Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

browser is hijacked and probably other problems


  • This topic is locked This topic is locked
13 replies to this topic

#1 crumbum

crumbum

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:39 PM

Posted 10 July 2009 - 04:21 AM

i used windows defender and it found 8 problems altogether, fixed 4. the other 4 were related to these two things: virtool win32 delfinject.gen! and trojan win32 alureon.gen!J

here's my hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:09:36 AM, on 7/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
c:\program files\avira\antivir desktop\avcenter.exe
C:\Program Files\Avira\AntiVir Desktop\avscan.exe
C:\Documents and Settings\crumbum\Local Settings\Temporary Internet Files\Content.IE5\8BLZ26V1\HiJackThis[1].exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase1140.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.119,85.255.112.101
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.119,85.255.112.101
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 5483 bytes


i hope you can help. thanks

also before these problems came up i have had spybot search and destroy installed, and now i can't get it to come up and scan for me. the icon is still in the bottom right on the taskbar though. after the problems came up i installed malwarebytes' anti malware and it's not working at all either.

Edited by crumbum, 10 July 2009 - 04:25 AM.


BC AdBot (Login to Remove)

 


m

#2 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:08:39 AM

Posted 10 July 2009 - 06:41 AM

Hello, my name is fenzodahl512 and welcome to Bleeping Computer.. Please do the following....



Please download The Comedian.exe by Rorschach112 to your desktop
  • Please disable all of your antivirus/firewall before doing this step. Please visit HERE if you don't know how..
  • Double click the program to run it. It will only take around several minutes to run.
  • It will do a series of tasks and tell you when each one is finished.
  • You will be prompted to press any key after each step
  • When it is done it will close and exit itself automatically.
  • You can delete The_Comedian.exe once it is finished
STOP! if you can't complete this step.. Tell me more about it..




NEXT


Please download Malwarebytes' Anti-Malware from HERE or HERE

Note: If you already have Malwarebytes' Anti-Malware, just run and update it.. Then do a "Perform Full Scan"

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.




NEXT


Please download RSIT by random/random and save it to your Desktop.
  • Double click on RSIT.exe to run RSIT
  • Before you click "Continue", make sure you change the List files/folders created or modified in the last 3 months
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt and info.txt in your next reply.



NEXT


Please download GMER and unzip it to your Desktop. <<mirror>>
Please rename the random filename or GMER into GAMERS
  • Open the renamed program and click on the Rootkit tab.
  • Make sure all the boxes on the right of the screen are checked, EXCEPT for ‘Show All’.
  • Click on Scan.
  • When the scan has run click Copy and paste the results into a Notepad >> save it and attach in this thread.
IMPORTANT: Do NOT run any program while you are doing these scans as it may interfere with the output results



Post me these logs in your next reply.. Post each log in separate post..

1. Malwarebytes'
2. RSIT log.txt
3. RSIT info.txt
4. Attach GAMERS result..

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#3 crumbum

crumbum
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:39 PM

Posted 10 July 2009 - 05:17 PM

the comedian file worked fine

i can't get malwarebytes' to run at all, i click on the icon on the desktop and nothing happens. i had it installed already, tried to get it to run, and coudn't. i uninstalled it, reinstalled it from the link you gave me, and it still wouldn't run.

Edited by crumbum, 10 July 2009 - 05:31 PM.


#4 crumbum

crumbum
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:39 PM

Posted 10 July 2009 - 05:20 PM

Logfile of random's system information tool 1.06 (written by random/random)
Run by crumbum at 2009-07-10 18:27:25
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 105 GB (69%) free of 153 GB
Total RAM: 958 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:27:26 PM, on 7/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\crumbum\Desktop\RSIT.exe
C:\Program Files\trend micro\crumbum.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase1140.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.119,85.255.112.101
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.119,85.255.112.101
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 5146 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\User_Feed_Synchronization-{CE490FD1-AF1A-4E16-9016-9D6E704BE5A6}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-08 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2004-08-04 208952]
"PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-04 455168]
"PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-04 455168]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"ATICCC"=C:\Program Files\ATI Technologies\ATI.ACE\cli.exe [2005-08-14 57344]
"AlcxMonitor"=C:\WINDOWS\ALCXMNTR.EXE [2004-09-07 57344]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-07-08 148888]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2009-06-17 414992]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
ATI CATALYST System Tray.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe

C:\Documents and Settings\crumbum\Start Menu\Programs\Startup
ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-08-13 46080]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Documents and Settings\crumbum\Local Settings\Temp\IXP000.TMP\Sat.TV.For.PC.ED.2009.PF67.exe"="C:\Documents and Settings\crumbum\Local Settings\Temp\IXP000.TMP\Sat.TV.For.PC.ED.2009.PF67.exe:*:Enabled:C:\DOCUME~1\crumbum\LOCALS~1\Temp\IXP000.TMP\Sat.TV.For.PC.ED.2009.PF67.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 3 months======

2009-07-10 17:53:03 ----D---- C:\rsit
2009-07-10 17:53:03 ----D---- C:\Program Files\trend micro
2009-07-10 17:52:26 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-07-10 17:52:26 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-07-10 17:48:44 ----D---- C:\WINDOWS\ERDNT
2009-07-10 17:48:20 ----D---- C:\Program Files\ERUNT
2009-07-10 04:15:14 ----D---- C:\WINDOWS\LastGood
2009-07-10 04:15:14 ----D---- C:\Program Files\Windows Live Safety Center
2009-07-10 03:02:35 ----A---- C:\WINDOWS\ntbtlog.txt
2009-07-09 20:45:12 ----RSHD---- C:\RECYCLER
2009-07-09 20:25:30 ----A---- C:\WINDOWS\system32\wmpns.dll
2009-07-09 20:23:47 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$
2009-07-09 20:23:31 ----HDC---- C:\WINDOWS\$NtUninstallKB923689$
2009-07-09 01:26:19 ----D---- C:\WINDOWS\RegisteredPackages
2009-07-09 01:25:44 ----N---- C:\WINDOWS\system32\pxinsa64.exe
2009-07-09 01:25:44 ----N---- C:\WINDOWS\system32\pxhpinst.exe
2009-07-09 01:25:44 ----N---- C:\WINDOWS\system32\pxcpya64.exe
2009-07-09 01:25:44 ----N---- C:\WINDOWS\system32\pxafs.dll
2009-07-09 01:25:43 ----N---- C:\WINDOWS\system32\vxblock.dll
2009-07-09 01:25:43 ----N---- C:\WINDOWS\system32\pxwave.dll
2009-07-09 01:25:43 ----N---- C:\WINDOWS\system32\pxsfs.dll
2009-07-09 01:25:43 ----N---- C:\WINDOWS\system32\pxmas.dll
2009-07-09 01:25:43 ----N---- C:\WINDOWS\system32\pxdrv.dll
2009-07-09 01:25:43 ----N---- C:\WINDOWS\system32\px.dll
2009-07-09 01:25:38 ----D---- C:\Program Files\Winamp
2009-07-09 01:25:38 ----D---- C:\Documents and Settings\crumbum\Application Data\Winamp
2009-07-09 00:30:59 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2009-07-09 00:30:44 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2009-07-08 17:56:33 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2009-07-08 17:56:23 ----D---- C:\Program Files\Common Files\Adobe
2009-07-08 17:56:23 ----D---- C:\Program Files\Adobe
2009-07-08 11:21:24 ----D---- C:\Documents and Settings\crumbum\Application Data\vlc
2009-07-08 11:19:47 ----D---- C:\Program Files\VideoLAN
2009-07-08 11:13:21 ----D---- C:\Program Files\Combined Community Codec Pack
2009-07-08 06:52:24 ----D---- C:\WINDOWS\Sun
2009-07-08 06:51:51 ----A---- C:\WINDOWS\system32\javaws.exe
2009-07-08 06:51:51 ----A---- C:\WINDOWS\system32\javaw.exe
2009-07-08 06:51:51 ----A---- C:\WINDOWS\system32\java.exe
2009-07-08 06:51:51 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-07-08 06:51:41 ----D---- C:\Program Files\Java
2009-07-08 06:51:21 ----D---- C:\Documents and Settings\crumbum\Application Data\Sun
2009-07-08 06:49:01 ----D---- C:\Program Files\uTorrent
2009-07-08 06:48:40 ----D---- C:\Documents and Settings\crumbum\Application Data\uTorrent
2009-07-08 05:20:58 ----D---- C:\WINDOWS\Prefetch
2009-07-08 05:19:42 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-07-08 05:19:35 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2009-07-08 05:19:30 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-07-08 05:19:26 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-07-08 05:19:22 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
2009-07-08 05:19:18 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-07-08 05:19:14 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-07-08 05:19:11 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-07-08 05:19:07 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-07-08 05:19:03 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-07-08 05:18:59 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-07-08 05:18:56 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-07-08 05:18:52 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-07-08 05:18:45 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-07-08 05:18:39 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-07-08 05:18:35 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-07-08 05:18:31 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-07-08 05:18:27 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-07-08 05:18:23 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-07-08 05:18:18 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-07-08 05:18:14 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-07-08 05:18:11 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-07-08 05:18:07 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-07-08 05:18:03 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-07-08 05:17:58 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-07-08 05:17:55 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2009-07-08 05:17:50 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-07-08 05:15:42 ----D---- C:\WINDOWS\system32\scripting
2009-07-08 05:15:42 ----D---- C:\WINDOWS\l2schemas
2009-07-08 05:15:41 ----D---- C:\WINDOWS\system32\en
2009-07-08 05:15:41 ----D---- C:\WINDOWS\system32\bits
2009-07-08 05:14:23 ----D---- C:\WINDOWS\ServicePackFiles
2009-07-08 05:14:00 ----D---- C:\WINDOWS\SoftwareDistribution
2009-07-08 05:13:51 ----SD---- C:\WINDOWS\system32\Microsoft
2009-07-08 05:13:51 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-07-08 05:12:44 ----D---- C:\WINDOWS\network diagnostic
2009-07-08 05:11:32 ----D---- C:\WINDOWS\system32\xircom
2009-07-08 05:11:32 ----D---- C:\Program Files\xerox
2009-07-08 05:11:32 ----D---- C:\Program Files\microsoft frontpage
2009-07-08 05:11:25 ----A---- C:\WINDOWS\control.ini
2009-07-08 05:11:25 ----A---- C:\AUTOEXEC.BAT
2009-07-08 05:11:12 ----A---- C:\WINDOWS\OEWABLog.txt
2009-07-08 05:11:09 ----A---- C:\WINDOWS\system32\mapi32.dll
2009-07-08 05:10:18 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-07-08 05:10:18 ----RD---- C:\WINDOWS\Offline Web Pages
2009-07-08 05:10:18 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-07-08 05:10:13 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-07-08 05:10:10 ----HD---- C:\Program Files\WindowsUpdate
2009-07-08 05:09:59 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2009-07-08 05:09:59 ----D---- C:\WINDOWS\EHome
2009-07-08 05:09:53 ----D---- C:\WINDOWS\system32\DirectX
2009-07-08 05:09:34 ----A---- C:\WINDOWS\system32\atrace.dll
2009-07-08 05:09:31 ----A---- C:\WINDOWS\system32\desktop.ini
2009-07-08 05:09:31 ----A---- C:\WINDOWS\desktop.ini
2009-07-08 05:09:26 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2009-07-08 05:09:24 ----D---- C:\Program Files\Common Files\Services
2009-07-08 05:09:24 ----A---- C:\WINDOWS\system32\acctres.dll
2009-07-08 05:09:22 ----SD---- C:\WINDOWS\Tasks
2009-07-08 05:09:22 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2009-07-08 05:09:21 ----D---- C:\Program Files\Common Files\MSSoap
2009-07-08 05:09:17 ----D---- C:\WINDOWS\srchasst
2009-07-08 05:09:16 ----D---- C:\WINDOWS\system32\Macromed
2009-07-08 05:09:13 ----A---- C:\WINDOWS\system32\wuweb.dll
2009-07-08 05:09:13 ----A---- C:\WINDOWS\system32\wucltui.dll
2009-07-08 05:09:13 ----A---- C:\WINDOWS\system32\wuauserv.dll
2009-07-08 05:09:13 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2009-07-08 05:09:12 ----A---- C:\WINDOWS\system32\wups.dll
2009-07-08 05:09:12 ----A---- C:\WINDOWS\system32\wuaueng.dll
2009-07-08 05:09:12 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2009-07-08 05:09:12 ----A---- C:\WINDOWS\system32\wuauclt.exe
2009-07-08 05:09:12 ----A---- C:\WINDOWS\system32\wuapi.dll
2009-07-08 05:09:12 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2009-07-08 05:09:12 ----A---- C:\WINDOWS\system32\qmgr.dll
2009-07-08 05:09:12 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2009-07-08 05:09:12 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2009-07-08 05:09:07 ----D---- C:\Program Files\Movie Maker
2009-07-08 05:09:04 ----A---- C:\WINDOWS\system32\safrslv.dll
2009-07-08 05:09:04 ----A---- C:\WINDOWS\system32\safrdm.dll
2009-07-08 05:09:04 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2009-07-08 05:09:04 ----A---- C:\WINDOWS\system32\racpldlg.dll
2009-07-08 05:09:00 ----A---- C:\WINDOWS\system32\fltmc.exe
2009-07-08 05:09:00 ----A---- C:\WINDOWS\system32\fltlib.dll
2009-07-08 05:08:59 ----D---- C:\WINDOWS\system32\Restore
2009-07-08 05:08:59 ----A---- C:\WINDOWS\system32\srsvc.dll
2009-07-08 05:08:59 ----A---- C:\WINDOWS\system32\srrstr.dll
2009-07-08 05:08:59 ----A---- C:\WINDOWS\system32\srclient.dll
2009-07-08 05:08:58 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2009-07-08 05:08:58 ----A---- C:\WINDOWS\system32\msconf.dll
2009-07-08 05:08:58 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2009-07-08 05:08:58 ----A---- C:\WINDOWS\system32\mnmdd.dll
2009-07-08 05:08:58 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2009-07-08 05:08:58 ----A---- C:\WINDOWS\system32\ils.dll
2009-07-08 05:08:55 ----D---- C:\Program Files\NetMeeting
2009-07-08 05:08:55 ----A---- C:\WINDOWS\system32\msoert2.dll
2009-07-08 05:08:55 ----A---- C:\WINDOWS\system32\msoeacct.dll
2009-07-08 05:08:54 ----A---- C:\WINDOWS\system32\inetres.dll
2009-07-08 05:08:54 ----A---- C:\WINDOWS\system32\inetcomm.dll
2009-07-08 05:08:52 ----D---- C:\Program Files\Outlook Express
2009-07-08 05:08:51 ----A---- C:\WINDOWS\system32\schedsvc.dll
2009-07-08 05:08:51 ----A---- C:\WINDOWS\system32\mstinit.exe
2009-07-08 05:08:51 ----A---- C:\WINDOWS\system32\mstask.dll
2009-07-08 05:08:51 ----A---- C:\WINDOWS\system32\isign32.dll
2009-07-08 05:08:51 ----A---- C:\WINDOWS\system32\inetcfg.dll
2009-07-08 05:08:51 ----A---- C:\WINDOWS\system32\icwphbk.dll
2009-07-08 05:08:51 ----A---- C:\WINDOWS\system32\icwdial.dll
2009-07-08 05:08:49 ----D---- C:\Program Files\CONEXANT
2009-07-08 05:08:46 ----D---- C:\Program Files\Common Files\System
2009-07-08 05:08:45 ----D---- C:\Program Files\Internet Explorer
2009-07-08 05:08:35 ----D---- C:\Program Files\ComPlus Applications
2009-07-08 05:08:33 ----A---- C:\WINDOWS\vbaddin.ini
2009-07-08 05:08:33 ----A---- C:\WINDOWS\vb.ini
2009-07-08 05:08:30 ----D---- C:\WINDOWS\Registration
2009-07-08 05:08:09 ----D---- C:\Program Files\Windows Media Player
2009-07-08 05:08:09 ----D---- C:\Program Files\Online Services
2009-07-08 05:08:05 ----D---- C:\Program Files\Messenger
2009-07-08 05:08:02 ----D---- C:\Program Files\MSN Gaming Zone
2009-07-08 05:08:02 ----A---- C:\WINDOWS\system32\write.exe
2009-07-08 05:07:55 ----A---- C:\WINDOWS\system32\sndvol32.exe
2009-07-08 05:07:55 ----A---- C:\WINDOWS\system32\hticons.dll
2009-07-08 05:07:54 ----A---- C:\WINDOWS\system32\winchat.exe
2009-07-08 05:07:54 ----A---- C:\WINDOWS\system32\avwav.dll
2009-07-08 05:07:54 ----A---- C:\WINDOWS\system32\avtapi.dll
2009-07-08 05:07:54 ----A---- C:\WINDOWS\system32\avmeter.dll
2009-07-08 05:07:49 ----A---- C:\WINDOWS\system32\getuname.dll
2009-07-08 05:07:48 ----A---- C:\WINDOWS\system32\winmine.exe
2009-07-08 05:07:48 ----A---- C:\WINDOWS\system32\sol.exe
2009-07-08 05:07:48 ----A---- C:\WINDOWS\system32\mshearts.exe
2009-07-08 05:07:48 ----A---- C:\WINDOWS\system32\charmap.exe
2009-07-08 05:07:48 ----A---- C:\WINDOWS\system32\calc.exe
2009-07-08 05:07:47 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2009-07-08 05:07:47 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2009-07-08 05:07:47 ----A---- C:\WINDOWS\system32\tslabels.ini
2009-07-08 05:07:47 ----A---- C:\WINDOWS\system32\tskill.exe
2009-07-08 05:07:47 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2009-07-08 05:07:47 ----A---- C:\WINDOWS\system32\tscon.exe
2009-07-08 05:07:47 ----A---- C:\WINDOWS\system32\shadow.exe
2009-07-08 05:07:47 ----A---- C:\WINDOWS\system32\rwinsta.exe
2009-07-08 05:07:47 ----A---- C:\WINDOWS\system32\reset.exe
2009-07-08 05:07:47 ----A---- C:\WINDOWS\system32\regini.exe
2009-07-08 05:07:47 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2009-07-08 05:07:47 ----A---- C:\WINDOWS\system32\qwinsta.exe
2009-07-08 05:07:47 ----A---- C:\WINDOWS\system32\qappsrv.exe
2009-07-08 05:07:47 ----A---- C:\WINDOWS\system32\msg.exe
2009-07-08 05:07:47 ----A---- C:\WINDOWS\system32\logoff.exe
2009-07-08 05:07:47 ----A---- C:\WINDOWS\system32\freecell.exe
2009-07-08 05:07:46 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2009-07-08 05:07:46 ----A---- C:\WINDOWS\system32\mtxex.dll
2009-07-08 05:07:46 ----A---- C:\WINDOWS\system32\mtxdm.dll
2009-07-08 05:07:46 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2009-07-08 05:07:46 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2009-07-08 05:07:46 ----A---- C:\WINDOWS\system32\cdmodem.dll
2009-07-08 05:07:45 ----A---- C:\WINDOWS\system32\stclient.dll
2009-07-08 05:07:45 ----A---- C:\WINDOWS\system32\comsnap.dll
2009-07-08 05:07:45 ----A---- C:\WINDOWS\system32\comrepl.dll
2009-07-08 05:07:45 ----A---- C:\WINDOWS\system32\comaddin.dll
2009-07-08 05:07:42 ----D---- C:\WINDOWS\OPTIONS
2009-07-08 05:07:42 ----D---- C:\Program Files\Realtek
2009-07-08 05:07:42 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2009-07-08 05:07:23 ----D---- C:\Program Files\MSN
2009-07-08 05:07:22 ----A---- C:\WINDOWS\system32\sndrec32.exe
2009-07-08 05:07:22 ----A---- C:\WINDOWS\system32\mplay32.exe
2009-07-08 05:07:22 ----A---- C:\WINDOWS\system32\hypertrm.dll
2009-07-08 05:07:22 ----A---- C:\WINDOWS\system32\accwiz.exe
2009-07-08 05:07:21 ----D---- C:\Program Files\Windows NT
2009-07-08 05:07:21 ----A---- C:\WINDOWS\system32\spider.exe
2009-07-08 05:07:21 ----A---- C:\WINDOWS\system32\mspaint.exe
2009-07-08 05:07:21 ----A---- C:\WINDOWS\system32\clipbrd.exe
2009-07-08 05:07:20 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2009-07-08 05:07:20 ----A---- C:\WINDOWS\system32\sessmgr.exe
2009-07-08 05:07:20 ----A---- C:\WINDOWS\system32\remotepg.dll
2009-07-08 05:07:20 ----A---- C:\WINDOWS\system32\rdshost.exe
2009-07-08 05:07:20 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2009-07-08 05:07:20 ----A---- C:\WINDOWS\system32\mstscax.dll
2009-07-08 05:07:20 ----A---- C:\WINDOWS\system32\mstsc.exe
2009-07-08 05:07:19 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2009-07-08 05:07:19 ----A---- C:\WINDOWS\system32\termsrv.dll
2009-07-08 05:07:19 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2009-07-08 05:07:19 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2009-07-08 05:07:19 ----A---- C:\WINDOWS\system32\rdpclip.exe
2009-07-08 05:07:19 ----A---- C:\WINDOWS\system32\rdchost.dll
2009-07-08 05:07:19 ----A---- C:\WINDOWS\system32\qprocess.exe
2009-07-08 05:07:19 ----A---- C:\WINDOWS\system32\icaapi.dll
2009-07-08 05:07:19 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2009-07-08 05:07:18 ----D---- C:\WINDOWS\system32\MsDtc
2009-07-08 05:07:18 ----A---- C:\WINDOWS\system32\xolehlp.dll
2009-07-08 05:07:18 ----A---- C:\WINDOWS\system32\mtxoci.dll
2009-07-08 05:07:18 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2009-07-08 05:07:18 ----A---- C:\WINDOWS\system32\msdtctm.dll
2009-07-08 05:07:18 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2009-07-08 05:07:18 ----A---- C:\WINDOWS\system32\msdtclog.dll
2009-07-08 05:07:17 ----D---- C:\WINDOWS\system32\Com
2009-07-08 05:07:17 ----A---- C:\WINDOWS\system32\msdtc.exe
2009-07-08 05:07:17 ----A---- C:\WINDOWS\system32\colbact.dll
2009-07-08 05:07:17 ----A---- C:\WINDOWS\system32\clbcatex.dll
2009-07-08 05:07:17 ----A---- C:\WINDOWS\system32\catsrvps.dll
2009-07-08 05:07:16 ----A---- C:\WINDOWS\system32\comsvcs.dll
2009-07-08 05:07:16 ----A---- C:\WINDOWS\system32\catsrvut.dll
2009-07-08 05:07:16 ----A---- C:\WINDOWS\system32\catsrv.dll
2009-07-08 05:07:15 ----A---- C:\WINDOWS\system32\comuid.dll
2009-07-08 05:07:15 ----A---- C:\WINDOWS\system32\clbcatq.dll
2009-07-08 05:07:10 ----A---- C:\WINDOWS\system32\servdeps.dll
2009-07-08 05:07:10 ----A---- C:\WINDOWS\system32\mmfutil.dll
2009-07-08 05:07:10 ----A---- C:\WINDOWS\system32\licwmi.dll
2009-07-08 05:07:10 ----A---- C:\WINDOWS\system32\cmprops.dll
2009-07-08 05:03:22 ----D---- C:\Documents and Settings\crumbum\Application Data\WinBatch
2009-07-08 05:01:47 ----A---- C:\WINDOWS\system32\ksuser.dll
2009-07-08 05:01:43 ----D---- C:\Program Files\Realtek AC97
2009-07-08 05:01:41 ----A---- C:\WINDOWS\system32\RTLCPL.exe
2009-07-08 05:01:41 ----A---- C:\WINDOWS\system32\RtlCPAPI.dll
2009-07-08 05:01:41 ----A---- C:\WINDOWS\system32\ChCfg.exe
2009-07-08 05:01:41 ----A---- C:\WINDOWS\soundman.exe
2009-07-08 05:01:41 ----A---- C:\WINDOWS\ALCXMNTR.EXE
2009-07-08 05:01:40 ----A---- C:\WINDOWS\alcupd.exe
2009-07-08 05:01:40 ----A---- C:\WINDOWS\alcrmv.exe
2009-07-08 04:51:53 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-07-08 04:51:53 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-08 04:50:22 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2_0$
2009-07-08 04:50:17 ----HDC---- C:\WINDOWS\$NtUninstallKB952954_0$
2009-07-08 04:50:10 ----HDC---- C:\WINDOWS\$NtUninstallKB959426_0$
2009-07-08 04:49:55 ----HDC---- C:\WINDOWS\$NtUninstallKB946648_0$
2009-07-08 04:49:46 ----HDC---- C:\WINDOWS\$NtUninstallKB961373_0$
2009-07-08 04:49:41 ----N---- C:\WINDOWS\system32\ati2sgag.exe
2009-07-08 04:49:41 ----HDC---- C:\WINDOWS\$NtUninstallKB956803_0$
2009-07-08 04:49:34 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2009-07-08 04:49:26 ----D---- C:\Program Files\ATI Technologies
2009-07-08 04:49:25 ----HDC---- C:\WINDOWS\$NtUninstallKB950974_0$
2009-07-08 04:49:20 ----HDC---- C:\WINDOWS\$NtUninstallKB960225_0$
2009-07-08 04:48:50 ----HDC---- C:\WINDOWS\$NtUninstallKB956572_0$
2009-07-08 04:48:44 ----HDC---- C:\WINDOWS\$NtUninstallKB961501_0$
2009-07-08 04:48:36 ----HDC---- C:\WINDOWS\$NtUninstallKB969897$
2009-07-08 04:48:31 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2_0$
2009-07-08 04:48:26 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-07-08 04:48:21 ----HDC---- C:\WINDOWS\$NtUninstallKB952004_0$
2009-07-08 04:48:17 ----HDC---- C:\WINDOWS\$NtUninstallKB969898$
2009-07-08 04:48:13 ----HDC---- C:\WINDOWS\$NtUninstallKB950762_0$
2009-07-08 04:48:08 ----HDC---- C:\WINDOWS\$NtUninstallKB957097_0$
2009-07-08 04:48:04 ----HDC---- C:\WINDOWS\$NtUninstallKB958687_0$
2009-07-08 04:47:59 ----HDC---- C:\WINDOWS\$NtUninstallKB952287_0$
2009-07-08 04:47:51 ----HDC---- C:\WINDOWS\$NtUninstallKB967715_0$
2009-07-08 04:47:47 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$
2009-07-08 04:47:42 ----HDC---- C:\WINDOWS\$NtUninstallKB951066_0$
2009-07-08 04:47:24 ----D---- C:\WINDOWS\ie8updates
2009-07-08 04:47:02 ----D---- C:\WINDOWS\WBEM
2009-07-08 04:46:02 ----HDC---- C:\WINDOWS\ie8
2009-07-08 04:46:02 ----D---- C:\WINDOWS\system32\en-US
2009-07-08 04:45:45 ----D---- C:\Documents and Settings\crumbum\Application Data\Mozilla
2009-07-08 04:45:34 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-07-08 04:45:29 ----HD---- C:\Program Files\InstallShield Installation Information
2009-07-08 04:45:19 ----D---- C:\Program Files\Common Files\InstallShield
2009-07-08 04:44:36 ----D---- C:\Program Files\Mozilla Firefox
2009-07-08 04:44:33 ----HDC---- C:\WINDOWS\$NtUninstallKB951748_0$
2009-07-08 04:43:57 ----A---- C:\WINDOWS\system32\MRT.exe
2009-07-08 04:43:52 ----HDC---- C:\WINDOWS\$NtUninstallKB970238_0$
2009-07-08 04:43:47 ----HDC---- C:\WINDOWS\$NtUninstallKB901190$
2009-07-08 04:43:43 ----HDC---- C:\WINDOWS\$NtUninstallKB960803_0$
2009-07-08 04:43:39 ----HDC---- C:\WINDOWS\$NtUninstallKB968537_0$
2009-07-08 04:43:35 ----HDC---- C:\WINDOWS\$NtUninstallKB954600_0$
2009-07-08 04:43:31 ----HDC---- C:\WINDOWS\$NtUninstallKB958644_0$
2009-07-08 04:43:27 ----HDC---- C:\WINDOWS\$NtUninstallKB955069_0$
2009-07-08 04:43:20 ----HDC---- C:\WINDOWS\$NtUninstallKB956802_0$
2009-07-08 04:43:15 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$
2009-07-08 04:43:06 ----HDC---- C:\WINDOWS\$NtUninstallKB923561_0$
2009-07-08 04:28:41 ----N---- C:\WINDOWS\system32\xpsp4res.dll
2009-07-08 04:28:40 ----A---- C:\WINDOWS\system32\xpsp3res.dll
2009-07-08 04:27:01 ----D---- C:\Documents and Settings\crumbum\Application Data\Macromedia
2009-07-08 04:26:49 ----D---- C:\Documents and Settings\crumbum\Application Data\Adobe
2009-07-08 04:21:24 ----D---- C:\Program Files\Avira
2009-07-08 04:21:24 ----D---- C:\Documents and Settings\All Users\Application Data\Avira
2009-07-08 04:17:27 ----D---- C:\WINDOWS\system32\PreInstall
2009-07-08 04:17:26 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2009-07-08 04:17:25 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2009-07-08 04:17:25 ----HD---- C:\WINDOWS\$hf_mig$
2009-07-08 04:17:15 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-07-08 04:17:08 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2009-07-08 04:15:39 ----D---- C:\Documents and Settings\crumbum\Application Data\Identities
2009-07-08 04:15:38 ----HD---- C:\Program Files\Uninstall Information
2009-07-08 04:15:35 ----ASH---- C:\Documents and Settings\crumbum\Application Data\desktop.ini
2009-07-08 04:15:34 ----SD---- C:\Documents and Settings\crumbum\Application Data\Microsoft
2009-07-08 04:14:57 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2009-07-08 00:05:59 ----A---- C:\WINDOWS\system32\h323log.txt
2009-07-08 00:04:31 ----A---- C:\WINDOWS\system32\usbui.dll
2009-07-08 00:03:34 ----A---- C:\WINDOWS\imsins.BAK
2009-07-08 00:03:32 ----SHD---- C:\WINDOWS\Installer
2009-07-08 00:03:32 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-07-08 00:03:31 ----D---- C:\Program Files\Common Files\ODBC
2009-07-08 00:03:31 ----A---- C:\WINDOWS\ODBCINST.INI
2009-07-08 00:03:28 ----D---- C:\Program Files\Common Files\SpeechEngines
2009-07-08 00:03:27 ----RD---- C:\Program Files
2009-07-08 00:03:27 ----D---- C:\Program Files\Common Files\Microsoft Shared
2009-07-08 00:03:27 ----D---- C:\Program Files\Common Files
2009-07-08 00:03:25 ----A---- C:\WINDOWS\system32\uniime.dll
2009-07-08 00:03:14 ----A---- C:\WINDOWS\system32\imjp81k.dll
2009-07-08 00:03:12 ----A---- C:\WINDOWS\system32\Thawbrkr.dll
2009-07-08 00:03:11 ----RA---- C:\WINDOWS\system32\kbdvntc.dll
2009-07-08 00:03:11 ----RA---- C:\WINDOWS\system32\kbdintel.dll
2009-07-08 00:03:11 ----RA---- C:\WINDOWS\system32\kbdintam.dll
2009-07-08 00:03:11 ----RA---- C:\WINDOWS\system32\kbdinpun.dll
2009-07-08 00:03:11 ----RA---- C:\WINDOWS\system32\kbdinmar.dll
2009-07-08 00:03:11 ----RA---- C:\WINDOWS\system32\kbdinkan.dll
2009-07-08 00:03:11 ----RA---- C:\WINDOWS\system32\kbdinhin.dll
2009-07-08 00:03:11 ----RA---- C:\WINDOWS\system32\kbdinguj.dll
2009-07-08 00:03:11 ----RA---- C:\WINDOWS\system32\kbdindev.dll
2009-07-08 00:03:11 ----RA---- C:\WINDOWS\system32\kbdgeo.dll
2009-07-08 00:03:11 ----RA---- C:\WINDOWS\system32\kbdarmw.dll
2009-07-08 00:03:11 ----RA---- C:\WINDOWS\system32\kbdarme.dll
2009-07-08 00:03:11 ----A---- C:\WINDOWS\system32\c_iscii.dll
2009-07-08 00:03:09 ----RA---- C:\WINDOWS\system32\kbdurdu.dll
2009-07-08 00:03:09 ----RA---- C:\WINDOWS\system32\kbdsyr2.dll
2009-07-08 00:03:09 ----RA---- C:\WINDOWS\system32\kbdsyr1.dll
2009-07-08 00:03:09 ----RA---- C:\WINDOWS\system32\kbdfa.dll
2009-07-08 00:03:09 ----RA---- C:\WINDOWS\system32\kbddiv2.dll
2009-07-08 00:03:09 ----RA---- C:\WINDOWS\system32\kbddiv1.dll
2009-07-08 00:03:09 ----RA---- C:\WINDOWS\system32\kbda3.dll
2009-07-08 00:03:09 ----RA---- C:\WINDOWS\system32\kbda2.dll
2009-07-08 00:03:09 ----RA---- C:\WINDOWS\system32\kbda1.dll
2009-07-08 00:03:09 ----A---- C:\WINDOWS\system32\kbdusa.dll
2009-07-08 00:03:07 ----RA---- C:\WINDOWS\system32\kbdheb.dll
2009-07-08 00:03:04 ----RA---- C:\WINDOWS\system32\kbdth3.dll
2009-07-08 00:03:04 ----RA---- C:\WINDOWS\system32\kbdth2.dll
2009-07-08 00:03:04 ----RA---- C:\WINDOWS\system32\kbdth1.dll
2009-07-08 00:03:04 ----RA---- C:\WINDOWS\system32\kbdth0.dll
2009-07-08 00:03:03 ----A---- C:\WINDOWS\system32\ftlx041e.dll
2009-07-08 00:03:03 ----A---- C:\WINDOWS\system32\chsbrkr.dll
2009-07-08 00:03:02 ----A---- C:\WINDOWS\system32\chtbrkr.dll
2009-07-08 00:03:01 ----A---- C:\WINDOWS\system32\msir3jp.dll
2009-07-08 00:03:01 ----A---- C:\WINDOWS\system32\korwbrkr.dll
2009-07-08 00:02:33 ----A---- C:\WINDOWS\system32\kbd101a.dll
2009-07-08 00:02:33 ----A---- C:\WINDOWS\system32\c_g18030.dll
2009-07-08 00:02:16 ----A---- C:\WINDOWS\system32\kbdnecNT.dll
2009-07-08 00:02:16 ----A---- C:\WINDOWS\system32\kbdnecAT.dll
2009-07-08 00:02:16 ----A---- C:\WINDOWS\system32\kbdnec95.dll
2009-07-08 00:02:16 ----A---- C:\WINDOWS\system32\kbdlk41j.dll
2009-07-08 00:02:16 ----A---- C:\WINDOWS\system32\kbdlk41a.dll
2009-07-08 00:02:16 ----A---- C:\WINDOWS\system32\kbdibm02.dll
2009-07-08 00:02:16 ----A---- C:\WINDOWS\system32\kbdax2.dll
2009-07-08 00:02:16 ----A---- C:\WINDOWS\system32\kbd106n.dll
2009-07-08 00:02:16 ----A---- C:\WINDOWS\system32\kbd101.dll
2009-07-08 00:02:16 ----A---- C:\WINDOWS\system32\f3ahvoas.dll
2009-07-08 00:01:35 ----A---- C:\WINDOWS\system32\c_is2022.dll
2009-07-08 00:01:34 ----A---- C:\WINDOWS\system32\kbdkor.dll
2009-07-08 00:01:34 ----A---- C:\WINDOWS\system32\kbdjpn.dll
2009-07-08 00:01:34 ----A---- C:\WINDOWS\system32\kbd106.dll
2009-07-08 00:01:34 ----A---- C:\WINDOWS\system32\kbd103.dll
2009-07-08 00:01:34 ----A---- C:\WINDOWS\system32\kbd101c.dll
2009-07-08 00:01:32 ----A---- C:\WINDOWS\system32\kbd101b.dll
2009-07-08 00:01:30 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2009-07-08 00:01:30 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2009-07-08 00:01:30 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2009-07-08 00:01:29 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2009-07-08 00:01:29 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2009-07-08 00:01:29 ----RA---- C:\WINDOWS\system32\kbdur.dll
2009-07-08 00:01:29 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2009-07-08 00:01:29 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2009-07-08 00:01:29 ----RA---- C:\WINDOWS\system32\kbdru.dll
2009-07-08 00:01:29 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2009-07-08 00:01:29 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2009-07-08 00:01:29 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2009-07-08 00:01:29 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2009-07-08 00:01:29 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2009-07-08 00:01:29 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2009-07-08 00:01:27 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2009-07-08 00:01:27 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2009-07-08 00:01:27 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2009-07-08 00:01:27 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2009-07-08 00:01:27 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2009-07-08 00:01:27 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2009-07-08 00:01:27 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2009-07-08 00:01:26 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2009-07-08 00:01:26 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2009-07-08 00:01:26 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2009-07-08 00:01:26 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2009-07-08 00:01:26 ----RA---- C:\WINDOWS\system32\kbdest.dll
2009-07-08 00:01:25 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2009-07-08 00:01:25 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2009-07-08 00:01:25 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2009-07-08 00:01:25 ----RA---- C:\WINDOWS\system32\kbdro.dll
2009-07-08 00:01:25 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2009-07-08 00:01:25 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2009-07-08 00:01:25 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2009-07-08 00:01:25 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2009-07-08 00:01:25 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2009-07-08 00:01:25 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2009-07-08 00:01:25 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2009-07-08 00:01:25 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2009-07-08 00:01:25 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2009-07-08 00:01:23 ----A---- C:\WINDOWS\system32\spxcoins.dll
2009-07-08 00:01:23 ----A---- C:\WINDOWS\system32\irclass.dll
2009-07-08 00:01:23 ----A---- C:\WINDOWS\system32\dgsetup.dll
2009-07-08 00:01:23 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2009-07-08 00:01:22 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2009-07-08 00:01:21 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2009-07-08 00:01:21 ----A---- C:\WINDOWS\TASKMAN.EXE
2009-07-08 00:01:20 ----A---- C:\WINDOWS\system32\batt.dll
2009-07-08 00:01:20 ----A---- C:\WINDOWS\notepad.exe
2009-07-08 00:01:19 ----A---- C:\WINDOWS\system32\storprop.dll
2009-07-08 00:01:13 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2009-07-08 00:01:11 ----RA---- C:\WINDOWS\SET8.tmp
2009-07-08 00:01:08 ----RA---- C:\WINDOWS\SET4.tmp
2009-07-08 00:01:06 ----RA---- C:\WINDOWS\SET3.tmp
2009-07-08 00:01:01 ----D---- C:\WINDOWS\system32\CatRoot2
2009-07-08 00:01:01 ----D---- C:\WINDOWS\system32\CatRoot
2009-07-08 00:00:56 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-07-08 00:00:35 ----A---- C:\WINDOWS\setuplog.txt
2009-07-08 00:00:32 ----SHD---- C:\System Volume Information
2009-07-08 00:00:32 ----D---- C:\Documents and Settings
2009-07-07 23:59:43 ----SH---- C:\boot.ini
2009-07-07 23:53:07 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-07-07 23:53:07 ----RSD---- C:\WINDOWS\Fonts
2009-07-07 23:53:07 ----RD---- C:\WINDOWS\Web
2009-07-07 23:53:07 ----HD---- C:\WINDOWS\inf
2009-07-07 23:53:07 ----D---- C:\WINDOWS\WinSxS
2009-07-07 23:53:07 ----D---- C:\WINDOWS\twain_32
2009-07-07 23:53:07 ----D---- C:\WINDOWS\Temp
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\wins
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\wbem
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\usmt
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\spool
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\ShellExt
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\Setup
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\ras
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\oobe
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\npp
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\mui
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\inetsrv
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\IME
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\icsxml
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\ias
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\export
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\drivers
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\dhcp
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\config
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\3com_dmi
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\3076
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\2052
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\1054
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\1042
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\1041
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\1037
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\1033
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\1031
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\1028
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32\1025
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system32
2009-07-07 23:53:07 ----D---- C:\WINDOWS\system
2009-07-07 23:53:07 ----D---- C:\WINDOWS\security
2009-07-07 23:53:07 ----D---- C:\WINDOWS\Resources
2009-07-07 23:53:07 ----D---- C:\WINDOWS\repair
2009-07-07 23:53:07 ----D---- C:\WINDOWS\Provisioning
2009-07-07 23:53:07 ----D---- C:\WINDOWS\PeerNet
2009-07-07 23:53:07 ----D---- C:\WINDOWS\pchealth
2009-07-07 23:53:07 ----D---- C:\WINDOWS\mui
2009-07-07 23:53:07 ----D---- C:\WINDOWS\msapps
2009-07-07 23:53:07 ----D---- C:\WINDOWS\msagent
2009-07-07 23:53:07 ----D---- C:\WINDOWS\Media
2009-07-07 23:53:07 ----D---- C:\WINDOWS\java
2009-07-07 23:53:07 ----D---- C:\WINDOWS\ime
2009-07-07 23:53:07 ----D---- C:\WINDOWS\Help
2009-07-07 23:53:07 ----D---- C:\WINDOWS\Driver Cache
2009-07-07 23:53:07 ----D---- C:\WINDOWS\Debug
2009-07-07 23:53:07 ----D---- C:\WINDOWS\Cursors
2009-07-07 23:53:07 ----D---- C:\WINDOWS\Connection Wizard
2009-07-07 23:53:07 ----D---- C:\WINDOWS\Config
2009-07-07 23:53:07 ----D---- C:\WINDOWS\AppPatch
2009-07-07 23:53:07 ----D---- C:\WINDOWS\addins
2009-07-07 23:53:07 ----D---- C:\WINDOWS
2009-04-29 00:31:46 ----N---- C:\WINDOWS\system32\ieencode.dll

======List of files/folders modified in the last 3 months======

2009-07-08 05:11:25 ----A---- C:\WINDOWS\win.ini
2009-07-08 00:01:24 ----A---- C:\WINDOWS\system.ini
2009-05-13 01:15:55 ----A---- C:\WINDOWS\system32\wininet.dll
2009-05-13 01:15:55 ----A---- C:\WINDOWS\system32\mshtml.dll
2009-05-07 11:32:35 ----A---- C:\WINDOWS\system32\localspl.dll
2009-04-30 17:22:33 ----A---- C:\WINDOWS\system32\iertutil.dll
2009-04-30 17:22:32 ----N---- C:\WINDOWS\system32\jsproxy.dll
2009-04-30 17:22:32 ----A---- C:\WINDOWS\system32\urlmon.dll
2009-04-30 17:22:32 ----A---- C:\WINDOWS\system32\ieframe.dll
2009-04-30 17:22:31 ----N---- C:\WINDOWS\system32\iedkcs32.dll
2009-04-30 07:21:08 ----N---- C:\WINDOWS\system32\ie4uinit.exe
2009-04-15 10:51:25 ----A---- C:\WINDOWS\system32\rpcrt4.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-03-24 55640]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-08-03 11868]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-08-29 3644928]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-08-13 1313792]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2007-04-26 988032]
R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys [2007-04-26 267520]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2006-01-18 80512]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2007-04-26 731136]
S3 aujasnkj;aujasnkj; \??\C:\DOCUME~1\crumbum\LOCALS~1\Temp\aujasnkj.sys []
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-05-11 185089]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-08-13 376832]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-07-08 152984]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2005-08-13 516096]

-----------------EOF-----------------

Attached Files


Edited by crumbum, 10 July 2009 - 05:28 PM.


#5 crumbum

crumbum
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:39 PM

Posted 10 July 2009 - 05:22 PM

info.txt logfile of random's system information tool 1.06 2009-07-10 18:27:27

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A91000000001}
ATI - Software Uninstall Utility-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center-->MsiExec.exe /I{82C96A65-AF5E-438B-900F-259869219BA0}
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
Combined Community Codec Pack 2008-09-21 16:18-->"C:\Program Files\Combined Community Codec Pack\unins000.exe"
ERUNT 1.1j-->"C:\Program Files\ERUNT\unins000.exe"
HijackThis 2.0.2-->"C:\Documents and Settings\crumbum\Local Settings\Temporary Internet Files\Content.IE5\8BLZ26V1\HijackThis.exe" /uninstall
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Java™ 6 Update 14-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216014FF}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mozilla Firefox (3.5)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
PCI SoftV92 Modem-->C:\Program Files\CONEXANT\CNXT_MODEM_PCI_HSF\UIU32m.exe -U -IPSCRCSR5K.inf
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x9 -removeonly
REALTEK GbE & FE Ethernet PCI NIC Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}\setup.exe" -l0x9 -removeonly
Security Update for Windows Internet Explorer 8 (KB969897)-->"C:\WINDOWS\ie8updates\KB969897-IE8\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Security Update for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Security Update for Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Security Update for Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Security Update for Windows XP (KB969897)-->"C:\WINDOWS\$NtUninstallKB969897$\spuninst\spuninst.exe"
Security Update for Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"
Security Update for Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Update for Windows Internet Explorer 8 (KB971930)-->"C:\WINDOWS\ie8updates\KB971930-IE8\spuninst\spuninst.exe"
Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Update for Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
VLC media player 1.0.0-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Live OneCare safety scanner-->RunDll32.exe "C:\Program Files\Windows Live Safety Center\wlscCore.dll",UninstallFunction WLSC_SCANNER_PRODUCT
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"

======Security center information======

AV: AntiVir Desktop (disabled)

======System event log======

Computer Name: CRUMBUM-EA70403
Event Code: 1002
Message: The IP address lease 98.228.109.194 for the Network Card with network address 0016173E6A01 has been
denied by the DHCP server 192.168.100.1 (The DHCP Server sent a DHCPNACK message).

Record Number: 304
Source Name: Dhcp
Time Written: 20090708095449.000000-240
Event Type: error
User:

Computer Name: CRUMBUM-EA70403
Event Code: 1000
Message: Your computer has lost the lease to its IP address 192.168.100.2 on the
Network Card with network address 0016173E6A01.

Record Number: 301
Source Name: Dhcp
Time Written: 20090708071937.000000-240
Event Type: error
User:

Computer Name: CRUMBUM-EA70403
Event Code: 1003
Message: Your computer was not able to renew its address from the network (from the
DHCP Server) for the Network Card with network address 0016173E6A01. The following
error occurred:
The semaphore timeout period has expired.
.
Your computer will continue to try and obtain an address on its own from
the network address (DHCP) server.

Record Number: 300
Source Name: Dhcp
Time Written: 20090708071937.000000-240
Event Type: warning
User:

Computer Name: CRUMBUM-EA70403
Event Code: 1002
Message: The IP address lease 98.228.109.194 for the Network Card with network address 0016173E6A01 has been
denied by the DHCP server 192.168.100.1 (The DHCP Server sent a DHCPNACK message).

Record Number: 299
Source Name: Dhcp
Time Written: 20090708071906.000000-240
Event Type: error
User:

Computer Name: CRUMBUM-EA70403
Event Code: 4226
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Record Number: 291
Source Name: Tcpip
Time Written: 20090708061121.000000-240
Event Type: warning
User:

=====Application event log=====

Computer Name: CRUMBUM-EA70403
Event Code: 1000
Message: Faulting application wlscuploader.exe, version 1.11.1140.1, faulting module wlscuploader.exe, version 1.11.1140.1, fault address 0x0000c3b5.

Record Number: 75
Source Name: Application Error
Time Written: 20090710045413.000000-240
Event Type: error
User:

Computer Name: CRUMBUM-EA70403
Event Code: 4113
Message: AntiVir has detected 'TR/Patched.GE'
in the file
C:\Documents and Settings\crumbum\Local Settings\Temp\tmpE0.tmp

Record Number: 71
Source Name: Avira AntiVir
Time Written: 20090710024624.000000-240
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: CRUMBUM-EA70403
Event Code: 1000
Message: Faulting application winamp.exe, version 5.5.6.2512, faulting module mshtml.dll, version 8.0.6001.18783, fault address 0x000f6aa4.

Record Number: 64
Source Name: Application Error
Time Written: 20090709065315.000000-240
Event Type: error
User:

Computer Name: CRUMBUM-EA70403
Event Code: 63
Message: A provider, HiPerfCooker_v1, has been registered in the WMI namespace, Root\WMI, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Record Number: 47
Source Name: WinMgmt
Time Written: 20090708051613.000000-240
Event Type: warning
User: CRUMBUM-EA70403\crumbum

Computer Name: CRUMBUM-EA70403
Event Code: 63
Message: A provider, HiPerfCooker_v1, has been registered in the WMI namespace, Root\WMI, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Record Number: 11
Source Name: WinMgmt
Time Written: 20090708050819.000000-240
Event Type: warning
User: NT AUTHORITY\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 55 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=3702
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

Edited by crumbum, 10 July 2009 - 05:29 PM.


#6 crumbum

crumbum
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:39 PM

Posted 10 July 2009 - 05:26 PM

here's the gamers log

Attached Files


Edited by crumbum, 10 July 2009 - 05:30 PM.


#7 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:08:39 AM

Posted 10 July 2009 - 11:55 PM

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix.. Please visit HERE if you don't know how.. Please re-enable them back after performing all steps given..

Please download ComboFix by sUBs from HERE or HERE or HERE and save it to your Desktop.

During the download, rename Combofix to Combo-Fix as follows:

Posted Image

Posted Image


It is important you rename Combofix during the download, but not after.

**NOTE: If you are using Firefox, make sure that your download settings are as follows:
  • Tools->Options->Main tab
  • Set to "Always ask me where to Save the files".

After that, double-click and run Combo-Fix. Let it finish its job and post the log here

If ComboFix asked you to install Recovery Console, please do so.. It will be your best interest..

Note: DON'T do anything with your computer while ComboFix is running.. Let ComboFix finishes its job..

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#8 crumbum

crumbum
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:39 PM

Posted 11 July 2009 - 01:50 AM

ComboFix 09-07-09.08 - crumbum 07/11/2009 2:39.1.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.958.681 [GMT -4:00]
Running from: c:\documents and settings\crumbum\Desktop\Combo-Fix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrator\Application Data\bcrypt.html
c:\documents and settings\crumbum\Application Data\bcrypt.html
c:\recycler\S-1-5-21-6075672805-1160678089-556862082-1518
c:\recycler\S-1-5-21-6075672805-1160678089-556862082-1518\rundll32.exe
c:\windows\system32\drivers\MSIVXmcodjbiqqhklvmkmrhorrmtjsveatvak.sys
c:\windows\system32\MSIVXcount
c:\windows\system32\MSIVXsupppnwmdtodyyhdvosexdlpltiyymtt.dll
c:\windows\system32\MSIVXyxagplonakrocdcvcdhbiyvfyxiunurm.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_MSIVXserv.sys


((((((((((((((((((((((((( Files Created from 2009-06-11 to 2009-07-11 )))))))))))))))))))))))))))))))
.

2009-07-10 21:48 . 2009-07-10 21:48 -------- d-----w- c:\program files\ERUNT
2009-07-10 08:15 . 2009-07-10 08:16 -------- d-----w- c:\program files\Windows Live Safety Center
2009-07-10 07:07 . 2009-07-10 07:07 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-07-10 00:25 . 2008-04-14 00:12 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-07-09 07:21 . 2009-07-09 07:21 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-07-08 21:57 . 2009-07-08 21:57 -------- d-----w- c:\documents and settings\crumbum\Local Settings\Application Data\Adobe
2009-07-08 21:56 . 2009-07-08 21:56 -------- d-----w- c:\program files\Common Files\Adobe
2009-07-08 15:21 . 2009-07-11 00:27 -------- d-----w- c:\documents and settings\crumbum\Application Data\vlc
2009-07-08 15:19 . 2009-07-08 15:19 -------- d-----w- c:\program files\VideoLAN
2009-07-08 15:13 . 2009-07-08 15:13 -------- d-----w- c:\program files\Combined Community Codec Pack
2009-07-08 10:52 . 2009-07-08 10:52 -------- d-----w- c:\windows\Sun
2009-07-08 10:51 . 2009-07-08 10:51 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-07-08 10:51 . 2009-07-08 10:51 -------- d-----w- c:\program files\Java
2009-07-08 10:51 . 2009-07-08 10:51 152576 ----a-w- c:\documents and settings\crumbum\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-07-08 10:49 . 2009-07-08 10:49 -------- d-----w- c:\program files\uTorrent
2009-07-08 10:48 . 2009-07-11 06:20 -------- d-----w- c:\documents and settings\crumbum\Application Data\uTorrent

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-11 06:22 . 2009-07-11 06:22 -------- d-----w- c:\program files\Elaborate Bytes
2009-07-10 23:29 . 2009-07-09 05:25 -------- d-----w- c:\documents and settings\crumbum\Application Data\Winamp
2009-07-10 22:27 . 2009-07-10 21:53 -------- d-----w- c:\program files\trend micro
2009-07-10 21:52 . 2009-07-10 21:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-10 21:52 . 2009-07-10 21:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-09 05:26 . 2009-07-09 05:25 -------- d-----w- c:\program files\Winamp
2009-07-08 09:17 . 2009-07-08 09:10 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-07-08 09:11 . 2009-07-08 09:11 -------- d-----w- c:\program files\microsoft frontpage
2009-07-08 09:08 . 2009-07-08 09:08 -------- d-----w- c:\program files\CONEXANT
2009-07-08 09:08 . 2009-07-08 09:08 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-07-08 09:07 . 2009-07-08 09:07 -------- d-----w- c:\program files\Realtek
2009-07-08 09:07 . 2009-07-08 08:45 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-08 09:03 . 2009-07-08 09:03 -------- d-----w- c:\documents and settings\crumbum\Application Data\WinBatch
2009-07-08 09:01 . 2009-07-08 09:01 -------- d-----w- c:\program files\Realtek AC97
2009-07-08 09:01 . 2009-07-08 08:45 -------- d-----w- c:\program files\Common Files\InstallShield
2009-07-08 08:53 . 2009-07-08 08:51 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-08 08:53 . 2009-07-08 08:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-08 08:50 . 2009-07-08 08:49 -------- d-----w- c:\program files\ATI Technologies
2009-07-08 08:45 . 2009-07-08 08:45 0 ----a-w- c:\windows\nsreg.dat
2009-07-08 08:21 . 2009-07-08 08:21 -------- d-----w- c:\program files\Avira
2009-07-08 08:21 . 2009-07-08 08:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-07-08 08:15 . 2009-07-08 08:15 34232 ----a-w- c:\documents and settings\crumbum\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-17 15:27 . 2009-07-10 21:52 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-17 15:27 . 2009-07-10 21:52 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-25 12:16 . 2009-05-25 12:16 134312 ----a-w- c:\windows\system32\ElbyVCD.dll
2009-05-25 12:01 . 2009-05-25 12:01 89256 ----a-w- c:\windows\system32\ElbyCDIO.dll
2009-05-22 23:08 . 2009-05-22 23:08 29696 ----a-w- c:\windows\system32\drivers\VClone.sys
2009-05-13 05:15 . 2004-08-04 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:32 . 2004-08-04 12:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-28 20:20 . 2009-07-09 05:25 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys
2009-04-28 20:20 . 2009-07-09 05:25 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys
2009-04-28 20:20 . 2009-07-09 05:25 44944 ------w- c:\windows\system32\drivers\PxHelp20.sys
2009-04-28 20:20 . 2009-07-09 05:25 129520 ------w- c:\windows\system32\pxafs.dll
2009-04-17 12:26 . 2004-08-04 12:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-04 12:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-14 57344]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-08 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-05-26 85160]
"AlcxMonitor"="ALCXMNTR.EXE" - c:\windows\ALCXMNTR.EXE [2004-09-07 57344]

c:\documents and settings\crumbum\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
ATI CATALYST System Tray.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2005-8-14 57344]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [7/8/2009 4:21 AM 108289]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-07-11 c:\windows\Tasks\User_Feed_Synchronization-{CE490FD1-AF1A-4E16-9016-9D6E704BE5A6}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://yahoo.com/
FF - ProfilePath - c:\documents and settings\crumbum\Application Data\Mozilla\Firefox\Profiles\1inljjjz.default\
FF - prefs.js: browser.startup.homepage - yahoo.com
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-11 02:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(588)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-07-11 2:45
ComboFix-quarantined-files.txt 2009-07-11 06:45

Pre-Run: 100,029,001,728 bytes free
Post-Run: 100,216,594,432 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

193 --- E O F --- 2009-07-10 00:23

#9 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:08:39 AM

Posted 11 July 2009 - 04:20 AM

Ok.. Now do a fullscan with Malwarebytes' and remove everything that it found.. Then post the log here :thumbup2:

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#10 crumbum

crumbum
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:39 PM

Posted 11 July 2009 - 09:05 AM

Malwarebytes' Anti-Malware 1.38
Database version: 2297
Windows 5.1.2600 Service Pack 3

7/11/2009 10:00:35 AM
mbam-log-2009-07-11 (10-00-35).txt

Scan type: Full Scan (C:\|D:\|E:\|)
Objects scanned: 121743
Time elapsed: 23 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#11 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:08:39 AM

Posted 11 July 2009 - 09:36 AM

Looks good.. How's the computer now? :thumbup2:

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#12 crumbum

crumbum
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:39 PM

Posted 11 July 2009 - 03:43 PM

it's just fine now. my browser doesn't seem to be hijacked anymore. i just can't understand why people want to try and mess up someone's computer. they must have a lot of time on their hands. thanks though. you sure know your stuff.

#13 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:08:39 AM

Posted 12 July 2009 - 02:08 AM

Looks good to me.. Lets do some cleanup...


Please download OTC by OldTimer and save it to Desktop.
  • Make sure you have internet connection..
  • Double-click OTC
  • Click the CleanUp! button.
  • Select Yes when the "Begin cleanup Process?" prompt appears.
  • If you are prompted to Reboot during the cleanup, select Yes


Please read these excellent articles write by my friends:
Preventing Malware and Safe Computing by Rorschach112
What makes your machine slow? by Artellos


Also, please read these excellent articles by miekiemoes :
Help! My computer is slow!
How to prevent Malware


Read these great info's about safe internet surfing..

http://www.pcpitstop.com/spycheck/safesurfing.asp
http://bluefive.pair.com/practice_safe_surfing.htm




Please reply to this thread once more and tell us about the computer behaviour before we can close this thread :thumbup2:



Have a safe and happy computing day!


Regards
fenzodahl512

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#14 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:08:39 AM

Posted 20 July 2009 - 04:12 AM

Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users