2007-11-19 00:25:02 5,152,768 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2008-04-12 17:13:31 5,013,504 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2007-11-19 00:25:03 2,027,520 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2008-04-12 17:13:22 2,068,480 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2007-11-19 00:25:07 2,940,928 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2008-04-12 17:13:28 3,076,096 ----a-w G:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2008-04-12 17:58:54 27,136 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\c6772fd12a581ad3be49e3f2a80b5622\Accessibility.ni.dll
+ 2008-04-12 17:59:05 51,712 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\AjaVideoProperties\a998b6420aafbbcef3bee4b5a54489ee\AjaVideoProperties.ni.dll
+ 2008-04-12 17:59:04 884,736 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\a1d353edc300e3aff0784202f68a657b\AspNetMMCExt.ni.dll
+ 2008-04-12 17:59:04 237,568 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\c10ec9b4de2b366236ec83237dc31281\CustomMarshalers.ni.dll
+ 2008-04-12 17:59:06 77,824 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\DecklinkVideoProper#\0ddb04f006d6908a135412b7956bf14c\DecklinkVideoProperties.ni.dll
+ 2008-04-12 17:59:11 15,360 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\dfsvc\837fe02bdcf637d5bf1e5ffb935ebb80\dfsvc.ni.exe
+ 2008-04-12 17:59:12 876,544 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\9710a3c0d11dd264c3a6b88977699e9b\Microsoft.Build.Engine.ni.dll
+ 2008-04-12 17:59:12 81,920 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\e2858a45971fb30b0c0523dbb52c1d4e\Microsoft.Build.Framework.ni.dll
+ 2008-04-12 17:59:16 1,695,744 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\63d69ffdf3c640d2d104a4b74e8115f8\Microsoft.Build.Tasks.ni.dll
+ 2008-04-12 17:59:17 167,936 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\11cb5418c06e30100616fbf205588489\Microsoft.Build.Utilities.ni.dll
+ 2008-04-12 17:59:19 1,740,800 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\923bd55258380eae77353d36a5a1b08f\Microsoft.VisualBasic.ni.dll
+ 2008-04-12 17:14:44 11,722,752 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\32e6f703c114f3a971cbe706586e3655\mscorlib.ni.dll
+ 2008-04-12 17:59:07 692,224 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Sony.Capture\7ac70ee0c977451d084f71b526a88389\Sony.Capture.ni.dll
+ 2008-04-12 17:59:08 274,432 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Sony.MediaSoftware.#\f799d881c0d833a94eabd06953c9c55a\Sony.MediaSoftware.ExternalVideoDevice.ni.dll
+ 2008-04-12 17:59:10 262,144 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Sony.Vegas.NetRender\b4e40d88d17786fc204fdeab2381ac85\Sony.Vegas.NetRender.ni.dll
+ 2008-04-12 17:59:09 630,784 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Sony.Vegas\713207897d70a84f17a74807ac92eb0d\Sony.Vegas.ni.dll
+ 2008-04-12 17:59:20 1,011,712 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\eee9b48577689e92db5a7b5c5de98d9b\System.Configuration.ni.dll
+ 2008-04-12 17:15:01 7,049,216 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\5f669e819da7010c1dca347a25597c42\System.Data.ni.dll
+ 2008-04-12 17:59:21 1,798,144 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Deployment\c7dea4895e1fa33d65e448c03de48d26\System.Deployment.ni.dll
+ 2008-04-12 17:15:14 10,969,088 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Design\c1e16b40e30a05c39be8aee46311841c\System.Design.ni.dll
+ 2008-04-12 17:59:22 1,224,704 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\914668b240550f529e54bb772c6fc881\System.DirectoryServices.ni.dll
+ 2008-04-12 17:59:23 512,000 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\f11bc82c09955cb8438d3885a99c297d\System.DirectoryServices.Protocols.ni.dll
+ 2008-04-12 17:15:17 229,376 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\b974f6c17d17a533adf6e7710c5a62fa\System.Drawing.Design.ni.dll
+ 2008-04-12 17:15:16 1,667,072 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\0e83aac37b2623f1a24c70979f31dd56\System.Drawing.ni.dll
+ 2008-04-12 17:59:25 659,456 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\646131eda5f21f4e6216733d49c22c56\System.EnterpriseServices.ni.dll
+ 2008-04-12 17:59:25 294,912 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\646131eda5f21f4e6216733d49c22c56\System.EnterpriseServices.Wrapper.dll
+ 2008-04-12 17:59:25 733,184 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Security\2b5994269cc5b996231c9b21afea9a91\System.Security.ni.dll
+ 2008-04-12 17:59:26 233,472 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\193ac978af569ad9ee45110b359961b9\System.ServiceProcess.ni.dll
+ 2008-04-12 17:59:27 679,936 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\12e0aa1030badf4524f897e3f57b037a\System.Transactions.ni.dll
+ 2008-04-12 17:59:40 2,342,912 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\37d87b3cab1c66ec4430ebb2abeaa570\System.Web.Mobile.ni.dll
+ 2008-04-12 17:59:40 237,568 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\b5b81faf46fc63c20d5339b36edd02fa\System.Web.RegularExpressions.ni.dll
+ 2008-04-12 17:59:42 1,986,560 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\38991368499e2109ea4099a0fe29c5a3\System.Web.Services.ni.dll
+ 2008-04-12 17:59:37 12,509,184 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\67cfb70213562afe2ca9b9066764af3a\System.Web.ni.dll
+ 2008-04-12 17:15:28 13,193,216 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3d8c79c45aa674e43f075e2e66b8caf5\System.Windows.Forms.ni.dll
+ 2008-04-12 17:15:33 5,771,264 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\c98cb65a79cfccb44ea727ebe4593ede\System.Xml.ni.dll
+ 2008-04-12 17:14:53 8,265,728 ----a-w G:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\ba0e3a22211ba7343e0116b051f2965a\System.ni.dll
+ 2008-04-25 14:44:06 2,048 --s-a-w G:\WINDOWS\bootstat.dat
+ 2006-01-04 10:06:40 1,822 ------w G:\WINDOWS\hppmdl03.dat
+ 2008-04-19 00:06:42 27,648 ----a-r G:\WINDOWS\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C91.exe
+ 2008-04-18 18:27:35 307,200 ----a-r G:\WINDOWS\Installer\{40589552-3892-409E-B92C-9F5032A4B2F0}\SafariIco.exe
- 1998-10-29 21:45:06 306,688 ----a-w G:\WINDOWS\IsUninst.exe
+ 1998-10-29 20:45:06 306,688 ----a-w G:\WINDOWS\IsUninst.exe
+ 2005-03-18 21:23:10 53,248 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2005-03-18 21:23:10 12,800 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.dll
+ 2005-03-18 21:23:14 473,600 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.dll
+ 2004-09-29 16:38:58 2,676,224 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.dll
+ 2005-03-18 21:23:10 145,920 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.dll
+ 2005-03-18 21:23:10 159,232 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.dll
+ 2005-03-18 21:23:14 364,544 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectPlay.dll
+ 2005-03-18 21:23:12 178,176 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.dll
+ 2005-03-18 21:23:14 223,232 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.dll
+ 2004-12-01 19:53:06 2,846,720 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.dll
+ 2005-02-05 23:32:54 563,712 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.dll
+ 2005-03-18 21:23:14 567,296 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.dll
+ 2005-05-26 19:15:56 576,000 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll
+ 2005-07-22 21:21:34 577,024 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll
+ 2005-09-28 18:11:52 577,536 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.dll
+ 2005-12-05 21:20:50 577,536 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\Microsoft.DirectX.Direct3DX.dll
+ 2006-02-03 11:40:48 578,560 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2910.0\Microsoft.DirectX.Direct3DX.dll
+ 2006-03-31 15:27:50 578,560 ----a-w G:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2911.0\Microsoft.DirectX.Direct3DX.dll
- 2005-09-23 12:28:52 72,704 ----a-w G:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe
+ 2007-10-24 05:47:38 82,944 ----a-w G:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe
- 2005-09-23 12:28:52 7,680 ----a-w G:\WINDOWS\Microsoft.NET\Framework\sbscmp10.dll
+ 2007-10-24 05:47:38 16,896 ----a-w G:\WINDOWS\Microsoft.NET\Framework\sbscmp10.dll
- 2005-09-23 12:28:56 7,680 ----a-w G:\WINDOWS\Microsoft.NET\Framework\sbscmp20_mscorwks.dll
+ 2007-10-24 05:47:40 16,896 ----a-w G:\WINDOWS\Microsoft.NET\Framework\sbscmp20_mscorwks.dll
- 2005-09-23 12:28:58 7,680 ----a-w G:\WINDOWS\Microsoft.NET\Framework\sbscmp20_perfcounter.dll
+ 2007-10-24 05:47:42 16,896 ----a-w G:\WINDOWS\Microsoft.NET\Framework\sbscmp20_perfcounter.dll
- 2005-09-23 12:28:56 7,680 ----a-w G:\WINDOWS\Microsoft.NET\Framework\SharedReg12.dll
+ 2007-10-24 05:47:40 16,896 ----a-w G:\WINDOWS\Microsoft.NET\Framework\SharedReg12.dll
- 2005-09-23 12:28:52 86,528 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll
+ 2007-10-24 05:47:38 97,280 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll
- 2005-09-23 12:28:36 18,944 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll
+ 2007-10-24 05:47:26 28,672 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll
- 2005-09-23 12:28:42 136,192 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll
+ 2007-10-24 05:47:30 145,408 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll
- 2005-09-23 12:28:44 4,608 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll
+ 2007-10-24 05:47:32 13,824 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll
- 2005-09-23 12:29:04 183,808 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll
+ 2007-10-24 05:47:48 193,016 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll
- 2005-09-23 12:28:28 208,896 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll
+ 2007-10-24 05:47:20 218,112 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll
- 2005-09-23 12:28:56 10,752 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll
+ 2007-10-24 05:47:40 10,752 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll
- 2005-09-23 12:28:58 138,240 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll
+ 2007-10-24 05:47:42 147,968 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll
- 2005-09-23 12:28:36 87,552 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\alink.dll
+ 2007-10-24 05:47:26 99,320 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\alink.dll
- 2007-04-13 09:21:18 58,712 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
+ 2007-10-24 05:47:42 59,392 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
- 2005-09-23 12:28:32 36,864 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
+ 2007-10-24 05:47:22 36,864 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
- 2007-04-13 09:20:52 10,752 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
+ 2007-10-24 05:47:22 22,024 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
- 2007-04-13 09:20:52 8,192 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
+ 2007-10-24 05:47:22 17,928 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
- 2007-04-13 09:20:52 23,552 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
+ 2007-10-24 05:47:22 33,288 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
- 2007-04-13 09:20:50 75,264 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
+ 2007-10-24 05:47:22 84,480 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
- 2005-09-23 12:28:32 13,824 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
+ 2007-10-24 05:47:22 24,576 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
- 2007-04-13 09:20:52 32,608 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
+ 2007-10-24 05:47:22 32,776 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
- 2005-09-23 12:28:32 106,496 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
+ 2007-10-24 05:47:22 106,496 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
- 2007-04-13 09:20:52 33,632 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
+ 2007-10-24 05:47:22 33,800 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
- 2007-04-13 09:20:52 32,600 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
+ 2007-10-24 05:47:22 33,280 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
- 2007-04-13 09:20:52 507,904 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
+ 2007-10-24 05:47:22 507,904 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
- 2005-09-23 12:28:56 106,496 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
+ 2007-10-24 05:47:40 106,496 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
- 2007-04-13 09:21:16 88,576 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
+ 2007-10-24 05:47:40 101,896 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
- 2005-09-23 12:28:42 76,984 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe
+ 2007-10-24 05:47:30 80,376 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe
- 2005-09-23 12:28:42 1,144,832 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscomp.dll
+ 2007-10-24 05:47:30 1,162,744 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscomp.dll
- 2005-09-23 12:28:42 13,312 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll
+ 2007-10-24 05:47:30 13,312 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll
- 2005-09-23 12:28:58 17,920 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll
+ 2007-10-24 05:47:42 27,136 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll
- 2005-09-23 12:28:56 68,608 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll
+ 2007-10-24 05:47:40 69,120 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll
- 2005-09-23 12:28:44 31,936 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
+ 2007-10-24 05:47:30 35,320 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
- 2005-09-23 12:28:38 52,736 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfdll.dll
+ 2007-10-24 05:47:28 66,552 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfdll.dll
- 2007-04-13 09:20:58 5,120 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
+ 2007-10-24 05:47:28 5,120 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
- 2005-09-23 12:29:12 547,840 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
+ 2007-10-24 05:47:54 572,936 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
- 2005-09-23 12:28:56 788,992 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll
+ 2007-10-24 05:47:40 798,224 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll
- 2005-09-23 12:28:50 9,216 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fusion.dll
+ 2007-10-24 05:47:36 18,936 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fusion.dll
- 2007-04-13 09:21:16 9,728 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
+ 2007-10-24 05:47:40 9,728 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
- 2005-09-23 12:28:56 8,192 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll
+ 2007-10-24 05:47:40 8,192 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll
- 2005-09-23 12:28:56 36,864 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEHost.dll
+ 2007-10-24 05:47:40 77,824 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEHost.dll
- 2005-09-23 12:28:56 5,632 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll
+ 2007-10-24 05:47:40 6,656 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll
- 2007-04-13 09:21:16 228,688 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
+ 2007-10-24 05:47:40 230,904 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
- 2007-04-13 09:21:16 28,672 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
+ 2007-10-24 05:47:40 28,672 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
- 2005-09-23 12:28:56 55,296 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll
+ 2007-10-24 05:47:40 65,032 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll
- 2005-09-23 12:28:56 72,192 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll
+ 2007-10-24 05:47:40 72,192 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll
- 2005-09-23 12:28:48 40,960 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe
+ 2007-10-24 05:47:34 40,960 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe
- 2007-04-13 09:21:10 413,696 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
+ 2007-10-24 05:47:36 348,160 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
- 2005-09-23 12:28:48 36,864 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll
+ 2007-10-24 05:47:36 36,864 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll
- 2007-04-13 09:21:10 647,168 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
+ 2007-10-24 05:47:36 655,360 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
- 2005-09-23 12:28:48 73,728 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll
+ 2007-10-24 05:47:36 77,824 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll
- 2007-04-13 09:21:08 749,568 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
+ 2007-10-24 05:47:34 749,568 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
- 2005-09-23 12:29:10 110,592 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2007-10-24 05:47:52 110,592 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll
- 2005-09-23 12:29:10 372,736 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll
+ 2007-10-24 05:47:52 372,736 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll
- 2005-09-23 12:29:08 667,648 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll
+ 2007-10-24 05:47:50 671,744 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll
- 2005-09-23 12:28:30 28,672 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll
+ 2007-10-24 05:47:20 28,672 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll
- 2005-09-23 12:29:10 5,632 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll
+ 2007-10-24 05:47:52 5,632 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll
- 2005-09-23 12:28:30 32,768 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll
+ 2007-10-24 05:47:20 32,768 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll
- 2005-09-23 12:28:30 12,800 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2007-10-24 05:47:20 12,800 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2005-09-23 12:28:30 7,168 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll
+ 2007-10-24 05:47:20 7,168 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll
- 2007-04-13 09:20:52 87,040 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
+ 2007-10-24 05:47:22 97,792 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
- 2005-09-23 12:28:48 69,632 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
+ 2007-10-24 05:47:36 69,632 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
- 2007-04-13 09:21:18 802,304 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
+ 2007-10-24 05:47:40 822,280 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
- 2005-09-23 12:28:56 73,216 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll
+ 2007-10-24 05:47:40 83,456 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll
- 2005-09-23 12:28:56 288,768 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll
+ 2007-10-24 05:47:40 308,224 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll
- 2007-04-13 09:21:16 36,864 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
+ 2007-10-24 05:47:40 47,104 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
- 2007-04-13 09:21:16 326,656 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
+ 2007-10-24 05:47:40 348,672 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
- 2005-09-23 12:28:56 81,408 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorld.dll
+ 2007-10-24 05:47:40 94,208 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorld.dll
- 2007-04-13 09:21:16 4,308,992 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
+ 2007-10-24 05:47:40 4,444,160 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
- 2007-04-13 09:21:16 102,912 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
+ 2007-10-24 05:47:40 114,688 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
- 2005-09-23 12:29:00 330,752 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
+ 2007-10-24 05:47:44 340,992 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
- 2005-09-23 12:28:56 67,072 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
+ 2007-10-24 05:47:40 77,312 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
- 2005-09-23 12:28:50 9,216 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll
+ 2007-10-24 05:47:36 18,944 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll
- 2007-04-13 09:21:18 227,328 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
+ 2007-10-24 05:47:40 242,688 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
- 2007-04-13 09:21:18 68,952 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
+ 2007-10-24 05:47:40 70,144 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
- 2005-09-23 12:28:56 10,240 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscortim.dll
+ 2007-10-24 05:47:40 19,456 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscortim.dll
- 2007-04-13 09:21:12 5,634,048 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
+ 2007-10-24 05:47:36 5,814,784 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
- 2005-09-23 12:29:00 22,528 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MUI\0409\mscorsecr.dll
+ 2007-10-24 05:47:44 31,744 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MUI\0409\mscorsecr.dll
- 2007-04-13 09:21:16 99,152 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe
+ 2007-10-24 05:47:40 101,880 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe
- 2007-04-13 09:21:18 15,360 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normalization.dll
+ 2007-10-24 05:47:40 24,584 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normalization.dll
- 2005-09-23 12:28:56 78,336 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll
+ 2007-10-24 05:47:40 89,096 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll
- 2007-04-13 09:21:12 136,192 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\peverify.dll
+ 2007-10-24 05:47:36 144,896 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\peverify.dll
- 2005-09-23 12:28:56 53,248 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
+ 2007-10-24 05:47:40 53,248 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
- 2005-09-23 12:28:56 32,768 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
+ 2007-10-24 05:47:40 32,768 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
- 2005-09-23 12:29:02 59,072 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
+ 2007-10-24 05:47:46 61,952 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
- 2005-09-23 12:28:58 7,680 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll
+ 2007-10-24 05:47:42 16,896 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll
- 2005-09-23 12:28:56 107,520 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\shfusion.dll
+ 2007-10-24 05:47:40 119,296 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\shfusion.dll
- 2005-09-23 12:29:00 85,504 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll
+ 2007-10-24 05:47:44 95,232 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll
- 2007-04-13 09:21:18 382,464 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\SOS.dll
+ 2007-10-24 05:47:40 392,696 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\SOS.dll
- 2007-04-13 09:21:18 110,592 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
+ 2007-10-24 05:47:40 110,592 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
- 2007-04-13 09:21:18 413,696 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
+ 2007-10-24 05:47:42 425,984 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
- 2005-09-23 12:28:56 81,920 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll
+ 2007-10-24 05:47:40 81,920 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll
- 2007-04-13 09:21:16 2,902,016 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
+ 2007-10-24 05:47:40 3,036,160 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
- 2007-04-13 09:21:18 482,304 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
+ 2007-10-24 05:47:40 483,840 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
- 2007-04-13 09:21:18 716,800 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
+ 2007-10-24 05:47:40 741,376 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
- 2007-04-13 09:20:58 888,832 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
+ 2007-10-24 05:47:28 933,888 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
- 2007-04-13 09:21:16 5,001,216 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
+ 2007-10-24 05:47:40 5,070,848 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
- 2005-09-23 12:28:56 397,312 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll
+ 2007-10-24 05:47:40 401,408 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll
- 2007-04-13 09:21:18 188,416 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
+ 2007-10-24 05:47:40 188,416 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
- 2007-04-13 09:21:16 2,940,928 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.dll
+ 2007-10-24 05:47:40 3,076,096 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.dll
- 2005-09-23 12:28:56 81,920 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll
+ 2007-10-24 05:47:40 81,920 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll
- 2007-04-13 09:21:16 577,536 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
+ 2007-10-24 05:47:40 630,784 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
- 2007-04-13 09:21:16 258,048 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
+ 2007-10-24 05:47:40 258,048 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
- 2007-04-13 09:21:18 47,616 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
+ 2007-10-24 05:47:40 57,392 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
- 2007-04-13 09:21:18 114,176 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
+ 2007-10-24 05:47:40 113,664 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
- 2007-04-13 09:21:16 372,736 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
+ 2007-10-24 05:47:40 372,736 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
- 2005-09-23 12:28:56 258,048 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll
+ 2007-10-24 05:47:40 258,048 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll
- 2007-04-13 09:21:16 299,008 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
+ 2007-10-24 05:47:40 299,008 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
- 2005-09-23 12:28:56 131,072 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll
+ 2007-10-24 05:47:40 131,072 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll
- 2005-09-23 12:28:56 258,048 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Security.dll
+ 2007-10-24 05:47:40 258,048 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Security.dll
- 2005-09-23 12:28:56 114,688 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll
+ 2007-10-24 05:47:40 114,688 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll
- 2007-04-13 09:21:18 260,096 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
+ 2007-10-24 05:47:40 261,120 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
- 2007-04-13 09:21:16 5,156,864 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
+ 2007-10-24 05:47:40 5,431,296 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
- 2005-09-23 12:28:56 835,584 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll
+ 2007-10-24 05:47:40 884,736 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll
- 2005-09-23 12:28:56 86,016 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll
+ 2007-10-24 05:47:40 90,112 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll
- 2005-09-23 12:28:56 823,296 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll
+ 2007-10-24 05:47:40 839,680 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll
- 2007-04-13 09:21:16 5,152,768 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
+ 2007-10-24 05:47:40 5,013,504 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
- 2007-04-13 09:21:16 2,027,520 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
+ 2007-10-24 05:47:40 2,068,480 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
- 2005-09-23 12:28:56 71,680 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL
+ 2007-10-24 05:47:40 81,400 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL
- 2007-04-13 09:21:28 1,166,672 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
+ 2007-10-24 05:47:48 1,172,472 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
- 2007-04-13 09:20:50 1,330,688 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
+ 2007-10-24 05:47:20 1,344,000 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
- 2007-04-13 09:20:52 406,016 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\webengine.dll
+ 2007-10-24 05:47:22 434,688 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\webengine.dll
- 2005-09-23 12:28:56 28,160 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll
+ 2007-10-24 05:47:40 37,896 ----a-w G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll
+ 2007-11-19 00:52:50 2,722 ----a-w G:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
+ 2004-08-12 06:00:00 2,000 ----a-w G:\WINDOWS\system\KEYBOARD.DRV
+ 2004-08-12 06:00:00 2,032 ----a-w G:\WINDOWS\system\MOUSE.DRV
+ 2004-08-12 06:00:00 1,744 ----a-w G:\WINDOWS\system\SOUND.DRV
+ 2004-08-12 06:00:00 2,176 ----a-w G:\WINDOWS\system\VGA.DRV
+ 2004-03-31 05:00:00 61,440 ----a-w G:\WINDOWS\system32\ADLOC.dll
+ 2007-02-20 18:59:06 53,248 ----a-w G:\WINDOWS\system32\AgCPanelFrench.dll
+ 2007-02-20 18:59:06 53,248 ----a-w G:\WINDOWS\system32\AgCPanelGerman.dll
+ 2007-02-20 18:59:08 53,248 ----a-w G:\WINDOWS\system32\AgCPanelJapanese.dll
+ 2007-02-20 18:59:06 53,248 ----a-w G:\WINDOWS\system32\AgCPanelKorean.dll
+ 2007-02-20 18:59:06 53,248 ----a-w G:\WINDOWS\system32\AgCPanelPortugese.dll
+ 2007-02-20 18:59:06 53,248 ----a-w G:\WINDOWS\system32\AgCPanelSimplifiedChinese.dll
+ 2007-02-20 18:59:04 53,248 ----a-w G:\WINDOWS\system32\AgCPanelSpanish.dll
+ 2007-02-20 18:59:06 53,248 ----a-w G:\WINDOWS\system32\AgCPanelSwedish.dll
+ 2007-02-20 18:59:06 53,248 ----a-w G:\WINDOWS\system32\AgCPanelTraditionalChinese.dll
+ 2007-01-06 00:38:18 198,257 ----a-w G:\WINDOWS\system32\AGEIA\app.bin
+ 2007-01-06 00:38:18 122,249 ----a-w G:\WINDOWS\system32\AGEIA\diag.bin
+ 2004-03-31 05:00:00 45,056 ----a-w G:\WINDOWS\system32\APLOC.dll
+ 2003-10-23 05:00:00 27,824 ----a-w G:\WINDOWS\system32\ascIP95.DLL
+ 2003-10-23 05:00:00 27,408 ----a-w G:\WINDOWS\system32\ascIPNT.DLL
+ 2001-03-03 00:52:40 15,360 ----a-w G:\WINDOWS\system32\asfsipc.dll
+ 2003-10-23 05:00:00 352,256 ----a-w G:\WINDOWS\system32\ASLOC.dll
+ 2002-12-05 17:55:43 569,616 ----a-w G:\WINDOWS\system32\COMCTL3N.DLL
+ 2004-08-12 06:00:00 1,788 ----a-w G:\WINDOWS\system32\Dcache.bin
- 2005-09-23 12:28:38 83,456 ----a-w G:\WINDOWS\system32\dfshim.dll
+ 2007-10-24 05:47:28 96,760 ----a-w G:\WINDOWS\system32\dfshim.dll
+ 2004-08-04 05:07:58 2,944 ----a-w G:\WINDOWS\system32\drivers\drmkaud.sys
+ 2004-08-12 06:00:00 2,944 ----a-w G:\WINDOWS\system32\drivers\null.sys
+ 2006-11-09 15:29:12 110,336 -c--a-r G:\WINDOWS\system32\DRVSTORE\athena_6BDC51EC34901E554F7E8DCB20A16311375D6D33\athena.sys
- 2008-04-10 14:26:03 154,768 ----a-w G:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-04-25 00:49:00 157,160 ----a-w G:\WINDOWS\system32\FNTCACHE.DAT
+ 2004-08-12 06:00:00 2,000 ----a-w G:\WINDOWS\system32\keyboard.drv
+ 2004-08-12 06:00:00 2,560 ----a-w G:\WINDOWS\system32\lz32.dll
- 2007-11-21 00:52:38 2,884,992 ----a-w G:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
+ 2008-03-25 03:21:18 2,889,088 ----a-w G:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
- 2007-11-21 00:52:40 218,496 ----a-w G:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2008-03-25 03:21:20 218,496 ----a-w G:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
- 2008-03-02 23:21:45 70,264 ----a-w G:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
+ 2008-04-19 01:12:39 70,264 ----a-w G:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
- 2008-02-25 16:13:42 29,488 ---ha-w G:\WINDOWS\system32\mlfcache.dat
+ 2008-04-25 01:02:52 30,016 ---ha-w G:\WINDOWS\system32\mlfcache.dat
+ 2004-08-12 06:00:00 2,032 ----a-w G:\WINDOWS\system32\mouse.drv
- 2007-04-13 09:21:14 271,360 ----a-w G:\WINDOWS\system32\mscoree.dll
+ 2007-10-24 05:47:38 282,112 ----a-w G:\WINDOWS\system32\mscoree.dll
- 2005-09-23 12:28:52 150,016 ----a-w G:\WINDOWS\system32\mscorier.dll
+ 2007-10-24 05:47:38 158,720 ----a-w G:\WINDOWS\system32\mscorier.dll
- 2005-09-23 12:28:52 74,240 ----a-w G:\WINDOWS\system32\mscories.dll
+ 2007-10-24 05:47:38 84,480 ----a-w G:\WINDOWS\system32\mscories.dll
+ 2002-12-05 17:57:30 118,784 ----a-w G:\WINDOWS\system32\MSSTDFMN.DLL
+ 2003-09-23 05:00:00 118,784 ----a-w G:\WINDOWS\system32\MSSTDFMT.DLL
- 1999-01-21 23:40:08 94,208 ----a-w G:\WINDOWS\system32\msstkprp.dll
+ 2003-09-23 05:00:00 94,208 ----a-w G:\WINDOWS\system32\Msstkprp.dll
- 2004-08-12 06:00:00 1,392,671 ----a-w G:\WINDOWS\system32\msvbvm60.dll
+ 2003-09-23 05:00:00 1,385,744 ----a-w G:\WINDOWS\system32\MSVBVM60.DLL
+ 2002-12-05 17:58:05 1,388,544 ----a-w G:\WINDOWS\system32\MSVBVM6N.DLL
+ 2003-09-23 05:00:00 434,252 ----a-w G:\WINDOWS\system32\MSVCRTD.DLL
- 2006-12-22 18:02:36 6,144 ----a-w G:\WINDOWS\system32\mui\0409\mscorees.dll
+ 2007-10-24 05:47:44 15,360 ----a-w G:\WINDOWS\system32\mui\0409\mscorees.dll
+ 2001-03-03 00:52:42 8,704 ----a-w G:\WINDOWS\system32\npwmsdrm.dll
+ 2002-12-05 17:58:17 614,672 ----a-w G:\WINDOWS\system32\OLEAUT3N.DLL
- 2008-03-11 22:22:29 70,174 ----a-w G:\WINDOWS\system32\perfc009.dat
+ 2008-04-12 17:13:48 71,358 ----a-w G:\WINDOWS\system32\perfc009.dat
- 2008-03-11 22:22:29 418,784 ----a-w G:\WINDOWS\system32\perfh009.dat
+ 2008-04-12 17:13:48 424,048 ----a-w G:\WINDOWS\system32\perfh009.dat
+ 2007-03-26 14:45:18 71,208 ----a-w G:\WINDOWS\system32\PhysXLoader.dll
+ 2004-08-12 06:00:00 1,744 ----a-w G:\WINDOWS\system32\sound.drv
+ 2004-08-12 06:00:00 2,176 ----a-w G:\WINDOWS\system32\vga.drv
+ 2004-08-12 06:00:00 2,864 ----a-w G:\WINDOWS\system32\winsock.dll
+ 2004-08-12 06:00:00 2,112 ----a-w G:\WINDOWS\system32\winspool.exe
+ 2004-08-12 06:00:00 2,736 ----a-w G:\WINDOWS\system32\wowdeb.exe
- 2007-02-20 06:45:09 15,128 ----a-w G:\WINDOWS\system32\x3daudio1_1.dll
+ 2007-03-05 16:42:18 15,128 ----a-w G:\WINDOWS\system32\x3daudio1_1.dll
- 2007-02-20 06:45:10 68,888 ----a-w G:\WINDOWS\system32\xinput1_3.dll
+ 2007-04-04 22:53:42 81,768 ----a-w G:\WINDOWS\system32\xinput1_3.dll
+ 2008-04-12 17:13:34 8,192 ----a-w G:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2007-10-24 05:47:56 479,232 ----a-w G:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\msvcm80.dll
+ 2007-10-24 05:47:56 558,080 ----a-w G:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\msvcp80.dll
+ 2007-10-24 05:47:56 635,904 ----a-w G:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\msvcr80.dll
- 2007-11-19 00:24:59 258,048 ----a-w G:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2008-04-12 17:13:40 258,048 ----a-w G:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
- 2007-11-19 00:24:59 114,176 ----a-w G:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2008-04-12 17:13:40 113,664 ----a-w G:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []
"ctfmon.exe"="G:\WINDOWS\system32\ctfmon.exe" [2004-08-12 02:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25 6731312]
"AntiSpywareMaster"="G:\Program Files\AntiSpywareMaster\asm.exe" [ ]
"NvCplDaemon"="G:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="G:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-11 01:45 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2008-03-01 09:06 124928 G:\WINDOWS\system32\advpack.dll]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvUkhFWO]
wvUkhFWO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\startupfolder\G:^Documents and Settings^Owner^Start Menu^Programs^Startup^DW_Start.lnk]
path=G:\Documents and Settings\Owner\Start Menu\Programs\Startup\DW_Start.lnk
backup=G:\WINDOWS\pss\DW_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
--a------ 2007-06-11 05:25 6731312 G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage]
G:\Program Files\AdVantage\AdVantage.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
--a------ 2001-12-18 18:45 53248 G:\Program Files\AIM95\aim.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
--a------ 2008-03-06 16:50 50528 G:\Program Files\AIM6\aim6.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2005-05-03 20:43 69632 G:\WINDOWS\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
--a------ 2008-04-24 20:20 579584 G:\PROGRA~1\Grisoft\AVG7\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
G:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM9f52abb0]
G:\WINDOWS\system32\xlhpmjmg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-12 02:00 15360 G:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2007-12-15 06:02 482760 G:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Fljcpj]
G:\Documents and Settings\Owner\My Documents\A?pPatch\r?gedit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2005-09-24 01:08 49152 G:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 G:\Program Files\Windows Live\Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
G:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 16:57 153136 G:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-12-05 02:41 8523776 G:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-12-05 02:41 81920 G:\WINDOWS\system32\NvMcTray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-12-05 02:41 1626112 G:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PeerGuardian]
--a------ 2005-09-18 18:40 1421824 G:\Program Files\PeerGuardian2\pg2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Prdr]
G:\WINDOWS\MANTEC~1\dvdplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 2007-01-20 03:09 200704 G:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-31 23:13 385024 G:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 2007-10-16 20:30 16855552 G:\WINDOWS\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-01-28 11:43 2097488 G:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-04-18 20:08 1271032 g:\program files\steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ToolBoxFX]
--a------ 2005-11-21 16:55 45056 G:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
G:\WINDOWS\system32\dumprep 0 -u

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VistaDrive]
--a------ 2006-10-05 22:56 280779 G:\WINDOWS\VistaDrive\VistaDrive.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
G:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NBService"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"Viewpoint Manager Service"=2 (0x2)
"usnjsvc"=3 (0x3)
"Bonjour Service"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"G:\\Program Files\\uTorrent\\uTorrent.exe"=
"G:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"G:\\Program Files\\AIM6\\aim6.exe"=
"G:\\Program Files\\AIM95\\aim.exe"=
"G:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"G:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"G:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"G:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"G:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"G:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"G:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"G:\\Program Files\\Sierra\\FEARCombat\\fpupdate.exe"=
"G:\\Program Files\\Counter-Strike\\hl.exe"=
"G:\\Program Files\\Sierra\\FEARCombat\\FEARServer.exe"=
"G:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"G:\\Program Files\\Sierra\\FEARCombat\\FEARMP.exe"=

R2 SBKUPNT;SBKUPNT;G:\WINDOWS\system32\Drivers\SBKUPNT.SYS [2001-07-13 13:56]
R3 HPFXBULK;HPFXBULK;G:\WINDOWS\system32\drivers\hpfxbulk.sys [2005-09-20 06:22]
S4 Viewpoint Manager Service;Viewpoint Manager Service;"G:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-04-25 11:04:03 G:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- G:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-25 10:44:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 1

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
G:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
G:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
G:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
G:\PROGRA~1\Grisoft\AVG7\avgemc.exe
G:\WINDOWS\system32\nvsvc32.exe
G:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-04-25 10:47:43 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-25 14:47:40
ComboFix2.txt 2008-04-12 00:09:35
ComboFix3.txt 2008-04-11 18:36:37

Pre-Run: 14,695,567,360 bytes free
Post-Run: 14,783,893,504 bytes free

807 --- E O F --- 2008-04-12 17:14:30

#6 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,723 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:09:35 PM

Posted 25 April 2008 - 11:25 PM

Hello ZenDavis,

I've merged your new topic with your previous topic. Please keep to this thread for this issue. If you know you will be away for a while and won't be able to respond, please let your helper know. Please let him know if you followed the instructions in his most recent post.

Back to you David.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#7 ZenDavis

ZenDavis
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:10:35 PM

Posted 27 April 2008 - 12:04 AM

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, April 27, 2008 1:02:38 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 27/04/2008
Kaspersky Anti-Virus database records: 727057
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
G:\

Scan Statistics:
Total number of scanned objects: 177789
Number of viruses found: 4
Number of infected objects: 9
Number of suspicious objects: 0
Duration of the scan process: 01:12:00

Infected Object Name / Virus Name / Last Action
C:\hiberfil.sys Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{CB7289FC-9316-460E-9D63-ECA0F1557A33}\RP215\change.log Object is locked skipped
C:\Windows\CSC\v2.0.6\pq Object is locked skipped
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl Object is locked skipped
G:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
G:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
G:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
G:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
G:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
G:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
G:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
G:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
G:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
G:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
G:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
G:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
G:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
G:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
G:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
G:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
G:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
G:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sdz80tns.default\cert8.db Object is locked skipped
G:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sdz80tns.default\formhistory.dat Object is locked skipped
G:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sdz80tns.default\history.dat Object is locked skipped
G:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sdz80tns.default\key3.db Object is locked skipped
G:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sdz80tns.default\parent.lock Object is locked skipped
G:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sdz80tns.default\search.sqlite Object is locked skipped
G:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sdz80tns.default\urlclassifier2.sqlite Object is locked skipped
G:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Application Data\Ahead\Nero Home\bl.db Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Application Data\Ahead\Nero Home\is2.db Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Application Data\Identities\{CEDA4B07-8655-4018-98AB-7450B09AC734}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Application Data\Identities\{CEDA4B07-8655-4018-98AB-7450B09AC734}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows Live Contacts\ahmedmalik00@hotmail.com\real\members.stg Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows Live Contacts\ahmedmalik00@hotmail.com\shadow\members.stg Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\sdz80tns.default\Cache\57D5CDB9d01 Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\sdz80tns.default\Cache\_CACHE_001_ Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\sdz80tns.default\Cache\_CACHE_002_ Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\sdz80tns.default\Cache\_CACHE_003_ Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\sdz80tns.default\Cache\_CACHE_MAP_ Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Temp\BCG26A.tmp Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Temp\~DF3C0A.tmp Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Temp\~DF490D.tmp Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Temp\~DF5961.tmp Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Temp\~DF5971.tmp Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
G:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
G:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped
G:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped
G:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped
G:\QooBox\Quarantine\catchme2008-04-25_104230.45.zip/opnOfDUo.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.qni skipped
G:\QooBox\Quarantine\catchme2008-04-25_104230.45.zip ZIP: infected - 1 skipped
G:\QooBox\Quarantine\G\WINDOWS\system32\wvUkhFWO.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.qng skipped
G:\QooBox\Quarantine\G\WINDOWS\system32\xlhpmjmg.dll.vir Infected: Packed.Win32.Monder.gen skipped
G:\QooBox\Quarantine\G\WINDOWS\system32\xxyyaASJ.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.qng skipped
G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
G:\System Volume Information\_restore{CB7289FC-9316-460E-9D63-ECA0F1557A33}\RP200\A0030700.EXE Object is locked skipped
G:\System Volume Information\_restore{CB7289FC-9316-460E-9D63-ECA0F1557A33}\RP213\A0032345.exe Object is locked skipped
G:\System Volume Information\_restore{CB7289FC-9316-460E-9D63-ECA0F1557A33}\RP213\A0032346.exe Object is locked skipped
G:\System Volume Information\_restore{CB7289FC-9316-460E-9D63-ECA0F1557A33}\RP214\A0032369.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.qng skipped
G:\System Volume Information\_restore{CB7289FC-9316-460E-9D63-ECA0F1557A33}\RP214\A0032370.dll Infected: Packed.Win32.Monder.gen skipped
G:\System Volume Information\_restore{CB7289FC-9316-460E-9D63-ECA0F1557A33}\RP214\A0032371.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.qng skipped
G:\System Volume Information\_restore{CB7289FC-9316-460E-9D63-ECA0F1557A33}\RP214\A0032379.dll Object is locked skipped
G:\System Volume Information\_restore{CB7289FC-9316-460E-9D63-ECA0F1557A33}\RP215\change.log Object is locked skipped
G:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
G:\WINDOWS\SchedLgU.Txt Object is locked skipped
G:\WINDOWS\SoftwareDistribution\EventCache\{213C1878-EB16-48F2-867E-619E1CC477F2}.bin Object is locked skipped
G:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
G:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
G:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
G:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
G:\WINDOWS\system32\config\default Object is locked skipped
G:\WINDOWS\system32\config\default.LOG Object is locked skipped
G:\WINDOWS\system32\config\Internet.evt Object is locked skipped
G:\WINDOWS\system32\config\SAM Object is locked skipped
G:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
G:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
G:\WINDOWS\system32\config\SECURITY Object is locked skipped
G:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
G:\WINDOWS\system32\config\software Object is locked skipped
G:\WINDOWS\system32\config\software.LOG Object is locked skipped
G:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
G:\WINDOWS\system32\config\system Object is locked skipped
G:\WINDOWS\system32\config\system.LOG Object is locked skipped
G:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
G:\WINDOWS\system32\h323log.txt Object is locked skipped
G:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
G:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
G:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
G:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
G:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
G:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
G:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
G:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

_______________

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:04:39 AM, on 4/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\svchost.exe
G:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\Explorer.EXE
G:\WINDOWS\system32\ctfmon.exe
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
G:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
G:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
G:\PROGRA~1\Grisoft\AVG7\avgemc.exe
G:\WINDOWS\system32\nvsvc32.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\wscntfy.exe
G:\Program Files\Internet Explorer\IEXPLORE.EXE
G:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
G:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
G:\Program Files\uTorrent\uTorrent.exe
G:\Program Files\Windows Live\Messenger\msnmsgr.exe
G:\Program Files\QuickTime\QuickTimePlayer.exe
G:\Program Files\AIM95\aim.exe
G:\Program Files\Winamp\winamp.exe
G:\Program Files\Nero\Nero 7\Core\nero.exe
G:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
G:\WINDOWS\system32\NOTEPAD.EXE
G:\PROGRA~1\MOZILL~1\FIREFOX.EXE
G:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - G:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AntiSpywareMaster] G:\Program Files\AntiSpywareMaster\asm.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE G:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] G:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] G:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\j2re1.4.1_05\bin\npjpi141_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\j2re1.4.1_05\bin\npjpi141_05.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - G:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - G:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O20 - Winlogon Notify: wvUkhFWO - wvUkhFWO.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - G:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NMIndexingService - Nero AG - G:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5503 bytes

#8 ZenDavis

ZenDavis
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:10:35 PM

Posted 28 April 2008 - 04:51 PM

Bump.

#9 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:03:35 AM

Posted 29 April 2008 - 02:59 PM

Please delete this folder:
G:\QooBox

Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following if still present:

O20 - Winlogon Notify: wvUkhFWO - wvUkhFWO.dll (file missing)

Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!

We need to purge your infected system restore points.
On the Desktop, right-click My Computer, then click Properties.
Click the System Restore tab near the top of the window.
Check Turn off System Restore, click Apply, and then click OK.
More information on how to disable your system restore can be found here.

We want to create a new, clean restore point. Please first reboot your computer.
On the Desktop, right-click My Computer, then click Properties.
Click the System Restore tab near the top of the window.
Uncheck "Turn off System Restore", click Apply, and then click OK.

Click Start > All Programs > Accessories > System Tools, and select System Restore.
In the System Restore wizard, select the box next the text labeled "Create a restore point" and click the Next button.
Type a description for your new restore point - Something like "After trojan/spyware cleanup".
Click Create, and after it has created the restore point, click "Close".
Further instructions on creating a restore point can be found here

Please reboot a final time and let me know how the PC is running.
I see a clean Hijackthis log now!

#10 ZenDavis

ZenDavis
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:10:35 PM

Posted 30 April 2008 - 08:45 PM

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:45:06 PM, on 4/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\spoolsv.exe
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
G:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
G:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
G:\PROGRA~1\Grisoft\AVG7\avgemc.exe
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
G:\WINDOWS\system32\ctfmon.exe
G:\WINDOWS\explorer.exe
G:\Program Files\Trend Micro\HijackThis\HijackThis.exe
G:\Program Files\Mozilla Firefox\firefox.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - G:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [WinampAgent] "G:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [ctfmon.exe] G:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User '?')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User '?')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User '?')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User '?')
O4 - HKUS\S-1-5-21-1482476501-790525478-839522115-1003\..\Run: [ctfmon.exe] G:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User '?')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User '?')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] G:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\j2re1.4.1_05\bin\npjpi141_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\j2re1.4.1_05\bin\npjpi141_05.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - G:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - G:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVG7\avgemc.exe

--
End of file - 4371 bytes

#11 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:03:35 AM

Posted 01 May 2008 - 11:18 AM

Looking good! How is the system running? :thumbsup:

#12 ZenDavis

ZenDavis
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:10:35 PM

Posted 06 May 2008 - 08:30 PM

Thanks for you help! It's working great now!

#13 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:03:35 AM

Posted 07 May 2008 - 04:01 PM

Glad I could help! :thumbsup:
The latest log is looking clean!
Follow this list and your potential for being infected again will be reduced dramatically.

Use an Anti Virus Software -
* It is very important that your computer has an anti-virus software running on your machine.
* This alone can save you a lot of trouble with malware in the future. This link has listings of stand-alone anti virus programs:
* Click here for more information on -> Computer Safety On line - Anti-Virus
* I would recommend Grisoft's AVG or AVAST.
* These are the more secure and better ones.

Update your Anti Virus Software - It is imperitive that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall -
* I can not stress how important it is that you use a Firewall on your computer.
* Without a firewall your computer is susceptible to being hacked and taken over.
* Simply using a Firewall in its default configuration can lower your risk greatly.
* For an article on Firewalls and a listing of some available ones see the link below:
* Click here for more information on -> Computer Safety On line - Software Firewalls
* I would recommend ZoneAlarm as a firewall as it's easy to use.

Visit Microsoft's Windows Update Site Frequently -
* It is important that you visit http://www.windowsupdate.com regularly.
* This will ensure your computer has always the latest security updates available installed on your computer.
* If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Next, if they're not already present, I would recommend the download and installation of some or all of the following programs (all free), and the updating of them regularly

Install Spybot© - Search and Destroy- Install and download Spybot - Search and Destroy with its TeaTimer option.
* This will provide real-time spyware & hijacker protection on your computer alongside your virus protection.
* You should also scan your computer with program on a regular basis just as you would an anti virus software.
* A tutorial on installing & using this product can be found here:
* Click here for more info -->Instructions for - Spybot S & D and Ad-aware

Install Lavasofts© Ad-Aware - Install and download Ad-Aware.
* You should also scan your computer with the program on a regular basis just as you would an anti virus software in conjunction with Spybot.
* A tutorial on installing & using this product can be found here:
* Click here for more info -->Instructions for - Spybot S & D and Ad-aware

Install Javacools© SpywareBlaster -
* SpywareBlaster will added a large list of programs and sites into your Internet Explorer and Firefox settings and that will protect you from running and downloading known malicious programs.
* A article on anti-malware products with links for this program and others can be found here:
* Click here for more info -->Computer Safety on line - Anti-Malware

Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.

If you have any addition questions just ask...
David




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users