Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan Virus Picked up on Avira


  • This topic is locked This topic is locked
11 replies to this topic

#1 Docker749

Docker749

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Hampshire
  • Local time:03:29 PM

Posted 01 December 2008 - 06:18 PM

Hi there
seem to have this popping up 7 to 20 times on start up tried everything to get rid

Virus or unwanted program 'TR/Silentbanker.N [trojan]'
detected in file 'C:\WINDOWS\system32\c_945760.nls.
Action performed: Deny access

done as requested on the help page and here are the results

1.Kaspersky Scan
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Monday, December 1, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, December 01, 2008 09:16:05
Records in database: 1428907
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
H:\
Z:\

Scan statistics:
Files scanned: 114530
Threat name: 1
Infected objects: 1
Suspicious objects: 0
Duration of the scan: 09:23:50


File name / Threat name / Threats count
C:\Documents and Settings\Sharron\Local Settings\Application Data\Identities\{F267441B-FC00-4A65-9899-97EE064867F0}\Microsoft\Outlook Express\Neil's.dbx Infected: not-a-virus:AdWare.Win32.Craagle.18 1

The selected area was scanned.

2 RSIT Info

.info.txt logfile of random's system information tool 1.04 2008-12-01 22:36:32

======Uninstall list======

-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\Program Files\Installshield Installation Information\{1002F323-18D1-4A79-95C8-84EA3E940287}\QBReplace.exe {1002F323-18D1-4A79-95C8-84EA3E940287}#{BB9C4072-0110-4192-A351-6DCEF8B67AFD}
-->C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNNMP.exe /UNINSTALL
-->MsiExec.exe /I{219B0DA4-8F1A-499D-8795-4A07C632521E}
-->MsiExec.exe /I{644B991F-B109-4360-9DA3-40CDAD13961C}
-->RunDll32 C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll,VoilaBarUnInstall
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
ABBYY FineReader 6.0 Sprint-->MsiExec.exe /I{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}
Ad-Aware SE Professional-->C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG
Adobe Acrobat 5.0-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.dll"
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Photoshop 7.0-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\Photoshop 7.0\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 7.0\Uninst.dll"
Adobe Reader 7.0.7-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70700000002}
Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Ambush Pack 1.00 for Pocket Tanks Deluxe-->"C:\Program Files\Pocket Tanks Deluxe\unins006.exe"
AnyDVD-->"C:\Program Files\SlySoft\AnyDVD\AnyDVD-uninst.exe" /D="C:\Program Files\SlySoft\AnyDVD"
Apple Mobile Device Support-->MsiExec.exe /I{976C2B2A-CE59-4AB3-83FB-BF895E28F2E6}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
a-squared Free 3.5-->"C:\Program Files\a-squared Free\unins000.exe"
Avanquest update-->C:\Program Files\InstallShield Installation Information\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}\setup.exe -runfromtemp -l0x0009 -removeonly
Avery DesignPro-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2CC982C0-7EAE-11D4-ACC3-0050568AD318}\setup.exe" -uninst
Avira Premium Security Suite-->C:\Program Files\Avira\Avira Premium Security Suite\SETUP.EXE /REMOVE
BitComet 0.91-->C:\Program Files\BitComet\uninst.exe
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
Caere Scan Manager 4.0-->C:\WINDOWS\UNSCAN40.EXE -f"C:\Program Files\Common Files\Caere\Scan Manager\DeIsL1.isu"
Card Game Classics -->C:\WINDOWS\uninst.exe -f"c:\program files\expert software\card game classics\DeIsL1.isu"
Chaos Pack 1.00 for Pocket Tanks Deluxe-->"C:\Program Files\Pocket Tanks Deluxe\unins007.exe"
Classic Menu 3.x for Office 2007-->"C:\Program Files\Classic Menu for Office\unins000.exe"
Coloreal-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BDE90251-93EB-4F6A-89D8-086E2D91DC56}\setup.exe"
Compaq Products & Accessories-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F484CCF1-34C3-49CE-80FF-B0B148D556AC}\setup.exe"
Compaq Wallpaper-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{03AAA1D8-D4CF-48BD-9C66-78B41D80DF06}\setup.exe"
Compaq WinDVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C1939820-A945-11D4-86F6-0001031E5712}\setup.exe" REMOVEALL
Cool Edit 2000-->C:\Program Files\CoolEdit2000\cep2unin.exe
Cool Edit Pro 2.1-->C:\Program Files\CoolEdit2000\cep2unin.exe
Cricut DesignStudio-->"C:\Program Files\Cricut Software\Cricut DesignStudio\uninstall.exe"
Download Accelerator Plus (DAP)-->C:\PROGRA~1\DAP\DAPREMOVE.EXE
Dr SpeedTouch-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CE6D39E2-D4CB-4C49-ABD9-8724B095D1EF}\Setup.exe" /l0009 -Control_Panel
DVD Decrypter (Remove Only)-->"C:\Program Files\DVD Decrypter\uninstall.exe"
DVD Shrink 3.2-->"C:\Program Files\DVD Shrink\unins000.exe"
Easy Access Button Support-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{93539D60-1817-11D1-9504-00805F26A89C}\setup.exe" -uninst
EasyRecovery Professional-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{A8BB9906-E618-406A-B161-7383AFF46C39} /l1033
EPSON Attach To Email-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{20C45B32-5AB6-46A4-94EF-58950CAF05E5} /l1033 ADDREMOVEDLG
EPSON Copy Utility 3-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{67EDD823-135A-4D59-87BD-950616D6E857}\SETUP.EXE" -l0x9 -UnInstall
EPSON Event Manager-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{48F22622-1CC2-4A83-9C1E-644DD96F832D}\Setup.exe" -l0x9 -u
EPSON File Manager-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E86BC406-944E-41F6-ADE6-2C136734C96B}\Setup.exe" -l0x9 UNINST
EPSON Image Clip Palette-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{314F6D08-A8B7-11D8-8446-0050BA1D384D}\Setup.exe" -l0x9 -u
EPSON Scan Assistant-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}\Setup.exe" -l0x9 -u
EPSON Scan-->C:\Program Files\epson\escndv\setup\setup.exe /r
FinePixViewer Resource-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B44529FF-501E-47CD-A06D-223C161BE058}\SETUP.EXE" -l0x9
FinePixViewer Ver.5.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{24ED4D80-8294-11D5-96CD-0040266301AD}\SETUP.EXE" -l0x9
Flamethrower Pack 1.00 for Pocket Tanks Deluxe-->"C:\Program Files\Pocket Tanks Deluxe\unins004.exe"
FreeRIP v2.944-->"C:\Program Files\FreeRIP2\unins000.exe"
FUJIFILM USB Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5490882C-6961-11D5-BAE5-00E0188E010B}\SETUP.EXE"
Garmin City Navigator Europe NT 2008-->MsiExec.exe /X{EEC8205A-E3DE-4C00-B60C-48E3B9B58B13}
Garmin POI Loader-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{08E4AE58-748D-4983-9B8A-495E2341769F}\setup.exe" -l0x9
Garmin WebUpdater-->MsiExec.exe /X{996EC44B-38E1-4898-8E47-3EE3D15F2712}
HighMAT Extension to Microsoft Windows XP CD Writing Wizard-->MsiExec.exe /X{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Format SDK (KB902344)-->"C:\WINDOWS\$NtUninstallKB902344$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
hp instant support-->C:\PROGRA~1\HEWLET~1\hpis\Uninstall.exe /s CeS
HP Software Update-->MsiExec.exe /X{936C42D0-8CEE-4BDF-B8CE-C4BDC93C6CF8}
ImageMixer VCD2 LE for FinePix-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B093990A-AAF2-44AC-9216-14BB7A2189B6}\SETUP.EXE" -l0x9
InCD-->C:\WINDOWS\NuNInst.exe /UNINSTALL
Intel® Network Connections Drivers-->Prounstl.exe
Iomega Tools for Windows NT-->C:\WINDOWS\uninst.exe -f"C:\Program Files\Iomega\ToolsNT\DeIsL1.isu"
iTunes-->MsiExec.exe /I{DDDE0BE3-0CBE-4BF6-B75A-E3F69C947843}
J2SE Runtime Environment 5.0 Update 9-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090}
Jane Greenoff Motif Library-->C:\PROGRA~1\Focus\Creator\UNWISE.EXE C:\PROGRA~1\Focus\Creator\INSTALL.LOG
Jane Greenoff Pattern Creator 2-->C:\PROGRA~1\FOCUSMM\JG2\UNWISE.EXE C:\PROGRA~1\FOCUSMM\JG2\INSTALL.LOG
Jane Greenoff's Cross Stitch Pattern Creator-->C:\WINDOWS\uninst.exe -f"C:\Program Files\Focus\Creator\DeIsL1.isu" -c"C:\Program Files\Focus\Creator\_ISREG32.DLL"
Java™ 6 Update 10-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
Java™ 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Jigs@w Puzzle-->C:\WINDOWS\tbuninst2.exe C:\Program Files\Jigs@w Puzzle\dezo.usc
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
MediaMonkey 2.5-->"C:\Program Files\MediaMonkey\unins000.exe"
Meteor Pack 1.00 for Pocket Tanks Deluxe-->"C:\Program Files\Pocket Tanks Deluxe\unins005.exe"
Microsoft .NET Framework 1.1 Hotfix (KB886903)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M886903\M886903Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft AutoRoute 2006-->MsiExec.exe /I{83ED1E80-A1B7-4236-BCF1-AC4A88151A6B}
Microsoft Base Smart Card Cryptographic Service Provider Package-->"C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Data Access Components KB870669-->C:\WINDOWS\muninst.exe C:\WINDOWS\INF\KB870669.inf
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Project 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-003B-0000-0000-0000000FF1CE} /uninstall {C1877F6E-C1C8-486D-A697-86431029690C}
Microsoft Office Project 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-00B4-0409-0000-0000000FF1CE} /uninstall {75EC8FFC-B913-4991-B3A1-22576D2FC45D}
Microsoft Office Project MUI (English) 2007-->MsiExec.exe /X{90120000-00B4-0409-0000-0000000FF1CE}
Microsoft Office Project Professional 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PRJPRO /dll OSETUP.DLL
Microsoft Office Project Professional 2007-->MsiExec.exe /X{90120000-003B-0000-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Visio 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-0051-0000-0000-0000000FF1CE} /uninstall {AA4F2610-5FF1-4DCD-A6FB-BCA2D09A6443}
Microsoft Office Visio 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-0054-0409-0000-0000000FF1CE} /uninstall {EA35370F-586C-45E1-AC6C-A4E275C6B762}
Microsoft Office Visio MUI (English) 2007-->MsiExec.exe /X{90120000-0054-0409-0000-0000000FF1CE}
Microsoft Office Visio Professional 2003-->MsiExec.exe /I{90510409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Visio Professional 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall VISPRO /dll OSETUP.DLL
Microsoft Office Visio Professional 2007-->MsiExec.exe /X{90120000-0051-0000-0000-0000000FF1CE}
Microsoft Office Word 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall WORD /dll OSETUP.DLL
Microsoft Office Word 2007-->MsiExec.exe /X{90120000-001B-0000-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Windows Journal Viewer-->MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA7}
Microsoft Word 2000 SR-1-->MsiExec.exe /I{00170409-78E1-11D2-B60F-006097C998E7}
Microsoft Works 2000-->MsiExec.exe /I{56364334-9530-11D2-BFFC-00C04FA329AA}
Microsoft XML Parser and SDK-->MsiExec.exe /I{3E908702-AF35-4611-9518-955DA24B7E07}
MobileMe Control Panel-->MsiExec.exe /I{2604C0F9-BFD3-4BA0-9EB5-22537C648F03}
ModemXpert-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9CB4FEE2-7F47-11D4-B6AD-00A0CC624550}\setup.exe" AnyText
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Nero PhotoShow Express-->"C:\Program Files\Ahead\Ahead\data\Xtras\Uninstall.exe"
Nero Suite-->C:\Program Files\Common Files\Ahead\Uninstall\Setup.exe /uninstall
NeroMIX-->C:\WINDOWS\UNNMIX.exe /UNINSTALL
NetWaiting-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe" AnyText
Nuke Pack 1.00 for Pocket Tanks Deluxe-->"C:\Program Files\Pocket Tanks Deluxe\unins002.exe"
NVIDIA Display Driver-->C:\WINDOWS\System32\nvudisp.exe Uninstall C:\WINDOWS\System32\nvdisp.nvu,NVIDIA Display Driver
NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI
NVIDIA Windows 2000/XP Display Drivers-->rundll32.exe C:\WINDOWS\system32\nvinstnt.dll,NvUninstallNT4 nv4_disp.inf
Orange Livebox-->C:\WINDOWS\Uninstall_Livebox.EXE
Orange Toolbar-->C:\Program Files\Orange Toolbar UK\uninst.exe
Panda ActiveScan-->C:\WINDOWS\system32\ASUninst.exe Panda ActiveScan
PDF Password Remover v2.5-->"C:\Program Files\PDF Password Remover v2.5\unins000.exe"
Photosmart 140,240,7200,7600,7700,7900 Series-->C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\setup\hpzscr01.exe -datfile hphscr01.dat
Pocket Tanks Deluxe 1.00a-->"C:\Program Files\Pocket Tanks Deluxe\unins000.exe"
Power Pack 1.00 for Pocket Tanks Deluxe-->"C:\Program Files\Pocket Tanks Deluxe\unins003.exe"
Presto! BizCard 4.1 Eng-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\NewSoft\BizCard 4.1 Eng\Uninst.isu" -c"C:\WINDOWS\StiRegstEng.dll"
QuickBooks Accountant 2005-->C:\Program Files\Installshield Installation Information\{442E5923-1BB6-4EAA-893D-62291D87219A}\QBReplace.exe {442E5923-1BB6-4EAA-893D-62291D87219A}#{BA0FD89C-32B4-4D4E-A024-D2B071C84749}
QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
RAW FILE CONVERTER LE-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D680C913-5955-469D-9D88-C1940F7506D6}\SETUP.EXE" -l0x9
RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Runtime 8.0 Libraries-->MsiExec.exe /I{EA4FA30B-7321-4428-90E9-28B088EC8DC9}
Sage Instant Accounting 2000-->C:\WINDOWS\IsUninst.exe -fC:\INSTACC\UNINST.ISU
Same3 Installation-->C:\WINDOWS\st6unst.exe -n "C:\Program Files\Same3\ST6UNST.000"
ScanSoft PDF Converter 3.0-->MsiExec.exe /I{602A205F-8D02-48EE-8782-262B2103B984}
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {90120000-003B-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {90120000-0051-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {90120000-003B-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {90120000-0051-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB955936)-->msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {1D94099C-2BBA-440E-BD5E-093BBDF8F028}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {90120000-003B-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {90120000-0051-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office Word 2007 (KB950113)-->msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
Security Update for Step By Step Interactive Training (KB898458)-->"C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
Security Update for Step By Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Security Update for Visio 2007 (KB947590)-->msiexec /package {90120000-0051-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
Security Update for Windows Internet Explorer 7 (KB928090)-->"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB929969)-->"C:\WINDOWS\ie7updates\KB929969\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB931768)-->"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB933566)-->"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB937143)-->"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB939653)-->"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB911565)-->"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Sony Ericsson Media Manager 1.0-->MsiExec.exe /X{06AC45D1-CB9B-48CC-B5C8-1A55DEE26AD0}
Sony Ericsson PC Suite 3.010.00-->C:\Program Files\InstallShield Installation Information\{2FFE93F0-BB72-4E52-8761-354D1AAA9387}\Setup.exe -runfromtemp -l0x0009 -removeonly
SoundMAX2-->C:\Program Files\Analog Devices\SoundMAX 2\ADIOUT.BAT
SpeedTouch USB Software-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D41FAAA9-8048-4906-86B2-9AADEA1FA0B7}\Setup.exe" /l0009 -Control_Panel
Spybot - Search & Destroy 1.5.2.20-->"C:\WINDOWS\unins000.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins001.exe"
Super Pack v1.00 for Pocket Tanks Deluxe-->"C:\Program Files\Pocket Tanks Deluxe\unins001.exe"
SUPERAntiSpyware Free Edition-->MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
Sure Cuts A Lot 1.002-->"C:\Program Files\Craft Edge\Sure Cuts A Lot\unins000.exe"
Thoosje Quick Xp Optimizer Installer V2-->MsiExec.exe /I{D21B65C4-F7ED-4805-8781-BB835AC85D14}
Thoosje Sidebar V2.3-->C:\Program Files\Thoosje Sidebar V2.3\Uninstall.exe
Uniblue ProcessScanner-->"C:\Program Files\Uniblue\ProcessScanner\unins000.exe"
Update for Office 2007 (KB946691)-->msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Office 2007 (KB946691)-->msiexec /package {90120000-003B-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Office 2007 (KB946691)-->msiexec /package {90120000-0051-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update Service-->C:\Program Files\Sony Ericsson\Update Service\uninst.exe
Video Converter 3-->C:\Program Files\Xilisoft\Video Converter 3\Uninstall.exe
Virtual Pool Hall-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Interplay Productions\Virtual Pool Hall\Uninst.isu"
Wanadoo Search Toolbar-->C:\Program Files\Wanadoo\WSBar\Uninstall.exe
Windows Driver Package - FTDI CDM Driver Package (06/27/2007 2.02.04)-->C:\PROGRA~1\DIFX\F5DE4F5A04FFC80D\DPInst.exe /u C:\WINDOWS\system32\DRVSTORE\ftdibus_1EFE8ACE84BF7FF75302177777293E12CA62079A\ftdibus.inf
Windows Driver Package - FTDI CDM Driver Package (06/27/2007 2.02.04)-->C:\PROGRA~1\DIFX\F5DE4F5A04FFC80D\DPInst.exe /u C:\WINDOWS\system32\DRVSTORE\ftdiport_E3FE268552211CE3257EFBEE0E69543753506151\ftdiport.inf
Windows Genuine Advantage v1.3.0254.0-->MsiExec.exe /I{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}
Windows Live Safety Scanner-->RunDll32.exe "C:\Program Files\Windows Live Safety Center\wlscCore.dll",UninstallFunction WLSC_SCANNER_PRODUCT
Windows Media Connect-->"C:\WINDOWS\$NtUninstallWMCSetup$\spuninst\spuninst.exe"
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Format SDK Hotfix - KB891122-->"C:\WINDOWS\$NtUninstallKB891122$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
WinZip-->"C:\Program Files\WinZip\WINZIP32.EXE" /uninstall
Your Uninstaller! 2006 Version 5-->"C:\Program Files\Your Uninstaller 2006\unins000.exe"

======Hosts File======

127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com

======Security center information======

AV: Avira Premium Security Suite
FW: Avira Firewall

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 1 Stepping 2, GenuineIntel
"PROCESSOR_REVISION"=0102
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"VERSION"=3.0.1
"SESSIONID"=1081266535464wuws06-le8a021:fc05fae345:10fd
"COLLECTIONID"=COL5123
"ITEMID"=dj-17724-8
"TOOLPATH"=/C:\Program%20Files\Hewlett-Packard\HP%20Software%20Update\install.htm
"HMSERVER"=https://h30083.www3.hp.com/wuss/servlet/WUSSServlet
"SWUTVER"=1.0.3.1
"OSVER"=winXPH
"LANG"=2057
"TIMEOUT"=0
"FP_NO_HOST_CHECK"=NO
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip

-----------------EOF-----------------

3. RSIT Report

Logfile of random's system information tool 1.04 (written by random/random)
Run by Sharron at 2008-12-01 22:35:24
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 11 GB (32%) free of 34 GB
Total RAM: 1023 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:36:19, on 01/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\Avira Premium Security Suite\sched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe
C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Documents and Settings\Sharron\Desktop\RSIT.exe
C:\Program Files\trend micro\Sharron.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: Orange Toolbar - {E97B5F2E-CA8E-4D34-BDA3-44EEC4ED2B12} - C:\Program Files\Orange Toolbar UK\ToolbarContainer192.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://sib1.od2.com/common/Member/ClientIn...2/OCI/setup.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/d...wlscbase969.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} -
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) -
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} -
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} -
O20 - AppInit_DLLs: karna.dat_
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira Premium Security Suite Firewall (AntiVirFirewallService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe
O23 - Service: Avira Premium Security Suite MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe
O23 - Service: Avira Premium Security Suite Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\sched.exe
O23 - Service: Avira Premium Security Suite Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe
O23 - Service: Avira Premium Security Suite WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AST Service (astcc) - Unknown owner - C:\WINDOWS\SYSTEM32\astsrv.exe (file missing)
O23 - Service: Avira Premium Security Suite MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: IomegaAccess - Iomega Corporation - C:\Program Files\Iomega\ToolsNT\IomegaAccess.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ptssvc - Unknown owner - C:\Program Files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe (file missing)

--
End of file - 7654 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 63128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8B68564D-53FD-4293-B80C-993A9F3988EE} - Wanadoo - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll [2004-02-12 286720]
{E97B5F2E-CA8E-4D34-BDA3-44EEC4ED2B12} - Orange Toolbar - C:\Program Files\Orange Toolbar UK\ToolbarContainer192.dll [2007-02-21 249856]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe [2008-04-14 169984]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\antiviirus]
C:\Program Files\antiviirus.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe /min []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\brastk]
brastk.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVD43]
C:\PROGRA~1\DVDREG~1\DVDRegionFree.exe /hidden []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EEventManager]
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe [2005-04-08 102400]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe [2003-05-07 188416]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ioloDelayModule]
C:\Program Files\iolo\System Mechanic Professional 6\delay.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2008-10-01 289576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jjfybptk]
C:\WINDOWS\system32\vodunyzi.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\WINDOWS\system32\NvCpl.dll [2003-07-28 4841472]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIEW]
C:\WINDOWS\system32\nview.dll [2003-07-28 852038]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\WINDOWS\system32\NvMcTray.dll [2003-07-28 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
C:\Program Files\McAfee.com\VSO\oasclnt.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC-Cleaner]
C:\Program Files\PC-Cleaner\PC-Cleaner.exe hide []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF3 Registry Controller]
C:\Program Files\ScanSoft\PDF Converter 3.0\\RegistryController.exe [2005-04-12 106496]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE]
C:\Program Files\REGSHAVE\REGSHAVE.EXE [2002-02-04 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSystemAnalyzer]
C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe [2007-08-02 348160]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics]
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe [2004-01-26 866816]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\srmclean]
C:\Cpqs\Scom\srmclean.exe [2001-07-24 36864]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2003-09-30 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STManager]
C:/Program Files/SpeedTouch/Dr SpeedTouch/drst.exe -b []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe [2008-02-22 144784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2005-08-05 180269]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe /checktask []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WCOLOREAL]
C:\Program Files\COMPAQ\Coloreal\coloreal.exe [2001-08-14 131072]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Exif Launcher.lnk]
C:\PROGRA~1\FINEPI~1\QuickDCF.exe [2004-11-26 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ZipToA"=2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="karna.dat_"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2008-07-23 352256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=157

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\DAP\DAP.exe"="C:\Program Files\DAP\DAP.exe:*:Disabled:Download Accelerator Plus"
"C:\Program Files\Ahead\Nero\nero.exe"="C:\Program Files\Ahead\Nero\nero.exe:*:Enabled:Nero Burning ROM"
"C:\WINDOWS\system32\fxsclnt.exe"="C:\WINDOWS\system32\fxsclnt.exe:*:Enabled:Microsoft Fax Console"
"C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe"="C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe:*:Enabled:Dr SpeedTouch"
"C:\Program Files\Real\RealPlayer\realplay.exe"="C:\Program Files\Real\RealPlayer\realplay.exe:*:Disabled:RealPlayer"
"C:\WINDOWS\system32\mmc.exe"="C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console"
"C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Grisoft\AVG Free\avginet.exe"="C:\Program Files\Grisoft\AVG Free\avginet.exe:*:Enabled:avginet.exe"
"C:\Program Files\Grisoft\AVG Free\avgamsvr.exe"="C:\Program Files\Grisoft\AVG Free\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\Program Files\Grisoft\AVG Free\avgcc.exe"="C:\Program Files\Grisoft\AVG Free\avgcc.exe:*:Enabled:avgcc.exe"
"C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe"="C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime"
"C:\Program Files\Sony Ericsson\Sony Ericsson Media Manager 1.0\MediaManager.exe"="C:\Program Files\Sony Ericsson\Sony Ericsson Media Manager 1.0\MediaManager.exe:*:Enabled:Sony Ericsson Media Manager 1.0"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Disabled:LimeWire"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\Sony Ericsson\Update Service\Update Service.exe"="C:\Program Files\Sony Ericsson\Update Service\Update Service.exe:*:Enabled:Update Service"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\english\setup.exe"="C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\english\setup.exe:*:Disabled:Kaspersky Anti-Virus 2009 Setup"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Disabled:Bonjour"
"C:\Program Files\BitTornado\btdownloadgui.exe"="C:\Program Files\BitTornado\btdownloadgui.exe:*:Disabled:btdownloadgui"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28e9d890-2db7-11da-a030-0090d0e13b71}]
shell\AutoRun\command - G:\setupSNK.exe


======File associations======

.js - open - NOTEPAD.EXE %1
.vbs - open - NOTEPAD.EXE %1

======List of files/folders created in the last 3 months======

2008-12-01 22:35:28 ----D---- C:\Program Files\trend micro
2008-12-01 22:35:24 ----D---- C:\rsit
2008-11-30 19:26:38 ----D---- C:\Program Files\a-squared Free
2008-11-29 23:38:59 ----D---- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-11-29 23:38:44 ----D---- C:\Program Files\SUPERAntiSpyware
2008-11-29 23:38:44 ----D---- C:\Documents and Settings\Sharron\Application Data\SUPERAntiSpyware.com
2008-11-29 23:38:16 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2008-11-29 22:57:17 ----D---- C:\Program Files\Enigma Software Group
2008-11-16 17:41:12 ----D---- C:\Documents and Settings\Sharron\Application Data\Avira
2008-11-16 17:29:53 ----A---- C:\WINDOWS\system32\avsda.dll
2008-11-16 17:29:44 ----D---- C:\Program Files\Avira
2008-11-16 17:29:44 ----D---- C:\Documents and Settings\All Users\Application Data\Avira
2008-11-16 12:21:55 ----D---- C:\fsaua.data
2008-11-16 11:13:22 ----D---- C:\WINDOWS\ERUNT
2008-11-16 10:49:38 ----D---- C:\SDFix
2008-11-13 10:18:45 ----SH---- C:\WINDOWS\SC62B1AA2.tmp
2008-11-12 21:22:00 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2008-11-12 21:18:11 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2008-11-12 21:14:42 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2008-11-07 23:26:50 ----D---- C:\Documents and Settings\Sharron\Application Data\PC Tools
2008-11-07 23:26:50 ----D---- C:\Documents and Settings\All Users\Application Data\PC Tools
2008-11-07 23:00:04 ----A---- C:\WINDOWS\ntbtlog.txt
2008-10-31 21:17:28 ----D---- C:\Documents and Settings\Sharron\Application Data\Malwarebytes
2008-10-31 21:16:54 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-31 21:16:53 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-31 21:01:50 ----A---- C:\WINDOWS\system32\javaws.exe
2008-10-31 21:01:50 ----A---- C:\WINDOWS\system32\javaw.exe
2008-10-31 21:01:50 ----A---- C:\WINDOWS\system32\java.exe
2008-10-31 21:01:50 ----A---- C:\WINDOWS\system32\deploytk.dll
2008-10-31 15:41:24 ----D---- C:\Documents and Settings\All Users\Application Data\Avg8
2008-10-31 15:33:36 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-10-24 22:59:48 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-10-23 20:20:31 ----HDC---- C:\Documents and Settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
2008-10-14 22:06:26 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-10-14 22:06:05 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$
2008-10-14 22:05:49 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-10-14 21:59:16 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-10-14 21:58:31 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2008-10-03 21:02:08 ----D---- C:\Program Files\iPod
2008-10-03 21:02:06 ----D---- C:\Program Files\iTunes
2008-10-03 21:02:06 ----D---- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-03 21:00:09 ----D---- C:\Program Files\Bonjour
2008-10-03 20:58:00 ----D---- C:\Program Files\QuickTime
2008-09-30 16:43:34 ----A---- C:\WINDOWS\system32\msxml4.dll
2008-09-28 20:08:11 ----A---- C:\WINDOWS\Cpwin32.ini
2008-09-28 20:07:58 ----A---- C:\WINDOWS\system32\zip32.dll
2008-09-28 20:07:46 ----D---- C:\cpwin32
2008-09-28 20:07:46 ----A---- C:\WINDOWS\system32\ebCrypt.dll
2008-09-28 20:07:41 ----A---- C:\WINDOWS\system32\Odbctl32.dll
2008-09-14 08:44:23 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-09-14 08:42:57 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$

======List of files/folders modified in the last 3 months======

2008-12-01 22:35:28 ----AD---- C:\Program Files
2008-12-01 22:34:35 ----D---- C:\WINDOWS\Prefetch
2008-12-01 22:23:26 ----D---- C:\WINDOWS\Temp
2008-12-01 21:18:24 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2008-12-01 12:30:55 ----ASH---- C:\boot.ini
2008-12-01 12:30:30 ----A---- C:\WINDOWS\win.ini
2008-12-01 12:30:30 ----A---- C:\WINDOWS\system.ini
2008-12-01 12:29:44 ----D---- C:\WINDOWS\system32\CatRoot2
2008-12-01 12:27:43 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-12-01 12:15:40 ----D---- C:\WINDOWS\system32
2008-12-01 07:21:01 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-30 21:09:07 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-11-30 16:24:32 ----SHD---- C:\System Volume Information
2008-11-30 11:04:25 ----D---- C:\WINDOWS\system32\Restore
2008-11-30 10:57:24 ----SD---- C:\WINDOWS\Tasks
2008-11-30 10:09:45 ----AD---- C:\WINDOWS
2008-11-29 23:38:56 ----SHD---- C:\WINDOWS\Installer
2008-11-29 23:38:54 ----SHD---- C:\Config.Msi
2008-11-29 23:38:16 ----D---- C:\Program Files\Common Files
2008-11-29 22:58:11 ----D---- C:\WINDOWS\system32\drivers
2008-11-29 14:01:13 ----A---- C:\WINDOWS\NeroDigital.ini
2008-11-24 17:26:48 ----D---- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-11-23 19:32:43 ----D---- C:\WINDOWS\system32\NtmsData
2008-11-18 19:45:35 ----A---- C:\WINDOWS\Chuffc.INI
2008-11-16 22:37:03 ----D---- C:\Program Files\Microsoft AutoRoute
2008-11-16 19:41:16 ----HD---- C:\Program Files\InstallShield Installation Information
2008-11-16 18:56:11 ----HD---- C:\WINDOWS\inf
2008-11-16 11:17:12 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-11-14 16:13:08 ----D---- C:\WINDOWS\system32\wbem
2008-11-14 16:12:53 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-11-14 13:41:12 ----D---- C:\WINDOWS\system32\ActiveScan
2008-11-13 22:30:02 ----D---- C:\WINDOWS\Drivers
2008-11-13 22:16:39 ----D---- C:\WINDOWS\msagent
2008-11-13 22:13:24 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-11-13 10:54:54 ----D---- C:\WINDOWS\Registration
2008-11-13 09:21:37 ----D---- C:\Documents and Settings\Sharron\Application Data\LimeWire
2008-11-13 01:43:19 ----D---- C:\Documents and Settings\Sharron\Application Data\MSN6
2008-11-13 01:37:14 ----D---- C:\WINDOWS\network diagnostic
2008-11-13 01:23:22 ----SHD---- C:\RECYCLER
2008-11-13 01:09:07 ----D---- C:\Documents and Settings
2008-11-12 21:31:56 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-11-12 21:21:55 ----HD---- C:\WINDOWS\$hf_mig$
2008-11-12 21:12:41 ----D---- C:\WINDOWS\WinSxS
2008-11-12 16:02:43 ----D---- C:\WINDOWS\History
2008-11-07 23:34:44 ----D---- C:\WINDOWS\Help
2008-11-07 23:31:10 ----D---- C:\WINDOWS\system32\config
2008-11-04 00:10:25 ----A---- C:\WINDOWS\system32\MRT.exe
2008-10-31 21:00:53 ----D---- C:\Program Files\Java
2008-10-31 20:23:30 ----D---- C:\Program Files\FreeRIP2
2008-10-31 14:01:38 ----D---- C:\WINDOWS\system32\CatRoot
2008-10-23 20:30:44 ----D---- C:\Program Files\Uniblue
2008-10-22 20:20:14 ----A---- C:\WINDOWS\APDFPRP.INI
2008-10-22 20:11:57 ----A---- C:\pdfinfo.ini
2008-10-22 20:11:45 ----A---- C:\WINDOWS\verypdf.ini
2008-10-21 06:52:01 ----D---- C:\Program Files\Microsoft Silverlight
2008-10-18 20:11:34 ----AC---- C:\WINDOWS\EyeCand3.INI
2008-10-16 14:13:40 ----A---- C:\WINDOWS\system32\wuweb.dll
2008-10-16 14:13:40 ----A---- C:\WINDOWS\system32\wuaueng.dll
2008-10-16 14:12:22 ----A---- C:\WINDOWS\system32\wucltui.dll
2008-10-16 14:12:20 ----A---- C:\WINDOWS\system32\wuapi.dll
2008-10-16 14:09:44 ----A---- C:\WINDOWS\system32\wups2.dll
2008-10-16 14:09:44 ----A---- C:\WINDOWS\system32\wuauclt.exe
2008-10-16 14:09:44 ----A---- C:\WINDOWS\system32\cdm.dll
2008-10-16 14:09:40 ----A---- C:\WINDOWS\system32\wucltui.dll.mui
2008-10-16 14:08:58 ----A---- C:\WINDOWS\system32\wups.dll
2008-10-16 14:07:44 ----A---- C:\WINDOWS\system32\wuapi.dll.mui
2008-10-16 14:07:14 ----A---- C:\WINDOWS\system32\wuaueng.dll.mui
2008-10-16 14:06:48 ----A---- C:\WINDOWS\system32\muweb.dll
2008-10-16 14:06:48 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2008-10-16 14:06:48 ----A---- C:\WINDOWS\system32\mucltui.dll
2008-10-15 16:34:24 ----A---- C:\WINDOWS\system32\netapi32.dll
2008-10-14 22:05:12 ----D---- C:\Program Files\Internet Explorer
2008-10-11 12:38:12 ----RSD---- C:\WINDOWS\assembly
2008-10-10 17:21:47 ----SD---- C:\Documents and Settings\Sharron\Application Data\Microsoft
2008-10-10 16:43:11 ----D---- C:\WINDOWS\ShellNew
2008-10-03 21:02:56 ----DC---- C:\WINDOWS\system32\DRVSTORE
2008-10-03 20:58:14 ----D---- C:\Program Files\Common Files\Apple
2008-10-03 17:41:15 ----A---- C:\WINDOWS\system32\ieframe.dll
2008-09-28 20:08:12 ----AC---- C:\WINDOWS\ODBCINST.INI
2008-09-10 01:14:56 ----N---- C:\WINDOWS\system32\msxml6.dll
2008-09-04 17:15:04 ----A---- C:\WINDOWS\system32\msxml3.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 as6eio;as6eio; C:\WINDOWS\System32\drivers\as6eio.SYS [1997-12-09 3616]
R1 avfwot;avfwot; C:\WINDOWS\system32\DRIVERS\avfwot.sys [2008-05-07 71592]
R1 avgio;avgio; \??\C:\Program Files\Avira\Avira Premium Security Suite\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2008-11-25 75072]
R1 Cdr4_2K;Cdr4_2K; C:\WINDOWS\system32\drivers\Cdr4_2K.sys [2002-12-28 53072]
R1 Cdr4_xp;Cdr4_xp; C:\WINDOWS\system32\drivers\Cdr4_xp.sys [2003-01-13 64208]
R1 Cdralw2k;Cdralw2k; C:\WINDOWS\system32\drivers\Cdralw2k.sys [2003-01-13 24839]
R1 cdrbsdrv;cdrbsdrv; C:\WINDOWS\system32\drivers\cdrbsdrv.sys [2004-03-08 13567]
R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2007-08-07 25160]
R1 InCDPass;InCDPass; C:\WINDOWS\System32\DRIVERS\InCDPass.sys [2004-09-13 28672]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\System32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 pctfw2;pctfw2; \??\C:\WINDOWS\system32\drivers\pctfw2.sys []
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-18 12032]
R2 Aspi32;Aspi32; C:\WINDOWS\system32\drivers\Aspi32.sys [1999-09-10 25244]
R2 Cnxtdiag;Cnxtdiag; C:\WINDOWS\System32\DRIVERS\cnxtdiag.sys [2001-07-03 17776]
R2 Fallback;Fallback; C:\WINDOWS\System32\DRIVERS\fallback.sys [2001-06-24 308403]
R2 Fsks;Fsks; C:\WINDOWS\System32\DRIVERS\fsksnt.sys [2001-06-24 124189]
R2 K56;K56; C:\WINDOWS\System32\DRIVERS\k56nt.sys [2001-06-24 427215]
R2 MaVctrl;MaVctrl; C:\WINDOWS\system32\DRIVERS\MaVc2K.sys [2004-08-23 11089]
R2 SoftFax;SoftFax; C:\WINDOWS\System32\DRIVERS\faxnt.sys [2001-06-24 215195]
R2 Tones;Tones; C:\WINDOWS\System32\DRIVERS\tonesnt.sys [2001-06-24 59375]
R2 V124;V124; C:\WINDOWS\System32\DRIVERS\v124nt.sys [2001-07-16 539917]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2003-03-13 100224]
R3 AnyDVD;AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [2007-08-04 96704]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 avfwim;AvFw Packet Filter Miniport; C:\WINDOWS\system32\DRIVERS\avfwim.sys [2008-05-07 71464]
R3 avgntflt;avgntflt; \??\C:\Program Files\Avira\Avira Premium Security Suite\avgntflt.sys []
R3 E100B;Intel® PRO Network Connection Driver; C:\WINDOWS\System32\DRIVERS\e100b325.sys [2007-11-16 165496]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\System32\DRIVERS\HPZid412.sys [2005-10-21 49920]
R3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\System32\DRIVERS\HPZipr12.sys [2005-10-21 16496]
R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\System32\DRIVERS\HPZius12.sys [2005-10-22 21568]
R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSFDPSP2.sys [2004-08-03 1041536]
R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\system32\DRIVERS\HSFBS2S2.sys [2004-08-03 220032]
R3 MaBtPort;MA Bluetooth VCOM Driver; C:\WINDOWS\system32\DRIVERS\mabtport.sys [2004-12-29 101952]
R3 MaBtVad;Mobile Action Bluetooth Audio; C:\WINDOWS\system32\DRIVERS\MaBtVad.sys [2004-12-10 14414]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2003-07-28 1341339]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2003-05-27 578304]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSFCXTS2.sys [2004-08-03 685056]
R4 InCDfs;InCD File System; C:\WINDOWS\system32\drivers\InCDfs.sys [2004-09-13 93440]
S1 EACMOS;EACMOS; C:\WINDOWS\system32\drivers\EACMOS.SYS []
S1 EAWDMFD;EAWDMFD; C:\WINDOWS\system32\drivers\EAWDMFD.sys []
S2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2004-08-03 11868]
S3 alcan5wn;SpeedTouch USB ADSL PPP Networking Driver (NDISWAN); C:\WINDOWS\system32\DRIVERS\alcan5wn.sys [2003-12-08 53600]
S3 alcaudsl;SpeedTouch ADSL Modem ATM Transport; C:\WINDOWS\system32\DRIVERS\alcaudsl.sys [2003-12-08 70688]
S3 basic2;basic2; C:\WINDOWS\System32\DRIVERS\basic2.sys [2001-07-16 76610]
S3 catchme;catchme; \??\C:\DOCUME~1\Sharron\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 ENUM1394;%1394\031887&040892.DeviceDesc%; C:\WINDOWS\System32\DRIVERS\enum1394.sys [2001-08-17 6400]
S3 FTDIBUS;USB Serial Converter Driver; C:\WINDOWS\system32\drivers\ftdibus.sys [2007-06-27 53184]
S3 FTSER2K;USB Serial Port Driver; C:\WINDOWS\system32\drivers\ftser2k.sys [2007-06-27 71488]
S3 ggflt;SEMC USB Flash Driver Filter; C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-08-31 13352]
S3 ggsemc;SEMC USB Flash Driver; C:\WINDOWS\system32\DRIVERS\ggsemc.sys [2008-08-31 21672]
S3 MaBtc;MA Bluetooth Core Driver; C:\WINDOWS\system32\DRIVERS\MABTC.sys [2005-01-18 96736]
S3 MaRdPnp;MaRdPnp; C:\WINDOWS\system32\DRIVERS\MaRdP2K.sys [2004-09-13 49611]
S3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\System32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nuvaud2;Pinnacle DVC 80 Audio; C:\WINDOWS\System32\DRIVERS\nuvaud2.sys [2001-12-03 26560]
S3 NUVision;Pinnacle DVC 80 Video; C:\WINDOWS\system32\DRIVERS\nuvvid2.sys [2001-12-03 155264]
S3 nuvvid2;NUVision II Video Service; C:\WINDOWS\System32\DRIVERS\nuvvid2.sys [2001-12-03 155264]
S3 nv4;nv4; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2003-07-28 1341339]
S3 Pcouffin;Low level access layer for CD devices; C:\WINDOWS\System32\Drivers\Pcouffin.sys []
S3 QCDonner;Logitech QuickCam Express(PID_0840); C:\WINDOWS\System32\DRIVERS\LVCD.sys [2002-06-10 39936]
S3 Rksample;Rksample; C:\WINDOWS\System32\DRIVERS\rksample.sys [2001-07-15 67222]
S3 s117bus;Sony Ericsson Device 117 driver (WDM); C:\WINDOWS\system32\DRIVERS\s117bus.sys [2007-06-25 82984]
S3 s117mdfl;Sony Ericsson Device 117 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s117mdfl.sys [2007-06-25 14888]
S3 s117mdm;Sony Ericsson Device 117 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s117mdm.sys [2007-06-25 108456]
S3 s117mgmt;Sony Ericsson Device 117 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s117mgmt.sys [2007-06-25 100264]
S3 s117nd5;Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (NDIS); C:\WINDOWS\system32\DRIVERS\s117nd5.sys [2007-06-25 22952]
S3 s117obex;Sony Ericsson Device 117 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s117obex.sys [2007-06-25 98344]
S3 s117unic;Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (WDM); C:\WINDOWS\system32\DRIVERS\s117unic.sys [2007-06-25 98856]
S3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
S3 Ser2pl;Prolific Serial port driver; C:\WINDOWS\system32\DRIVERS\ser2pl.sys [2003-07-16 43264]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\System32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 StillCam;Still Serial Digital Camera Driver; C:\WINDOWS\System32\DRIVERS\serscan.sys [2001-08-17 6784]
S3 streamip;BDA IPSink; C:\WINDOWS\System32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2007-10-31 30464]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 usbser;MOTOROLA Modem Driver; C:\WINDOWS\system32\DRIVERS\usbser.sys [2008-04-13 26112]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\System32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 a2free;a-squared Free Service; C:\Program Files\a-squared Free\a2service.exe [2008-11-30 419448]
R2 AntiVirFirewallService;Avira Premium Security Suite Firewall; C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe [2008-05-16 344321]
R2 AntiVirMailService;Avira Premium Security Suite MailGuard; C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe [2008-11-25 164097]
R2 AntiVirScheduler;Avira Premium Security Suite Scheduler; C:\Program Files\Avira\Avira Premium Security Suite\sched.exe [2008-10-15 68865]
R2 AntiVirService;Avira Premium Security Suite Guard; C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe [2008-10-15 151297]
R2 antivirwebservice;Avira Premium Security Suite WebGuard; C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE [2008-06-12 258305]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-10-01 116040]
R2 AVEService;Avira Premium Security Suite MailGuard helper service; C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe [2008-05-09 41217]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 InCDsrv;InCD Helper; C:\Program Files\Ahead\InCD\InCDsrv.exe [2004-09-13 1192050]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-10-31 152984]
R2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\system32\nvsvc32.exe [2003-07-28 77824]
R2 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 astcc;AST Service; C:\WINDOWS\SYSTEM32\astsrv.exe []
S2 IomegaAccess;IomegaAccess; C:\Program Files\Iomega\ToolsNT\IomegaAccess.exe [1998-06-23 167936]
S2 ptssvc;ptssvc; C:\Program Files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe []
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-14 267776]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-10-01 536872]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\HPZipm12.exe [2003-05-14 65795]
S4 ZipToA;ZipToA; C:\WINDOWS\System32\ZipToA.exe [1998-07-27 151552]

-----------------EOF-----------------

Spent 3 Weeks getting rid of a virus that AVG didnt notice 2009 one thought i got rid then this popped up on 20-nov-08

Have deleted this from my inbox and deleted files
File name / Threat name / Threats count
C:\Documents and Settings\Sharron\Local Settings\Application Data\Identities\{F267441B-FC00-4A65-9899-97EE064867F0}\Microsoft\Outlook Express\Neil's.dbx Infected: not-a-virus:AdWare.Win32.Craagle.18 1

Computer is about 10 years old i know i need a new one as i have a load of crap hidden in the system that i have got rid of but there is still stuff left

just done a start up and the infection didnt appear (hope it was just the inbox)

I'm in no rush so please take your time can cope without for now
many thanks for your help
Docker

BC AdBot (Login to Remove)

 


#2 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:29 AM

Posted 08 December 2008 - 12:54 AM

Hello. I am PropagandaPanda (Panda or PP for short), and I will be helping you with your log.

I apologize for the delay in response. We get overwhelmed with logs at times, but we are trying our best to keep up. If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following so I can have a look at the current condition of your machine.

You may want to keep the link to this topic in your favourites. Alternatively, you can click the Posted Image button at the top bar of this topic and Track this Topic, where you can choose email notifications. The topics you are tracking are shown here.

Please take note of some guidelines for this fix:
  • Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
  • If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
  • Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
  • Finally, please reply using the Posted Image button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
Download and Run ATFCleaner
Please download ATF Cleaner by Atribune. This program will clear out temporary files before we run OTScanIt. You will likely be logged out of the forum where you are recieving help.

This program is for XP and Windows 2000 only.
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main Select Files to Delete choose: Select All.
  • Click the Empty Selected button.
  • If you use any other browsers, select them appropriately from the top and empty all items.
Download and Run OTScanIt
Download OTScanIt by OldTimer to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt on your desktop.
  • Open the OTScanIt folder and double-click on OTScanIt.exe to start the program. If you are running on Vista then right-click the program and choose Run as Administrator.
  • Check the Scan all users box at the top left.
  • Change the Rootkit Scan setting from "No" to Yes.
  • Click the Extras button under "Additional Scans".
  • Now click the Run Scan button on the toolbar.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
  • Close Notepad (saving the change if necessary).
  • Use the Add Reply button in the forum and Attach the scan back here (do not copy/paste it as it will be too big to fit into the post). It will be located in the OTScanIt folder and named OTScanIt.txt.

Please also tell me of any changes you have made to your computer since your topic was started.

If you do not make a reply in 5 days, we will need to close your topic.

With Regards,
The Panda

Important Note to Other Users Reading this Topic: The instructions provided in this topic below this point are for the original topic starter only. Even if you have similar problems or log entries to those given here, please do not follow the directions, especially those involving specific tools and scripts. Doing so can result in serious damage to your computer. Instead, please start your own topic. Feel free to link to any relevant topics as needed.

#3 Docker749

Docker749
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Hampshire
  • Local time:03:29 PM

Posted 08 December 2008 - 12:53 PM

Hi Panda
Thank you for the reply, please find attached the scans that you required i've put them both up

i have taken off the computer Bitcomet (from reading the other posts) and some games i dont use

many thanks for the help

Docker :thumbsup:

Attached Files



#4 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:29 AM

Posted 08 December 2008 - 08:12 PM

Hello Docker.

Let's get started.

Disable Realtime Protection
Antimalware programs can interfere with the tools we need to run. Please disable all realtime protections you have enabled. Refer to this page, if you are unsure how.

To disable Avira:
  • Navigate to the system tray on the bottom right hand corner and look for an open white umbrella on red background (looks to this: Posted Image )
  • right click it-> untick the option AntiVir Guard enable.
  • You should now see a closed, white umbrella on a red background (looks to this: Posted Image )
To disable SpyBot's TeaTimer:
You can find instructions with visuals here.
  • Run Spybot-S&D in Advanced Mode. If it is not already set to do this Go to the Mode menu select Advanced Mode.
  • On the left hand side, Click on Tools.
  • Click on the Resident icon in the list.
  • Uncheck Resident TeaTimer and OK any prompts.
  • Download ResetTeaTimer.bat and run it to remove entries set by TeaTimer. If you are not using Internet Explorer, you may not be prompted to download the file when you click it. In that case, right click it and select "Save Target/Link as" and save the file onto your desktop.
    The file should take only a second to finish. Delete this file after use.
Restart your computer for the changes to take affect.

Install ERUNT
This tool will create a complete backup of your registry. After every reboot, a new backup is created to ensure we have a safety net after each step. Do not delete these backups until we are finished.
  • Please download erunt-setup.exe to your desktop.
  • Double click erunt-setup.exe. Follow the prompts and allow ERUNT to be installed with the settings at default. If you do not want a Desktop icon, feel free to uncheck that. When asked if you want to create an ERUNT entry in the startup folder, answer Yes. You can delete the installation file after use.
  • Erunt will open when the installation is finished. Check all items to be backed up in the default location and click OK.
You can find a complete guide to using the program here:
http://www.larshederer.homepage.t-online.de/erunt/erunt.txt

When we are finished with fixing your computer (I will make it clear when we are), you can uninstall ERUNT through Add/Remove Programs. The backups will be stored at C:\WINDOWS\erdnt, and will not be deleted when ERUNT is uninstalled.

Run Fix with OTScanIt
We will run OTScanIt with directives. If you have lost your copy of OTScanIt, download it here and extract it like you did last time.
  • Double click the OTScanIt.exe icon in the OTScanIt folder on your desktop. If you are using Windows Vista, right click OTScanIt.exe and select Run as Administrator.
  • Copy the contents of the codebox below into the "Paste fix here" box.
    [Kill Explorer]
    [Registry - Safe List]
    < AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
    *AppInit_DLLs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls
    YN -> karna.dat_ -> 
    < AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
    < Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    YN -> "C:\Program Files\BitComet\BitComet.exe" -> C:\Program Files\BitComet\BitComet.exe [C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client]
    YN -> "C:\Program Files\BitTornado\btdownloadgui.exe" -> C:\Program Files\BitTornado\btdownloadgui.exe [C:\Program Files\BitTornado\btdownloadgui.exe:*:Disabled:btdownloadgui]
    YN -> "C:\Program Files\Grisoft\AVG Free\avgamsvr.exe" -> C:\Program Files\Grisoft\AVG Free\avgamsvr.exe [C:\Program Files\Grisoft\AVG Free\avgamsvr.exe:*:Enabled:avgamsvr.exe]
    YN -> "C:\Program Files\Grisoft\AVG Free\avgcc.exe" -> C:\Program Files\Grisoft\AVG Free\avgcc.exe [C:\Program Files\Grisoft\AVG Free\avgcc.exe:*:Enabled:avgcc.exe]
    YN -> "C:\Program Files\Grisoft\AVG Free\avginet.exe" -> C:\Program Files\Grisoft\AVG Free\avginet.exe [C:\Program Files\Grisoft\AVG Free\avginet.exe:*:Enabled:avginet.exe]
    YN -> "C:\Program Files\LimeWire\LimeWire.exe" -> C:\Program Files\LimeWire\LimeWire.exe [C:\Program Files\LimeWire\LimeWire.exe:*:Disabled:LimeWire]
    [Files/Folders - Created Within 30 Days]
    NY -> rasqervy.dll -> %SystemRoot%\rasqervy.dll
    NY -> sdfinacs.dll -> %SystemRoot%\sdfinacs.dll
    NY -> sdfixwcs.dll -> %SystemRoot%\sdfixwcs.dll
    NY -> wuasirvy.dll -> %SystemRoot%\wuasirvy.dll
    [CatchMe Rootkit Scan by GMER]
    NY -> C:\WINDOWS\system32\c_945760.nls 125952 bytes executable -> 
    [Custom Items]
    :reg
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""
    :end
    [Empty Temp Folders]
    [Reboot]
  • Close all windows except OTScanIt.
  • Click it Run Fix button.
When the fix is completed a message box will popup either telling you that it is finished, or that a reboot is needed to complete the fix. If the fix is complete, click OK and Notepad will open with a log of actions taken during the fix. Post that log back here in your next reply.

If a reboot is required, click the "Yes" button to reboot the machine. After the reboot, OTScanIt2 will finish moving any files that could not be moved during the fix. Notepad will open with the final results at that time. Post that log back here in your next reply.

Download and Run Scan with GMER
We will use GMER to scan for rootkits.
  • Download gmer.zip and save to your desktop.
  • Unzip/extract the file to its own folder. (Click here for information on how to do this if not sure. Win 2000 users click here.
  • Close all other running programs. There is a small chance this application may crash your computer so save any work you have open.
  • Double-click on Gmer.exe to start the program.
  • Allow the gmer.sys driver to load if asked.
  • If it gives you a warning at program start about rootkit activity and asks if you want to run a scan...click NO.
  • Click the >>>.
  • Click on Settings, then check the first five settings:
    • System Protection and Tracing
    • Processes
    • Save created processes to the log
    • Drivers
    • Save loaded drivers to the log
  • Click OK.
  • You will be prompted to restart your computer. Please do so.
After the reboot, run Gmer again and click on the Rootkit tab.
  • Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive.
  • Make sure all other boxes on the right of the screen are checked, EXCEPT for Show All.
  • Click on the Scan and wait for the scan to finish.
    Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan. You will know that the scan is done when the Stop buttons turns back to Scan.
  • When completed, click on the Copy button and right-click on your Desktop, choose New>Text document. Once the file is created, open it and right-click again and choose Paste. Save the file as gmer.txt and copy the information in your next reply.
  • Note: If you have any problems, try running GMER in Safe Mode. However, do not use the MsConfig method to edit the Boot.ini.
Important!:Please do not select the Show all checkbox during the scan..

Re-enable your protection at this time

Please post back with:
-the OTScanIt fix log
-the GMER scan log
-a new OTScanIt scan log (settings as they are when you open the program, log attached)

Avira still picking up that infection?

With Regards,
The Panda

#5 Docker749

Docker749
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Hampshire
  • Local time:03:29 PM

Posted 09 December 2008 - 03:03 PM

Hi The Panda
Thank you for helping me so far, please find attached the logs you requested

Avira is not picking up the silentbanker anymore, but when i restarted the computer after disabling realtime protection i got a warning

When accessing data from the URL, "-----LINK REMOVED-----"
a virus or unwanted program 'TR/Dldr.Agent.atha' [trojan] was found.
Action taken: Blocked file

also when i try and access my Royal Bank of Scotland internet account i can put coustomer no in then my pass words then it comes up with a web site and its not the same as RBS and it asks for all my info

the account is suspended as when it came up i phoned RBS and they told me it was a trojan on the computer

cheers Docker

Process Explorer.EXE killed successfully!
[Registry - Safe List]
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:karna.dat_ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\BitComet\BitComet.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\BitTornado\btdownloadgui.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Grisoft\AVG Free\avgamsvr.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Grisoft\AVG Free\avgcc.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Grisoft\AVG Free\avginet.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\LimeWire\LimeWire.exe deleted successfully.
[Files/Folders - Created Within 30 Days]
C:\WINDOWS\rasqervy.dll moved successfully.
C:\WINDOWS\sdfinacs.dll moved successfully.
C:\WINDOWS\sdfixwcs.dll moved successfully.
C:\WINDOWS\wuasirvy.dll moved successfully.
[Custom Items]
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\"AppInit_DLLs"|"" /E : value set successfully!
[Empty Temp Folders]
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_d8.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
RecycleBin -> emptied.
< End of fix log >
OTScanIt2 by OldTimer - Version 1.0.2.1 fix logfile created on 12092008_182708

Files moved on Reboot...
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\Perflib_Perfdata_d8.dat not found!

Registry entries deleted on Reboot...


GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2008-12-09 19:42:37
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.14 ----

SSDT F7BB4D04 ZwCreateThread
SSDT F7BB4CF0 ZwOpenProcess
SSDT F7BB4CF5 ZwOpenThread
SSDT F7BB4CFF ZwTerminateProcess
SSDT F7BB4CFA ZwWriteVirtualMemory

---- User code sections - GMER 1.0.14 ----

.text C:\WINDOWS\System32\svchost.exe[416] kernel32.dll!FindNextFileW 7C80EFCA 8 Bytes [ 58, 68, CA, EF, 3B, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[416] kernel32.dll!FindNextFileW + 9 7C80EFD3 4 Bytes [ C2, 9C, 00, C3 ]
.text C:\WINDOWS\System32\svchost.exe[416] kernel32.dll!ExitProcess 7C81CAFA 7 Bytes [ 58, 68, FA, CA, 3C, 01, 50 ]
.text C:\WINDOWS\System32\svchost.exe[416] kernel32.dll!ExitProcess + 8 7C81CB02 5 Bytes [ 36, C0, 9C, 00, C3 ]
.text C:\WINDOWS\System32\svchost.exe[416] kernel32.dll!FindNextFileA 7C834EC9 7 Bytes [ 58, 68, C9, 4E, 3E, 01, 50 ]
.text C:\WINDOWS\System32\svchost.exe[416] kernel32.dll!FindNextFileA + 8 7C834ED1 5 Bytes [ BB, C1, 9C, 00, C3 ]
.text C:\WINDOWS\System32\svchost.exe[416] ADVAPI32.dll!CryptDeriveKey 77DE9FDD 13 Bytes [ 58, 68, DD, 9F, 56, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[416] ADVAPI32.dll!CryptImportKey 77DEA1D1 13 Bytes [ 58, 68, D1, A1, 56, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[416] ADVAPI32.dll!CryptGenKey 77E117D9 13 Bytes [ 58, 68, D9, 17, 59, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[416] wininet.dll!HttpOpenRequestA 78064341 13 Bytes [ 58, 68, 41, 43, 6D, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[416] wininet.dll!InternetConnectA 7806499A 13 Bytes [ 58, 68, 9A, 49, 6D, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[416] wininet.dll!HttpOpenRequestW 78065D62 13 Bytes [ 58, 68, 62, 5D, 6D, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[416] wininet.dll!InternetReadFile 7806ABB4 13 Bytes [ 58, 68, B4, AB, 6D, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[416] wininet.dll!InternetQueryDataAvailable 7806ADF5 13 Bytes [ 58, 68, F5, AD, 6D, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[416] wininet.dll!HttpSendRequestA 7806CD40 13 Bytes [ 58, 68, 40, CD, 6D, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[416] wininet.dll!InternetWriteFile 78073645 13 Bytes [ 58, 68, 45, 36, 6E, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[416] wininet.dll!CommitUrlCacheEntryA 7807FC0A 13 Bytes [ 58, 68, 0A, FC, 6E, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[416] wininet.dll!HttpSendRequestW 78080825 13 Bytes [ 58, 68, 25, 08, 6F, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[416] wininet.dll!InternetReadFileExW 78082AAA 13 Bytes [ 58, 68, AA, 2A, 6F, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[416] wininet.dll!InternetReadFileExA 78082AE2 13 Bytes [ 58, 68, E2, 2A, 6F, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[416] wininet.dll!InternetErrorDlg 780DC93B 13 Bytes [ 58, 68, 3B, C9, 74, 01, 50, ... ]
.text C:\HP\KBD\KBD.EXE[432] kernel32.dll!FindNextFileW 7C80EFCA 8 Bytes [ 58, 68, CA, EF, E8, 01, 50, ... ]
.text C:\HP\KBD\KBD.EXE[432] kernel32.dll!FindNextFileW + 9 7C80EFD3 4 Bytes [ C2, 54, 01, C3 ]
.text C:\HP\KBD\KBD.EXE[432] kernel32.dll!ExitProcess 7C81CAFA 7 Bytes [ 58, 68, FA, CA, E9, 01, 50 ]
.text C:\HP\KBD\KBD.EXE[432] kernel32.dll!ExitProcess + 8 7C81CB02 5 Bytes [ 36, C0, 54, 01, C3 ]
.text C:\HP\KBD\KBD.EXE[432] kernel32.dll!FindNextFileA 7C834EC9 7 Bytes [ 58, 68, C9, 4E, EB, 01, 50 ]
.text C:\HP\KBD\KBD.EXE[432] kernel32.dll!FindNextFileA + 8 7C834ED1 5 Bytes [ BB, C1, 54, 01, C3 ]
.text C:\HP\KBD\KBD.EXE[432] ADVAPI32.dll!CryptDeriveKey 77DE9FDD 13 Bytes [ 58, 68, DD, 9F, 03, 02, 50, ... ]
.text C:\HP\KBD\KBD.EXE[432] ADVAPI32.dll!CryptImportKey 77DEA1D1 13 Bytes [ 58, 68, D1, A1, 03, 02, 50, ... ]
.text C:\HP\KBD\KBD.EXE[432] ADVAPI32.dll!CryptGenKey 77E117D9 13 Bytes [ 58, 68, D9, 17, 06, 02, 50, ... ]
.text C:\HP\KBD\KBD.EXE[432] wininet.dll!HttpOpenRequestA 78064341 13 Bytes [ 58, 68, 41, 43, 1A, 02, 50, ... ]
.text C:\HP\KBD\KBD.EXE[432] wininet.dll!InternetConnectA 7806499A 13 Bytes [ 58, 68, 9A, 49, 1A, 02, 50, ... ]
.text C:\HP\KBD\KBD.EXE[432] wininet.dll!HttpOpenRequestW 78065D62 13 Bytes [ 58, 68, 62, 5D, 1A, 02, 50, ... ]
.text C:\HP\KBD\KBD.EXE[432] wininet.dll!InternetReadFile 7806ABB4 13 Bytes [ 58, 68, B4, AB, 1A, 02, 50, ... ]
.text C:\HP\KBD\KBD.EXE[432] wininet.dll!InternetQueryDataAvailable 7806ADF5 13 Bytes [ 58, 68, F5, AD, 1A, 02, 50, ... ]
.text C:\HP\KBD\KBD.EXE[432] wininet.dll!HttpSendRequestA 7806CD40 13 Bytes [ 58, 68, 40, CD, 1A, 02, 50, ... ]
.text C:\HP\KBD\KBD.EXE[432] wininet.dll!InternetWriteFile 78073645 13 Bytes [ 58, 68, 45, 36, 1B, 02, 50, ... ]
.text C:\HP\KBD\KBD.EXE[432] wininet.dll!CommitUrlCacheEntryA 7807FC0A 13 Bytes [ 58, 68, 0A, FC, 1B, 02, 50, ... ]
.text C:\HP\KBD\KBD.EXE[432] wininet.dll!HttpSendRequestW 78080825 13 Bytes [ 58, 68, 25, 08, 1C, 02, 50, ... ]
.text C:\HP\KBD\KBD.EXE[432] wininet.dll!InternetReadFileExW 78082AAA 13 Bytes [ 58, 68, AA, 2A, 1C, 02, 50, ... ]
.text C:\HP\KBD\KBD.EXE[432] wininet.dll!InternetReadFileExA 78082AE2 13 Bytes [ 58, 68, E2, 2A, 1C, 02, 50, ... ]
.text C:\HP\KBD\KBD.EXE[432] wininet.dll!InternetErrorDlg 780DC93B 13 Bytes [ 58, 68, 3B, C9, 21, 02, 50, ... ]
.text C:\WINDOWS\system32\ctfmon.exe[452] kernel32.dll!FindNextFileW 7C80EFCA 8 Bytes [ 58, 68, CA, EF, E4, 00, 50, ... ]
.text C:\WINDOWS\system32\ctfmon.exe[452] kernel32.dll!FindNextFileW + 9 7C80EFD3 4 Bytes [ C2, B7, 00, C3 ]
.text C:\WINDOWS\system32\ctfmon.exe[452] kernel32.dll!ExitProcess 7C81CAFA 7 Bytes [ 58, 68, FA, CA, E5, 00, 50 ]
.text C:\WINDOWS\system32\ctfmon.exe[452] kernel32.dll!ExitProcess + 8 7C81CB02 5 Bytes [ 36, C0, B7, 00, C3 ]
.text C:\WINDOWS\system32\ctfmon.exe[452] kernel32.dll!FindNextFileA 7C834EC9 7 Bytes [ 58, 68, C9, 4E, E7, 00, 50 ]
.text C:\WINDOWS\system32\ctfmon.exe[452] kernel32.dll!FindNextFileA + 8 7C834ED1 5 Bytes [ BB, C1, B7, 00, C3 ]
.text C:\WINDOWS\system32\ctfmon.exe[452] ADVAPI32.dll!CryptDeriveKey 77DE9FDD 13 Bytes [ 58, 68, DD, 9F, 03, 01, 50, ... ]
.text C:\WINDOWS\system32\ctfmon.exe[452] ADVAPI32.dll!CryptImportKey 77DEA1D1 13 Bytes [ 58, 68, D1, A1, 03, 01, 50, ... ]
.text C:\WINDOWS\system32\ctfmon.exe[452] ADVAPI32.dll!CryptGenKey 77E117D9 13 Bytes [ 58, 68, D9, 17, 06, 01, 50, ... ]
.text C:\WINDOWS\system32\ctfmon.exe[452] wininet.dll!HttpOpenRequestA 78064341 13 Bytes [ 58, 68, 41, 43, 1A, 01, 50, ... ]
.text C:\WINDOWS\system32\ctfmon.exe[452] wininet.dll!InternetConnectA 7806499A 13 Bytes [ 58, 68, 9A, 49, 1A, 01, 50, ... ]
.text C:\WINDOWS\system32\ctfmon.exe[452] wininet.dll!HttpOpenRequestW 78065D62 13 Bytes [ 58, 68, 62, 5D, 1A, 01, 50, ... ]
.text C:\WINDOWS\system32\ctfmon.exe[452] wininet.dll!InternetReadFile 7806ABB4 13 Bytes [ 58, 68, B4, AB, 1A, 01, 50, ... ]
.text C:\WINDOWS\system32\ctfmon.exe[452] wininet.dll!InternetQueryDataAvailable 7806ADF5 13 Bytes [ 58, 68, F5, AD, 1A, 01, 50, ... ]
.text C:\WINDOWS\system32\ctfmon.exe[452] wininet.dll!HttpSendRequestA 7806CD40 13 Bytes [ 58, 68, 40, CD, 1A, 01, 50, ... ]
.text C:\WINDOWS\system32\ctfmon.exe[452] wininet.dll!InternetWriteFile 78073645 13 Bytes [ 58, 68, 45, 36, 1B, 01, 50, ... ]
.text C:\WINDOWS\system32\ctfmon.exe[452] wininet.dll!CommitUrlCacheEntryA 7807FC0A 13 Bytes [ 58, 68, 0A, FC, 1B, 01, 50, ... ]
.text C:\WINDOWS\system32\ctfmon.exe[452] wininet.dll!HttpSendRequestW 78080825 13 Bytes [ 58, 68, 25, 08, 1C, 01, 50, ... ]
.text C:\WINDOWS\system32\ctfmon.exe[452] wininet.dll!InternetReadFileExW 78082AAA 13 Bytes [ 58, 68, AA, 2A, 1C, 01, 50, ... ]
.text C:\WINDOWS\system32\ctfmon.exe[452] wininet.dll!InternetReadFileExA 78082AE2 13 Bytes [ 58, 68, E2, 2A, 1C, 01, 50, ... ]
.text C:\WINDOWS\system32\ctfmon.exe[452] wininet.dll!InternetErrorDlg 780DC93B 13 Bytes [ 58, 68, 3B, C9, 21, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[476] kernel32.dll!FindNextFileW 7C80EFCA 8 Bytes [ 58, 68, CA, EF, 01, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[476] kernel32.dll!FindNextFileW + 9 7C80EFD3 4 Bytes [ C2, 9C, 00, C3 ]
.text C:\WINDOWS\System32\svchost.exe[476] kernel32.dll!ExitProcess 7C81CAFA 7 Bytes [ 58, 68, FA, CA, 02, 01, 50 ]
.text C:\WINDOWS\System32\svchost.exe[476] kernel32.dll!ExitProcess + 8 7C81CB02 5 Bytes [ 36, C0, 9C, 00, C3 ]
.text C:\WINDOWS\System32\svchost.exe[476] kernel32.dll!FindNextFileA 7C834EC9 7 Bytes [ 58, 68, C9, 4E, 04, 01, 50 ]
.text C:\WINDOWS\System32\svchost.exe[476] kernel32.dll!FindNextFileA + 8 7C834ED1 5 Bytes [ BB, C1, 9C, 00, C3 ]
.text C:\WINDOWS\System32\svchost.exe[476] ADVAPI32.dll!CryptDeriveKey 77DE9FDD 13 Bytes [ 58, 68, DD, 9F, 79, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[476] ADVAPI32.dll!CryptImportKey 77DEA1D1 13 Bytes [ 58, 68, D1, A1, 79, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[476] ADVAPI32.dll!CryptGenKey 77E117D9 13 Bytes [ 58, 68, D9, 17, 7C, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[476] wininet.dll!HttpOpenRequestA 78064341 13 Bytes [ 58, 68, 41, 43, C0, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[476] wininet.dll!InternetConnectA 7806499A 13 Bytes [ 58, 68, 9A, 49, C0, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[476] wininet.dll!HttpOpenRequestW 78065D62 13 Bytes [ 58, 68, 62, 5D, C0, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[476] wininet.dll!InternetReadFile 7806ABB4 13 Bytes [ 58, 68, B4, AB, C0, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[476] wininet.dll!InternetQueryDataAvailable 7806ADF5 13 Bytes [ 58, 68, F5, AD, C0, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[476] wininet.dll!HttpSendRequestA 7806CD40 13 Bytes [ 58, 68, 40, CD, C0, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[476] wininet.dll!InternetWriteFile 78073645 13 Bytes [ 58, 68, 45, 36, C1, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[476] wininet.dll!CommitUrlCacheEntryA 7807FC0A 13 Bytes [ 58, 68, 0A, FC, C1, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[476] wininet.dll!HttpSendRequestW 78080825 13 Bytes [ 58, 68, 25, 08, C2, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[476] wininet.dll!InternetReadFileExW 78082AAA 13 Bytes [ 58, 68, AA, 2A, C2, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[476] wininet.dll!InternetReadFileExA 78082AE2 13 Bytes [ 58, 68, E2, 2A, C2, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[476] wininet.dll!InternetErrorDlg 780DC93B 13 Bytes [ 58, 68, 3B, C9, C7, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[772] kernel32.dll!FindNextFileW 7C80EFCA 8 Bytes [ 58, 68, CA, EF, E7, 00, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[772] kernel32.dll!FindNextFileW + 9 7C80EFD3 4 Bytes [ C2, 9C, 00, C3 ]
.text C:\WINDOWS\system32\svchost.exe[772] kernel32.dll!ExitProcess 7C81CAFA 7 Bytes [ 58, 68, FA, CA, E8, 00, 50 ]
.text C:\WINDOWS\system32\svchost.exe[772] kernel32.dll!ExitProcess + 8 7C81CB02 5 Bytes [ 36, C0, 9C, 00, C3 ]
.text C:\WINDOWS\system32\svchost.exe[772] kernel32.dll!FindNextFileA 7C834EC9 7 Bytes [ 58, 68, C9, 4E, EA, 00, 50 ]
.text C:\WINDOWS\system32\svchost.exe[772] kernel32.dll!FindNextFileA + 8 7C834ED1 5 Bytes [ BB, C1, 9C, 00, C3 ]
.text C:\WINDOWS\system32\svchost.exe[772] ADVAPI32.dll!CryptDeriveKey 77DE9FDD 13 Bytes [ 58, 68, DD, 9F, 0C, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[772] ADVAPI32.dll!CryptImportKey 77DEA1D1 13 Bytes [ 58, 68, D1, A1, 0C, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[772] ADVAPI32.dll!CryptGenKey 77E117D9 13 Bytes [ 58, 68, D9, 17, 0F, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[772] wininet.dll!HttpOpenRequestA 78064341 13 Bytes [ 58, 68, 41, 43, 23, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[772] wininet.dll!InternetConnectA 7806499A 13 Bytes [ 58, 68, 9A, 49, 23, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[772] wininet.dll!HttpOpenRequestW 78065D62 13 Bytes [ 58, 68, 62, 5D, 23, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[772] wininet.dll!InternetReadFile 7806ABB4 13 Bytes [ 58, 68, B4, AB, 23, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[772] wininet.dll!InternetQueryDataAvailable 7806ADF5 13 Bytes [ 58, 68, F5, AD, 23, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[772] wininet.dll!HttpSendRequestA 7806CD40 13 Bytes [ 58, 68, 40, CD, 23, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[772] wininet.dll!InternetWriteFile 78073645 13 Bytes [ 58, 68, 45, 36, 24, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[772] wininet.dll!CommitUrlCacheEntryA 7807FC0A 13 Bytes [ 58, 68, 0A, FC, 24, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[772] wininet.dll!HttpSendRequestW 78080825 13 Bytes [ 58, 68, 25, 08, 25, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[772] wininet.dll!InternetReadFileExW 78082AAA 13 Bytes [ 58, 68, AA, 2A, 25, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[772] wininet.dll!InternetReadFileExA 78082AE2 13 Bytes [ 58, 68, E2, 2A, 25, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[772] wininet.dll!InternetErrorDlg 780DC93B 13 Bytes [ 58, 68, 3B, C9, 2A, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] kernel32.dll!FindNextFileW 7C80EFCA 8 Bytes [ 58, 68, CA, EF, DE, 00, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] kernel32.dll!FindNextFileW + 9 7C80EFD3 4 Bytes [ C2, A5, 00, C3 ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] kernel32.dll!ExitProcess 7C81CAFA 7 Bytes [ 58, 68, FA, CA, DF, 00, 50 ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] kernel32.dll!ExitProcess + 8 7C81CB02 5 Bytes [ 36, C0, A5, 00, C3 ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] kernel32.dll!FindNextFileA 7C834EC9 7 Bytes [ 58, 68, C9, 4E, E1, 00, 50 ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] kernel32.dll!FindNextFileA + 8 7C834ED1 5 Bytes [ BB, C1, A5, 00, C3 ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] ADVAPI32.dll!CryptDeriveKey 77DE9FDD 13 Bytes [ 58, 68, DD, 9F, F9, 00, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] ADVAPI32.dll!CryptImportKey 77DEA1D1 13 Bytes [ 58, 68, D1, A1, F9, 00, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] ADVAPI32.dll!CryptGenKey 77E117D9 13 Bytes [ 58, 68, D9, 17, FC, 00, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] wininet.dll!HttpOpenRequestA 78064341 13 Bytes [ 58, 68, 41, 43, 10, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] wininet.dll!InternetConnectA 7806499A 13 Bytes [ 58, 68, 9A, 49, 10, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] wininet.dll!HttpOpenRequestW 78065D62 13 Bytes [ 58, 68, 62, 5D, 10, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] wininet.dll!InternetReadFile 7806ABB4 13 Bytes [ 58, 68, B4, AB, 10, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] wininet.dll!InternetQueryDataAvailable 7806ADF5 13 Bytes [ 58, 68, F5, AD, 10, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] wininet.dll!HttpSendRequestA 7806CD40 13 Bytes [ 58, 68, 40, CD, 10, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] wininet.dll!InternetWriteFile 78073645 13 Bytes [ 58, 68, 45, 36, 11, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] wininet.dll!CommitUrlCacheEntryA 7807FC0A 13 Bytes [ 58, 68, 0A, FC, 11, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] wininet.dll!HttpSendRequestW 78080825 13 Bytes [ 58, 68, 25, 08, 12, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] wininet.dll!InternetReadFileExW 78082AAA 13 Bytes [ 58, 68, AA, 2A, 12, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] wininet.dll!InternetReadFileExA 78082AE2 13 Bytes [ 58, 68, E2, 2A, 12, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe[900] wininet.dll!InternetErrorDlg 780DC93B 13 Bytes [ 58, 68, 3B, C9, 17, 01, 50, ... ]
.text C:\WINDOWS\Explorer.EXE[1196] kernel32.dll!FindNextFileW 7C80EFCA 8 Bytes [ 58, 68, CA, EF, E4, 00, 50, ... ]
.text C:\WINDOWS\Explorer.EXE[1196] kernel32.dll!FindNextFileW + 9 7C80EFD3 4 Bytes [ C2, CA, 00, C3 ]
.text C:\WINDOWS\Explorer.EXE[1196] kernel32.dll!ExitProcess 7C81CAFA 7 Bytes [ 58, 68, FA, CA, E5, 00, 50 ]
.text C:\WINDOWS\Explorer.EXE[1196] kernel32.dll!ExitProcess + 8 7C81CB02 5 Bytes [ 36, C0, CA, 00, C3 ]
.text C:\WINDOWS\Explorer.EXE[1196] kernel32.dll!FindNextFileA 7C834EC9 7 Bytes [ 58, 68, C9, 4E, E7, 00, 50 ]
.text C:\WINDOWS\Explorer.EXE[1196] kernel32.dll!FindNextFileA + 8 7C834ED1 5 Bytes [ BB, C1, CA, 00, C3 ]
.text C:\WINDOWS\Explorer.EXE[1196] ADVAPI32.dll!CryptDeriveKey 77DE9FDD 13 Bytes [ 58, 68, DD, 9F, 11, 01, 50, ... ]
.text C:\WINDOWS\Explorer.EXE[1196] ADVAPI32.dll!CryptImportKey 77DEA1D1 13 Bytes [ 58, 68, D1, A1, 11, 01, 50, ... ]
.text C:\WINDOWS\Explorer.EXE[1196] ADVAPI32.dll!CryptGenKey 77E117D9 13 Bytes [ 58, 68, D9, 17, 14, 01, 50, ... ]
.text C:\WINDOWS\System32\cisvc.exe[1248] kernel32.dll!FindNextFileW 7C80EFCA 8 Bytes [ 58, 68, CA, EF, BB, 00, 50, ... ]
.text C:\WINDOWS\System32\cisvc.exe[1248] kernel32.dll!FindNextFileW + 9 7C80EFD3 4 Bytes [ C2, 93, 00, C3 ]
.text C:\WINDOWS\System32\cisvc.exe[1248] kernel32.dll!ExitProcess 7C81CAFA 7 Bytes [ 58, 68, FA, CA, BC, 00, 50 ]
.text C:\WINDOWS\System32\cisvc.exe[1248] kernel32.dll!ExitProcess + 8 7C81CB02 5 Bytes [ 36, C0, 93, 00, C3 ]
.text C:\WINDOWS\System32\cisvc.exe[1248] kernel32.dll!FindNextFileA 7C834EC9 7 Bytes [ 58, 68, C9, 4E, BE, 00, 50 ]
.text C:\WINDOWS\System32\cisvc.exe[1248] kernel32.dll!FindNextFileA + 8 7C834ED1 5 Bytes [ BB, C1, 93, 00, C3 ]
.text C:\WINDOWS\System32\cisvc.exe[1248] ADVAPI32.dll!CryptDeriveKey 77DE9FDD 13 Bytes [ 58, 68, DD, 9F, D6, 00, 50, ... ]
.text C:\WINDOWS\System32\cisvc.exe[1248] ADVAPI32.dll!CryptImportKey 77DEA1D1 13 Bytes [ 58, 68, D1, A1, D6, 00, 50, ... ]
.text C:\WINDOWS\System32\cisvc.exe[1248] ADVAPI32.dll!CryptGenKey 77E117D9 13 Bytes [ 58, 68, D9, 17, D9, 00, 50, ... ]
.text C:\WINDOWS\System32\cisvc.exe[1248] wininet.dll!HttpOpenRequestA 78064341 13 Bytes [ 58, 68, 41, 43, ED, 00, 50, ... ]
.text C:\WINDOWS\System32\cisvc.exe[1248] wininet.dll!InternetConnectA 7806499A 13 Bytes [ 58, 68, 9A, 49, ED, 00, 50, ... ]
.text C:\WINDOWS\System32\cisvc.exe[1248] wininet.dll!HttpOpenRequestW 78065D62 13 Bytes [ 58, 68, 62, 5D, ED, 00, 50, ... ]
.text C:\WINDOWS\System32\cisvc.exe[1248] wininet.dll!InternetReadFile 7806ABB4 13 Bytes [ 58, 68, B4, AB, ED, 00, 50, ... ]
.text C:\WINDOWS\System32\cisvc.exe[1248] wininet.dll!InternetQueryDataAvailable 7806ADF5 13 Bytes [ 58, 68, F5, AD, ED, 00, 50, ... ]
.text C:\WINDOWS\System32\cisvc.exe[1248] wininet.dll!HttpSendRequestA 7806CD40 13 Bytes [ 58, 68, 40, CD, ED, 00, 50, ... ]
.text C:\WINDOWS\System32\cisvc.exe[1248] wininet.dll!InternetWriteFile 78073645 13 Bytes [ 58, 68, 45, 36, EE, 00, 50, ... ]
.text C:\WINDOWS\System32\cisvc.exe[1248] wininet.dll!CommitUrlCacheEntryA 7807FC0A 13 Bytes [ 58, 68, 0A, FC, EE, 00, 50, ... ]
.text C:\WINDOWS\System32\cisvc.exe[1248] wininet.dll!HttpSendRequestW 78080825 13 Bytes [ 58, 68, 25, 08, EF, 00, 50, ... ]
.text C:\WINDOWS\System32\cisvc.exe[1248] wininet.dll!InternetReadFileExW 78082AAA 13 Bytes [ 58, 68, AA, 2A, EF, 00, 50, ... ]
.text C:\WINDOWS\System32\cisvc.exe[1248] wininet.dll!InternetReadFileExA 78082AE2 13 Bytes [ 58, 68, E2, 2A, EF, 00, 50, ... ]
.text C:\WINDOWS\System32\cisvc.exe[1248] wininet.dll!InternetErrorDlg 780DC93B 13 Bytes [ 58, 68, 3B, C9, F4, 00, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[1332] kernel32.dll!FindNextFileW 7C80EFCA 8 Bytes [ 58, 68, CA, EF, C9, 00, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[1332] kernel32.dll!FindNextFileW + 9 7C80EFD3 4 Bytes [ C2, 9C, 00, C3 ]
.text C:\WINDOWS\System32\svchost.exe[1332] kernel32.dll!ExitProcess 7C81CAFA 7 Bytes [ 58, 68, FA, CA, CA, 00, 50 ]
.text C:\WINDOWS\System32\svchost.exe[1332] kernel32.dll!ExitProcess + 8 7C81CB02 5 Bytes [ 36, C0, 9C, 00, C3 ]
.text C:\WINDOWS\System32\svchost.exe[1332] kernel32.dll!FindNextFileA 7C834EC9 7 Bytes [ 58, 68, C9, 4E, CC, 00, 50 ]
.text C:\WINDOWS\System32\svchost.exe[1332] kernel32.dll!FindNextFileA + 8 7C834ED1 5 Bytes [ BB, C1, 9C, 00, C3 ]
.text C:\WINDOWS\System32\svchost.exe[1332] ADVAPI32.dll!CryptDeriveKey 77DE9FDD 13 Bytes [ 58, 68, DD, 9F, E4, 00, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[1332] ADVAPI32.dll!CryptImportKey 77DEA1D1 13 Bytes [ 58, 68, D1, A1, E4, 00, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[1332] ADVAPI32.dll!CryptGenKey 77E117D9 13 Bytes [ 58, 68, D9, 17, E7, 00, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[1332] wininet.dll!HttpOpenRequestA 78064341 13 Bytes [ 58, 68, 41, 43, 02, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[1332] wininet.dll!InternetConnectA 7806499A 13 Bytes [ 58, 68, 9A, 49, 02, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[1332] wininet.dll!HttpOpenRequestW 78065D62 13 Bytes [ 58, 68, 62, 5D, 02, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[1332] wininet.dll!InternetReadFile 7806ABB4 13 Bytes [ 58, 68, B4, AB, 02, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[1332] wininet.dll!InternetQueryDataAvailable 7806ADF5 13 Bytes [ 58, 68, F5, AD, 02, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[1332] wininet.dll!HttpSendRequestA 7806CD40 13 Bytes [ 58, 68, 40, CD, 02, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[1332] wininet.dll!InternetWriteFile 78073645 13 Bytes [ 58, 68, 45, 36, 03, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[1332] wininet.dll!CommitUrlCacheEntryA 7807FC0A 13 Bytes [ 58, 68, 0A, FC, 03, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[1332] wininet.dll!HttpSendRequestW 78080825 13 Bytes [ 58, 68, 25, 08, 04, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[1332] wininet.dll!InternetReadFileExW 78082AAA 13 Bytes [ 58, 68, AA, 2A, 04, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[1332] wininet.dll!InternetReadFileExA 78082AE2 13 Bytes [ 58, 68, E2, 2A, 04, 01, 50, ... ]
.text C:\WINDOWS\System32\svchost.exe[1332] wininet.dll!InternetErrorDlg 780DC93B 13 Bytes [ 58, 68, 3B, C9, 09, 01, 50, ... ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] kernel32.dll!FindNextFileW 7C80EFCA 8 Bytes [ 58, 68, CA, EF, ED, 00, 50, ... ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] kernel32.dll!FindNextFileW + 9 7C80EFD3 4 Bytes [ C2, B4, 00, C3 ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] kernel32.dll!ExitProcess 7C81CAFA 7 Bytes [ 58, 68, FA, CA, EE, 00, 50 ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] kernel32.dll!ExitProcess + 8 7C81CB02 5 Bytes [ 36, C0, B4, 00, C3 ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] kernel32.dll!FindNextFileA 7C834EC9 7 Bytes [ 58, 68, C9, 4E, F0, 00, 50 ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] kernel32.dll!FindNextFileA + 8 7C834ED1 5 Bytes [ BB, C1, B4, 00, C3 ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] ADVAPI32.dll!CryptDeriveKey 77DE9FDD 13 Bytes [ 58, 68, DD, 9F, 0C, 01, 50, ... ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] ADVAPI32.dll!CryptImportKey 77DEA1D1 13 Bytes [ 58, 68, D1, A1, 0C, 01, 50, ... ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] ADVAPI32.dll!CryptGenKey 77E117D9 13 Bytes [ 58, 68, D9, 17, 0F, 01, 50, ... ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] wininet.dll!HttpOpenRequestA 78064341 13 Bytes [ 58, 68, 41, 43, 23, 01, 50, ... ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] wininet.dll!InternetConnectA 7806499A 13 Bytes [ 58, 68, 9A, 49, 23, 01, 50, ... ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] wininet.dll!HttpOpenRequestW 78065D62 13 Bytes [ 58, 68, 62, 5D, 23, 01, 50, ... ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] wininet.dll!InternetReadFile 7806ABB4 13 Bytes [ 58, 68, B4, AB, 23, 01, 50, ... ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] wininet.dll!InternetQueryDataAvailable 7806ADF5 13 Bytes [ 58, 68, F5, AD, 23, 01, 50, ... ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] wininet.dll!HttpSendRequestA 7806CD40 13 Bytes [ 58, 68, 40, CD, 23, 01, 50, ... ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] wininet.dll!InternetWriteFile 78073645 13 Bytes [ 58, 68, 45, 36, 24, 01, 50, ... ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] wininet.dll!CommitUrlCacheEntryA 7807FC0A 13 Bytes [ 58, 68, 0A, FC, 24, 01, 50, ... ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] wininet.dll!HttpSendRequestW 78080825 13 Bytes [ 58, 68, 25, 08, 25, 01, 50, ... ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] wininet.dll!InternetReadFileExW 78082AAA 13 Bytes [ 58, 68, AA, 2A, 25, 01, 50, ... ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] wininet.dll!InternetReadFileExA 78082AE2 13 Bytes [ 58, 68, E2, 2A, 25, 01, 50, ... ]
.text C:\WINDOWS\system32\spoolsv.exe[1496] wininet.dll!InternetErrorDlg 780DC93B 13 Bytes [ 58, 68, 3B, C9, 2A, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] kernel32.dll!FindNextFileW 7C80EFCA 8 Bytes [ 58, 68, CA, EF, 4D, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] kernel32.dll!FindNextFileW + 9 7C80EFD3 4 Bytes [ C2, ED, 00, C3 ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] kernel32.dll!ExitProcess 7C81CAFA 7 Bytes [ 58, 68, FA, CA, 4E, 01, 50 ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] kernel32.dll!ExitProcess + 8 7C81CB02 5 Bytes [ 36, C0, ED, 00, C3 ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] kernel32.dll!FindNextFileA 7C834EC9 7 Bytes [ 58, 68, C9, 4E, 50, 01, 50 ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] kernel32.dll!FindNextFileA + 8 7C834ED1 5 Bytes [ BB, C1, ED, 00, C3 ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] ADVAPI32.dll!CryptDeriveKey 77DE9FDD 13 Bytes [ 58, 68, DD, 9F, 6D, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] ADVAPI32.dll!CryptImportKey 77DEA1D1 13 Bytes [ 58, 68, D1, A1, 6D, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] ADVAPI32.dll!CryptGenKey 77E117D9 13 Bytes [ 58, 68, D9, 17, 70, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] wininet.dll!HttpOpenRequestA 78064341 13 Bytes [ 58, 68, 41, 43, 84, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] wininet.dll!InternetConnectA 7806499A 13 Bytes [ 58, 68, 9A, 49, 84, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] wininet.dll!HttpOpenRequestW 78065D62 13 Bytes [ 58, 68, 62, 5D, 84, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] wininet.dll!InternetReadFile 7806ABB4 13 Bytes [ 58, 68, B4, AB, 84, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] wininet.dll!InternetQueryDataAvailable 7806ADF5 13 Bytes [ 58, 68, F5, AD, 84, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] wininet.dll!HttpSendRequestA 7806CD40 13 Bytes [ 58, 68, 40, CD, 84, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] wininet.dll!InternetWriteFile 78073645 13 Bytes [ 58, 68, 45, 36, 85, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] wininet.dll!CommitUrlCacheEntryA 7807FC0A 13 Bytes [ 58, 68, 0A, FC, 85, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] wininet.dll!HttpSendRequestW 78080825 13 Bytes [ 58, 68, 25, 08, 86, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] wininet.dll!InternetReadFileExW 78082AAA 13 Bytes [ 58, 68, AA, 2A, 86, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] wininet.dll!InternetReadFileExA 78082AE2 13 Bytes [ 58, 68, E2, 2A, 86, 01, 50, ... ]
.text C:\Program Files\Avira\Avira Premium Security Suite\sched.exe[1572] wininet.dll!InternetErrorDlg 780DC93B 13 Bytes [ 58, 68, 3B, C9, 8B, 01, 50, ... ]
.text C:\WINDOWS\system32\winlogon.exe[1640] kernel32.dll!FindNextFileW 7C80EFCA 8 Bytes [ 58, 68, CA, EF, 64, 01, 50, ... ]
.text C:\WINDOWS\system32\winlogon.exe[1640] kernel32.dll!FindNextFileW + 9 7C80EFD3 4 Bytes [ C2, 3A, 01, C3 ]
.text C:\WINDOWS\system32\winlogon.exe[1640] kernel32.dll!ExitProcess 7C81CAFA 7 Bytes [ 58, 68, FA, CA, 65, 01, 50 ]
.text C:\WINDOWS\system32\winlogon.exe[1640] kernel32.dll!ExitProcess + 8 7C81CB02 5 Bytes [ 36, C0, 3A, 01, C3 ]
.text C:\WINDOWS\system32\winlogon.exe[1640] kernel32.dll!FindNextFileA 7C834EC9 7 Bytes [ 58, 68, C9, 4E, 67, 01, 50 ]
.text C:\WINDOWS\system32\winlogon.exe[1640] kernel32.dll!FindNextFileA + 8 7C834ED1 5 Bytes [ BB, C1, 3A, 01, C3 ]
.text C:\WINDOWS\system32\winlogon.exe[1640] ADVAPI32.dll!CryptDeriveKey 77DE9FDD 13 Bytes [ 58, 68, DD, 9F, 7F, 01, 50, ... ]
.text C:\WINDOWS\system32\winlogon.exe[1640] ADVAPI32.dll!CryptImportKey 77DEA1D1 13 Bytes [ 58, 68, D1, A1, 7F, 01, 50, ... ]
.text C:\WINDOWS\system32\winlogon.exe[1640] ADVAPI32.dll!CryptGenKey 77E117D9 13 Bytes [ 58, 68, D9, 17, 82, 01, 50, ... ]
.text C:\WINDOWS\system32\winlogon.exe[1640] wininet.dll!HttpOpenRequestA 78064341 13 Bytes [ 58, 68, 41, 43, 96, 01, 50, ... ]
.text C:\WINDOWS\system32\winlogon.exe[1640] wininet.dll!InternetConnectA 7806499A 13 Bytes [ 58, 68, 9A, 49, 96, 01, 50, ... ]
.text C:\WINDOWS\system32\winlogon.exe[1640] wininet.dll!HttpOpenRequestW 78065D62 13 Bytes [ 58, 68, 62, 5D, 96, 01, 50, ... ]
.text C:\WINDOWS\system32\winlogon.exe[1640] wininet.dll!InternetReadFile 7806ABB4 13 Bytes [ 58, 68, B4, AB, 96, 01, 50, ... ]
.text C:\WINDOWS\system32\winlogon.exe[1640] wininet.dll!InternetQueryDataAvailable 7806ADF5 13 Bytes [ 58, 68, F5, AD, 96, 01, 50, ... ]
.text C:\WINDOWS\system32\winlogon.exe[1640] wininet.dll!HttpSendRequestA 7806CD40 13 Bytes [ 58, 68, 40, CD, 96, 01, 50, ... ]
.text C:\WINDOWS\system32\winlogon.exe[1640] wininet.dll!InternetWriteFile 78073645 13 Bytes [ 58, 68, 45, 36, 97, 01, 50, ... ]
.text C:\WINDOWS\system32\winlogon.exe[1640] wininet.dll!CommitUrlCacheEntryA 7807FC0A 13 Bytes [ 58, 68, 0A, FC, 97, 01, 50, ... ]
.text C:\WINDOWS\system32\winlogon.exe[1640] wininet.dll!HttpSendRequestW 78080825 13 Bytes [ 58, 68, 25, 08, 98, 01, 50, ... ]
.text C:\WINDOWS\system32\winlogon.exe[1640] wininet.dll!InternetReadFileExW 78082AAA 13 Bytes [ 58, 68, AA, 2A, 98, 01, 50, ... ]
.text C:\WINDOWS\system32\winlogon.exe[1640] wininet.dll!InternetReadFileExA 78082AE2 13 Bytes [ 58, 68, E2, 2A, 98, 01, 50, ... ]
.text C:\WINDOWS\system32\winlogon.exe[1640] wininet.dll!InternetErrorDlg 780DC93B 13 Bytes [ 58, 68, 3B, C9, 9D, 01, 50, ... ]
.text C:\WINDOWS\system32\lsass.exe[1744] kernel32.dll!FindNextFileW 7C80EFCA 8 Bytes [ 58, 68, CA, EF, 11, 01, 50, ... ]
.text C:\WINDOWS\system32\lsass.exe[1744] kernel32.dll!FindNextFileW + 9 7C80EFD3 4 Bytes [ C2, 8C, 00, C3 ]
.text C:\WINDOWS\system32\lsass.exe[1744] kernel32.dll!ExitProcess 7C81CAFA 7 Bytes [ 58, 68, FA, CA, 12, 01, 50 ]
.text C:\WINDOWS\system32\lsass.exe[1744] kernel32.dll!ExitProcess + 8 7C81CB02 5 Bytes [ 36, C0, 8C, 00, C3 ]
.text C:\WINDOWS\system32\lsass.exe[1744] kernel32.dll!FindNextFileA 7C834EC9 7 Bytes [ 58, 68, C9, 4E, 14, 01, 50 ]
.text C:\WINDOWS\system32\lsass.exe[1744] kernel32.dll!FindNextFileA + 8 7C834ED1 5 Bytes [ BB, C1, 8C, 00, C3 ]
.text C:\WINDOWS\system32\lsass.exe[1744] ADVAPI32.dll!CryptDeriveKey 77DE9FDD 13 Bytes [ 58, 68, DD, 9F, 2C, 01, 50, ... ]
.text C:\WINDOWS\system32\lsass.exe[1744] ADVAPI32.dll!CryptImportKey 77DEA1D1 13 Bytes [ 58, 68, D1, A1, 2C, 01, 50, ... ]
.text C:\WINDOWS\system32\lsass.exe[1744] ADVAPI32.dll!CryptGenKey 77E117D9 13 Bytes [ 58, 68, D9, 17, 2F, 01, 50, ... ]
.text C:\WINDOWS\system32\lsass.exe[1744] wininet.dll!HttpOpenRequestA 78064341 13 Bytes [ 58, 68, 41, 43, 43, 01, 50, ... ]
.text C:\WINDOWS\system32\lsass.exe[1744] wininet.dll!InternetConnectA 7806499A 13 Bytes [ 58, 68, 9A, 49, 43, 01, 50, ... ]
.text C:\WINDOWS\system32\lsass.exe[1744] wininet.dll!HttpOpenRequestW 78065D62 13 Bytes [ 58, 68, 62, 5D, 43, 01, 50, ... ]
.text C:\WINDOWS\system32\lsass.exe[1744] wininet.dll!InternetReadFile 7806ABB4 13 Bytes [ 58, 68, B4, AB, 43, 01, 50, ... ]
.text C:\WINDOWS\system32\lsass.exe[1744] wininet.dll!InternetQueryDataAvailable 7806ADF5 13 Bytes [ 58, 68, F5, AD, 43, 01, 50, ... ]
.text C:\WINDOWS\system32\lsass.exe[1744] wininet.dll!HttpSendRequestA 7806CD40 13 Bytes [ 58, 68, 40, CD, 43, 01, 50, ... ]
.text C:\WINDOWS\system32\lsass.exe[1744] wininet.dll!InternetWriteFile 78073645 13 Bytes [ 58, 68, 45, 36, 44, 01, 50, ... ]
.text C:\WINDOWS\system32\lsass.exe[1744] wininet.dll!CommitUrlCacheEntryA 7807FC0A 13 Bytes [ 58, 68, 0A, FC, 44, 01, 50, ... ]
.text C:\WINDOWS\system32\lsass.exe[1744] wininet.dll!HttpSendRequestW 78080825 13 Bytes [ 58, 68, 25, 08, 45, 01, 50, ... ]
.text C:\WINDOWS\system32\lsass.exe[1744] wininet.dll!InternetReadFileExW 78082AAA 13 Bytes [ 58, 68, AA, 2A, 45, 01, 50, ... ]
.text C:\WINDOWS\system32\lsass.exe[1744] wininet.dll!InternetReadFileExA 78082AE2 13 Bytes [ 58, 68, E2, 2A, 45, 01, 50, ... ]
.text C:\WINDOWS\system32\lsass.exe[1744] wininet.dll!InternetErrorDlg 780DC93B 13 Bytes [ 58, 68, 3B, C9, 4A, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!FindNextFileW 7C80EFCA 8 Bytes [ 58, 68, CA, EF, 01, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!FindNextFileW + 9 7C80EFD3 4 Bytes [ C2, 9C, 00, C3 ]
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!ExitProcess 7C81CAFA 7 Bytes [ 58, 68, FA, CA, 02, 01, 50 ]
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!ExitProcess + 8 7C81CB02 5 Bytes [ 36, C0, 9C, 00, C3 ]
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!FindNextFileA 7C834EC9 7 Bytes [ 58, 68, C9, 4E, 04, 01, 50 ]
.text C:\WINDOWS\system32\svchost.exe[1988] kernel32.dll!FindNextFileA + 8 7C834ED1 5 Bytes [ BB, C1, 9C, 00, C3 ]
.text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!CryptDeriveKey 77DE9FDD 13 Bytes [ 58, 68, DD, 9F, 1C, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!CryptImportKey 77DEA1D1 13 Bytes [ 58, 68, D1, A1, 1C, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[1988] ADVAPI32.dll!CryptGenKey 77E117D9 13 Bytes [ 58, 68, D9, 17, 1F, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[1988] wininet.dll!HttpOpenRequestA 78064341 13 Bytes [ 58, 68, 41, 43, 33, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[1988] wininet.dll!InternetConnectA 7806499A 13 Bytes [ 58, 68, 9A, 49, 33, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[1988] wininet.dll!HttpOpenRequestW 78065D62 13 Bytes [ 58, 68, 62, 5D, 33, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[1988] wininet.dll!InternetReadFile 7806ABB4 13 Bytes [ 58, 68, B4, AB, 33, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[1988] wininet.dll!InternetQueryDataAvailable 7806ADF5 13 Bytes [ 58, 68, F5, AD, 33, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[1988] wininet.dll!HttpSendRequestA 7806CD40 13 Bytes [ 58, 68, 40, CD, 33, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[1988] wininet.dll!InternetWriteFile 78073645 13 Bytes [ 58, 68, 45, 36, 34, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[1988] wininet.dll!CommitUrlCacheEntryA 7807FC0A 13 Bytes [ 58, 68, 0A, FC, 34, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[1988] wininet.dll!HttpSendRequestW 78080825 13 Bytes [ 58, 68, 25, 08, 35, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[1988] wininet.dll!InternetReadFileExW 78082AAA 13 Bytes [ 58, 68, AA, 2A, 35, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[1988] wininet.dll!InternetReadFileExA 78082AE2 13 Bytes [ 58, 68, E2, 2A, 35, 01, 50, ... ]
.text C:\WINDOWS\system32\svchost.exe[1988] wininet.dll!InternetErrorDlg 780DC93B 13 Bytes [ 58, 68, 3B, C9, 3A, 01, 50, ... ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] kernel32.dll!FindNextFileW 7C80EFCA 8 Bytes [ 58, 68, CA, EF, 2C, 01, 50, ... ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] kernel32.dll!FindNextFileW + 9 7C80EFD3 4 Bytes [ C2, B6, 00, C3 ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] kernel32.dll!ExitProcess 7C81CAFA 7 Bytes [ 58, 68, FA, CA, 2D, 01, 50 ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] kernel32.dll!ExitProcess + 8 7C81CB02 5 Bytes [ 36, C0, B6, 00, C3 ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] kernel32.dll!FindNextFileA 7C834EC9 7 Bytes [ 58, 68, C9, 4E, 2F, 01, 50 ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] kernel32.dll!FindNextFileA + 8 7C834ED1 5 Bytes [ BB, C1, B6, 00, C3 ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] ADVAPI32.dll!CryptDeriveKey 77DE9FDD 13 Bytes [ 58, 68, DD, 9F, 47, 01, 50, ... ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] ADVAPI32.dll!CryptImportKey 77DEA1D1 13 Bytes [ 58, 68, D1, A1, 47, 01, 50, ... ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] ADVAPI32.dll!CryptGenKey 77E117D9 13 Bytes [ 58, 68, D9, 17, 4A, 01, 50, ... ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] wininet.dll!HttpOpenRequestA 78064341 13 Bytes [ 58, 68, 41, 43, 5E, 01, 50, ... ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] wininet.dll!InternetConnectA 7806499A 13 Bytes [ 58, 68, 9A, 49, 5E, 01, 50, ... ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] wininet.dll!HttpOpenRequestW 78065D62 13 Bytes [ 58, 68, 62, 5D, 5E, 01, 50, ... ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] wininet.dll!InternetReadFile 7806ABB4 13 Bytes [ 58, 68, B4, AB, 5E, 01, 50, ... ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] wininet.dll!InternetQueryDataAvailable 7806ADF5 13 Bytes [ 58, 68, F5, AD, 5E, 01, 50, ... ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] wininet.dll!HttpSendRequestA 7806CD40 13 Bytes [ 58, 68, 40, CD, 5E, 01, 50, ... ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] wininet.dll!InternetWriteFile 78073645 13 Bytes [ 58, 68, 45, 36, 5F, 01, 50, ... ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] wininet.dll!CommitUrlCacheEntryA 7807FC0A 13 Bytes [ 58, 68, 0A, FC, 5F, 01, 50, ... ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] wininet.dll!HttpSendRequestW 78080825 13 Bytes [ 58, 68, 25, 08, 60, 01, 50, ... ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] wininet.dll!InternetReadFileExW 78082AAA 13 Bytes [ 58, 68, AA, 2A, 60, 01, 50, ... ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] wininet.dll!InternetReadFileExA 78082AE2 13 Bytes [ 58, 68, E2, 2A, 60, 01, 50, ... ]
.text C:\WINDOWS\system32\wuauclt.exe[3536] wininet.dll!InternetErrorDlg 780DC93B 13 Bytes [ 58, 68, 3B, C9, 65, 01, 50, ... ]

---- Devices - GMER 1.0.14 ----

AttachedDevice \Driver\Tcpip \Device\Ip avfwot.sys (TDI filtering kernel driver/Avira GmbH)
AttachedDevice \Driver\Tcpip \Device\Ip pctfw2.sys (PC Tools TDI Driver/PC Tools)
AttachedDevice \Driver\Tcpip \Device\Tcp pctfw2.sys (PC Tools TDI Driver/PC Tools)
AttachedDevice \Driver\Tcpip \Device\Tcp avfwot.sys (TDI filtering kernel driver/Avira GmbH)

Device pci.sys (NT Plug and Play PCI Enumerator/Microsoft Corporation)

AttachedDevice \Driver\Tcpip \Device\Udp pctfw2.sys (PC Tools TDI Driver/PC Tools)
AttachedDevice \Driver\Tcpip \Device\Udp avfwot.sys (TDI filtering kernel driver/Avira GmbH)
AttachedDevice \Driver\Tcpip \Device\RawIp pctfw2.sys (PC Tools TDI Driver/PC Tools)
AttachedDevice \Driver\Tcpip \Device\RawIp avfwot.sys (TDI filtering kernel driver/Avira GmbH)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat InCDrec.SYS (InCD File System Recognizer/Ahead Software AG)

---- Files - GMER 1.0.14 ----

File C:\WINDOWS\system32\c_945760.nls 125952 bytes executable

---- EOF - GMER 1.0.14 ----

Attached Files


Edited by PropagandaPanda, 09 December 2008 - 08:47 PM.


#6 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:29 AM

Posted 09 December 2008 - 08:44 PM

Hello Docker.

Let's see what ComboFix can do about that..
Please disable Avira before we begin.

Download and Run ComboFix with CFScript
Download Combofix by sUBs from any of the links below, and save it to your desktop.
Link 1, Link 2, Link 3
  • Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are not sure how.
  • Open notepad (Start>Run>"notepad") and copy/paste the text in the box below into it:
    Rootkit::
    C:\WINDOWS\system32\c_945760.nls
    Save this as CFScript.txt, in the same location as ComboFix.exe. (This should be your desktop.)
    Posted Image
    Refering to the picture above, drag CFScript into ComboFix.exe

  • If you did not have it installed, you will see the prompt below. Choose YES.
    Posted ImagePosted Image

  • When the Recovery Console has been installed, you will see the prompt below. Choose NO.
    Posted Image
  • When finished, ComboFix will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).
Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

Follow up with a new GMER log please.

Re-enable your protection at this time. The logs can be posted directly into your reply.

With Regards,
The Panda

#7 Docker749

Docker749
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Hampshire
  • Local time:03:29 PM

Posted 11 December 2008 - 04:31 AM

Hi The Panda

Done as requested attached are the logs

my computer came up with this on opening after combofix started again

Virus or unwanted program 'TR/Trash.Gen [trojan]'
detected in file 'C:\Qoobox\Quarantine\C\WINDOWS\system32\c_945760.nls.vir.
Action performed: Deny access

came up twice

many thanks
docker

Attached Files



#8 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:29 AM

Posted 11 December 2008 - 04:58 AM

Hello.

ComboFix quarentined c_945760.nls, and it can no longer harm your computer.

Please disable your protection.

Run ComboFix with CFScript
We will run ComboFix again. The instructions are slightly different from the initial run.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are unsure how.
  • Open notepad (Start>Run>"notepad") and copy/paste the text in the box below into it:
    http://www.bleepingcomputer.com/forums/t/183304/trojan-virus-picked-up-on-avira/
    
    Suspect::[59]
    c:\windows\system32\DRIVERS\ggflt.sys
    c:\windows\system32\DRIVERS\MaRdP2K.sys
    
    File::
    c:\windows\SC62B1AA2.tmp
    
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux2"=-
    "wave2"=-
    "mixer2"=-
    "midi1"=-
    "midi2"=-
    "aux1"=-
    "wave1"=-
    "mixer1"=-
    Save this as CFScript.txt, in the same location as ComboFix.exe. (This should be your desktop.)
    Posted Image
  • Close all windows at this point.
  • Refering to the picture above, drag CFScript into ComboFix.exe.
  • When finished, it shall produce a log for you at "C:\ComboFix.txt"
Upload Samples Collected by ComboFix
When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.
  • A browser will open.
  • Simply follow the instructions to copy/paste/send the requested file.
F-Secure Online Scan
Please run F-Secure Online Scanner.
This scan is for Internet Explorer only.
  • It is suggested that you disable security programs and close any other windows during the scan. While your security is disabled, please refrain from surfing on other sites. Refer to this page if you are unsure how.
  • Go to F-Secure Online Scanner
  • Follow the instructions here for installation.
  • Accept the License Agreement.
  • Once the ActiveX installs, click Full System Scan
  • Once the download completes, the scan will begin automatically. The scan will take some time to finish, so please be patient.
  • When the scan completes, click the Automatic cleaning (recommended) button.
  • Click the Show Report button and copy the entire report in your next reply.
  • Be sure to re-enable any security programs.

With Regards,
The Panda

#9 Docker749

Docker749
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Hampshire
  • Local time:03:29 PM

Posted 11 December 2008 - 04:35 PM

Hi The Panda

Here are the logs requested

combofix didnt ask to open a browser or i didnt see it and it did it automaticaly i am attaching the log just in case

thank you for you help so far

docker

Attached Files



#10 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:29 AM

Posted 11 December 2008 - 09:08 PM

Hello.

Seems like the file that ComboFix was suppose to submit disappeared :thumbsup: . It was not likely a malware file anyways.

Your logs look clean. If it's good on your side too, then we can wrap up.

Uninstall ComboFix
Remove Combofix now that we're done with it.
  • Click on your Start Menu, then Run....
  • Now type combofix /u in the runbox and click OK. Notice the space between the "x" and "/".
    Posted Image
Uninstalling ComboFix will do the following:
  • Delete ComboFix and its components from your computer.
  • Delete other tools commonly used during the malware removal process.
  • Resets clock settings to standard format.
  • Hide file extensions and hidden/system files.
  • Clear System Restore cache and creates new restore point.
Remove ERUNT Backups
You should remove all the backups that ERUNT has made. Those backups may contain old registry keys, possibly those created by malware.

Delete everything under:
C:\WINDOWS\erdnt\

ERUNT will automatically remove backups older than 30 days, so there is no need to clear that folder manually in the future.

It is a good idea to have ERUNT installed, even when you are not infected. Tasks like installing programs and changing settings, which involve working with the registry, can cause problems that can be quickly undone by reverting to a backup. However, if you wish to uninstall the program, do so using Add/Remove Programs.

Run Cleanup with OTScantIt
This will remove all the tools we used.
  • Double click the OTScanIt.exe icon in the OTScanIt folder on your desktop. If you are using Windows Vista, right click OTScanIt.exe and select Run as Administrator.
  • Click the CleanUp bottun.
  • Restart if prompted.
Preventing Malware Infection in the Future
Please also have a look at the following links, giving some advice and suggestions for preventing future infections: Visit the Windows Update Site regularly.
  • Lots of Hacking/Trojans use the methods found (plugged by the updates) that have not been stopped by people not updating.
  • Update ALL Critical updates and any other Windows updates for services/programs that you use.
  • If you wish, you can also use automatic updates. This is a good thing to have if you want to be up-to-date all the time, but can also be a bit of an annoyance due to its handling and the sizes of the updates. If you wish to turn on automatic updates then you will find here is a nice little article about turning on automatic updates.
    Note that it will download them for you, but you still have to actually click install.
    If you do not want to have automatic updates turned on, or are on dial-up, you can always download updates separately at: http://windowsupdate.microsoft.com.
It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.

Finally, and definitely the MOST IMPORTANT step, click on the following tutorial and follow each step listed there:

Simple and easy ways to keep your computer safe and secure on the Internet

For general slowness problems, take a look at Slow Computer/browser? It May Not Be Malware. Read How to use the Startup Database to identify and disable uneeded processes and increase the amount of available resources.

Do you have any further questions or concerns?

Edited by PropagandaPanda, 11 December 2008 - 09:10 PM.


#11 Docker749

Docker749
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Hampshire
  • Local time:03:29 PM

Posted 12 December 2008 - 08:08 AM

Hi The Panda :thumbsup: :)

Thank you for all your help in this stressful time cross fingers all is well

hope you have a happy christmas and new year

again thank you

Docker :)

#12 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:29 AM

Posted 12 December 2008 - 10:07 PM

You are welcome Docker :thumbsup: .

Since this issue appears to be resolved, this topic is now closed.
If you are the topic starter and need this topic reopened, send me a message.

Everyone else, please begin a new topic.

With Regards,
The Panda




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users