Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

reinfected


  • This topic is locked This topic is locked
26 replies to this topic

#1 mriendeau

mriendeau

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:02:01 AM

Posted 29 January 2009 - 06:20 PM

Hello. I am new here. Thank you for your service and reading my log.
I have never posted a hijackthis log but I'm fed up and am now going to do so.

Recently I reinstalled windows xp home edition (about 3 days ago) and yesterday I some how got infected again with what my comp had in the first place. I have not gone to any porn sites and all I have downloaded in the way of programs are:

1.Pctools. spyware doctor (my antivirus program)

2. my Ati drivers.

3. .netframework 3.5

4. a sound driver bundle from Xceed Software Inc. called

5. the game Unreal tournament 2004.

yesterday I downloaded some pictures from facebook onto my hard drive.


Symptoms:
Task manager has been disabled by your administrater.
Registry editing has been disabled by your administrater.

Also my spyware doctor has picked up 2 ip addresses trying to connect to my computer which i chose to block
those Ip's are:

1195.24.77.224, 72.232.11.26

Here is my hijack this log:
ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:49:00 PM, on 1/29/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
E:\vtaitc.pif
C:\WINDOWS\system32\wpabaln.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\glxavn.exe
C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\yrew.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe


thanks for your help

BC AdBot (Login to Remove)

 


#2 mriendeau

mriendeau
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:02:01 AM

Posted 29 January 2009 - 06:22 PM

When I posted the above post my spyware doctor popped up saying HIGH RISK THREAT DETECTED. Trojan. downloader.small!sd6. I cliked on block

#3 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:01:01 PM

Posted 05 February 2009 - 05:42 AM

Hi,

If you still need help with this go to c:\program files\trend micro\hijackthis folder and rename hijackthis.exe file to something.exe. Post a fresh hjt log after renaming is done.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#4 mriendeau

mriendeau
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:02:01 AM

Posted 05 February 2009 - 11:49 AM

Hi I did what you instructed I named it somethingelse.exe and double cliked it and the same Error came up: Hijackthishas encountered a problem and needs ti close.

#5 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:01:01 PM

Posted 05 February 2009 - 01:04 PM

Hi again,

Let's see if other tool runs.
  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized, if not you'll find it in c:\rsit folder)

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#6 mriendeau

mriendeau
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:02:01 AM

Posted 05 February 2009 - 03:53 PM

Hi again here is the log:

gfile of random's system information tool 1.05 (written by random/random)
Run by mike riendeau at 2009-02-05 12:50:53
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 68 GB (89%) free of 76 GB
Total RAM: 1022 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:51:40 PM, on 1/29/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
E:\vtaitc.pif
C:\WINDOWS\system32\wpabaln.exe
C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\glxavn.exe
C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\yrew.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 3302 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java™ Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-02-02 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-02-02 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-02-02 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-08-29 135168]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2004-10-14 1474560]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-02-02 136600]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-12-01 143360]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=1
"DisableTaskMgr"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\system32\mmc.exe"="C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console"
"E:\vtaitc.pif"="E:\vtaitc.pif:*:Enabled:ipsec"
"C:\Program Files\Spyware Doctor\pctsTray.exe"="C:\Program Files\Spyware Doctor\pctsTray.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\ggwhja.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\ggwhja.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\xcphub.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\xcphub.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winmbdl.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winmbdl.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winvhnbxu.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winvhnbxu.exe:*:Enabled:ipsec"
"C:\Program Files\Analog Devices\Core\smax4pnp.exe"="C:\Program Files\Analog Devices\Core\smax4pnp.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\glxavn.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\glxavn.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\yrew.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\yrew.exe:*:Enabled:ipsec"
"C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe:*:Enabled:ipsec"
"C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\nhice.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\nhice.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\ypiru.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\ypiru.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winmkxtxb.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winmkxtxb.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\wintvrp.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\wintvrp.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\jmxhwj.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\jmxhwj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\qhry.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\qhry.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winlbeqix.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winlbeqix.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winiahnba.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winiahnba.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\windxtc.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\windxtc.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\gwlrkl.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\gwlrkl.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\dgryvd.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\dgryvd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winjvseng.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winjvseng.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winweiky.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winweiky.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\slve.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\slve.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\vetwu.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\vetwu.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\wvxt.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\wvxt.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winyykmv.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winyykmv.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\yhbt.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\yhbt.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\jmldip.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\jmldip.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\wintxty.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\wintxty.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winylvmpi.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winylvmpi.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\xlev.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\xlev.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winjxvd.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winjxvd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\otwftv.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\otwftv.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\vowww.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\vowww.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\vweilv.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\vweilv.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winnchbb.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winnchbb.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winhmexhk.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winhmexhk.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\unvhry.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\unvhry.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winsqlda.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winsqlda.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winwlxd.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winwlxd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winxmye.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winxmye.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\imhk.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\imhk.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\hwmsd.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\hwmsd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\yjmw.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\yjmw.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winqoilb.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winqoilb.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winetjlgu.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winetjlgu.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winliucs.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winliucs.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\wingtkm.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\wingtkm.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\adnvl.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\adnvl.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\ishbyd.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\ishbyd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\pxpgm.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\pxpgm.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\wincbkwn.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\wincbkwn.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\nmxe.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\nmxe.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\stne.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\stne.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\crqglx.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\crqglx.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\roxgpt.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\roxgpt.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\gfmyh.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\gfmyh.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winiksdqq.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winiksdqq.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\wxaex.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\wxaex.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winnmga.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winnmga.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\apvknw.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\apvknw.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winrchij.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winrchij.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\oenor.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\oenor.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winhgvoi.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winhgvoi.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\dljgvd.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\dljgvd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\qmpec.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\qmpec.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\mhwkpj.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\mhwkpj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winioycc.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winioycc.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\txarc.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\txarc.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winylnd.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winylnd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\axwpkb.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\axwpkb.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winbbjcal.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winbbjcal.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\jjhi.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\jjhi.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winldvnc.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winldvnc.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winydhxh.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winydhxh.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\oubq.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\oubq.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\megmhg.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\megmhg.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winpaam.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winpaam.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\lupru.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\lupru.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winqtbq.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winqtbq.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winxpws.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winxpws.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\ymlswk.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\ymlswk.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\vilydl.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\vilydl.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winkuhafv.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winkuhafv.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\npgg.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\npgg.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\huvmx.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\huvmx.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\mnbad.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\mnbad.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\wineqsyw.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\wineqsyw.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winrtiyiy.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winrtiyiy.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\dfyd.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\dfyd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\ywdsa.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\ywdsa.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\rxbl.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\rxbl.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winpbwxn.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\winpbwxn.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\ukte.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\ukte.exe:*:Enabled:ipsec"
"C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\twqvc.exe"="C:\DOCUME~1\MIKERI~1\LOCALS~1\Temp\twqvc.exe:*:Enabled:ipsec"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{217a8abc-edb1-11dd-a8c5-0014bf5849cd}]
shell\aUtOpLay\command - E:\vtaitc.pif
shell\AutoRun\command - E:\vtaitc.pif
shell\eXploRe\command - E:\vtaitc.pif
shell\oPEn\command - E:\vtaitc.pif


======List of files/folders created in the last 1 months======

2009-02-05 12:50:53 ----D---- C:\rsit
2009-02-02 22:35:52 ----D---- C:\Documents and Settings\mike riendeau\Application Data\Mozilla
2009-02-02 22:34:36 ----A---- C:\WINDOWS\system32\javaws.exe
2009-02-02 22:34:36 ----A---- C:\WINDOWS\system32\javaw.exe
2009-02-02 22:34:36 ----A---- C:\WINDOWS\system32\java.exe
2009-02-02 22:34:36 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-02-02 22:34:18 ----D---- C:\Program Files\Java
2009-02-02 22:34:00 ----D---- C:\Documents and Settings\mike riendeau\Application Data\Sun
2009-01-29 14:48:42 ----D---- C:\Program Files\Trend Micro
2009-01-28 01:02:40 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2009-01-28 01:02:18 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2009-01-27 17:46:28 ----A---- C:\WINDOWS\system32\ksuser.dll
2009-01-27 17:46:22 ----D---- C:\WINDOWS\VirtualEar
2009-01-27 17:46:22 ----D---- C:\Program Files\Analog Devices
2009-01-27 17:46:22 ----A---- C:\WINDOWS\system32\virtear.dll
2009-01-27 17:46:22 ----A---- C:\WINDOWS\system32\DSndUp.exe
2009-01-27 17:46:22 ----A---- C:\WINDOWS\system32\CleanUp.exe
2009-01-27 17:46:22 ----A---- C:\WINDOWS\system32\Audio3d.dll
2009-01-27 17:45:56 ----D---- C:\dell
2009-01-27 17:45:56 ----A---- C:\WINDOWS\system32\PostProc.dll
2009-01-27 17:45:56 ----A---- C:\WINDOWS\system32\Edcrypt.dll
2009-01-27 17:11:45 ----D---- C:\Documents and Settings\mike riendeau\Application Data\ATI
2009-01-27 17:11:45 ----D---- C:\Documents and Settings\All Users\Application Data\ATI
2009-01-27 16:14:44 ----D---- C:\Program Files\MSBuild
2009-01-27 16:14:40 ----D---- C:\WINDOWS\system32\XPSViewer
2009-01-27 16:14:34 ----D---- C:\Program Files\Reference Assemblies
2009-01-27 16:14:06 ----N---- C:\WINDOWS\system32\spmsg2.dll
2009-01-27 16:13:14 ----RSD---- C:\WINDOWS\assembly
2009-01-27 16:11:59 ----D---- C:\WINDOWS\Microsoft.NET
2009-01-27 16:01:50 ----N---- C:\WINDOWS\system32\ati2sgag.exe
2009-01-27 16:00:47 ----HD---- C:\Program Files\InstallShield Installation Information
2009-01-27 16:00:47 ----D---- C:\Program Files\ATI Technologies
2009-01-27 15:59:56 ----D---- C:\Program Files\Common Files\InstallShield
2009-01-27 15:59:40 ----D---- C:\ATI
2009-01-27 14:58:32 ----SHD---- C:\RECYCLER
2009-01-27 13:25:17 ----D---- C:\UT2004Demo
2009-01-26 23:25:54 ----D---- C:\WINDOWS\Prefetch
2009-01-26 23:24:20 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-01-26 23:24:09 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-01-26 23:23:56 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-01-26 23:23:07 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2009-01-26 23:22:50 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-01-26 23:22:34 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-01-26 23:22:17 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-01-26 23:22:06 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-01-26 23:21:55 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2009-01-26 23:21:44 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-01-26 23:21:33 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-01-26 23:21:21 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-01-26 23:21:09 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2009-01-26 23:20:58 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-01-26 23:20:47 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-01-26 23:20:37 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-01-26 23:20:24 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-01-26 23:20:14 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-01-26 23:20:03 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2009-01-26 23:13:45 ----D---- C:\WINDOWS\system32\scripting
2009-01-26 23:13:45 ----D---- C:\WINDOWS\l2schemas
2009-01-26 23:13:44 ----D---- C:\WINDOWS\system32\en
2009-01-26 23:13:43 ----D---- C:\WINDOWS\system32\bits
2009-01-26 23:09:45 ----D---- C:\WINDOWS\ServicePackFiles
2009-01-26 23:02:45 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-01-26 23:00:07 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2009-01-26 22:59:59 ----D---- C:\WINDOWS\EHome
2009-01-26 22:54:27 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2_0$
2009-01-26 22:54:14 ----HDC---- C:\WINDOWS\$NtUninstallKB952954_0$
2009-01-26 22:54:05 ----HDC---- C:\WINDOWS\$NtUninstallKB946648_0$
2009-01-26 22:53:59 ----HDC---- C:\WINDOWS\$NtUninstallKB956803_0$
2009-01-26 22:52:35 ----D---- C:\WINDOWS\ie7updates
2009-01-26 22:51:55 ----D---- C:\WINDOWS\WBEM
2009-01-26 22:51:48 ----D---- C:\WINDOWS\system32\en-US
2009-01-26 22:49:59 ----HDC---- C:\WINDOWS\ie7
2009-01-26 22:49:46 ----HDC---- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
2009-01-26 22:49:29 ----HDC---- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
2009-01-26 22:49:15 ----HDC---- C:\WINDOWS\$NtUninstallKB915865$
2009-01-26 22:49:11 ----A---- C:\WINDOWS\system32\xmllite.dll
2009-01-26 22:48:30 ----D---- C:\WINDOWS\network diagnostic
2009-01-26 22:48:28 ----HDC---- C:\WINDOWS\$NtUninstallKB914440$
2009-01-26 22:48:19 ----HDC---- C:\WINDOWS\$NtUninstallKB904942$
2009-01-26 22:46:56 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2009-01-26 22:46:46 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$
2009-01-26 22:46:22 ----HDC---- C:\WINDOWS\$NtUninstallKB958215$
2009-01-26 22:46:13 ----HDC---- C:\WINDOWS\$NtUninstallKB950974_0$
2009-01-26 22:46:06 ----HDC---- C:\WINDOWS\$NtUninstallKB951698_0$
2009-01-26 22:45:54 ----HDC---- C:\WINDOWS\$NtUninstallKB954211_0$
2009-01-26 22:45:42 ----HDC---- C:\WINDOWS\$NtUninstallKB956841_0$
2009-01-26 22:45:31 ----HDC---- C:\WINDOWS\$NtUninstallKB960714$
2009-01-26 22:45:24 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-01-26 22:45:18 ----HDC---- C:\WINDOWS\$NtUninstallKB950762_0$
2009-01-26 22:45:10 ----HDC---- C:\WINDOWS\$NtUninstallKB957097_0$
2009-01-26 22:45:04 ----HDC---- C:\WINDOWS\$NtUninstallKB958687_0$
2009-01-26 22:44:58 ----HDC---- C:\WINDOWS\$NtUninstallKB952287_0$
2009-01-26 22:44:52 ----HDC---- C:\WINDOWS\$NtUninstallKB951066_0$
2009-01-26 22:44:42 ----HDC---- C:\WINDOWS\$NtUninstallKB951748_0$
2009-01-26 22:44:37 ----HDC---- C:\WINDOWS\$NtUninstallKB938464_0$
2009-01-26 22:44:31 ----HDC---- C:\WINDOWS\$NtUninstallKB954600_0$
2009-01-26 22:44:24 ----HDC---- C:\WINDOWS\$NtUninstallKB958644_0$
2009-01-26 22:44:16 ----HDC---- C:\WINDOWS\$NtUninstallKB955069_0$
2009-01-26 22:44:10 ----HDC---- C:\WINDOWS\$NtUninstallKB956802_0$
2009-01-26 22:43:49 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$
2009-01-26 22:43:17 ----A---- C:\WINDOWS\system32\MRT.exe
2009-01-26 22:41:03 ----D---- C:\Documents and Settings\mike riendeau\Application Data\Adobe
2009-01-26 22:40:39 ----D---- C:\Documents and Settings\mike riendeau\Application Data\Macromedia
2009-01-26 22:25:03 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2009-01-26 22:17:16 ----D---- C:\WINDOWS\system32\PreInstall
2009-01-26 22:17:15 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2009-01-26 22:17:14 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2009-01-26 22:17:12 ----D---- C:\Documents and Settings\All Users\Application Data\PC Tools
2009-01-26 22:15:49 ----D---- C:\Program Files\Common Files\PC Tools
2009-01-26 22:10:44 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2009-01-26 22:10:33 ----D---- C:\Program Files\Spyware Doctor
2009-01-26 22:10:33 ----D---- C:\Documents and Settings\mike riendeau\Application Data\PC Tools
2009-01-26 22:08:16 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2009-01-26 21:51:24 ----D---- C:\Documents and Settings\mike riendeau\Application Data\Identities
2009-01-26 21:51:23 ----HD---- C:\Program Files\Uninstall Information
2009-01-26 21:51:17 ----SD---- C:\Documents and Settings\mike riendeau\Application Data\Microsoft
2009-01-26 21:51:17 ----ASH---- C:\Documents and Settings\mike riendeau\Application Data\desktop.ini
2009-01-26 21:46:52 ----D---- C:\WINDOWS\SoftwareDistribution
2009-01-26 21:46:51 ----SD---- C:\WINDOWS\system32\Microsoft
2009-01-26 21:46:50 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-01-26 21:43:52 ----D---- C:\WINDOWS\system32\xircom
2009-01-26 21:43:52 ----D---- C:\Program Files\xerox
2009-01-26 21:43:52 ----D---- C:\Program Files\microsoft frontpage
2009-01-26 21:43:48 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-01-26 21:43:47 ----HD---- C:\WINDOWS\$hf_mig$
2009-01-26 21:43:46 ----A---- C:\WINDOWS\system32\xpsp3res.dll
2009-01-26 21:43:36 ----A---- C:\WINDOWS\control.ini
2009-01-26 21:43:36 ----A---- C:\AUTOEXEC.BAT
2009-01-26 21:43:22 ----A---- C:\WINDOWS\OEWABLog.txt
2009-01-26 21:43:18 ----A---- C:\WINDOWS\system32\mapi32.dll
2009-01-26 21:42:40 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-01-26 21:42:40 ----RD---- C:\WINDOWS\Offline Web Pages
2009-01-26 21:42:40 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-01-26 21:42:35 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-01-26 21:42:31 ----HD---- C:\Program Files\WindowsUpdate
2009-01-26 21:42:12 ----D---- C:\WINDOWS\system32\DirectX
2009-01-26 21:41:50 ----A---- C:\WINDOWS\system32\atrace.dll
2009-01-26 21:41:46 ----A---- C:\WINDOWS\system32\desktop.ini
2009-01-26 21:41:46 ----A---- C:\WINDOWS\desktop.ini
2009-01-26 21:41:38 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2009-01-26 21:41:36 ----D---- C:\Program Files\Common Files\Services
2009-01-26 21:41:36 ----A---- C:\WINDOWS\system32\acctres.dll
2009-01-26 21:41:33 ----SD---- C:\WINDOWS\Tasks
2009-01-26 21:41:33 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2009-01-26 21:41:32 ----D---- C:\Program Files\Common Files\MSSoap
2009-01-26 21:41:27 ----D---- C:\WINDOWS\srchasst
2009-01-26 21:41:25 ----D---- C:\WINDOWS\system32\Macromed
2009-01-26 21:41:22 ----A---- C:\WINDOWS\system32\wuweb.dll
2009-01-26 21:41:22 ----A---- C:\WINDOWS\system32\wucltui.dll
2009-01-26 21:41:22 ----A---- C:\WINDOWS\system32\wuauserv.dll
2009-01-26 21:41:22 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2009-01-26 21:41:21 ----A---- C:\WINDOWS\system32\wups.dll
2009-01-26 21:41:21 ----A---- C:\WINDOWS\system32\wuaueng.dll
2009-01-26 21:41:21 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2009-01-26 21:41:21 ----A---- C:\WINDOWS\system32\wuauclt.exe
2009-01-26 21:41:21 ----A---- C:\WINDOWS\system32\wuapi.dll
2009-01-26 21:41:21 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2009-01-26 21:41:21 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2009-01-26 21:41:20 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2009-01-26 21:41:20 ----A---- C:\WINDOWS\system32\qmgr.dll
2009-01-26 21:41:15 ----D---- C:\Program Files\Movie Maker
2009-01-26 21:41:11 ----A---- C:\WINDOWS\system32\safrslv.dll
2009-01-26 21:41:11 ----A---- C:\WINDOWS\system32\safrdm.dll
2009-01-26 21:41:11 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2009-01-26 21:41:11 ----A---- C:\WINDOWS\system32\racpldlg.dll
2009-01-26 21:41:06 ----A---- C:\WINDOWS\system32\fltmc.exe
2009-01-26 21:41:06 ----A---- C:\WINDOWS\system32\fltlib.dll
2009-01-26 21:41:05 ----D---- C:\WINDOWS\system32\Restore
2009-01-26 21:41:05 ----A---- C:\WINDOWS\system32\srsvc.dll
2009-01-26 21:41:05 ----A---- C:\WINDOWS\system32\srrstr.dll
2009-01-26 21:41:05 ----A---- C:\WINDOWS\system32\srclient.dll
2009-01-26 21:41:04 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2009-01-26 21:41:04 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2009-01-26 21:41:04 ----A---- C:\WINDOWS\system32\mnmdd.dll
2009-01-26 21:41:04 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2009-01-26 21:41:04 ----A---- C:\WINDOWS\system32\ils.dll
2009-01-26 21:41:03 ----A---- C:\WINDOWS\system32\msconf.dll
2009-01-26 21:41:00 ----D---- C:\Program Files\NetMeeting
2009-01-26 21:41:00 ----A---- C:\WINDOWS\system32\msoert2.dll
2009-01-26 21:41:00 ----A---- C:\WINDOWS\system32\msoeacct.dll
2009-01-26 21:40:59 ----A---- C:\WINDOWS\system32\inetres.dll
2009-01-26 21:40:58 ----A---- C:\WINDOWS\system32\inetcomm.dll
2009-01-26 21:40:56 ----D---- C:\Program Files\Outlook Express
2009-01-26 21:40:56 ----A---- C:\WINDOWS\system32\schedsvc.dll
2009-01-26 21:40:55 ----A---- C:\WINDOWS\system32\mstinit.exe
2009-01-26 21:40:55 ----A---- C:\WINDOWS\system32\mstask.dll
2009-01-26 21:40:55 ----A---- C:\WINDOWS\system32\icwphbk.dll
2009-01-26 21:40:55 ----A---- C:\WINDOWS\system32\icwdial.dll
2009-01-26 21:40:54 ----A---- C:\WINDOWS\system32\isign32.dll
2009-01-26 21:40:54 ----A---- C:\WINDOWS\system32\inetcfg.dll
2009-01-26 21:40:48 ----D---- C:\Program Files\Common Files\System
2009-01-26 21:40:47 ----D---- C:\Program Files\Internet Explorer
2009-01-26 21:40:36 ----D---- C:\Program Files\ComPlus Applications
2009-01-26 21:40:34 ----A---- C:\WINDOWS\vbaddin.ini
2009-01-26 21:40:34 ----A---- C:\WINDOWS\vb.ini
2009-01-26 21:40:30 ----D---- C:\WINDOWS\Registration
2009-01-26 21:40:07 ----D---- C:\Program Files\Windows Media Player
2009-01-26 21:40:07 ----D---- C:\Program Files\Online Services
2009-01-26 21:40:02 ----D---- C:\Program Files\Messenger
2009-01-26 21:39:58 ----D---- C:\Program Files\MSN Gaming Zone
2009-01-26 21:39:58 ----A---- C:\WINDOWS\system32\write.exe
2009-01-26 21:39:49 ----A---- C:\WINDOWS\system32\sndvol32.exe
2009-01-26 21:39:49 ----A---- C:\WINDOWS\system32\hticons.dll
2009-01-26 21:39:49 ----A---- C:\WINDOWS\system32\avwav.dll
2009-01-26 21:39:49 ----A---- C:\WINDOWS\system32\avmeter.dll
2009-01-26 21:39:48 ----A---- C:\WINDOWS\system32\winchat.exe
2009-01-26 21:39:48 ----A---- C:\WINDOWS\system32\avtapi.dll
2009-01-26 21:39:41 ----A---- C:\WINDOWS\system32\getuname.dll
2009-01-26 21:39:40 ----A---- C:\WINDOWS\system32\winmine.exe
2009-01-26 21:39:40 ----A---- C:\WINDOWS\system32\sol.exe
2009-01-26 21:39:40 ----A---- C:\WINDOWS\system32\charmap.exe
2009-01-26 21:39:40 ----A---- C:\WINDOWS\system32\calc.exe
2009-01-26 21:39:39 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2009-01-26 21:39:39 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2009-01-26 21:39:39 ----A---- C:\WINDOWS\system32\tslabels.ini
2009-01-26 21:39:39 ----A---- C:\WINDOWS\system32\tskill.exe
2009-01-26 21:39:39 ----A---- C:\WINDOWS\system32\reset.exe
2009-01-26 21:39:39 ----A---- C:\WINDOWS\system32\mshearts.exe
2009-01-26 21:39:39 ----A---- C:\WINDOWS\system32\freecell.exe
2009-01-26 21:39:38 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2009-01-26 21:39:38 ----A---- C:\WINDOWS\system32\tscon.exe
2009-01-26 21:39:38 ----A---- C:\WINDOWS\system32\shadow.exe
2009-01-26 21:39:38 ----A---- C:\WINDOWS\system32\rwinsta.exe
2009-01-26 21:39:38 ----A---- C:\WINDOWS\system32\regini.exe
2009-01-26 21:39:38 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2009-01-26 21:39:38 ----A---- C:\WINDOWS\system32\qwinsta.exe
2009-01-26 21:39:38 ----A---- C:\WINDOWS\system32\qappsrv.exe
2009-01-26 21:39:38 ----A---- C:\WINDOWS\system32\msg.exe
2009-01-26 21:39:38 ----A---- C:\WINDOWS\system32\logoff.exe
2009-01-26 21:39:38 ----A---- C:\WINDOWS\system32\cdmodem.dll
2009-01-26 21:39:37 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2009-01-26 21:39:37 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2009-01-26 21:39:36 ----A---- C:\WINDOWS\system32\stclient.dll
2009-01-26 21:39:36 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2009-01-26 21:39:36 ----A---- C:\WINDOWS\system32\mtxex.dll
2009-01-26 21:39:36 ----A---- C:\WINDOWS\system32\mtxdm.dll
2009-01-26 21:39:36 ----A---- C:\WINDOWS\system32\comsnap.dll
2009-01-26 21:39:36 ----A---- C:\WINDOWS\system32\comrepl.dll
2009-01-26 21:39:36 ----A---- C:\WINDOWS\system32\comaddin.dll
2009-01-26 21:39:31 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2009-01-26 21:39:14 ----D---- C:\Program Files\MSN
2009-01-26 21:39:13 ----A---- C:\WINDOWS\system32\sndrec32.exe
2009-01-26 21:39:13 ----A---- C:\WINDOWS\system32\mplay32.exe
2009-01-26 21:39:13 ----A---- C:\WINDOWS\system32\accwiz.exe
2009-01-26 21:39:12 ----D---- C:\Program Files\Windows NT
2009-01-26 21:39:12 ----A---- C:\WINDOWS\system32\mspaint.exe
2009-01-26 21:39:12 ----A---- C:\WINDOWS\system32\hypertrm.dll
2009-01-26 21:39:11 ----A---- C:\WINDOWS\system32\spider.exe
2009-01-26 21:39:11 ----A---- C:\WINDOWS\system32\clipbrd.exe
2009-01-26 21:39:10 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2009-01-26 21:39:10 ----A---- C:\WINDOWS\system32\mstscax.dll
2009-01-26 21:39:10 ----A---- C:\WINDOWS\system32\mstsc.exe
2009-01-26 21:39:09 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2009-01-26 21:39:09 ----A---- C:\WINDOWS\system32\termsrv.dll
2009-01-26 21:39:09 ----A---- C:\WINDOWS\system32\sessmgr.exe
2009-01-26 21:39:09 ----A---- C:\WINDOWS\system32\remotepg.dll
2009-01-26 21:39:09 ----A---- C:\WINDOWS\system32\rdshost.exe
2009-01-26 21:39:09 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2009-01-26 21:39:09 ----A---- C:\WINDOWS\system32\rdchost.dll
2009-01-26 21:39:08 ----D---- C:\WINDOWS\system32\MsDtc
2009-01-26 21:39:08 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2009-01-26 21:39:08 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2009-01-26 21:39:08 ----A---- C:\WINDOWS\system32\rdpclip.exe
2009-01-26 21:39:08 ----A---- C:\WINDOWS\system32\qprocess.exe
2009-01-26 21:39:08 ----A---- C:\WINDOWS\system32\mtxoci.dll
2009-01-26 21:39:08 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2009-01-26 21:39:08 ----A---- C:\WINDOWS\system32\icaapi.dll
2009-01-26 21:39:08 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2009-01-26 21:39:07 ----A---- C:\WINDOWS\system32\xolehlp.dll
2009-01-26 21:39:07 ----A---- C:\WINDOWS\system32\msdtctm.dll
2009-01-26 21:39:07 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2009-01-26 21:39:06 ----A---- C:\WINDOWS\system32\msdtclog.dll
2009-01-26 21:39:06 ----A---- C:\WINDOWS\system32\msdtc.exe
2009-01-26 21:39:05 ----D---- C:\WINDOWS\system32\Com
2009-01-26 21:39:05 ----A---- C:\WINDOWS\system32\colbact.dll
2009-01-26 21:39:05 ----A---- C:\WINDOWS\system32\clbcatex.dll
2009-01-26 21:39:05 ----A---- C:\WINDOWS\system32\catsrvut.dll
2009-01-26 21:39:05 ----A---- C:\WINDOWS\system32\catsrvps.dll
2009-01-26 21:39:05 ----A---- C:\WINDOWS\system32\catsrv.dll
2009-01-26 21:39:04 ----A---- C:\WINDOWS\system32\comsvcs.dll
2009-01-26 21:39:03 ----A---- C:\WINDOWS\system32\comuid.dll
2009-01-26 21:39:03 ----A---- C:\WINDOWS\system32\clbcatq.dll
2009-01-26 21:38:57 ----A---- C:\WINDOWS\system32\servdeps.dll
2009-01-26 21:38:57 ----A---- C:\WINDOWS\system32\mmfutil.dll
2009-01-26 21:38:57 ----A---- C:\WINDOWS\system32\licwmi.dll
2009-01-26 21:38:57 ----A---- C:\WINDOWS\system32\cmprops.dll
2009-01-26 13:37:07 ----A---- C:\WINDOWS\system32\h323log.txt
2009-01-26 13:32:52 ----A---- C:\WINDOWS\system32\usbui.dll
2009-01-26 13:31:59 ----A---- C:\WINDOWS\imsins.BAK
2009-01-26 13:31:57 ----SHD---- C:\WINDOWS\Installer
2009-01-26 13:31:57 ----D---- C:\Program Files\Common Files\ODBC
2009-01-26 13:31:57 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-01-26 13:31:57 ----A---- C:\WINDOWS\ODBCINST.INI
2009-01-26 13:31:53 ----D---- C:\Program Files\Common Files\SpeechEngines
2009-01-26 13:31:52 ----RD---- C:\Program Files
2009-01-26 13:31:52 ----D---- C:\Program Files\Common Files\Microsoft Shared
2009-01-26 13:31:52 ----D---- C:\Program Files\Common Files
2009-01-26 13:31:49 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2009-01-26 13:31:49 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2009-01-26 13:31:49 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2009-01-26 13:31:47 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2009-01-26 13:31:47 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2009-01-26 13:31:47 ----RA---- C:\WINDOWS\system32\kbdur.dll
2009-01-26 13:31:47 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2009-01-26 13:31:47 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2009-01-26 13:31:47 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2009-01-26 13:31:47 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2009-01-26 13:31:47 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2009-01-26 13:31:47 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2009-01-26 13:31:46 ----RA---- C:\WINDOWS\system32\kbdru.dll
2009-01-26 13:31:46 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2009-01-26 13:31:46 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2009-01-26 13:31:44 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2009-01-26 13:31:44 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2009-01-26 13:31:44 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2009-01-26 13:31:44 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2009-01-26 13:31:44 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2009-01-26 13:31:44 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2009-01-26 13:31:44 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2009-01-26 13:31:42 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2009-01-26 13:31:42 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2009-01-26 13:31:42 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2009-01-26 13:31:42 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2009-01-26 13:31:42 ----RA---- C:\WINDOWS\system32\kbdest.dll
2009-01-26 13:31:40 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2009-01-26 13:31:40 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2009-01-26 13:31:40 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2009-01-26 13:31:40 ----RA---- C:\WINDOWS\system32\kbdro.dll
2009-01-26 13:31:40 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2009-01-26 13:31:40 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2009-01-26 13:31:40 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2009-01-26 13:31:40 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2009-01-26 13:31:40 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2009-01-26 13:31:40 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2009-01-26 13:31:40 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2009-01-26 13:31:40 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2009-01-26 13:31:40 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2009-01-26 13:31:37 ----A---- C:\WINDOWS\system32\spxcoins.dll
2009-01-26 13:31:37 ----A---- C:\WINDOWS\system32\irclass.dll
2009-01-26 13:31:37 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2009-01-26 13:31:37 ----A---- C:\WINDOWS\system32\dgsetup.dll
2009-01-26 13:31:37 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2009-01-26 13:31:34 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2009-01-26 13:31:34 ----A---- C:\WINDOWS\TASKMAN.EXE
2009-01-26 13:31:34 ----A---- C:\WINDOWS\system32\batt.dll
2009-01-26 13:31:33 ----A---- C:\WINDOWS\notepad.exe
2009-01-26 13:31:32 ----A---- C:\WINDOWS\system32\storprop.dll
2009-01-26 13:31:26 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2009-01-26 13:31:25 ----RA---- C:\WINDOWS\SET25.tmp
2009-01-26 13:31:22 ----RA---- C:\WINDOWS\SET8.tmp
2009-01-26 13:31:19 ----RA---- C:\WINDOWS\SET4.tmp
2009-01-26 13:31:17 ----RA---- C:\WINDOWS\SET3.tmp
2009-01-26 13:31:10 ----D---- C:\WINDOWS\system32\CatRoot2
2009-01-26 13:31:10 ----D---- C:\WINDOWS\system32\CatRoot
2009-01-26 13:31:05 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-01-26 13:30:17 ----A---- C:\WINDOWS\setuplog.txt
2009-01-26 13:30:14 ----SHD---- C:\System Volume Information
2009-01-26 13:30:14 ----D---- C:\Documents and Settings
2009-01-26 13:29:31 ----SH---- C:\boot.ini
2009-01-26 13:23:33 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-01-26 13:23:33 ----RSD---- C:\WINDOWS\Fonts
2009-01-26 13:23:33 ----RD---- C:\WINDOWS\Web
2009-01-26 13:23:33 ----HD---- C:\WINDOWS\inf
2009-01-26 13:23:33 ----D---- C:\WINDOWS\WinSxS
2009-01-26 13:23:33 ----D---- C:\WINDOWS\twain_32
2009-01-26 13:23:33 ----D---- C:\WINDOWS\Temp
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\wins
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\wbem
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\usmt
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\spool
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\ShellExt
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\Setup
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\ras
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\oobe
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\npp
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\mui
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\inetsrv
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\IME
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\icsxml
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\ias
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\export
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\drivers
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\dhcp
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\config
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\3com_dmi
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\3076
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\2052
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\1054
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\1042
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\1041
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\1037
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\1033
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\1031
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\1028
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32\1025
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system32
2009-01-26 13:23:33 ----D---- C:\WINDOWS\system
2009-01-26 13:23:33 ----D---- C:\WINDOWS\security
2009-01-26 13:23:33 ----D---- C:\WINDOWS\Resources
2009-01-26 13:23:33 ----D---- C:\WINDOWS\repair
2009-01-26 13:23:33 ----D---- C:\WINDOWS\Provisioning
2009-01-26 13:23:33 ----D---- C:\WINDOWS\PeerNet
2009-01-26 13:23:33 ----D---- C:\WINDOWS\pchealth
2009-01-26 13:23:33 ----D---- C:\WINDOWS\mui
2009-01-26 13:23:33 ----D---- C:\WINDOWS\msapps
2009-01-26 13:23:33 ----D---- C:\WINDOWS\msagent
2009-01-26 13:23:33 ----D---- C:\WINDOWS\Media
2009-01-26 13:23:33 ----D---- C:\WINDOWS\java
2009-01-26 13:23:33 ----D---- C:\WINDOWS\ime
2009-01-26 13:23:33 ----D---- C:\WINDOWS\Help
2009-01-26 13:23:33 ----D---- C:\WINDOWS\Driver Cache
2009-01-26 13:23:33 ----D---- C:\WINDOWS\Debug
2009-01-26 13:23:33 ----D---- C:\WINDOWS\Cursors
2009-01-26 13:23:33 ----D---- C:\WINDOWS\Connection Wizard
2009-01-26 13:23:33 ----D---- C:\WINDOWS\Config
2009-01-26 13:23:33 ----D---- C:\WINDOWS\AppPatch
2009-01-26 13:23:33 ----D---- C:\WINDOWS\addins
2009-01-26 13:23:33 ----D---- C:\WINDOWS

======List of files/folders modified in the last 1 months======

2009-01-29 04:49:18 ----A---- C:\WINDOWS\system.ini
2009-01-26 21:43:36 ----A---- C:\WINDOWS\win.ini
2009-01-07 17:20:24 ----A---- C:\WINDOWS\system32\LegitCheckControl.DLL

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 pctfw2;pctfw2; \??\C:\WINDOWS\system32\drivers\pctfw2.sys []
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-02-28 12032]
R3 abp470n5;abp470n5; \??\C:\WINDOWS\system32\drivers\ohnojj.sys []
R3 ADM851x;ADMtek ADM8513 USB To Fast Ethernet Adapter; C:\WINDOWS\system32\DRIVERS\ADM851x.SYS [2003-07-10 26493]
R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter; C:\WINDOWS\system32\DRIVERS\AN983.sys [2004-08-03 36224]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-12-01 3452928]
R3 IKFileSec;File Security Driver; C:\WINDOWS\system32\drivers\ikfilesec.sys [2008-08-25 40840]
R3 IKSysFlt;System Filter Driver; C:\WINDOWS\system32\drivers\iksysflt.sys [2008-08-25 66952]
R3 IKSysSec;System Security Driver; C:\WINDOWS\system32\drivers\iksyssec.sys [2008-08-25 81288]
R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2004-09-17 732928]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2005-01-27 260352]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-12-01 598016]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-02-02 152984]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2008-12-01 593920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2008-06-13 426552]
S3 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2008-10-09 1079176]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

And here is the Info log:

info.txt logfile of random's system information tool 1.05 2009-02-05 12:51:02

======Uninstall list======

-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->MsiExec.exe /X{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}
ATI - Software Uninstall Utility-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Catalyst Control Center - Branding-->MsiExec.exe /I{D3B1C799-CB73-42DE-BA0F-2344793A095C}
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Java™ 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft .NET Framework 3.5-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\setup.exe
Microsoft .NET Framework 3.5-->MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
SoundMAX-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\SETUP.exe" -l0x9 -removeonly
Spyware Doctor 6.0-->C:\Program Files\Spyware Doctor\unins000.exe /LOG
Unreal Tournament 2004 Demo-->C:\UT2004Demo\System\Setup.exe uninstall "UT2004-Demo"
Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"

======Security center information======

AV: Spyware Doctor with AntiVirus (disabled)

System event log

Computer Name: MIKE
Event Code: 15007
Message: Reservation for namespace identified by URL prefix http://*:2869/ was successfully added.

Record Number: 5
Source Name: HTTP
Time Written: 20090126214229.000000-480
Event Type: information
User:

Computer Name: MIKE
Event Code: 6011
Message: The NetBIOS name and DNS host name of this machine have been changed from MACHINENAME to MIKE.

Record Number: 4
Source Name: EventLog
Time Written: 20090126213721.000000-480
Event Type: information
User:

Computer Name: MACHINENAME
Event Code: 2
Message: While validating that \Device\Serial0 was really a serial port, a fifo was detected. The fifo will be used.

Record Number: 3
Source Name: Serial
Time Written: 20090126133038.000000-480
Event Type: information
User:

Computer Name: MACHINENAME
Event Code: 6005
Message: The Event log service was started.

Record Number: 2
Source Name: EventLog
Time Written: 20090126133018.000000-480
Event Type: information
User:

Computer Name: MACHINENAME
Event Code: 6009
Message: Microsoft ® Windows ® 5.01. 2600 Service Pack 2 Uniprocessor Free.

Record Number: 1
Source Name: EventLog
Time Written: 20090126133018.000000-480
Event Type: information
User:

Application event log

Computer Name: MIKE
Event Code: 1000
Message: Performance counters for the ContentIndex (ContentIndex) service were loaded successfully.
The Record Data contains the new index values assigned
to this service.

Record Number: 5
Source Name: LoadPerf
Time Written: 20090126214008.000000-480
Event Type: information
User:

Computer Name: MIKE
Event Code: 1000
Message: Performance counters for the TermService (Terminal Services) service were loaded successfully.
The Record Data contains the new index values assigned
to this service.

Record Number: 4
Source Name: LoadPerf
Time Written: 20090126214007.000000-480
Event Type: information
User:

Computer Name: MIKE
Event Code: 1000
Message: Performance counters for the RemoteAccess (Routing and Remote Access) service were loaded successfully.
The Record Data contains the new index values assigned
to this service.

Record Number: 3
Source Name: LoadPerf
Time Written: 20090126213753.000000-480
Event Type: information
User:

Computer Name: MIKE
Event Code: 1000
Message: Performance counters for the PSched (PSched) service were loaded successfully.
The Record Data contains the new index values assigned
to this service.

Record Number: 2
Source Name: LoadPerf
Time Written: 20090126213730.000000-480
Event Type: information
User:

Computer Name: MIKE
Event Code: 1000
Message: Performance counters for the RSVP (QoS RSVP) service were loaded successfully.
The Record Data contains the new index values assigned
to this service.

Record Number: 1
Source Name: LoadPerf
Time Written: 20090126213729.000000-480
Event Type: information
User:

Security event log

Computer Name: MIKE
Event Code: 540
Message: Successful Network Logon:

User Name:

Domain:

Logon ID: (0x0,0x136F2)

Logon Type: 3

Logon Process: NtLmSsp

Authentication Package: NTLM

Workstation Name:

Logon GUID: -

Record Number: 803
Source Name: Security
Time Written: 20090129144120.000000-480
Event Type: audit success
User: NT AUTHORITY\ANONYMOUS LOGON

Computer Name: MIKE
Event Code: 615
Message: IPSec Services: IPSec Services has started successfully.



Record Number: 802
Source Name: Security
Time Written: 20090129144120.000000-480
Event Type: audit success
User: NT AUTHORITY\NETWORK SERVICE

Computer Name: MIKE
Event Code: 615
Message: IPSec Services: IPSec Services failed to get the complete list of network interfaces on the machine. This can be a potential security hazard to the machine since some of the network interfaces may not get the protection as desired by the applied IPSec filters. Please run IPSec monitor snap-in to further diagnose the problem.



Record Number: 801
Source Name: Security
Time Written: 20090129144120.000000-480
Event Type: audit failure
User: NT AUTHORITY\NETWORK SERVICE

Computer Name: MIKE
Event Code: 576
Message: Special privileges assigned to new logon:

User Name: LOCAL SERVICE

Domain: NT AUTHORITY

Logon ID: (0x0,0x3E5)

Privileges: SeAuditPrivilege
SeAssignPrimaryTokenPrivilege
SeChangeNotifyPrivilege

Record Number: 800
Source Name: Security
Time Written: 20090129144118.000000-480
Event Type: audit success
User: NT AUTHORITY\LOCAL SERVICE

Computer Name: MIKE
Event Code: 528
Message: Successful Logon:

User Name: LOCAL SERVICE

Domain: NT AUTHORITY

Logon ID: (0x0,0x3E5)

Logon Type: 5

Logon Process: Advapi

Authentication Package: Negotiate

Workstation Name:

Logon GUID: -

Record Number: 799
Source Name: Security
Time Written: 20090129144118.000000-480
Event Type: audit success
User: NT AUTHORITY\LOCAL SERVICE

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 3, GenuineIntel
"PROCESSOR_REVISION"=0403
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

#7 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:01:01 PM

Posted 06 February 2009 - 12:58 PM

Hi,

Well, that's nasty looking one for sure. Let's see if we can make it better.


Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
    Remember to re-enable them afterwards.

  • Click Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New HijackThis log.


A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#8 mriendeau

mriendeau
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:02:01 AM

Posted 06 February 2009 - 06:08 PM

ok doing it now will post log

#9 mriendeau

mriendeau
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:02:01 AM

Posted 06 February 2009 - 06:21 PM

here is my Comfix log thank you


ComboFix 09-02-06.01 - mike riendeau 2009-02-06 15:15:50.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.690 [GMT -8:00]
Running from: c:\documents and settings\mike riendeau\Desktop\ComboFix.exe
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-01-06 to 2009-02-06 )))))))))))))))))))))))))))))))
.

2009-02-06 10:27 . 2008-04-13 16:11 21,504 --a------ c:\windows\system32\hidserv.dll
2009-02-06 10:27 . 2008-04-13 16:11 21,504 --a--c--- c:\windows\system32\dllcache\hidserv.dll
2009-02-06 10:26 . 2008-04-13 10:45 10,368 --a------ c:\windows\system32\drivers\hidusb.sys
2009-02-06 10:26 . 2008-04-13 10:45 10,368 --a--c--- c:\windows\system32\dllcache\hidusb.sys
2009-02-06 10:24 . 2008-04-13 10:45 60,032 --a------ c:\windows\system32\drivers\USBAUDIO.sys
2009-02-06 10:24 . 2008-04-13 10:45 60,032 --a--c--- c:\windows\system32\dllcache\usbaudio.sys
2009-02-06 10:23 . 2008-04-13 10:45 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys
2009-02-06 10:23 . 2008-04-13 10:45 32,128 --a--c--- c:\windows\system32\dllcache\usbccgp.sys
2009-02-05 12:50 . 2009-02-05 12:51 <DIR> d-------- C:\rsit
2009-02-02 22:34 . 2009-02-02 22:34 <DIR> d-------- c:\program files\Java
2009-02-02 22:34 . 2009-02-02 22:34 410,984 --a------ c:\windows\system32\deploytk.dll
2009-02-02 22:34 . 2009-02-02 22:34 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-01-29 14:48 . 2009-01-29 14:48 <DIR> d-------- c:\program files\Trend Micro
2009-01-29 04:48 . 2008-04-13 10:45 26,368 --a--c--- c:\windows\system32\dllcache\usbstor.sys
2009-01-27 17:47 . 2008-04-13 11:17 83,072 --a------ c:\windows\system32\drivers\wdmaud.sys
2009-01-27 17:47 . 2008-04-13 11:17 83,072 --a--c--- c:\windows\system32\dllcache\wdmaud.sys
2009-01-27 17:47 . 2008-04-13 10:45 52,864 --a------ c:\windows\system32\drivers\DMusic.sys
2009-01-27 17:47 . 2008-04-13 10:45 52,864 --a--c--- c:\windows\system32\dllcache\dmusic.sys
2009-01-27 17:47 . 2008-04-13 10:45 6,272 --a------ c:\windows\system32\drivers\splitter.sys
2009-01-27 17:47 . 2008-04-13 10:45 6,272 --a--c--- c:\windows\system32\dllcache\splitter.sys
2009-01-27 17:46 . 2009-01-27 17:46 <DIR> d-------- c:\program files\Analog Devices
2009-01-27 17:45 . 2009-01-27 17:45 <DIR> d-------- C:\dell
2009-01-27 17:45 . 2001-09-19 12:47 765,952 --a------ c:\windows\system\crlds3d.dll
2009-01-27 17:45 . 2004-09-17 09:02 732,928 --a------ c:\windows\system32\drivers\senfilt.sys
2009-01-27 17:45 . 2004-09-23 07:55 311,296 --a------ c:\windows\system32\Edcrypt.dll
2009-01-27 17:45 . 2005-01-27 15:31 260,352 --a------ c:\windows\system32\drivers\smwdm.sys
2009-01-27 17:45 . 2004-10-05 16:10 23,040 --a------ c:\windows\system32\PostProc.dll
2009-01-27 17:11 . 2009-01-27 17:11 <DIR> d-------- c:\documents and settings\mike riendeau\Application Data\ATI
2009-01-27 17:11 . 2009-01-27 17:11 <DIR> d-------- c:\documents and settings\All Users\Application Data\ATI
2009-01-27 16:14 . 2009-01-27 16:14 <DIR> d-------- c:\windows\system32\XPSViewer
2009-01-27 16:14 . 2009-01-27 16:14 <DIR> d-------- c:\program files\Reference Assemblies
2009-01-27 16:14 . 2009-01-27 16:14 <DIR> d-------- c:\program files\MSBuild
2009-01-27 16:14 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-01-27 16:03 . 2009-01-27 16:03 0 --a------ c:\windows\ativpsrm.bin
2009-01-27 16:01 . 2008-12-01 14:35 593,920 --------- c:\windows\system32\ati2sgag.exe
2009-01-27 16:00 . 2009-01-27 17:46 <DIR> d--h----- c:\program files\InstallShield Installation Information
2009-01-27 16:00 . 2009-01-27 16:02 <DIR> d-------- c:\program files\ATI Technologies
2009-01-27 15:59 . 2009-01-27 16:01 <DIR> d-------- c:\program files\Common Files\InstallShield
2009-01-27 15:59 . 2009-01-27 15:59 <DIR> d-------- C:\ATI
2009-01-27 15:39 . 2009-01-27 15:39 664 --a------ c:\windows\system32\d3d9caps.dat
2009-01-27 13:36 . 2009-01-27 13:36 552 --a------ c:\windows\system32\d3d8caps.dat
2009-01-27 13:25 . 2009-02-01 07:05 <DIR> d-------- C:\UT2004Demo
2009-01-26 23:13 . 2009-01-26 23:13 <DIR> d-------- c:\windows\system32\scripting
2009-01-26 23:13 . 2009-01-26 23:13 <DIR> d-------- c:\windows\system32\en
2009-01-26 23:13 . 2009-01-26 23:13 <DIR> d-------- c:\windows\system32\bits
2009-01-26 23:13 . 2009-01-26 23:13 <DIR> d-------- c:\windows\l2schemas
2009-01-26 23:09 . 2009-01-26 23:14 <DIR> d-------- c:\windows\ServicePackFiles
2009-01-26 22:59 . 2009-01-26 22:59 <DIR> d-------- c:\windows\EHome
2009-01-26 22:52 . 2008-10-16 12:38 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll
2009-01-26 22:52 . 2007-04-17 01:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat
2009-01-26 22:52 . 2007-03-07 21:10 991,232 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui
2009-01-26 22:52 . 2008-10-16 12:38 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll
2009-01-26 22:52 . 2008-10-16 12:38 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll
2009-01-26 22:52 . 2008-10-16 12:38 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll
2009-01-26 22:52 . 2008-10-16 12:38 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll
2009-01-26 22:52 . 2008-10-16 12:38 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll
2009-01-26 22:52 . 2008-10-16 05:11 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe
2009-01-26 22:39 . 2004-08-03 22:41 1,041,536 --------- c:\windows\system32\drivers\hsfdpsp2.sys
2009-01-26 22:38 . 2008-12-01 14:13 3,452,928 --a------ c:\windows\system32\drivers\ati2mtag.sys
2009-01-26 22:25 . 2008-06-13 03:05 272,128 --------- c:\windows\system32\drivers\bthport.sys
2009-01-26 22:25 . 2008-06-13 03:05 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys
2009-01-26 22:24 . 2008-09-15 04:12 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys
2009-01-26 22:23 . 2009-01-26 22:23 <DIR> d--hs---- c:\documents and settings\mike riendeau\UserData
2009-01-26 22:23 . 2008-08-14 02:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2009-01-26 22:23 . 2008-08-14 02:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-01-26 22:23 . 2008-08-14 01:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-01-26 22:23 . 2008-08-14 01:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2009-01-26 22:22 . 2008-10-24 03:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2009-01-26 22:22 . 2008-12-11 02:57 333,952 -----c--- c:\windows\system32\dllcache\srv.sys
2009-01-26 22:22 . 2008-05-08 06:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys
2009-01-26 22:21 . 2008-04-11 11:04 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
2009-01-26 22:21 . 2008-10-15 08:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2009-01-26 22:17 . 2009-01-26 22:17 <DIR> d-------- c:\documents and settings\All Users\Application Data\PC Tools
2009-01-26 22:17 . 2009-01-26 22:16 160,792 --a------ c:\windows\system32\drivers\pctfw2.sys
2009-01-26 22:17 . 2007-08-10 20:46 26,488 --a------ c:\windows\system32\spupdsvc.exe
2009-01-26 22:15 . 2009-01-26 22:17 <DIR> d-------- c:\program files\Common Files\PC Tools
2009-01-26 22:10 . 2009-02-06 15:12 <DIR> d-------- c:\program files\Spyware Doctor
2009-01-26 22:10 . 2009-01-26 22:10 <DIR> d-------- c:\documents and settings\mike riendeau\Application Data\PC Tools
2009-01-26 22:10 . 2009-02-06 15:12 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-01-26 22:10 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2009-01-26 22:10 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2009-01-26 22:10 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2009-01-26 22:10 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2009-01-26 22:07 . 2003-07-10 10:09 26,493 -ra------ c:\windows\system32\drivers\ADM851x.SYS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-27 05:43 --------- d-----w c:\program files\microsoft frontpage
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-01 20:52 425,984 ----a-w c:\windows\system32\ATIDEMGX.dll
2008-12-01 20:51 318,464 ----a-w c:\windows\system32\ati2dvag.dll
2008-12-01 20:46 11,304,960 ----a-w c:\windows\system32\atioglxx.dll
2008-12-01 20:41 188,416 ----a-w c:\windows\system32\atipdlxx.dll
2008-12-01 20:40 43,520 ----a-w c:\windows\system32\ati2edxx.dll
2008-12-01 20:40 26,112 ----a-w c:\windows\system32\Ati2mdxx.exe
2008-12-01 20:40 147,456 ----a-w c:\windows\system32\Oemdspif.dll
2008-12-01 20:40 143,360 ----a-w c:\windows\system32\ati2evxx.dll
2008-12-01 20:38 598,016 ----a-w c:\windows\system32\ati2evxx.exe
2008-12-01 20:37 53,248 ----a-w c:\windows\system32\ATIDDC.DLL
2008-12-01 20:27 4,120,384 ----a-w c:\windows\system32\ati3duag.dll
2008-12-01 20:19 307,200 ----a-w c:\windows\system32\atiiiexx.dll
2008-12-01 20:11 2,495,360 ----a-w c:\windows\system32\ativvaxx.dll
2008-12-01 19:57 48,640 ----a-w c:\windows\system32\amdpcom32.dll
2008-12-01 19:53 45,056 ----a-w c:\windows\system32\amdcalrt.dll
2008-12-01 19:53 45,056 ----a-w c:\windows\system32\amdcalcl.dll
2008-12-01 19:53 401,408 ----a-w c:\windows\system32\atikvmag.dll
2008-12-01 19:52 86,016 ----a-w c:\windows\system32\atiadlxx.dll
2008-12-01 19:52 17,408 ----a-w c:\windows\system32\atitvo32.dll
2008-12-01 19:50 3,252,224 ----a-w c:\windows\system32\Amdcaldd.dll
2008-12-01 19:50 286,720 ----a-w c:\windows\system32\atiok3x2.dll
2008-12-01 19:45 577,536 ----a-w c:\windows\system32\ati2cqag.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 135168]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1474560]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-02 136600]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Spyware Doctor\\pctsTray.exe"=
"c:\\Program Files\\Analog Devices\\Core\\smax4pnp.exe"=
"c:\\Program Files\\ATI Technologies\\ATI.ACE\\Core-Static\\ccc.exe"=
"c:\\Program Files\\ATI Technologies\\ATI.ACE\\Core-Static\\CLIStart.exe"=
"c:\\WINDOWS\\system32\\wpabaln.exe"=
"c:\\Program Files\\Spyware Doctor\\pctsAuxs.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\UT2004Demo\\System\\UT2004.exe"=

R1 pctfw2;pctfw2;c:\windows\system32\drivers\pctfw2.sys [2009-01-26 160792]
R3 ADM851x;ADMtek ADM8513 USB To Fast Ethernet Adapter;c:\windows\system32\drivers\ADM851x.SYS [2009-01-26 26493]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-01-26 356920]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - HIDSERV
*Deregistered* - mchInjDrv

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{217a8abc-edb1-11dd-a8c5-0014bf5849cd}]
\Shell\aUtOpLay\comManD - E:\vtaitc.pif
\Shell\AutoRun\command - E:\vtaitc.pif
\Shell\eXploRe\COMmaND - E:\vtaitc.pif
\Shell\oPEn\commanD - E:\vtaitc.pif
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
LSP: c:\program files\Common Files\PC Tools\LSP\PCTLsp.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-06 15:16:40
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(664)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(720)
c:\program files\Common Files\PC Tools\LSP\PCTLsp.dll
.
Completion time: 2009-02-06 15:18:14
ComboFix-quarantined-files.txt 2009-02-06 23:18:12

Pre-Run: 72,060,690,432 bytes free
Post-Run: 72,151,425,024 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

206 --- E O F --- 2009-01-28 09:02:46

#10 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:01:01 PM

Posted 07 February 2009 - 06:19 AM

Hi again,


Kaspersky Online Scanner

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

  • Read the requirements and privacy statement then click on the Accept button.
  • The program will launch and start to download the latest definition files.
  • You will be prompted to install an application from Kaspersky. Click Run
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • Click on Save Report As....
  • Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Save this report to a convenient place.
  • Copy and paste that information & a fresh hjt log into your topic.
  • The scan will take a while so be patient and let it run. As it scans your machine very deeply it could take hours to complete, Kaspersky suggests running it during a time of low activity.
If you need a tutorial, see here

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#11 mriendeau

mriendeau
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:02:01 AM

Posted 07 February 2009 - 01:52 PM

should i disable My spyware coctor While performing this? Also, When I clik the link for kaspersky It says "cannot display the web page"

Edited by mriendeau, 07 February 2009 - 01:55 PM.


#12 mriendeau

mriendeau
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:02:01 AM

Posted 07 February 2009 - 02:01 PM

Hi Blade. I also tried to get there from google and It appears I cannot access kaspersky from anywhere.

#13 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:01:01 PM

Posted 08 February 2009 - 11:29 AM

Hi again,

Let's see if this works.

* Go here to run an online scanner from ESET.
  • Note: You will need to use Internet explorer for this scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is UNchecked and the option Scan unwanted applications is checkmarked.
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic, along with a new HijackThis log.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#14 mriendeau

mriendeau
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:02:01 AM

Posted 08 February 2009 - 11:32 AM

ok trying now

#15 mriendeau

mriendeau
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:02:01 AM

Posted 08 February 2009 - 11:36 AM

It says Windows has blocked this software because it can't verify the publisher. This happens after I allow it to install the activex software




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users