Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

WOW (World of Warcraft) Account was hacked. Possible keylogger or infection


  • This topic is locked This topic is locked
13 replies to this topic

#1 panaceasolace

panaceasolace

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:06 PM

Posted 12 July 2009 - 10:31 PM

I am not experiencing any performance problems, but my WOW account was hacked and as I have never given my account information to anyone, I am now paranoid of a keylogger or some other type of infection. Thank you for any help or advise you can give.


DDS (Ver_09-06-26.01) - NTFSx86
Run by Administrator at 20:20:35.44 on Sun 07/12/2009
Internet Explorer: 8.0.6001.18783
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3326.1950 [GMT -7:00]

SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: CA Anti-Spyware *enabled* (Updated) {6B98D35F-BB76-41C0-876B-A50645ED099A}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\AASP\1.00.33\aaCenter.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\PSIService.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\KeyScrambler\KeyScrambler.exe
C:\Program Files\CA\CA Internet Security Suite\casc.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Administrator\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://en.wikipedia.org/wiki/Main_Page
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: KeyScramblerBHO Class: {2b9f5787-88a5-4945-90e7-c4b18563bc5e} - c:\program files\keyscrambler\KeyScramblerIE.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
TB: {10134636-E7AF-4AC5-A1DC-C7C44BB97D81} - No File
uRun: [WMPNSCFG] "c:\program files\windows media player\WMPNSCFG.exe"
mRun: [Windows Defender] "%ProgramFiles%\Windows Defender\MSASCui.exe" -hide
mRun: [C6501Sound] "RunDll32" c6501.cpl,CMICtrlWnd
mRun: [NvCplDaemon] "RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup
mRun: [KeyScrambler] c:\program files\keyscrambler\keyscrambler.exe /a
mRun: [cctray] c:\program files\ca\ca internet security suite\casc.exe
mRun: [CAPPActiveProtection] "c:\program files\ca\ca internet security suite\ca anti-spyware\CAPPActiveProtection.exe"
mRun: [CaPPcl] c:\program files\ca\ca internet security suite\ca anti-spyware\CAAntiSpyware.exe /scan /startup
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - {B745F984-EF2E-40D6-A9AC-D8CED7230E61} - c:\program files\keyscrambler\KeyScramblerIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
Notify: PFW - UmxWnp.Dll

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-7-12 114768]
R1 KmxAgent;KmxAgent;c:\windows\system32\drivers\KmxAgent.sys [2009-1-9 72696]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-7-12 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-7-12 51792]
R2 ccSchedulerSVC;CA Common Scheduler Service;c:\program files\ca\ca internet security suite\ccschedulersvc.exe [2009-7-8 128240]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2009-7-2 1153368]
R2 UmxAgent;HIPS Event Manager;c:\program files\ca\sharedcomponents\hipsengine\UmxAgent.exe [2009-1-9 1153528]
R2 UmxCfg;HIPS Configuration Interpreter;c:\program files\ca\sharedcomponents\hipsengine\UmxCfg.exe [2009-1-9 797176]
R2 UmxPol;HIPS Policy Manager;c:\program files\ca\sharedcomponents\hipsengine\UmxPol.exe [2009-1-9 297464]
R3 c65013264;C-Media CM6501 Like Sound UDAX Interface;c:\windows\system32\drivers\c6501.sys [2008-9-12 1298944]
R3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [2009-7-4 114024]
R3 KmxCfg;KmxCfg;c:\windows\system32\drivers\KmxCfg.sys [2009-1-9 205304]
R3 PPCtlPriv;PPCtlPriv;c:\program files\ca\ca internet security suite\ca anti-spyware\PPCtlPriv.exe [2009-7-8 222448]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648]

=============== Created Last 30 ================

2009-07-12 18:53 51,792 a------- c:\windows\system32\drivers\aswMonFlt.sys
2009-07-12 18:48 <DIR> --d----- c:\program files\SpywareBlaster
2009-07-12 18:40 <DIR> --d----- c:\program files\Trend Micro
2009-07-12 18:33 <DIR> --d----- c:\program files\Secunia
2009-07-09 18:25 <DIR> --d----- c:\users\admini~1\appdata\roaming\Uniblue
2009-07-08 18:47 <DIR> --d----- c:\program files\Audible
2009-07-08 07:58 <DIR> --d----- c:\programdata\Logs
2009-07-08 07:58 <DIR> --d----- c:\progra~2\Logs
2009-07-08 07:56 250,544 a------- c:\windows\system32\KeyHelp.ocx
2009-07-08 07:56 <DIR> --d----- c:\program files\common files\Scanner
2009-07-08 07:56 111,856 a------- c:\windows\system32\wbem\canvprov.dll
2009-07-08 07:56 6,552 a------- c:\windows\system32\wbem\canvprov.mof
2009-07-08 07:56 <DIR> --d----- c:\program files\CA
2009-07-08 07:53 <DIR> --d----- c:\programdata\CA
2009-07-08 07:53 <DIR> --d----- c:\progra~2\CA
2009-07-05 00:24 0 a---h--- C:\ProgramData.LOG2
2009-07-05 00:24 0 a---h--- C:\ProgramData.LOG1
2009-07-04 20:24 <DIR> --d----- c:\program files\CCleaner
2009-07-04 20:09 114,024 a------- c:\windows\system32\drivers\keyscrambler.sys
2009-07-04 20:09 <DIR> --d----- c:\program files\KeyScrambler
2009-07-04 19:35 775,168 a------- c:\windows\is-IVD80.exe
2009-07-04 19:35 10,194 a------- c:\windows\is-IVD80.msg
2009-07-04 19:35 325 a------- c:\windows\is-IVD80.lst
2009-07-04 19:35 <DIR> --d----- c:\program files\MSSOAP
2009-07-04 19:35 <DIR> --d----- c:\program files\common files\MSSoap
2009-07-04 19:35 <DIR> --d----- c:\program files\Webroot
2009-07-04 19:33 164 a------- c:\windows\install.dat
2009-07-02 20:52 <DIR> --d----- c:\programdata\Spybot - Search & Destroy
2009-07-02 20:52 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-07-02 20:52 <DIR> --d----- c:\progra~2\Spybot - Search & Destroy
2009-06-17 05:20 12,648 a------- c:\windows\system32\drivers\psi_mf.sys

==================== Find3M ====================

2009-07-12 19:41 65,511 a------- c:\programdata\nvModes.dat
2009-07-12 19:41 65,511 a------- c:\progra~2\nvModes.dat
2009-07-08 07:58 143,360 a------- c:\windows\inf\infstrng.dat
2009-07-08 07:58 51,200 a------- c:\windows\inf\infpub.dat
2009-07-08 07:58 86,016 a------- c:\windows\inf\infstor.dat
2009-05-28 07:45 665,600 a------- c:\windows\inf\drvindex.dat
2009-05-08 22:50 915,456 a------- c:\windows\system32\wininet.dll
2009-05-08 22:34 71,680 a------- c:\windows\system32\iesetup.dll
2009-05-01 00:08 1,194,528 a------- c:\windows\system32\nvcplui.exe
2009-05-01 00:08 1,292,832 a------- c:\windows\system32\nvsvs.dll
2009-05-01 00:07 13,781,536 a------- c:\windows\system32\nvcpl.dll
2009-05-01 00:07 4,045,344 a------- c:\windows\system32\nvvitvs.dll
2009-05-01 00:07 4,020,768 a------- c:\windows\system32\nvdisps.dll
2009-05-01 00:07 3,516,960 a------- c:\windows\system32\nvgames.dll
2009-05-01 00:07 3,123,744 a------- c:\windows\system32\nvwss.dll
2009-05-01 00:07 1,288,736 a------- c:\windows\system32\nvmobls.dll
2009-05-01 00:07 768,544 a------- c:\windows\system32\nvsvc.dll
2009-05-01 00:07 211,488 a------- c:\windows\system32\nvvsvc.exe
2009-05-01 00:07 195,104 a------- c:\windows\system32\nvmccss.dll
2009-05-01 00:07 143,360 a------- c:\windows\system32\nvshext.dll
2009-05-01 00:07 92,704 a------- c:\windows\system32\nvmctray.dll
2009-04-30 22:02 10,366,976 a------- c:\windows\system32\nvoglv32.dll
2009-04-30 22:02 7,593,472 a------- c:\windows\system32\nvd3dum.dll
2009-04-30 22:02 3,128,320 a------- c:\windows\system32\nvwgf2um.dll
2009-04-30 22:02 1,704,960 a------- c:\windows\system32\nvcuda.dll
2009-04-30 22:02 1,314,816 a------- c:\windows\system32\nvcuvenc.dll
2009-04-30 22:02 983,552 a------- c:\windows\system32\nvapi.dll
2009-04-30 22:02 663,552 a------- c:\windows\system32\nvcuvid.dll
2009-04-30 22:02 457,248 a------- c:\windows\system32\nvudisp.exe
2009-04-30 22:02 143,360 a------- c:\windows\system32\nvcod146.dll
2009-04-30 22:02 143,360 a------- c:\windows\system32\nvcod.dll
2009-04-27 00:42 457,248 a------- c:\windows\system32\NVUNINST.EXE
2009-04-23 05:15 784,896 a------- c:\windows\system32\rpcrt4.dll
2009-04-23 05:14 623,616 a------- c:\windows\system32\localspl.dll
2009-04-21 04:39 2,034,688 a------- c:\windows\system32\win32k.sys
2008-09-17 00:42 1,386,064 a------- c:\programdata\pswi_preloaded.exe
2008-09-17 00:42 1,386,064 a------- c:\progra~2\pswi_preloaded.exe
2008-01-20 19:43 174 a--sh--- c:\program files\desktop.ini
2006-11-02 05:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 05:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 05:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 05:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 02:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 02:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 02:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 02:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat
2008-09-17 00:44 8 ---shr-- c:\windows\system32\6DD5F5351F.sys
2008-10-24 02:27 5,018 a--sh--- c:\windows\system32\KGyGaAvL.sys

============= FINISH: 20:21:19.76 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:09:06 PM

Posted 23 July 2009 - 10:53 AM

Hello panaceasolace and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#3 panaceasolace

panaceasolace
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:06 PM

Posted 25 July 2009 - 11:03 AM

I am not experiencing any performance issues but my WOW account was recently hacked. I have not found any viruses or trojans in scans but removed quite a few malware when I ran spybot. I would like to make sure that my pc is as secure as possible. At the time that my account was hacked I was running windows firewall and virus protection, I have installed several more security programs since then. Here are the results of my scan.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-06-26.01)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 9/12/2008 10:06:05 PM
System Uptime: 7/24/2009 11:50:35 PM (9 hours ago)

Motherboard: ASUSTeK Computer INC. | | M2N-SLI
Processor: AMD Phenom™ 9550 Quad-Core Processor | Socket AM2 | 2210/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 466 GiB total, 300.097 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable
J: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP396: 7/4/2009 9:34:10 PM - Scheduled Checkpoint
RP397: 7/5/2009 12:35:40 AM - Windows Update
RP398: 7/5/2009 11:17:16 PM - Scheduled Checkpoint
RP399: 7/6/2009 7:00:35 AM - Windows Update
RP400: 7/7/2009 - Scheduled Checkpoint
RP401: 7/8/2009 - Scheduled Checkpoint
RP403: 7/8/2009 7:47:50 AM - Avira AntiVir Personal - 7/8/2009 7:47
RP404: 7/8/2009 7:57:36 AM - Device Driver Package Install: CA Network Service
RP405: 7/9/2009 12:00:03 AM - Scheduled Checkpoint
RP406: 7/9/2009 7:00:52 AM - Windows Update
RP407: 7/9/2009 6:30:43 PM - Uniblue RegistryBooster 2009
RP408: 7/11/2009 12:00:06 AM - Scheduled Checkpoint
RP409: 7/11/2009 4:45:14 PM - Installed Fix Sound
RP410: 7/12/2009 9:41:59 PM - Scheduled Checkpoint
RP411: 7/13/2009 7:00:36 AM - Windows Update
RP412: 7/13/2009 8:18:08 PM - Scheduled Checkpoint
RP413: 7/15/2009 12:00:01 AM - Scheduled Checkpoint
RP414: 7/15/2009 8:27:54 PM - Windows Update
RP415: 7/15/2009 8:37:53 PM - Windows Update
RP416: 7/16/2009 7:00:48 AM - Windows Update
RP417: 7/17/2009 12:35:51 AM - Device Driver Package Install: COMODO Network Service
RP418: 7/17/2009 10:24:55 PM - Scheduled Checkpoint
RP419: 7/18/2009 10:25:58 PM - Scheduled Checkpoint
RP420: 7/19/2009 10:55:19 PM - Scheduled Checkpoint
RP421: 7/20/2009 7:00:42 AM - Windows Update
RP422: 7/21/2009 12:00:07 AM - Scheduled Checkpoint
RP423: 7/21/2009 6:16:31 AM - Installed Java™ 6 Update 14
RP424: 7/21/2009 6:49:16 AM - Installed AMD CPUInfo
RP425: 7/21/2009 6:56:00 AM - Device Driver Package Install: NVIDIA Display adapters
RP426: 7/21/2009 11:34:04 PM - Windows Update
RP427: 7/22/2009 8:50:42 PM - Windows Update
RP428: 7/23/2009 7:00:44 AM - Windows Update
RP429: 7/24/2009 9:27:25 AM - Scheduled Checkpoint
RP430: 7/25/2009 12:19:05 AM - Scheduled Checkpoint

==== Installed Programs ======================

2007 Microsoft Office system
AAC Decoder
Activation Assistant for the 2007 Microsoft Office suites
Adobe Flash Player 10 ActiveX
Adobe Reader 8.1.6
AMD CPUInfo
Apple Mobile Device Support
Apple Software Update
Audible Download Manager
AutoUpdate
avast! Antivirus
Bonjour
C-Media CM6501 Like Sound Driver
CA Anti-Spyware
CA Internet Security Suite
CA Pest Patrol Realtime Protection
CCleaner (remove only)
Choice Guard
Color Cop 5.4.3
COMODO Firewall Pro
Cool & Quiet
Corel Snapfire DVD Maker
Corel Snapfire Plus
Curse Client
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
Fraps (remove only)
H.264 Decoder
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
iPod for Windows 2006-06-28
iTunes
Java™ 6 Update 14
Junk Mail filter update
KeyScrambler
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB929729)
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Live Add-in 1.3
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Hybrid 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
MKV Splitter
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 and SOAP Toolkit 3.0
NVIDIA Drivers
NVIDIA Performance
NVIDIA PhysX
NVIDIA Stereoscopic 3D Driver
NVIDIA System Monitor
NVIDIA System Update
PC Probe II
QuickTime
Secunia PSI
Spybot - Search & Destroy
SpywareBlaster 4.2
System Requirements Lab
Tortun 0.8
Try Corel Snapfire muvee autoProducer add on
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
VC80CRTRedist - 8.0.50727.762
Ventrilo Client
Ventrilo Server
Warhammer Online - Age of Reckoning
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Live Writer
WinZip 12.1

==== Event Viewer Messages From Past Week ========

7/25/2009 7:57:13 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.15.101 for the Network Card with network address 001FC6BE684D has been denied by the DHCP server 192.168.15.1 (The DHCP Server sent a DHCPNACK message).
7/24/2009 11:23:30 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.15.100 for the Network Card with network address 001FC6BE684D has been denied by the DHCP server 192.168.15.1 (The DHCP Server sent a DHCPNACK message).
7/23/2009 6:16:03 AM, Error: Service Control Manager [7016] - The NVIDIA Display Driver Service service has reported an invalid current state 32.

==== End Of File ===========================

#4 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:04:06 PM

Posted 26 July 2009 - 09:24 AM

Hello panaceasolace :thumbup2: Welcome to the BC HijackThis Log and Analysis forum. I will be assisting you in cleaning up your system.


I ask that you refrain from running tools other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.



In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. By doing this and then choosing Immediate E-Mail notification and then clicking on Proceed you will be advised when we respond the your topic and facilitate the cleaning of your machine.

After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.





Please perform the following:



Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.



Download GMER Rootkit Scanner from here to your desktop.
  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO, then use the following settings for a more complete scan.


    Posted Image
    Click the image to enlarge it


  • In the right panel, you will see several boxes that have been checked. Uncheck the following ...
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries










When completed please post the log fromMBAM as well as the one from GMER.

Please do not post any logs as an attachment unless asked to do so.





Thanks,



thewall
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#5 panaceasolace

panaceasolace
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:06 PM

Posted 29 July 2009 - 10:20 PM

Thank you very much for your help. Here are the logs:

Malwarebytes' Anti-Malware 1.39
Database version: 2523
Windows 6.0.6002 Service Pack 2

7/28/2009 2:19:29 PM
mbam-log-2009-07-28 (14-19-29).txt

Scan type: Quick Scan
Objects scanned: 88965
Time elapsed: 4 minute(s), 2 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-07-29 20:18:48
Windows 6.0.6002 Service Pack 2


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwAdjustPrivilegesToken [0x8F450D50]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwAlpcConnectPort [0x8F451B38]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwAlpcCreatePort [0x8F45117C]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwConnectPort [0x8F450346]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwCreateFile [0x8F450964]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwCreatePort [0x8F4500A8]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwCreateSection [0x8F4507D6]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwCreateSymbolicLinkObject [0x8F450F36]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwCreateThread [0x8F44FC78]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwDuplicateObject [0x8F44FB2A]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwLoadDriver [0x8F4517D8]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwOpenFile [0x8F450B74]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwOpenProcess [0x8F44F84A]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwOpenSection [0x8F45067A]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwOpenThread [0x8F44F9D2]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwRequestWaitReplyPort [0x8F4501BE]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwSecureConnectPort [0x8F4515B6]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwSetSystemInformation [0x8F451978]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwShutdownSystem [0x8F450508]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwSystemDebugControl [0x8F45056E]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwTerminateProcess [0x8F44FF72]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwTerminateThread [0x8F44FE40]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwCreateThreadEx [0x8F451282]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Firewall Pro Sandbox Driver/COMODO) ZwCreateUserProcess [0x8F451D82]

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\tdx \Device\Tcp cmdhlp.sys (COMODO Firewall Pro Helper Driver/COMODO)
AttachedDevice \Driver\tdx \Device\Udp cmdhlp.sys (COMODO Firewall Pro Helper Driver/COMODO)
AttachedDevice \Driver\tdx \Device\RawIp cmdhlp.sys (COMODO Firewall Pro Helper Driver/COMODO)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install@LastSuccessTime 2009-07-23 03:51:22
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore@LastIndex 435

---- Files - GMER 1.0.15 ----

File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS16AEF.log 131072 bytes
File C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@www.sephora[3].txt 741 bytes

---- EOF - GMER 1.0.15 ----

#6 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:04:06 PM

Posted 30 July 2009 - 08:37 PM

I'm running a little behind so I'll be back just as quickly as possible. Might be tomorrow.
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#7 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:04:06 PM

Posted 31 July 2009 - 01:49 PM

I believe you are OK, but let's run RSIT since we are looking.
  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#8 panaceasolace

panaceasolace
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:06 PM

Posted 31 July 2009 - 09:29 PM

Here are the log results. Thanks again for your assistance.

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2009-07-31 19:22:44
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 297 GB (62%) free of 477 GB
Total RAM: 3326 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:23:04 PM, on 7/31/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\AASP\1.00.33\aaCenter.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\KeyScrambler\KeyScrambler.exe
C:\Program Files\CA\CA Internet Security Suite\casc.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\World of Warcraft\BackgroundDownloader.exe
C:\Program Files\Curse\CurseClient.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Users\Administrator\Desktop\RSIT.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.wikipedia.org/wiki/Main_Page
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: QFX Software KeyScrambler - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] "%ProgramFiles%\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [C6501Sound] "RunDll32" c6501.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [KeyScrambler] C:\Program Files\KeyScrambler\keyscrambler.exe /a
O4 - HKLM\..\Run: [cctray] C:\Program Files\CA\CA Internet Security Suite\casc.exe
O4 - HKLM\..\Run: [CAPPActiveProtection] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe"
O4 - HKLM\..\Run: [CaPPcl] C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe /scan /startup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
O9 - Extra 'Tools' menuitem: &KeyScrambler... - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CA Common Scheduler Service (ccSchedulerSVC) - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: Performance Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
O23 - Service: Update Center Service (UpdateCenterService) - NVIDIA - C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe

--
End of file - 7001 bytes

======Scheduled tasks folder======

C:\Windows\tasks\User_Feed_Synchronization-{34B7A635-B3A7-4924-9099-C774709CD75C}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2B9F5787-88A5-4945-90E7-C4B18563BC5E}]
KeyScramblerBHO Class - C:\Program Files\KeyScrambler\KeyScramblerIE.dll [2009-03-24 833776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-21 41368]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-20 1008184]
"C6501Sound"=RunDll32 c6501.cpl,CMICtrlWnd []
"KeyScrambler"=C:\Program Files\KeyScrambler\keyscrambler.exe [2009-03-24 510704]
"cctray"=C:\Program Files\CA\CA Internet Security Suite\casc.exe [2009-07-08 374000]
"CAPPActiveProtection"=C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe [2009-07-08 324848]
"CaPPcl"=C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe [2009-07-08 570608]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-02-05 81000]
"COMODO Firewall Pro"=C:\Program Files\COMODO\Firewall\cfp.exe [2009-07-17 1655552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"=" C:\Windows\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\PFW]
C:\Windows\system32\UmxWnp.Dll [2007-06-06 79368]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 3 months======

2009-07-31 19:22:44 ----D---- C:\rsit
2009-07-29 20:01:07 ----A---- C:\Windows\system32\mshtml.dll
2009-07-29 20:01:06 ----A---- C:\Windows\system32\ieframe.dll
2009-07-29 20:01:05 ----A---- C:\Windows\system32\wininet.dll
2009-07-29 20:01:05 ----A---- C:\Windows\system32\urlmon.dll
2009-07-29 20:01:05 ----A---- C:\Windows\system32\iertutil.dll
2009-07-29 20:01:04 ----A---- C:\Windows\system32\occache.dll
2009-07-29 20:01:04 ----A---- C:\Windows\system32\msfeedssync.exe
2009-07-29 20:01:04 ----A---- C:\Windows\system32\msfeedsbs.dll
2009-07-29 20:01:04 ----A---- C:\Windows\system32\msfeeds.dll
2009-07-29 20:01:04 ----A---- C:\Windows\system32\jsproxy.dll
2009-07-29 20:01:04 ----A---- C:\Windows\system32\ieUnatt.exe
2009-07-29 20:01:04 ----A---- C:\Windows\system32\ieui.dll
2009-07-29 20:01:04 ----A---- C:\Windows\system32\iesysprep.dll
2009-07-29 20:01:04 ----A---- C:\Windows\system32\iesetup.dll
2009-07-29 20:01:04 ----A---- C:\Windows\system32\iepeers.dll
2009-07-29 20:01:04 ----A---- C:\Windows\system32\iedkcs32.dll
2009-07-29 20:01:04 ----A---- C:\Windows\system32\ie4uinit.exe
2009-07-29 20:01:03 ----A---- C:\Windows\system32\iernonce.dll
2009-07-28 14:14:21 ----D---- C:\Users\Administrator\AppData\Roaming\Malwarebytes
2009-07-28 14:12:27 ----D---- C:\ProgramData\Malwarebytes
2009-07-28 14:12:03 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-07-21 06:55:08 ----A---- C:\Windows\system32\nvudisp.exe
2009-07-21 06:54:55 ----A---- C:\Windows\system32\nvwgf2um.dll
2009-07-21 06:54:55 ----A---- C:\Windows\system32\nvoglv32.dll
2009-07-21 06:54:53 ----A---- C:\Windows\system32\nvcuvid.dll
2009-07-21 06:54:53 ----A---- C:\Windows\system32\nvcuvenc.dll
2009-07-21 06:54:53 ----A---- C:\Windows\system32\nvcuda.dll
2009-07-21 06:54:53 ----A---- C:\Windows\system32\nvcod157.dll
2009-07-21 06:54:53 ----A---- C:\Windows\system32\nvcod.dll
2009-07-21 06:50:24 ----D---- C:\Program Files\AMD
2009-07-21 06:23:31 ----D---- C:\Windows\Sun
2009-07-21 06:20:16 ----A---- C:\Windows\system32\javaws.exe
2009-07-21 06:20:16 ----A---- C:\Windows\system32\javaw.exe
2009-07-21 06:20:16 ----A---- C:\Windows\system32\java.exe
2009-07-21 06:20:16 ----A---- C:\Windows\system32\deploytk.dll
2009-07-21 06:16:59 ----D---- C:\Program Files\Java
2009-07-17 00:34:52 ----D---- C:\Users\Administrator\AppData\Roaming\Comodo
2009-07-17 00:34:52 ----D---- C:\ProgramData\comodo
2009-07-17 00:34:52 ----A---- C:\Windows\system32\guard32.dll
2009-07-17 00:34:50 ----D---- C:\Program Files\COMODO
2009-07-15 20:32:00 ----D---- C:\Program Files\iTunes
2009-07-15 20:27:39 ----A---- C:\Windows\system32\t2embed.dll
2009-07-15 20:27:39 ----A---- C:\Windows\system32\fontsub.dll
2009-07-15 20:27:39 ----A---- C:\Windows\system32\atmfd.dll
2009-07-15 20:27:38 ----A---- C:\Windows\system32\lpk.dll
2009-07-15 20:27:38 ----A---- C:\Windows\system32\dciman32.dll
2009-07-14 13:29:28 ----A---- C:\Windows\system32\nvcplui.exe
2009-07-14 13:29:26 ----A---- C:\Windows\system32\nvsvs.dll
2009-07-14 13:29:12 ----A---- C:\Windows\system32\nvwss.dll
2009-07-14 13:29:10 ----A---- C:\Windows\system32\nvvitvs.dll
2009-07-14 13:29:10 ----A---- C:\Windows\system32\nvmobls.dll
2009-07-14 13:29:10 ----A---- C:\Windows\system32\nvmccss.dll
2009-07-14 13:29:08 ----A---- C:\Windows\system32\nvgames.dll
2009-07-14 13:29:06 ----A---- C:\Windows\system32\nvvsvc.exe
2009-07-14 13:29:06 ----A---- C:\Windows\system32\nvsvc.dll
2009-07-14 13:29:06 ----A---- C:\Windows\system32\nvmctray.dll
2009-07-14 13:29:06 ----A---- C:\Windows\system32\nvdisps.dll
2009-07-14 13:29:06 ----A---- C:\Windows\system32\nvcpl.dll
2009-07-12 18:53:04 ----A---- C:\Windows\system32\aswBoot.exe
2009-07-12 18:53:03 ----D---- C:\Program Files\Alwil Software
2009-07-12 18:48:32 ----D---- C:\Program Files\SpywareBlaster
2009-07-12 18:40:37 ----D---- C:\Program Files\Trend Micro
2009-07-12 18:33:14 ----D---- C:\Program Files\Secunia
2009-07-09 18:25:56 ----D---- C:\Users\Administrator\AppData\Roaming\Uniblue
2009-07-08 18:47:09 ----D---- C:\Program Files\Audible
2009-07-08 07:58:50 ----D---- C:\ProgramData\Logs
2009-07-08 07:57:17 ----HD---- C:\Config.msi
2009-07-08 07:56:36 ----D---- C:\Program Files\Common Files\Scanner
2009-07-08 07:56:34 ----A---- C:\caavsetupLog.txt
2009-07-08 07:56:27 ----D---- C:\Program Files\CA
2009-07-08 07:53:41 ----D---- C:\ProgramData\CA
2009-07-08 07:53:29 ----A---- C:\caisslog.txt
2009-07-04 20:24:08 ----D---- C:\Program Files\CCleaner
2009-07-04 20:09:15 ----D---- C:\Program Files\KeyScrambler
2009-07-04 19:35:52 ----A---- C:\Windows\is-IVD80.exe
2009-07-04 19:35:36 ----D---- C:\Program Files\MSSOAP
2009-07-04 19:35:36 ----D---- C:\Program Files\Common Files\MSSoap
2009-07-04 19:35:26 ----D---- C:\Program Files\Webroot
2009-07-02 20:52:28 ----D---- C:\ProgramData\Spybot - Search & Destroy
2009-07-02 20:52:28 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-06-10 06:46:45 ----A---- C:\Windows\system32\localspl.dll
2009-06-10 06:45:40 ----A---- C:\Windows\system32\rpcrt4.dll
2009-06-03 22:29:19 ----D---- C:\Users\Administrator\AppData\Roaming\Windows Live Writer
2009-06-03 21:54:30 ----D---- C:\Program Files\NVIDIA Corporation
2009-06-03 21:35:42 ----A---- C:\Windows\system32\XAudio2_4.dll
2009-06-03 21:35:42 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2009-06-03 21:35:42 ----A---- C:\Windows\system32\D3DX9_41.dll
2009-06-03 21:35:42 ----A---- C:\Windows\system32\d3dx10_41.dll
2009-06-03 21:35:42 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2009-06-03 21:35:41 ----A---- C:\Windows\system32\XAudio2_3.dll
2009-06-03 21:35:41 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2009-06-03 21:35:41 ----A---- C:\Windows\system32\xactengine3_4.dll
2009-06-03 21:35:41 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2009-06-03 21:35:41 ----A---- C:\Windows\system32\D3DX9_40.dll
2009-06-03 21:35:41 ----A---- C:\Windows\system32\d3dx10_40.dll
2009-06-03 21:35:41 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2009-06-03 21:35:40 ----A---- C:\Windows\system32\XAudio2_2.dll
2009-06-03 21:35:40 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2009-06-03 21:35:40 ----A---- C:\Windows\system32\xactengine3_3.dll
2009-06-03 21:35:40 ----A---- C:\Windows\system32\xactengine3_2.dll
2009-06-03 21:35:40 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2009-06-03 21:35:40 ----A---- C:\Windows\system32\d3dx10_39.dll
2009-06-03 21:35:40 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2009-06-03 21:35:39 ----A---- C:\Windows\system32\D3DX9_39.dll
2009-06-02 22:12:20 ----D---- C:\Program Files\QuickTime
2009-05-29 00:53:40 ----D---- C:\Program Files\Microsoft Office Outlook Connector
2009-05-29 00:52:59 ----D---- C:\Program Files\Microsoft
2009-05-29 00:52:42 ----D---- C:\Program Files\Windows Live SkyDrive
2009-05-29 00:47:21 ----D---- C:\Program Files\Common Files\Windows Live
2009-05-28 07:45:22 ----D---- C:\Windows\system32\eu-ES
2009-05-28 07:45:22 ----D---- C:\Windows\system32\ca-ES
2009-05-28 07:45:21 ----D---- C:\Windows\system32\vi-VN
2009-05-26 18:12:41 ----D---- C:\Windows\system32\EventProviders
2009-05-26 18:12:00 ----A---- C:\Windows\system32\NlsLexicons0007.dll
2009-05-26 18:11:57 ----A---- C:\Windows\system32\SLsvc.exe
2009-05-26 18:11:57 ----A---- C:\Windows\system32\SLCExt.dll
2009-05-26 18:11:56 ----A---- C:\Windows\system32\FunctionDiscoveryFolder.dll
2009-05-26 18:11:56 ----A---- C:\Windows\system32\DevicePairingWizard.exe
2009-05-26 18:11:55 ----A---- C:\Windows\system32\NlsLexicons0009.dll
2009-05-26 18:11:53 ----A---- C:\Windows\system32\mssrch.dll
2009-05-26 18:11:52 ----A---- C:\Windows\system32\tquery.dll
2009-05-26 18:11:51 ----A---- C:\Windows\system32\RMActivate_isv.exe
2009-05-26 18:11:51 ----A---- C:\Windows\system32\PresentationNative_v0300.dll
2009-05-26 18:11:51 ----A---- C:\Windows\system32\lsasrv.dll
2009-05-26 18:11:50 ----A---- C:\Windows\system32\scavenge.dll
2009-05-26 18:11:50 ----A---- C:\Windows\system32\RMActivate.exe
2009-05-26 18:11:50 ----A---- C:\Windows\system32\msi.dll
2009-05-26 18:11:49 ----A---- C:\Windows\system32\WscEapPr.dll
2009-05-26 18:11:49 ----A---- C:\Windows\system32\wcnwiz2.dll
2009-05-26 18:11:49 ----A---- C:\Windows\system32\sysmain.dll
2009-05-26 18:11:49 ----A---- C:\Windows\system32\secproc_isv.dll
2009-05-26 18:11:49 ----A---- C:\Windows\system32\imapi2fs.dll
2009-05-26 18:11:48 ----A---- C:\Windows\system32\mf.dll
2009-05-26 18:11:48 ----A---- C:\Windows\system32\icardagt.exe
2009-05-26 18:11:47 ----A---- C:\Windows\system32\EhStorShell.dll
2009-05-26 18:11:47 ----A---- C:\Windows\system32\AuxiliaryDisplayCpl.dll
2009-05-26 18:11:46 ----A---- C:\Windows\system32\spwizui.dll
2009-05-26 18:11:46 ----A---- C:\Windows\system32\spreview.exe
2009-05-26 18:11:46 ----A---- C:\Windows\system32\spinstall.exe
2009-05-26 18:11:46 ----A---- C:\Windows\system32\drmv2clt.dll
2009-05-26 18:11:45 ----A---- C:\Windows\system32\shell32.dll
2009-05-26 18:11:45 ----A---- C:\Windows\system32\secproc.dll
2009-05-26 18:11:45 ----A---- C:\Windows\system32\SearchIndexer.exe
2009-05-26 18:11:45 ----A---- C:\Windows\system32\p2psvc.dll
2009-05-26 18:11:45 ----A---- C:\Windows\system32\mcupdate_GenuineIntel.dll
2009-05-26 18:11:44 ----A---- C:\Windows\system32\mssvp.dll
2009-05-26 18:11:44 ----A---- C:\Windows\system32\mssphtb.dll
2009-05-26 18:11:44 ----A---- C:\Windows\system32\mssph.dll
2009-05-26 18:11:44 ----A---- C:\Windows\system32\MSMPEG2VDEC.DLL
2009-05-26 18:11:44 ----A---- C:\Windows\system32\mscoree.dll
2009-05-26 18:11:44 ----A---- C:\Windows\system32\imapi2.dll
2009-05-26 18:11:43 ----A---- C:\Windows\system32\sdohlp.dll
2009-05-26 18:11:43 ----A---- C:\Windows\system32\ntkrnlpa.exe
2009-05-26 18:11:43 ----A---- C:\Windows\system32\esent.dll
2009-05-26 18:11:42 ----A---- C:\Windows\system32\sperror.dll
2009-05-26 18:11:42 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2009-05-26 18:11:42 ----A---- C:\Windows\system32\korwbrkr.dll
2009-05-26 18:11:42 ----A---- C:\Windows\system32\IMJP10K.DLL
2009-05-26 18:11:42 ----A---- C:\Windows\system32\DevicePairing.dll
2009-05-26 18:11:41 ----A---- C:\Windows\system32\wmp.dll
2009-05-26 18:11:41 ----A---- C:\Windows\system32\wevtsvc.dll
2009-05-26 18:11:41 ----A---- C:\Windows\system32\SLC.dll
2009-05-26 18:11:41 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2009-05-26 18:11:41 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2009-05-26 18:11:41 ----A---- C:\Windows\system32\msshsq.dll
2009-05-26 18:11:41 ----A---- C:\Windows\system32\IasMigReader.exe
2009-05-26 18:11:40 ----A---- C:\Windows\system32\WMVCORE.DLL
2009-05-26 18:11:40 ----A---- C:\Windows\system32\ntoskrnl.exe
2009-05-26 18:11:40 ----A---- C:\Windows\system32\msjet40.dll
2009-05-26 18:11:40 ----A---- C:\Windows\system32\MPSSVC.dll
2009-05-26 18:11:39 ----A---- C:\Windows\system32\Query.dll
2009-05-26 18:11:39 ----A---- C:\Windows\system32\qmgr.dll
2009-05-26 18:11:39 ----A---- C:\Windows\system32\msxml6.dll
2009-05-26 18:11:38 ----A---- C:\Windows\system32\srchadmin.dll
2009-05-26 18:11:38 ----A---- C:\Windows\system32\P2PGraph.dll
2009-05-26 18:11:38 ----A---- C:\Windows\system32\ole32.dll
2009-05-26 18:11:38 ----A---- C:\Windows\system32\ntdll.dll
2009-05-26 18:11:38 ----A---- C:\Windows\system32\msxml3.dll
2009-05-26 18:11:38 ----A---- C:\Windows\system32\msexch40.dll
2009-05-26 18:11:38 ----A---- C:\Windows\system32\diagperf.dll
2009-05-26 18:11:37 ----A---- C:\Windows\system32\winload.exe
2009-05-26 18:11:37 ----A---- C:\Windows\system32\uDWM.dll
2009-05-26 18:11:37 ----A---- C:\Windows\system32\riched20.dll
2009-05-26 18:11:37 ----A---- C:\Windows\system32\mmc.exe
2009-05-26 18:11:37 ----A---- C:\Windows\system32\mblctr.exe
2009-05-26 18:11:37 ----A---- C:\Windows\system32\IasMigPlugin.dll
2009-05-26 18:11:37 ----A---- C:\Windows\system32\EncDec.dll
2009-05-26 18:11:37 ----A---- C:\Windows\system32\dfsr.exe
2009-05-26 18:11:36 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2009-05-26 18:11:36 ----A---- C:\Windows\system32\SearchFilterHost.exe
2009-05-26 18:11:36 ----A---- C:\Windows\system32\RacEngn.dll
2009-05-26 18:11:36 ----A---- C:\Windows\system32\milcore.dll
2009-05-26 18:11:36 ----A---- C:\Windows\system32\kernel32.dll
2009-05-26 18:11:36 ----A---- C:\Windows\system32\fdBth.dll
2009-05-26 18:11:35 ----A---- C:\Windows\system32\spoolss.dll
2009-05-26 18:11:35 ----A---- C:\Windows\system32\schedsvc.dll
2009-05-26 18:11:35 ----A---- C:\Windows\system32\NaturalLanguage6.dll
2009-05-26 18:11:35 ----A---- C:\Windows\system32\msjtes40.dll
2009-05-26 18:11:35 ----A---- C:\Windows\system32\EhStorAPI.dll
2009-05-26 18:11:35 ----A---- C:\Windows\system32\CertEnroll.dll
2009-05-26 18:11:35 ----A---- C:\Windows\system32\AuxiliaryDisplayDriverLib.dll
2009-05-26 18:11:34 ----A---- C:\Windows\system32\WinSAT.exe
2009-05-26 18:11:34 ----A---- C:\Windows\system32\PresentationSettings.exe
2009-05-26 18:11:34 ----A---- C:\Windows\system32\msvcp60.dll
2009-05-26 18:11:34 ----A---- C:\Windows\system32\infocardapi.dll
2009-05-26 18:11:34 ----A---- C:\Windows\system32\gpedit.dll
2009-05-26 18:11:34 ----A---- C:\Windows\system32\es.dll
2009-05-26 18:11:33 ----A---- C:\Windows\system32\WMPhoto.dll
2009-05-26 18:11:33 ----A---- C:\Windows\system32\WebClnt.dll
2009-05-26 18:11:33 ----A---- C:\Windows\system32\mstext40.dll
2009-05-26 18:11:33 ----A---- C:\Windows\system32\msexcl40.dll
2009-05-26 18:11:33 ----A---- C:\Windows\system32\Magnify.exe
2009-05-26 18:11:33 ----A---- C:\Windows\system32\AuxiliaryDisplayServices.dll
2009-05-26 18:11:33 ----A---- C:\Windows\system32\advapi32.dll
2009-05-26 18:11:32 ----A---- C:\Windows\system32\WindowsAnytimeUpgradeCPL.dll
2009-05-26 18:11:32 ----A---- C:\Windows\system32\vssapi.dll
2009-05-26 18:11:32 ----A---- C:\Windows\system32\slwmi.dll
2009-05-26 18:11:32 ----A---- C:\Windows\system32\NetProjW.dll
2009-05-26 18:11:32 ----A---- C:\Windows\system32\msxbde40.dll
2009-05-26 18:11:32 ----A---- C:\Windows\system32\mstscax.dll
2009-05-26 18:11:32 ----A---- C:\Windows\system32\comsvcs.dll
2009-05-26 18:11:32 ----A---- C:\Windows\system32\authui.dll
2009-05-26 18:11:31 ----A---- C:\Windows\system32\propsys.dll
2009-05-26 18:11:31 ----A---- C:\Windows\system32\PresentationHost.exe
2009-05-26 18:11:31 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-05-26 18:11:31 ----A---- C:\Windows\system32\newdev.dll
2009-05-26 18:11:31 ----A---- C:\Windows\system32\msrepl40.dll
2009-05-26 18:11:31 ----A---- C:\Windows\system32\iasrecst.dll
2009-05-26 18:11:31 ----A---- C:\Windows\system32\gpsvc.dll
2009-05-26 18:11:31 ----A---- C:\Windows\system32\eudcedit.exe
2009-05-26 18:11:31 ----A---- C:\Windows\system32\crypt32.dll
2009-05-26 18:11:30 ----A---- C:\Windows\system32\setupapi.dll
2009-05-26 18:11:30 ----A---- C:\Windows\system32\rpcss.dll
2009-05-26 18:11:30 ----A---- C:\Windows\system32\mspbde40.dll
2009-05-26 18:11:30 ----A---- C:\Windows\system32\d3d9.dll
2009-05-26 18:11:30 ----A---- C:\Windows\explorer.exe
2009-05-26 18:11:29 ----A---- C:\Windows\system32\wevtapi.dll
2009-05-26 18:11:29 ----A---- C:\Windows\system32\shlwapi.dll
2009-05-26 18:11:29 ----A---- C:\Windows\system32\photowiz.dll
2009-05-26 18:11:29 ----A---- C:\Windows\system32\nlhtml.dll
2009-05-26 18:11:29 ----A---- C:\Windows\system32\msrd3x40.dll
2009-05-26 18:11:29 ----A---- C:\Windows\system32\msltus40.dll
2009-05-26 18:11:29 ----A---- C:\Windows\system32\msdtctm.dll
2009-05-26 18:11:29 ----A---- C:\Windows\system32\mfc42.dll
2009-05-26 18:11:29 ----A---- C:\Windows\system32\EhStorPwdMgr.dll
2009-05-26 18:11:29 ----A---- C:\Windows\system32\EhStorAuthn.dll
2009-05-26 18:11:29 ----A---- C:\Windows\system32\davclnt.dll
2009-05-26 18:11:29 ----A---- C:\Windows\system32\browseui.dll
2009-05-26 18:11:28 ----A---- C:\Windows\system32\win32spl.dll
2009-05-26 18:11:28 ----A---- C:\Windows\system32\WcnNetsh.dll
2009-05-26 18:11:28 ----A---- C:\Windows\system32\user32.dll
2009-05-26 18:11:28 ----A---- C:\Windows\system32\SLCommDlg.dll
2009-05-26 18:11:28 ----A---- C:\Windows\system32\samsrv.dll
2009-05-26 18:11:28 ----A---- C:\Windows\system32\quartz.dll
2009-05-26 18:11:28 ----A---- C:\Windows\system32\ci.dll
2009-05-26 18:11:27 ----A---- C:\Windows\system32\winhttp.dll
2009-05-26 18:11:27 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe
2009-05-26 18:11:27 ----A---- C:\Windows\system32\oleaut32.dll
2009-05-26 18:11:27 ----A---- C:\Windows\system32\netshell.dll
2009-05-26 18:11:27 ----A---- C:\Windows\system32\mswstr10.dll
2009-05-26 18:11:27 ----A---- C:\Windows\system32\msv1_0.dll
2009-05-26 18:11:27 ----A---- C:\Windows\system32\kerberos.dll
2009-05-26 18:11:27 ----A---- C:\Windows\system32\IKEEXT.DLL
2009-05-26 18:11:27 ----A---- C:\Windows\system32\compcln.exe
2009-05-26 18:11:27 ----A---- C:\Windows\system32\audiosrv.dll
2009-05-26 18:11:27 ----A---- C:\Windows\system32\apds.dll
2009-05-26 18:11:26 ----A---- C:\Windows\system32\xmlfilter.dll
2009-05-26 18:11:26 ----A---- C:\Windows\system32\msctf.dll
2009-05-26 18:11:26 ----A---- C:\Windows\system32\emdmgmt.dll
2009-05-26 18:11:25 ----A---- C:\Windows\system32\VSSVC.exe
2009-05-26 18:11:25 ----A---- C:\Windows\system32\QAGENTRT.DLL
2009-05-26 18:11:25 ----A---- C:\Windows\system32\msvcrt.dll
2009-05-26 18:11:25 ----A---- C:\Windows\system32\mfc42u.dll
2009-05-26 18:11:25 ----A---- C:\Windows\system32\iphlpsvc.dll
2009-05-26 18:11:25 ----A---- C:\Windows\system32\gdi32.dll
2009-05-26 18:11:24 ----A---- C:\Windows\system32\sqlsrv32.dll
2009-05-26 18:11:24 ----A---- C:\Windows\system32\SLUI.exe
2009-05-26 18:11:24 ----A---- C:\Windows\system32\msrd2x40.dll
2009-05-26 18:11:24 ----A---- C:\Windows\system32\eapphost.dll
2009-05-26 18:11:23 ----A---- C:\Windows\system32\winresume.exe
2009-05-26 18:11:23 ----A---- C:\Windows\system32\wevtutil.exe
2009-05-26 18:11:23 ----A---- C:\Windows\system32\shdocvw.dll
2009-05-26 18:11:23 ----A---- C:\Windows\system32\propdefs.dll
2009-05-26 18:11:23 ----A---- C:\Windows\system32\odbc32.dll
2009-05-26 18:11:23 ----A---- C:\Windows\system32\mssitlb.dll
2009-05-26 18:11:23 ----A---- C:\Windows\system32\dbgeng.dll
2009-05-26 18:11:22 ----A---- C:\Windows\system32\WsmSvc.dll
2009-05-26 18:11:22 ----A---- C:\Windows\system32\vds.exe
2009-05-26 18:11:22 ----A---- C:\Windows\system32\usp10.dll
2009-05-26 18:11:22 ----A---- C:\Windows\system32\swprv.dll
2009-05-26 18:11:22 ----A---- C:\Windows\system32\mmcndmgr.dll
2009-05-26 18:11:21 ----A---- C:\Windows\system32\schannel.dll
2009-05-26 18:11:21 ----A---- C:\Windows\system32\netlogon.dll
2009-05-26 18:11:21 ----A---- C:\Windows\system32\msscb.dll
2009-05-26 18:11:21 ----A---- C:\Windows\system32\msctfp.dll
2009-05-26 18:11:21 ----A---- C:\Windows\system32\fdBthProxy.dll
2009-05-26 18:11:21 ----A---- C:\Windows\system32\evr.dll
2009-05-26 18:11:21 ----A---- C:\Windows\system32\drvinst.exe
2009-05-26 18:11:21 ----A---- C:\Windows\system32\devmgr.dll
2009-05-26 18:11:21 ----A---- C:\Windows\system32\DevicePairingProxy.dll
2009-05-26 18:11:21 ----A---- C:\Windows\system32\BFE.DLL
2009-05-26 18:11:21 ----A---- C:\Windows\system32\adsldpc.dll
2009-05-26 18:11:20 ----A---- C:\Windows\system32\WSDApi.dll
2009-05-26 18:11:20 ----A---- C:\Windows\system32\WMVSDECD.DLL
2009-05-26 18:11:20 ----A---- C:\Windows\system32\Wldap32.dll
2009-05-26 18:11:20 ----A---- C:\Windows\system32\WindowsCodecs.dll
2009-05-26 18:11:20 ----A---- C:\Windows\system32\wcnwiz.dll
2009-05-26 18:11:20 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2009-05-26 18:11:19 ----A---- C:\Windows\system32\wercon.exe
2009-05-26 18:11:19 ----A---- C:\Windows\system32\services.exe
2009-05-26 18:11:18 ----A---- C:\Windows\system32\wcncsvc.dll
2009-05-26 18:11:18 ----A---- C:\Windows\system32\umpnpmgr.dll
2009-05-26 18:11:18 ----A---- C:\Windows\system32\taskeng.exe
2009-05-26 18:11:18 ----A---- C:\Windows\system32\rtffilt.dll
2009-05-26 18:11:18 ----A---- C:\Windows\system32\reg.exe
2009-05-26 18:11:18 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2009-05-26 18:11:18 ----A---- C:\Windows\system32\mswdat10.dll
2009-05-26 18:11:18 ----A---- C:\Windows\system32\msjter40.dll
2009-05-26 18:11:18 ----A---- C:\Windows\system32\msdtcprx.dll
2009-05-26 18:11:18 ----A---- C:\Windows\system32\msdrm.dll
2009-05-26 18:11:18 ----A---- C:\Windows\system32\mimefilt.dll
2009-05-26 18:11:18 ----A---- C:\Windows\system32\ipsmsnap.dll
2009-05-26 18:11:18 ----A---- C:\Windows\system32\dnsapi.dll
2009-05-26 18:11:18 ----A---- C:\Windows\system32\comdlg32.dll
2009-05-26 18:11:18 ----A---- C:\Windows\system32\certutil.exe
2009-05-26 18:11:18 ----A---- C:\Windows\system32\certcli.dll
2009-05-26 18:11:18 ----A---- C:\Windows\system32\adtschema.dll
2009-05-26 18:11:17 ----A---- C:\Windows\system32\WMNetMgr.dll
2009-05-26 18:11:17 ----A---- C:\Windows\system32\w32time.dll
2009-05-26 18:11:17 ----A---- C:\Windows\system32\IPSECSVC.DLL
2009-05-26 18:11:17 ----A---- C:\Windows\system32\bcrypt.dll
2009-05-26 18:11:16 ----A---- C:\Windows\system32\rsaenh.dll
2009-05-26 18:11:16 ----A---- C:\Windows\system32\msshooks.dll
2009-05-26 18:11:16 ----A---- C:\Windows\system32\msscntrs.dll
2009-05-26 18:11:16 ----A---- C:\Windows\system32\msihnd.dll
2009-05-26 18:11:16 ----A---- C:\Windows\system32\bthserv.dll
2009-05-26 18:11:15 ----A---- C:\Windows\system32\TsWpfWrp.exe
2009-05-26 18:11:15 ----A---- C:\Windows\system32\netapi32.dll
2009-05-26 18:11:15 ----A---- C:\Windows\system32\mtxclu.dll
2009-05-26 18:11:15 ----A---- C:\Windows\system32\msstrc.dll
2009-05-26 18:11:15 ----A---- C:\Windows\system32\mscories.dll
2009-05-26 18:11:15 ----A---- C:\Windows\system32\MMDevAPI.dll
2009-05-26 18:11:15 ----A---- C:\Windows\system32\inetpp.dll
2009-05-26 18:11:15 ----A---- C:\Windows\system32\inetcomm.dll
2009-05-26 18:11:15 ----A---- C:\Windows\system32\hidserv.dll
2009-05-26 18:11:15 ----A---- C:\Windows\system32\fundisc.dll
2009-05-26 18:11:15 ----A---- C:\Windows\system32\dhcpcsvc6.dll
2009-05-26 18:11:15 ----A---- C:\Windows\system32\dfshim.dll
2009-05-26 18:11:15 ----A---- C:\Windows\system32\cryptsvc.dll
2009-05-26 18:11:14 ----A---- C:\Windows\system32\wmicmiplugin.dll
2009-05-26 18:11:14 ----A---- C:\Windows\system32\termsrv.dll
2009-05-26 18:11:14 ----A---- C:\Windows\system32\shsvcs.dll
2009-05-26 18:11:14 ----A---- C:\Windows\system32\profsvc.dll
2009-05-26 18:11:14 ----A---- C:\Windows\system32\msiexec.exe
2009-05-26 18:11:14 ----A---- C:\Windows\system32\imapi.dll
2009-05-26 18:11:14 ----A---- C:\Windows\system32\gameux.dll
2009-05-26 18:11:13 ----A---- C:\Windows\system32\wdc.dll
2009-05-26 18:11:13 ----A---- C:\Windows\system32\rasmans.dll
2009-05-26 18:11:13 ----A---- C:\Windows\system32\pnidui.dll
2009-05-26 18:11:13 ----A---- C:\Windows\system32\iassdo.dll
2009-05-26 18:11:13 ----A---- C:\Windows\system32\chsbrkr.dll
2009-05-26 18:11:12 ----A---- C:\Windows\system32\wersvc.dll
2009-05-26 18:11:12 ----A---- C:\Windows\system32\spoolsv.exe
2009-05-26 18:11:12 ----A---- C:\Windows\system32\slmgr.vbs
2009-05-26 18:11:12 ----A---- C:\Windows\system32\scrrun.dll
2009-05-26 18:11:12 ----A---- C:\Windows\system32\PSHED.DLL
2009-05-26 18:11:12 ----A---- C:\Windows\system32\pdh.dll
2009-05-26 18:11:12 ----A---- C:\Windows\system32\icardres.dll
2009-05-26 18:11:12 ----A---- C:\Windows\system32\dhcpcsvc.dll
2009-05-26 18:11:12 ----A---- C:\Windows\system32\azroles.dll
2009-05-26 18:11:12 ----A---- C:\Windows\system32\autofmt.exe
2009-05-26 18:11:11 ----A---- C:\Windows\system32\wmpmde.dll
2009-05-26 18:11:11 ----A---- C:\Windows\system32\winlogon.exe
2009-05-26 18:11:11 ----A---- C:\Windows\system32\SyncCenter.dll
2009-05-26 18:11:11 ----A---- C:\Windows\system32\pidgenx.dll
2009-05-26 18:11:11 ----A---- C:\Windows\system32\CertEnrollUI.dll
2009-05-26 18:11:10 ----A---- C:\Windows\system32\SLUINotify.dll
2009-05-26 18:11:10 ----A---- C:\Windows\system32\sethc.exe
2009-05-26 18:11:10 ----A---- C:\Windows\system32\ncrypt.dll
2009-05-26 18:11:10 ----A---- C:\Windows\system32\msjetoledb40.dll
2009-05-26 18:11:10 ----A---- C:\Windows\system32\kd1394.dll
2009-05-26 18:11:10 ----A---- C:\Windows\system32\comuid.dll
2009-05-26 18:11:10 ----A---- C:\Windows\system32\certmgr.dll
2009-05-26 18:11:09 ----A---- C:\Windows\system32\wisptis.exe
2009-05-26 18:11:09 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2009-05-26 18:11:09 ----A---- C:\Windows\system32\untfs.dll
2009-05-26 18:11:09 ----A---- C:\Windows\system32\taskcomp.dll
2009-05-26 18:11:09 ----A---- C:\Windows\system32\spp.dll
2009-05-26 18:11:09 ----A---- C:\Windows\system32\scrobj.dll
2009-05-26 18:11:09 ----A---- C:\Windows\system32\rtutils.dll
2009-05-26 18:11:09 ----A---- C:\Windows\system32\printui.dll
2009-05-26 18:11:09 ----A---- C:\Windows\system32\iassam.dll
2009-05-26 18:11:09 ----A---- C:\Windows\system32\iasnap.dll
2009-05-26 18:11:09 ----A---- C:\Windows\system32\dwm.exe
2009-05-26 18:11:09 ----A---- C:\Windows\system32\autochk.exe
2009-05-26 18:11:08 ----A---- C:\Windows\system32\wow32.dll
2009-05-26 18:11:08 ----A---- C:\Windows\system32\winsrv.dll
2009-05-26 18:11:08 ----A---- C:\Windows\system32\userenv.dll
2009-05-26 18:11:08 ----A---- C:\Windows\system32\osk.exe
2009-05-26 18:11:08 ----A---- C:\Windows\system32\onex.dll
2009-05-26 18:11:08 ----A---- C:\Windows\system32\mswsock.dll
2009-05-26 18:11:08 ----A---- C:\Windows\system32\kdcom.dll
2009-05-26 18:11:08 ----A---- C:\Windows\system32\cscript.exe
2009-05-26 18:11:08 ----A---- C:\Windows\system32\basecsp.dll
2009-05-26 18:11:08 ----A---- C:\Windows\system32\autoconv.exe
2009-05-26 18:11:08 ----A---- C:\Windows\system32\audiodg.exe
2009-05-26 18:11:07 ----A---- C:\Windows\system32\WinSCard.dll
2009-05-26 18:11:07 ----A---- C:\Windows\system32\winmm.dll
2009-05-26 18:11:07 ----A---- C:\Windows\system32\WerFaultSecure.exe
2009-05-26 18:11:07 ----A---- C:\Windows\system32\spcmsg.dll
2009-05-26 18:11:07 ----A---- C:\Windows\system32\RelMon.dll
2009-05-26 18:11:07 ----A---- C:\Windows\system32\rdpencom.dll
2009-05-26 18:11:07 ----A---- C:\Windows\system32\offfilt.dll
2009-05-26 18:11:07 ----A---- C:\Windows\system32\msftedit.dll
2009-05-26 18:11:07 ----A---- C:\Windows\system32\kdusb.dll
2009-05-26 18:11:07 ----A---- C:\Windows\system32\dnsrslvr.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\wsepno.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\wscript.exe
2009-05-26 18:11:06 ----A---- C:\Windows\system32\wiaservc.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\WerFault.exe
2009-05-26 18:11:06 ----A---- C:\Windows\system32\Utilman.exe
2009-05-26 18:11:06 ----A---- C:\Windows\system32\ulib.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\sysclass.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\stobject.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\SndVol.exe
2009-05-26 18:11:06 ----A---- C:\Windows\system32\secur32.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\secproc_ssp.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\prnntfy.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\odbccp32.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\msnetobj.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\mscms.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\mfplat.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\mcmde.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\iasdatastore.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\dsound.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\diskraid.exe
2009-05-26 18:11:06 ----A---- C:\Windows\system32\apphelp.dll
2009-05-26 18:11:06 ----A---- C:\Windows\system32\adsmsext.dll
2009-05-26 18:11:05 ----A---- C:\Windows\system32\wscntfy.dll
2009-05-26 18:11:05 ----A---- C:\Windows\system32\wlansvc.dll
2009-05-26 18:11:05 ----A---- C:\Windows\system32\wlangpui.dll
2009-05-26 18:11:05 ----A---- C:\Windows\system32\rastapi.dll
2009-05-26 18:11:05 ----A---- C:\Windows\system32\pnpsetup.dll
2009-05-26 18:11:05 ----A---- C:\Windows\system32\ipsecsnp.dll
2009-05-26 18:11:05 ----A---- C:\Windows\system32\IPHLPAPI.DLL
2009-05-26 18:11:05 ----A---- C:\Windows\system32\fdProxy.dll
2009-05-26 18:11:05 ----A---- C:\Windows\system32\diskpart.exe
2009-05-26 18:11:05 ----A---- C:\Windows\system32\cryptui.dll
2009-05-26 18:11:05 ----A---- C:\Windows\system32\brcpl.dll
2009-05-26 18:11:04 ----A---- C:\Windows\system32\zipfldr.dll
2009-05-26 18:11:04 ----A---- C:\Windows\system32\wusa.exe
2009-05-26 18:11:04 ----A---- C:\Windows\system32\wscsvc.dll
2009-05-26 18:11:04 ----A---- C:\Windows\system32\WMVENCOD.DLL
2009-05-26 18:11:04 ----A---- C:\Windows\system32\vdsdyn.dll
2009-05-26 18:11:04 ----A---- C:\Windows\system32\regsvc.dll
2009-05-26 18:11:04 ----A---- C:\Windows\system32\rastls.dll
2009-05-26 18:11:04 ----A---- C:\Windows\system32\rasapi32.dll
2009-05-26 18:11:04 ----A---- C:\Windows\system32\ntprint.dll
2009-05-26 18:11:04 ----A---- C:\Windows\system32\netiohlp.dll
2009-05-26 18:11:04 ----A---- C:\Windows\system32\mscorier.dll
2009-05-26 18:11:04 ----A---- C:\Windows\system32\logman.exe
2009-05-26 18:11:04 ----A---- C:\Windows\system32\iasrad.dll
2009-05-26 18:11:04 ----A---- C:\Windows\system32\iashlpr.dll
2009-05-26 18:11:04 ----A---- C:\Windows\system32\gpapi.dll
2009-05-26 18:11:04 ----A---- C:\Windows\system32\findstr.exe
2009-05-26 18:11:03 ----A---- C:\Windows\system32\wsnmp32.dll
2009-05-26 18:11:03 ----A---- C:\Windows\system32\wshext.dll
2009-05-26 18:11:03 ----A---- C:\Windows\system32\wpccpl.dll
2009-05-26 18:11:03 ----A---- C:\Windows\system32\wer.dll
2009-05-26 18:11:03 ----A---- C:\Windows\system32\themecpl.dll
2009-05-26 18:11:03 ----A---- C:\Windows\system32\rasdlg.dll
2009-05-26 18:11:03 ----A---- C:\Windows\system32\netcenter.dll
2009-05-26 18:11:03 ----A---- C:\Windows\system32\iassvcs.dll
2009-05-26 18:11:02 ----A---- C:\Windows\system32\uxsms.dll
2009-05-26 18:11:02 ----A---- C:\Windows\system32\tsbyuv.dll
2009-05-26 18:11:02 ----A---- C:\Windows\system32\srvsvc.dll
2009-05-26 18:11:02 ----A---- C:\Windows\system32\slcc.dll
2009-05-26 18:11:02 ----A---- C:\Windows\system32\scansetting.dll
2009-05-26 18:11:02 ----A---- C:\Windows\system32\powrprof.dll
2009-05-26 18:11:02 ----A---- C:\Windows\system32\powercpl.dll
2009-05-26 18:11:02 ----A---- C:\Windows\system32\PerfCenterCPL.dll
2009-05-26 18:11:02 ----A---- C:\Windows\system32\ntmarta.dll
2009-05-26 18:11:02 ----A---- C:\Windows\system32\networkmap.dll
2009-05-26 18:11:02 ----A---- C:\Windows\system32\msutb.dll
2009-05-26 18:11:02 ----A---- C:\Windows\system32\mstsc.exe
2009-05-26 18:11:02 ----A---- C:\Windows\system32\mstlsapi.dll
2009-05-26 18:11:02 ----A---- C:\Windows\system32\mssprxy.dll
2009-05-26 18:11:02 ----A---- C:\Windows\system32\iasads.dll
2009-05-26 18:11:02 ----A---- C:\Windows\system32\iasacct.dll
2009-05-26 18:11:02 ----A---- C:\Windows\system32\authz.dll
2009-05-26 18:11:01 ----A---- C:\Windows\system32\wlanpref.dll
2009-05-26 18:11:01 ----A---- C:\Windows\system32\wlanhlp.dll
2009-05-26 18:11:01 ----A---- C:\Windows\system32\usercpl.dll
2009-05-26 18:11:01 ----A---- C:\Windows\system32\themeui.dll
2009-05-26 18:11:01 ----A---- C:\Windows\system32\systemcpl.dll
2009-05-26 18:11:01 ----A---- C:\Windows\system32\sud.dll
2009-05-26 18:11:01 ----A---- C:\Windows\system32\samlib.dll
2009-05-26 18:11:01 ----A---- C:\Windows\system32\qdvd.dll
2009-05-26 18:11:01 ----A---- C:\Windows\system32\pcaui.dll
2009-05-26 18:11:01 ----A---- C:\Windows\system32\newdev.exe
2009-05-26 18:11:01 ----A---- C:\Windows\system32\mmci.dll
2009-05-26 18:11:01 ----A---- C:\Windows\system32\dot3svc.dll
2009-05-26 18:11:01 ----A---- C:\Windows\system32\connect.dll
2009-05-26 18:11:01 ----A---- C:\Windows\system32\autoplay.dll
2009-05-26 18:11:01 ----A---- C:\Windows\system32\accessibilitycpl.dll
2009-05-26 18:11:00 ----A---- C:\Windows\system32\wpcao.dll
2009-05-26 18:11:00 ----A---- C:\Windows\system32\vdsutil.dll
2009-05-26 18:11:00 ----A---- C:\Windows\system32\tapisrv.dll
2009-05-26 18:11:00 ----A---- C:\Windows\system32\scksp.dll
2009-05-26 18:11:00 ----A---- C:\Windows\system32\scesrv.dll
2009-05-26 18:11:00 ----A---- C:\Windows\system32\rpchttp.dll
2009-05-26 18:11:00 ----A---- C:\Windows\system32\regapi.dll
2009-05-26 18:11:00 ----A---- C:\Windows\system32\psisdecd.dll
2009-05-26 18:11:00 ----A---- C:\Windows\system32\oleprn.dll
2009-05-26 18:11:00 ----A---- C:\Windows\system32\msinfo32.exe
2009-05-26 18:11:00 ----A---- C:\Windows\system32\mpr.dll
2009-05-26 18:11:00 ----A---- C:\Windows\system32\imm32.dll
2009-05-26 18:11:00 ----A---- C:\Windows\system32\feclient.dll
2009-05-26 18:11:00 ----A---- C:\Windows\system32\AudioSes.dll
2009-05-26 18:10:59 ----A---- C:\Windows\system32\wscisvif.dll
2009-05-26 18:10:59 ----A---- C:\Windows\system32\rekeywiz.exe
2009-05-26 18:10:59 ----A---- C:\Windows\system32\iaspolcy.dll
2009-05-26 18:10:59 ----A---- C:\Windows\system32\Faultrep.dll
2009-05-26 18:10:59 ----A---- C:\Windows\system32\dot3msm.dll
2009-05-26 18:10:59 ----A---- C:\Windows\system32\DeviceEject.exe
2009-05-26 18:10:58 ----A---- C:\Windows\system32\sdclt.exe
2009-05-26 18:10:58 ----A---- C:\Windows\system32\scecli.dll
2009-05-26 18:10:58 ----A---- C:\Windows\system32\rasgcw.dll
2009-05-26 18:10:58 ----A---- C:\Windows\system32\qedit.dll
2009-05-26 18:10:58 ----A---- C:\Windows\system32\pnpui.dll
2009-05-26 18:10:58 ----A---- C:\Windows\system32\perfdisk.dll
2009-05-26 18:10:58 ----A---- C:\Windows\system32\ncryptui.dll
2009-05-26 18:10:58 ----A---- C:\Windows\system32\hdwwiz.exe
2009-05-26 18:10:58 ----A---- C:\Windows\system32\dpapimig.exe
2009-05-26 18:10:58 ----A---- C:\Windows\system32\certreq.exe
2009-05-26 18:10:57 ----A---- C:\Windows\system32\whealogr.dll
2009-05-26 18:10:57 ----A---- C:\Windows\system32\TSTheme.exe
2009-05-26 18:10:57 ----A---- C:\Windows\system32\tcpmon.dll
2009-05-26 18:10:57 ----A---- C:\Windows\system32\tcpipcfg.dll
2009-05-26 18:10:57 ----A---- C:\Windows\system32\srcore.dll
2009-05-26 18:10:57 ----A---- C:\Windows\system32\spwinsat.dll
2009-05-26 18:10:57 ----A---- C:\Windows\system32\SnippingTool.exe
2009-05-26 18:10:57 ----A---- C:\Windows\system32\SmartcardCredentialProvider.dll
2009-05-26 18:10:57 ----A---- C:\Windows\system32\SCardSvr.dll
2009-05-26 18:10:57 ----A---- C:\Windows\system32\rasplap.dll
2009-05-26 18:10:57 ----A---- C:\Windows\system32\raschap.dll
2009-05-26 18:10:57 ----A---- C:\Windows\system32\PnPUnattend.exe
2009-05-26 18:10:57 ----A---- C:\Windows\system32\FWPUCLNT.DLL
2009-05-26 18:10:57 ----A---- C:\Windows\system32\fdWSD.dll
2009-05-26 18:10:57 ----A---- C:\Windows\system32\conime.exe
2009-05-26 18:10:57 ----A---- C:\Windows\system32\cmmon32.exe
2009-05-26 18:10:57 ----A---- C:\Windows\system32\cmdial32.dll
2009-05-26 18:10:56 ----A---- C:\Windows\system32\WMVXENCD.DLL
2009-05-26 18:10:56 ----A---- C:\Windows\system32\wlanui.dll
2009-05-26 18:10:56 ----A---- C:\Windows\system32\wlanmsm.dll
2009-05-26 18:10:56 ----A---- C:\Windows\system32\wiaaut.dll
2009-05-26 18:10:56 ----A---- C:\Windows\system32\shwebsvc.dll
2009-05-26 18:10:56 ----A---- C:\Windows\system32\shsetup.dll
2009-05-26 18:10:56 ----A---- C:\Windows\system32\rasppp.dll
2009-05-26 18:10:56 ----A---- C:\Windows\system32\PnPutil.exe
2009-05-26 18:10:56 ----A---- C:\Windows\system32\oobefldr.dll
2009-05-26 18:10:56 ----A---- C:\Windows\system32\MSVidCtl.dll
2009-05-26 18:10:56 ----A---- C:\Windows\system32\fontext.dll
2009-05-26 18:10:56 ----A---- C:\Windows\system32\dsprop.dll
2009-05-26 18:10:56 ----A---- C:\Windows\system32\dimsroam.dll
2009-05-26 18:10:55 ----A---- C:\Windows\system32\WSDMon.dll
2009-05-26 18:10:55 ----A---- C:\Windows\system32\wmpeffects.dll
2009-05-26 18:10:55 ----A---- C:\Windows\system32\wmdrmsdk.dll
2009-05-26 18:10:55 ----A---- C:\Windows\system32\wlgpclnt.dll
2009-05-26 18:10:55 ----A---- C:\Windows\system32\smss.exe
2009-05-26 18:10:55 ----A---- C:\Windows\system32\rdpwsx.dll
2009-05-26 18:10:55 ----A---- C:\Windows\system32\rasmontr.dll
2009-05-26 18:10:55 ----A---- C:\Windows\system32\netplwiz.dll
2009-05-26 18:10:55 ----A---- C:\Windows\system32\mscandui.dll
2009-05-26 18:10:55 ----A---- C:\Windows\system32\modemui.dll
2009-05-26 18:10:55 ----A---- C:\Windows\system32\dataclen.dll
2009-05-26 18:10:55 ----A---- C:\Windows\system32\credui.dll
2009-05-26 18:10:55 ----A---- C:\Windows\system32\chtbrkr.dll
2009-05-26 18:10:55 ----A---- C:\Windows\system32\blackbox.dll
2009-05-26 18:10:54 ----A---- C:\Windows\system32\wscapi.dll
2009-05-26 18:10:54 ----A---- C:\Windows\system32\wpcsvc.dll
2009-05-26 18:10:54 ----A---- C:\Windows\system32\thawbrkr.dll
2009-05-26 18:10:54 ----A---- C:\Windows\system32\softkbd.dll
2009-05-26 18:10:54 ----A---- C:\Windows\system32\sendmail.dll
2009-05-26 18:10:54 ----A---- C:\Windows\system32\networkexplorer.dll
2009-05-26 18:10:54 ----A---- C:\Windows\system32\msscp.dll
2009-05-26 18:10:54 ----A---- C:\Windows\system32\msimtf.dll
2009-05-26 18:10:54 ----A---- C:\Windows\system32\msctfui.dll
2009-05-26 18:10:54 ----A---- C:\Windows\system32\MediaMetadataHandler.dll
2009-05-26 18:10:54 ----A---- C:\Windows\system32\logagent.exe
2009-05-26 18:10:54 ----A---- C:\Windows\system32\InkEd.dll
2009-05-26 18:10:54 ----A---- C:\Windows\system32\ifmon.dll
2009-05-26 18:10:54 ----A---- C:\Windows\system32\gpresult.exe
2009-05-26 18:10:54 ----A---- C:\Windows\system32\cipher.exe
2009-05-26 18:10:54 ----A---- C:\Windows\system32\certprop.dll
2009-05-26 18:10:54 ----A---- C:\Windows\system32\Apphlpdm.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\wshbth.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\version.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\SLLUA.exe
2009-05-26 18:10:53 ----A---- C:\Windows\system32\puiapi.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\olepro32.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\msjint40.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\msisip.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\MsCtfMonitor.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\mprapi.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\l2nacp.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\input.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\ftp.exe
2009-05-26 18:10:53 ----A---- C:\Windows\system32\fdSSDP.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\fc.exe
2009-05-26 18:10:53 ----A---- C:\Windows\system32\ExplorerFrame.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\eapp3hst.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\drmmgrtn.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\dmusic.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\dmsynth.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\cscapi.dll
2009-05-26 18:10:53 ----A---- C:\Windows\system32\cdd.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\wsdchngr.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\tscupgrd.exe
2009-05-26 18:10:52 ----A---- C:\Windows\system32\Storprop.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\SMBHelperClass.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\slcinst.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\rrinstaller.exe
2009-05-26 18:10:52 ----A---- C:\Windows\system32\rasdial.exe
2009-05-26 18:10:52 ----A---- C:\Windows\system32\rasdiag.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\PortableDeviceTypes.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\ocsetup.exe
2009-05-26 18:10:52 ----A---- C:\Windows\system32\nslookup.exe
2009-05-26 18:10:52 ----A---- C:\Windows\system32\networkitemfactory.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\mfps.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\ipconfig.exe
2009-05-26 18:10:52 ----A---- C:\Windows\system32\FwRemoteSvr.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\fdWCN.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\eappgnui.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\eappcfg.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\dot3cfg.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\cscdll.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\CHxReadingStringIME.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\bthudtask.exe
2009-05-26 18:10:52 ----A---- C:\Windows\system32\bthci.dll
2009-05-26 18:10:52 ----A---- C:\Windows\system32\aaclient.dll
2009-05-26 18:10:51 ----A---- C:\Windows\system32\tsgqec.dll
2009-05-26 18:10:51 ----A---- C:\Windows\system32\PNPXAssoc.dll
2009-05-26 18:10:51 ----A---- C:\Windows\system32\mmcico.dll
2009-05-26 18:10:51 ----A---- C:\Windows\system32\mfpmp.exe
2009-05-26 18:10:51 ----A---- C:\Windows\system32\hbaapi.dll
2009-05-26 18:10:51 ----A---- C:\Windows\system32\gpupdate.exe
2009-05-26 18:10:51 ----A---- C:\Windows\system32\fdeploy.dll
2009-05-26 18:10:51 ----A---- C:\Windows\system32\csrstub.exe
2009-05-26 18:10:51 ----A---- C:\Windows\system32\cbsra.exe
2009-05-26 18:10:51 ----A---- C:\Windows\system32\bitsigd.dll
2009-05-26 18:10:51 ----A---- C:\Windows\system32\atmlib.dll
2009-05-26 18:10:50 ----A---- C:\Windows\system32\winrnr.dll
2009-05-26 18:10:50 ----A---- C:\Windows\system32\vdmdbg.dll
2009-05-26 18:10:50 ----A---- C:\Windows\system32\slwga.dll
2009-05-26 18:10:50 ----A---- C:\Windows\system32\odbcconf.dll
2009-05-26 18:10:50 ----A---- C:\Windows\system32\NcdProp.dll
2009-05-26 18:10:50 ----A---- C:\Windows\system32\iscsilog.dll
2009-05-26 18:10:50 ----A---- C:\Windows\system32\inetppui.dll
2009-05-26 18:10:49 ----A---- C:\Windows\system32\midimap.dll
2009-05-26 18:10:48 ----A---- C:\Windows\system32\wmploc.DLL
2009-05-26 18:10:48 ----A---- C:\Windows\system32\spwmp.dll
2009-05-26 18:10:48 ----A---- C:\Windows\system32\msimsg.dll
2009-05-26 18:10:48 ----A---- C:\Windows\system32\mferror.dll
2009-05-26 18:10:48 ----A---- C:\Windows\system32\f3ahvoas.dll
2009-05-26 18:10:48 ----A---- C:\Windows\system32\dxmasf.dll
2009-05-26 18:10:35 ----A---- C:\Windows\system32\SmiEngine.dll
2009-05-26 18:10:31 ----A---- C:\Windows\system32\wdscore.dll
2009-05-26 18:10:31 ----A---- C:\Windows\system32\PkgMgr.exe
2009-05-26 18:10:22 ----A---- C:\Windows\system32\drvstore.dll
2009-05-18 06:44:06 ----D---- C:\Users\Administrator\AppData\Roaming\Acreon
2009-05-14 05:56:03 ----D---- C:\ProgramData\WinZip
2009-05-14 05:56:00 ----D---- C:\Program Files\WinZip
2009-05-14 05:41:47 ----D---- C:\Users\Administrator\AppData\Roaming\eMusic
2009-05-14 05:41:13 ----D---- C:\Program Files\eMusic Download Manager
2009-05-13 19:54:12 ----D---- C:\Windows\system32\Interface
2009-05-01 00:07:52 ----A---- C:\Windows\system32\nvshext.dll

======List of files/folders modified in the last 3 months======

2009-07-31 19:22:56 ----D---- C:\Windows\Prefetch
2009-07-31 19:22:49 ----D---- C:\Windows\Temp
2009-07-31 19:20:15 ----D---- C:\World of Warcraft
2009-07-31 19:20:15 ----D---- C:\Program Files\Curse
2009-07-31 00:05:00 ----D---- C:\Windows\System32
2009-07-31 00:05:00 ----D---- C:\Windows\inf
2009-07-31 00:05:00 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-07-30 23:59:07 ----D---- C:\ProgramData\NVIDIA
2009-07-30 23:43:24 ----D---- C:\Windows\Minidump
2009-07-30 23:42:53 ----D---- C:\Windows
2009-07-30 23:42:53 ----D---- C:\Program Files\Microsoft Silverlight
2009-07-30 21:50:28 ----D---- C:\Windows\system32\drivers
2009-07-30 21:47:15 ----SHD---- C:\Windows\Installer
2009-07-30 21:46:34 ----SHD---- C:\System Volume Information
2009-07-29 20:22:00 ----D---- C:\Windows\system32\migration
2009-07-29 20:21:59 ----D---- C:\Program Files\Internet Explorer
2009-07-29 20:02:06 ----D---- C:\Windows\winsxs
2009-07-29 20:00:33 ----D---- C:\Windows\system32\catroot
2009-07-29 20:00:31 ----D---- C:\Windows\system32\catroot2
2009-07-28 14:12:27 ----HD---- C:\ProgramData
2009-07-28 14:12:03 ----RD---- C:\Program Files
2009-07-21 06:57:52 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2009-07-21 06:57:38 ----D---- C:\Program Files\AGEIA Technologies
2009-07-21 06:54:51 ----D---- C:\NVIDIA
2009-07-19 18:41:04 ----AD---- C:\ProgramData\TEMP
2009-07-17 01:32:08 ----D---- C:\Windows\Tasks
2009-07-15 23:13:44 ----SD---- C:\Windows\Downloaded Program Files
2009-07-15 20:38:59 ----D---- C:\ProgramData\Microsoft Help
2009-07-15 20:32:01 ----D---- C:\Program Files\iPod
2009-07-15 20:32:00 ----D---- C:\Program Files\Common Files\Apple
2009-07-15 20:30:16 ----D---- C:\Program Files\Windows Mail
2009-07-15 20:28:26 ----D---- C:\Windows\Debug
2009-07-14 11:54:00 ----A---- C:\Windows\system32\nvd3dum.dll
2009-07-14 11:54:00 ----A---- C:\Windows\system32\nvapi.dll
2009-07-12 18:33:23 ----D---- C:\Windows\system32\Tasks
2009-07-12 18:12:13 ----A---- C:\Windows\SYSTEM.INI
2009-07-10 07:01:34 ----A---- C:\Windows\system32\NVUNINST.EXE
2009-07-08 08:00:07 ----D---- C:\Windows\Downloaded Installations
2009-07-08 07:56:36 ----D---- C:\Program Files\Common Files
2009-07-08 07:56:29 ----D---- C:\Windows\system32\wbem
2009-07-07 08:10:56 ----A---- C:\Windows\system32\mrt.exe
2009-07-05 00:24:29 ----D---- C:\ProgramData\Electronic Arts
2009-07-05 00:24:13 ----RD---- C:\Users
2009-07-04 19:35:52 ----A---- C:\Windows\win.ini
2009-07-03 20:31:35 ----D---- C:\Windows\system32\spool
2009-07-03 20:31:35 ----D---- C:\Windows\system
2009-07-03 20:31:35 ----D---- C:\Windows\registration
2009-07-03 20:31:35 ----D---- C:\Users\Administrator\AppData\Roaming\Ventrilo
2009-07-03 20:31:35 ----D---- C:\Users\Administrator\AppData\Roaming\MobMapUpdater
2009-07-03 20:24:08 ----D---- C:\ProgramData\Media Center Programs
2009-07-03 19:46:22 ----D---- C:\Windows\Logs
2009-06-29 17:24:48 ----D---- C:\Windows\system32\Macromed
2009-06-24 16:13:09 ----D---- C:\Windows\Microsoft.NET
2009-06-19 11:19:37 ----D---- C:\Program Files\Electronic Arts
2009-06-10 07:19:05 ----RSD---- C:\Windows\assembly
2009-06-10 07:11:50 ----D---- C:\Windows\ehome
2009-06-03 23:53:16 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2009-06-03 22:35:05 ----D---- C:\Users\Administrator\AppData\Roaming\Apple Computer
2009-06-03 22:00:03 ----HD---- C:\Program Files\InstallShield Installation Information
2009-06-03 21:35:43 ----D---- C:\Windows\system32\directx
2009-06-03 21:35:14 ----HD---- C:\Windows\msdownld.tmp
2009-05-29 00:59:49 ----D---- C:\Program Files\SystemRequirementsLab
2009-05-29 00:53:40 ----D---- C:\Program Files\Common Files\System
2009-05-29 00:53:27 ----D---- C:\Program Files\Windows Live
2009-05-29 00:46:45 ----SD---- C:\ProgramData\Microsoft
2009-05-28 08:05:32 ----D---- C:\Windows\rescache
2009-05-28 07:51:18 ----SHD---- C:\Boot
2009-05-28 07:46:07 ----D---- C:\Program Files\Windows Calendar
2009-05-28 07:46:07 ----D---- C:\Program Files\Movie Maker
2009-05-28 07:46:06 ----D---- C:\Program Files\Windows Sidebar
2009-05-28 07:46:06 ----D---- C:\Program Files\Windows Media Player
2009-05-28 07:46:06 ----D---- C:\Program Files\Windows Journal
2009-05-28 07:46:06 ----D---- C:\Program Files\Windows Collaboration
2009-05-28 07:46:05 ----D---- C:\Windows\servicing
2009-05-28 07:46:05 ----D---- C:\Program Files\Windows Photo Gallery
2009-05-28 07:46:05 ----D---- C:\Program Files\Windows Defender
2009-05-28 07:46:00 ----D---- C:\Windows\IME
2009-05-28 07:45:59 ----D---- C:\Windows\system32\XPSViewer
2009-05-28 07:45:59 ----D---- C:\Windows\system32\sk-SK
2009-05-28 07:45:59 ----D---- C:\Windows\system32\lv-LV
2009-05-28 07:45:59 ----D---- C:\Windows\system32\ko-KR
2009-05-28 07:45:59 ----D---- C:\Windows\system32\hr-HR
2009-05-28 07:45:59 ----D---- C:\Windows\system32\et-EE
2009-05-28 07:45:59 ----D---- C:\Windows\system32\da-DK
2009-05-28 07:45:57 ----D---- C:\Windows\system32\en-US
2009-05-28 07:45:56 ----D---- C:\Windows\system32\oobe
2009-05-28 07:45:56 ----D---- C:\Windows\system32\it-IT
2009-05-28 07:45:56 ----D---- C:\Windows\system32\el-GR
2009-05-28 07:45:56 ----D---- C:\Windows\system32\de-DE
2009-05-28 07:45:53 ----D---- C:\Windows\system32\sv-SE
2009-05-28 07:45:53 ----D---- C:\Windows\system32\SLUI
2009-05-28 07:45:53 ----D---- C:\Windows\system32\setup
2009-05-28 07:45:53 ----D---- C:\Windows\system32\ru-RU
2009-05-28 07:45:53 ----D---- C:\Windows\system32\pt-PT
2009-05-28 07:45:53 ----D---- C:\Windows\system32\hu-HU
2009-05-28 07:45:53 ----D---- C:\Windows\system32\he-IL
2009-05-28 07:45:53 ----D---- C:\Windows\system32\fr-FR
2009-05-28 07:45:53 ----D---- C:\Windows\system32\fi-FI
2009-05-28 07:45:53 ----D---- C:\Windows\system32\cs-CZ
2009-05-28 07:45:53 ----D---- C:\Windows\system32\AdvancedInstallers
2009-05-28 07:45:52 ----D---- C:\Windows\system32\zh-TW
2009-05-28 07:45:52 ----D---- C:\Windows\system32\zh-CN
2009-05-28 07:45:52 ----D---- C:\Windows\system32\uk-UA
2009-05-28 07:45:52 ----D---- C:\Windows\system32\sr-Latn-CS
2009-05-28 07:45:52 ----D---- C:\Windows\system32\sl-SI
2009-05-28 07:45:52 ----D---- C:\Windows\system32\ro-RO
2009-05-28 07:45:52 ----D---- C:\Windows\system32\pl-PL
2009-05-28 07:45:52 ----D---- C:\Windows\system32\manifeststore
2009-05-28 07:45:52 ----D---- C:\Windows\system32\ja-JP
2009-05-28 07:45:52 ----D---- C:\Windows\system32\es-ES
2009-05-28 07:45:52 ----D---- C:\Windows\system32\en
2009-05-28 07:45:52 ----D---- C:\Windows\system32\bg-BG
2009-05-28 07:45:51 ----D---- C:\Windows\system32\tr-TR
2009-05-28 07:45:51 ----D---- C:\Windows\system32\th-TH
2009-05-28 07:45:50 ----D---- C:\Windows\system32\pt-BR
2009-05-28 07:45:50 ----D---- C:\Windows\system32\nl-NL
2009-05-28 07:45:50 ----D---- C:\Windows\system32\nb-NO
2009-05-28 07:45:50 ----D---- C:\Windows\system32\migwiz
2009-05-28 07:45:50 ----D---- C:\Windows\system32\lt-LT
2009-05-28 07:45:50 ----D---- C:\Windows\system32\ar-SA
2009-05-28 07:45:29 ----RSD---- C:\Windows\Fonts
2009-05-28 07:45:29 ----D---- C:\Windows\AppPatch
2009-05-28 07:45:21 ----D---- C:\Windows\system32\Boot

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AsIO;AsIO; C:\Windows\system32\drivers\AsIO.sys [2006-10-18 12664]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2009-02-05 23152]
R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2009-02-05 114768]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2009-02-05 51376]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver; C:\Windows\System32\DRIVERS\cmdguard.sys [2009-07-17 85008]
R1 cmdHlp;COMODO Firewall Pro Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys [2009-07-17 25104]
R1 KmxAgent;KmxAgent; C:\Windows\System32\DRIVERS\kmxagent.sys [2009-01-09 72696]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\DRIVERS\aswMonFlt.sys [2009-02-05 51792]
R2 NVR0FLASHDev;NVR0FLASHDev; \??\C:\Windows\nvflash.sys [2009-01-07 36896]
R3 AmdLLD;AMD Low Level Device Driver; C:\Windows\system32\DRIVERS\AmdLLD.sys [2009-04-22 42552]
R3 c65013264;C-Media CM6501 Like Sound UDAX Interface; C:\Windows\system32\drivers\c6501.sys [2007-02-07 1298944]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 Inspect;Comodo Firewall Network Driver; C:\Windows\system32\DRIVERS\inspect.sys [2009-07-17 73232]
R3 KeyScrambler;KeyScrambler; C:\Windows\System32\drivers\keyscrambler.sys [2009-01-18 114024]
R3 KmxCfg;KmxCfg; C:\Windows\System32\DRIVERS\kmxcfg.sys [2009-01-09 205304]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2006-10-17 7680]
R3 NVENETFD;NVIDIA nForce 10/100/1000 Mbps Ethernet ; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2008-08-01 1052704]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2009-07-14 9557216]
R3 NVR0Dev;NVR0Dev; \??\C:\Windows\nvoclock.sys [2009-01-06 36640]
R3 PSI;PSI; C:\Windows\system32\DRIVERS\psi_mf.sys [2009-06-17 12648]
R3 usbaudio;USB Audio Driver (WDM); C:\Windows\system32\drivers\usbaudio.sys [2009-04-10 73216]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-20 83328]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-20 5632]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-20 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-20 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-20 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-20 6016]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-20 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-20 386616]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2008-01-20 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-05-29 144712]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-02-05 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-02-05 138680]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 ccSchedulerSVC;CA Common Scheduler Service; C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe [2009-07-08 128240]
R2 cmdAgent;COMODO Firewall Pro Helper Service; C:\Program Files\COMODO\Firewall\cmdagent.exe [2009-07-17 519936]
R2 ITMRTSVC;CA Pest Patrol Realtime Protection Service; C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe [2008-09-29 283888]
R2 nTuneService;Performance Service; C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe [2009-01-06 174624]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-07-14 215584]
R2 ProtexisLicensing;ProtexisLicensing; C:\Windows\system32\PSIService.exe [2006-11-02 174656]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2009-07-14 239648]
R2 UmxAgent;HIPS Event Manager; C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe [2009-01-09 1153528]
R2 UmxCfg;HIPS Configuration Interpreter; C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe [2009-01-09 797176]
R2 UmxPol;HIPS Policy Manager; C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe [2009-01-09 297464]
R2 UpdateCenterService;Update Center Service; C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe [2009-01-07 121376]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-02-05 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-02-05 352920]
R3 CaCCProvSP;CaCCProvSP; C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe [2009-07-08 259312]
R3 PPCtlPriv;PPCtlPriv; C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe [2009-07-08 222448]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2009-03-29 31048]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-07-13 542496]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------


info.txt logfile of random's system information tool 1.06 2009-07-31 19:23:10

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->MsiExec.exe /X{166478EA-A017-43C0-BE42-7560BD5A646B}
2007 Microsoft Office system-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROHYBRIDR /dll OSETUP.DLL
Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.6-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81300000003}
AMD CPUInfo-->MsiExec.exe /X{8AB445D0-CD91-47CC-B1A9-A654B4B261E4}
Apple Mobile Device Support-->MsiExec.exe /I{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Audible Download Manager-->C:\Program Files\Audible\Bin\AudibleDM_iTunesSetup[1].exe /Uninstall
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
CA Anti-Spyware-->"C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\setup\ccinstaller.exe" /u /silent /module="pp"
CA Internet Security Suite-->"C:\Program Files\CA\CA Internet Security Suite\caunst.exe" /u
CA Pest Patrol Realtime Protection-->MsiExec.exe /X{F05A5232-CE5E-4274-AB27-44EB8105898D}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
C-Media CM6501 Like Sound Driver-->C:\Windows\system32\c6501rm.exe
Color Cop 5.4.3-->"C:\Program Files\Color_Cop\unins000.exe"
COMODO Firewall Pro-->C:\Program Files\COMODO\Firewall\cfpconfg.exe -u
Cool & Quiet-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1ADE1AA0-7F82-4BB1-B1BD-727DE438057B}\setup.exe" -l0x9
Corel Snapfire DVD Maker-->MsiExec.exe /X{17E14D89-3A9F-4706-9F9B-C2DFC7ABE94B}
Corel Snapfire Plus-->MsiExec.exe /X{7ADE3A47-B425-45E9-8FF6-11BE2B775645}
Curse Client-->C:\Program Files\Curse\uninstall.exe
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Program Files\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Fraps (remove only)-->"C:\Fraps\uninstall.exe"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
iPod for Windows 2006-06-28-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{BD57EA4D-026E-4F08-9B93-080E282B81FE} /l1033
iTunes-->MsiExec.exe /I{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}
Java™ 6 Update 14-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216014FF}
Junk Mail filter update-->MsiExec.exe /I{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}
KeyScrambler-->C:\Program Files\KeyScrambler\uninstall.exe
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office Live Add-in 1.3-->MsiExec.exe /I{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}
Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook Connector-->MsiExec.exe /I{95120000-0120-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Professional Hybrid 2007-->MsiExec.exe /X{91120000-0031-0000-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 and SOAP Toolkit 3.0-->MsiExec.exe /I{32343DB6-9A52-40C9-87E4-5E7C79791C87}
NVIDIA Drivers-->C:\Windows\system32\nvuninst.exe UninstallGUI
NVIDIA Performance-->"C:\Program Files\InstallShield Installation Information\{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}\setup.exe" -runfromtemp -l0x0409 -removeonly
NVIDIA Performance-->MsiExec.exe /I{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}
NVIDIA PhysX-->MsiExec.exe /X{B83FC356-B7C0-441F-8A4D-D71E088E7974}
NVIDIA Stereoscopic 3D Driver-->"C:\Program Files\NVIDIA Corporation\3D Vision\nvStInst.exe" /uninstall /ask
NVIDIA System Monitor-->"C:\Program Files\InstallShield Installation Information\{E9CFBE78-ED91-4FCF-9E6F-210E477E527D}\setup.exe" -runfromtemp -l0x0409 -removeonly
NVIDIA System Monitor-->MsiExec.exe /I{E9CFBE78-ED91-4FCF-9E6F-210E477E527D}
NVIDIA System Update-->"C:\Program Files\InstallShield Installation Information\{6F69C969-2942-4E7B-B594-75B37664B8BA}\setup.exe" -runfromtemp -l0x0409 -removeonly
NVIDIA System Update-->MsiExec.exe /I{6F69C969-2942-4E7B-B594-75B37664B8BA}
PC Probe II-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F7338FA3-DAB5-49B2-900D-0AFB5760C166}\setup.exe" -l0x9
QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68}
Secunia PSI-->"C:\Program Files\Secunia\PSI\uninstall.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SpywareBlaster 4.2-->"C:\Program Files\SpywareBlaster\unins000.exe"
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
Tortun 0.8-->"C:\Program Files\Tortun\unins000.exe"
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
Ventrilo Client-->MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Ventrilo Server-->MsiExec.exe /X{1D46A3A0-B37D-423A-91C2-101A49E2FF80}
Warhammer Online - Age of Reckoning -->C:\Program Files\Electronic Arts\Warhammer Online - Age of Reckoning\uninst2.exe
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{C6CA8874-5F22-4AF0-9BE3-016BF299C536}
Windows Live Mail-->MsiExec.exe /I{63C1109E-D977-49ED-BCE3-D00D0BF187D6}
Windows Live Sign-in Assistant-->MsiExec.exe /I{9422C8EA-B0C6-4197-B8FC-DC797658CA00}
Windows Live Upload Tool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Windows Live Writer-->MsiExec.exe /X{6A92E5C5-0578-443D-91F3-92ECE5F2CAE2}
WinZip 12.1-->MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240B8}

=====HijackThis Backups=====

O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll [2009-07-15]
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll [2009-07-15]
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll [2009-07-15]
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL [2009-07-15]
O13 - Gopher Prefix: [2009-07-15]
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 [2009-07-15]
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll [2009-07-15]
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab [2009-07-15]
O1 - Hosts: ::1 localhost [2009-07-21]
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [2009-07-21]
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [2009-07-21]

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

FW: COMODO Firewall Pro (disabled)
AS: Spybot - Search and Destroy (disabled)
AS: Windows Defender
AS: CA Anti-Spyware

======System event log======

Computer Name: USER-PC
Event Code: 15016
Message: Unable to initialize the security package Kerberos for server side authentication. The data field contains the error number.
Record Number: 25517
Source Name: Microsoft-Windows-HttpEvent
Time Written: 20081121222027.310746-000
Event Type: Error
User:

Computer Name: USER-PC
Event Code: 3004
Message: Windows Defender Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. Windows Defender can't undo changes that you allow.
For more information please see the following:
Not Applicable
Scan ID: {78E2C324-195C-4316-A947-493F605A0D0F}
User: USER-PC\Administrator
Name: Unknown
ID:
Severity ID:
Category ID:
Path Found: regkey:HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task;runkey:HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task;file:C:\Program Files\QuickTime\QTTask.exe
Alert Type: Unclassified software
Detection Type:
Record Number: 25482
Source Name: Microsoft-Windows-Windows Defender
Time Written: 20081121091126.000000-000
Event Type: Warning
User:

Computer Name: USER-PC
Event Code: 7032
Message: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Apple Mobile Device service, but this action failed with the following error:
An instance of the service is already running.
Record Number: 25481
Source Name: Service Control Manager
Time Written: 20081121091121.000000-000
Event Type: Error
User:

Computer Name: USER-PC
Event Code: 7031
Message: The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
Record Number: 25479
Source Name: Service Control Manager
Time Written: 20081121091021.000000-000
Event Type: Error
User:

Computer Name: USER-PC
Event Code: 7031
Message: The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
Record Number: 25477
Source Name: Service Control Manager
Time Written: 20081121091011.000000-000
Event Type: Error
User:

=====Application event log=====

Computer Name: USER-PC
Event Code: 63
Message: A provider, OffProv12, has been registered in the Windows Management Instrumentation namespace Root\MSAPPS12 to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.
Record Number: 97
Source Name: Microsoft-Windows-WMI
Time Written: 20080913052334.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: USER-PC
Event Code: 63
Message: A provider, OffProv12, has been registered in the Windows Management Instrumentation namespace Root\MSAPPS12 to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.
Record Number: 96
Source Name: Microsoft-Windows-WMI
Time Written: 20080913052334.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: USER-PC
Event Code: 8194
Message: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005. This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {fc28639d-f7bd-4075-ab9b-02c955d78cdc}
Record Number: 66
Source Name: VSS
Time Written: 20080913052051.000000-000
Event Type: Error
User:

Computer Name: USER-PC
Event Code: 10
Message: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Record Number: 26
Source Name: Microsoft-Windows-WMI
Time Written: 20080913050900.000000-000
Event Type: Error
User:

Computer Name: USER-PC
Event Code: 1008
Message: The Windows Search Service is attempting to remove the old catalog.

Record Number: 20
Source Name: Microsoft-Windows-Search
Time Written: 20080913050846.000000-000
Event Type: Warning
User:

=====Security event log=====

Computer Name: 26L2233B1-13
Event Code: 4648
Message: A logon was attempted using explicit credentials.

Subject:
Security ID: S-1-5-18
Account Name: 26L2233B1-13$
Account Domain: WORKGROUP
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon GUID: {00000000-0000-0000-0000-000000000000}

Target Server:
Target Server Name: localhost
Additional Information: localhost

Process Information:
Process ID: 0x1fc
Process Name: C:\Windows\System32\services.exe

Network Information:
Network Address: -
Port: -

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Record Number: 5
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080913050359.538410-000
Event Type: Audit Success
User:

Computer Name: 26L2233B1-13
Event Code: 4902
Message: The Per-user audit policy table was created.

Number of Elements: 0
Policy ID: 0x5c794
Record Number: 4
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080913050357.447997-000
Event Type: Audit Success
User:

Computer Name: 26L2233B1-13
Event Code: 4624
Message: An account was successfully logged on.

Subject:
Security ID: S-1-0-0
Account Name: -
Account Domain: -
Logon ID: 0x0

Logon Type: 0

New Logon:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x4
Process Name:

Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: -
Authentication Package: -
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 3
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080913050356.418390-000
Event Type: Audit Success
User:

Computer Name: 26L2233B1-13
Event Code: 4608
Message: Windows is starting up.

This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
Record Number: 2
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080913050356.402790-000
Event Type: Audit Success
User:

Computer Name: 26L2233B1-13
Event Code: 4634
Message: An account was logged off.

Subject:
Security ID: S-1-5-7
Account Name: ANONYMOUS LOGON
Account Domain: NT AUTHORITY
Logon ID: 0x1f2f0

Logon Type: 3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Record Number: 1
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080121025830.171200-000
Event Type: Audit Success
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Common Files\DivX Shared\;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=16
"PROCESSOR_IDENTIFIER"=x86 Family 16 Model 2 Stepping 3, AuthenticAMD
"PROCESSOR_REVISION"=0203
"NUMBER_OF_PROCESSORS"=4
"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat
"DFSTRACINGON"=FALSE
"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip

-----------------EOF-----------------

#9 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:04:06 PM

Posted 02 August 2009 - 10:08 AM

You're Adobe Reader is a little out of date. It needs to be upgraded:

Please uninstall older version of Adobe Reader before installing the latest version

* Click Start
* Control Panel
* Double clicking on Add/Remove Programs
* Locate older version of Adobe Reader and click on Change/Remove to uninstall it
* Click HERE to download the latest version of Adobe Acrobat Reader.
* Select your Windows version and click onDownload. If you are using Internet Explorer, you will receive prompts. Allow the installation to be ran and it will be installed automatically for you. If you are using other browsers, it will prompt you to save a file. Save this file to your desktop and run it to install the latest version of Adobe Reader.
* Close your Internet browser and open it again.



Did you disable your COMODO Firewall?
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#10 panaceasolace

panaceasolace
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:06 PM

Posted 02 August 2009 - 08:22 PM

Thanks, I've now got 9.1 installed.

Yes, I had temporarily disabled my firewall while I ran those scans. Is there anything else that looks suspect on my scans? Thanks for your advise!

#11 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:04:06 PM

Posted 03 August 2009 - 03:07 PM

You're welcome.

You now appear to be clean. :thumbup2:

Uninstalling GMER:

for XP
Start ---> Run, copy/paste C:\WINDOWS\gmer_uninstall.cmd in the Run window and click Okay

for Vista, the command needs to be run from a command prompt with elevated permissions.



Below are some steps to follow in order to dramatically lower the chances of reinfection
You may have already implemented some of the steps below, however you should follow any steps that you have not already implemented
  • Disable and Enable System Restore. - You should disable and enable system restore to make sure there are no infected files found in a restore point. You can find instructions on how to enable and enable system restore here: Windows Vista System Restore Guide
    Do this only once and not on a regular basis.
  • Make sure you install all the security updates for Windows, Internet explorer & Microsoft Office]
    Whenever a security problem in its software is found, Microsoft will usually create a patch for it to that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC, so keeping up with these patches will help to prevent malicious software being installed on your PC
    Go here to check for & install updates to Microsoft applications
    Note: The update process uses activex, so you will need to use internet explorer for it, and allow the activex control that it wants to install
  • Keep your non-Microsoft applications updated as well
    Microsoft isn't the only company whose products can contain security vulnerabilities, to check for other vulnerable programs running on your PC that are in need of an update, you can use the Secunia Software Inspector - I suggest that you run it at least once a month
  • Make Internet Explorer more secure
    Click Start > Run
    Type Inetcpl.cpl & click OK
    Click on the Security tab
    Click Reset all zones to default level
    Make sure the Internet Zone is selected & Click Custom level
    In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • Install the MVPs hosts file, and update it regularly
    You can use the HostMan host file manager to do this automaticly if you wish.
    For more information on the hosts file, and what it can do for you, you can view the Tutorial on the Hosts file
  • Install a-squared Free & update and scan with it regularly
    a-squared free is a product from Emsi Software provided free for private use that can detect and remove a variety of malicious software. You can get it here
    Note: If you have a dialup internet connection, you may also like to install a-squared Anti-Dialer which provides some real time protection against premium rate dialers
  • Finally, this is very important. It is absolutely essential to keep all of your security programs up to date


If you have any other questions or issues feel free to ask as I will be checking back on this topic.



Other than that if there is nothing else I can do for you then I wish you good luck in the future and thank you for using our forum. :)


thewall
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#12 panaceasolace

panaceasolace
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:06 PM

Posted 03 August 2009 - 07:57 PM

Thank you again, I have followed all of your suggestions. I sent you a small tip via paypal as well, I appreciate your time.

#13 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:04:06 PM

Posted 03 August 2009 - 08:21 PM

Thank you very much. :thumbup2: I was trying to figure out who that came from.

Good luck to you!
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#14 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:04:06 PM

Posted 04 August 2009 - 07:13 AM

Since this issue appears to be resolved ... this Topic has been closed.

If your the topic starter, and need this topic reopened, please contact me via pm with the address of the thread.

Everyone else please begin a New Topic.
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users