Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Virtuemonde Evolved?


  • This topic is locked This topic is locked
32 replies to this topic

#1 bigz123

bigz123

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:09:50 PM

Posted 30 November 2008 - 10:27 AM

Everyone join the official i hate virtuemonde club today! oh wait.. the browser gets redirected so i cant...

I seem to have found exactly what is out of place and require assistance to remove it if possible. i would have just completeley formatted and reinstalled windows but i just recently backed up a whole bunch of stuff on my computer and cant find an alternative to store it on.
I got the usual from spybot S&D and removed the files witch seemed to be the issue. but they came back again and again. i have also tried Avast to no avail and Add Aware "witch finds things but virtuemonde seems to inject code and cause a nasty error. terrible little bug. Also ran VundoFIX.exe and Virtumondobegone.exe and they both find nothing. great. using teatimer i witness it contiualy trying to add registry entries ending in randomly named .dll files. for example, lehebofi.dll i set them all to auto deny but thats still slows my computer down terrible because of all the background action. i have the log for Teatimer but i dont think its nescessarey to post it. so after all that heres my hijack this log.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:02:37 AM, on 11/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: (no name) - {3ee2fbd1-70f2-4469-bb9e-c7edf9073289} - C:\WINDOWS\system32\yinazeku.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s
O4 - HKLM\..\Run: [CPMab950101] Rundll32.exe "c:\windows\system32\silugihi.dll",a
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Program Files\Trend Micro\HijackThis\HijackThis.exe /startupscan
O4 - HKUS\S-1-5-19\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: C:\WINDOWS\system32\hegiguve.dll c:\windows\system32\silugihi.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\silugihi.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\silugihi.dll

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 4309 bytes








please somebody help... im about ready to pull MY plug if u know what i mean. im so sick of it. worst ive ever come across.




QUICK LITTLE EDIT!!! I HAVE 2 partitions h: and c: of coarse c is my os and usual installations and i store my games music and all kinds of installers and patches on H: don't know if that helps or not

Edited by bigz123, 30 November 2008 - 10:31 AM.


BC AdBot (Login to Remove)

 


#2 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:08:50 PM

Posted 30 November 2008 - 03:17 PM

Hello! :thumbsup:
My name is Sam and I will be helping you.

I will do my best to communicate clearly to you so that we can resolve your issues as quickly as possible. In order to see what's going on with your computer I will ask for you to post various logs from the tools that we will use to fix your computer. Please communicate freely with me about how your computer is reacting and behaving as we work through this process.


Please download random's system information tool (RSIT) and save it to your desktop.
  • Double click on RSIT.exe to run it.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#3 bigz123

bigz123
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:09:50 PM

Posted 30 November 2008 - 04:31 PM

info.txt logfile of random's system information tool 1.04 2008-11-30 15:25:03

======Uninstall list======

-->MsiExec /X{A7E07C2B-2220-4415-87E3-784D5814BC93}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware-->MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Battlefield 2™-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}\setup.exe" -l0x9 -removeonly
Battlefield 2142-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ED50ECE9-EC54-4C05-B5ED-EE4741A9F2EC}\setup.exe" -l0x9 -removeonly
Combat Arms-->"C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe" -mode:uninstall -dll:ngm.nexon.net/ngm/NGM/Bin/NGMDll.dll -game:33563143 -locale:US
Craxtion4-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B16ACC3B-A84E-46B2-B6B4-0E088A94A944}\setup.exe" -l0x9 -removeonly
FlashFXP v3-->"C:\Program Files\FlashFXP\Uninstall.exe" "C:\Program Files\FlashFXP\install.log" -u
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
ImgBurn-->"C:\Program Files\ImgBurn\uninstall.exe"
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
mIRC-->C:\Program Files\mIRC\uninstall.exe _?=C:\Program Files\mIRC
Mozilla Firefox (3.0.4)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
NVIDIA ForceWare Network Access Manager-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{1F6423DE-7959-4178-80E0-023C7EAA5347} /l1033
NVIDIA PhysX v8.09.04-->MsiExec.exe /X{A7E07C2B-2220-4415-87E3-784D5814BC93}
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m -nrg2709
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Ventrilo Client-->MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
XBCD 1.07-->C:\Program Files\XBCD\uninst.exe
XBox Audio Driver 0.2-->C:\Program Files\XBAudio\uninst.exe
Xfire (remove only)-->"C:\Program Files\Xfire\uninst.exe"

=====HijackThis Backups=====

O2 - BHO: (no name) - {3ee2fbd1-70f2-4469-bb9e-c7edf9073289} - C:\WINDOWS\system32\yinazeku.dll
O4 - HKLM\..\Run: [CPMab950101] Rundll32.exe "c:\windows\system32\silugihi.dll",a
O4 - HKUS\S-1-5-20\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s (User 'LOCAL SERVICE')
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (file missing)
O20 - AppInit_DLLs: C:\WINDOWS\system32\hegiguve.dll c:\windows\system32\vukefese.dll c:\windows\system32\silugihi.dll
O4 - HKLM\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\silugihi.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\silugihi.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\silugihi.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\silugihi.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\hegiguve.dll c:\windows\system32\silugihi.dll
O2 - BHO: (no name) - {3ee2fbd1-70f2-4469-bb9e-c7edf9073289} - C:\WINDOWS\system32\yinazeku.dll (file missing)
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\silugihi.dll
O2 - BHO: (no name) - {3ee2fbd1-70f2-4469-bb9e-c7edf9073289} - C:\WINDOWS\system32\yinazeku.dll (file missing)
O4 - HKLM\..\Run: [CPMab950101] Rundll32.exe "c:\windows\system32\silugihi.dll",a
O4 - HKUS\S-1-5-20\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s (User 'NETWORK SERVICE')
O20 - AppInit_DLLs: c:\windows\system32\silugihi.dll,C:\WINDOWS\system32\hegiguve.dll
O4 - HKLM\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\silugihi.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\silugihi.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\hegiguve.dll
O2 - BHO: (no name) - {3ee2fbd1-70f2-4469-bb9e-c7edf9073289} - C:\WINDOWS\system32\yinazeku.dll (file missing)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\silugihi.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\hegiguve.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\silugihi.dll
O2 - BHO: (no name) - {3ee2fbd1-70f2-4469-bb9e-c7edf9073289} - C:\WINDOWS\system32\yinazeku.dll (file missing)
O4 - HKUS\S-1-5-20\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s (User 'NETWORK SERVICE')
O4 - HKLM\..\Run: [CPMab950101] Rundll32.exe "c:\windows\system32\silugihi.dll",a
O4 - HKLM\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s
O2 - BHO: (no name) - {3ee2fbd1-70f2-4469-bb9e-c7edf9073289} - C:\WINDOWS\system32\yinazeku.dll (file missing)

======Security center information======

FW: ActiveArmor Firewall

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 79 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=4f02
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------
.
.
.
.
.
.
.
.
.
.
.Next




Logfile of random's system information tool 1.04 (written by random/random)
Run by Voltron at 2008-11-30 15:24:59
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 47 GB (29%) free of 160 GB
Total RAM: 2046 MB (76% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:25:01 PM, on 11/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\DOCUME~1\Voltron\LOCALS~1\Temp\~e5.0001
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Voltron\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Voltron.exe

O2 - BHO: (no name) - {3ee2fbd1-70f2-4469-bb9e-c7edf9073289} - C:\WINDOWS\system32\yinazeku.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [CPMab950101] Rundll32.exe "c:\windows\system32\silugihi.dll",a
O4 - HKLM\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Program Files\Trend Micro\HijackThis\HijackThis.exe /startupscan
O4 - HKUS\S-1-5-19\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: C:\WINDOWS\system32\hegiguve.dll c:\windows\system32\silugihi.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\silugihi.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\silugihi.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 4364 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ee2fbd1-70f2-4469-bb9e-c7edf9073289}]
C:\WINDOWS\system32\yinazeku.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-10-07 13574144]
"nwiz"=nwiz.exe /install []
"nTrayFw"=C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe [2006-02-17 270336]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-10-07 86016]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-10-09 17021440]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2008-06-19 57344]
"CPMab950101"=c:\windows\system32\silugihi.dll [2008-11-30 95284]
"fadugupage"=C:\WINDOWS\system32\lehebofi.dll []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-09-16 1833296]
"HijackThis startup scan"=C:\Program Files\Trend Micro\HijackThis\HijackThis.exe [2008-11-29 396288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a8a6329d]
C:\WINDOWS\system32\dagenoja.dll []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CPMab950101]
c:\windows\system32\vukefese.dll []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fadugupage]
C:\WINDOWS\system32\lehebofi.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\WINDOWS\system32\hegiguve.dll c:\windows\system32\silugihi.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\silugihi.dll [2008-11-30 95284]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\silugihi.dll [2008-11-30 95284]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
C:\WINDOWS\system32\hegiguve.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server"
"H:\Battlefield 2142\BF2142.exe"="H:\Battlefield 2142\BF2142.exe:*:Enabled:Battlefield 2"
"C:\Program Files\Xfire\xfire.exe"="C:\Program Files\Xfire\xfire.exe:*:Enabled:Xfire"
"C:\Program Files\Ventrilo\Ventrilo.exe"="C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe"
"H:\CCP\EVE\bin\ExeFile.exe"="H:\CCP\EVE\bin\ExeFile.exe:*:Enabled:CCP ExeFile"
"C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe"="C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"C:\Nexon\Combat Arms\CombatArms.exe"="C:\Nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe"
"C:\Nexon\Combat Arms\Engine.exe"="C:\Nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe"
"C:\Nexon\Combat Arms\NMService.exe"="C:\Nexon\Combat Arms\NMService.exe:*:Enabled:Nexon Messenger Core"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\WINDOWS\system32\wbem\wmiprvse.exe"="C:\WINDOWS\system32\wbem\wmiprvse.exe:*:Enabled:wmiprvse"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe:*:Enabled:nSvcIp"
"C:\Program Files\EA GAMES\Battlefield 2\BF2.exe"="C:\Program Files\EA GAMES\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2"
"H:\Battlefield 2\BF2.exe"="H:\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2"
"C:\WINDOWS\system32\logonui.exe"="C:\WINDOWS\system32\logonui.exe:*:Enabled:logonui"
"C:\Program Files\GameSpy Arcade\Aphex.exe"="C:\Program Files\GameSpy Arcade\Aphex.exe:*:Enabled:GameSpy Arcade"
"C:\Program Files\Firefly Studios\Stronghold Crusader\Stronghold_Crusader_Extreme.exe"="C:\Program Files\Firefly Studios\Stronghold Crusader\Stronghold_Crusader_Extreme.exe:*:Enabled:Stronghold Crusader"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Program Files\FlashFXP\FlashFXP.exe"="C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3"
"C:\Documents and Settings\Voltron\Desktop\auto_xbins_2008\xbins.exe"="C:\Documents and Settings\Voltron\Desktop\auto_xbins_2008\xbins.exe:*:Enabled:xbins"
"C:\XBOX\auto_xbins_2008\xbins.exe"="C:\XBOX\auto_xbins_2008\xbins.exe:*:Enabled:xbins"
"C:\WINDOWS\system32\lsass.exe"="C:\WINDOWS\system32\lsass.exe:*:Enabled:lsass"
"C:\Documents and Settings\Voltron\Desktop\xbins.exe"="C:\Documents and Settings\Voltron\Desktop\xbins.exe:*:Enabled:xbins"
"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe:*:Enabled:nSvcAppFlt"
"C:\Program Files\mIRC\mirc.exe"="C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\WINDOWS\system32\spoolsv.exe"="C:\WINDOWS\system32\spoolsv.exe:*:Enabled:spoolsv"
"C:\WINDOWS\explorer.exe"="C:\WINDOWS\explorer.exe:*:Enabled:Explorer"
"C:\WINDOWS\system32\winlogon.exe"="C:\WINDOWS\system32\winlogon.exe:*:Enabled:winlogon"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Nexon\Combat Arms\CombatArms.exe"="C:\Nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe"
"C:\Nexon\Combat Arms\Engine.exe"="C:\Nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe"
"C:\Program Files\FlashFXP\FlashFXP.exe"="C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3"

======List of files/folders created in the last 1 months======

2008-11-30 15:24:59 ----D---- C:\rsit
2008-11-30 08:18:11 ----D---- C:\Program Files\Lavasoft
2008-11-30 07:17:30 ----SH---- C:\WINDOWS\system32\ilufazok.ini
2008-11-29 23:31:40 ----D---- C:\Program Files\Trend Micro
2008-11-29 23:27:47 ----D---- C:\Documents and Settings\Voltron\Application Data\Help
2008-11-29 21:30:04 ----D---- C:\WINDOWS\Prefetch
2008-11-29 21:26:41 ----D---- C:\Program Files\msn gaming zone
2008-11-29 21:25:36 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2008-11-29 21:16:46 ----A---- C:\WINDOWS\system32\spxcoins.dll
2008-11-29 21:16:46 ----A---- C:\WINDOWS\system32\irclass.dll
2008-11-29 21:16:35 ----RA---- C:\WINDOWS\SET3E.tmp
2008-11-29 21:16:33 ----RA---- C:\WINDOWS\SET32.tmp
2008-11-29 21:16:32 ----RA---- C:\WINDOWS\SET2F.tmp
2008-11-29 20:18:39 ----A---- C:\WINDOWS\ntbtlog.txt
2008-11-29 19:27:10 ----A---- C:\WINDOWS\system32\MSVCR71.dll
2008-11-29 19:27:10 ----A---- C:\WINDOWS\system32\MSVCP71.dll
2008-11-29 19:27:10 ----A---- C:\WINDOWS\system32\MFC71.dll
2008-11-29 19:27:09 ----D---- C:\Program Files\Alwil Software
2008-11-29 17:05:41 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-11-29 16:46:32 ----D---- C:\Program Files\Trojan Killer
2008-11-29 16:35:37 ----ASH---- C:\WINDOWS\system32\igeyimot.ini
2008-11-29 08:46:32 ----A---- C:\WINDOWS\system32\WNASPI32.DLL
2008-11-28 22:19:34 ----ASH---- C:\WINDOWS\system32\nimaboyu.exe
2008-11-28 10:57:06 ----D---- C:\Program Files\Team Craxtion
2008-11-28 10:53:47 ----RSD---- C:\WINDOWS\assembly
2008-11-28 10:53:25 ----D---- C:\WINDOWS\Microsoft.NET
2008-11-28 10:15:32 ----D---- C:\Documents and Settings\Voltron\Application Data\ImgBurn
2008-11-28 10:14:42 ----D---- C:\Program Files\ImgBurn
2008-11-28 06:10:38 ----D---- C:\XBOX
2008-11-28 05:45:54 ----D---- C:\Program Files\mIRC
2008-11-28 05:45:54 ----D---- C:\Documents and Settings\Voltron\Application Data\mIRC
2008-11-28 05:38:59 ----D---- C:\Documents and Settings\Voltron\Application Data\Xbins
2008-11-28 05:38:53 ----D---- C:\Documents and Settings\Voltron\Application Data\WinRAR
2008-11-28 05:17:57 ----D---- C:\Program Files\FlashFXP
2008-11-28 05:17:57 ----D---- C:\Documents and Settings\All Users\Application Data\FlashFXP
2008-11-28 04:18:40 ----ASH---- C:\WINDOWS\system32\funugipi.exe
2008-11-27 23:31:16 ----A---- C:\WINDOWS\system32\CmdLineExt.dll
2008-11-27 23:27:49 ----D---- C:\Program Files\GameSpy Arcade
2008-11-27 19:43:09 ----D---- C:\Program Files\XBAudio
2008-11-27 08:17:10 ----ASH---- C:\WINDOWS\system32\ravufuge.exe
2008-11-26 23:33:02 ----AHT---- C:\WINDOWS\system32\e6c7d5.dll
2008-11-26 23:33:02 ----AHT---- C:\WINDOWS\system32\35e8073.dll
2008-11-26 23:33:01 ----AHT---- C:\WINDOWS\system32\e68ccd0.dll
2008-11-26 23:33:01 ----AHT---- C:\WINDOWS\system32\23b10280.dll
2008-11-26 19:18:22 ----D---- C:\WINDOWS\pss
2008-11-26 18:59:25 ----D---- C:\VundoFix Backups
2008-11-26 18:59:25 ----A---- C:\VundoFix.txt
2008-11-26 18:56:28 ----A---- C:\WINDOWS\wininit.ini
2008-11-26 18:41:50 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-11-26 18:41:50 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-26 15:16:43 ----ASH---- C:\WINDOWS\system32\ajonegad.ini
2008-11-26 03:16:41 ----ASH---- C:\WINDOWS\system32\udefujed.ini
2008-11-26 03:15:41 ----D---- C:\Program Files\eMule
2008-11-26 02:13:51 ----D---- C:\Documents and Settings\Voltron\Application Data\Mozilla
2008-11-26 02:13:47 ----D---- C:\Program Files\Mozilla Firefox
2008-11-25 11:43:57 ----A---- C:\WINDOWS\system32\wmpns.dll
2008-11-24 23:53:29 ----D---- C:\Program Files\XBCD
2008-11-24 23:25:08 ----D---- C:\Documents and Settings\Voltron\Application Data\fltk.org
2008-11-24 23:15:47 ----D---- C:\WINDOWS\RegisteredPackages
2008-11-24 23:15:25 ----D---- C:\Program Files\Winamp
2008-11-24 23:15:25 ----D---- C:\Documents and Settings\Voltron\Application Data\Winamp
2008-11-24 23:07:10 ----D---- C:\Documents and Settings\Voltron\Application Data\LimeWire
2008-11-24 23:06:52 ----A---- C:\WINDOWS\system32\deploytk.dll
2008-11-24 23:06:05 ----D---- C:\Documents and Settings\Voltron\Application Data\Sun
2008-11-24 20:09:55 ----D---- C:\Nexon
2008-11-24 20:09:54 ----D---- C:\Documents and Settings\All Users\Application Data\NexonUS
2008-11-24 05:15:08 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2008-11-24 04:31:56 ----D---- C:\Documents and Settings\Voltron\Application Data\uTorrent
2008-11-24 04:28:34 ----D---- C:\Documents and Settings\Voltron\Application Data\Macromedia
2008-11-24 04:28:34 ----D---- C:\Documents and Settings\Voltron\Application Data\Adobe
2008-11-24 04:13:34 ----D---- C:\Documents and Settings\Voltron\Application Data\Ventrilo
2008-11-24 04:13:21 ----D---- C:\Program Files\Ventrilo
2008-11-24 04:13:20 ----A---- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2008-11-24 02:44:51 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2008-11-24 02:35:55 ----D---- C:\Documents and Settings\Voltron\Application Data\Xfire
2008-11-24 02:35:53 ----D---- C:\Program Files\Xfire
2008-11-24 02:30:20 ----D---- C:\WINDOWS\system32\LogFiles
2008-11-24 02:30:20 ----A---- C:\WINDOWS\system32\PnkBstrA.exe
2008-11-24 02:23:34 ----SHD---- C:\RECYCLER
2008-11-24 02:22:50 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2008-11-24 02:22:50 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2008-11-24 02:22:50 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2008-11-24 02:22:50 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2008-11-24 02:22:50 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2008-11-24 02:22:50 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2008-11-24 02:22:50 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2008-11-24 02:22:49 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2008-11-24 02:22:49 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2008-11-24 02:12:54 ----A---- C:\WINDOWS\system32\wpa.bak
2008-11-24 02:08:24 ----D---- C:\WINDOWS\system32\Lang
2008-11-24 02:05:58 ----D---- C:\WINDOWS\system32\RTCOM
2008-11-24 02:05:56 ----A---- C:\WINDOWS\system32\ksuser.dll
2008-11-24 02:05:32 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2008-11-24 02:05:29 ----A---- C:\WINDOWS\SOUNDMAN.EXE
2008-11-24 02:05:29 ----A---- C:\WINDOWS\RtlUpd.exe
2008-11-24 02:05:29 ----A---- C:\WINDOWS\RTLCPL.EXE
2008-11-24 02:05:27 ----D---- C:\Program Files\Realtek
2008-11-24 02:05:27 ----A---- C:\WINDOWS\RTHDCPL.EXE
2008-11-24 02:05:27 ----A---- C:\WINDOWS\MicCal.exe
2008-11-24 02:05:27 ----A---- C:\WINDOWS\ALCWZRD.EXE
2008-11-24 02:05:27 ----A---- C:\WINDOWS\ALCMTR.EXE
2008-11-24 02:05:23 ----A---- C:\WINDOWS\RtlExUpd.dll
2008-11-24 02:05:23 ----A---- C:\WINDOWS\HideWin.exe
2008-11-24 02:04:02 ----D---- C:\WINDOWS\system32\AGEIA
2008-11-24 02:04:02 ----D---- C:\Program Files\AGEIA Technologies
2008-11-24 02:03:57 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2008-11-24 02:03:50 ----D---- C:\WINDOWS\nview
2008-11-24 02:03:50 ----A---- C:\WINDOWS\system32\nvudisp.exe
2008-11-24 02:02:09 ----HD---- C:\Program Files\InstallShield Installation Information
2008-11-24 02:01:42 ----D---- C:\Program Files\NVIDIA Corporation
2008-11-24 02:00:58 ----D---- C:\Program Files\Common Files\InstallShield
2008-11-24 02:00:32 ----A---- C:\WINDOWS\system32\CapabilityTable.exe
2008-11-24 02:00:24 ----A---- C:\WINDOWS\system32\nvuide.exe
2008-11-24 02:00:23 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-11-24 01:59:30 ----A---- C:\WINDOWS\system32\nvunrm.exe
2008-11-24 01:59:29 ----A---- C:\WINDOWS\system32\nvusmb.exe
2008-11-24 01:59:20 ----A---- C:\WINDOWS\system32\NVUNINST.EXE
2008-11-24 01:59:19 ----D---- C:\Documents and Settings\Voltron\Application Data\InstallShield
2008-11-24 01:59:02 ----D---- C:\NVIDIA
2008-11-24 01:57:36 ----D---- C:\Documents and Settings\Voltron\Application Data\Identities
2008-11-24 01:57:35 ----HD---- C:\Program Files\Uninstall Information
2008-11-24 01:57:30 ----SD---- C:\Documents and Settings\Voltron\Application Data\Microsoft
2008-11-24 01:57:30 ----ASH---- C:\Documents and Settings\Voltron\Application Data\desktop.ini
2008-11-24 01:56:58 ----D---- C:\WINDOWS\SoftwareDistribution
2008-11-24 01:56:57 ----SD---- C:\WINDOWS\system32\Microsoft
2008-11-24 01:56:57 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-11-24 01:54:11 ----D---- C:\WINDOWS\system32\xircom
2008-11-24 01:54:11 ----D---- C:\Program Files\xerox
2008-11-24 01:54:11 ----D---- C:\Program Files\microsoft frontpage
2008-11-24 01:54:09 ----D---- C:\DELL
2008-11-24 01:54:03 ----A---- C:\WINDOWS\control.ini
2008-11-24 01:54:03 ----A---- C:\AUTOEXEC.BAT
2008-11-24 01:53:50 ----A---- C:\WINDOWS\OEWABLog.txt
2008-11-24 01:53:47 ----A---- C:\WINDOWS\system32\mapi32.dll
2008-11-24 01:53:10 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-11-24 01:53:10 ----RD---- C:\WINDOWS\Offline Web Pages
2008-11-24 01:53:06 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2008-11-24 01:53:03 ----HD---- C:\Program Files\WindowsUpdate
2008-11-24 01:52:50 ----D---- C:\WINDOWS\system32\DirectX
2008-11-24 01:52:35 ----A---- C:\WINDOWS\system32\atrace.dll
2008-11-24 01:52:33 ----A---- C:\WINDOWS\system32\desktop.ini
2008-11-24 01:52:33 ----A---- C:\WINDOWS\desktop.ini
2008-11-24 01:52:28 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2008-11-24 01:52:27 ----A---- C:\WINDOWS\system32\acctres.dll
2008-11-24 01:52:26 ----D---- C:\Program Files\Common Files\Services
2008-11-24 01:52:25 ----SD---- C:\WINDOWS\Tasks
2008-11-24 01:52:25 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2008-11-24 01:52:24 ----D---- C:\Program Files\Common Files\MSSoap
2008-11-24 01:52:21 ----D---- C:\WINDOWS\srchasst
2008-11-24 01:52:20 ----D---- C:\WINDOWS\system32\Macromed
2008-11-24 01:52:18 ----A---- C:\WINDOWS\system32\wuweb.dll
2008-11-24 01:52:18 ----A---- C:\WINDOWS\system32\wups.dll
2008-11-24 01:52:18 ----A---- C:\WINDOWS\system32\wucltui.dll
2008-11-24 01:52:18 ----A---- C:\WINDOWS\system32\wuauserv.dll
2008-11-24 01:52:18 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2008-11-24 01:52:18 ----A---- C:\WINDOWS\system32\wuaueng.dll
2008-11-24 01:52:18 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2008-11-24 01:52:18 ----A---- C:\WINDOWS\system32\wuauclt.exe
2008-11-24 01:52:17 ----A---- C:\WINDOWS\system32\wuapi.dll
2008-11-24 01:52:17 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2008-11-24 01:52:17 ----A---- C:\WINDOWS\system32\qmgr.dll
2008-11-24 01:52:17 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2008-11-24 01:52:17 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2008-11-24 01:52:14 ----D---- C:\Program Files\Movie Maker
2008-11-24 01:52:11 ----A---- C:\WINDOWS\system32\safrslv.dll
2008-11-24 01:52:11 ----A---- C:\WINDOWS\system32\safrdm.dll
2008-11-24 01:52:11 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2008-11-24 01:52:11 ----A---- C:\WINDOWS\system32\racpldlg.dll
2008-11-24 01:52:09 ----A---- C:\WINDOWS\system32\fltMc.exe
2008-11-24 01:52:09 ----A---- C:\WINDOWS\system32\fltlib.dll
2008-11-24 01:52:08 ----D---- C:\WINDOWS\system32\Restore
2008-11-24 01:52:08 ----A---- C:\WINDOWS\system32\srsvc.dll
2008-11-24 01:52:08 ----A---- C:\WINDOWS\system32\srrstr.dll
2008-11-24 01:52:08 ----A---- C:\WINDOWS\system32\srclient.dll
2008-11-24 01:52:07 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2008-11-24 01:52:07 ----A---- C:\WINDOWS\system32\msconf.dll
2008-11-24 01:52:07 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2008-11-24 01:52:07 ----A---- C:\WINDOWS\system32\mnmdd.dll
2008-11-24 01:52:07 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2008-11-24 01:52:07 ----A---- C:\WINDOWS\system32\ils.dll
2008-11-24 01:52:05 ----D---- C:\Program Files\NetMeeting
2008-11-24 01:52:05 ----A---- C:\WINDOWS\system32\msoert2.dll
2008-11-24 01:52:05 ----A---- C:\WINDOWS\system32\msoeacct.dll
2008-11-24 01:52:04 ----A---- C:\WINDOWS\system32\inetres.dll
2008-11-24 01:52:04 ----A---- C:\WINDOWS\system32\inetcomm.dll
2008-11-24 01:52:02 ----D---- C:\Program Files\Outlook Express
2008-11-24 01:52:02 ----A---- C:\WINDOWS\system32\schedsvc.dll
2008-11-24 01:52:02 ----A---- C:\WINDOWS\system32\mstinit.exe
2008-11-24 01:52:02 ----A---- C:\WINDOWS\system32\mstask.dll
2008-11-24 01:52:02 ----A---- C:\WINDOWS\system32\isign32.dll
2008-11-24 01:52:02 ----A---- C:\WINDOWS\system32\inetcfg.dll
2008-11-24 01:52:02 ----A---- C:\WINDOWS\system32\icwphbk.dll
2008-11-24 01:52:02 ----A---- C:\WINDOWS\system32\icwdial.dll
2008-11-24 01:51:58 ----D---- C:\Program Files\Common Files\System
2008-11-24 01:51:57 ----D---- C:\Program Files\Internet Explorer
2008-11-24 01:51:49 ----D---- C:\Program Files\ComPlus Applications
2008-11-24 01:51:48 ----A---- C:\WINDOWS\vbaddin.ini
2008-11-24 01:51:48 ----A---- C:\WINDOWS\vb.ini
2008-11-24 01:51:44 ----D---- C:\WINDOWS\Registration
2008-11-24 01:51:24 ----D---- C:\Program Files\Windows Media Player
2008-11-24 01:51:24 ----D---- C:\Program Files\Online Services
2008-11-24 01:51:20 ----D---- C:\Program Files\Messenger
2008-11-24 01:51:18 ----A---- C:\WINDOWS\system32\write.exe
2008-11-24 01:51:12 ----A---- C:\WINDOWS\system32\sndvol32.exe
2008-11-24 01:51:12 ----A---- C:\WINDOWS\system32\hticons.dll
2008-11-24 01:51:11 ----A---- C:\WINDOWS\system32\winchat.exe
2008-11-24 01:51:11 ----A---- C:\WINDOWS\system32\avwav.dll
2008-11-24 01:51:11 ----A---- C:\WINDOWS\system32\avtapi.dll
2008-11-24 01:51:11 ----A---- C:\WINDOWS\system32\avmeter.dll
2008-11-24 01:51:06 ----A---- C:\WINDOWS\system32\getuname.dll
2008-11-24 01:51:06 ----A---- C:\WINDOWS\system32\charmap.exe
2008-11-24 01:51:06 ----A---- C:\WINDOWS\system32\calc.exe
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\tslabels.ini
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\tskill.exe
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\tscon.exe
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\shadow.exe
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\rwinsta.exe
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\reset.exe
2008-11-24 01:51:04 ----A---- C:\WINDOWS\system32\regini.exe
2008-11-24 01:51:04 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2008-11-24 01:51:04 ----A---- C:\WINDOWS\system32\qwinsta.exe
2008-11-24 01:51:04 ----A---- C:\WINDOWS\system32\qappsrv.exe
2008-11-24 01:51:04 ----A---- C:\WINDOWS\system32\msg.exe
2008-11-24 01:51:04 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2008-11-24 01:51:04 ----A---- C:\WINDOWS\system32\logoff.exe
2008-11-24 01:51:04 ----A---- C:\WINDOWS\system32\cdmodem.dll
2008-11-24 01:51:03 ----A---- C:\WINDOWS\system32\stclient.dll
2008-11-24 01:51:03 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2008-11-24 01:51:03 ----A---- C:\WINDOWS\system32\mtxex.dll
2008-11-24 01:51:03 ----A---- C:\WINDOWS\system32\mtxdm.dll
2008-11-24 01:51:03 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2008-11-24 01:51:03 ----A---- C:\WINDOWS\system32\comsnap.dll
2008-11-24 01:51:03 ----A---- C:\WINDOWS\system32\comrepl.dll

2008-11-24 01:51:03 ----A---- C:\WINDOWS\system32\comaddin.dll
2008-11-24 01:51:00 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2008-11-24 01:50:51 ----D---- C:\Program Files\MSN
2008-11-24 01:50:50 ----D---- C:\Program Files\Windows NT
2008-11-24 01:50:50 ----A---- C:\WINDOWS\system32\sndrec32.exe
2008-11-24 01:50:50 ----A---- C:\WINDOWS\system32\mspaint.exe
2008-11-24 01:50:50 ----A---- C:\WINDOWS\system32\mplay32.exe
2008-11-24 01:50:50 ----A---- C:\WINDOWS\system32\hypertrm.dll
2008-11-24 01:50:50 ----A---- C:\WINDOWS\system32\accwiz.exe
2008-11-24 01:50:49 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2008-11-24 01:50:49 ----A---- C:\WINDOWS\system32\clipbrd.exe
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\termsrv.dll
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\sessmgr.exe
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\remotepg.dll
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\rdshost.exe
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\rdpclip.exe
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\rdchost.dll
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\qprocess.exe
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\mstscax.dll
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\mstsc.exe
2008-11-24 01:50:47 ----D---- C:\WINDOWS\system32\MsDtc
2008-11-24 01:50:47 ----A---- C:\WINDOWS\system32\xolehlp.dll
2008-11-24 01:50:47 ----A---- C:\WINDOWS\system32\mtxoci.dll
2008-11-24 01:50:47 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2008-11-24 01:50:47 ----A---- C:\WINDOWS\system32\msdtctm.dll
2008-11-24 01:50:47 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2008-11-24 01:50:47 ----A---- C:\WINDOWS\system32\msdtclog.dll
2008-11-24 01:50:47 ----A---- C:\WINDOWS\system32\icaapi.dll
2008-11-24 01:50:47 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2008-11-24 01:50:46 ----D---- C:\WINDOWS\system32\Com
2008-11-24 01:50:46 ----A---- C:\WINDOWS\system32\msdtc.exe
2008-11-24 01:50:46 ----A---- C:\WINDOWS\system32\colbact.dll
2008-11-24 01:50:46 ----A---- C:\WINDOWS\system32\clbcatex.dll
2008-11-24 01:50:46 ----A---- C:\WINDOWS\system32\catsrvut.dll
2008-11-24 01:50:46 ----A---- C:\WINDOWS\system32\catsrvps.dll
2008-11-24 01:50:45 ----A---- C:\WINDOWS\system32\comuid.dll
2008-11-24 01:50:45 ----A---- C:\WINDOWS\system32\comsvcs.dll
2008-11-24 01:50:45 ----A---- C:\WINDOWS\system32\clbcatq.dll
2008-11-24 01:50:45 ----A---- C:\WINDOWS\system32\catsrv.dll
2008-11-24 01:50:41 ----A---- C:\WINDOWS\system32\servdeps.dll
2008-11-24 01:50:41 ----A---- C:\WINDOWS\system32\mmfutil.dll
2008-11-24 01:50:41 ----A---- C:\WINDOWS\system32\licwmi.dll
2008-11-24 01:50:41 ----A---- C:\WINDOWS\system32\cmprops.dll
2008-11-23 19:49:45 ----A---- C:\WINDOWS\system32\h323log.txt
2008-11-23 19:47:32 ----A---- C:\WINDOWS\imsins.BAK
2008-11-23 19:47:30 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-11-23 19:47:29 ----SHD---- C:\WINDOWS\Installer
2008-11-23 19:47:29 ----D---- C:\Program Files\Common Files\ODBC
2008-11-23 19:47:29 ----A---- C:\WINDOWS\ODBCINST.INI
2008-11-23 19:47:26 ----RD---- C:\Program Files
2008-11-23 19:47:26 ----D---- C:\Program Files\Common Files\SpeechEngines
2008-11-23 19:47:26 ----D---- C:\Program Files\Common Files\Microsoft Shared
2008-11-23 19:47:26 ----D---- C:\Program Files\Common Files
2008-11-23 19:47:17 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2008-11-23 19:47:16 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2008-11-23 19:47:15 ----A---- C:\WINDOWS\system32\CONFIG.TMP
2008-11-23 19:47:14 ----A---- C:\WINDOWS\system32\storprop.dll
2008-11-23 19:47:08 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2008-11-23 19:47:05 ----RA---- C:\WINDOWS\SET8.tmp
2008-11-23 19:47:03 ----RA---- C:\WINDOWS\SET4.tmp
2008-11-23 19:47:02 ----RA---- C:\WINDOWS\SET3.tmp
2008-11-23 19:46:57 ----D---- C:\WINDOWS\system32\CatRoot2
2008-11-23 19:46:57 ----D---- C:\WINDOWS\system32\CatRoot
2008-11-23 19:46:51 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-11-23 19:46:37 ----A---- C:\WINDOWS\setuplog.txt
2008-11-23 19:46:34 ----SHD---- C:\System Volume Information
2008-11-23 19:46:34 ----D---- C:\Documents and Settings
2008-11-23 19:40:42 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-11-23 19:40:42 ----RSD---- C:\WINDOWS\Fonts
2008-11-23 19:40:42 ----RD---- C:\WINDOWS\Web
2008-11-23 19:40:42 ----HD---- C:\WINDOWS\inf
2008-11-23 19:40:42 ----D---- C:\WINDOWS\WinSxS
2008-11-23 19:40:42 ----D---- C:\WINDOWS\twain_32
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Temp
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\wins
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\wbem
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\usmt
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\spool
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\ShellExt
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\Setup
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\ras
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\oobe
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\npp
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\mui
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\inetsrv
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\IME
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\icsxml
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\ias
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\export
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\drivers
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\dhcp
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\config
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\3com_dmi
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\3076
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\2052
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\1054
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\1042
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\1041
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\1037
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\1033
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\1031
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\1028
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\1025
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system
2008-11-23 19:40:42 ----D---- C:\WINDOWS\security
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Resources
2008-11-23 19:40:42 ----D---- C:\WINDOWS\repair
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Provisioning
2008-11-23 19:40:42 ----D---- C:\WINDOWS\PeerNet
2008-11-23 19:40:42 ----D---- C:\WINDOWS\pchealth
2008-11-23 19:40:42 ----D---- C:\WINDOWS\mui
2008-11-23 19:40:42 ----D---- C:\WINDOWS\msapps
2008-11-23 19:40:42 ----D---- C:\WINDOWS\msagent
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Media
2008-11-23 19:40:42 ----D---- C:\WINDOWS\java
2008-11-23 19:40:42 ----D---- C:\WINDOWS\ime
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Help
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Driver Cache
2008-11-23 19:40:42 ----D---- C:\WINDOWS\dell
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Debug
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Cursors
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Connection Wizard
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Config
2008-11-23 19:40:42 ----D---- C:\WINDOWS\AppPatch
2008-11-23 19:40:42 ----D---- C:\WINDOWS\addins
2008-11-23 19:40:42 ----D---- C:\WINDOWS
2008-11-20 14:44:26 ----A---- C:\WINDOWS\system32\xfcodec.dll

======List of files/folders modified in the last 1 months======

2008-11-30 07:17:26 ----ASH---- C:\WINDOWS\system32\silugihi.dll
2008-11-30 07:17:26 ----ASH---- C:\WINDOWS\system32\kozafuli.dll
2008-11-29 21:25:24 ----A---- C:\WINDOWS\win.ini
2008-11-29 21:16:51 ----A---- C:\WINDOWS\system.ini
2008-11-29 16:35:35 ----ASH---- C:\WINDOWS\system32\tomiyegi.dll
2008-11-29 16:35:35 ----ASH---- C:\WINDOWS\system32\jalopeya.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ASPI32;ASPI32; C:\WINDOWS\system32\drivers\ASPI32.sys [1999-09-10 25244]
R1 Tcpip6;Microsoft IPv6 Protocol Driver; C:\WINDOWS\system32\DRIVERS\tcpip6.sys [2004-08-12 223616]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-12 12032]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-12 60800]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2004-08-12 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-10-13 4879360]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-12 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-12 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-10-07 6133856]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-02-17 34176]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-02-17 13056]
R3 tunmp;Microsoft Tun Miniport Adapter Driver; C:\WINDOWS\system32\DRIVERS\tunmp.sys [2004-08-12 12416]
R3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-12 31616]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-12 26624]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-12 57600]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-12 17024]
R3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-12 26496]
R3 XBAudio;XBox Audio Module; C:\WINDOWS\system32\drivers\xbaudio.sys [2004-05-16 8844]
R3 XBCD;XBCD Kernel Module; C:\WINDOWS\System32\Drivers\xbcd.sys [2005-05-13 19212]
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 6to4;IPv6 Helper Service; C:\WINDOWS\system32\svchost.exe [2004-08-12 14336]
R2 ForceWare Intelligent Application Manager (IAM);ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe [2006-02-17 139264]
R2 ForcewareWebInterface;Forceware Web Interface; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe [2006-02-17 20543]
R2 nSvcIp;ForceWare IP service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe [2006-02-17 127035]
R2 nSvcLog;ForceWare user log service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe [2006-02-17 61503]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-10-07 163908]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2008-11-24 66872]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2008-11-29 201816]
S2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-09-10 611664]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]

-----------------EOF-----------------

#4 bigz123

bigz123
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:09:50 PM

Posted 30 November 2008 - 04:39 PM

Pop ups have completely stopped now using firefox... Internet Explorer is not working at all just shows me the page cannot be displayed error no matter where i go. not much more to update there... random internet issues.. getting disconected from Xfire periodically and games have thier moments where they just dont connect for some reason... along with firefox keeps being redirected from certain sites to blank pages or non existant pages or evan adds...

#5 bigz123

bigz123
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:09:50 PM

Posted 30 November 2008 - 04:49 PM

by the way... hi SAM nice to meet u thank you for your help hope we can get this fixed

#6 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:08:50 PM

Posted 30 November 2008 - 04:52 PM

Good info. Thank you.

Please download the OTMoveIt3 by OldTimer.
  • Save it to your desktop.
  • Please click OTMoveIt3 and then click >> run.
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :files
    C:\WINDOWS\system32\silugihi.dll
    C:\WINDOWS\system32\kozafuli.dll
    C:\WINDOWS\system32\tomiyegi.dll
    C:\WINDOWS\system32\jalopeya.dll
    C:\WINDOWS\system32\ajonegad.ini
    C:\WINDOWS\system32\udefujed.ini
    C:\WINDOWS\system32\ravufuge.exe
    C:\WINDOWS\system32\e6c7d5.dll
    C:\WINDOWS\system32\35e8073.dll
    C:\WINDOWS\system32\e68ccd0.dll
    C:\WINDOWS\system32\23b10280.dll
    C:\WINDOWS\system32\funugipi.exe
    C:\WINDOWS\system32\nimaboyu.exe
    C:\WINDOWS\system32\igeyimot.ini
    C:\WINDOWS\SET3E.tmp
    C:\WINDOWS\SET32.tmp
    C:\WINDOWS\SET2F.tmp
    
    :reg
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a8a6329d]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CPMab950101]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fadugupage]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLS"=-
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "nwiz"=-
    "Alcmtr"=-
    "CPMab950101"=-
    "fadugupage"=-
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ee2fbd1-70f2-4469-bb9e-c7edf9073289}]
    
    :Commands
    [EmptyTemp]
    [Reboot]
  • Return to OTMoveIt3, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.


=================


Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
  • Make sure you are connected to the Internet.
  • Double-click on Download_mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Quick Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.


And also post a new log from RSIT.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#7 bigz123

bigz123
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:09:50 PM

Posted 30 November 2008 - 05:06 PM

Move it log 1
========== FILES ==========
DllUnregisterServer procedure not found in C:\WINDOWS\system32\silugihi.dll
C:\WINDOWS\system32\silugihi.dll NOT unregistered.
C:\WINDOWS\system32\silugihi.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\kozafuli.dll
C:\WINDOWS\system32\kozafuli.dll NOT unregistered.
C:\WINDOWS\system32\kozafuli.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\tomiyegi.dll
C:\WINDOWS\system32\tomiyegi.dll NOT unregistered.
C:\WINDOWS\system32\tomiyegi.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\jalopeya.dll
C:\WINDOWS\system32\jalopeya.dll NOT unregistered.
C:\WINDOWS\system32\jalopeya.dll moved successfully.
C:\WINDOWS\system32\ajonegad.ini moved successfully.
C:\WINDOWS\system32\udefujed.ini moved successfully.
C:\WINDOWS\system32\ravufuge.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\e6c7d5.dll
C:\WINDOWS\system32\e6c7d5.dll NOT unregistered.
C:\WINDOWS\system32\e6c7d5.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\35e8073.dll
C:\WINDOWS\system32\35e8073.dll NOT unregistered.
C:\WINDOWS\system32\35e8073.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\e68ccd0.dll
C:\WINDOWS\system32\e68ccd0.dll NOT unregistered.
C:\WINDOWS\system32\e68ccd0.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\23b10280.dll
C:\WINDOWS\system32\23b10280.dll NOT unregistered.
C:\WINDOWS\system32\23b10280.dll moved successfully.
C:\WINDOWS\system32\funugipi.exe moved successfully.
C:\WINDOWS\system32\nimaboyu.exe moved successfully.
C:\WINDOWS\system32\igeyimot.ini moved successfully.
C:\WINDOWS\SET3E.tmp moved successfully.
C:\WINDOWS\SET32.tmp moved successfully.
C:\WINDOWS\SET2F.tmp moved successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a8a6329d\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CPMab950101\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fadugupage\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLS deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\nwiz deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Alcmtr deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\CPMab950101 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\fadugupage deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ee2fbd1-70f2-4469-bb9e-c7edf9073289}\\ deleted successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Voltron\LOCALS~1\Temp\~e5.0001.dir.0000\~df394b.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Voltron\LOCALS~1\Temp\etilqs_pGVeHy0QyfcdeKdLqXEV scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Voltron\LOCALS~1\Temp\~e5.0001 scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Voltron\Local Settings\Application Data\Mozilla\Firefox\Profiles\aon6ahuv.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Voltron\Local Settings\Application Data\Mozilla\Firefox\Profiles\aon6ahuv.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Voltron\Local Settings\Application Data\Mozilla\Firefox\Profiles\aon6ahuv.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Voltron\Local Settings\Application Data\Mozilla\Firefox\Profiles\aon6ahuv.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Voltron\Local Settings\Application Data\Mozilla\Firefox\Profiles\aon6ahuv.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11302008_155744

Files moved on Reboot...
C:\DOCUME~1\Voltron\LOCALS~1\Temp\~e5.0001.dir.0000\~df394b.tmp moved successfully.
File C:\DOCUME~1\Voltron\LOCALS~1\Temp\etilqs_pGVeHy0QyfcdeKdLqXEV not found!
C:\DOCUME~1\Voltron\LOCALS~1\Temp\~e5.0001 moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
C:\Documents and Settings\Voltron\Local Settings\Application Data\Mozilla\Firefox\Profiles\aon6ahuv.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Voltron\Local Settings\Application Data\Mozilla\Firefox\Profiles\aon6ahuv.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Voltron\Local Settings\Application Data\Mozilla\Firefox\Profiles\aon6ahuv.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Voltron\Local Settings\Application Data\Mozilla\Firefox\Profiles\aon6ahuv.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Voltron\Local Settings\Application Data\Mozilla\Firefox\Profiles\aon6ahuv.default\urlclassifier3.sqlite moved successfully.

#8 bigz123

bigz123
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:09:50 PM

Posted 30 November 2008 - 05:15 PM

Malwarebytes' Anti-Malware 1.30
Database version: 1439
Windows 5.1.2600 Service Pack 2

11/30/2008 4:11:06 PM
mbam-log-2008-11-30 (16-11-06).txt

Scan type: Quick Scan
Objects scanned: 44351
Time elapsed: 1 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 3
Registry Values Infected: 3
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\hegiguve.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fadugupage (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo) -> Data: c:\windows\system32\hegiguve.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\hegiguve.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo) -> Data: system32\hegiguve.dll -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\hegiguve.dll (Trojan.Vundo) -> Delete on reboot.

#9 bigz123

bigz123
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:09:50 PM

Posted 30 November 2008 - 05:19 PM

Logfile of random's system information tool 1.04 (written by random/random)
Run by Voltron at 2008-11-30 16:17:04
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 47 GB (29%) free of 160 GB
Total RAM: 2046 MB (80% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:17:05 PM, on 11/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Voltron\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Voltron.exe

O2 - BHO: (no name) - {3ee2fbd1-70f2-4469-bb9e-c7edf9073289} - C:\WINDOWS\system32\yinazeku.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Program Files\Trend Micro\HijackThis\HijackThis.exe /startupscan
O4 - HKUS\S-1-5-19\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: c:\windows\system32\silugihi.dll, c:\windows\system32\jalopeya.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 4162 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ee2fbd1-70f2-4469-bb9e-c7edf9073289}]
C:\WINDOWS\system32\yinazeku.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-10-07 13574144]
"nTrayFw"=C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe [2006-02-17 270336]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-10-07 86016]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-10-09 17021440]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2008-06-19 57344]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-09-16 1833296]
"HijackThis startup scan"=C:\Program Files\Trend Micro\HijackThis\HijackThis.exe [2008-11-29 396288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="c:\windows\system32\silugihi.dll, c:\windows\system32\jalopeya.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server"
"H:\Battlefield 2142\BF2142.exe"="H:\Battlefield 2142\BF2142.exe:*:Enabled:Battlefield 2"
"C:\Program Files\Xfire\xfire.exe"="C:\Program Files\Xfire\xfire.exe:*:Enabled:Xfire"
"C:\Program Files\Ventrilo\Ventrilo.exe"="C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe"
"H:\CCP\EVE\bin\ExeFile.exe"="H:\CCP\EVE\bin\ExeFile.exe:*:Enabled:CCP ExeFile"
"C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe"="C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"C:\Nexon\Combat Arms\CombatArms.exe"="C:\Nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe"
"C:\Nexon\Combat Arms\Engine.exe"="C:\Nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe"
"C:\Nexon\Combat Arms\NMService.exe"="C:\Nexon\Combat Arms\NMService.exe:*:Enabled:Nexon Messenger Core"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\WINDOWS\system32\wbem\wmiprvse.exe"="C:\WINDOWS\system32\wbem\wmiprvse.exe:*:Enabled:wmiprvse"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe:*:Enabled:nSvcIp"
"C:\Program Files\EA GAMES\Battlefield 2\BF2.exe"="C:\Program Files\EA GAMES\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2"
"H:\Battlefield 2\BF2.exe"="H:\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2"
"C:\WINDOWS\system32\logonui.exe"="C:\WINDOWS\system32\logonui.exe:*:Enabled:logonui"
"C:\Program Files\GameSpy Arcade\Aphex.exe"="C:\Program Files\GameSpy Arcade\Aphex.exe:*:Enabled:GameSpy Arcade"
"C:\Program Files\Firefly Studios\Stronghold Crusader\Stronghold_Crusader_Extreme.exe"="C:\Program Files\Firefly Studios\Stronghold Crusader\Stronghold_Crusader_Extreme.exe:*:Enabled:Stronghold Crusader"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Program Files\FlashFXP\FlashFXP.exe"="C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3"
"C:\Documents and Settings\Voltron\Desktop\auto_xbins_2008\xbins.exe"="C:\Documents and Settings\Voltron\Desktop\auto_xbins_2008\xbins.exe:*:Enabled:xbins"
"C:\XBOX\auto_xbins_2008\xbins.exe"="C:\XBOX\auto_xbins_2008\xbins.exe:*:Enabled:xbins"
"C:\WINDOWS\system32\lsass.exe"="C:\WINDOWS\system32\lsass.exe:*:Enabled:lsass"
"C:\Documents and Settings\Voltron\Desktop\xbins.exe"="C:\Documents and Settings\Voltron\Desktop\xbins.exe:*:Enabled:xbins"
"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe:*:Enabled:nSvcAppFlt"
"C:\Program Files\mIRC\mirc.exe"="C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\WINDOWS\system32\spoolsv.exe"="C:\WINDOWS\system32\spoolsv.exe:*:Enabled:spoolsv"
"C:\WINDOWS\explorer.exe"="C:\WINDOWS\explorer.exe:*:Enabled:Explorer"
"C:\WINDOWS\system32\winlogon.exe"="C:\WINDOWS\system32\winlogon.exe:*:Enabled:winlogon"
"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe:*:Enabled:nSvcLog"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Nexon\Combat Arms\CombatArms.exe"="C:\Nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe"
"C:\Nexon\Combat Arms\Engine.exe"="C:\Nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe"
"C:\Program Files\FlashFXP\FlashFXP.exe"="C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3"

======List of files/folders created in the last 1 months======

2008-11-30 16:07:59 ----D---- C:\Documents and Settings\Voltron\Application Data\Malwarebytes
2008-11-30 16:07:55 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-11-30 16:07:55 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-11-30 15:57:44 ----D---- C:\_OTMoveIt
2008-11-30 15:24:59 ----D---- C:\rsit
2008-11-30 08:18:11 ----D---- C:\Program Files\Lavasoft
2008-11-30 07:17:30 ----SH---- C:\WINDOWS\system32\ilufazok.ini
2008-11-29 23:31:40 ----D---- C:\Program Files\Trend Micro
2008-11-29 23:27:47 ----D---- C:\Documents and Settings\Voltron\Application Data\Help
2008-11-29 21:30:04 ----D---- C:\WINDOWS\Prefetch
2008-11-29 21:26:41 ----D---- C:\Program Files\msn gaming zone
2008-11-29 21:25:36 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2008-11-29 21:16:46 ----A---- C:\WINDOWS\system32\spxcoins.dll
2008-11-29 21:16:46 ----A---- C:\WINDOWS\system32\irclass.dll
2008-11-29 20:18:39 ----A---- C:\WINDOWS\ntbtlog.txt
2008-11-29 19:27:10 ----A---- C:\WINDOWS\system32\MSVCR71.dll
2008-11-29 19:27:10 ----A---- C:\WINDOWS\system32\MSVCP71.dll
2008-11-29 19:27:10 ----A---- C:\WINDOWS\system32\MFC71.dll
2008-11-29 19:27:09 ----D---- C:\Program Files\Alwil Software
2008-11-29 17:05:41 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-11-29 16:46:32 ----D---- C:\Program Files\Trojan Killer
2008-11-29 08:46:32 ----A---- C:\WINDOWS\system32\WNASPI32.DLL
2008-11-28 10:57:06 ----D---- C:\Program Files\Team Craxtion
2008-11-28 10:53:47 ----RSD---- C:\WINDOWS\assembly
2008-11-28 10:53:25 ----D---- C:\WINDOWS\Microsoft.NET
2008-11-28 10:15:32 ----D---- C:\Documents and Settings\Voltron\Application Data\ImgBurn
2008-11-28 10:14:42 ----D---- C:\Program Files\ImgBurn
2008-11-28 06:10:38 ----D---- C:\XBOX
2008-11-28 05:45:54 ----D---- C:\Program Files\mIRC
2008-11-28 05:45:54 ----D---- C:\Documents and Settings\Voltron\Application Data\mIRC
2008-11-28 05:38:59 ----D---- C:\Documents and Settings\Voltron\Application Data\Xbins
2008-11-28 05:38:53 ----D---- C:\Documents and Settings\Voltron\Application Data\WinRAR
2008-11-28 05:17:57 ----D---- C:\Program Files\FlashFXP
2008-11-28 05:17:57 ----D---- C:\Documents and Settings\All Users\Application Data\FlashFXP
2008-11-27 23:31:16 ----A---- C:\WINDOWS\system32\CmdLineExt.dll
2008-11-27 23:27:49 ----D---- C:\Program Files\GameSpy Arcade
2008-11-27 19:43:09 ----D---- C:\Program Files\XBAudio
2008-11-26 19:18:22 ----D---- C:\WINDOWS\pss
2008-11-26 18:59:25 ----D---- C:\VundoFix Backups
2008-11-26 18:59:25 ----A---- C:\VundoFix.txt
2008-11-26 18:56:28 ----A---- C:\WINDOWS\wininit.ini
2008-11-26 18:41:50 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-11-26 18:41:50 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-26 03:15:41 ----D---- C:\Program Files\eMule
2008-11-26 02:13:51 ----D---- C:\Documents and Settings\Voltron\Application Data\Mozilla
2008-11-26 02:13:47 ----D---- C:\Program Files\Mozilla Firefox
2008-11-25 11:43:57 ----A---- C:\WINDOWS\system32\wmpns.dll
2008-11-24 23:53:29 ----D---- C:\Program Files\XBCD
2008-11-24 23:25:08 ----D---- C:\Documents and Settings\Voltron\Application Data\fltk.org
2008-11-24 23:15:47 ----D---- C:\WINDOWS\RegisteredPackages
2008-11-24 23:15:25 ----D---- C:\Program Files\Winamp
2008-11-24 23:15:25 ----D---- C:\Documents and Settings\Voltron\Application Data\Winamp
2008-11-24 23:07:10 ----D---- C:\Documents and Settings\Voltron\Application Data\LimeWire
2008-11-24 23:06:52 ----A---- C:\WINDOWS\system32\deploytk.dll
2008-11-24 23:06:05 ----D---- C:\Documents and Settings\Voltron\Application Data\Sun
2008-11-24 20:09:55 ----D---- C:\Nexon
2008-11-24 20:09:54 ----D---- C:\Documents and Settings\All Users\Application Data\NexonUS
2008-11-24 05:15:08 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2008-11-24 04:31:56 ----D---- C:\Documents and Settings\Voltron\Application Data\uTorrent
2008-11-24 04:28:34 ----D---- C:\Documents and Settings\Voltron\Application Data\Macromedia
2008-11-24 04:28:34 ----D---- C:\Documents and Settings\Voltron\Application Data\Adobe
2008-11-24 04:13:34 ----D---- C:\Documents and Settings\Voltron\Application Data\Ventrilo
2008-11-24 04:13:21 ----D---- C:\Program Files\Ventrilo
2008-11-24 04:13:20 ----A---- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2008-11-24 02:44:51 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2008-11-24 02:35:55 ----D---- C:\Documents and Settings\Voltron\Application Data\Xfire
2008-11-24 02:35:53 ----D---- C:\Program Files\Xfire
2008-11-24 02:30:20 ----D---- C:\WINDOWS\system32\LogFiles
2008-11-24 02:30:20 ----A---- C:\WINDOWS\system32\PnkBstrA.exe
2008-11-24 02:23:34 ----SHD---- C:\RECYCLER
2008-11-24 02:22:50 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2008-11-24 02:22:50 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2008-11-24 02:22:50 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2008-11-24 02:22:50 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2008-11-24 02:22:50 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2008-11-24 02:22:50 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2008-11-24 02:22:50 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2008-11-24 02:22:49 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2008-11-24 02:22:49 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2008-11-24 02:12:54 ----A---- C:\WINDOWS\system32\wpa.bak
2008-11-24 02:08:24 ----D---- C:\WINDOWS\system32\Lang
2008-11-24 02:05:58 ----D---- C:\WINDOWS\system32\RTCOM
2008-11-24 02:05:56 ----A---- C:\WINDOWS\system32\ksuser.dll
2008-11-24 02:05:32 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2008-11-24 02:05:29 ----A---- C:\WINDOWS\SOUNDMAN.EXE
2008-11-24 02:05:29 ----A---- C:\WINDOWS\RtlUpd.exe
2008-11-24 02:05:29 ----A---- C:\WINDOWS\RTLCPL.EXE
2008-11-24 02:05:27 ----D---- C:\Program Files\Realtek
2008-11-24 02:05:27 ----A---- C:\WINDOWS\RTHDCPL.EXE
2008-11-24 02:05:27 ----A---- C:\WINDOWS\MicCal.exe
2008-11-24 02:05:27 ----A---- C:\WINDOWS\ALCWZRD.EXE
2008-11-24 02:05:27 ----A---- C:\WINDOWS\ALCMTR.EXE
2008-11-24 02:05:23 ----A---- C:\WINDOWS\RtlExUpd.dll
2008-11-24 02:05:23 ----A---- C:\WINDOWS\HideWin.exe
2008-11-24 02:04:02 ----D---- C:\WINDOWS\system32\AGEIA
2008-11-24 02:04:02 ----D---- C:\Program Files\AGEIA Technologies
2008-11-24 02:03:57 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2008-11-24 02:03:50 ----D---- C:\WINDOWS\nview
2008-11-24 02:03:50 ----A---- C:\WINDOWS\system32\nvudisp.exe
2008-11-24 02:02:09 ----HD---- C:\Program Files\InstallShield Installation Information
2008-11-24 02:01:42 ----D---- C:\Program Files\NVIDIA Corporation
2008-11-24 02:00:58 ----D---- C:\Program Files\Common Files\InstallShield
2008-11-24 02:00:32 ----A---- C:\WINDOWS\system32\CapabilityTable.exe
2008-11-24 02:00:24 ----A---- C:\WINDOWS\system32\nvuide.exe
2008-11-24 02:00:23 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-11-24 01:59:30 ----A---- C:\WINDOWS\system32\nvunrm.exe
2008-11-24 01:59:29 ----A---- C:\WINDOWS\system32\nvusmb.exe
2008-11-24 01:59:20 ----A---- C:\WINDOWS\system32\NVUNINST.EXE
2008-11-24 01:59:19 ----D---- C:\Documents and Settings\Voltron\Application Data\InstallShield
2008-11-24 01:59:02 ----D---- C:\NVIDIA
2008-11-24 01:57:36 ----D---- C:\Documents and Settings\Voltron\Application Data\Identities
2008-11-24 01:57:35 ----HD---- C:\Program Files\Uninstall Information
2008-11-24 01:57:30 ----SD---- C:\Documents and Settings\Voltron\Application Data\Microsoft
2008-11-24 01:57:30 ----ASH---- C:\Documents and Settings\Voltron\Application Data\desktop.ini
2008-11-24 01:56:58 ----D---- C:\WINDOWS\SoftwareDistribution
2008-11-24 01:56:57 ----SD---- C:\WINDOWS\system32\Microsoft
2008-11-24 01:56:57 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-11-24 01:54:11 ----D---- C:\WINDOWS\system32\xircom
2008-11-24 01:54:11 ----D---- C:\Program Files\xerox
2008-11-24 01:54:11 ----D---- C:\Program Files\microsoft frontpage
2008-11-24 01:54:09 ----D---- C:\DELL
2008-11-24 01:54:03 ----A---- C:\WINDOWS\control.ini
2008-11-24 01:54:03 ----A---- C:\AUTOEXEC.BAT
2008-11-24 01:53:50 ----A---- C:\WINDOWS\OEWABLog.txt
2008-11-24 01:53:47 ----A---- C:\WINDOWS\system32\mapi32.dll
2008-11-24 01:53:10 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-11-24 01:53:10 ----RD---- C:\WINDOWS\Offline Web Pages
2008-11-24 01:53:06 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2008-11-24 01:53:03 ----HD---- C:\Program Files\WindowsUpdate
2008-11-24 01:52:50 ----D---- C:\WINDOWS\system32\DirectX
2008-11-24 01:52:35 ----A---- C:\WINDOWS\system32\atrace.dll
2008-11-24 01:52:33 ----A---- C:\WINDOWS\system32\desktop.ini
2008-11-24 01:52:33 ----A---- C:\WINDOWS\desktop.ini
2008-11-24 01:52:28 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2008-11-24 01:52:27 ----A---- C:\WINDOWS\system32\acctres.dll
2008-11-24 01:52:26 ----D---- C:\Program Files\Common Files\Services
2008-11-24 01:52:25 ----SD---- C:\WINDOWS\Tasks
2008-11-24 01:52:25 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2008-11-24 01:52:24 ----D---- C:\Program Files\Common Files\MSSoap
2008-11-24 01:52:21 ----D---- C:\WINDOWS\srchasst
2008-11-24 01:52:20 ----D---- C:\WINDOWS\system32\Macromed
2008-11-24 01:52:18 ----A---- C:\WINDOWS\system32\wuweb.dll
2008-11-24 01:52:18 ----A---- C:\WINDOWS\system32\wups.dll
2008-11-24 01:52:18 ----A---- C:\WINDOWS\system32\wucltui.dll
2008-11-24 01:52:18 ----A---- C:\WINDOWS\system32\wuauserv.dll
2008-11-24 01:52:18 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2008-11-24 01:52:18 ----A---- C:\WINDOWS\system32\wuaueng.dll
2008-11-24 01:52:18 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2008-11-24 01:52:18 ----A---- C:\WINDOWS\system32\wuauclt.exe
2008-11-24 01:52:17 ----A---- C:\WINDOWS\system32\wuapi.dll
2008-11-24 01:52:17 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2008-11-24 01:52:17 ----A---- C:\WINDOWS\system32\qmgr.dll
2008-11-24 01:52:17 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2008-11-24 01:52:17 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2008-11-24 01:52:14 ----D---- C:\Program Files\Movie Maker
2008-11-24 01:52:11 ----A---- C:\WINDOWS\system32\safrslv.dll
2008-11-24 01:52:11 ----A---- C:\WINDOWS\system32\safrdm.dll
2008-11-24 01:52:11 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2008-11-24 01:52:11 ----A---- C:\WINDOWS\system32\racpldlg.dll
2008-11-24 01:52:09 ----A---- C:\WINDOWS\system32\fltMc.exe
2008-11-24 01:52:09 ----A---- C:\WINDOWS\system32\fltlib.dll
2008-11-24 01:52:08 ----D---- C:\WINDOWS\system32\Restore
2008-11-24 01:52:08 ----A---- C:\WINDOWS\system32\srsvc.dll
2008-11-24 01:52:08 ----A---- C:\WINDOWS\system32\srrstr.dll
2008-11-24 01:52:08 ----A---- C:\WINDOWS\system32\srclient.dll
2008-11-24 01:52:07 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2008-11-24 01:52:07 ----A---- C:\WINDOWS\system32\msconf.dll
2008-11-24 01:52:07 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2008-11-24 01:52:07 ----A---- C:\WINDOWS\system32\mnmdd.dll
2008-11-24 01:52:07 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2008-11-24 01:52:07 ----A---- C:\WINDOWS\system32\ils.dll
2008-11-24 01:52:05 ----D---- C:\Program Files\NetMeeting
2008-11-24 01:52:05 ----A---- C:\WINDOWS\system32\msoert2.dll
2008-11-24 01:52:05 ----A---- C:\WINDOWS\system32\msoeacct.dll
2008-11-24 01:52:04 ----A---- C:\WINDOWS\system32\inetres.dll
2008-11-24 01:52:04 ----A---- C:\WINDOWS\system32\inetcomm.dll
2008-11-24 01:52:02 ----D---- C:\Program Files\Outlook Express
2008-11-24 01:52:02 ----A---- C:\WINDOWS\system32\schedsvc.dll
2008-11-24 01:52:02 ----A---- C:\WINDOWS\system32\mstinit.exe
2008-11-24 01:52:02 ----A---- C:\WINDOWS\system32\mstask.dll
2008-11-24 01:52:02 ----A---- C:\WINDOWS\system32\isign32.dll
2008-11-24 01:52:02 ----A---- C:\WINDOWS\system32\inetcfg.dll
2008-11-24 01:52:02 ----A---- C:\WINDOWS\system32\icwphbk.dll
2008-11-24 01:52:02 ----A---- C:\WINDOWS\system32\icwdial.dll
2008-11-24 01:51:58 ----D---- C:\Program Files\Common Files\System
2008-11-24 01:51:57 ----D---- C:\Program Files\Internet Explorer
2008-11-24 01:51:49 ----D---- C:\Program Files\ComPlus Applications
2008-11-24 01:51:48 ----A---- C:\WINDOWS\vbaddin.ini
2008-11-24 01:51:48 ----A---- C:\WINDOWS\vb.ini
2008-11-24 01:51:44 ----D---- C:\WINDOWS\Registration
2008-11-24 01:51:24 ----D---- C:\Program Files\Windows Media Player
2008-11-24 01:51:24 ----D---- C:\Program Files\Online Services
2008-11-24 01:51:20 ----D---- C:\Program Files\Messenger
2008-11-24 01:51:18 ----A---- C:\WINDOWS\system32\write.exe
2008-11-24 01:51:12 ----A---- C:\WINDOWS\system32\sndvol32.exe
2008-11-24 01:51:12 ----A---- C:\WINDOWS\system32\hticons.dll
2008-11-24 01:51:11 ----A---- C:\WINDOWS\system32\winchat.exe
2008-11-24 01:51:11 ----A---- C:\WINDOWS\system32\avwav.dll
2008-11-24 01:51:11 ----A---- C:\WINDOWS\system32\avtapi.dll
2008-11-24 01:51:11 ----A---- C:\WINDOWS\system32\avmeter.dll
2008-11-24 01:51:06 ----A---- C:\WINDOWS\system32\getuname.dll
2008-11-24 01:51:06 ----A---- C:\WINDOWS\system32\charmap.exe
2008-11-24 01:51:06 ----A---- C:\WINDOWS\system32\calc.exe
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\tslabels.ini
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\tskill.exe
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\tscon.exe
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\shadow.exe
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\rwinsta.exe
2008-11-24 01:51:05 ----A---- C:\WINDOWS\system32\reset.exe
2008-11-24 01:51:04 ----A---- C:\WINDOWS\system32\regini.exe
2008-11-24 01:51:04 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2008-11-24 01:51:04 ----A---- C:\WINDOWS\system32\qwinsta.exe
2008-11-24 01:51:04 ----A---- C:\WINDOWS\system32\qappsrv.exe
2008-11-24 01:51:04 ----A---- C:\WINDOWS\system32\msg.exe
2008-11-24 01:51:04 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2008-11-24 01:51:04 ----A---- C:\WINDOWS\system32\logoff.exe
2008-11-24 01:51:04 ----A---- C:\WINDOWS\system32\cdmodem.dll
2008-11-24 01:51:03 ----A---- C:\WINDOWS\system32\stclient.dll
2008-11-24 01:51:03 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2008-11-24 01:51:03 ----A---- C:\WINDOWS\system32\mtxex.dll
2008-11-24 01:51:03 ----A---- C:\WINDOWS\system32\mtxdm.dll
2008-11-24 01:51:03 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2008-11-24 01:51:03 ----A---- C:\WINDOWS\system32\comsnap.dll
2008-11-24 01:51:03 ----A---- C:\WINDOWS\system32\comrepl.dll
2008-11-24 01:51:03 ----A---- C:\WINDOWS\system32\comaddin.dll
2008-11-24 01:51:00 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2008-11-24 01:50:51 ----D---- C:\Program Files\MSN
2008-11-24 01:50:50 ----D---- C:\Program Files\Windows NT
2008-11-24 01:50:50 ----A---- C:\WINDOWS\system32\sndrec32.exe
2008-11-24 01:50:50 ----A---- C:\WINDOWS\system32\mspaint.exe
2008-11-24 01:50:50 ----A---- C:\WINDOWS\system32\mplay32.exe
2008-11-24 01:50:50 ----A---- C:\WINDOWS\system32\hypertrm.dll
2008-11-24 01:50:50 ----A---- C:\WINDOWS\system32\accwiz.exe
2008-11-24 01:50:49 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2008-11-24 01:50:49 ----A---- C:\WINDOWS\system32\clipbrd.exe
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\termsrv.dll
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\sessmgr.exe
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\remotepg.dll
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\rdshost.exe
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\rdpclip.exe
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\rdchost.dll
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\qprocess.exe
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\mstscax.dll
2008-11-24 01:50:48 ----A---- C:\WINDOWS\system32\mstsc.exe
2008-11-24 01:50:47 ----D---- C:\WINDOWS\system32\MsDtc
2008-11-24 01:50:47 ----A---- C:\WINDOWS\system32\xolehlp.dll
2008-11-24 01:50:47 ----A---- C:\WINDOWS\system32\mtxoci.dll
2008-11-24 01:50:47 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2008-11-24 01:50:47 ----A---- C:\WINDOWS\system32\msdtctm.dll
2008-11-24 01:50:47 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2008-11-24 01:50:47 ----A---- C:\WINDOWS\system32\msdtclog.dll
2008-11-24 01:50:47 ----A---- C:\WINDOWS\system32\icaapi.dll
2008-11-24 01:50:47 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2008-11-24 01:50:46 ----D---- C:\WINDOWS\system32\Com
2008-11-24 01:50:46 ----A---- C:\WINDOWS\system32\msdtc.exe
2008-11-24 01:50:46 ----A---- C:\WINDOWS\system32\colbact.dll
2008-11-24 01:50:46 ----A---- C:\WINDOWS\system32\clbcatex.dll
2008-11-24 01:50:46 ----A---- C:\WINDOWS\system32\catsrvut.dll
2008-11-24 01:50:46 ----A---- C:\WINDOWS\system32\catsrvps.dll
2008-11-24 01:50:45 ----A---- C:\WINDOWS\system32\comuid.dll
2008-11-24 01:50:45 ----A---- C:\WINDOWS\system32\comsvcs.dll
2008-11-24 01:50:45 ----A---- C:\WINDOWS\system32\clbcatq.dll
2008-11-24 01:50:45 ----A---- C:\WINDOWS\system32\catsrv.dll
2008-11-24 01:50:41 ----A---- C:\WINDOWS\system32\servdeps.dll
2008-11-24 01:50:41 ----A---- C:\WINDOWS\system32\mmfutil.dll
2008-11-24 01:50:41 ----A---- C:\WINDOWS\system32\licwmi.dll
2008-11-24 01:50:41 ----A---- C:\WINDOWS\system32\cmprops.dll
2008-11-23 19:49:45 ----A---- C:\WINDOWS\system32\h323log.txt
2008-11-23 19:47:32 ----A---- C:\WINDOWS\imsins.BAK
2008-11-23 19:47:30 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-11-23 19:47:29 ----SHD---- C:\WINDOWS\Installer
2008-11-23 19:47:29 ----D---- C:\Program Files\Common Files\ODBC
2008-11-23 19:47:29 ----A---- C:\WINDOWS\ODBCINST.INI
2008-11-23 19:47:26 ----RD---- C:\Program Files
2008-11-23 19:47:26 ----D---- C:\Program Files\Common Files\SpeechEngines
2008-11-23 19:47:26 ----D---- C:\Program Files\Common Files\Microsoft Shared
2008-11-23 19:47:26 ----D---- C:\Program Files\Common Files
2008-11-23 19:47:17 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2008-11-23 19:47:16 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2008-11-23 19:47:15 ----A---- C:\WINDOWS\system32\CONFIG.TMP
2008-11-23 19:47:14 ----A---- C:\WINDOWS\system32\storprop.dll
2008-11-23 19:47:08 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2008-11-23 19:47:05 ----RA---- C:\WINDOWS\SET8.tmp
2008-11-23 19:47:03 ----RA---- C:\WINDOWS\SET4.tmp
2008-11-23 19:47:02 ----RA---- C:\WINDOWS\SET3.tmp
2008-11-23 19:46:57 ----D---- C:\WINDOWS\system32\CatRoot2
2008-11-23 19:46:57 ----D---- C:\WINDOWS\system32\CatRoot
2008-11-23 19:46:51 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-11-23 19:46:37 ----A---- C:\WINDOWS\setuplog.txt
2008-11-23 19:46:34 ----SHD---- C:\System Volume Information
2008-11-23 19:46:34 ----D---- C:\Documents and Settings
2008-11-23 19:40:42 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-11-23 19:40:42 ----RSD---- C:\WINDOWS\Fonts
2008-11-23 19:40:42 ----RD---- C:\WINDOWS\Web
2008-11-23 19:40:42 ----HD---- C:\WINDOWS\inf
2008-11-23 19:40:42 ----D---- C:\WINDOWS\WinSxS
2008-11-23 19:40:42 ----D---- C:\WINDOWS\twain_32
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Temp
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\wins
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\wbem
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\usmt
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\spool
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\ShellExt
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\Setup
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\ras
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\oobe
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\npp
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\mui
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\inetsrv
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\IME
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\icsxml
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\ias
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\export
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\drivers
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\dhcp
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\config
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\3com_dmi
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\3076
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\2052
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\1054
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\1042
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\1041
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\1037
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\1033
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\1031
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\1028
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32\1025
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system32
2008-11-23 19:40:42 ----D---- C:\WINDOWS\system
2008-11-23 19:40:42 ----D---- C:\WINDOWS\security
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Resources
2008-11-23 19:40:42 ----D---- C:\WINDOWS\repair
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Provisioning
2008-11-23 19:40:42 ----D---- C:\WINDOWS\PeerNet
2008-11-23 19:40:42 ----D---- C:\WINDOWS\pchealth
2008-11-23 19:40:42 ----D---- C:\WINDOWS\mui
2008-11-23 19:40:42 ----D---- C:\WINDOWS\msapps
2008-11-23 19:40:42 ----D---- C:\WINDOWS\msagent
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Media
2008-11-23 19:40:42 ----D---- C:\WINDOWS\java
2008-11-23 19:40:42 ----D---- C:\WINDOWS\ime
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Help
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Driver Cache
2008-11-23 19:40:42 ----D---- C:\WINDOWS\dell
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Debug
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Cursors
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Connection Wizard
2008-11-23 19:40:42 ----D---- C:\WINDOWS\Config
2008-11-23 19:40:42 ----D---- C:\WINDOWS\AppPatch
2008-11-23 19:40:42 ----D---- C:\WINDOWS\addins
2008-11-23 19:40:42 ----D---- C:\WINDOWS
2008-11-20 14:44:26 ----A---- C:\WINDOWS\system32\xfcodec.dll

======List of files/folders modified in the last 1 months======

2008-11-29 21:25:24 ----A---- C:\WINDOWS\win.ini
2008-11-29 21:16:51 ----A---- C:\WINDOWS\system.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ASPI32;ASPI32; C:\WINDOWS\system32\drivers\ASPI32.sys [1999-09-10 25244]
R1 Tcpip6;Microsoft IPv6 Protocol Driver; C:\WINDOWS\system32\DRIVERS\tcpip6.sys [2004-08-12 223616]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-12 12032]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-12 60800]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2004-08-12 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-10-13 4879360]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-12 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-12 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-10-07 6133856]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-02-17 34176]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-02-17 13056]
R3 tunmp;Microsoft Tun Miniport Adapter Driver; C:\WINDOWS\system32\DRIVERS\tunmp.sys [2004-08-12 12416]
R3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-12 31616]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-12 26624]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-12 57600]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-12 17024]
R3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-12 26496]
R3 XBAudio;XBox Audio Module; C:\WINDOWS\system32\drivers\xbaudio.sys [2004-05-16 8844]
R3 XBCD;XBCD Kernel Module; C:\WINDOWS\System32\Drivers\xbcd.sys [2005-05-13 19212]
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 6to4;IPv6 Helper Service; C:\WINDOWS\system32\svchost.exe [2004-08-12 14336]
R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-09-10 611664]
R2 ForceWare Intelligent Application Manager (IAM);ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe [2006-02-17 139264]
R2 ForcewareWebInterface;Forceware Web Interface; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe [2006-02-17 20543]
R2 nSvcIp;ForceWare IP service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe [2006-02-17 127035]
R2 nSvcLog;ForceWare user log service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe [2006-02-17 61503]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-10-07 163908]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2008-11-24 66872]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2008-11-29 201816]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]

-----------------EOF-----------------

#10 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:08:50 PM

Posted 30 November 2008 - 05:34 PM

Copy the text below into OTMoveit3 and click the MoveIt button just like before.

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ee2fbd1-70f2-4469-bb9e-c7edf9073289}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Alcmtr"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"=-

:files
C:\WINDOWS\ALCMTR.EXE


Please post the resulting log along with a new hijackthis log.
How is your computer behaving now?
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#11 bigz123

bigz123
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:09:50 PM

Posted 30 November 2008 - 05:40 PM

========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ee2fbd1-70f2-4469-bb9e-c7edf9073289}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Alcmtr deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLS deleted successfully.
========== FILES ==========
C:\WINDOWS\ALCMTR.EXE moved successfully.

OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11302008_164024

#12 bigz123

bigz123
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:09:50 PM

Posted 30 November 2008 - 05:42 PM

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:40:54 PM, on 11/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Voltron\Desktop\OTMoveIt3.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Program Files\Trend Micro\HijackThis\HijackThis.exe /startupscan
O4 - HKUS\S-1-5-19\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 3800 bytes

#13 bigz123

bigz123
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:09:50 PM

Posted 30 November 2008 - 05:48 PM

well seems to be a bit faster IE is still not working properly just tells me it cant display any pages. using fire fox. it stopped the errors at the startup that said they couldn't find the randomely named dll files i deleted. ill restart and see what happens. things are looking up!

#14 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:08:50 PM

Posted 30 November 2008 - 05:53 PM

For this next step you will need to disable Spybot's Teatimer or it will interfere with Hijackthis.
  • Open Spybot Search & Destroy.
  • In the Mode menu click "Advanced mode" if not already selected.
  • Choose "Yes" at the Warning prompt.
  • Expand the "Tools" menu.
  • Click "Resident".
  • Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
  • In the File menu click "Exit" to exit Spybot Search & Destroy.
===================

Run Hijackthis again, click scan, and Put a checkmark next to each of the lines listed below. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

O4 - HKUS\S-1-5-19\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [fadugupage] Rundll32.exe "C:\WINDOWS\system32\lehebofi.dll",s (User 'NETWORK SERVICE')



Reboot your computer.



Let's take a look at another log that will show us some more detail.
  • Please download OTViewIt by OldTimer to your desktop.
  • Double click on the OTViewIt.exe icon on your desktop.
  • Check the Scan All Users checkbox and leave Use Whitelist checked. Set the File Age to 30 days.
  • Click on the Run Scan button. Two reports that are located in the same location as OTViewIt will open.OTViewIt.txt <-- Will be opened
    Extra.txt <-- Will be minimized
Copy and Paste the logs into your next reply.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#15 bigz123

bigz123
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:09:50 PM

Posted 30 November 2008 - 06:31 PM

OTViewIt logfile created on: 11/30/2008 5:27:18 PM - Run 2
OTViewIt by OldTimer - Version 1.0.20.0 Folder = C:\Documents and Settings\Voltron\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.67 Gb Available Physical Memory | 83.44% Memory free
3.85 Gb Paging File | 3.66 Gb Available in Paging File | 95.18% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 156.24 Gb Total Space | 45.54 Gb Free Space | 29.15% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 30.06 Gb Total Space | 14.04 Gb Free Space | 46.71% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded

Computer Name: ZACK-287C23B1C1
Current User Name: Voltron
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Whitelist: On
File Age = 30 Days

========== Processes ==========

[2006/02/17 10:40:36 | 00,270,336 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
[2004/08/12 08:04:33 | 00,033,280 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\rundll32.exe
[2008/10/09 14:54:26 | 17,021,440 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.EXE
[2006/02/17 10:17:08 | 00,020,543 | ---- | M] (Apache Software Foundation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
[2006/02/17 10:35:58 | 00,127,035 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
[2006/02/17 10:35:42 | 00,061,503 | ---- | M] (NVIDIA) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
[2008/10/07 13:33:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
[2008/11/24 02:30:20 | 00,066,872 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe
[2008/11/29 22:13:58 | 00,201,816 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrB.exe
[2006/02/17 10:39:02 | 00,139,264 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
[2004/08/12 08:10:00 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe
[2006/02/17 10:17:08 | 00,020,543 | ---- | M] (Apache Software Foundation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
[2008/10/31 14:55:59 | 00,307,712 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
[2008/11/30 17:26:16 | 00,422,400 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Voltron\Desktop\OTViewIt.exe

========== (O23) Win32 Services ==========

[2005/09/23 07:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
[2005/09/23 07:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
[2006/02/17 10:39:02 | 00,139,264 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM) [Auto | Running])
[2006/02/17 10:17:08 | 00,020,543 | ---- | M] (Apache Software Foundation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe -- (ForcewareWebInterface [Auto | Running])
[2006/02/17 10:35:58 | 00,127,035 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe -- (nSvcIp [Auto | Running])
[2006/02/17 10:35:42 | 00,061,503 | ---- | M] (NVIDIA) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe -- (nSvcLog [Auto | Running])
[2008/10/07 13:33:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc [Auto | Running])
[2008/11/24 02:30:20 | 00,066,872 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA [Auto | Running])
[2008/11/29 22:13:58 | 00,201,816 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrB.exe -- (PnkBstrB [Auto | Running])
[2005/01/28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe -- (UMWdf [On_Demand | Stopped])

========== Driver Services ==========

[1999/09/10 12:06:00 | 00,025,244 | ---- | M] (Adaptec) -- C:\WINDOWS\System32\drivers\ASPI32.SYS -- (ASPI32 [System | Running])
[2005/01/07 17:07:18 | 00,138,752 | ---- | M] (Windows ® Server 2003 DDK provider) -- C:\WINDOWS\system32\drivers\Hdaudbus.sys -- (HDAudBus [On_Demand | Running])
[2008/10/13 18:26:10 | 04,879,360 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running])
[2008/10/07 13:33:00 | 06,133,856 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv [On_Demand | Running])
[2006/04/24 17:52:28 | 00,100,736 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\drivers\nvata.sys -- (nvata [Boot | Running])
[2006/02/17 11:28:30 | 00,034,176 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD [On_Demand | Running])
[2006/02/17 11:28:32 | 00,013,056 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus [On_Demand | Running])
[2008/11/29 22:15:04 | 00,137,992 | ---- | M] () -- C:\WINDOWS\system32\drivers\PnkBstrK.sys -- (PnkBstrK [On_Demand | Stopped])
[2004/08/12 08:03:49 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink [On_Demand | Running])
[2004/08/12 08:04:51 | 00,027,440 | ---- | M] () -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv [On_Demand | Stopped])
[2004/08/12 08:07:09 | 00,223,616 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6 [System | Running])
[2004/08/12 08:06:15 | 00,012,416 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\tunmp.sys -- (tunmp [On_Demand | Running])
[2004/08/03 23:07:56 | 00,059,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio [On_Demand | Running])
[2004/08/12 08:10:27 | 00,012,032 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\ws2ifsl.sys -- (WS2IFSL [System | Running])
[2004/05/16 14:43:56 | 00,008,844 | ---- | M] (Redcl0ud) -- C:\WINDOWS\system32\drivers\XBAudio.sys -- (XBAudio [On_Demand | Running])
[2005/05/13 14:59:44 | 00,019,212 | ---- | M] (Redcl0ud) -- C:\WINDOWS\system32\drivers\xbcd.sys -- (XBCD [On_Demand | Running])

========== (R ) Internet Explorer ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL"=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
"Default_Search_URL"=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
"Local Page"=%SystemRoot%\system32\blank.htm
"Search Page"=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
"Start Page"=http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
"CustomizeSearch"=http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
"SearchAssistant"=http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main]
"Local Page"=C:\WINDOWS\system32\blank.htm
"Page_Transitions"=
"Search Page"=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
"Start Page"=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL]
"provider"=

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" (HKLM) -- C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = 0

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = 0

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main]

[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = 0

[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main]

[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main]

[HKEY_USERS\S-1-5-21-1220945662-1677128483-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main]
"Local Page"=C:\WINDOWS\system32\blank.htm
"Page_Transitions"=
"Search Page"=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
"Start Page"=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_USERS\S-1-5-21-1220945662-1677128483-839522115-1004\Software\Microsoft\Internet Explorer\SearchURL]
"provider"=

[HKEY_USERS\S-1-5-21-1220945662-1677128483-839522115-1004\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" (HKLM) -- C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-1220945662-1677128483-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = 0

========== (O1) Hosts File ==========

HOSTS File = (734 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
First 25 entries...
127.0.0.1 localhost

========== (O2) BHO's ==========

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\]
{3ee2fbd1-70f2-4469-bb9e-c7edf9073289} (HKLM) -- C:\WINDOWS\system32\yinazeku.dll File not found
{53707962-6F74-2D53-2644-206D7942484F} (HKLM) -- C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
{DBC80044-A445-435b-BC74-9C25C1C588A9} (HKLM) -- Reg Error: Key does not exist or could not be opened. File not found

========== (O4) Run Keys ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nTrayFw"=C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe (NVIDIA Corporation)
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation)
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation)
"RTHDCPL"=RTHDCPL.EXE (Realtek Semiconductor Corp.)

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HijackThis startup scan"=C:\Program Files\Trend Micro\HijackThis\HijackThis.exe /startupscan (Trend Micro Inc.)

[HKEY_USERS\S-1-5-21-1220945662-1677128483-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HijackThis startup scan"=C:\Program Files\Trend Micro\HijackThis\HijackThis.exe /startupscan (Trend Micro Inc.)

========== (O4) Startup Folders ==========


========== (O6 & O7) Current Version Policies ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun"=145

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun"=145

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun"=145

[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun"=145

[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun"=145

[HKEY_USERS\S-1-5-21-1220945662-1677128483-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun"=145

========== (O9) IE Extensions ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\]
{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}: Menu: Spybot - Search & Destroy Configuration -- %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [2008/09/15 14:25:44 | 01,562,960 | RHS- | M] (Safer Networking Limited)
{FB5F1910-F110-11d2-BB9E-00C04F795683}: Button: Messenger -- %ProgramFiles%\Messenger\msmsgs.exe [2004/08/04 01:06:34 | 01,667,584 | ---- | M] (Microsoft Corporation)
{FB5F1910-F110-11d2-BB9E-00C04F795683}: Menu: Windows Messenger -- %ProgramFiles%\Messenger\msmsgs.exe [2004/08/04 01:06:34 | 01,667,584 | ---- | M] (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\]
CmdMapping\\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot - Search & Destroy Configuration] -> [2008/09/15 14:25:44 | 01,562,960 | RHS- | M] (Safer Networking Limited)
CmdMapping\\{FB5F1910-F110-11d2-BB9E-00C04F795683} [HKLM] -> %ProgramFiles%\Messenger\msmsgs.exe [Messenger] -> [2004/08/04 01:06:34 | 01,667,584 | ---- | M] (Microsoft Corporation)

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Extensions\]
CmdMapping\\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot - Search & Destroy Configuration] -> [2008/09/15 14:25:44 | 01,562,960 | RHS- | M] (Safer Networking Limited)
CmdMapping\\{FB5F1910-F110-11d2-BB9E-00C04F795683} [HKLM] -> %ProgramFiles%\Messenger\msmsgs.exe [Messenger] -> [2004/08/04 01:06:34 | 01,667,584 | ---- | M] (Microsoft Corporation)

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Extensions\]
CmdMapping\\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot - Search & Destroy Configuration] -> [2008/09/15 14:25:44 | 01,562,960 | RHS- | M] (Safer Networking Limited)
CmdMapping\\{FB5F1910-F110-11d2-BB9E-00C04F795683} [HKLM] -> %ProgramFiles%\Messenger\msmsgs.exe [Messenger] -> [2004/08/04 01:06:34 | 01,667,584 | ---- | M] (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-1220945662-1677128483-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Extensions\]
CmdMapping\\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot - Search & Destroy Configuration] -> [2008/09/15 14:25:44 | 01,562,960 | RHS- | M] (Safer Networking Limited)
CmdMapping\\{FB5F1910-F110-11d2-BB9E-00C04F795683} [HKLM] -> %ProgramFiles%\Messenger\msmsgs.exe [Messenger] -> [2004/08/04 01:06:34 | 01,667,584 | ---- | M] (Microsoft Corporation)

========== (O12) Internet Explorer Plugins ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\]
PluginsPage: "" = http://activex.microsoft.com/controls/find...=%s&mime=%s
PluginsPageFriendlyName: "" = Microsoft ActiveX Gallery

========== (O13) Default Prefixes ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix]
""=http://

========== (O15) Trusted Sites ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\]
1 domain(s) and sub-domain(s) not assigned to a zone.

========== (O16) DPF ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\]
{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}: http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab -- Reg Error: Key does not exist or could not be opened.

========== (O17) DNS Name Servers ==========

{0BAC8E2D-F02E-43FA-9C64-5D40A3CC4EEE} (Servers: | Description: NVIDIA nForce Networking Controller)
{E6497669-5F2E-4167-9ED9-2721E69F9EC0} (Servers: | Description: 1394 Net Adapter)

========== Safeboot Options ==========

"AlternateShell"=cmd.exe

========== CDRom AutoRun Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
"AutoRun" = 1

========== Autorun Files on Drives ==========

AUTOEXEC.BAT []
[2008/11/24 01:54:03 | 00,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT -- [ NTFS ]

========== Files/Folders - Created Within 30 Days ==========

[1 C:\WINDOWS\System32\*.tmp files]
[3 C:\WINDOWS\*.tmp files]
[2008/11/30 17:26:16 | 00,422,400 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Voltron\Desktop\OTViewIt.exe
[2008/11/30 16:07:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\Malwarebytes
[2008/11/30 16:07:58 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2008/11/30 16:07:58 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2008/11/30 16:07:56 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2008/11/30 16:07:55 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2008/11/30 16:07:55 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2008/11/30 16:07:15 | 02,372,472 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Voltron\Desktop\mbam-setup.exe
[2008/11/30 15:57:44 | 00,000,000 | ---D | C] -- C:\_OTMoveIt
[2008/11/30 15:56:36 | 00,349,696 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Voltron\Desktop\OTMoveIt3.exe
[2008/11/30 15:24:59 | 00,000,000 | ---D | C] -- C:\rsit
[2008/11/30 15:24:30 | 00,305,705 | ---- | C] () -- C:\Documents and Settings\Voltron\Desktop\RSIT.exe
[2008/11/30 13:38:03 | 00,004,608 | ---- | C] () -- C:\Documents and Settings\Voltron\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/11/30 07:17:30 | 00,000,120 | -HS- | C] () -- C:\WINDOWS\System32\ilufazok.ini
[2008/11/29 23:31:40 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\Voltron\Desktop\HijackThis.lnk
[2008/11/29 23:31:40 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2008/11/29 23:31:24 | 00,812,344 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\Voltron\Desktop\HJTInstall.exe
[2008/11/29 23:27:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Local Settings\Application Data\Help
[2008/11/29 23:27:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\Help
[2008/11/29 21:30:04 | 00,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2008/11/29 21:28:33 | 00,113,222 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\zoneclim.dll
[2008/11/29 21:28:33 | 00,041,029 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\zcorem.dll
[2008/11/29 21:28:33 | 00,036,937 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\zclientm.exe
[2008/11/29 21:28:33 | 00,029,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\znetm.dll
[2008/11/29 21:28:33 | 00,013,894 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\zonelibm.dll
[2008/11/29 21:28:33 | 00,004,677 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\zeeverm.dll
[2008/11/29 21:28:27 | 00,156,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winzm.ime
[2008/11/29 21:28:27 | 00,156,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winsp.ime
[2008/11/29 21:28:27 | 00,156,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winpy.ime
[2008/11/29 21:28:26 | 00,119,808 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winmine.exe
[2008/11/29 21:28:26 | 00,069,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wingb.ime
[2008/11/29 21:28:26 | 00,065,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winime.ime
[2008/11/29 21:28:25 | 00,079,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winar30.ime
[2008/11/29 21:28:25 | 00,041,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\weitekp9.dll
[2008/11/29 21:28:25 | 00,031,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\weitekp9.sys
[2008/11/29 21:28:24 | 00,426,041 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\voicepad.dll
[2008/11/29 21:28:24 | 00,086,073 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\voicesub.dll
[2008/11/29 21:28:24 | 00,048,256 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\w32.dll
[2008/11/29 21:28:22 | 00,076,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\uniime.dll
[2008/11/29 21:28:22 | 00,065,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\unicdime.ime
[2008/11/29 21:28:22 | 00,032,339 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\uniansi.dll
[2008/11/29 21:28:21 | 00,014,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tsprof.exe
[2008/11/29 21:28:20 | 00,571,392 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tintlgnt.ime
[2008/11/29 21:28:20 | 00,455,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tintsetp.exe
[2008/11/29 21:28:20 | 00,044,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tintlphr.exe
[2008/11/29 21:28:20 | 00,010,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tmigrate.dll
[2008/11/29 21:28:19 | 00,185,344 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\thawbrkr.dll
[2008/11/29 21:28:19 | 00,021,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tdipx.sys
[2008/11/29 21:28:19 | 00,019,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tdspx.sys
[2008/11/29 21:28:19 | 00,013,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tdasync.sys
[2008/11/29 21:28:17 | 00,101,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\srusbusd.dll
[2008/11/29 21:28:16 | 00,538,624 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\spider.exe
[2008/11/29 21:28:16 | 00,143,422 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\softkey.dll
[2008/11/29 21:28:16 | 00,056,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sol.exe
[2008/11/29 21:28:15 | 00,358,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\snmpincl.dll
[2008/11/29 21:28:15 | 00,259,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\snmpcl.dll
[2008/11/29 21:28:15 | 00,188,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\snmpsmir.dll
[2008/11/29 21:28:15 | 00,040,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\snmpthrd.dll
[2008/11/29 21:28:15 | 00,010,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\snmpstup.dll
[2008/11/29 21:28:15 | 00,008,704 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\snmptrap.exe
[2008/11/29 21:28:15 | 00,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_snprfdll.dll
[2008/11/29 21:28:15 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\snmpmib.dll
[2008/11/29 21:28:14 | 00,456,704 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\smtpsvc.dll
[2008/11/29 21:28:14 | 00,236,544 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\smi2smir.exe
[2008/11/29 21:28:14 | 00,032,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\snmp.exe
[2008/11/29 21:28:14 | 00,015,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\smierrsm.dll
[2008/11/29 21:28:14 | 00,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_smtpctrs.dll
[2008/11/29 21:28:14 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\smimsgif.dll
[2008/11/29 21:28:14 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\smierrsy.dll
[2008/11/29 21:28:13 | 00,038,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm9aw.dll
[2008/11/29 21:28:13 | 00,031,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\smb6w.dll
[2008/11/29 21:28:13 | 00,031,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sma3w.dll
[2008/11/29 21:28:13 | 00,030,208 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm87w.dll
[2008/11/29 21:28:13 | 00,030,208 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm81w.dll
[2008/11/29 21:28:13 | 00,029,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm8cw.dll
[2008/11/29 21:28:13 | 00,026,624 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm93w.dll
[2008/11/29 21:28:13 | 00,026,624 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm92w.dll
[2008/11/29 21:28:13 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm90w.dll
[2008/11/29 21:28:13 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm8dw.dll
[2008/11/29 21:28:13 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm8aw.dll
[2008/11/29 21:28:13 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm89w.dll
[2008/11/29 21:28:12 | 02,178,131 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shvlres.dll
[2008/11/29 21:28:12 | 00,066,113 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shvl.dll
[2008/11/29 21:28:12 | 00,042,573 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shvlzm.exe
[2008/11/29 21:28:12 | 00,025,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sm59w.dll
[2008/11/29 21:28:12 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\simptcp.dll
[2008/11/29 21:28:10 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_seos.dll
[2008/11/29 21:28:09 | 00,753,236 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rvseres.dll
[2008/11/29 21:28:09 | 00,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia330.dll
[2008/11/29 21:28:09 | 00,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia001.dll
[2008/11/29 21:28:09 | 00,057,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_scripto.dll
[2008/11/29 21:28:09 | 00,042,574 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rvsezm.exe
[2008/11/29 21:28:09 | 00,026,624 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rw330ext.dll
[2008/11/29 21:28:09 | 00,024,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rw001ext.dll
[2008/11/29 21:28:08 | 00,048,706 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rvse.dll
[2008/11/29 21:28:08 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\romanime.ime
[2008/11/29 21:28:07 | 00,023,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_regtrace.exe
[2008/11/29 21:28:07 | 00,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\register.exe
[2008/11/29 21:28:05 | 00,077,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\quick.ime
[2008/11/29 21:28:05 | 00,020,736 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ramdisk.sys
[2008/11/29 21:28:05 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\quser.exe
[2008/11/29 21:28:05 | 00,009,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\query.exe
[2008/11/29 21:28:04 | 00,131,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pmxviceo.dll
[2008/11/29 21:28:04 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pmxmcro.dll
[2008/11/29 21:28:04 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pmxgl.dll
[2008/11/29 21:28:03 | 00,482,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pintlgnt.ime
[2008/11/29 21:28:03 | 00,281,088 | ---- | C] (Cinematronics) -- C:\WINDOWS\System32\dllcache\pinball.exe
[2008/11/29 21:28:03 | 00,175,104 | ---- | C] () -- C:\WINDOWS\System32\dllcache\pintlcsa.dll
[2008/11/29 21:28:03 | 00,070,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pintlphr.exe
[2008/11/29 21:28:03 | 00,067,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pmigrate.dll
[2008/11/29 21:28:03 | 00,053,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pintlcsd.dll
[2008/11/29 21:28:02 | 00,079,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\phon.ime
[2008/11/29 21:28:02 | 00,036,927 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\padrs411.dll
[2008/11/29 21:28:02 | 00,015,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\padrs404.dll
[2008/11/29 21:28:02 | 00,015,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\padrs804.dll
[2008/11/29 21:28:02 | 00,014,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\padrs412.dll
[2008/11/29 21:27:59 | 00,038,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_ntfsdrv.dll
[2008/11/29 21:27:57 | 00,229,439 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\multibox.dll
[2008/11/29 21:27:57 | 00,111,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mtstocom.exe
[2008/11/29 21:27:54 | 01,875,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msir3jp.lex
[2008/11/29 21:27:54 | 00,098,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msir3jp.dll
[2008/11/29 21:27:53 | 00,126,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshearts.exe
[2008/11/29 21:27:50 | 00,092,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mga.sys
[2008/11/29 21:27:50 | 00,092,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mga.dll
[2008/11/29 21:27:50 | 00,007,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\migregdb.exe
[2008/11/29 21:27:48 | 00,065,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_mailmsg.dll
[2008/11/29 21:27:48 | 00,022,528 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\lpdsvc.dll
[2008/11/29 21:27:48 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\lprmon.dll
[2008/11/29 21:27:47 | 00,033,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\lmmib2.dll
[2008/11/29 21:27:46 | 01,158,818 | ---- | C] () -- C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2008/11/29 21:27:46 | 00,070,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\korwbrkr.dll
[2008/11/29 21:27:46 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdth3.dll
[2008/11/29 21:27:46 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdvntc.dll
[2008/11/29 21:27:46 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdusa.dll
[2008/11/29 21:27:46 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdurdu.dll
[2008/11/29 21:27:45 | 00,009,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdnecat.dll
[2008/11/29 21:27:45 | 00,007,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdnecnt.dll
[2008/11/29 21:27:45 | 00,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdnec95.dll
[2008/11/29 21:27:45 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdlk41a.dll
[2008/11/29 21:27:45 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdth2.dll
[2008/11/29 21:27:45 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdlk41j.dll
[2008/11/29 21:27:45 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdth1.dll
[2008/11/29 21:27:45 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdth0.dll
[2008/11/29 21:27:45 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdsyr2.dll
[2008/11/29 21:27:45 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdsyr1.dll
[2008/11/29 21:27:45 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdintel.dll
[2008/11/29 21:27:44 | 00,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdibm02.dll
[2008/11/29 21:27:44 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdinpun.dll
[2008/11/29 21:27:44 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdintam.dll
[2008/11/29 21:27:44 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdinmar.dll
[2008/11/29 21:27:44 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdinkan.dll
[2008/11/29 21:27:44 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdinhin.dll
[2008/11/29 21:27:44 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdinguj.dll
[2008/11/29 21:27:44 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdindev.dll
[2008/11/29 21:27:44 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdheb.dll
[2008/11/29 21:27:44 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdfa.dll
[2008/11/29 21:27:44 | 00,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdgeo.dll
[2008/11/29 21:27:43 | 00,018,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jupiw.dll
[2008/11/29 21:27:43 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdax2.dll
[2008/11/29 21:27:43 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbd106n.dll
[2008/11/29 21:27:43 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbd101a.dll
[2008/11/29 21:27:43 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbd101.dll
[2008/11/29 21:27:43 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbddiv2.dll
[2008/11/29 21:27:43 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbddiv1.dll
[2008/11/29 21:27:43 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbda3.dll
[2008/11/29 21:27:43 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbda2.dll
[2008/11/29 21:27:43 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbda1.dll
[2008/11/29 21:27:43 | 00,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdarmw.dll
[2008/11/29 21:27:43 | 00,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdarme.dll
[2008/11/29 21:27:42 | 00,035,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iprip.dll
[2008/11/29 21:27:41 | 00,471,102 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imskdic.dll
[2008/11/29 21:27:41 | 00,315,452 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imskf.dll
[2008/11/29 21:27:41 | 00,059,392 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imscinst.exe
[2008/11/29 21:27:40 | 00,274,489 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjputyc.dll
[2008/11/29 21:27:40 | 00,262,200 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjputy.exe
[2008/11/29 21:27:40 | 00,233,527 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjprw.exe
[2008/11/29 21:27:40 | 00,208,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjpmig.exe
[2008/11/29 21:27:40 | 00,196,665 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imjpinst.exe
[2008/11/29 21:27:40 | 00,155,705 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjpdsvr.exe
[2008/11/29 21:27:40 | 00,102,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imlang.dll
[2008/11/29 21:27:40 | 00,059,904 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imkrinst.exe
[2008/11/29 21:27:40 | 00,045,109 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjpuex.exe
[2008/11/29 21:27:39 | 00,811,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjp81k.dll
[2008/11/29 21:27:39 | 00,716,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjpcus.dll
[2008/11/29 21:27:39 | 00,368,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjpcic.dll
[2008/11/29 21:27:39 | 00,307,257 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjpdct.exe
[2008/11/29 21:27:39 | 00,081,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjpdct.dll
[2008/11/29 21:27:39 | 00,057,398 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjpdadm.exe
[2008/11/29 21:27:38 | 00,340,023 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imjp81.ime
[2008/11/29 21:27:38 | 00,311,359 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imepadsv.exe
[2008/11/29 21:27:38 | 00,134,339 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imekr.lex
[2008/11/29 21:27:38 | 00,106,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imekrcic.dll
[2008/11/29 21:27:38 | 00,102,463 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imepadsm.dll
[2008/11/29 21:27:38 | 00,094,720 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imekr61.ime
[2008/11/29 21:27:38 | 00,086,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imekrmbx.dll
[2008/11/29 21:27:38 | 00,044,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\imekrmig.exe
[2008/11/29 21:27:33 | 10,129,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hwxkor.dll
[2008/11/29 21:27:28 | 13,463,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hwxjpn.dll
[2008/11/29 21:27:25 | 10,096,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hwxcht.dll
[2008/11/29 21:27:25 | 01,175,635 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hrtzres.dll
[2008/11/29 21:27:25 | 00,057,409 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hrtz.dll
[2008/11/29 21:27:25 | 00,042,573 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hrtzzm.exe
[2008/11/29 21:27:24 | 00,108,827 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hanja.lex
[2008/11/29 21:27:24 | 00,039,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hostmib.dll
[2008/11/29 21:27:24 | 00,036,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hanjadic.dll
[2008/11/29 21:27:23 | 00,400,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxsxp32.dll
[2008/11/29 21:27:23 | 00,397,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxstiff.dll
[2008/11/29 21:27:23 | 00,192,512 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxswzrd.dll
[2008/11/29 21:27:23 | 00,154,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxsui.dll
[2008/11/29 21:27:22 | 00,562,176 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxsst.dll
[2008/11/29 21:27:22 | 00,267,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxssvc.exe
[2008/11/29 21:27:22 | 00,246,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxst30.dll
[2008/11/29 21:27:22 | 00,229,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxscover.exe
[2008/11/29 21:27:22 | 00,055,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxsevent.dll
[2008/11/29 21:27:22 | 00,031,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxsroute.dll
[2008/11/29 21:27:22 | 00,027,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxsdrv.dll
[2008/11/29 21:27:22 | 00,023,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxsmon.dll
[2008/11/29 21:27:22 | 00,023,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxsext32.dll
[2008/11/29 21:27:22 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxssend.exe
[2008/11/29 21:27:22 | 00,008,704 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxsperf.dll
[2008/11/29 21:27:22 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxsres.dll
[2008/11/29 21:27:21 | 00,452,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxsapi.dll
[2008/11/29 21:27:21 | 00,285,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxscomex.dll
[2008/11/29 21:27:21 | 00,143,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxsclnt.exe
[2008/11/29 21:27:21 | 00,132,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxsclntr.dll
[2008/11/29 21:27:21 | 00,111,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxscfgwz.dll
[2008/11/29 21:27:21 | 00,094,208 | ---- | C] () -- C:\WINDOWS\System32\dllcache\fpencode.dll
[2008/11/29 21:27:21 | 00,072,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fxscom.dll
[2008/11/29 21:27:21 | 00,055,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\freecell.exe
[2008/11/29 21:27:21 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ftlx041e.dll
[2008/11/29 21:27:20 | 00,043,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_fcachdll.dll
[2008/11/29 21:27:20 | 00,024,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fpadmcgi.exe
[2008/11/29 21:27:20 | 00,020,541 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fpadmdll.dll
[2008/11/29 21:27:20 | 00,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\flattemp.exe
[2008/11/29 21:27:19 | 00,101,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\evntagnt.dll
[2008/11/29 21:27:19 | 00,092,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\evntwin.exe
[2008/11/29 21:27:19 | 00,057,856 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esuimgd.dll
[2008/11/29 21:27:19 | 00,045,056 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esunid.dll
[2008/11/29 21:27:19 | 00,031,744 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esucmd.dll
[2008/11/29 21:27:19 | 00,025,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\et4000.sys
[2008/11/29 21:27:19 | 00,024,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\evntcmd.exe
[2008/11/29 21:27:19 | 00,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\f3ahvoas.dll
[2008/11/29 21:27:13 | 00,078,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dayi.ime
[2008/11/29 21:27:11 | 00,057,399 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cplexe.exe
[2008/11/29 21:27:11 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cprofile.exe
[2008/11/29 21:27:10 | 01,039,955 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cmnresm.dll
[2008/11/29 21:27:10 | 00,217,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cmnclim.dll
[2008/11/29 21:27:09 | 00,838,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chtbrkr.dll
[2008/11/29 21:27:09 | 00,480,256 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cintsetp.exe
[2008/11/29 21:27:09 | 00,198,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cintime.dll
[2008/11/29 21:27:09 | 00,173,568 | ---- | C] () -- C:\WINDOWS\System32\dllcache\chtskf.dll
[2008/11/29 21:27:09 | 00,097,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chtmbx.dll
[2008/11/29 21:27:09 | 00,056,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chtskdic.dll
[2008/11/29 21:27:09 | 00,021,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cintlgnt.ime
[2008/11/29 21:27:08 | 01,677,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chsbrkr.dll
[2008/11/29 21:27:08 | 00,780,885 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chkrres.dll
[2008/11/29 21:27:08 | 00,042,575 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chkrzm.exe
[2008/11/29 21:27:08 | 00,040,515 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chkr.dll
[2008/11/29 21:27:08 | 00,015,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chgport.exe
[2008/11/29 21:27:08 | 00,014,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chgusr.exe
[2008/11/29 21:27:08 | 00,013,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chglogon.exe
[2008/11/29 21:27:07 | 00,078,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\chajei.ime
[2008/11/29 21:27:07 | 00,054,528 | ---- | C] (Philips Semiconductors GmbH) -- C:\WINDOWS\System32\dllcache\cap7146.sys
[2008/11/29 21:27:07 | 00,009,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\change.exe
[2008/11/29 21:27:06 | 00,218,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\c_g18030.dll
[2008/11/29 21:27:06 | 00,010,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\c_iscii.dll
[2008/11/29 21:27:06 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\c_is2022.dll
[2008/11/29 21:27:00 | 01,817,687 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bckgres.dll
[2008/11/29 21:27:00 | 00,082,501 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bckg.dll
[2008/11/29 21:27:00 | 00,042,577 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bckgzm.exe
[2008/11/29 21:26:59 | 00,331,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\aqueue.dll
[2008/11/29 21:26:59 | 00,045,056 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_aqadmin.dll
[2008/11/29 21:26:58 | 00,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0804.dll
[2008/11/29 21:26:58 | 00,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0412.dll
[2008/11/29 21:26:58 | 00,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0411.dll
[2008/11/29 21:26:58 | 00,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt040d.dll
[2008/11/29 21:26:58 | 00,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0404.dll
[2008/11/29 21:26:58 | 00,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0401.dll
[2008/11/29 21:26:57 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\EXCH_adsiisex.dll
[2008/11/29 21:26:54 | 00,032,827 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tcptest.exe
[2008/11/29 21:26:54 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tcptsat.dll
[2008/11/29 21:26:53 | 00,020,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shtml.dll
[2008/11/29 21:26:53 | 00,016,437 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shtml.exe
[2008/11/29 21:26:49 | 00,598,071 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fpmmc.dll
[2008/11/29 21:26:49 | 00,208,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fpmmcsat.dll
[2008/11/29 21:26:49 | 00,020,538 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fpremadm.exe
[2008/11/29 21:26:48 | 00,876,653 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fp4awel.dll
[2008/11/29 21:26:48 | 00,188,494 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fpcount.exe
[2008/11/29 21:26:48 | 00,109,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fp98swin.exe
[2008/11/29 21:26:48 | 00,102,509 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fp4atxt.dll
[2008/11/29 21:26:48 | 00,049,212 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fp4awebs.dll
[2008/11/29 21:26:48 | 00,041,020 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fp4avnb.dll
[2008/11/29 21:26:48 | 00,032,826 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fp4avss.dll
[2008/11/29 21:26:48 | 00,020,541 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fpexedll.dll
[2008/11/29 21:26:48 | 00,014,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fp98sadm.exe
[2008/11/29 21:26:47 | 00,188,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cfgwiz.exe
[2008/11/29 21:26:47 | 00,184,435 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fp4amsft.dll
[2008/11/29 21:26:47 | 00,147,513 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fp4apws.dll
[2008/11/29 21:26:47 | 00,082,035 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fp4anscp.dll
[2008/11/29 21:26:47 | 00,049,210 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fp4areg.dll
[2008/11/29 21:26:46 | 00,020,540 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\author.dll
[2008/11/29 21:26:46 | 00,016,439 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\author.exe
[2008/11/29 21:26:46 | 00,016,439 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\admin.exe
[2008/11/29 21:26:45 | 00,020,540 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\admin.dll
[2008/11/29 21:26:41 | 00,000,000 | ---D | C] -- C:\Program Files\msn gaming zone
[2008/11/29 21:18:51 | 00,201,157 | ---- | C] () -- C:\WINDOWS\System32\nvapps.nvb
[2008/11/29 21:16:46 | 00,024,661 | ---- | C] (Perle Systems Ltd.) -- C:\WINDOWS\System32\spxcoins.dll
[2008/11/29 21:16:46 | 00,024,661 | ---- | C] (Perle Systems Ltd.) -- C:\WINDOWS\System32\dllcache\spxcoins.dll
[2008/11/29 21:16:46 | 00,013,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\irclass.dll
[2008/11/29 21:16:46 | 00,013,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\irclass.dll
[2008/11/29 21:16:38 | 00,168,806 | ---- | C] () -- C:\WINDOWS\System32\dllcache\startoc.cat
[2008/11/29 21:16:38 | 00,037,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MW770.CAT
[2008/11/29 21:16:38 | 00,031,281 | ---- | C] () -- C:\WINDOWS\System32\dllcache\FP4.CAT
[2008/11/29 21:16:38 | 00,024,209 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn7.cat
[2008/11/29 21:16:38 | 00,013,753 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IMS.CAT
[2008/11/29 21:16:38 | 00,011,651 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn9.cat
[2008/11/29 21:16:38 | 00,009,581 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSMSGS.CAT
[2008/11/29 21:16:38 | 00,008,574 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IASNT4.CAT
[2008/11/29 21:16:38 | 00,007,710 | ---- | C] () -- C:\WINDOWS\System32\dllcache\OEMBIOS.CAT
[2008/11/29 21:16:38 | 00,007,245 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSTSWEB.CAT
[2008/11/29 21:16:37 | 02,012,670 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5.CAT
[2008/11/29 21:16:37 | 01,086,058 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NTPRINT.CAT
[2008/11/29 21:16:37 | 01,042,903 | ---- | C] () -- C:\WINDOWS\System32\dllcache\SP2.CAT
[2008/11/29 21:16:37 | 00,797,189 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5IIS.CAT
[2008/11/29 21:16:37 | 00,399,645 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MAPIMIG.CAT
[2008/11/29 21:16:37 | 00,382,952 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5INF.CAT
[2008/11/29 20:26:50 | 00,096,978 | ---- | C] (Business Information Solutions) -- C:\Documents and Settings\Voltron\Desktop\VirtumundoBeGone.exe
[2008/11/29 19:27:10 | 01,060,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MFC71.dll
[2008/11/29 19:27:10 | 00,499,712 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSVCP71.dll
[2008/11/29 19:27:10 | 00,348,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSVCR71.dll
[2008/11/29 19:27:09 | 00,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2008/11/29 19:19:20 | 27,462,344 | ---- | C] () -- C:\Documents and Settings\Voltron\Desktop\setupeng.exe
[2008/11/29 17:05:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Lavasoft
[2008/11/29 17:01:13 | 23,804,784 | ---- | C] () -- C:\Documents and Settings\Voltron\Desktop\aaw2008.exe
[2008/11/29 16:46:32 | 00,000,000 | ---D | C] -- C:\Program Files\Trojan Killer
[2008/11/29 16:46:06 | 04,713,897 | ---- | C] (GridinSoft, Inc. ) -- C:\Documents and Settings\Voltron\Desktop\trojankiller-setup.exe
[2008/11/29 08:46:32 | 00,045,056 | ---- | C] (Adaptec) -- C:\WINDOWS\System32\WNASPI32.DLL
[2008/11/29 08:46:32 | 00,025,244 | ---- | C] (Adaptec) -- C:\WINDOWS\System32\drivers\ASPI32.SYS
[2008/11/29 08:46:32 | 00,005,600 | ---- | C] (Adaptec) -- C:\WINDOWS\System\WINASPI.DLL
[2008/11/29 08:46:32 | 00,004,672 | ---- | C] (Adaptec) -- C:\WINDOWS\System\WOWPOST.EXE
[2008/11/28 10:57:06 | 00,000,595 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Craxtion4.lnk
[2008/11/28 10:57:06 | 00,000,000 | ---D | C] -- C:\Program Files\Team Craxtion
[2008/11/28 10:53:47 | 00,000,000 | R-SD | C] -- C:\WINDOWS\assembly
[2008/11/28 10:53:25 | 00,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET
[2008/11/28 10:15:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\ImgBurn
[2008/11/28 10:14:42 | 00,001,528 | ---- | C] () -- C:\Documents and Settings\Voltron\Desktop\ImgBurn.lnk
[2008/11/28 10:14:42 | 00,000,000 | ---D | C] -- C:\Program Files\ImgBurn
[2008/11/28 09:00:15 | 00,000,402 | ---- | C] () -- C:\Documents and Settings\Voltron\Desktop\Shortcut to Rips.lnk
[2008/11/28 09:00:12 | 00,000,493 | ---- | C] () -- C:\Documents and Settings\Voltron\Desktop\Shortcut to ISOs.lnk
[2008/11/28 07:20:24 | 00,000,533 | ---- | C] () -- C:\Documents and Settings\Voltron\Desktop\Shortcut to xISO.lnk
[2008/11/28 07:10:43 | 00,000,345 | ---- | C] () -- C:\Documents and Settings\Voltron\Desktop\XBOX.lnk
[2008/11/28 06:10:38 | 00,000,000 | ---D | C] -- C:\XBOX
[2008/11/28 05:47:25 | 00,012,736 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2008/11/28 05:45:54 | 00,000,626 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\mIRC.lnk
[2008/11/28 05:45:54 | 00,000,000 | ---D | C] -- C:\Program Files\mIRC
[2008/11/28 05:45:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\mIRC
[2008/11/28 05:38:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\Xbins
[2008/11/28 05:38:54 | 01,050,112 | ---- | C] () -- C:\Documents and Settings\Voltron\Desktop\xbins.exe
[2008/11/28 05:38:53 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\WinRAR
[2008/11/28 05:17:57 | 00,000,000 | ---D | C] -- C:\Program Files\FlashFXP
[2008/11/28 05:17:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\FlashFXP
[2008/11/28 05:11:25 | 00,000,104 | ---- | C] () -- C:\Documents and Settings\Voltron\Desktop\Shortcut to Internet.lnk
[2008/11/28 05:09:55 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\My Documents\Downloads
[2008/11/27 23:31:16 | 00,107,888 | ---- | C] (Sony DADC Austria AG.) -- C:\WINDOWS\System32\CmdLineExt.dll
[2008/11/27 23:27:49 | 00,000,000 | ---D | C] -- C:\Program Files\GameSpy Arcade
[2008/11/27 20:41:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\My Documents\Battlefield 2
[2008/11/27 20:18:30 | 00,000,586 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Play BF2 Online Now!.lnk
[2008/11/27 20:18:30 | 00,000,564 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Battlefield 2.lnk
[2008/11/27 19:43:31 | 00,059,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\USBAUDIO.sys
[2008/11/27 19:43:09 | 00,000,000 | ---D | C] -- C:\Program Files\XBAudio
[2008/11/26 19:18:22 | 00,000,000 | ---D | C] -- C:\WINDOWS\pss
[2008/11/26 18:59:25 | 00,000,000 | ---D | C] -- C:\VundoFix Backups
[2008/11/26 18:56:28 | 00,000,211 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2008/11/26 18:41:50 | 00,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2008/11/26 18:41:50 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2008/11/26 03:15:41 | 00,000,000 | ---D | C] -- C:\Program Files\eMule
[2008/11/26 02:13:53 | 00,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2008/11/26 02:13:51 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Local Settings\Application Data\Mozilla
[2008/11/26 02:13:51 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\Mozilla
[2008/11/26 02:13:47 | 00,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2008/11/25 11:43:57 | 00,221,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmpns.dll
[2008/11/24 23:53:29 | 00,000,000 | ---D | C] -- C:\Program Files\XBCD
[2008/11/24 23:25:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\fltk.org
[2008/11/24 23:18:38 | 00,029,495 | ---- | C] () -- C:\Documents and Settings\Voltron\Desktop\all.m3u
[2008/11/24 23:16:00 | 00,000,664 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Winamp.lnk
[2008/11/24 23:15:47 | 00,000,000 | ---D | C] -- C:\WINDOWS\RegisteredPackages
[2008/11/24 23:15:25 | 00,000,000 | ---D | C] -- C:\Program Files\Winamp
[2008/11/24 23:15:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\Winamp
[2008/11/24 23:07:19 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\My Documents\LimeWire
[2008/11/24 23:07:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\LimeWire
[2008/11/24 23:06:05 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\Sun
[2008/11/24 20:12:11 | 00,001,497 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Combat Arms.lnk
[2008/11/24 20:09:55 | 00,000,000 | ---D | C] -- C:\Nexon
[2008/11/24 20:09:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NexonUS
[2008/11/24 05:15:18 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\My Documents\EVE
[2008/11/24 05:15:08 | 03,727,720 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_35.dll
[2008/11/24 04:31:56 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\uTorrent
[2008/11/24 04:28:34 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\Macromedia
[2008/11/24 04:28:34 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\Adobe
[2008/11/24 04:13:34 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\Ventrilo
[2008/11/24 04:13:22 | 00,000,630 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Ventrilo.lnk
[2008/11/24 04:13:21 | 00,000,000 | ---D | C] -- C:\Program Files\Ventrilo
[2008/11/24 04:13:20 | 00,000,262 | ---- | C] () -- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2008/11/24 02:50:13 | 00,137,992 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2008/11/24 02:44:51 | 00,201,816 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrB.exe
[2008/11/24 02:35:55 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\Xfire
[2008/11/24 02:35:53 | 00,000,000 | ---D | C] -- C:\Program Files\Xfire
[2008/11/24 02:30:20 | 00,066,872 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrA.exe
[2008/11/24 02:30:20 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles
[2008/11/24 02:25:12 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\My Documents\Battlefield 2142
[2008/11/24 02:23:34 | 00,000,000 | -HSD | C] -- C:\RECYCLER
[2008/11/24 02:23:09 | 00,000,626 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Play BF2142 Online Now!.lnk
[2008/11/24 02:23:09 | 00,000,604 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Battlefield 2142.lnk
[2008/11/24 02:22:50 | 02,332,368 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_29.dll
[2008/11/24 02:22:50 | 02,323,664 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_28.dll
[2008/11/24 02:22:50 | 02,319,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_27.dll
[2008/11/24 02:22:50 | 02,297,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_26.dll
[2008/11/24 02:22:50 | 00,230,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_0.dll
[2008/11/24 02:22:50 | 00,061,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xinput9_1_0.dll
[2008/11/24 02:22:50 | 00,014,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\x3daudio1_0.dll
[2008/11/24 02:22:49 | 02,337,488 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_25.dll
[2008/11/24 02:22:49 | 02,222,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_24.dll
[2008/11/24 02:12:54 | 00,012,540 | ---- | C] () -- C:\WINDOWS\System32\wpa.bak
[2008/11/24 02:08:24 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\Lang
[2008/11/24 02:07:19 | 04,287,764 | -H-- | C] () -- C:\Documents and Settings\Voltron\Local Settings\Application Data\IconCache.db
[2008/11/24 02:06:17 | 00,006,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\splitter.sys
[2008/11/24 02:06:17 | 00,000,553 | ---- | C] () -- C:\WINDOWS\USetup.iss
[2008/11/24 02:06:14 | 00,052,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\DMusic.sys
[2008/11/24 02:05:58 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\RTCOM
[2008/11/24 02:05:56 | 00,130,048 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ksproxy.ax
[2008/11/24 02:05:56 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ksuser.dll
[2008/11/24 02:05:32 | 00,022,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spupdsvc.exe
[2008/11/24 02:05:27 | 02,808,832 | ---- | C] (RealTek Semicoductor Corp.) -- C:\WINDOWS\ALCWZRD.EXE
[2008/11/24 02:05:27 | 00,000,000 | ---D | C] -- C:\Program Files\Realtek
[2008/11/24 02:04:02 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\AGEIA
[2008/11/24 02:04:02 | 00,000,000 | ---D | C] -- C:\Program Files\AGEIA Technologies
[2008/11/24 02:03:57 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard
[2008/11/24 02:03:50 | 00,195,368 | ---- | C] () -- C:\WINDOWS\System32\nvapps.xml
[2008/11/24 02:03:50 | 00,018,477 | ---- | C] () -- C:\WINDOWS\System32\nvdisp.nvu
[2008/11/24 02:03:50 | 00,000,000 | ---D | C] -- C:\WINDOWS\nview
[2008/11/24 02:02:09 | 00,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information
[2008/11/24 02:02:04 | 00,001,959 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ActiveArmor Firewall.lnk
[2008/11/24 02:01:54 | 00,001,024 | ---- | C] () -- C:\.rnd
[2008/11/24 02:01:50 | 00,000,022 | ---- | C] () -- C:\WINDOWS\FileName
[2008/11/24 02:00:58 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[2008/11/24 02:00:24 | 00,001,570 | ---- | C] () -- C:\WINDOWS\System32\nvide.nvu
[2008/11/24 02:00:23 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\ReinstallBackups
[2008/11/24 01:59:30 | 00,003,657 | ---- | C] () -- C:\WINDOWS\System32\nvnrm.nvu
[2008/11/24 01:59:29 | 00,001,864 | ---- | C] () -- C:\WINDOWS\System32\nvsmb.nvu
[2008/11/24 01:59:19 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\InstallShield
[2008/11/24 01:59:02 | 00,000,000 | ---D | C] -- C:\NVIDIA
[2008/11/24 01:57:50 | 00,012,816 | ---- | C] () -- C:\Documents and Settings\Voltron\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2008/11/24 01:57:36 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Application Data\Identities
[2008/11/24 01:57:35 | 00,000,000 | -H-D | C] -- C:\Program Files\Uninstall Information
[2008/11/24 01:57:33 | 00,000,078 | -HS- | C] () -- C:\Documents and Settings\Voltron\My Documents\desktop.ini
[2008/11/24 01:57:33 | 00,000,000 | R--D | C] -- C:\Documents and Settings\Voltron\My Documents\My Pictures
[2008/11/24 01:57:33 | 00,000,000 | R--D | C] -- C:\Documents and Settings\Voltron\My Documents\My Music
[2008/11/24 01:57:30 | 00,000,084 | -HS- | C] () -- C:\Documents and Settings\Voltron\Start Menu\Programs\Startup\desktop.ini
[2008/11/24 01:57:30 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\Voltron\Application Data\desktop.ini
[2008/11/24 01:57:30 | 00,000,000 | --SD | C] -- C:\Documents and Settings\Voltron\Application Data\Microsoft
[2008/11/24 01:57:30 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Voltron\Local Settings\Application Data\Microsoft
[2008/11/24 01:56:58 | 00,000,000 | ---D | C] -- C:\WINDOWS\SoftwareDistribution
[2008/11/24 01:56:57 | 00,000,006 | -H-- | C] () -- C:\WINDOWS\tasks\SA.DAT
[2008/11/24 01:56:57 | 00,000,000 | --SD | C] -- C:\WINDOWS\System32\Microsoft
[2008/11/24 01:56:32 | 00,008,192 | ---- | C] () -- C:\WINDOWS\REGLOCS.OLD
[2008/11/24 01:55:34 | 00,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2008/11/24 01:54:36 | 00,618,605 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fp4autl.dll
[2008/11/24 01:54:11 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\xircom
[2008/11/24 01:54:11 | 00,000,000 | ---D | C] -- C:\Program Files\xerox
[2008/11/24 01:54:11 | 00,000,000 | ---D | C] -- C:\Program Files\microsoft frontpage
[2008/11/24 01:54:09 | 00,000,000 | ---D | C] -- C:\DELL
[2008/11/24 01:54:03 | 00,002,577 | ---- | C] () -- C:\WINDOWS\System32\CONFIG.NT
[2008/11/24 01:54:03 | 00,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2008/11/24 01:54:03 | 00,000,000 | RHS- | C] () -- C:\IO.SYS
[2008/11/24 01:54:03 | 00,000,000 | ---- | C] () -- C:\WINDOWS\control.ini
[2008/11/24 01:54:03 | 00,000,000 | ---- | C] () -- C:\CONFIG.SYS
[2008/11/24 01:54:03 | 00,000,000 | ---- | C] () -- C:\AUTOEXEC.BAT
[2008/11/24 01:53:55 | 00,023,392 | ---- | C] () -- C:\WINDOWS\System32\nscompat.tlb
[2008/11/24 01:53:55 | 00,016,832 | ---- | C] () -- C:\WINDOWS\System32\amcompat.tlb
[2008/11/24 01:53:54 | 00,316,640 | ---- | C] () -- C:\WINDOWS\WMSysPr9.prx
[2008/11/24 01:53:47 | 00,112,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mapi32.dll
[2008/11/24 01:53:10 | 00,000,000 | --SD | C] -- C:\WINDOWS\Downloaded Program Files
[2008/11/24 01:53:10 | 00,000,000 | R--D | C] -- C:\WINDOWS\Offline Web Pages
[2008/11/24 01:53:03 | 00,000,000 | -H-D | C] -- C:\Program Files\WindowsUpdate
[2008/11/24 01:52:55 | 04,399,505 | ---- | C] () -- C:\WINDOWS\System32\dllcache\nls302en.lex
[2008/11/24 01:52:50 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\DirectX
[2008/11/24 01:52:36 | 00,028,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msoobe.exe
[2008/11/24 01:52:35 | 00,099,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\helphost.exe
[2008/11/24 01:52:35 | 00,035,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\notiflag.exe
[2008/11/24 01:52:35 | 00,021,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\brpinfo.dll
[2008/11/24 01:52:35 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\atrace.dll
[2008/11/24 01:52:35 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\atrace.dll
[2008/11/24 01:52:35 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hcappres.dll
[2008/11/24 01:52:33 | 00,048,680 | -HS- | C] () -- C:\WINDOWS\winnt256.bmp
[2008/11/24 01:52:33 | 00,048,680 | -HS- | C] () -- C:\WINDOWS\winnt.bmp
[2008/11/24 01:52:33 | 00,000,002 | ---- | C] () -- C:\WINDOWS\System32\desktop.ini
[2008/11/24 01:52:33 | 00,000,002 | ---- | C] () -- C:\WINDOWS\desktop.ini
[2008/11/24 01:52:29 | 00,047,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\srdiag.exe
[2008/11/24 01:52:28 | 00,118,784 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msg723.acm
[2008/11/24 01:52:28 | 00,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\nmevtmsg.dll
[2008/11/24 01:52:28 | 00,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wb32.exe
[2008/11/24 01:52:28 | 00,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nmevtmsg.dll
[2008/11/24 01:52:28 | 00,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cb32.exe
[2008/11/24 01:52:28 | 00,000,984 | ---- | C] () -- C:\WINDOWS\System32\dllcache\srframe.mmf
[2008/11/24 01:52:27 | 00,064,512 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\acctres.dll
[2008/11/24 01:52:27 | 00,064,512 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\acctres.dll
[2008/11/24 01:52:27 | 00,039,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msinfo32.exe
[2008/11/24 01:52:26 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Services
[2008/11/24 01:52:25 | 00,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\trialoc.dll
[2008/11/24 01:52:25 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\icfgnt5.dll
[2008/11/24 01:52:25 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\icfgnt5.dll
[2008/11/24 01:52:25 | 00,000,065 | RH-- | C] () -- C:\WINDOWS\tasks\desktop.ini
[2008/11/24 01:52:25 | 00,000,000 | --SD | C] -- C:\WINDOWS\Tasks
[2008/11/24 01:52:24 | 00,235,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mssoap1.dll
[2008/11/24 01:52:24 | 00,093,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieinfo5.ocx
[2008/11/24 01:52:24 | 00,073,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\icwtutor.exe
[2008/11/24 01:52:24 | 00,061,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\icwres.dll
[2008/11/24 01:52:24 | 00,025,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wisc10.dll
[2008/11/24 01:52:24 | 00,023,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mssoapr.dll
[2008/11/24 01:52:24 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\isignup.exe
[2008/11/24 01:52:24 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\MSSoap
[2008/11/24 01:52:22 | 00,725,566 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\srchui.dll
[2008/11/24 01:52:22 | 00,058,434 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\srchctls.dll
[2008/11/24 01:52:21 | 03,166,208 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msgr3en.dll
[2008/11/24 01:52:21 | 00,848,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\vgx.dll
[2008/11/24 01:52:21 | 00,000,000 | ---D | C] -- C:\WINDOWS\srchasst
[2008/11/24 01:52:20 | 00,774,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\setup_wm.exe
[2008/11/24 01:52:20 | 00,368,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mpvis.dll
[2008/11/24 01:52:20 | 00,098,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmpband.dll
[2008/11/24 01:52:20 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\Macromed
[2008/11/24 01:52:19 | 00,786,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\migrate.exe
[2008/11/24 01:52:19 | 00,364,544 | ---- | C] (Microsoft Corporation (written by Digital Renaissance Inc.)) -- C:\WINDOWS\System32\dllcache\npdsplay.dll
[2008/11/24 01:52:19 | 00,226,816 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\npdrmv2.dll
[2008/11/24 01:52:19 | 00,221,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmpns.dll
[2008/11/24 01:52:19 | 00,073,728 | --S- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmplayer.exe
[2008/11/24 01:52:19 | 00,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\custsat.dll
[2008/11/24 01:52:19 | 00,010,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\npwmsdrm.dll
[2008/11/24 01:52:19 | 00,004,639 | --S- | C] () -- C:\WINDOWS\System32\dllcache\mplayer2.exe
[2008/11/24 01:52:18 | 01,134,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuaueng.dll
[2008/11/24 01:52:18 | 01,134,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuaueng.dll
[2008/11/24 01:52:18 | 00,183,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuaueng1.dll
[2008/11/24 01:52:18 | 00,183,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuaueng1.dll
[2008/11/24 01:52:18 | 00,165,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuauclt1.exe
[2008/11/24 01:52:18 | 00,165,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuauclt1.exe
[2008/11/24 01:52:18 | 00,162,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuaucpl.cpl
[2008/11/24 01:52:18 | 00,162,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuaucpl.cpl
[2008/11/24 01:52:18 | 00,120,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuweb.dll
[2008/11/24 01:52:18 | 00,120,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuweb.dll
[2008/11/24 01:52:18 | 00,112,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wucltui.dll
[2008/11/24 01:52:18 | 00,112,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wucltui.dll
[2008/11/24 01:52:18 | 00,111,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuauclt.exe
[2008/11/24 01:52:18 | 00,111,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuauclt.exe
[2008/11/24 01:52:18 | 00,036,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wups.dll
[2008/11/24 01:52:18 | 00,036,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wups.dll
[2008/11/24 01:52:18 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuauserv.dll
[2008/11/24 01:52:18 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuauserv.dll
[2008/11/24 01:52:17 | 00,430,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuapi.dll
[2008/11/24 01:52:17 | 00,430,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuapi.dll
[2008/11/24 01:52:17 | 00,382,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qmgr.dll
[2008/11/24 01:52:17 | 00,382,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\qmgr.dll
[2008/11/24 01:52:17 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qmgrprxy.dll
[2008/11/24 01:52:17 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\qmgrprxy.dll
[2008/11/24 01:52:17 | 00,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bitsprx2.dll
[2008/11/24 01:52:17 | 00,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\bitsprx2.dll
[2008/11/24 01:52:17 | 00,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bitsprx3.dll
[2008/11/24 01:52:17 | 00,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\bitsprx3.dll
[2008/11/24 01:52:16 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmm2res2.dll
[2008/11/24 01:52:16 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmm2eres.dll
[2008/11/24 01:52:15 | 04,256,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmm2res.dll
[2008/11/24 01:52:15 | 00,502,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmm2fxa.dll
[2008/11/24 01:52:15 | 00,402,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmm2filt.dll
[2008/11/24 01:52:15 | 00,325,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmm2fxb.dll
[2008/11/24 01:52:15 | 00,167,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmm2ae.dll
[2008/11/24 01:52:15 | 00,007,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmm2ext.dll
[2008/11/24 01:52:14 | 03,555,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\moviemk.exe
[2008/11/24 01:52:14 | 00,000,000 | ---D | C] -- C:\Program Files\Movie Maker
[2008/11/24 01:52:13 | 00,561,664 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msobmain.dll
[2008/11/24 01:52:13 | 00,122,368 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msobcomm.dll
[2008/11/24 01:52:13 | 00,051,200 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\oobebaln.exe
[2008/11/24 01:52:13 | 00,030,720 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msobshel.dll
[2008/11/24 01:52:13 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msobweb.dll
[2008/11/24 01:52:13 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msobdl.dll
[2008/11/24 01:52:11 | 00,150,528 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\uploadm.exe
[2008/11/24 01:52:11 | 00,102,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pchshell.dll
[2008/11/24 01:52:11 | 00,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\safrslv.dll
[2008/11/24 01:52:11 | 00,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\safrslv.dll
[2008/11/24 01:52:11 | 00,043,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\safrcdlg.dll
[2008/11/24 01:52:11 | 00,043,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\racpldlg.dll
[2008/11/24 01:52:11 | 00,043,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\safrcdlg.dll
[2008/11/24 01:52:11 | 00,043,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\racpldlg.dll
[2008/11/24 01:52:11 | 00,038,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pchsvc.dll
[2008/11/24 01:52:11 | 00,029,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\safrdm.dll
[2008/11/24 01:52:11 | 00,029,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\safrdm.dll
[2008/11/24 01:52:10 | 00,376,320 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msinfo.dll
[2008/11/24 01:52:09 | 00,768,512 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\helpctr.exe
[2008/11/24 01:52:09 | 00,743,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\helpsvc.exe
[2008/11/24 01:52:09 | 00,158,208 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msconfig.exe
[2008/11/24 01:52:09 | 00,022,528 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\fltMc.exe
[2008/11/24 01:52:09 | 00,022,528 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fltmc.exe
[2008/11/24 01:52:09 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hscupd.exe
[2008/11/24 01:52:09 | 00,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\fltlib.dll
[2008/11/24 01:52:09 | 00,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fltlib.dll
[2008/11/24 01:52:08 | 00,380,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rstrui.exe
[2008/11/24 01:52:08 | 00,239,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\srrstr.dll
[2008/11/24 01:52:08 | 00,239,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\srrstr.dll
[2008/11/24 01:52:08 | 00,170,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\srsvc.dll
[2008/11/24 01:52:08 | 00,170,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\srsvc.dll
[2008/11/24 01:52:08 | 00,124,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\fltMgr.sys
[2008/11/24 01:52:08 | 00,124,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fltmgr.sys
[2008/11/24 01:52:08 | 00,073,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\sr.sys
[2008/11/24 01:52:08 | 00,073,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sr.sys
[2008/11/24 01:52:08 | 00,067,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\srclient.dll
[2008/11/24 01:52:08 | 00,067,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\srclient.dll
[2008/11/24 01:52:08 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\Restore
[2008/11/24 01:52:07 | 00,385,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\callcont.dll
[2008/11/24 01:52:07 | 00,229,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nmas.dll
[2008/11/24 01:52:07 | 00,188,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msh261.drv
[2008/11/24 01:52:07 | 00,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ils.dll
[2008/11/24 01:52:07 | 00,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ils.dll
[2008/11/24 01:52:07 | 00,069,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msconf.dll
[2008/11/24 01:52:07 | 00,069,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msconf.dll
[2008/11/24 01:52:07 | 00,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dcap32.dll
[2008/11/24 01:52:07 | 00,034,560 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mnmdd.dll
[2008/11/24 01:52:07 | 00,034,560 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mnmdd.dll
[2008/11/24 01:52:07 | 00,032,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mnmsrvc.exe
[2008/11/24 01:52:07 | 00,032,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mnmsrvc.exe
[2008/11/24 01:52:07 | 00,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\nmmkcert.dll
[2008/11/24 01:52:07 | 00,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nmmkcert.dll
[2008/11/24 01:52:07 | 00,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nmasnt.dll
[2008/11/24 01:52:06 | 00,274,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mst120.dll
[2008/11/24 01:52:06 | 00,221,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nac.dll
[2008/11/24 01:52:06 | 00,188,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nmwb.dll
[2008/11/24 01:52:06 | 00,151,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nmft.dll
[2008/11/24 01:52:06 | 00,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nmchat.dll
[2008/11/24 01:52:06 | 00,077,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nmcom.dll
[2008/11/24 01:52:06 | 00,061,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rrcm.dll
[2008/11/24 01:52:06 | 00,057,344 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mst123.dll
[2008/11/24 01:52:06 | 00,057,344 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\h323cc.dll
[2008/11/24 01:52:06 | 00,045,056 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\confmrsl.dll
[2008/11/24 01:52:05 | 01,032,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\conf.exe
[2008/11/24 01:52:05 | 00,504,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wab32.dll
[2008/11/24 01:52:05 | 00,252,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msoeacct.dll
[2008/11/24 01:52:05 | 00,252,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msoeacct.dll
[2008/11/24 01:52:05 | 00,172,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nmoldwb.dll
[2008/11/24 01:52:05 | 00,105,984 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msoert2.dll
[2008/11/24 01:52:05 | 00,105,984 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msoert2.dll
[2008/11/24 01:52:05 | 00,084,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wabimp.dll
[2008/11/24 01:52:05 | 00,046,080 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wab.exe
[2008/11/24 01:52:05 | 00,032,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wabfind.dll
[2008/11/24 01:52:05 | 00,030,208 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wabmig.exe
[2008/11/24 01:52:05 | 00,000,000 | ---D | C] -- C:\Program Files\NetMeeting
[2008/11/24 01:52:04 | 00,678,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\inetcomm.dll
[2008/11/24 01:52:04 | 00,678,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetcomm.dll
[2008/11/24 01:52:04 | 00,249,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wab32res.dll
[2008/11/24 01:52:04 | 00,104,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\oeimport.dll
[2008/11/24 01:52:04 | 00,081,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\directdb.dll
[2008/11/24 01:52:04 | 00,060,416 | --S- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msimn.exe
[2008/11/24 01:52:04 | 00,048,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\inetres.dll
[2008/11/24 01:52:04 | 00,048,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetres.dll
[2008/11/24 01:52:03 | 02,479,616 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msoeres.dll
[2008/11/24 01:52:03 | 01,311,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msoe.dll
[2008/11/24 01:52:03 | 00,073,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\setup50.exe
[2008/11/24 01:52:03 | 00,060,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\oemig50.exe
[2008/11/24 01:52:03 | 00,035,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\oemiglib.dll
[2008/11/24 01:52:02 | 00,274,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mstask.dll
[2008/11/24 01:52:02 | 00,274,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstask.dll
[2008/11/24 01:52:02 | 00,274,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\inetcfg.dll
[2008/11/24 01:52:02 | 00,274,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetcfg.dll
[2008/11/24 01:52:02 | 00,190,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\schedsvc.dll
[2008/11/24 01:52:02 | 00,190,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\schedsvc.dll
[2008/11/24 01:52:02 | 00,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\isign32.dll
[2008/11/24 01:52:02 | 00,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\isign32.dll
[2008/11/24 01:52:02 | 00,073,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\icwdial.dll
[2008/11/24 01:52:02 | 00,073,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\icwdial.dll
[2008/11/24 01:52:02 | 00,065,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\icwphbk.dll
[2008/11/24 01:52:02 | 00,065,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\icwphbk.dll
[2008/11/24 01:52:02 | 00,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mstinit.exe
[2008/11/24 01:52:02 | 00,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstinit.exe
[2008/11/24 01:52:02 | 00,000,000 | ---D | C] -- C:\Program Files\Outlook Express
[2008/11/24 01:52:01 | 00,561,179 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dao360.dll
[2008/11/24 01:52:01 | 00,214,528 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\icwconn1.exe
[2008/11/24 01:52:01 | 00,172,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\icwhelp.dll
[2008/11/24 01:52:01 | 00,086,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\icwconn2.exe
[2008/11/24 01:52:01 | 00,061,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\icwconn.dll
[2008/11/24 01:52:01 | 00,049,152 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\icwutil.dll
[2008/11/24 01:52:01 | 00,032,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\icwdl.dll
[2008/11/24 01:52:01 | 00,024,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\icwrmind.exe
[2008/11/24 01:52:01 | 00,020,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetwiz.exe
[2008/11/24 01:52:00 | 00,487,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\oledb32.dll
[2008/11/24 01:52:00 | 00,217,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sqlxmlx.dll
[2008/11/24 01:52:00 | 00,204,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdaps.dll
[2008/11/24 01:52:00 | 00,094,208 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdatl3.dll
[2008/11/24 01:52:00 | 00,077,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdaosp.dll
[2008/11/24 01:52:00 | 00,065,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\oledb32r.dll
[2008/11/24 01:52:00 | 00,024,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msxactps.dll
[2008/11/24 01:52:00 | 00,020,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdatt.dll
[2008/11/24 01:52:00 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdasqlr.dll
[2008/11/24 01:52:00 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdaurl.dll
[2008/11/24 01:51:59 | 00,536,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msado15.dll
[2008/11/24 01:51:59 | 00,315,392 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdasql.dll
[2008/11/24 01:51:59 | 00,233,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdaora.dll
[2008/11/24 01:51:59 | 00,200,704 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msadox.dll
[2008/11/24 01:51:59 | 00,180,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msadomd.dll
[2008/11/24 01:51:59 | 00,118,784 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdarem.dll
[2008/11/24 01:51:59 | 00,102,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msjro.dll
[2008/11/24 01:51:59 | 00,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msado27.tlb
[2008/11/24 01:51:59 | 00,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msado26.tlb
[2008/11/24 01:51:59 | 00,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msado25.tlb
[2008/11/24 01:51:59 | 00,061,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msado21.tlb
[2008/11/24 01:51:59 | 00,061,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msado20.tlb
[2008/11/24 01:51:59 | 00,057,344 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msadrh15.dll
[2008/11/24 01:51:59 | 00,057,344 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msador15.dll
[2008/11/24 01:51:59 | 00,024,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msader15.dll
[2008/11/24 01:51:59 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdaorar.dll
[2008/11/24 01:51:59 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdasc.dll
[2008/11/24 01:51:59 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdaer.dll
[2008/11/24 01:51:59 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdaenum.dll
[2008/11/24 01:51:59 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdadc.dll
[2008/11/24 01:51:58 | 00,331,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msadce.dll
[2008/11/24 01:51:58 | 00,200,704 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdaprst.dll
[2008/11/24 01:51:58 | 00,155,648 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msadds.dll
[2008/11/24 01:51:58 | 00,153,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\triedit.dll
[2008/11/24 01:51:58 | 00,143,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msadco.dll
[2008/11/24 01:51:58 | 00,128,000 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dhtmled.ocx
[2008/11/24 01:51:58 | 00,061,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msadcf.dll
[2008/11/24 01:51:58 | 00,053,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msadcs.dll
[2008/11/24 01:51:58 | 00,036,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdfmap.dll
[2008/11/24 01:51:58 | 00,024,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msaddsr.dll
[2008/11/24 01:51:58 | 00,020,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msadcer.dll
[2008/11/24 01:51:58 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdaremr.dll
[2008/11/24 01:51:58 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdaprsr.dll
[2008/11/24 01:51:58 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msadcor.dll
[2008/11/24 01:51:58 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msadcfr.dll
[2008/11/24 01:51:58 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\System
[2008/11/24 01:51:57 | 00,093,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iexplore.exe
[2008/11/24 01:51:57 | 00,038,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hmmapi.dll
[2008/11/24 01:51:57 | 00,018,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedw.exe
[2008/11/24 01:51:57 | 00,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Pictures
[2008/11/24 01:51:57 | 00,000,000 | ---D | C] -- C:\Program Files\Internet Explorer
[2008/11/24 01:51:55 | 00,022,720 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008/11/24 01:51:49 | 00,000,000 | ---D | C] -- C:\Program Files\ComPlus Applications
[2008/11/24 01:51:48 | 00,000,037 | ---- | C] () -- C:\WINDOWS\vbaddin.ini
[2008/11/24 01:51:48 | 00,000,036 | ---- | C] () -- C:\WINDOWS\vb.ini
[2008/11/24 01:51:44 | 00,000,000 | ---D | C] -- C:\WINDOWS\Registration
[2008/11/24 01:51:24 | 00,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Music
[2008/11/24 01:51:24 | 00,000,000 | ---D | C] -- C:\Program Files\Windows Media Player
[2008/11/24 01:51:24 | 00,000,000 | ---D | C] -- C:\Program Files\Online Services
[2008/11/24 01:51:20 | 00,000,000 | ---D | C] -- C:\Program Files\Messenger
[2008/11/24 01:51:18 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\write.exe
[2008/11/24 01:51:18 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\write.exe
[2008/11/24 01:51:12 | 00,138,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\sndvol32.exe
[2008/11/24 01:51:12 | 00,138,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sndvol32.exe
[2008/11/24 01:51:11 | 00,227,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\avtapi.dll
[2008/11/24 01:51:11 | 00,227,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\avtapi.dll
[2008/11/24 01:51:11 | 00,073,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\avwav.dll
[2008/11/24 01:51:11 | 00,073,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\avwav.dll
[2008/11/24 01:51:11 | 00,035,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\winchat.exe
[2008/11/24 01:51:11 | 00,035,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winchat.exe
[2008/11/24 01:51:11 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\avmeter.dll
[2008/11/24 01:51:11 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\avmeter.dll
[2008/11/24 01:51:07 | 00,065,978 | ---- | C] () -- C:\WINDOWS\Soap Bubbles.bmp
[2008/11/24 01:51:07 | 00,065,954 | ---- | C] () -- C:\WINDOWS\Prairie Wind.bmp
[2008/11/24 01:51:07 | 00,065,832 | ---- | C] () -- C:\WINDOWS\Santa Fe Stucco.bmp
[2008/11/24 01:51:07 | 00,026,680 | ---- | C] () -- C:\WINDOWS\River Sumida.bmp
[2008/11/24 01:51:07 | 00,026,582 | ---- | C] () -- C:\WINDOWS\Greenstone.bmp
[2008/11/24 01:51:07 | 00,017,362 | ---- | C] () -- C:\WINDOWS\Rhododendron.bmp
[2008/11/24 01:51:07 | 00,017,336 | ---- | C] () -- C:\WINDOWS\Gone Fishing.bmp
[2008/11/24 01:51:07 | 00,017,062 | ---- | C] () -- C:\WINDOWS\Coffee Bean.bmp
[2008/11/24 01:51:07 | 00,016,730 | ---- | C] () -- C:\WINDOWS\FeatherTexture.bmp
[2008/11/24 01:51:07 | 00,009,522 | ---- | C] () -- C:\WINDOWS\Zapotec.bmp
[2008/11/24 01:51:07 | 00,001,272 | ---- | C] () -- C:\WINDOWS\Blue Lace 16.bmp
[2008/11/24 01:51:06 | 00,605,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\getuname.dll
[2008/11/24 01:51:06 | 00,605,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\getuname.dll
[2008/11/24 01:51:06 | 00,114,688 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\calc.exe
[2008/11/24 01:51:06 | 00,114,688 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\calc.exe
[2008/11/24 01:51:06 | 00,080,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\charmap.exe
[2008/11/24 01:51:06 | 00,080,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\charmap.exe
[2008/11/24 01:51:05 | 00,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\tsshutdn.exe
[2008/11/24 01:51:05 | 00,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tsshutdn.exe
[2008/11/24 01:51:05 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\tskill.exe
[2008/11/24 01:51:05 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tskill.exe
[2008/11/24 01:51:05 | 00,015,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rwinsta.exe
[2008/11/24 01:51:05 | 00,015,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rwinsta.exe
[2008/11/24 01:51:05 | 00,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\tsdiscon.exe
[2008/11/24 01:51:05 | 00,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\tscon.exe
[2008/11/24 01:51:05 | 00,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\shadow.exe
[2008/11/24 01:51:05 | 00,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tsdiscon.exe
[2008/11/24 01:51:05 | 00,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tscon.exe
[2008/11/24 01:51:05 | 00,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shadow.exe
[2008/11/24 01:51:05 | 00,013,223 | ---- | C] () -- C:\WINDOWS\System32\tslabels.ini
[2008/11/24 01:51:05 | 00,009,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\reset.exe
[2008/11/24 01:51:05 | 00,009,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\reset.exe
[2008/11/24 01:51:05 | 00,003,286 | ---- | C] () -- C:\WINDOWS\System32\tslabels.h
[2008/11/24 01:51:05 | 00,001,161 | ---- | C] () -- C:\WINDOWS\System32\usrlogon.cmd
[2008/11/24 01:51:04 | 00,033,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\regini.exe
[2008/11/24 01:51:04 | 00,033,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\regini.exe
[2008/11/24 01:51:04 | 00,022,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qwinsta.exe
[2008/11/24 01:51:04 | 00,022,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\qwinsta.exe
[2008/11/24 01:51:04 | 00,020,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msg.exe
[2008/11/24 01:51:04 | 00,020,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msg.exe
[2008/11/24 01:51:04 | 00,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mtsadmin.tlb
[2008/11/24 01:51:04 | 00,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qappsrv.exe
[2008/11/24 01:51:04 | 00,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\qappsrv.exe
[2008/11/24 01:51:04 | 00,015,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cdmodem.dll
[2008/11/24 01:51:04 | 00,015,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\cdmodem.dll
[2008/11/24 01:51:04 | 00,015,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\logoff.exe
[2008/11/24 01:51:04 | 00,015,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\logoff.exe
[2008/11/24 01:51:04 | 00,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comrereg.exe
[2008/11/24 01:51:04 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rdpcfgex.dll
[2008/11/24 01:51:04 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdpcfgex.dll
[2008/11/24 01:51:04 | 00,001,931 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.ini
[2008/11/24 01:51:04 | 00,000,768 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.h
[2008/11/24 01:51:03 | 00,147,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comsnap.dll
[2008/11/24 01:51:03 | 00,147,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comsnap.dll
[2008/11/24 01:51:03 | 00,082,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comrepl.dll
[2008/11/24 01:51:03 | 00,082,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comrepl.dll
[2008/11/24 01:51:03 | 00,054,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\stclient.dll
[2008/11/24 01:51:03 | 00,054,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\stclient.dll
[2008/11/24 01:51:03 | 00,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmi2xml.dll
[2008/11/24 01:51:03 | 00,025,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comaddin.dll
[2008/11/24 01:51:03 | 00,025,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comaddin.dll
[2008/11/24 01:51:03 | 00,025,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mtxlegih.dll
[2008/11/24 01:51:03 | 00,025,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mtxlegih.dll
[2008/11/24 01:51:03 | 00,020,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mtxdm.dll
[2008/11/24 01:51:03 | 00,020,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mtxdm.dll
[2008/11/24 01:51:03 | 00,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dcomcnfg.exe
[2008/11/24 01:51:03 | 00,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dcomcnfg.exe
[2008/11/24 01:51:03 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mtxex.dll
[2008/11/24 01:51:03 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mtxex.dll
[2008/11/24 01:51:01 | 00,116,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\updprov.dll
[2008/11/24 01:51:01 | 00,075,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmipicmp.dll
[2008/11/24 01:51:01 | 00,061,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmimsg.dll
[2008/11/24 01:51:01 | 00,059,904 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wbemdisp.tlb
[2008/11/24 01:51:01 | 00,052,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmitimep.dll
[2008/11/24 01:51:01 | 00,031,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wbemads.tlb
[2008/11/24 01:51:01 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winmgmtr.dll
[2008/11/24 01:51:01 | 00,013,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winmgmt.exe
[2008/11/24 01:51:01 | 00,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wbemads.dll
[2008/11/24 01:51:00 | 00,273,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msiprov.dll
[2008/11/24 01:51:00 | 00,120,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dsprov.dll
[2008/11/24 01:51:00 | 00,063,488 | ---- | C] () -- C:\WINDOWS\System32\wmimgmt.msc
[2008/11/24 01:51:00 | 00,061,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tmplprov.dll
[2008/11/24 01:51:00 | 00,059,904 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\trnsprov.dll
[2008/11/24 01:51:00 | 00,053,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fwdprov.dll
[2008/11/24 01:51:00 | 00,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\smtpcons.dll
[2008/11/24 01:51:00 | 00,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\unsecapp.exe
[2008/11/24 01:50:51 | 00,214,528 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wordpad.exe
[2008/11/24 01:50:51 | 00,000,000 | ---D | C] -- C:\Program Files\MSN
[2008/11/24 01:50:50 | 00,539,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dialer.exe
[2008/11/24 01:50:50 | 00,343,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mspaint.exe
[2008/11/24 01:50:50 | 00,343,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mspaint.exe
[2008/11/24 01:50:50 | 00,183,808 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\accwiz.exe
[2008/11/24 01:50:50 | 00,183,808 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\accwiz.exe
[2008/11/24 01:50:50 | 00,131,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\sndrec32.exe
[2008/11/24 01:50:50 | 00,131,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sndrec32.exe
[2008/11/24 01:50:50 | 00,123,392 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mplay32.exe
[2008/11/24 01:50:50 | 00,123,392 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mplay32.exe
[2008/11/24 01:50:50 | 00,068,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\access.cpl
[2008/11/24 01:50:50 | 00,068,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\access.cpl
[2008/11/24 01:50:50 | 00,000,000 | ---D | C] -- C:\Program Files\Windows NT
[2008/11/24 01:50:49 | 00,139,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\rdpwd.sys
[2008/11/24 01:50:49 | 00,139,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdpwd.sys
[2008/11/24 01:50:49 | 00,102,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\clipbrd.exe
[2008/11/24 01:50:49 | 00,102,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\clipbrd.exe
[2008/11/24 01:50:49 | 00,093,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\tscfgwmi.dll
[2008/11/24 01:50:49 | 00,093,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tscfgwmi.dll
[2008/11/24 01:50:49 | 00,021,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\tdtcp.sys
[2008/11/24 01:50:49 | 00,021,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tdtcp.sys
[2008/11/24 01:50:49 | 00,012,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\tdpipe.sys
[2008/11/24 01:50:49 | 00,012,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tdpipe.sys
[2008/11/24 01:50:48 | 00,655,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mstscax.dll
[2008/11/24 01:50:48 | 00,655,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstscax.dll
[2008/11/24 01:50:48 | 00,407,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mstsc.exe
[2008/11/24 01:50:48 | 00,407,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstsc.exe
[2008/11/24 01:50:48 | 00,295,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\termsrv.dll
[2008/11/24 01:50:48 | 00,295,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\termsrv.dll
[2008/11/24 01:50:48 | 00,147,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rdchost.dll
[2008/11/24 01:50:48 | 00,147,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdchost.dll
[2008/11/24 01:50:48 | 00,140,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\sessmgr.exe
[2008/11/24 01:50:48 | 00,140,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sessmgr.exe
[2008/11/24 01:50:48 | 00,087,176 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rdpwsx.dll
[2008/11/24 01:50:48 | 00,087,176 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdpwsx.dll
[2008/11/24 01:50:48 | 00,067,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rdshost.exe
[2008/11/24 01:50:48 | 00,067,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdshost.exe
[2008/11/24 01:50:48 | 00,062,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rdpclip.exe
[2008/11/24 01:50:48 | 00,062,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdpclip.exe
[2008/11/24 01:50:48 | 00,060,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\remotepg.dll
[2008/11/24 01:50:48 | 00,060,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\remotepg.dll
[2008/11/24 01:50:48 | 00,044,544 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\tscupgrd.exe
[2008/11/24 01:50:48 | 00,044,544 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tscupgrd.exe
[2008/11/24 01:50:48 | 00,020,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qprocess.exe
[2008/11/24 01:50:48 | 00,020,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\qprocess.exe
[2008/11/24 01:50:48 | 00,019,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rdpsnd.dll
[2008/11/24 01:50:48 | 00,019,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdpsnd.dll
[2008/11/24 01:50:48 | 00,013,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rdsaddin.exe
[2008/11/24 01:50:48 | 00,013,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdsaddin.exe
[2008/11/24 01:50:47 | 00,949,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msdtctm.dll
[2008/11/24 01:50:47 | 00,949,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdtctm.dll
[2008/11/24 01:50:47 | 00,425,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msdtcprx.dll
[2008/11/24 01:50:47 | 00,425,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdtcprx.dll
[2008/11/24 01:50:47 | 00,161,280 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msdtcuiu.dll
[2008/11/24 01:50:47 | 00,161,280 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdtcuiu.dll
[2008/11/24 01:50:47 | 00,090,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mtxoci.dll
[2008/11/24 01:50:47 | 00,090,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mtxoci.dll
[2008/11/24 01:50:47 | 00,058,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msdtclog.dll
[2008/11/24 01:50:47 | 00,058,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdtclog.dll
[2008/11/24 01:50:47 | 00,038,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cfgbkend.dll
[2008/11/24 01:50:47 | 00,038,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\cfgbkend.dll
[2008/11/24 01:50:47 | 00,011,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xolehlp.dll
[2008/11/24 01:50:47 | 00,011,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\xolehlp.dll
[2008/11/24 01:50:47 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\icaapi.dll
[2008/11/24 01:50:47 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\icaapi.dll
[2008/11/24 01:50:47 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\MsDtc
[2008/11/24 01:50:46 | 00,628,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\catsrvut.dll
[2008/11/24 01:50:46 | 00,628,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\catsrvut.dll
[2008/11/24 01:50:46 | 00,195,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comadmin.dll
[2008/11/24 01:50:46 | 00,110,080 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\clbcatex.dll
[2008/11/24 01:50:46 | 00,110,080 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\clbcatex.dll
[2008/11/24 01:50:46 | 00,085,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\catsrvps.dll
[2008/11/24 01:50:46 | 00,085,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\catsrvps.dll
[2008/11/24 01:50:46 | 00,062,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\colbact.dll
[2008/11/24 01:50:46 | 00,062,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\colbact.dll
[2008/11/24 01:50:46 | 00,009,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comrepl.exe
[2008/11/24 01:50:46 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msdtc.exe
[2008/11/24 01:50:46 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdtc.exe
[2008/11/24 01:50:46 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\Com
[2008/11/24 01:50:45 | 01,251,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comsvcs.dll
[2008/11/24 01:50:45 | 01,251,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comsvcs.dll
[2008/11/24 01:50:45 | 00,540,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comuid.dll
[2008/11/24 01:50:45 | 00,540,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comuid.dll
[2008/11/24 01:50:45 | 00,501,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\clbcatq.dll
[2008/11/24 01:50:45 | 00,501,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\clbcatq.dll
[2008/11/24 01:50:45 | 00,229,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\catsrv.dll
[2008/11/24 01:50:45 | 00,229,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\catsrv.dll
[2008/11/24 01:50:44 | 00,437,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiprvsd.dll
[2008/11/24 01:50:44 | 00,218,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiprvse.exe
[2008/11/24 01:50:44 | 00,156,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmipcima.dll
[2008/11/24 01:50:44 | 00,144,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmisvc.dll
[2008/11/24 01:50:44 | 00,144,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiprov.dll
[2008/11/24 01:50:44 | 00,132,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmipdskq.dll
[2008/11/24 01:50:44 | 00,095,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiutils.dll
[2008/11/24 01:50:44 | 00,062,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmipjobj.dll
[2008/11/24 01:50:44 | 00,062,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmipiprt.dll
[2008/11/24 01:50:44 | 00,041,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmipsess.dll
[2008/11/24 01:50:43 | 00,530,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wbemcore.dll
[2008/11/24 01:50:43 | 00,273,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wbemess.dll
[2008/11/24 01:50:43 | 00,214,528 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wbemcomn.dll
[2008/11/24 01:50:43 | 00,197,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wbemupgd.dll
[2008/11/24 01:50:43 | 00,196,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiadap.exe
[2008/11/24 01:50:43 | 00,196,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wbemcntl.dll
[2008/11/24 01:50:43 | 00,178,176 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wbemdisp.dll
[2008/11/24 01:50:43 | 00,140,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmidcprv.dll
[2008/11/24 01:50:43 | 00,131,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\viewprov.dll
[2008/11/24 01:50:43 | 00,126,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiapsrv.exe
[2008/11/24 01:50:43 | 00,116,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wbemtest.exe
[2008/11/24 01:50:43 | 00,089,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiaprpl.dll
[2008/11/24 01:50:43 | 00,086,528 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\stdprov.dll
[2008/11/24 01:50:43 | 00,071,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wbemcons.dll
[2008/11/24 01:50:43 | 00,060,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmicookr.dll
[2008/11/24 01:50:43 | 00,043,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wbemsvc.dll
[2008/11/24 01:50:43 | 00,036,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\scrcons.exe
[2008/11/24 01:50:43 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wbemprox.dll
[2008/11/24 01:50:43 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiapres.dll
[2008/11/24 01:50:42 | 00,472,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fastprox.dll
[2008/11/24 01:50:42 | 00,247,808 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\esscli.dll
[2008/11/24 01:50:42 | 00,237,056 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\provthrd.dll
[2008/11/24 01:50:42 | 00,212,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntevt.dll
[2008/11/24 01:50:42 | 00,185,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\framedyn.dll
[2008/11/24 01:50:42 | 00,177,152 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\repdrvfs.dll
[2008/11/24 01:50:42 | 00,123,904 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mofd.dll
[2008/11/24 01:50:42 | 00,047,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ncprov.dll
[2008/11/24 01:50:42 | 00,024,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\krnlprov.dll
[2008/11/24 01:50:42 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mofcomp.exe
[2008/11/24 01:50:41 | 01,352,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cimwin32.dll
[2008/11/24 01:50:41 | 00,185,344 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cmprops.dll
[2008/11/24 01:50:41 | 00,185,344 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\cmprops.dll
[2008/11/24 01:50:41 | 00,058,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\licwmi.dll
[2008/11/24 01:50:41 | 00,058,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\licwmi.dll
[2008/11/24 01:50:41 | 00,056,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\servdeps.dll
[2008/11/24 01:50:41 | 00,056,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\servdeps.dll
[2008/11/24 01:50:41 | 00,017,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mmfutil.dll
[2008/11/24 01:50:41 | 00,017,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mmfutil.dll
[2008/11/24 01:50:37 | 00,196,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\rdpdr.sys
[2008/11/24 01:50:37 | 00,040,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\termdd.sys
[2008/11/23 19:49:27 | 00,003,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\audstub.sys
[2008/11/23 19:48:54 | 00,057,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\redbook.sys
[2008/11/23 19:48:41 | 00,006,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\enum1394.sys
[2008/11/23 19:47:32 | 00,004,625 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2008/11/23 19:47:30 | 00,458,340 | ---- | C] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2008/11/23 19:47:29 | 00,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008/11/23 19:47:29 | 00,000,000 | -HSD | C] -- C:\WINDOWS\Installer
[2008/11/23 19:47:29 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\ODBC
[2008/11/23 19:47:28 | 00,077,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\spcommon.dll
[2008/11/23 19:47:28 | 00,061,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\spcplui.dll
[2008/11/23 19:47:27 | 01,685,606 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sam.spd
[2008/11/23 19:47:27 | 00,774,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\spttseng.dll
[2008/11/23 19:47:27 | 00,605,050 | ---- | C] () -- C:\WINDOWS\System32\dllcache\r1033tts.lxa
[2008/11/23 19:47:27 | 00,000,888 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sam.sdf
[2008/11/23 19:47:26 | 00,741,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sapi.dll
[2008/11/23 19:47:26 | 00,643,717 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ltts1033.lxa
[2008/11/23 19:47:26 | 00,155,648 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sapi.cpl
[2008/11/23 19:47:26 | 00,036,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sapisvr.exe
[2008/11/23 19:47:26 | 00,000,000 | R--D | C] -- C:\Program Files
[2008/11/23 19:47:26 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\SpeechEngines
[2008/11/23 19:47:26 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Microsoft Shared
[2008/11/23 19:47:26 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files
[2008/11/23 19:47:25 | 00,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt041f.dll
[2008/11/23 19:47:24 | 00,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0419.dll
[2008/11/23 19:47:22 | 00,022,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0408.dll
[2008/11/23 19:47:20 | 00,019,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt040e.dll
[2008/11/23 19:47:20 | 00,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0415.dll
[2008/11/23 19:47:20 | 00,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agt0405.dll
[2008/11/23 19:47:16 | 00,013,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\WFWNET.DRV
[2008/11/23 19:47:16 | 00,004,048 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\TIMER.DRV
[2008/11/23 19:47:16 | 00,003,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\SYSTEM.DRV
[2008/11/23 19:47:16 | 00,002,176 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\VGA.DRV
[2008/11/23 19:47:16 | 00,002,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\MOUSE.DRV
[2008/11/23 19:47:16 | 00,001,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\SOUND.DRV
[2008/11/23 19:47:15 | 00,069,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\AVICAP.DLL
[2008/11/23 19:47:15 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\irenum.sys
[2008/11/23 19:47:15 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\irenum.sys
[2008/11/23 19:47:15 | 00,002,000 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\KEYBOARD.DRV
[2008/11/23 19:47:15 | 00,001,688 | ---- | C] () -- C:\WINDOWS\System32\AUTOEXEC.NT
[2008/11/23 19:47:14 | 00,146,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System\WINSPOOL.DRV
[2008/11/23 19:47:14 | 00,074,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\storprop.dll
[2008/11/23 19:47:08 | 00,000,084 | -HS- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
[2008/11/23 19:47:08 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Documents\desktop.ini
[2008/11/23 19:47:08 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2008/11/23 19:47:07 | 00,007,334 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmerrenu.cat
[2008/11/23 19:46:57 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot2
[2008/11/23 19:46:57 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot
[2008/11/23 19:46:51 | 00,318,309 | ---- | C] () -- C:\WINDOWS\setupapi.old
[2008/11/23 19:46:51 | 00,000,000 | --SD | C] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2008/11/23 19:46:34 | 00,000,000 | -HSD | C] -- C:\System Volume Information
[2008/11/23 19:46:34 | 00,000,000 | ---D | C] -- C:\Documents and Settings
[2008/11/23 19:46:33 | 00,091,088 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2008/11/23 19:45:31 | 00,000,288 | ---- | C] () -- C:\WINDOWS\System32\$winnt$.inf
[2008/11/23 19:40:42 | 00,000,000 | R-SD | C] -- C:\WINDOWS\Fonts
[2008/11/23 19:40:42 | 00,000,000 | RHSD | C] -- C:\WINDOWS\System32\dllcache
[2008/11/23 19:40:42 | 00,000,000 | R--D | C] -- C:\WINDOWS\Web
[2008/11/23 19:40:42 | 00,000,000 | -H-D | C] -- C:\WINDOWS\inf
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\WinSxS
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\twain_32
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\Temp
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\wins
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\wbem
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\usmt
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\spool
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\ShellExt
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\Setup
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\ras
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\oobe
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\npp
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\mui
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\inetsrv
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\IME
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\icsxml
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\ias
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\export
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\etc
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\disdn
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\dhcp
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\config
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\3com_dmi
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\3076
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\2052
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\1054
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\1042
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\1041
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\1037
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\1033
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\1031
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\1028
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\1025
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\system32
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\system
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\security
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\Resources
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\repair
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\Provisioning
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\PeerNet
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\pchealth
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\mui
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\msapps
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\msagent
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\Media
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\java
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\ime
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\Help
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\Driver Cache
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\dell
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\Debug
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\Cursors
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\Connection Wizard
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\Config
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\AppPatch
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\addins
[2008/11/23 19:40:42 | 00,000,000 | ---D | C] -- C:\WINDOWS
[2008/11/20 14:44:26 | 00,042,320 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll

========== Files - Modified Within 30 Days ==========

[1 C:\WINDOWS\System32\*.tmp files]
[3 C:\WINDOWS\*.tmp files]
[2008/11/30 17:26:16 | 00,422,400 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Voltron\Desktop\OTViewIt.exe
[2008/11/30 17:24:33 | 00,195,368 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2008/11/30 17:24:31 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2008/11/30 17:24:30 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2008/11/30 17:23:48 | 04,287,764 | -H-- | M] () -- C:\Documents and Settings\Voltron\Local Settings\Application Data\IconCache.db
[2008/11/30 16:12:23 | 00,091,088 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2008/11/30 16:11:49 | 00,008,812 | -H-- | M] () -- C:\WINDOWS\System32\lovidave
[2008/11/30 16:07:58 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2008/11/30 16:07:17 | 02,372,472 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Voltron\Desktop\mbam-setup.exe
[2008/11/30 15:56:36 | 00,349,696 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Voltron\Desktop\OTMoveIt3.exe
[2008/11/30 15:24:30 | 00,305,705 | ---- | M] () -- C:\Documents and Settings\Voltron\Desktop\RSIT.exe
[2008/11/30 13:38:04 | 00,004,608 | ---- | M] () -- C:\Documents and Settings\Voltron\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/11/30 11:12:25 | 00,000,493 | ---- | M] () -- C:\Documents and Settings\Voltron\Desktop\Shortcut to ISOs.lnk
[2008/11/30 07:45:14 | 00,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2008/11/30 07:17:30 | 00,000,120 | -HS- | M] () -- C:\WINDOWS\System32\ilufazok.ini
[2008/11/29 23:31:40 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\Voltron\Desktop\HijackThis.lnk
[2008/11/29 23:31:24 | 00,812,344 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\Voltron\Desktop\HJTInstall.exe
[2008/11/29 22:15:04 | 00,137,992 | ---- | M] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2008/11/29 22:13:58 | 00,201,816 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.exe
[2008/11/29 21:44:32 | 00,012,540 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2008/11/29 21:44:32 | 00,012,540 | ---- | M] () -- C:\WINDOWS\System32\wpa.bak
[2008/11/29 21:42:37 | 00,458,340 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2008/11/29 21:42:37 | 00,392,296 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2008/11/29 21:42:37 | 00,058,596 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2008/11/29 21:28:47 | 00,000,288 | ---- | M] () -- C:\WINDOWS\System32\$winnt$.inf
[2008/11/29 21:26:33 | 00,000,084 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
[2008/11/29 21:26:29 | 00,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2008/11/29 21:26:28 | 00,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2008/11/29 21:26:28 | 00,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2008/11/29 21:26:16 | 00,004,161 | ---- | M] () -- C:\WINDOWS\ODBCINST.INI
[2008/11/29 21:25:24 | 00,000,477 | ---- | M] () -- C:\WINDOWS\win.ini
[2008/11/29 21:25:12 | 00,022,720 | ---- | M] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008/11/29 21:16:51 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2008/11/29 21:16:38 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\All Users\Documents\desktop.ini
[2008/11/29 21:16:38 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2008/11/29 20:26:50 | 00,096,978 | ---- | M] (Business Information Solutions) -- C:\Documents and Settings\Voltron\Desktop\VirtumundoBeGone.exe
[2008/11/29 19:24:30 | 27,462,344 | ---- | M] () -- C:\Documents and Settings\Voltron\Desktop\setupeng.exe
[2008/11/29 18:43:30 | 00,004,625 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2008/11/29 18:43:20 | 00,318,309 | ---- | M] () -- C:\WINDOWS\setupapi.old
[2008/11/29 17:02:52 | 23,804,784 | ---- | M] () -- C:\Documents and Settings\Voltron\Desktop\aaw2008.exe
[2008/11/29 16:46:17 | 04,713,897 | ---- | M] (GridinSoft, Inc. ) -- C:\Documents and Settings\Voltron\Desktop\trojankiller-setup.exe
[2008/11/28 10:57:50 | 00,012,816 | ---- | M] () -- C:\Documents and Settings\Voltron\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2008/11/28 10:57:06 | 00,000,595 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Craxtion4.lnk
[2008/11/28 10:14:42 | 00,001,528 | ---- | M] () -- C:\Documents and Settings\Voltron\Desktop\ImgBurn.lnk
[2008/11/28 09:00:15 | 00,000,402 | ---- | M] () -- C:\Documents and Settings\Voltron\Desktop\Shortcut to Rips.lnk
[2008/11/28 07:20:24 | 00,000,533 | ---- | M] () -- C:\Documents and Settings\Voltron\Desktop\Shortcut to xISO.lnk
[2008/11/28 07:10:43 | 00,000,345 | ---- | M] () -- C:\Documents and Settings\Voltron\Desktop\XBOX.lnk
[2008/11/28 05:47:25 | 00,012,736 | -H-- | M] () -- C:\WINDOWS\System32\mlfcache.dat
[2008/11/28 05:45:54 | 00,000,626 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\mIRC.lnk
[2008/11/28 05:11:25 | 00,000,104 | ---- | M] () -- C:\Documents and Settings\Voltron\Desktop\Shortcut to Internet.lnk
[2008/11/27 23:31:16 | 00,107,888 | ---- | M] (Sony DADC Austria AG.) -- C:\WINDOWS\System32\CmdLineExt.dll
[2008/11/27 20:18:30 | 00,000,586 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Play BF2 Online Now!.lnk
[2008/11/27 20:18:30 | 00,000,564 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Battlefield 2.lnk
[2008/11/26 18:56:30 | 00,000,211 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2008/11/26 02:13:53 | 00,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat
[2008/11/24 23:18:38 | 00,029,495 | ---- | M] () -- C:\Documents and Settings\Voltron\Desktop\all.m3u
[2008/11/24 23:16:00 | 00,000,664 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Winamp.lnk
[2008/11/24 20:12:11 | 00,001,497 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Combat Arms.lnk
[2008/11/24 04:13:22 | 00,000,630 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Ventrilo.lnk
[2008/11/24 04:13:22 | 00,000,262 | ---- | M] () -- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2008/11/24 02:30:20 | 00,066,872 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrA.exe
[2008/11/24 02:23:09 | 00,000,626 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Play BF2142 Online Now!.lnk
[2008/11/24 02:23:09 | 00,000,604 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Battlefield 2142.lnk
[2008/11/24 02:02:04 | 00,001,959 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ActiveArmor Firewall.lnk
[2008/11/24 02:01:54 | 00,001,024 | ---- | M] () -- C:\.rnd
[2008/11/24 02:01:50 | 00,000,022 | ---- | M] () -- C:\WINDOWS\FileName
[2008/11/24 01:57:42 | 00,000,078 | -HS- | M] () -- C:\Documents and Settings\Voltron\My Documents\desktop.ini
[2008/11/24 01:56:32 | 00,008,192 | ---- | M] () -- C:\WINDOWS\REGLOCS.OLD
[2008/11/24 01:54:05 | 00,000,084 | -HS- | M] () -- C:\Documents and Settings\Voltron\Start Menu\Programs\Startup\desktop.ini
[2008/11/24 01:54:03 | 00,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/11/24 01:54:03 | 00,000,000 | RHS- | M] () -- C:\IO.SYS
[2008/11/24 01:54:03 | 00,000,000 | ---- | M] () -- C:\WINDOWS\control.ini
[2008/11/24 01:54:03 | 00,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2008/11/24 01:54:03 | 00,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2008/11/24 01:51:48 | 00,000,037 | ---- | M] () -- C:\WINDOWS\vbaddin.ini
[2008/11/24 01:51:48 | 00,000,036 | ---- | M] () -- C:\WINDOWS\vb.ini
[2008/11/23 19:47:08 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Voltron\Application Data\desktop.ini
[2008/11/20 14:44:26 | 00,042,320 | ---- | M] () -- C:\WINDOWS\System32\xfcodec.dll
< End of report >






























OTViewIt Extras logfile created on: 11/30/2008 5:27:18 PM - Run 2
OTViewIt by OldTimer - Version 1.0.20.0 Folder = C:\Documents and Settings\Voltron\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.67 Gb Available Physical Memory | 83.44% Memory free
3.85 Gb Paging File | 3.66 Gb Available in Paging File | 95.18% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 156.24 Gb Total Space | 45.54 Gb Free Space | 29.15% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 30.06 Gb Total Space | 14.04 Gb Free Space | 46.71% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded

Computer Name: ZACK-287C23B1C1
Current User Name: Voltron
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Whitelist: On
File Age = 30 Days

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled"=1
"AntiVirusDisableNotify"=1
"FirewallDisableNotify"=1
"UpdatesDisableNotify"=1
"AntiVirusOverride"=0
"FirewallOverride"=0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\IcmpSettings]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[2004/08/12 08:05:01 | 00,140,800 | ---- | M] (Microsoft Corporation) -- %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
[2008/11/23 22:51:53 | 01,093,632 | ---- | M] (Nexon) -- C:\Nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe
[2008/11/07 06:11:10 | 01,055,744 | ---- | M] (Nexon) -- C:\Nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe
[2008/02/20 10:52:20 | 03,068,360 | ---- | M] (IniCom Networks, Inc.) -- C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
[2004/08/12 08:05:01 | 00,140,800 | ---- | M] (Microsoft Corporation) -- %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
[2006/02/17 10:17:08 | 00,020,543 | ---- | M] (Apache Software Foundation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server
[2008/05/21 13:33:10 | 08,419,956 | ---- | M] () -- H:\Battlefield 2142\BF2142.exe:*:Enabled:Battlefield 2
[2008/11/20 14:44:24 | 02,986,320 | ---- | M] (Xfire Inc.) -- C:\Program Files\Xfire\xfire.exe:*:Enabled:Xfire
[2008/11/10 10:23:50 | 01,539,072 | ---- | M] () -- C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe
File not found -- H:\CCP\EVE\bin\ExeFile.exe:*:Enabled:CCP ExeFile
[2008/11/24 20:09:54 | 00,159,744 | ---- | M] (Nexon) -- C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe:*:Enabled:Nexon Game Manager
[2008/11/23 22:51:53 | 01,093,632 | ---- | M] (Nexon) -- C:\Nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe
[2008/11/07 06:11:10 | 01,055,744 | ---- | M] (Nexon) -- C:\Nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe
[2008/10/01 13:39:08 | 01,470,464 | R--- | M] (Nexon Corp.) -- C:\Nexon\Combat Arms\NMService.exe:*:Enabled:Nexon Messenger Core
File not found -- C:\Program Files\eMule\emule.exe:*:Enabled:eMule
[2004/08/12 08:10:00 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe:*:Enabled:wmiprvse
[2008/11/29 22:13:58 | 00,201,816 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB
[2006/02/17 10:35:58 | 00,127,035 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe:*:Enabled:nSvcIp
File not found -- C:\Program Files\EA GAMES\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2
[2006/09/26 17:53:22 | 07,574,463 | ---- | M] () -- H:\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2
[2004/08/12 07:59:06 | 00,514,560 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\logonui.exe:*:Enabled:logonui
File not found -- C:\Program Files\GameSpy Arcade\Aphex.exe:*:Enabled:GameSpy Arcade
File not found -- C:\Program Files\Firefly Studios\Stronghold Crusader\Stronghold_Crusader_Extreme.exe:*:Enabled:Stronghold Crusader
[2004/08/12 07:56:59 | 00,030,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper
[2008/02/20 10:52:20 | 03,068,360 | ---- | M] (IniCom Networks, Inc.) -- C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3
File not found -- C:\Documents and Settings\Voltron\Desktop\auto_xbins_2008\xbins.exe:*:Enabled:xbins
File not found -- C:\XBOX\auto_xbins_2008\xbins.exe:*:Enabled:xbins
[2004/08/12 07:59:07 | 00,013,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\lsass.exe:*:Enabled:lsass
[2008/02/21 18:19:50 | 01,050,112 | ---- | M] () -- C:\Documents and Settings\Voltron\Desktop\xbins.exe:*:Enabled:xbins
[2006/02/17 10:39:02 | 00,139,264 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe:*:Enabled:nSvcAppFlt
[2008/10/17 02:39:50 | 02,810,880 | ---- | M] (mIRC Co. Ltd.) -- C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC
[2004/08/12 08:06:19 | 00,057,856 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spoolsv.exe:*:Enabled:spoolsv
[2004/08/12 07:57:20 | 01,032,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe:*:Enabled:Explorer
[2004/08/12 08:09:30 | 00,502,272 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\winlogon.exe:*:Enabled:winlogon
[2006/02/17 10:35:42 | 00,061,503 | ---- | M] (NVIDIA) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe:*:Enabled:nSvcLog

========== (O10) Winsock2 Catalogs ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\]
Protocol_Catalog9\Catalog_Entries\000000000001 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000002 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000003 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000004 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000005 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000006 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000007 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000008 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000009 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000010 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000011 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000012 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000013 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000014 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000015 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000016 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000017 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000018 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000019 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000020 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000021 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000022 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000023 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
Protocol_Catalog9\Catalog_Entries\000000000024 -- C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)

========== (O18) Protocol Handlers ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\]
ipp: [HKLM - No CLSID value]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\] - Protocol Handlers
[2002/05/24 12:22:16 | 00,532,480 | ---- | M] (Microsoft Corporation) C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL ipp\0x00000001:{E1D2BF42-A96B-11d1-9C6B-0000F875AC61} (HKLM) [HKLM - Microsoft OLE DB Moniker Binder for Internet Publishing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\]
msdaipp: [HKLM - No CLSID value]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\] - Protocol Handlers
[2002/05/24 12:22:16 | 00,532,480 | ---- | M] (Microsoft Corporation) C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL msdaipp\0x00000001:{E1D2BF42-A96B-11d1-9C6B-0000F875AC61} (HKLM) [HKLM - Microsoft OLE DB Moniker Binder for Internet Publishing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\] - Protocol Handlers
[2002/05/24 12:22:16 | 00,532,480 | ---- | M] (Microsoft Corporation) C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL msdaipp\oledb:{E1D2BF40-A96B-11d1-9C6B-0000F875AC61} (HKLM) [HKLM - MSDAIPP.BINDER]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}"=Battlefield 2™
"{1F6423DE-7959-4178-80E0-023C7EAA5347}"=NVIDIA ForceWare Network Access Manager
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}"=WebFldrs XP
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}"=Microsoft .NET Framework 2.0
"{789289CA-F73A-4A16-A331-54D498CE069F}"=Ventrilo Client
"{96E3AED5-3D0B-4BB0-84C2-1EDADB204487}"=FlashFXP v3
"{A7E07C2B-2220-4415-87E3-784D5814BC93}"=NVIDIA PhysX v8.09.04
"{B16ACC3B-A84E-46B2-B6B4-0E088A94A944}"=Craxtion4
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1"=Spybot - Search & Destroy
"{ED50ECE9-EC54-4C05-B5ED-EE4741A9F2EC}"=Battlefield 2142
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}"=Realtek High Definition Audio Driver
"Adobe Flash Player ActiveX"=Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin"=Adobe Flash Player 10 Plugin
"Combat Arms"=Combat Arms
"HijackThis"=HijackThis 2.0.2
"ImgBurn"=ImgBurn
"InstallShield_{1F6423DE-7959-4178-80E0-023C7EAA5347}"=NVIDIA ForceWare Network Access Manager
"Malwarebytes' Anti-Malware_is1"=Malwarebytes' Anti-Malware
"Microsoft .NET Framework 2.0"=Microsoft .NET Framework 2.0
"mIRC"=mIRC
"Mozilla Firefox (3.0.4)"=Mozilla Firefox (3.0.4)
"NVIDIA Drivers"=NVIDIA Drivers
"Winamp"=Winamp
"Windows Media Format Runtime"=Windows Media Format Runtime
"XBCD"=XBCD 1.07
"XBox Audio Driver"=XBox Audio Driver 0.2
"Xfire"=Xfire (remove only)

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/26/2008 11:07:39 PM | Computer Name = ZACK-287C23B1C1 | Source = | ID = 0
Description =

Error - 11/26/2008 11:07:39 PM | Computer Name = ZACK-287C23B1C1 | Source = | ID = 0
Description =

Error - 11/26/2008 11:25:16 PM | Computer Name = ZACK-287C23B1C1 | Source = Application Error | ID = 1000
Description = Faulting application ventrilo.exe, version 3.0.4.0, faulting module
unknown, version 0.0.0.0, fault address 0x4b435553.

Error - 11/26/2008 11:29:58 PM | Computer Name = ZACK-287C23B1C1 | Source = Application Hang | ID = 1002
Description = Hanging application uTorrent.exe, version 1.8.1.12639, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/27/2008 1:20:49 PM | Computer Name = ZACK-287C23B1C1 | Source = Application Error | ID = 1000
Description = Faulting application ventrilo.exe, version 3.0.4.0, faulting module
unknown, version 0.0.0.0, fault address 0x4b435553.

[ System Events ]
Error - 11/30/2008 7:19:56 PM | Computer Name = ZACK-287C23B1C1 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/30/2008 7:19:56 PM | Computer Name = ZACK-287C23B1C1 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/30/2008 7:19:56 PM | Computer Name = ZACK-287C23B1C1 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/30/2008 7:19:56 PM | Computer Name = ZACK-287C23B1C1 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/30/2008 7:19:56 PM | Computer Name = ZACK-287C23B1C1 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/30/2008 7:19:56 PM | Computer Name = ZACK-287C23B1C1 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/30/2008 7:19:57 PM | Computer Name = ZACK-287C23B1C1 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/30/2008 7:19:57 PM | Computer Name = ZACK-287C23B1C1 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/30/2008 7:19:57 PM | Computer Name = ZACK-287C23B1C1 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 11/30/2008 7:25:20 PM | Computer Name = ZACK-287C23B1C1 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the NVSvc service.


< End of report >




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users