Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

google research redirected in latest firefox and IE8


  • This topic is locked This topic is locked
18 replies to this topic

#1 nursesoldier

nursesoldier

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:08 AM

Posted 18 August 2009 - 09:14 PM

hello, nursesoldier here.
I just recovered my laptop from Advanced Virus Remover and other spyware via Malwarebye, Superantispyware, Spybot, Spywareblaster, ERUNT, AVG etc. etc. However, every one and then, clicking on a google search result would go to some random advertisement site. Would you kindly help me out.

Thank you for your help and kindness.

Extras.txt log:
OTL Extras logfile created on: 8/18/2009 9:54:23 PM - Run 1
OTL by OldTimer - Version 3.0.10.7 Folder = E:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1022.92 Mb Total Physical Memory | 338.60 Mb Available Physical Memory | 33.10% Memory free
2.40 Gb Paging File | 1.78 Gb Available in Paging File | 74.23% Paging File free
Paging file location(s): C:\pagefile.sys 1533 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 93.16 Gb Total Space | 44.37 Gb Free Space | 47.63% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 1.89 Gb Total Space | 1.70 Gb Free Space | 89.85% Space Free | Partition Type: FAT
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: IBM-3FBC926A126
Current User Name: Aaron
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

[HKEY_USERS\.DEFAULT\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_USERS\S-1-5-18\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_USERS\S-1-5-21-759709484-1590946691-836536277-1004\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\drivers\svchost.exe" = %windir%\system32\drivers\svchost.exe:*:Enabled:svchost -- File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE" = C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE:*:Enabled:Microsoft Office Word -- (Microsoft Corporation)
"%windir%\system32\drivers\svchost.exe" = %windir%\system32\drivers\svchost.exe:*:Enabled:svchost -- File not found
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" = C:\Program Files\Common Files\Real\Update_OB\realsched.exe:*:Enabled:realsched -- (RealNetworks, Inc.)
"C:\WINDOWS\system32\taskmgr.exe" = C:\WINDOWS\system32\taskmgr.exe:*:Enabled:taskmgr -- (Microsoft Corporation)
"C:\IBMTOOLS\Updater\jre\bin\javaw.exe" = C:\IBMTOOLS\Updater\jre\bin\javaw.exe:*:Enabled:javaw -- ()
"C:\Program Files\Microsoft Office\OFFICE11\POWERPNT.EXE" = C:\Program Files\Microsoft Office\OFFICE11\POWERPNT.EXE:*:Enabled:Microsoft Office PowerPoint -- (Microsoft Corporation)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{1E34AB5C-B893-4EE9-82F3-F195978D009D}" = IBM Access Support - Local Content Pack
"{1F7CCFA3-D926-4882-B2A5-A0217ED25597}" = PC-Doctor for Windows
"{2111B23F-7FDA-4A41-8309-E5A1663CA296}" = IBM ThinkPad Keyboard Customizer Utility
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 15
"{2CCBABCB-6427-4A55-B091-49864623C43F}" = Google Toolbar for Firefox
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}" = ATI HydraVision
"{46A84694-59EC-48F0-964C-7E76E9F8A2ED}" = ThinkVantage Active Protection System
"{5E863175-E85D-44A6-8968-82507D34AE7F}" = QuickTime
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{6CE96A14-61E2-48CC-837E-22710A953ADE}" = IBM Themes
"{710C0BB2-FE39-484E-BB23-C9B96835A14A}" = Access IBM Message Center
"{7148F0A8-6813-11D6-A77B-00B0D0142130}" = Java 2 Runtime Environment, SE v1.4.2_13
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{82512BC9-BD5D-4C50-BE4D-B98E7DF78687}" = IBM ThinkPad UltraNav Wizard
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{903B0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Project Professional 2003
"{90510409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Visio Professional 2003
"{90A10409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office OneNote 2003
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{98E8A2EF-4EAE-43B8-A172-74842B764777}" = InterVideo WinDVD
"{A2289997-10A3-48F2-AA03-99180D761661}" = ThinkVantage Fingerprint Software 5.6
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AB90749C-7422-4580-8A7A-66CC5E9E5F98}" = iTunes
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B5599ECB-DA72-43EE-8A30-2C80396FF8BB}" = Access IBM
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF44C7A5-5705-41E4-BE84-A9A42977AB05}" = alm
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{EA664480-3844-11D5-8C25-444553540000}" = IBM TrackPoint Accessibility Features
"{F151F2B3-0C32-44D3-90E2-E639B8024622}" = Rescue and Recovery
"{F1F721BF-040C-4096-988A-1DB01EB73B0C}" = TPNala Wallpaper
"{FC081D4D-DF1B-4CF1-B530-027E4118D846}" = ThinkPad Configuration
"AC3Filter" = AC3Filter (remove only)
"Access IBM Tools" = Access IBM Tools
"Ad-Aware SE Personal" = Ad-Aware SE Personal
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Agere Systems Soft Modem" = Agere Systems AC'97 Modem
"ATI Display Driver" = ATI Display Driver
"Audacity_is1" = Audacity 1.2.6
"AVG8Uninstall" = AVG Free 8.5
"CNXT_MODEM_PCI_VEN_8086&DEV_24C6&SUBSYS_05591014" = ThinkPad Integrated 56K Modem
"CutePDF Writer Installation" = CutePDF Writer 2.7
"ERUNT_is1" = ERUNT 1.1j
"EZ Gig II" = Apricorn EZ Gig II
"ffdshow_is1" = ffdshow [rev 1082] [2007-03-28]
"Free YouTube Download_is1" = Free YouTube Download 2.3
"Free YouTube to Mp3 Converter_is1" = Free YouTube to Mp3 Converter version 3.2
"Google Updater" = Google Updater
"GoogleVideoPlayer" = Google Video Player
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"JRE 1.3.1_01" = Java 2 Runtime Environment Standard Edition v1.3.1_01
"LiveUpdate" = LiveUpdate 3.0 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.2)" = Mozilla Firefox (3.5.2)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Power Management Driver" = ThinkPad Power Management Driver
"PROSet" = Intel® PRO Network Adapters and Drivers
"RealPlayer 6.0" = RealPlayer
"SpywareBlaster_is1" = SpywareBlaster 4.2
"SynTPDeinstKey" = IBM ThinkPad UltraNav Driver
"ThinkPad FullScreen Magnifier" = ThinkPad FullScreen Magnifier
"ThinkPadSoftwareInstaller" = ThinkPad Software Installer
"Uninstall_is1" = Uninstall 1.0.0.1
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/1/2009 12:13:40 AM | Computer Name = IBM-3FBC926A126 | Source = Application Error | ID = 1000
Description = Faulting application firefox.exe, version 1.9.0.3474, faulting module
xul.dll, version 1.9.0.3474, fault address 0x005f0295.

Error - 8/6/2009 2:25:22 AM | Computer Name = IBM-3FBC926A126 | Source = Application Hang | ID = 1002
Description = Hanging application realplay.exe, version 11.0.0.446, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 8/6/2009 2:25:22 AM | Computer Name = IBM-3FBC926A126 | Source = Application Hang | ID = 1002
Description = Hanging application realplay.exe, version 11.0.0.446, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 8/11/2009 6:19:34 PM | Computer Name = IBM-3FBC926A126 | Source = Application Hang | ID = 1002
Description = Hanging application FreeYouTubeToMP3Converter.exe, version 3.1.5.55,
hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 8/17/2009 5:53:32 PM | Computer Name = IBM-3FBC926A126 | Source = Application Error | ID = 1000
Description = Faulting application 010.exe, version 0.0.0.0, faulting module 010.exe,
version 0.0.0.0, fault address 0x00007ad2.

Error - 8/17/2009 6:01:48 PM | Computer Name = IBM-3FBC926A126 | Source = Application Error | ID = 1000
Description = Faulting application 302.exe, version 0.0.0.0, faulting module 302.exe,
version 0.0.0.0, fault address 0x00007ad2.

Error - 8/17/2009 6:41:00 PM | Computer Name = IBM-3FBC926A126 | Source = JavaQuickStarterService | ID = 1
Description =

Error - 8/17/2009 7:14:33 PM | Computer Name = IBM-3FBC926A126 | Source = JavaQuickStarterService | ID = 1
Description =

Error - 8/17/2009 11:07:53 PM | Computer Name = IBM-3FBC926A126 | Source = Application Hang | ID = 1002
Description = Hanging application AcroRd32.exe, version 8.1.0.137, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 8/18/2009 4:45:37 PM | Computer Name = IBM-3FBC926A126 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16876, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 8/18/2009 5:49:27 PM | Computer Name = IBM-3FBC926A126 | Source = Service Control Manager | ID = 7034
Description = The TVT Backup Service service terminated unexpectedly. It has done
this 1 time(s).

Error - 8/18/2009 5:49:28 PM | Computer Name = IBM-3FBC926A126 | Source = Service Control Manager | ID = 7034
Description = The TVT Scheduler service terminated unexpectedly. It has done this
1 time(s).

Error - 8/18/2009 5:49:28 PM | Computer Name = IBM-3FBC926A126 | Source = Service Control Manager | ID = 7031
Description = The TVT Windows Update Monitor service terminated unexpectedly. It
has done this 1 time(s). The following corrective action will be taken in 500
milliseconds: Restart the service.

Error - 8/18/2009 5:49:30 PM | Computer Name = IBM-3FBC926A126 | Source = Service Control Manager | ID = 7031
Description = The Windows CardSpace service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 120000 milliseconds:
Restart the service.

Error - 8/18/2009 5:51:35 PM | Computer Name = IBM-3FBC926A126 | Source = Service Control Manager | ID = 7000
Description = The AntipyProex service failed to start due to the following error:
%%2

Error - 8/18/2009 5:51:35 PM | Computer Name = IBM-3FBC926A126 | Source = Service Control Manager | ID = 7023
Description = The USB Audio (WDM)Helper service terminated with the following error:
%%126

Error - 8/18/2009 5:51:36 PM | Computer Name = IBM-3FBC926A126 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Beep

Error - 8/18/2009 6:27:17 PM | Computer Name = IBM-3FBC926A126 | Source = Service Control Manager | ID = 7000
Description = The AntipyProex service failed to start due to the following error:
%%2

Error - 8/18/2009 6:27:17 PM | Computer Name = IBM-3FBC926A126 | Source = Service Control Manager | ID = 7023
Description = The USB Audio (WDM)Helper service terminated with the following error:
%%126

Error - 8/18/2009 6:27:17 PM | Computer Name = IBM-3FBC926A126 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Beep


< End of report >

OTL.txt log:

OTL logfile created on: 8/18/2009 9:54:23 PM - Run 1
OTL by OldTimer - Version 3.0.10.7 Folder = E:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1022.92 Mb Total Physical Memory | 338.60 Mb Available Physical Memory | 33.10% Memory free
2.40 Gb Paging File | 1.78 Gb Available in Paging File | 74.23% Paging File free
Paging file location(s): C:\pagefile.sys 1533 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 93.16 Gb Total Space | 44.37 Gb Free Space | 47.63% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 1.89 Gb Total Space | 1.70 Gb Free Space | 89.85% Space Free | Partition Type: FAT
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: IBM-3FBC926A126
Current User Name: Aaron
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2005/11/11 02:33:00 | 00,073,782 | ---- | M] () -- C:\WINDOWS\System32\ibmpmsvc.exe
PRC - [2005/03/22 19:55:02 | 00,360,448 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe
PRC - [2005/03/22 19:55:02 | 00,360,448 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe
PRC - [2008/04/13 20:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2009/08/17 22:33:45 | 02,007,832 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgtray.exe
PRC - [2008/06/06 18:21:04 | 00,181,536 | ---- | M] (Lenovo.) -- C:\WINDOWS\System32\TpShocks.exe
PRC - [2003/06/27 09:53:32 | 00,088,363 | ---- | M] (Agere Systems) -- C:\WINDOWS\AGRSMMSG.exe
PRC - [2002/12/24 06:01:00 | 00,204,800 | ---- | M] (IBM Corp.) -- C:\Program Files\ThinkPad\Utilities\EzEjMnAp.Exe
PRC - [2008/09/02 14:18:43 | 00,185,896 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2003/08/07 19:57:52 | 00,094,208 | ---- | M] () -- C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
PRC - [2003/07/31 19:24:24 | 00,512,000 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
PRC - [2003/07/31 19:25:34 | 00,110,592 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2004/07/27 16:50:18 | 00,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
PRC - [2009/07/25 05:23:12 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2007/04/06 02:23:52 | 00,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2003/06/23 11:34:18 | 00,077,824 | ---- | M] () -- C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
PRC - [2002/01/10 19:01:34 | 00,065,536 | ---- | M] (IBM Corporation) -- C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
PRC - [2006/07/25 19:03:42 | 00,100,032 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
PRC - [2009/08/17 22:33:42 | 00,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe
PRC - [2009/07/25 05:23:10 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2004/09/29 13:14:36 | 00,069,632 | ---- | M] (HP) -- C:\WINDOWS\System32\HPZipm12.exe
PRC - [2009/08/17 22:33:51 | 00,486,680 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgrsx.exe
PRC - [2008/05/14 15:58:54 | 00,644,408 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
PRC - [2008/05/14 16:21:16 | 00,037,416 | ---- | M] (Lenovo.) -- C:\WINDOWS\System32\TPHDEXLG.exe
PRC - [2003/07/11 22:19:22 | 00,032,768 | ---- | M] () -- C:\WINDOWS\System32\TpKmpSVC.exe
PRC - [2008/05/14 16:25:12 | 00,520,192 | ---- | M] () -- C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
PRC - [2008/05/14 16:32:28 | 00,950,272 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
PRC - [2008/05/14 16:42:30 | 01,155,072 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
PRC - [2008/05/09 05:50:46 | 00,253,952 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe
PRC - [2009/03/08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe
PRC - [2009/03/08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe
PRC - [2009/03/08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe
PRC - [2009/03/08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe
PRC - [2007/05/11 03:06:38 | 00,341,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
PRC - [2009/08/18 18:23:08 | 00,514,048 | ---- | M] (OldTimer Tools) -- E:\OTL.exe

========== Win32 Services (SafeList) ==========

SRV - File not found -- -- (AntipPro2009_100 [Auto | Stopped])
SRV - [2008/07/25 11:16:40 | 00,034,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2005/03/22 19:55:02 | 00,360,448 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe -- (Ati HotKey Poller [Auto | Running])
SRV - [2006/07/25 19:03:42 | 00,100,032 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler [Auto | Running])
SRV - [2009/08/17 22:33:42 | 00,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe -- (avg8wd [Auto | Running])
SRV - [2008/07/25 11:17:02 | 00,069,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2008/07/29 21:10:04 | 00,046,104 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped])
SRV - [2009/03/21 14:19:15 | 00,183,280 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc [Auto | Stopped])
SRV - [2008/04/13 20:12:02 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2005/11/11 02:33:00 | 00,073,782 | ---- | M] () -- C:\WINDOWS\System32\ibmpmsvc.exe -- (IBMPMSVC [Auto | Running])
SRV - [2008/07/29 19:24:50 | 00,881,664 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped])
SRV - [2007/03/14 19:05:42 | 00,500,800 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service [On_Demand | Stopped])
SRV - [2008/04/13 20:11:55 | 00,028,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\irmon.dll -- (Irmon [Auto | Running])
SRV - [2009/07/25 05:23:10 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running])
SRV - [2006/07/25 19:03:42 | 02,119,360 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE -- (LiveUpdate [On_Demand | Stopped])
SRV - [2008/07/29 19:16:38 | 00,132,096 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped])
SRV - [2003/07/28 16:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2004/09/29 13:14:36 | 00,069,632 | ---- | M] (HP) -- C:\WINDOWS\System32\HPZipm12.exe -- (Pml Driver HPZ12 [Auto | Running])
SRV - [2008/05/14 15:58:54 | 00,644,408 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe -- (ThinkVantage Registry Monitor Service [Auto | Running])
SRV - [2008/05/14 16:21:16 | 00,037,416 | ---- | M] (Lenovo.) -- C:\WINDOWS\System32\TPHDEXLG.exe -- (TPHDEXLGSVC [Auto | Running])
SRV - [2003/07/11 22:19:22 | 00,032,768 | ---- | M] () -- C:\WINDOWS\System32\TpKmpSVC.exe -- (TpKmpSVC [Auto | Running])
SRV - [2008/05/14 16:25:12 | 00,520,192 | ---- | M] () -- C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe -- (TVT Backup Protection Service [Auto | Running])
SRV - [2008/05/14 16:32:28 | 00,950,272 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe -- (TVT Backup Service [Auto | Running])
SRV - [2008/05/14 16:42:30 | 01,155,072 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe -- (TVT Scheduler [Auto | Running])
SRV - [2008/05/09 05:50:46 | 00,253,952 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe -- (TVT_UpdateMonitor [Auto | Running])
SRV - [2006/10/18 21:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])

========== Driver Services (SafeList) ==========

DRV - [2001/08/17 16:20:04 | 00,096,256 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\drivers\ac97intc.sys -- (ac97intc [On_Demand | Stopped])
DRV - [2003/10/23 12:17:10 | 00,100,384 | ---- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\System32\drivers\aeaudio.sys -- (aeaudio [On_Demand | Running])
DRV - [2003/06/27 09:53:44 | 01,196,352 | ---- | M] (Agere Systems) -- C:\WINDOWS\System32\DRIVERS\AGRSM.sys -- (AgereSoftModem [On_Demand | Stopped])
DRV - [2001/08/17 17:51:56 | 00,005,248 | ---- | M] (Acer Laboratories Inc.) -- C:\WINDOWS\System32\DRIVERS\aliide.sys -- (AliIde [Disabled | Stopped])
DRV - [2008/04/13 14:36:39 | 00,043,008 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\DRIVERS\amdagp.sys -- (amdagp [Disabled | Stopped])
DRV - [2001/08/17 17:52:00 | 00,026,496 | ---- | M] (Advanced System Products, Inc.) -- C:\WINDOWS\System32\DRIVERS\asc.sys -- (asc [Disabled | Stopped])
DRV - [2001/08/17 17:51:58 | 00,014,848 | ---- | M] (Advanced System Products, Inc.) -- C:\WINDOWS\System32\DRIVERS\asc3550.sys -- (asc3550 [Disabled | Stopped])
DRV - [2005/03/22 20:00:58 | 01,034,752 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\DRIVERS\ati2mtag.sys -- (ati2mtag [On_Demand | Running])
DRV - [2005/05/17 10:20:06 | 00,015,872 | ---- | M] (Atmel, Inc.) -- C:\WINDOWS\System32\DRIVERS\atmeltpm.sys -- (atmeltpm [On_Demand | Running])
DRV - [2009/08/17 22:33:50 | 00,335,240 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86 [System | Running])
DRV - [2009/08/17 22:33:51 | 00,027,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86 [System | Running])
DRV - [2001/08/17 17:51:54 | 00,006,656 | ---- | M] (CMD Technology, Inc.) -- C:\WINDOWS\System32\DRIVERS\cmdide.sys -- (CmdIde [Disabled | Stopped])
DRV - [2001/08/17 17:52:16 | 00,179,584 | ---- | M] (Mylex Corporation) -- C:\WINDOWS\System32\DRIVERS\dac2w2k.sys -- (dac2w2k [Disabled | Stopped])
DRV - [2003/01/19 19:29:18 | 00,103,936 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\DRIVERS\e1000325.sys -- (E1000 [On_Demand | Running])
DRV - [2004/10/14 15:30:44 | 00,155,648 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\DRIVERS\e100b325.sys -- (E100B [On_Demand | Stopped])
DRV - [2007/04/20 21:54:41 | 00,028,800 | ---- | M] (Apricorn) -- C:\WINDOWS\System32\DRIVERS\ezgfsfilt.sys -- (ezgfsfilt [Auto | Running])
DRV - [2007/04/20 21:54:41 | 00,213,696 | ---- | M] (Apricorn) -- C:\WINDOWS\system32\DRIVERS\ezgmntr.sys -- (ezgmntr [Boot | Running])
DRV - [2006/09/19 16:44:04 | 00,015,664 | ---- | M] (GEAR Software Inc.) -- C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys -- (GEARAspiWDM [On_Demand | Stopped])
DRV - [2002/11/18 21:20:44 | 00,030,976 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\DRIVERS\gv3.sys -- (gv3 [On_Demand | Stopped])
DRV - [2004/12/14 12:07:44 | 00,051,120 | ---- | M] (HP) -- C:\WINDOWS\System32\DRIVERS\HPZid412.sys -- (HPZid412 [On_Demand | Stopped])
DRV - [2004/12/14 12:07:44 | 00,016,496 | ---- | M] (HP) -- C:\WINDOWS\System32\DRIVERS\HPZipr12.sys -- (HPZipr12 [On_Demand | Stopped])
DRV - [2004/12/14 12:07:44 | 00,021,744 | ---- | M] (HP) -- C:\WINDOWS\System32\DRIVERS\HPZius12.sys -- (HPZius12 [On_Demand | Stopped])
DRV - [2005/01/25 15:26:36 | 00,207,616 | ---- | M] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\DRIVERS\HSFHWICH.sys -- (HSFHWICH [On_Demand | Running])
DRV - [2005/01/25 15:27:14 | 01,038,208 | ---- | M] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\DRIVERS\HSF_DPV.sys -- (HSF_DPV [On_Demand | Running])
DRV - [2005/11/11 02:33:00 | 00,010,112 | ---- | M] (Lenovo.) -- C:\WINDOWS\System32\DRIVERS\ibmpmdrv.sys -- (IBMPMDRV [On_Demand | Running])
DRV - [2004/08/04 02:41:36 | 00,606,684 | ---- | M] (LT) -- C:\WINDOWS\System32\DRIVERS\ltmdmnt.sys -- (ltmodem5 [On_Demand | Stopped])
DRV - [2004/03/17 12:04:14 | 00,013,059 | ---- | M] (Conexant) -- C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys -- (mdmxsdk [Auto | Running])
DRV - [2001/08/17 17:52:12 | 00,017,280 | ---- | M] (American Megatrends Inc.) -- C:\WINDOWS\System32\DRIVERS\mraid35x.sys -- (mraid35x [Disabled | Stopped])
DRV - [2008/04/13 14:54:36 | 00,028,672 | ---- | M] (National Semiconductor Corporation) -- C:\WINDOWS\System32\DRIVERS\nscirda.sys -- (NSCIRDA [On_Demand | Running])
DRV - [2000/03/23 01:42:24 | 00,044,192 | ---- | M] (PC-Doctor Inc.) -- C:\WINDOWS\System32\drivers\PcdrNt.sys -- (PcdrNt [On_Demand | Stopped])
DRV - [2003/02/14 17:16:32 | 00,096,256 | ---- | M] (Cisco Systems) -- C:\WINDOWS\System32\DRIVERS\PCX504.sys -- (PCX504 [On_Demand | Stopped])
DRV - [2001/09/13 10:58:02 | 00,007,012 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\PMEMNT.SYS -- (PMEM [Auto | Running])
DRV - [2009/05/07 00:20:22 | 00,030,144 | ---- | M] (Lenovo (United States) Inc.) -- C:\WINDOWS\System32\DRIVERS\psadd.sys -- (psadd [On_Demand | Running])
DRV - [2002/08/29 09:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2008/11/21 17:47:48 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2001/08/17 17:52:20 | 00,040,320 | ---- | M] (QLogic Corporation) -- C:\WINDOWS\System32\DRIVERS\ql1080.sys -- (ql1080 [Disabled | Stopped])
DRV - [2001/08/17 17:52:20 | 00,045,312 | ---- | M] (QLogic Corporation) -- C:\WINDOWS\System32\DRIVERS\ql12160.sys -- (ql12160 [Disabled | Stopped])
DRV - [2001/08/17 17:52:18 | 00,049,024 | ---- | M] (QLogic Corporation) -- C:\WINDOWS\System32\DRIVERS\ql1280.sys -- (ql1280 [Disabled | Stopped])
DRV - [2007/02/12 05:41:00 | 00,306,304 | ---- | M] (Realtek Semiconductor Corporation ) -- C:\WINDOWS\System32\DRIVERS\rtl8185.sys -- (rtl8185 [On_Demand | Stopped])
DRV - [2001/11/01 06:57:14 | 00,095,104 | ---- | M] (S3 Graphics, Inc.) -- C:\WINDOWS\System32\DRIVERS\s3ssavm.sys -- (S3SSavage [On_Demand | Stopped])
DRV - [2009/04/28 11:33:42 | 00,009,968 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV [System | Running])
DRV - [2009/04/28 11:33:44 | 00,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM [On_Demand | Stopped])
DRV - [2009/08/17 17:56:48 | 00,074,480 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys -- (SASKUTIL [System | Running])
DRV - [2007/11/13 06:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])
DRV - [2008/05/14 16:21:16 | 00,114,728 | ---- | M] (Lenovo.) -- C:\WINDOWS\System32\DRIVERS\Apsx86.sys -- (Shockprf [Boot | Running])
DRV - [2008/04/13 14:36:39 | 00,040,960 | ---- | M] (Silicon Integrated Systems Corporation) -- C:\WINDOWS\System32\DRIVERS\sisagp.sys -- (sisagp [Disabled | Stopped])
DRV - [2006/10/02 01:55:00 | 00,014,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\Smapint.sys -- (Smapint [System | Running])
DRV - [2007/08/14 15:46:36 | 00,010,896 | ---- | M] (UPEK Inc.) -- C:\Program Files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys -- (smihlp [Auto | Running])
DRV - [2003/10/27 15:09:06 | 00,578,432 | ---- | M] (Analog Devices, Inc.) -- C:\WINDOWS\System32\drivers\smwdm.sys -- (smwdm [On_Demand | Running])
DRV - [2007/04/20 21:54:40 | 00,082,464 | ---- | M] (Acronis) -- C:\WINDOWS\system32\DRIVERS\snapman.sys -- (snapman [Boot | Running])
DRV - [2001/08/17 18:07:44 | 00,019,072 | ---- | M] (Adaptec, Inc.) -- C:\WINDOWS\System32\DRIVERS\sparrow.sys -- (Sparrow [Disabled | Stopped])
DRV - [2001/08/17 18:07:34 | 00,016,256 | ---- | M] (Symbios Logic Inc.) -- C:\WINDOWS\System32\DRIVERS\symc810.sys -- (symc810 [Disabled | Stopped])
DRV - [2001/08/17 18:07:36 | 00,032,640 | ---- | M] (LSI Logic) -- C:\WINDOWS\System32\DRIVERS\symc8xx.sys -- (symc8xx [Disabled | Stopped])
DRV - [2001/08/17 18:07:40 | 00,028,384 | ---- | M] (LSI Logic) -- C:\WINDOWS\System32\DRIVERS\sym_hi.sys -- (sym_hi [Disabled | Stopped])
DRV - [2001/08/17 18:07:42 | 00,030,688 | ---- | M] (LSI Logic) -- C:\WINDOWS\System32\DRIVERS\sym_u3.sys -- (sym_u3 [Disabled | Stopped])
DRV - [2003/07/31 19:04:04 | 00,270,288 | ---- | M] (Synaptics, Inc.) -- C:\WINDOWS\System32\DRIVERS\SynTP.sys -- (SynTP [On_Demand | Running])
DRV - [2007/08/14 15:25:52 | 00,047,376 | ---- | M] (UPEK Inc.) -- C:\WINDOWS\System32\Drivers\tcusb.sys -- (TcUsb [On_Demand | Running])
DRV - [2006/10/02 01:55:00 | 00,009,343 | ---- | M] () -- C:\WINDOWS\System32\drivers\TDSMAPI.SYS -- (TDSMAPI [System | Running])
DRV - [2008/05/14 16:21:16 | 00,019,496 | ---- | M] (Lenovo.) -- C:\WINDOWS\System32\DRIVERS\ApsHM86.sys -- (TPDIGIMN [Boot | Running])
DRV - [2003/06/23 11:33:58 | 00,016,162 | ---- | M] (IBM Corporation) -- C:\WINDOWS\System32\drivers\TPHKDRV.sys -- (TPHKDRV [System | Running])
DRV - [2003/01/17 05:32:00 | 00,015,360 | ---- | M] (IBM Corp.) -- C:\WINDOWS\System32\drivers\Tppwr.sys -- (TPPWR [System | Running])
DRV - [2009/05/07 00:22:42 | 00,033,536 | ---- | M] (Lenovo) -- C:\WINDOWS\System32\DRIVERS\tvtfilter.sys -- (tvtfilter [Auto | Running])
DRV - [2008/02/22 16:54:40 | 00,037,312 | ---- | M] (Lenovo (United States) Inc.) -- C:\WINDOWS\System32\DRIVERS\Tvti2c.sys -- (TVTI2C [On_Demand | Running])
DRV - [2008/05/09 05:50:48 | 00,046,144 | ---- | M] (Lenovo) -- C:\WINDOWS\System32\DRIVERS\tvtumon.sys -- (tvtumon [System | Running])
DRV - [2001/08/17 17:48:14 | 00,011,520 | ---- | M] (IBM Corporation) -- C:\WINDOWS\System32\DRIVERS\TwoTrack.sys -- (TwoTrack [On_Demand | Stopped])
DRV - [2001/08/17 17:52:22 | 00,036,736 | ---- | M] (Promise Technology, Inc.) -- C:\WINDOWS\System32\DRIVERS\ultra.sys -- (ultra [Disabled | Stopped])
DRV - [2008/04/13 14:45:12 | 00,060,032 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbaudio.sys -- (usbaudio [On_Demand | Stopped])
DRV - [2008/05/27 02:08:26 | 02,216,064 | ---- | M] (Intel® Corporation) -- C:\WINDOWS\System32\DRIVERS\w29n51.sys -- (w29n51 [On_Demand | Running])
DRV - [2003/03/12 18:16:44 | 02,390,528 | ---- | M] (Intel® Corporation) -- C:\WINDOWS\System32\DRIVERS\w70n51.sys -- (w70n51 [On_Demand | Stopped])
DRV - [2005/01/25 15:26:28 | 00,703,616 | ---- | M] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys -- (winachsf [On_Demand | Running])

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default = A3 08 78 01 FB D2 1E 43 9C 15 53 E0 A9 65 40 C6 [binary data]
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome
IE - URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default = A3 08 78 01 FB D2 1E 43 9C 15 53 E0 A9 65 40 C6 [binary data]
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome
IE - URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Default = A3 08 78 01 FB D2 1E 43 9C 15 53 E0 A9 65 40 C6 [binary data]
IE - HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Default = A3 08 78 01 FB D2 1E 43 9C 15 53 E0 A9 65 40 C6 [binary data]
IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-759709484-1590946691-836536277-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-759709484-1590946691-836536277-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch
IE - HKU\S-1-5-21-759709484-1590946691-836536277-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.uscis.gov/
IE - URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
IE - URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-759709484-1590946691-836536277-1004\S-1-5-21-759709484-1590946691-836536277-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
FF - prefs.js..browser.startup.homepage: "http://www.uscis.gov/"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.5
FF - prefs.js..extensions.enabledItems: avg@igeared:2.507.024.001
FF - prefs.js..extensions.enabledItems: {3112ca9c-de6d-4884-a869-9855de68056c}:3.1.20081127W
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}:6.0.14
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15
FF - prefs.js..extensions.enabledItems: dvscontextmenuy@dvdvideosoft.com:1.0
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.4.4.118
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.2
FF - prefs.js..keyword.URL: "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p="

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/09/02 14:19:48 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG8\Firefox [2009/06/26 21:50:42 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Documents and Settings\All Users\Application Data\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2008/11/24 10:31:30 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG8\Toolbar\Firefox\avg@igeared [2009/08/18 15:28:11 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/08/18 18:32:13 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/03/10 23:44:49 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/08/18 17:54:01 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/08/18 17:54:00 | 00,000,000 | ---D | M]

[2008/11/30 14:03:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Aaron\Application Data\mozilla\Extensions
[2008/11/30 14:03:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Aaron\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/08/16 21:50:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Aaron\Application Data\mozilla\Firefox\Profiles\uxdqwci5.default\extensions
[2008/12/18 00:52:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Aaron\Application Data\mozilla\Firefox\Profiles\uxdqwci5.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009/08/12 19:59:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Aaron\Application Data\mozilla\Firefox\Profiles\uxdqwci5.default\extensions\toolbar@ask.com
[2009/08/18 17:54:10 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2008/09/02 14:16:02 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009/08/18 17:54:00 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2008/09/02 13:32:45 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
[2009/03/10 23:45:04 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
[2009/04/23 21:12:13 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009/06/09 23:32:29 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
[2009/08/11 21:48:50 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
[2008/09/02 14:16:02 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\google-ggic@partners.mozilla.com
[2009/07/30 07:26:53 | 00,023,544 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/07/30 07:26:54 | 00,137,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/07/25 05:23:01 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeploytk.dll
[2008/11/21 17:45:04 | 01,332,224 | ---- | M] (DivX,Inc.) -- C:\Program Files\mozilla firefox\plugins\npdivx32.dll
[2008/11/21 17:45:26 | 00,098,304 | ---- | M] (DivX, Inc) -- C:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll
[2009/07/30 07:26:55 | 00,065,016 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2007/05/10 22:52:34 | 00,095,864 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll
[2008/09/02 14:19:30 | 00,144,984 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\mozilla firefox\plugins\nppl3260.dll
[2008/09/02 14:20:04 | 00,008,192 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\mozilla firefox\plugins\nprjplug.dll
[2008/09/02 14:19:13 | 00,094,208 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\mozilla firefox\plugins\nprpjplug.dll
[2009/07/30 03:24:20 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/07/30 03:24:20 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/08/18 17:54:28 | 00,001,473 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg_igeared.xml
[2009/07/30 03:24:20 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/07/30 03:24:20 | 00,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/07/30 03:24:20 | 00,002,371 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/07/30 03:24:20 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2009/07/30 03:24:20 | 00,000,792 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-759709484-1590946691-836536277-1004\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (Google Inc.)
O3 - HKU\S-1-5-21-759709484-1590946691-836536277-1004\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
O3 - HKU\S-1-5-21-759709484-1590946691-836536277-1004\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AGRSMMSG] C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\irprops.CPL (Microsoft Corporation)
O4 - HKLM..\Run: [BMMGAG] C:\Program Files\ThinkPad\Utilities\PWRMONIT.DLL (IBM Corp.)
O4 - HKLM..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE ()
O4 - HKLM..\Run: [EZEJMNAP] C:\Program Files\ThinkPad\Utilities\EzEjMnAp.Exe (IBM Corp.)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [PSQLLauncher] C:\Program Files\ThinkVantage Fingerprint Software\launcher.exe (UPEK Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Computer, Inc.)
O4 - HKLM..\Run: [S3TRAY2] C:\WINDOWS\System32\S3Tray2.exe (S3 Graphics, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [TP4EX] C:\WINDOWS\System32\tp4ex.exe (IBM Corporation)
O4 - HKLM..\Run: [TPHOTKEY] C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe ()
O4 - HKLM..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe (IBM Corp.)
O4 - HKLM..\Run: [TpShocks] C:\WINDOWS\System32\TpShocks.exe (Lenovo.)
O4 - HKU\S-1-5-21-759709484-1590946691-836536277-1004..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\Aaron\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-759709484-1590946691-836536277-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-759709484-1590946691-836536277-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-759709484-1590946691-836536277-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-759709484-1590946691-836536277-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-759709484-1590946691-836536277-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O7 - HKU\S-1-5-21-759709484-1590946691-836536277-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKU\S-1-5-21-759709484-1590946691-836536277-1004_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Save YouTube Video - C:\Program Files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll (DVSTeam)
O8 - Extra context menu item: Save YouTube Video as MP3 - C:\Program Files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll (DVSTeam)
O8 - Extra context menu item: Subscribe in default RSS reader - C:\Documents and Settings\Aaron\Application Data\RssBandit\iecontext_subscribefeed.htm ()
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (Intertrust Technologies, Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-759709484-1590946691-836536277-1004\..Trusted Domains: 25 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {036F8A56-0BC8-4607-8F98-D3231E6FF5ED} http://conference.cpbis.gatech.edu/SiteRoo...raUpdaterAx.cab (Reg Error: Key error.)
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} http://www-307.ibm.com/pc/support/acpir.cab (IASRunner Class)
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} http://download.microsoft.com/download/7/1...20/pmupd806.exe (MSN Money Charting)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/...can8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {897520CD-B1C8-4745-B46D-B03CF8701BB8} http://jigsaw.com/cab/app/JigsawContactFinder.CAB (Jigsaw Contact Finder)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA} http://java.sun.com/products/plugin/1.3.1/...-131_01-win.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\Ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\psfus: DllName - C:\WINDOWS\system32\psqlpwd.dll - C:\WINDOWS\System32\psqlpwd.dll (UPEK Inc.)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/01/20 02:31:54 | 00,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/08/18 13:11:26 | 00,000,361 | ---- | M] () - E:\autorun.inf -- [ FAT ]
O33 - MountPoints2\{0f2f7430-853d-11de-b752-0013cece8a1b}\Shell\AutoRun\command - "" = E:\BOOTEX\thumbcache_131.exe -- [2009/08/17 16:53:08 | 00,131,072 | RHS- | M] ()
O33 - MountPoints2\{0f2f7430-853d-11de-b752-0013cece8a1b}\Shell\explore\command - "" = E:\BOOTEX\thumbcache_131.exe -- [2009/08/17 16:53:08 | 00,131,072 | RHS- | M] ()
O33 - MountPoints2\{0f2f7430-853d-11de-b752-0013cece8a1b}\Shell\open\command - "" = E:\.\\BOOTEX\thumbcache_131.exe -- [2009/08/17 16:53:08 | 00,131,072 | RHS- | M] ()
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/08/18 21:53:08 | 00,514,048 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Aaron\Desktop\OTL.exe
[2009/08/18 21:53:08 | 00,472,064 | ---- | C] ( ) -- C:\Documents and Settings\Aaron\Desktop\RootRepeal.exe
[2009/08/18 21:53:06 | 33,961,728 | ---- | C] () -- C:\Documents and Settings\Aaron\Desktop\avira_antivir_personal_en.exe
[2009/08/18 21:53:06 | 02,062,665 | ---- | C] () -- C:\Documents and Settings\Aaron\Desktop\spywareguardsetup.exe
[2009/08/18 18:23:19 | 00,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
[2009/08/18 18:21:39 | 00,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2009/08/18 18:19:29 | 00,246,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieproxy.dll
[2009/08/18 18:19:29 | 00,012,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\xpshims.dll
[2009/08/18 18:18:48 | 00,101,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iecompat.dll
[2009/08/18 18:13:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Aaron\My Documents\Downloads
[2009/08/18 15:29:51 | 00,000,000 | ---D | C] -- C:\WINDOWS\BDOSCAN8
[2009/08/18 15:02:04 | 00,000,000 | ---D | C] -- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
[2009/08/18 15:02:04 | 00,000,000 | ---D | C] -- C:\Program Files\File Scanner Library (Spybot - Search & Destroy)
[2009/08/18 14:08:39 | 00,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2009/08/18 14:08:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2009/08/18 14:04:29 | 00,181,248 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Aaron\Desktop\OTC.exe
[2009/08/18 14:04:28 | 08,050,536 | ---- | C] (Mozilla) -- C:\Documents and Settings\Aaron\Desktop\Firefox Setup 3.5.2.exe
[2009/08/18 14:04:28 | 00,000,361 | ---- | C] () -- C:\Documents and Settings\Aaron\Desktop\autorun.inf
[2009/08/18 13:48:35 | 00,000,000 | ---D | C] -- C:\Avenger
[2009/08/18 13:40:04 | 00,731,136 | ---- | C] () -- C:\Documents and Settings\Aaron\Desktop\avenger.exe
[2009/08/18 13:36:04 | 00,000,000 | -HSD | C] -- C:\RECYCLER
[2009/08/18 13:27:42 | 03,597,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\mshtml.dll
[2009/08/18 13:27:42 | 02,189,056 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\ntoskrnl.exe
[2009/08/18 13:27:42 | 02,066,048 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\ntkrnlpa.exe
[2009/08/18 13:27:42 | 01,614,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\sfcfiles.dll
[2009/08/18 13:27:42 | 01,033,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\explorer.exe
[2009/08/18 13:27:42 | 00,989,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\kernel32.dll
[2009/08/18 13:27:42 | 00,927,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\mfc40u.dll
[2009/08/18 13:27:42 | 00,827,392 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\wininet.dll
[2009/08/18 13:27:42 | 00,792,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\comres.dll
[2009/08/18 13:27:42 | 00,617,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\comctl32.dll
[2009/08/18 13:27:42 | 00,578,560 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\user32.dll
[2009/08/18 13:27:42 | 00,574,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\ntfs.sys
[2009/08/18 13:27:42 | 00,507,904 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\winlogon.exe
[2009/08/18 13:27:42 | 00,435,200 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\ntmssvc.dll
[2009/08/18 13:27:42 | 00,409,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\qmgr.dll
[2009/08/18 13:27:42 | 00,407,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\netlogon.dll
[2009/08/18 13:27:42 | 00,401,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\rpcss.dll
[2009/08/18 13:27:42 | 00,361,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\tcpip.sys
[2009/08/18 13:27:42 | 00,295,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\termsrv.dll
[2009/08/18 13:27:42 | 00,182,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\ndis.sys
[2009/08/18 13:27:42 | 00,181,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\scecli.dll
[2009/08/18 13:27:42 | 00,171,008 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\srsvc.dll
[2009/08/18 13:27:42 | 00,167,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\appmgmts.dll
[2009/08/18 13:27:42 | 00,142,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\aec.sys
[2009/08/18 13:27:42 | 00,110,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\services.exe
[2009/08/18 13:27:42 | 00,110,080 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\imm32.dll
[2009/08/18 13:27:42 | 00,088,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\rasauto.dll
[2009/08/18 13:27:42 | 00,082,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\ws2_32.dll
[2009/08/18 13:27:42 | 00,057,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\spoolsv.exe
[2009/08/18 13:27:42 | 00,051,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\wuauclt.exe
[2009/08/18 13:27:42 | 00,036,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\ip6fw.sys
[2009/08/18 13:27:42 | 00,033,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\msgsvc.dll
[2009/08/18 13:27:42 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\userinit.exe
[2009/08/18 13:27:42 | 00,024,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\kbdclass.sys
[2009/08/18 13:27:42 | 00,022,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\lpk.dll
[2009/08/18 13:27:42 | 00,017,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\powrprof.dll
[2009/08/18 13:27:42 | 00,015,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\ctfmon.exe
[2009/08/18 13:27:42 | 00,014,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\svchost.exe
[2009/08/18 13:27:42 | 00,014,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\asyncmac.sys
[2009/08/18 13:27:42 | 00,013,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\wscntfy.exe
[2009/08/18 13:27:42 | 00,013,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\lsass.exe
[2009/08/18 13:27:42 | 00,011,648 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\acpiec.sys
[2009/08/18 13:27:42 | 00,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\sfc.dll
[2009/08/18 13:27:42 | 00,002,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\null.sys
[2009/08/18 13:27:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\dllcache\cache
[2009/08/18 13:21:57 | 00,000,000 | ---D | C] -- C:\WINDOWS\temp
[2009/08/18 13:21:55 | 00,050,176 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\proquota.exe
[2009/08/18 13:21:55 | 00,050,176 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\proquota.exe
[2009/08/18 13:10:03 | 00,000,211 | ---- | C] () -- C:\Boot.bak
[2009/08/18 13:09:57 | 00,260,272 | ---- | C] () -- C:\cmldr
[2009/08/18 13:09:56 | 00,000,000 | RHSD | C] -- C:\cmdcons
[2009/08/18 13:07:21 | 00,216,064 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2009/08/18 13:07:21 | 00,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2009/08/18 13:07:21 | 00,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2009/08/18 13:07:21 | 00,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2009/08/18 13:07:21 | 00,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2009/08/18 13:07:21 | 00,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2009/08/18 13:07:21 | 00,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2009/08/18 13:07:21 | 00,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2009/08/18 13:06:26 | 00,000,000 | ---D | C] -- C:\Qoobox
[2009/08/18 13:03:24 | 00,001,745 | ---- | C] () -- C:\Documents and Settings\Aaron\Desktop\HijackThis.lnk
[2009/08/18 13:03:24 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/08/18 13:00:55 | 03,124,187 | ---- | C] () -- C:\Documents and Settings\Aaron\Desktop\ComboFix.exe
[2009/08/18 13:00:55 | 03,012,768 | ---- | C] (Javacool Software LLC ) -- C:\Documents and Settings\Aaron\Desktop\spywareblastersetup42.exe
[2009/08/18 13:00:55 | 00,288,768 | ---- | C] () -- C:\Documents and Settings\Aaron\Desktop\6o8elsic.exe
[2009/08/18 13:00:54 | 16,409,960 | ---- | C] (Safer Networking Limited ) -- C:\Documents and Settings\Aaron\Desktop\spybotsd162.exe
[2009/08/18 13:00:54 | 00,812,344 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\Aaron\Desktop\HJTInstall.exe
[2009/08/18 13:00:54 | 00,272,384 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Aaron\Desktop\TFC.exe
[2009/08/18 12:53:27 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/08/18 12:17:05 | 00,000,434 | ---- | C] () -- C:\WINDOWS\tasks\At1.job
[2009/08/18 12:03:53 | 00,000,000 | ---D | C] -- C:\Program Files\SpywareBlaster
[2009/08/18 12:03:27 | 00,000,778 | ---- | C] () -- C:\Documents and Settings\Aaron\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2009/08/18 12:03:10 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/08/17 19:36:27 | 00,000,000 | -H-D | C] -- C:\WINDOWS\System32\GroupPolicy
[2009/08/17 17:16:40 | 00,000,099 | ---- | C] () -- C:\Documents and Settings\Aaron\Desktop\fix.reg
[2009/08/17 17:14:44 | 00,000,000 | ---D | C] -- C:\_OTM
[2009/08/17 17:13:05 | 00,408,064 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Aaron\Desktop\OTM.com
[2009/08/17 17:09:29 | 10,726,80960 | -HS- | C] () -- C:\hiberfil.sys
[2009/08/17 16:58:27 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\images
[2009/08/17 16:51:53 | 00,131,072 | ---- | C] () -- C:\djos.exe
[2009/08/17 16:51:18 | 00,000,000 | -HS- | C] () -- C:\1693041208
[2009/08/13 20:50:59 | 01,089,593 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ntprint.cat
[2009/08/11 21:48:48 | 00,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2009/08/11 21:48:48 | 00,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2009/08/11 21:48:48 | 00,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2009/08/11 18:14:43 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Aaron\Local Settings\Application Data\AskToolbar
[2009/08/11 18:14:39 | 00,000,234 | ---- | C] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2009/08/11 18:14:33 | 00,000,000 | ---D | C] -- C:\Program Files\Ask.com
[2009/08/11 17:00:25 | 00,000,000 | ---D | C] -- C:\2b055e90dcb7821dbcecf79e
[2009/08/11 17:00:00 | 00,000,000 | ---D | C] -- C:\WINDOWS\SxsCaPendDel
[2009/08/11 16:18:04 | 00,128,512 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dhtmled.ocx
[2009/08/11 16:17:37 | 01,315,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msoe.dll
[2009/08/06 20:14:22 | 00,081,156 | ---- | C] () -- C:\Documents and Settings\Aaron\Desktop\amelie.srt
[2009/08/06 20:07:59 | 72,805,9904 | ---- | C] () -- C:\Documents and Settings\Aaron\Desktop\Amelie.avi
[2009/08/06 15:56:48 | 10,734,71488 | ---- | C] () -- C:\Documents and Settings\Aaron\Desktop\OneClickMoviez.Com-Wtchmn-DirectorsCut-aXXo.avi
[2009/08/05 05:01:48 | 00,204,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mswebdvd.dll
[2009/07/30 16:45:26 | 00,019,378 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\bajaqu.dat
[2009/07/30 16:45:26 | 00,019,168 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\imyliv.bin
[2009/07/30 16:45:26 | 00,019,146 | ---- | C] () -- C:\WINDOWS\ygute.lib
[2009/07/30 16:45:26 | 00,018,544 | ---- | C] () -- C:\Program Files\Common Files\upiqavem._dl
[2009/07/30 16:45:26 | 00,018,347 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\jeger.bat
[2009/07/30 16:45:26 | 00,018,336 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\zodomaduho.pif
[2009/07/30 16:45:26 | 00,017,783 | ---- | C] () -- C:\Documents and Settings\Aaron\Local Settings\Application Data\ikylojed.reg
[2009/07/30 16:45:26 | 00,017,282 | ---- | C] () -- C:\WINDOWS\fyvom.inf
[2009/07/30 16:45:26 | 00,016,862 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\mizofu.bat
[2009/07/30 16:45:26 | 00,016,837 | ---- | C] () -- C:\Program Files\Common Files\vadukefu._dl
[2009/07/30 16:45:26 | 00,016,422 | ---- | C] () -- C:\Documents and Settings\Aaron\Application Data\otum.db
[2009/07/30 16:45:26 | 00,016,350 | ---- | C] () -- C:\WINDOWS\System32\enisulyzu.exe
[2009/07/30 16:45:26 | 00,016,304 | ---- | C] () -- C:\Documents and Settings\Aaron\Local Settings\Application Data\ruhihe.reg
[2009/07/30 16:45:26 | 00,015,224 | ---- | C] () -- C:\Program Files\Common Files\yhyryjyw.exe
[2009/07/30 16:45:26 | 00,014,508 | ---- | C] () -- C:\WINDOWS\anobibym.vbs
[2009/07/30 16:45:26 | 00,013,226 | ---- | C] () -- C:\Documents and Settings\Aaron\Application Data\xycuqi.dat
[2009/07/30 16:45:26 | 00,012,181 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\awawag.sys
[2009/07/30 16:45:26 | 00,010,872 | ---- | C] () -- C:\WINDOWS\ogohom.inf
[2009/01/05 15:44:10 | 00,000,453 | ---- | C] () -- C:\WINDOWS\bdoscandellang.ini
[2008/11/21 17:47:52 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008/11/21 17:45:16 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008/11/21 17:45:16 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest
[2008/11/21 17:44:16 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2008/10/05 14:50:40 | 00,010,752 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2008/10/05 14:50:40 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2008/09/13 17:14:07 | 00,000,062 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2007/04/20 21:54:42 | 00,037,888 | ---- | C] () -- C:\WINDOWS\System32\setupnt.dll
[2007/01/29 13:10:24 | 00,087,800 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll
[2007/01/20 02:39:20 | 00,002,481 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2007/01/20 02:24:13 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2007/01/20 02:16:02 | 00,000,222 | ---- | C] () -- C:\WINDOWS\Welcome.ini
[2007/01/20 02:08:40 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\FPCALL.dll
[2007/01/20 02:07:50 | 00,009,343 | ---- | C] () -- C:\WINDOWS\System32\drivers\TDSMAPI.SYS
[2007/01/20 00:40:25 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/01/26 16:42:26 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2003/01/07 19:05:08 | 00,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/11/15 12:13:44 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\CInsX500.dll
[2002/11/15 05:14:28 | 00,143,360 | ---- | C] () -- C:\WINDOWS\System32\AIBMRUNL.dll
[2002/10/07 19:48:06 | 00,122,880 | ---- | C] () -- C:\WINDOWS\System32\e1000msg.dll
[2002/09/26 21:26:59 | 00,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini
[1980/01/01 04:00:00 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll
[1980/01/01 04:00:00 | 00,000,786 | ---- | C] () -- C:\WINDOWS\win.ini
[1980/01/01 04:00:00 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini

========== Files - Modified Within 30 Days ==========

[2009/08/18 21:01:01 | 00,000,234 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2009/08/18 19:54:37 | 39,968,284 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/08/18 19:54:37 | 00,067,775 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/08/18 19:37:35 | 00,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2009/08/18 18:47:36 | 33,961,728 | ---- | M] () -- C:\Documents and Settings\Aaron\Desktop\avira_antivir_personal_en.exe
[2009/08/18 18:44:36 | 02,062,665 | ---- | M] () -- C:\Documents and Settings\Aaron\Desktop\spywareguardsetup.exe
[2009/08/18 18:33:11 | 00,002,278 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/08/18 18:26:52 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/08/18 18:26:46 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/08/18 18:26:43 | 10,726,80960 | -HS- | M] () -- C:\hiberfil.sys
[2009/08/18 18:24:14 | 00,472,064 | ---- | M] ( ) -- C:\Documents and Settings\Aaron\Desktop\RootRepeal.exe
[2009/08/18 18:23:22 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2009/08/18 18:23:08 | 00,514,048 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Aaron\Desktop\OTL.exe
[2009/08/18 13:53:22 | 00,181,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Aaron\Desktop\OTC.exe
[2009/08/18 13:44:48 | 08,050,536 | ---- | M] (Mozilla) -- C:\Documents and Settings\Aaron\Desktop\Firefox Setup 3.5.2.exe
[2009/08/18 13:25:13 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/08/18 13:24:40 | 00,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009/08/18 13:11:26 | 00,000,361 | ---- | M] () -- C:\Documents and Settings\Aaron\Desktop\autorun.inf
[2009/08/18 13:10:04 | 00,000,281 | RHS- | M] () -- C:\BOOT.INI
[2009/08/18 13:03:24 | 00,001,745 | ---- | M] () -- C:\Documents and Settings\Aaron\Desktop\HijackThis.lnk
[2009/08/18 12:44:26 | 00,288,768 | ---- | M] () -- C:\Documents and Settings\Aaron\Desktop\6o8elsic.exe
[2009/08/18 12:40:24 | 16,409,960 | ---- | M] (Safer Networking Limited ) -- C:\Documents and Settings\Aaron\Desktop\spybotsd162.exe
[2009/08/18 12:38:58 | 00,272,384 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Aaron\Desktop\TFC.exe
[2009/08/18 12:28:28 | 00,812,344 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\Aaron\Desktop\HJTInstall.exe
[2009/08/18 12:23:58 | 03,124,187 | ---- | M] () -- C:\Documents and Settings\Aaron\Desktop\ComboFix.exe
[2009/08/18 12:17:05 | 00,000,434 | ---- | M] () -- C:\WINDOWS\tasks\At1.job
[2009/08/18 12:04:50 | 00,000,062 | ---- | M] () -- C:\WINDOWS\WININIT.INI
[2009/08/18 12:03:27 | 00,000,778 | ---- | M] () -- C:\Documents and Settings\Aaron\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2009/08/18 11:43:00 | 03,012,768 | ---- | M] (Javacool Software LLC ) -- C:\Documents and Settings\Aaron\Desktop\spywareblastersetup42.exe
[2009/08/17 22:33:51 | 00,027,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/08/17 22:33:51 | 00,011,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2009/08/17 22:33:50 | 00,335,240 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2009/08/17 17:16:41 | 00,000,099 | ---- | M] () -- C:\Documents and Settings\Aaron\Desktop\fix.reg
[2009/08/17 17:13:06 | 00,408,064 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Aaron\Desktop\OTM.com
[2009/08/17 16:53:06 | 00,131,072 | ---- | M] () -- C:\djos.exe
[2009/08/17 16:51:18 | 00,000,000 | -HS- | M] () -- C:\1693041208
[2009/08/14 23:37:57 | 00,109,056 | ---- | M] () -- C:\Documents and Settings\Aaron\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/11 23:13:43 | 00,000,786 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/08/11 20:24:20 | 00,066,800 | ---- | M] () -- C:\Documents and Settings\Aaron\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/08/11 17:33:43 | 00,263,824 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/08/11 17:09:00 | 00,506,068 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009/08/11 17:09:00 | 00,444,596 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/08/11 17:09:00 | 00,072,306 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009/08/08 12:10:14 | 00,216,064 | ---- | M] () -- C:\WINDOWS\PEV.exe
[2009/08/06 18:02:35 | 10,734,71488 | ---- | M] () -- C:\Documents and Settings\Aaron\Desktop\OneClickMoviez.Com-Wtchmn-DirectorsCut-aXXo.avi
[2009/08/06 02:20:08 | 00,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
[2009/08/05 05:01:48 | 00,204,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mswebdvd.dll
[2009/08/05 05:01:48 | 00,204,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mswebdvd.dll
[2009/08/03 13:36:28 | 00,038,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/08/03 13:36:06 | 00,019,096 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/07/30 16:45:26 | 00,019,378 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\bajaqu.dat
[2009/07/30 16:45:26 | 00,019,168 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\imyliv.bin
[2009/07/30 16:45:26 | 00,019,146 | ---- | M] () -- C:\WINDOWS\ygute.lib
[2009/07/30 16:45:26 | 00,018,544 | ---- | M] () -- C:\Program Files\Common Files\upiqavem._dl
[2009/07/30 16:45:26 | 00,018,347 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\jeger.bat
[2009/07/30 16:45:26 | 00,018,336 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\zodomaduho.pif
[2009/07/30 16:45:26 | 00,017,783 | ---- | M] () -- C:\Documents and Settings\Aaron\Local Settings\Application Data\ikylojed.reg
[2009/07/30 16:45:26 | 00,017,282 | ---- | M] () -- C:\WINDOWS\fyvom.inf
[2009/07/30 16:45:26 | 00,016,862 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\mizofu.bat
[2009/07/30 16:45:26 | 00,016,837 | ---- | M] () -- C:\Program Files\Common Files\vadukefu._dl
[2009/07/30 16:45:26 | 00,016,422 | ---- | M] () -- C:\Documents and Settings\Aaron\Application Data\otum.db
[2009/07/30 16:45:26 | 00,016,350 | ---- | M] () -- C:\WINDOWS\System32\enisulyzu.exe
[2009/07/30 16:45:26 | 00,016,304 | ---- | M] () -- C:\Documents and Settings\Aaron\Local Settings\Application Data\ruhihe.reg
[2009/07/30 16:45:26 | 00,015,224 | ---- | M] () -- C:\Program Files\Common Files\yhyryjyw.exe
[2009/07/30 16:45:26 | 00,014,508 | ---- | M] () -- C:\WINDOWS\anobibym.vbs
[2009/07/30 16:45:26 | 00,013,226 | ---- | M] () -- C:\Documents and Settings\Aaron\Application Data\xycuqi.dat
[2009/07/30 16:45:26 | 00,012,181 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\awawag.sys
[2009/07/30 16:45:26 | 00,010,872 | ---- | M] () -- C:\WINDOWS\ogohom.inf
[2009/07/29 20:49:14 | 24,281,536 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe
[2009/07/27 18:27:12 | 00,128,512 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dhtmled.ocx
[2009/07/25 05:23:07 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2009/07/25 05:23:07 | 00,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2009/07/25 05:23:05 | 00,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2009/07/25 05:23:00 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll
[2009/07/25 03:00:33 | 00,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl

========== LOP Check ==========

[2009/07/30 16:45:26 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Aaron\Application Data
[2008/12/29 19:10:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Aaron\Application Data\AVGTOOLBAR
[2008/09/02 11:21:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Aaron\Application Data\IBM
[2007/01/22 01:14:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Aaron\Application Data\InterTrust
[2008/09/02 11:04:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Aaron\Application Data\InterVideo
[2007/01/29 20:12:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Aaron\Application Data\Jigsaw
[2008/09/13 18:45:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Aaron\Application Data\Leadertech
[2007/02/15 15:03:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Aaron\Application Data\RssBandit
[2009/07/05 13:40:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Aaron\Application Data\U3
[2007/04/10 14:56:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Aaron\Application Data\WebEx
[2002/09/26 21:06:28 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Administrator\Application Data
[2009/08/18 14:08:39 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Application Data
[2009/07/10 23:54:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2008/09/24 13:38:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ibm
[2002/09/26 21:27:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SBSI
[2009/08/18 18:51:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2008/05/27 02:27:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\UIB
[2008/09/02 10:52:51 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Default User\Application Data
[2009/06/11 19:52:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data
[2009/06/11 19:52:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\AVGTOOLBAR
[2002/09/26 21:24:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data
[2009/08/18 12:17:05 | 00,000,434 | ---- | M] () -- C:\WINDOWS\Tasks\At1.job
[2008/09/03 14:25:07 | 00,000,506 | ---- | M] () -- C:\WINDOWS\Tasks\BMMTask.job
[2002/08/29 09:00:00 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009/08/18 19:37:35 | 00,000,868 | ---- | M] () -- C:\WINDOWS\Tasks\Google Software Updater.job
[2009/08/18 18:26:52 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT
[2009/08/18 21:01:01 | 00,000,234 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
< End of report >

ROOTREPEAL report:

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/08/18 21:58
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xBAC70000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7DA5000 Size: 8192 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xB7857000 Size: 49152 File Visible: No Signed: -
Status: -

Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!

Path: C:\WINDOWS\system32\kbiwkmamaycono.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\kbiwkmanxosumj.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\kbiwkmbbshhsqa.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\kbiwkmdcpcrjqv.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\kbiwkmgcfjwfvd.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\kbiwkmglytlsdu.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\kbiwkmkegctkva.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\kbiwkmmucxovbu.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\kbiwkmncbqxxmt.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\kbiwkmpucfmiqy.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\kbiwkmqvdhabwq.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\kbiwkmrnrewwmy.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\kbiwkmthxdnwdk.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\kbiwkmtkltputp.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\kbiwkmvmlfqrss.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\kbiwkmwhxidlyk.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\temp\kbiwkmtsowdlbbcx.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\drivers\kbiwkmrklyfwop.sys
Status: Invisible to the Windows API!

Path: c:\documents and settings\aaron\local settings\temp\~df3e56.tmp
Status: Allocation size mismatch (API: 57344, Raw: 0)

Path: C:\Documents and Settings\Aaron\Local Settings\temp\~DF846B.tmp
Status: Locked to the Windows API!

Path: c:\documents and settings\aaron\local settings\temp\~df959d.tmp
Status: Allocation size mismatch (API: 196608, Raw: 16384)

Path: C:\Documents and Settings\Aaron\Local Settings\temp\~DFA438.tmp
Status: Locked to the Windows API!

Path: c:\documents and settings\aaron\local settings\temp\hsperfdata_aaron\3056
Status: Allocation size mismatch (API: 65536, Raw: 0)

Stealth Objects
-------------------
Object: Hidden Module [Name: kbiwkmdcpcrjqv.dll]
Process: svchost.exe (PID: 1188) Address: 0x10000000 Size: 53248

Object: Hidden Module [Name: kbiwkmncbqxxmt.dll]
Process: Explorer.EXE (PID: 240) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: kbiwkmncbqxxmt.dll]
Process: iexplore.exe (PID: 2076) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: kbiwkmncbqxxmt.dll]
Process: iexplore.exe (PID: 3636) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: kbiwkmncbqxxmt.dll]
Process: iexplore.exe (PID: 3056) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: kbiwkmncbqxxmt.dll]
Process: iexplore.exe (PID: 868) Address: 0x10000000 Size: 32768

Hidden Services
-------------------
Service Name: kbiwkmgiyxuwqm
Image Path: C:\WINDOWS\system32\drivers\kbiwkmrklyfwop.sys

==EOF==

BC AdBot (Login to Remove)

 


#2 DocSatan

DocSatan

    Bleepin' Wanna-Be


  • Members
  • 2,156 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Boston, Ma.
  • Local time:09:08 AM

Posted 30 August 2009 - 07:32 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

#3 nursesoldier

nursesoldier
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:08 AM

Posted 31 August 2009 - 12:32 AM

THanks so much for the response.
Problem is google search results being redirected to random and hostile sites after virus/malware removal
DDS.txt:

DDS (Ver_09-07-30.01) - NTFSx86
Run by Aaron at 1:25:50.43 on Mon 08/31/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.85 [GMT -4:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\TpShocks.exe
svchost.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\System32\TPHDEXLG.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe
c:\program files\common files\installshield\updateservice\isuspm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Aaron\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.uscis.gov/
uInternet Connection Wizard,ShellNext = hxxp:///
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
mURLSearchHooks: H - No File
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: SpywareGuardDLBLOCK.CBrowserHelper: {4a368e80-174f-4872-96b5-0b27ddd11db2} - c:\program files\spywareguard\dlprotect.dll
BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [PSQLLauncher] "c:\program files\thinkvantage fingerprint software\launcher.exe" /startup
mRun: [TpShocks] TpShocks.exe
mRun: [BMMGAG] RunDll32 c:\progra~1\thinkpad\utilit~1\pwrmonit.dll,StartPwrMonitor
mRun: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [BMMLREF] c:\program files\thinkpad\utilities\BMMLREF.EXE
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [EZEJMNAP] c:\progra~1\thinkpad\utilit~1\EzEjMnAp.Exe
mRun: [S3TRAY2] S3Tray2.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [TP4EX] tp4ex.exe
mRun: [TPHOTKEY] c:\progra~1\thinkpad\pkgmgr\hotkey\TPHKMGR.exe
mRun: [TPKMAPHELPER] c:\program files\thinkpad\utilities\TpKmapAp.exe -helper
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
StartupFolder: c:\docume~1\aaron\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\aaron\startm~1\programs\startup\spywar~1.lnk - c:\program files\spywareguard\sgmain.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Save YouTube Video - c:\program files\common files\dvdvideosoft\dll\IEContextMenuY.dll/scriptY2MP4.htm
IE: Save YouTube Video as MP3 - c:\program files\common files\dvdvideosoft\dll\IEContextMenuY.dll/scriptY2MP3.htm
IE: Subscribe in default RSS reader - c:\documents and settings\aaron\application data\rssbandit\iecontext_subscribefeed.htm
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {036F8A56-0BC8-4607-8F98-D3231E6FF5ED} - hxxp://conference.cpbis.gatech.edu/SiteRoots/main/Install/win32/CentraUpdaterAx.cab
DPF: {2DAD3559-2923-4935-AD49-B673D2539944} - hxxp://www-307.ibm.com/pc/support/acpir.cab
DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} - hxxp://download.microsoft.com/download/7/1/D/71D9F11F-0C02-4707-9D60-D56EA8951020/pmupd806.exe
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
DPF: {897520CD-B1C8-4745-B46D-B03CF8701BB8} - hxxp://jigsaw.com/cab/app/JigsawContactFinder.CAB
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/1.3.1/jinstall-131_01-win.cab
DPF: {CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: psfus - c:\windows\system32\psqlpwd.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
SEH: SpywareGuard.Handler: {81559c35-8464-49f7-bb0e-07a383bef910} - c:\program files\spywareguard\spywareguard.dll
LSA: Notification Packages = scecli psqlpwd

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\aaron\applic~1\mozilla\firefox\profiles\uxdqwci5.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - hxxp://www.uscis.gov/
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=
FF - component: c:\program files\common files\dvdvideosoft\dll\ffcontextmenuy\components\FFContextMenu.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R0 ezgmntr;EZ GIG II Backup Archive Explorer;c:\windows\system32\drivers\ezgmntr.sys [2007-4-20 213696]
R0 Shockprf;Shockprf;c:\windows\system32\drivers\ApsX86.sys [2008-5-14 114728]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [2008-5-14 19496]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-8-18 11608]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-4-28 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-4-28 74480]
R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [2007-1-20 15360]
R1 tvtumon;tvtumon;c:\windows\system32\drivers\tvtumon.sys [2008-5-9 46144]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-8-18 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-8-18 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-8-18 55656]
R2 ezgfsfilt;EZ GIG II FS Filter;c:\windows\system32\drivers\ezgfsfilt.sys [2007-4-20 28800]
R2 smihlp;SMI Helper Driver (smihlp);c:\program files\common files\thinkvantage fingerprint software\drivers\smihlp.sys [2007-8-14 10896]
R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\lenovo\rescue and recovery\rrpservice.exe [2008-5-14 520192]
R2 TVT_UpdateMonitor;TVT Windows Update Monitor;c:\program files\lenovo\rescue and recovery\UpdateMonitor.exe [2008-5-9 253952]
R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [2008-2-22 37312]
S2 AntipPro2009_100;AntipyProex;c:\windows\svchast.exe --> c:\windows\svchast.exe [?]
S2 wwdliucd;USB Audio (WDM)Helper;c:\windows\system32\svchost.exe -k netsvcs [1980-1-1 14336]
S3 PCDRDRV;Pcdr Helper Driver;\??\c:\progra~1\pc-doc~1\diagno~1\pcdrdrv.sys --> c:\progra~1\pc-doc~1\diagno~1\PCDRDRV.sys [?]
S3 PCX504;Cisco Systems Wireless LAN Adapter Driver;c:\windows\system32\drivers\PCX504.sys [1980-1-1 96256]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-4-28 7408]

=============== Created Last 30 ================

2009-08-26 02:41 <DIR> --dsh--- c:\documents and settings\aaron\IECompatCache
2009-08-18 22:37 55,656 a------- c:\windows\system32\drivers\avgntflt.sys
2009-08-18 22:37 <DIR> --d----- c:\program files\Avira
2009-08-18 22:37 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avira
2009-08-18 22:26 <DIR> --d----- c:\program files\SpywareGuard
2009-08-18 18:30 <DIR> --dsh--- c:\documents and settings\aaron\PrivacIE
2009-08-18 18:26 <DIR> --dsh--- c:\documents and settings\aaron\IETldCache
2009-08-18 18:23 <DIR> --d----- c:\windows\ie8updates
2009-08-18 18:21 <DIR> -cd-h--- c:\windows\ie8
2009-08-18 18:19 246,272 -------- c:\windows\system32\dllcache\ieproxy.dll
2009-08-18 18:19 12,800 -------- c:\windows\system32\dllcache\xpshims.dll
2009-08-18 18:18 101,376 -------- c:\windows\system32\dllcache\iecompat.dll
2009-08-18 15:21 91 a------- c:\windows\system32\kbiwkmgcfjwfvd.dat
2009-08-18 15:02 <DIR> --d----- c:\program files\TeaTimer (Spybot - Search & Destroy)
2009-08-18 15:02 <DIR> --d----- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-08-18 14:11 20,480 a------- c:\windows\system32\kbiwkmncbqxxmt.dll
2009-08-18 14:11 45,056 a------- c:\windows\system32\kbiwkmdcpcrjqv.dll
2009-08-18 14:08 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-08-18 14:08 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-08-18 13:58 9,736 a------- c:\windows\system32\kbiwkmpucfmiqy.dat
2009-08-18 13:27 <DIR> --d----- c:\windows\system32\dllcache\cache
2009-08-18 13:21 50,176 a------- c:\windows\system32\proquota.exe
2009-08-18 13:21 50,176 a------- c:\windows\system32\dllcache\proquota.exe
2009-08-18 13:09 <DIR> a-dshr-- C:\cmdcons
2009-08-18 13:07 216,064 a------- c:\windows\PEV.exe
2009-08-18 13:07 161,792 a------- c:\windows\SWREG.exe
2009-08-18 13:07 98,816 a------- c:\windows\sed.exe
2009-08-18 13:03 <DIR> --d----- c:\program files\Trend Micro
2009-08-18 12:03 <DIR> --d----- c:\program files\SpywareBlaster
2009-08-17 22:20 91 a------- c:\windows\system32\kbiwkmqvdhabwq.dat
2009-08-17 22:10 20,480 a------- c:\windows\system32\kbiwkmrnrewwmy.dll
2009-08-17 22:10 13,030 a------- c:\windows\system32\kbiwkmwhxidlyk.dat
2009-08-17 22:10 45,056 a------- c:\windows\system32\kbiwkmtkltputp.dll
2009-08-17 19:53 91 a------- c:\windows\system32\kbiwkmglytlsdu.dat
2009-08-17 19:36 <DIR> --d-h--- c:\windows\system32\GroupPolicy
2009-08-17 19:22 20,480 a------- c:\windows\system32\kbiwkmthxdnwdk.dll
2009-08-17 19:22 2,491 a------- c:\windows\system32\kbiwkmmucxovbu.dat
2009-08-17 19:22 45,056 a------- c:\windows\system32\kbiwkmvmlfqrss.dll
2009-08-17 17:19 91 a------- c:\windows\system32\kbiwkmkegctkva.dat
2009-08-17 17:14 <DIR> --d----- C:\_OTM
2009-08-17 16:58 <DIR> a-d----- c:\windows\system32\images
2009-08-17 16:55 20,992 a------- c:\windows\system32\kbiwkmamaycono.dll
2009-08-17 16:54 3,811 a------- c:\windows\system32\kbiwkmanxosumj.dat
2009-08-17 16:54 44,544 a------- c:\windows\system32\kbiwkmbbshhsqa.dll
2009-08-17 16:51 0 a--sh--- C:\1693041208
2009-08-13 20:50 1,089,593 -------- c:\windows\system32\dllcache\ntprint.cat
2009-08-11 18:14 <DIR> --d----- c:\program files\Ask.com
2009-08-11 17:00 <DIR> --d----- C:\2b055e90dcb7821dbcecf79e
2009-08-11 17:00 <DIR> --d----- c:\windows\SxsCaPendDel
2009-08-11 16:18 128,512 -------- c:\windows\system32\dllcache\dhtmled.ocx
2009-08-11 16:17 1,315,328 -------- c:\windows\system32\dllcache\msoe.dll
2009-08-05 05:01 204,800 -------- c:\windows\system32\dllcache\mswebdvd.dll

==================== Find3M ====================

2009-08-05 05:01 204,800 -------- c:\windows\system32\mswebdvd.dll
2009-08-03 13:36 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 13:36 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-07-30 16:45 19,168 a------- c:\docume~1\alluse~1\applic~1\imyliv.bin
2009-07-30 16:45 18,544 a------- c:\program files\common files\upiqavem._dl
2009-07-30 16:45 18,347 a------- c:\docume~1\alluse~1\applic~1\jeger.bat
2009-07-30 16:45 16,862 a------- c:\docume~1\alluse~1\applic~1\mizofu.bat
2009-07-30 16:45 16,837 a------- c:\program files\common files\vadukefu._dl
2009-07-30 16:45 16,350 a------- c:\windows\system32\enisulyzu.exe
2009-07-30 16:45 15,224 a------- c:\program files\common files\yhyryjyw.exe
2009-07-30 16:45 14,508 a------- c:\windows\anobibym.vbs
2009-07-30 16:45 13,226 a------- c:\docume~1\aaron\applic~1\xycuqi.dat
2009-07-30 16:45 12,181 a------- c:\docume~1\alluse~1\applic~1\awawag.sys
2009-07-25 05:23 411,368 a------- c:\windows\system32\deploytk.dll
2009-07-19 18:48 11,067,392 -------- c:\windows\system32\dllcache\ieframe.dll
2009-07-19 09:33 3,597,824 a------- c:\windows\system32\dllcache\cache\mshtml.dll
2009-07-19 09:18 5,937,152 -------- c:\windows\system32\dllcache\mshtml.dll
2009-07-17 15:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-17 15:01 58,880 -------- c:\windows\system32\dllcache\atl.dll
2009-07-13 23:43 10,841,088 -------- c:\windows\system32\dllcache\wmp.dll
2009-07-13 23:43 286,208 -------- c:\windows\system32\wmpdxm.dll
2009-07-13 23:43 286,208 -------- c:\windows\system32\dllcache\wmpdxm.dll
2009-07-03 13:09 915,456 a------- c:\windows\system32\wininet.dll
2009-07-03 13:09 915,456 -------- c:\windows\system32\dllcache\wininet.dll
2009-07-03 13:09 1,208,832 -------- c:\windows\system32\dllcache\urlmon.dll
2009-07-03 13:09 206,848 -------- c:\windows\system32\dllcache\occache.dll
2009-07-03 13:09 594,432 -------- c:\windows\system32\dllcache\msfeeds.dll
2009-07-03 13:09 55,296 -------- c:\windows\system32\dllcache\msfeedsbs.dll
2009-07-03 13:09 1,985,536 -------- c:\windows\system32\dllcache\iertutil.dll
2009-07-03 13:09 25,600 -------- c:\windows\system32\dllcache\jsproxy.dll
2009-07-03 13:09 184,320 -------- c:\windows\system32\dllcache\iepeers.dll
2009-07-03 13:09 386,048 -------- c:\windows\system32\dllcache\iedkcs32.dll
2009-07-03 07:01 173,056 -------- c:\windows\system32\dllcache\ie4uinit.exe
2009-06-29 12:12 827,392 a------- c:\windows\system32\dllcache\cache\wininet.dll
2009-06-29 12:12 133,120 -------- c:\windows\system32\dllcache\extmgr.dll
2009-06-29 07:07 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe
2009-06-25 04:25 301,568 a------- c:\windows\system32\kerberos.dll
2009-06-25 04:25 147,456 a------- c:\windows\system32\schannel.dll
2009-06-25 04:25 136,192 a------- c:\windows\system32\msv1_0.dll
2009-06-25 04:25 56,832 a------- c:\windows\system32\secur32.dll
2009-06-25 04:25 54,272 a------- c:\windows\system32\wdigest.dll
2009-06-25 04:25 730,112 -------- c:\windows\system32\lsasrv.dll
2009-06-25 04:25 730,112 -------- c:\windows\system32\dllcache\lsasrv.dll
2009-06-25 04:25 301,568 -------- c:\windows\system32\dllcache\kerberos.dll
2009-06-25 04:25 147,456 -------- c:\windows\system32\dllcache\schannel.dll
2009-06-25 04:25 136,192 -------- c:\windows\system32\dllcache\msv1_0.dll
2009-06-25 04:25 56,832 -------- c:\windows\system32\dllcache\secur32.dll
2009-06-25 04:25 54,272 -------- c:\windows\system32\dllcache\wdigest.dll
2009-06-24 07:18 92,928 -------- c:\windows\system32\dllcache\ksecdd.sys
2009-06-16 10:36 119,808 -------- c:\windows\system32\t2embed.dll
2009-06-16 10:36 119,808 -------- c:\windows\system32\dllcache\t2embed.dll
2009-06-16 10:36 81,920 -------- c:\windows\system32\fontsub.dll
2009-06-16 10:36 81,920 -------- c:\windows\system32\dllcache\fontsub.dll
2009-06-12 08:31 80,896 -------- c:\windows\system32\tlntsess.exe
2009-06-12 08:31 80,896 -------- c:\windows\system32\dllcache\tlntsess.exe
2009-06-12 08:31 76,288 -------- c:\windows\system32\telnet.exe
2009-06-12 08:31 76,288 -------- c:\windows\system32\dllcache\telnet.exe
2009-06-10 10:13 84,992 a------- c:\windows\system32\avifil32.dll
2009-06-10 10:13 84,992 -------- c:\windows\system32\dllcache\avifil32.dll
2009-06-10 09:19 2,066,432 -------- c:\windows\system32\mstscax.dll
2009-06-10 09:19 2,066,432 -------- c:\windows\system32\dllcache\mstscax.dll
2009-06-10 02:14 132,096 -------- c:\windows\system32\wkssvc.dll
2009-06-10 02:14 132,096 -------- c:\windows\system32\dllcache\wkssvc.dll
2009-06-03 15:09 1,291,264 a------- c:\windows\system32\quartz.dll
2009-06-03 15:09 1,291,264 -------- c:\windows\system32\dllcache\quartz.dll
2007-03-05 00:22 56,912 -------- c:\documents and settings\aaron\g2mdlhlpx.exe
2008-09-04 23:09 32,768 ---sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090420080905\index.dat

============= FINISH: 1:26:51.43 ===============

Attached Files



#4 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:08 AM

Posted 04 September 2009 - 08:25 AM

Hello. I am PropagandaPanda (Panda or PP for short), and I will be helping you.

Looks like you were infected with a rootkit.

Disable Realtime Protection
Antimalware programs can interfere with ComboFix and other tools we need to run. Please temporarily disable all realtime protections you have enabled. Refer to this page, if you are unsure how.

Download and Run ComboFix
Download Combofix by sUBs from any of the links below, and save it to your desktop. If you have already run ComboFix, delete your old copy and download a new one.
Link 1, Link 2, Link 3
  • Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are not sure how.
  • Double click on ComboFix.exe and follow the prompts. If you are using Windows Vista, right click the icon and select "Run as Administrator". You will not recieve the prompts below if you are not using Windows XP. ComboFix will check to see if you have the Windows Recovery Console installed.
  • If you did not have it installed, you will see the prompt below. Choose YES.
    Posted ImagePosted Image

  • When the Recovery Console has been installed, you will see the prompt below. Choose YES.
    Posted Image
  • When finished, ComboFix will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).
Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

Download and Run Scan with GMER
We will use GMER to scan for rootkits.

Please download GMER to your desktop. Note that the file will be randomly named to prevent active malware from stopping the download.
  • Close all other open programs as there is a slight chance your computer will crash.
  • Double click the GMER program ******.exe. Your security programs may detect GMER's driver trying to load. Allow it.
  • You may see a warning saying "GMER has detected rootkit activity". If so, select NO.
  • Leaving the settings at default, click Scan.
  • When the scan is complete, click Save and save the log onto your desktop.
Please include the log in your next reply.

In your next reply include:
-the ComboFix log
-the GMER scan log

Please also tell me of any changes you have made to your computer since you started your topic.

With Regards,
The Panda

#5 nursesoldier

nursesoldier
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:08 AM

Posted 05 September 2009 - 06:07 PM

thank you so much for the help.
No changes made to the computer

ComboFix log:
ComboFix 09-09-05.02 - Aaron 09/05/2009 18:23.2.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.607 [GMT -4:00]
Running from: c:\documents and settings\Aaron\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Aaron\Local Settings\Application Data\ikylojed.reg
c:\documents and settings\Aaron\Local Settings\Application Data\ruhihe.reg
c:\documents and settings\All Users\Application Data\jeger.bat
c:\documents and settings\All Users\Application Data\mizofu.bat
c:\windows\anobibym.vbs
c:\windows\Downloaded Program Files\MyWebEx
c:\windows\Downloaded Program Files\Temp
c:\windows\fyvom.inf
c:\windows\ogohom.inf
c:\windows\system32\images
c:\windows\system32\images\i1.gif
c:\windows\system32\images\i2.gif
c:\windows\system32\images\i3.gif
c:\windows\system32\images\j1.gif
c:\windows\system32\images\j2.gif
c:\windows\system32\images\j3.gif
c:\windows\system32\images\jj1.gif
c:\windows\system32\images\jj2.gif
c:\windows\system32\images\jj3.gif
c:\windows\system32\images\l1.gif
c:\windows\system32\images\l2.gif
c:\windows\system32\images\l3.gif
c:\windows\system32\images\pix.gif
c:\windows\system32\images\t1.gif
c:\windows\system32\images\t2.gif
c:\windows\system32\images\up1.gif
c:\windows\system32\images\up2.gif
c:\windows\system32\images\w1.gif
c:\windows\system32\images\w11.gif
c:\windows\system32\images\w2.gif
c:\windows\system32\images\w3.gif
c:\windows\system32\images\w3.jpg
c:\windows\system32\images\wt1.gif
c:\windows\system32\images\wt2.gif
c:\windows\system32\images\wt3.gif
c:\windows\system32\kbiwkmamaycono.dll
c:\windows\system32\kbiwkmanxosumj.dat
c:\windows\system32\kbiwkmbbshhsqa.dll
c:\windows\system32\kbiwkmdcpcrjqv.dll
c:\windows\system32\kbiwkmgcfjwfvd.dat
c:\windows\system32\kbiwkmglytlsdu.dat
c:\windows\system32\kbiwkmkegctkva.dat
c:\windows\system32\kbiwkmmucxovbu.dat
c:\windows\system32\kbiwkmncbqxxmt.dll
c:\windows\system32\kbiwkmpucfmiqy.dat
c:\windows\system32\kbiwkmqvdhabwq.dat
c:\windows\system32\kbiwkmrnrewwmy.dll
c:\windows\system32\kbiwkmthxdnwdk.dll
c:\windows\system32\kbiwkmtkltputp.dll
c:\windows\system32\kbiwkmvmlfqrss.dll
c:\windows\system32\kbiwkmwhxidlyk.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ANTIPPRO2009_100
-------\Service_AntipPro2009_100


((((((((((((((((((((((((( Files Created from 2009-08-05 to 2009-09-05 )))))))))))))))))))))))))))))))
.

2009-08-26 06:41 . 2009-08-26 06:41 -------- d-sh--w- c:\documents and settings\Aaron\IECompatCache
2009-08-19 02:37 . 2009-07-28 20:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-19 02:37 . 2009-03-30 14:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-08-19 02:37 . 2009-02-13 16:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-08-19 02:37 . 2009-02-13 16:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-08-19 02:37 . 2009-08-19 02:37 -------- d-----w- c:\program files\Avira
2009-08-19 02:37 . 2009-08-19 02:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-08-19 02:26 . 2009-09-04 17:45 -------- d-----w- c:\program files\SpywareGuard
2009-08-18 22:32 . 2009-08-18 22:32 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-08-18 22:30 . 2009-08-18 22:30 -------- d-sh--w- c:\documents and settings\Aaron\PrivacIE
2009-08-18 22:26 . 2009-08-18 22:26 -------- d-sh--w- c:\documents and settings\Aaron\IETldCache
2009-08-18 22:23 . 2009-08-18 22:23 -------- d-----w- c:\windows\ie8updates
2009-08-18 22:21 . 2009-08-18 22:21 -------- dc-h--w- c:\windows\ie8
2009-08-18 22:19 . 2009-07-03 17:09 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-08-18 22:19 . 2009-07-03 17:09 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll
2009-08-18 22:18 . 2009-07-01 07:08 101376 ------w- c:\windows\system32\dllcache\iecompat.dll
2009-08-18 19:29 . 2009-08-18 22:34 -------- d-----w- c:\windows\BDOSCAN8
2009-08-18 19:02 . 2009-08-18 19:02 -------- d-----w- c:\program files\TeaTimer (Spybot - Search & Destroy)
2009-08-18 19:02 . 2009-08-18 19:02 -------- d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-08-18 18:08 . 2009-08-18 18:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-18 18:08 . 2009-08-18 18:08 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-18 17:21 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe
2009-08-18 17:21 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\dllcache\proquota.exe
2009-08-18 17:03 . 2009-08-18 17:03 -------- d-----w- c:\program files\Trend Micro
2009-08-18 16:03 . 2009-08-18 22:51 -------- d-----w- c:\program files\SpywareBlaster
2009-08-18 16:03 . 2009-08-18 16:03 -------- d-----w- c:\program files\ERUNT
2009-08-17 23:36 . 2009-08-17 23:36 -------- d--h--w- c:\windows\system32\GroupPolicy
2009-08-17 21:14 . 2009-08-17 21:14 -------- d-----w- C:\_OTM
2009-08-11 22:14 . 2009-08-11 22:22 -------- d-----w- c:\documents and settings\Aaron\Local Settings\Application Data\AskToolbar
2009-08-11 22:14 . 2009-08-11 22:14 -------- d-----w- c:\program files\Ask.com
2009-08-11 21:00 . 2009-08-11 21:01 -------- d-----w- C:\2b055e90dcb7821dbcecf79e
2009-08-11 21:00 . 2009-08-11 21:33 -------- d-----w- c:\windows\SxsCaPendDel
2009-08-11 20:17 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-05 03:20 . 2007-01-19 21:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-08-20 02:22 . 2007-04-13 05:47 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-20 02:20 . 2007-01-19 16:42 -------- d-----w- c:\program files\Google
2009-08-17 22:00 . 2009-04-24 04:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-17 21:56 . 2009-04-30 00:35 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-08-12 01:48 . 2007-02-14 19:08 -------- d-----w- c:\program files\Java
2009-08-12 00:24 . 2007-01-20 05:25 66800 ----a-w- c:\documents and settings\Aaron\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-11 22:21 . 2009-06-03 00:13 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2009-08-11 22:13 . 2009-06-03 00:13 -------- d-----w- c:\program files\DVDVideoSoft
2009-08-05 09:01 . 1980-01-01 08:00 204800 ------w- c:\windows\system32\mswebdvd.dll
2009-08-03 17:36 . 2009-04-24 04:50 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 17:36 . 2009-04-24 04:50 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-31 03:45 . 2008-10-07 18:04 -------- d-----w- c:\documents and settings\Aaron\Application Data\DivX
2009-07-30 20:45 . 2009-07-30 20:45 19168 ----a-w- c:\documents and settings\All Users\Application Data\imyliv.bin
2009-07-30 20:45 . 2009-07-30 20:45 18544 ----a-w- c:\program files\Common Files\upiqavem._dl
2009-07-30 20:45 . 2009-07-30 20:45 16837 ----a-w- c:\program files\Common Files\vadukefu._dl
2009-07-30 20:45 . 2009-07-30 20:45 16350 ----a-w- c:\windows\system32\enisulyzu.exe
2009-07-30 20:45 . 2009-07-30 20:45 15224 ----a-w- c:\program files\Common Files\yhyryjyw.exe
2009-07-30 20:45 . 2009-07-30 20:45 13226 ----a-w- c:\documents and settings\Aaron\Application Data\xycuqi.dat
2009-07-30 20:45 . 2009-07-30 20:45 12181 ----a-w- c:\documents and settings\All Users\Application Data\awawag.sys
2009-07-25 09:23 . 2009-03-11 03:45 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:01 . 1980-01-01 08:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 03:43 . 2007-01-20 05:13 286208 ------w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 1980-01-01 08:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-25 08:25 . 1980-01-01 08:00 730112 ------w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 1980-01-01 08:00 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 1980-01-01 08:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 1980-01-01 08:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:25 . 1980-01-01 08:00 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 1980-01-01 08:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-24 11:18 . 1980-01-01 08:00 92928 ------w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:36 . 1980-01-01 08:00 81920 ------w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 1980-01-01 08:00 119808 ------w- c:\windows\system32\t2embed.dll
2009-06-12 12:31 . 1980-01-01 08:00 80896 ------w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 1980-01-01 08:00 76288 ------w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 1980-01-01 08:00 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 13:19 . 2002-09-27 01:11 2066432 ------w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 1980-01-01 08:00 132096 ------w- c:\windows\system32\wkssvc.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-08-18_17.25.11 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-07 06:19 . 2007-11-07 06:19 54272 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1\vcomp90.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 62976 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90rus.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 46080 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90kor.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 46592 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90jpn.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 64512 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90ita.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 66048 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90fra.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 65024 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esp.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 65024 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esn.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 56832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90enu.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 66560 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90deu.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 39936 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90cht.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 38912 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90chs.dll
+ 2008-07-29 10:07 . 2008-07-29 10:07 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90u.dll
+ 2008-07-29 10:07 . 2008-07-29 10:07 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90.dll
+ 2009-09-05 22:32 . 2009-09-05 22:32 16384 c:\windows\temp\Perflib_Perfdata_160.dat
+ 2006-11-27 08:45 . 2009-07-14 11:03 46080 c:\windows\system32\tzchange.exe
+ 2007-01-20 05:04 . 2009-01-07 22:21 26144 c:\windows\system32\spupdsvc.exe
+ 2007-01-20 22:34 . 2009-01-07 22:20 16928 c:\windows\system32\spmsg.dll
+ 1980-01-01 08:00 . 2009-03-08 08:31 46592 c:\windows\system32\pngfilt.dll
- 2006-06-29 13:05 . 2006-06-29 13:05 23552 c:\windows\system32\normaliz.dll
+ 2006-06-29 13:05 . 2009-01-07 22:20 23552 c:\windows\system32\normaliz.dll
- 2006-06-28 22:59 . 2006-06-28 22:59 24576 c:\windows\system32\nlsdl.dll
+ 2006-06-28 22:59 . 2009-01-07 22:20 24576 c:\windows\system32\nlsdl.dll
- 1980-01-01 08:00 . 2006-10-17 16:28 48128 c:\windows\system32\mshtmler.dll
+ 1980-01-01 08:00 . 2009-03-08 08:31 48128 c:\windows\system32\mshtmler.dll
+ 1980-01-01 08:00 . 2009-03-08 08:31 66560 c:\windows\system32\mshtmled.dll
- 1980-01-01 08:00 . 2006-10-17 16:56 45568 c:\windows\system32\mshta.exe
+ 1980-01-01 08:00 . 2009-03-08 08:31 45568 c:\windows\system32\mshta.exe
+ 2006-10-17 16:58 . 2009-03-08 08:31 13312 c:\windows\system32\msfeedssync.exe
+ 2006-11-08 02:03 . 2009-07-03 17:09 55296 c:\windows\system32\msfeedsbs.dll
+ 2008-09-07 22:33 . 2009-09-01 04:05 88589 c:\windows\system32\Macromed\Flash\uninstall_activeX.exe
+ 1980-01-01 08:00 . 2009-03-08 08:34 43008 c:\windows\system32\licmgr10.dll
+ 1980-01-01 08:00 . 2009-07-03 17:09 25600 c:\windows\system32\jsproxy.dll
+ 1980-01-01 08:00 . 2009-03-08 08:32 94720 c:\windows\system32\inseng.dll
+ 1980-01-01 08:00 . 2009-03-08 08:31 34816 c:\windows\system32\imgutil.dll
+ 2006-11-07 08:26 . 2009-03-08 08:32 36864 c:\windows\system32\ieudinit.exe
+ 1980-01-01 08:00 . 2009-03-08 08:32 71680 c:\windows\system32\iesetup.dll
+ 1980-01-01 08:00 . 2009-03-08 08:32 55808 c:\windows\system32\iernonce.dll
- 2006-06-29 13:05 . 2006-06-29 13:05 26112 c:\windows\system32\idndl.dll
+ 2006-06-29 13:05 . 2009-01-07 22:20 26112 c:\windows\system32\idndl.dll
+ 2006-10-17 16:58 . 2009-03-08 08:31 59904 c:\windows\system32\icardie.dll
+ 2009-08-19 02:37 . 2009-05-11 14:12 28520 c:\windows\system32\drivers\ssmdrv.sys
+ 1980-01-01 08:00 . 2008-04-14 00:12 14336 c:\windows\system32\dllcache\svchost.exe
+ 2006-10-17 16:58 . 2009-03-08 08:31 46592 c:\windows\system32\dllcache\pngfilt.dll
- 2006-10-17 16:28 . 2006-10-17 16:28 48128 c:\windows\system32\dllcache\mshtmler.dll
+ 2006-10-17 16:28 . 2009-03-08 08:31 48128 c:\windows\system32\dllcache\mshtmler.dll
+ 2006-11-08 02:03 . 2009-03-08 08:31 66560 c:\windows\system32\dllcache\mshtmled.dll
- 2006-10-17 16:56 . 2006-10-17 16:56 45568 c:\windows\system32\dllcache\mshta.exe
+ 2006-10-17 16:56 . 2009-03-08 08:31 45568 c:\windows\system32\dllcache\mshta.exe
+ 2007-12-07 02:21 . 2009-07-03 17:09 55296 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2006-10-17 17:05 . 2009-03-08 08:34 43008 c:\windows\system32\dllcache\licmgr10.dll
+ 2006-11-08 02:03 . 2009-07-03 17:09 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2006-11-07 08:26 . 2009-03-08 08:32 94720 c:\windows\system32\dllcache\inseng.dll
+ 2006-10-17 16:57 . 2009-03-08 08:31 34816 c:\windows\system32\dllcache\imgutil.dll
+ 2006-11-07 08:26 . 2009-03-08 08:32 71680 c:\windows\system32\dllcache\iesetup.dll
+ 2006-11-07 08:26 . 2009-03-08 08:32 55808 c:\windows\system32\dllcache\iernonce.dll
+ 2007-12-07 02:21 . 2009-03-08 08:31 59904 c:\windows\system32\dllcache\icardie.dll
+ 2006-10-17 16:44 . 2009-03-08 08:24 68608 c:\windows\system32\dllcache\hmmapi.dll
+ 2009-06-29 16:12 . 2009-03-08 08:33 18944 c:\windows\system32\dllcache\corpol.dll
+ 2009-08-18 17:27 . 2008-10-16 19:09 51224 c:\windows\system32\dllcache\cache\wuauclt.exe
+ 2009-08-18 17:27 . 2008-04-14 00:12 13824 c:\windows\system32\dllcache\cache\wscntfy.exe
+ 2009-08-18 17:27 . 2008-04-14 00:12 82432 c:\windows\system32\dllcache\cache\ws2_32.dll
+ 2009-08-18 17:27 . 2008-04-14 00:12 26112 c:\windows\system32\dllcache\cache\userinit.exe
+ 2009-08-18 17:27 . 2008-04-14 00:12 14336 c:\windows\system32\dllcache\cache\svchost.exe
+ 2009-08-18 17:27 . 2008-04-14 00:12 57856 c:\windows\system32\dllcache\cache\spoolsv.exe
+ 2009-08-18 17:27 . 2008-04-14 00:12 88576 c:\windows\system32\dllcache\cache\rasauto.dll
+ 2009-08-18 17:27 . 2008-04-14 00:12 17408 c:\windows\system32\dllcache\cache\powrprof.dll
+ 2009-08-18 17:27 . 2008-04-14 00:11 33792 c:\windows\system32\dllcache\cache\msgsvc.dll
+ 2009-08-18 17:27 . 2008-04-14 00:12 13312 c:\windows\system32\dllcache\cache\lsass.exe
+ 2009-08-18 17:27 . 2008-04-14 00:11 22016 c:\windows\system32\dllcache\cache\lpk.dll
+ 2009-08-18 17:27 . 2008-04-13 18:39 24576 c:\windows\system32\dllcache\cache\kbdclass.sys
+ 2009-08-18 17:27 . 2008-04-13 18:53 36608 c:\windows\system32\dllcache\cache\ip6fw.sys
+ 2009-08-18 17:27 . 2008-04-14 00:12 15360 c:\windows\system32\dllcache\cache\ctfmon.exe
+ 2009-08-18 17:27 . 2008-04-13 18:57 14336 c:\windows\system32\dllcache\cache\asyncmac.sys
+ 2009-08-18 17:27 . 2002-08-29 13:00 11648 c:\windows\system32\dllcache\cache\acpiec.sys
+ 2006-11-07 08:26 . 2009-03-08 08:32 72704 c:\windows\system32\dllcache\admparse.dll
+ 1980-01-01 08:00 . 2009-03-08 08:33 18944 c:\windows\system32\corpol.dll
- 2002-09-27 01:22 . 2009-08-18 16:53 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-08-18 17:34 . 2009-08-19 16:32 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2002-09-27 01:22 . 2009-08-19 16:32 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2002-09-27 01:22 . 2009-08-18 16:53 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2002-09-27 01:22 . 2009-08-18 16:53 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2002-09-27 01:22 . 2009-08-19 16:32 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 1980-01-01 08:00 . 2009-03-08 08:32 72704 c:\windows\system32\admparse.dll
+ 2009-08-20 02:20 . 2009-08-20 02:20 24064 c:\windows\Installer\21a442c.msi
+ 2009-08-18 22:23 . 2009-03-08 08:33 12288 c:\windows\ie8updates\KB972260-IE8\xpshims.dll
+ 2009-08-18 22:23 . 2009-03-08 08:31 55296 c:\windows\ie8updates\KB972260-IE8\msfeedsbs.dll
+ 2009-08-18 22:23 . 2009-03-08 08:33 25600 c:\windows\ie8updates\KB972260-IE8\jsproxy.dll
+ 2009-08-18 22:21 . 2009-03-08 18:23 58464 c:\windows\ie8\spuninst\iecustom.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 44544 c:\windows\ie8\pngfilt.dll
+ 2009-08-18 22:21 . 2006-10-17 16:28 48128 c:\windows\ie8\mshtmler.dll
+ 2009-08-18 22:21 . 2006-10-17 16:56 45568 c:\windows\ie8\mshta.exe
+ 2009-08-18 22:21 . 2006-10-17 16:58 12288 c:\windows\ie8\msfeedssync.exe
+ 2009-08-18 22:21 . 2009-06-29 16:12 52224 c:\windows\ie8\msfeedsbs.dll
+ 2009-08-18 22:21 . 2006-10-17 17:05 40960 c:\windows\ie8\licmgr10.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 27648 c:\windows\ie8\jsproxy.dll
+ 2009-08-18 22:21 . 2006-11-07 08:26 92672 c:\windows\ie8\inseng.dll
+ 2009-08-18 22:21 . 2006-10-17 16:57 36352 c:\windows\ie8\imgutil.dll
+ 2009-08-18 22:21 . 2006-11-07 08:26 55296 c:\windows\ie8\iesetup.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 44544 c:\windows\ie8\iernonce.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 78336 c:\windows\ie8\ieencode.dll
+ 2009-08-18 22:21 . 2009-06-29 11:07 70656 c:\windows\ie8\ie4uinit.exe
+ 2009-08-18 22:21 . 2009-06-29 16:12 63488 c:\windows\ie8\icardie.dll
+ 2009-08-18 22:21 . 2006-10-17 16:44 60416 c:\windows\ie8\hmmapi.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 17408 c:\windows\ie8\corpol.dll
+ 2009-08-18 22:21 . 2006-11-07 08:26 71680 c:\windows\ie8\admparse.dll
+ 2009-01-05 19:44 . 2009-01-05 19:44 53248 c:\windows\bdoscandel.exe
+ 2009-08-18 19:30 . 2009-08-18 19:30 86016 c:\windows\BDOSCAN8\librtvr.dll
+ 2009-08-18 19:30 . 2009-08-18 19:30 27136 c:\windows\BDOSCAN8\avxt.dll
+ 2009-08-18 19:30 . 2009-08-18 19:30 10240 c:\windows\BDOSCAN8\avxs.dll
+ 2009-08-18 19:30 . 2009-08-18 19:30 45056 c:\windows\BDOSCAN8\avxdisk.dll
+ 2009-08-18 17:27 . 2008-04-14 00:12 5120 c:\windows\system32\dllcache\cache\sfc.dll
+ 2009-08-18 17:27 . 2002-08-29 13:00 2944 c:\windows\system32\dllcache\cache\null.sys
+ 2009-08-18 22:23 . 2009-03-08 08:35 2048 c:\windows\ie8updates\KB972636-IE8\iecompat.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 655872 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcr90.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 572928 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcp90.dll
+ 2008-07-29 07:54 . 2008-07-29 07:54 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcm90.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 161784 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2\atl90.dll
+ 2007-01-19 16:20 . 2009-01-07 22:21 121856 c:\windows\system32\xmllite.dll
- 2007-01-19 16:20 . 2008-04-14 00:12 121856 c:\windows\system32\xmllite.dll
+ 2006-10-17 17:05 . 2009-03-08 08:34 208384 c:\windows\system32\WinFXDocObj.exe
+ 1980-01-01 08:00 . 2009-03-08 08:34 236544 c:\windows\system32\webcheck.dll
+ 2002-02-26 22:58 . 2009-03-08 08:33 420352 c:\windows\system32\vbscript.dll
- 1980-01-01 08:00 . 2009-06-29 16:12 105984 c:\windows\system32\url.dll
+ 1980-01-01 08:00 . 2009-03-08 08:34 105984 c:\windows\system32\url.dll
+ 1980-01-01 08:00 . 2009-07-03 17:09 206848 c:\windows\system32\occache.dll
+ 1980-01-01 08:00 . 2009-03-08 08:32 611840 c:\windows\system32\mstime.dll
+ 1980-01-01 08:00 . 2009-03-08 08:34 193536 c:\windows\system32\msrating.dll
- 1980-01-01 08:00 . 2006-11-08 02:03 156160 c:\windows\system32\msls31.dll
+ 1980-01-01 08:00 . 2009-03-08 08:22 156160 c:\windows\system32\msls31.dll
+ 2006-11-08 02:03 . 2009-07-03 17:09 594432 c:\windows\system32\msfeeds.dll
+ 2009-01-07 22:20 . 2009-01-07 22:20 265720 c:\windows\system32\msdbg2.dll
+ 2009-07-18 03:12 . 2009-07-18 03:12 257440 c:\windows\system32\Macromed\Flash\FlashUtil10c.exe
+ 2003-01-13 22:57 . 2009-03-08 08:33 726528 c:\windows\system32\jscript.dll
+ 2006-11-08 02:03 . 2009-03-08 08:22 164352 c:\windows\system32\ieui.dll
+ 1980-01-01 08:00 . 2009-07-03 17:09 184320 c:\windows\system32\iepeers.dll
+ 1980-01-01 08:00 . 2009-07-03 17:09 386048 c:\windows\system32\iedkcs32.dll
+ 2006-10-17 16:27 . 2009-03-08 08:11 445952 c:\windows\system32\ieapfltr.dll
+ 1980-01-01 08:00 . 2009-03-08 08:32 163840 c:\windows\system32\ieakui.dll
+ 1980-01-01 08:00 . 2009-03-08 08:33 229376 c:\windows\system32\ieaksie.dll
+ 1980-01-01 08:00 . 2009-03-08 08:33 125952 c:\windows\system32\ieakeng.dll
+ 1980-01-01 08:00 . 2009-07-03 11:01 173056 c:\windows\system32\ie4uinit.exe
+ 1980-01-01 08:00 . 2009-03-08 08:31 216064 c:\windows\system32\dxtrans.dll
+ 1980-01-01 08:00 . 2009-03-08 08:31 348160 c:\windows\system32\dxtmsft.dll
+ 2006-11-08 02:03 . 2009-07-03 17:09 915456 c:\windows\system32\dllcache\wininet.dll
+ 2006-11-08 02:03 . 2009-03-08 08:34 236544 c:\windows\system32\dllcache\webcheck.dll
+ 2006-11-08 02:03 . 2009-03-08 08:33 759296 c:\windows\system32\dllcache\VGX.dll
+ 2008-05-09 10:53 . 2009-03-08 08:33 420352 c:\windows\system32\dllcache\vbscript.dll
+ 2006-10-17 17:05 . 2009-03-08 08:34 105984 c:\windows\system32\dllcache\url.dll
- 2006-10-17 17:05 . 2009-06-29 16:12 105984 c:\windows\system32\dllcache\url.dll
+ 2009-01-07 22:20 . 2009-01-07 22:20 134144 c:\windows\system32\dllcache\sqmapi.dll
+ 2009-01-07 22:20 . 2009-01-07 22:20 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2006-10-17 17:04 . 2009-07-03 17:09 206848 c:\windows\system32\dllcache\occache.dll
+ 2006-11-08 02:03 . 2009-03-08 08:32 611840 c:\windows\system32\dllcache\mstime.dll
+ 2006-10-17 17:05 . 2009-03-08 08:34 193536 c:\windows\system32\dllcache\msrating.dll
+ 2006-11-08 02:03 . 2009-03-08 08:22 156160 c:\windows\system32\dllcache\msls31.dll
- 2006-11-08 02:03 . 2006-11-08 02:03 156160 c:\windows\system32\dllcache\msls31.dll
+ 2007-12-07 02:21 . 2009-07-03 17:09 594432 c:\windows\system32\dllcache\msfeeds.dll
+ 2008-05-09 10:53 . 2009-03-08 08:33 726528 c:\windows\system32\dllcache\jscript.dll
+ 2006-10-17 17:04 . 2009-03-08 18:09 638816 c:\windows\system32\dllcache\iexplore.exe
+ 2006-11-08 02:03 . 2009-07-03 17:09 184320 c:\windows\system32\dllcache\iepeers.dll
+ 2006-11-07 08:27 . 2009-07-03 17:09 386048 c:\windows\system32\dllcache\iedkcs32.dll
+ 2007-12-07 02:21 . 2009-03-08 08:11 445952 c:\windows\system32\dllcache\ieapfltr.dll
+ 2006-11-07 08:25 . 2009-03-08 08:32 163840 c:\windows\system32\dllcache\ieakui.dll
+ 2006-11-07 08:27 . 2009-03-08 08:33 229376 c:\windows\system32\dllcache\ieaksie.dll
+ 2006-11-07 08:26 . 2009-03-08 08:33 125952 c:\windows\system32\dllcache\ieakeng.dll
+ 2006-11-07 08:26 . 2009-07-03 11:01 173056 c:\windows\system32\dllcache\ie4uinit.exe
+ 2006-10-17 16:57 . 2009-03-08 08:31 216064 c:\windows\system32\dllcache\dxtrans.dll
+ 2006-10-17 16:58 . 2009-03-08 08:31 348160 c:\windows\system32\dllcache\dxtmsft.dll
+ 2009-08-18 17:27 . 2008-04-14 00:12 507904 c:\windows\system32\dllcache\cache\winlogon.exe
+ 2009-08-18 17:27 . 2009-06-29 16:12 827392 c:\windows\system32\dllcache\cache\wininet.dll
+ 2009-08-18 17:27 . 2008-04-14 00:12 578560 c:\windows\system32\dllcache\cache\user32.dll
+ 2009-08-18 17:27 . 2008-04-14 00:12 295424 c:\windows\system32\dllcache\cache\termsrv.dll
+ 2009-08-18 17:27 . 2008-06-20 11:51 361600 c:\windows\system32\dllcache\cache\tcpip.sys
+ 2009-08-18 17:27 . 2008-04-14 00:12 171008 c:\windows\system32\dllcache\cache\srsvc.dll
+ 2009-08-18 17:27 . 2009-02-06 11:11 110592 c:\windows\system32\dllcache\cache\services.exe
+ 2009-08-18 17:27 . 2008-04-14 00:12 181248 c:\windows\system32\dllcache\cache\scecli.dll
+ 2009-08-18 17:27 . 2009-02-09 12:10 401408 c:\windows\system32\dllcache\cache\rpcss.dll
+ 2009-08-18 17:27 . 2008-04-14 00:12 409088 c:\windows\system32\dllcache\cache\qmgr.dll
+ 2009-08-18 17:27 . 2008-04-14 00:12 435200 c:\windows\system32\dllcache\cache\ntmssvc.dll
+ 2009-08-18 17:27 . 2008-04-13 19:15 574976 c:\windows\system32\dllcache\cache\ntfs.sys
+ 2009-08-18 17:27 . 2008-04-14 00:12 407040 c:\windows\system32\dllcache\cache\netlogon.dll
+ 2009-08-18 17:27 . 2008-04-13 19:20 182656 c:\windows\system32\dllcache\cache\ndis.sys
+ 2009-08-18 17:27 . 2008-04-14 00:11 927504 c:\windows\system32\dllcache\cache\mfc40u.dll
+ 2009-08-18 17:27 . 2009-03-21 14:06 989696 c:\windows\system32\dllcache\cache\kernel32.dll
+ 2009-08-18 17:27 . 2008-04-14 00:11 110080 c:\windows\system32\dllcache\cache\imm32.dll
+ 2009-08-18 17:27 . 2008-04-14 00:11 792064 c:\windows\system32\dllcache\cache\comres.dll
+ 2009-08-18 17:27 . 2008-04-14 00:11 617472 c:\windows\system32\dllcache\cache\comctl32.dll
+ 2009-08-18 17:27 . 2008-04-14 00:11 167936 c:\windows\system32\dllcache\cache\appmgmts.dll
+ 2009-08-18 17:27 . 2008-04-13 16:39 142592 c:\windows\system32\dllcache\cache\aec.sys
+ 2006-11-07 08:26 . 2009-03-08 08:32 128512 c:\windows\system32\dllcache\advpack.dll
+ 2009-08-18 22:32 . 2009-08-19 16:32 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
+ 1980-01-01 08:00 . 2009-03-08 08:32 128512 c:\windows\system32\advpack.dll
+ 2009-03-20 15:48 . 2009-03-20 15:48 183808 c:\windows\Installer\566ae.msp
+ 2009-08-19 02:35 . 2009-08-19 02:35 228352 c:\windows\Installer\235d4.msi
+ 2009-08-18 22:23 . 2008-07-08 13:02 382840 c:\windows\ie8updates\KB972636-IE8\spuninst\updspapi.dll
+ 2009-08-18 22:23 . 2008-07-08 13:02 231288 c:\windows\ie8updates\KB972636-IE8\spuninst\spuninst.exe
+ 2009-08-18 22:23 . 2009-03-08 08:34 914944 c:\windows\ie8updates\KB972260-IE8\wininet.dll
+ 2009-08-18 22:23 . 2009-05-26 11:40 382840 c:\windows\ie8updates\KB972260-IE8\spuninst\updspapi.dll
+ 2009-08-18 22:23 . 2009-05-26 11:40 231288 c:\windows\ie8updates\KB972260-IE8\spuninst\spuninst.exe
+ 2009-08-18 22:23 . 2009-03-08 08:34 109568 c:\windows\ie8updates\KB972260-IE8\occache.dll
+ 2009-08-18 22:23 . 2009-03-08 08:32 594432 c:\windows\ie8updates\KB972260-IE8\msfeeds.dll
+ 2009-08-18 22:23 . 2009-03-08 08:33 246784 c:\windows\ie8updates\KB972260-IE8\ieproxy.dll
+ 2009-08-18 22:23 . 2009-03-08 08:31 183808 c:\windows\ie8updates\KB972260-IE8\iepeers.dll
+ 2009-08-18 22:23 . 2009-03-08 18:09 391536 c:\windows\ie8updates\KB972260-IE8\iedkcs32.dll
+ 2009-08-18 22:23 . 2009-03-08 08:32 173056 c:\windows\ie8updates\KB972260-IE8\ie4uinit.exe
+ 2009-08-18 22:21 . 2009-06-29 16:12 827392 c:\windows\ie8\wininet.dll
+ 2009-08-18 22:21 . 2006-10-17 17:05 206336 c:\windows\ie8\winfxdocobj.exe
+ 2009-08-18 22:21 . 2009-06-29 16:12 233472 c:\windows\ie8\webcheck.dll
+ 2009-08-18 22:21 . 2007-07-12 23:31 765952 c:\windows\ie8\vgx.dll
+ 2009-08-18 22:21 . 2008-05-09 10:53 430080 c:\windows\ie8\vbscript.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 105984 c:\windows\ie8\url.dll
+ 2009-08-18 22:21 . 2009-01-07 22:21 382496 c:\windows\ie8\spuninst\updspapi.dll
+ 2009-08-18 22:21 . 2009-01-07 22:20 231456 c:\windows\ie8\spuninst\spuninst.exe
+ 2009-08-18 22:21 . 2006-09-06 21:43 213216 c:\windows\ie8\spuninst.exe
+ 2009-08-18 22:21 . 2009-06-29 16:12 102912 c:\windows\ie8\occache.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 671232 c:\windows\ie8\mstime.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 193024 c:\windows\ie8\msrating.dll
+ 2009-08-18 22:21 . 2006-11-08 02:03 156160 c:\windows\ie8\msls31.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 477696 c:\windows\ie8\mshtmled.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 459264 c:\windows\ie8\msfeeds.dll
+ 2009-08-18 22:21 . 2008-05-09 10:53 512000 c:\windows\ie8\jscript.dll
+ 2009-08-18 22:21 . 2009-06-29 08:35 634632 c:\windows\ie8\iexplore.exe
+ 2009-08-18 22:21 . 2006-11-08 02:03 180736 c:\windows\ie8\ieui.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 268288 c:\windows\ie8\iertutil.dll
+ 2009-08-18 22:21 . 2006-11-08 02:03 287744 c:\windows\ie8\ieproxy.dll
+ 2009-08-18 22:21 . 2006-11-08 02:03 191488 c:\windows\ie8\iepeers.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 385024 c:\windows\ie8\iedkcs32.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 380928 c:\windows\ie8\ieapfltr.dll
+ 2009-08-18 22:21 . 2009-06-29 08:33 161792 c:\windows\ie8\ieakui.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 230400 c:\windows\ie8\ieaksie.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 153088 c:\windows\ie8\ieakeng.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 214528 c:\windows\ie8\dxtrans.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 347136 c:\windows\ie8\dxtmsft.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 124928 c:\windows\ie8\advpack.dll
+ 2009-09-05 22:17 . 2009-09-05 22:17 249856 c:\windows\ERDNT\AutoBackup\9-5-2009\Users\00000002\UsrClass.dat
+ 2009-09-05 22:17 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\9-5-2009\ERDNT.EXE
+ 2009-08-31 04:49 . 2009-08-31 04:49 249856 c:\windows\ERDNT\AutoBackup\8-31-2009\Users\00000002\UsrClass.dat
+ 2009-08-31 04:49 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\8-31-2009\ERDNT.EXE
+ 2009-08-30 16:23 . 2009-08-30 16:23 249856 c:\windows\ERDNT\AutoBackup\8-30-2009\Users\00000002\UsrClass.dat
+ 2009-08-30 16:23 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\8-30-2009\ERDNT.EXE
+ 2009-08-29 12:34 . 2009-08-29 12:34 249856 c:\windows\ERDNT\AutoBackup\8-29-2009\Users\00000002\UsrClass.dat
+ 2009-08-29 12:34 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\8-29-2009\ERDNT.EXE
+ 2009-08-28 18:29 . 2009-08-28 18:29 249856 c:\windows\ERDNT\AutoBackup\8-28-2009\Users\00000002\UsrClass.dat
+ 2009-08-28 18:29 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\8-28-2009\ERDNT.EXE
+ 2009-08-28 01:38 . 2009-08-28 01:38 249856 c:\windows\ERDNT\AutoBackup\8-27-2009\Users\00000002\UsrClass.dat
+ 2009-08-28 01:38 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\8-27-2009\ERDNT.EXE
+ 2009-08-26 16:43 . 2009-08-26 16:43 249856 c:\windows\ERDNT\AutoBackup\8-26-2009\Users\00000002\UsrClass.dat
+ 2009-08-26 16:43 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\8-26-2009\ERDNT.EXE
+ 2009-08-25 12:47 . 2009-08-25 12:47 249856 c:\windows\ERDNT\AutoBackup\8-25-2009\Users\00000002\UsrClass.dat
+ 2009-08-25 12:47 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\8-25-2009\ERDNT.EXE
+ 2009-08-24 07:17 . 2009-08-24 07:17 249856 c:\windows\ERDNT\AutoBackup\8-24-2009\Users\00000002\UsrClass.dat
+ 2009-08-24 07:17 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\8-24-2009\ERDNT.EXE
+ 2009-08-24 00:27 . 2009-08-24 00:27 249856 c:\windows\ERDNT\AutoBackup\8-23-2009\Users\00000002\UsrClass.dat
+ 2009-08-24 00:27 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\8-23-2009\ERDNT.EXE
+ 2009-08-20 08:11 . 2009-08-20 08:11 249856 c:\windows\ERDNT\AutoBackup\8-20-2009\Users\00000002\UsrClass.dat
+ 2009-08-20 08:11 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\8-20-2009\ERDNT.EXE
+ 2009-08-19 16:34 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\8-19-2009\ERDNT.EXE
+ 2009-08-18 19:11 . 2005-10-20 16:02 163328 c:\windows\ERDNT\8-18-2009\ERDNT.EXE
+ 2009-01-05 19:44 . 2009-01-05 19:44 741376 c:\windows\Downloaded Program Files\ipsupd.dll
+ 2009-01-05 19:44 . 2009-08-18 19:30 142848 c:\windows\BDOSCAN8\libfn.dll
+ 2009-01-05 19:44 . 2009-01-05 19:44 741376 c:\windows\BDOSCAN8\ipsupd.dll
+ 2009-01-05 19:44 . 2009-08-18 19:30 102400 c:\windows\BDOSCAN8\bdcore.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 3783672 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90u.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 3768312 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90.dll
+ 2003-07-14 00:03 . 2009-07-03 17:09 1208832 c:\windows\system32\urlmon.dll
+ 2003-07-14 00:02 . 2009-07-19 13:18 5937152 c:\windows\system32\mshtml.dll
+ 2006-10-17 16:57 . 2009-07-03 17:09 1985536 c:\windows\system32\iertutil.dll
+ 2006-09-06 04:01 . 2009-02-07 01:07 3698584 c:\windows\system32\ieapfltr.dat
+ 2006-11-08 02:03 . 2009-07-03 17:09 1208832 c:\windows\system32\dllcache\urlmon.dll
+ 2009-01-07 22:20 . 2009-01-07 22:20 1497088 c:\windows\system32\dllcache\shdocvw.dll
+ 2006-11-08 02:03 . 2009-07-19 13:18 5937152 c:\windows\system32\dllcache\mshtml.dll
+ 2007-12-07 02:21 . 2009-07-03 17:09 1985536 c:\windows\system32\dllcache\iertutil.dll
+ 2007-04-17 09:32 . 2009-02-07 01:07 3698584 c:\windows\system32\dllcache\ieapfltr.dat
+ 2009-08-18 17:27 . 2008-04-14 00:12 1614848 c:\windows\system32\dllcache\cache\sfcfiles.dll
+ 2009-08-18 17:27 . 2009-02-06 11:08 2189056 c:\windows\system32\dllcache\cache\ntoskrnl.exe
+ 2009-08-18 17:27 . 2009-02-07 23:02 2066048 c:\windows\system32\dllcache\cache\ntkrnlpa.exe
+ 2009-08-18 17:27 . 2009-07-19 13:33 3597824 c:\windows\system32\dllcache\cache\mshtml.dll
+ 2009-08-18 17:27 . 2008-04-14 00:12 1033728 c:\windows\system32\dllcache\cache\explorer.exe
+ 2009-01-07 22:20 . 2009-01-07 22:20 1022976 c:\windows\system32\dllcache\browseui.dll
+ 2009-08-18 22:23 . 2009-03-08 08:34 1206784 c:\windows\ie8updates\KB972260-IE8\urlmon.dll
+ 2009-08-18 22:23 . 2009-03-08 08:41 5937152 c:\windows\ie8updates\KB972260-IE8\mshtml.dll
+ 2009-08-18 22:23 . 2009-03-08 08:32 1985024 c:\windows\ie8updates\KB972260-IE8\iertutil.dll
+ 2009-08-18 22:21 . 2009-06-29 16:12 1159680 c:\windows\ie8\urlmon.dll
+ 2009-08-18 22:21 . 2009-07-19 13:33 3597824 c:\windows\ie8\mshtml.dll
+ 2009-08-18 22:21 . 2009-07-19 13:32 6067200 c:\windows\ie8\ieframe.dll
+ 2009-08-18 22:21 . 2009-06-29 08:33 2452872 c:\windows\ie8\ieapfltr.dat
+ 2009-09-05 22:17 . 2009-09-05 22:17 7536640 c:\windows\ERDNT\AutoBackup\9-5-2009\Users\00000001\NTUSER.DAT
+ 2009-08-31 04:49 . 2009-08-31 04:49 7561216 c:\windows\ERDNT\AutoBackup\8-31-2009\Users\00000001\NTUSER.DAT
+ 2009-08-30 16:22 . 2009-08-30 16:23 7553024 c:\windows\ERDNT\AutoBackup\8-30-2009\Users\00000001\NTUSER.DAT
+ 2009-08-29 12:34 . 2009-08-29 12:34 7553024 c:\windows\ERDNT\AutoBackup\8-29-2009\Users\00000001\NTUSER.DAT
+ 2009-08-28 18:29 . 2009-08-28 18:29 7536640 c:\windows\ERDNT\AutoBackup\8-28-2009\Users\00000001\NTUSER.DAT
+ 2009-08-28 01:38 . 2009-08-28 01:38 7536640 c:\windows\ERDNT\AutoBackup\8-27-2009\Users\00000001\NTUSER.DAT
+ 2009-08-26 16:43 . 2009-08-26 16:43 7528448 c:\windows\ERDNT\AutoBackup\8-26-2009\Users\00000001\NTUSER.DAT
+ 2009-08-25 12:47 . 2009-08-25 12:47 7512064 c:\windows\ERDNT\AutoBackup\8-25-2009\Users\00000001\NTUSER.DAT
+ 2009-08-24 07:17 . 2009-08-24 07:17 7503872 c:\windows\ERDNT\AutoBackup\8-24-2009\Users\00000001\NTUSER.DAT
+ 2009-08-24 00:27 . 2009-08-24 00:27 7499776 c:\windows\ERDNT\AutoBackup\8-23-2009\Users\00000001\NTUSER.DAT
+ 2009-08-20 08:11 . 2009-08-20 08:11 7495680 c:\windows\ERDNT\AutoBackup\8-20-2009\Users\00000001\NTUSER.DAT
+ 2006-11-08 02:03 . 2009-07-19 22:48 11067392 c:\windows\system32\ieframe.dll
+ 2007-12-07 02:21 . 2009-07-19 22:48 11067392 c:\windows\system32\dllcache\ieframe.dll
+ 2009-08-18 22:23 . 2009-03-08 08:39 11063808 c:\windows\ie8updates\KB972260-IE8\ieframe.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-06-16 21:22 1144712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-16 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-16 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-06 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PSQLLauncher"="c:\program files\ThinkVantage Fingerprint Software\launcher.exe" [2007-08-14 48904]
"BMMGAG"="c:\progra~1\ThinkPad\UTILIT~1\pwrmonit.dll" [2003-01-17 64000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"BMMLREF"="c:\program files\ThinkPad\Utilities\BMMLREF.EXE" [2003-01-17 20480]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-04-30 315392]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2002-12-24 204800]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-02 185896]
"TPHOTKEY"="c:\progra~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [2003-08-07 94208]
"TPKMAPHELPER"="c:\program files\ThinkPad\Utilities\TpKmapAp.exe" [2003-08-08 897024]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-07-31 512000]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-07-31 110592]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-02-16 282624]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"TpShocks"="TpShocks.exe" - c:\windows\system32\TpShocks.exe [2008-06-06 181536]
"BluetoothAuthenticationAgent"="irprops.cpl" - c:\windows\system32\irprops.cpl [2008-04-14 380416]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2003-06-27 88363]
"S3TRAY2"="S3Tray2.exe" - c:\windows\system32\S3Tray2.exe [2001-10-12 69632]
"TP4EX"="tp4ex.exe" - c:\windows\system32\TP4EX.exe [2002-09-04 53248]

c:\documents and settings\Aaron\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ------w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2007-08-14 19:54 89600 ------w- c:\windows\system32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft Office\\OFFICE11\\WINWORD.EXE"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe"=
"c:\\WINDOWS\\system32\\taskmgr.exe"=
"c:\\IBMTOOLS\\Updater\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\Microsoft Office\\OFFICE11\\POWERPNT.EXE"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

R0 ezgmntr;EZ GIG II Backup Archive Explorer;c:\windows\system32\drivers\ezgmntr.sys [4/20/2007 9:54 PM 213696]
R0 Shockprf;Shockprf;c:\windows\system32\drivers\ApsX86.sys [5/14/2008 4:21 PM 114728]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [5/14/2008 4:21 PM 19496]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [4/28/2009 11:33 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [4/28/2009 11:33 AM 74480]
R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [1/20/2007 2:07 AM 15360]
R1 tvtumon;tvtumon;c:\windows\system32\drivers\tvtumon.sys [5/9/2008 5:50 AM 46144]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8/18/2009 10:37 PM 108289]
R2 ezgfsfilt;EZ GIG II FS Filter;c:\windows\system32\drivers\ezgfsfilt.sys [4/20/2007 9:54 PM 28800]
R2 smihlp;SMI Helper Driver (smihlp);c:\program files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys [8/14/2007 3:46 PM 10896]
R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [5/14/2008 4:25 PM 520192]
R2 TVT_UpdateMonitor;TVT Windows Update Monitor;c:\program files\Lenovo\Rescue and Recovery\UpdateMonitor.exe [5/9/2008 5:50 AM 253952]
R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [2/22/2008 4:54 PM 37312]
S2 wwdliucd;USB Audio (WDM)Helper;c:\windows\System32\svchost.exe -k netsvcs [1/1/1980 4:00 AM 14336]
S3 PCDRDRV;Pcdr Helper Driver;\??\c:\progra~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys --> c:\progra~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys [?]
S3 PCX504;Cisco Systems Wireless LAN Adapter Driver;c:\windows\system32\drivers\PCX504.sys [1/1/1980 4:00 AM 96256]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [4/28/2009 11:33 AM 7408]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
wwdliucd
cexuz

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-20 c:\windows\Tasks\BMMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\BMMTASK.EXE [2007-01-20 09:32]

2009-09-05 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-19 18:19]

2009-09-05 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-06-16 21:22]
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.uscis.gov/
uInternet Connection Wizard,ShellNext = hxxp:///
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Save YouTube Video - c:\program files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP4.htm
IE: Save YouTube Video as MP3 - c:\program files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP3.htm
IE: Subscribe in default RSS reader - c:\documents and settings\Aaron\Application Data\RssBandit\iecontext_subscribefeed.htm
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {036F8A56-0BC8-4607-8F98-D3231E6FF5ED} - hxxp://conference.cpbis.gatech.edu/SiteRoots/main/Install/win32/CentraUpdaterAx.cab
DPF: {897520CD-B1C8-4745-B46D-B03CF8701BB8} - hxxp://jigsaw.com/cab/app/JigsawContactFinder.CAB
FF - ProfilePath - c:\documents and settings\Aaron\Application Data\Mozilla\Firefox\Profiles\uxdqwci5.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - hxxp://www.uscis.gov/
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=
FF - component: c:\program files\Common Files\DVDVideoSoft\Dll\FFContextMenuY\components\FFContextMenu.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-05 18:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-759709484-1590946691-836536277-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4C4BAB43-E4FD-4034-8290-50EDB73F7550}\iexplore]
@DACL=(02 0000)
"Type"=dword:00000003
"Flags"=dword:00000000
"Count"=dword:00000021
"Time"=hex:d8,07,0c,00,01,00,1d,00,16,00,16,00,0f,00,02,02

[HKEY_USERS\S-1-5-21-759709484-1590946691-836536277-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F77523C7-A773-4609-BF6B-0BE67D44C646}\iexplore]
@DACL=(02 0000)
"Type"=dword:00000003
"Flags"=dword:00000000
"Count"=dword:0000001b
"Time"=hex:d8,07,0c,00,01,00,1d,00,16,00,16,00,11,00,47,01

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{4c4bab43-e4fd-4034-8290-50edb73f7550}\InprocServer32]
@DACL=(02 0000)
@="c:\\WINDOWS\\system32\\wapcry.dll"
"ThreadingModel"="free"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"Installed"="1"
"NoChange"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed"="1"
@=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(748)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\psqlpwd.dll
c:\program files\ThinkVantage Fingerprint Software\homefus2.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\program files\ThinkVantage Fingerprint Software\infra.dll
c:\program files\ThinkVantage Fingerprint Software\homepass.dll
c:\program files\ThinkVantage Fingerprint Software\bio.dll
c:\program files\ThinkVantage Fingerprint Software\ps2css.dll
c:\program files\ThinkVantage Fingerprint Software\remote.dll
c:\program files\ThinkVantage Fingerprint Software\pscssint.dll

- - - - - - - > 'lsass.exe'(804)
c:\windows\system32\psqlpwd.dll
c:\program files\ThinkVantage Fingerprint Software\homefus2.dll
c:\program files\ThinkVantage Fingerprint Software\infra.dll

- - - - - - - > 'explorer.exe'(1816)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
c:\progra~1\ThinkPad\UTILIT~1\pwrmonit.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
c:\windows\system32\TPHDEXLG.exe
c:\windows\system32\TpKmpSvc.exe
c:\program files\Lenovo\Rescue and Recovery\rrservice.exe
c:\program files\Common Files\Lenovo\Scheduler\tvtsched.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
c:\program files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
c:\program files\SpywareGuard\sgbhp.exe
.
**************************************************************************
.
Completion time: 2009-09-05 18:37 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-05 22:37
ComboFix2.txt 2009-08-18 17:30

Pre-Run: 42,723,741,696 bytes free
Post-Run: 43,739,561,984 bytes free

688 --- E O F --- 2009-08-26 19:02

#6 nursesoldier

nursesoldier
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:08 AM

Posted 05 September 2009 - 06:10 PM

GMER log attached

#7 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:08 AM

Posted 05 September 2009 - 06:48 PM

Hello.

I don't see the attached GMER log.

Run ComboFix with CFScript
We will run ComboFix again with a script.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are unsure how.
  • Open notepad (Start>Run>"notepad") and copy/paste the text in the box below into it:
    File::
    c:\documents and settings\All Users\Application Data\imyliv.bin
    c:\program files\Common Files\upiqavem._dl
    c:\program files\Common Files\vadukefu._dl
    c:\windows\system32\enisulyzu.exe
    c:\program files\Common Files\yhyryjyw.exe
    c:\documents and settings\Aaron\Application Data\xycuqi.dat
    c:\documents and settings\All Users\Application Data\awawag.sys
    
    NetSvc::
    wwdliucd
    cexuz
    
    RegLock::
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
    
    RegLockDel::
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{4c4bab43-e4fd-4034-8290-50edb73f7550}]
    
    FileLook::
    c:\windows\system32\kerberos.dll
    c:\windows\system32\schannel.dll
    c:\windows\system32\msv1_0.dll
    c:\windows\System32\svchost.exe
    
    Registry::
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\drivers\\svchost.exe"=-
    
    Driver::
    wwdliucd
    cexuz
    Save this as CFScript.txt, in the same location as ComboFix.exe. (This should be your desktop.)
    Posted Image
    Refering to the picture above, drag CFScript into ComboFix.exe.
When finished, it shall produce a log for you at "C:\ComboFix.txt". Post back with that log.

Do not mouseclick ComboFix's window while it's running. That may cause it to stall

Download and run MalwareBytes Anti-Malware
If you already have MBAM installed, simply update and run a quick scan.

Please download Malwarebytes Anti-Malware setup and to your desktop.
alternate download link 1
alternate download link 2

Refer to the steps given here on installing MalwareBytes, running the scan, and saving the log file (not on using File Assasin).
  • If you have trouble updating, try the other mirror download site.
  • Should the computer in question not be able update using the normal method download the update file from here, using another machine if needed. Simply double click the file to install the updates.
  • If MalwareBytes asks to reboot to remove certain items, do so right away.
Please include the scan logfile in your next reply.
With Regards,
The Panda

#8 nursesoldier

nursesoldier
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:08 AM

Posted 05 September 2009 - 07:56 PM

hello,
not sure what I'm doing wrong. The log from GMER was said to be too long and could not be posted. I tried to attach it as .rar and it did not work either.

COMBOFIX log:

ComboFix 09-09-05.02 - Aaron 09/05/2009 20:39.3.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.596 [GMT -4:00]
Running from: c:\documents and settings\Aaron\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Aaron\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\documents and settings\Aaron\Application Data\xycuqi.dat"
"c:\documents and settings\All Users\Application Data\awawag.sys"
"c:\documents and settings\All Users\Application Data\imyliv.bin"
"c:\program files\Common Files\upiqavem._dl"
"c:\program files\Common Files\vadukefu._dl"
"c:\program files\Common Files\yhyryjyw.exe"
"c:\windows\system32\enisulyzu.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Aaron\Application Data\xycuqi.dat
c:\documents and settings\All Users\Application Data\awawag.sys
c:\documents and settings\All Users\Application Data\imyliv.bin
c:\program files\Common Files\upiqavem._dl
c:\program files\Common Files\vadukefu._dl
c:\program files\Common Files\yhyryjyw.exe
c:\windows\system32\enisulyzu.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CEXUZ
-------\Legacy_WWDLIUCD
-------\Service_wwdliucd


((((((((((((((((((((((((( Files Created from 2009-08-06 to 2009-09-06 )))))))))))))))))))))))))))))))
.

2009-08-26 06:41 . 2009-08-26 06:41 -------- d-sh--w- c:\documents and settings\Aaron\IECompatCache
2009-08-19 02:37 . 2009-07-28 20:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-19 02:37 . 2009-03-30 14:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-08-19 02:37 . 2009-02-13 16:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-08-19 02:37 . 2009-02-13 16:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-08-19 02:37 . 2009-08-19 02:37 -------- d-----w- c:\program files\Avira
2009-08-19 02:37 . 2009-08-19 02:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-08-19 02:26 . 2009-09-06 00:36 -------- d-----w- c:\program files\SpywareGuard
2009-08-18 22:32 . 2009-08-18 22:32 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-08-18 22:30 . 2009-08-18 22:30 -------- d-sh--w- c:\documents and settings\Aaron\PrivacIE
2009-08-18 22:26 . 2009-08-18 22:26 -------- d-sh--w- c:\documents and settings\Aaron\IETldCache
2009-08-18 22:23 . 2009-08-18 22:23 -------- d-----w- c:\windows\ie8updates
2009-08-18 22:21 . 2009-08-18 22:21 -------- dc-h--w- c:\windows\ie8
2009-08-18 22:19 . 2009-07-03 17:09 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-08-18 22:19 . 2009-07-03 17:09 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll
2009-08-18 22:18 . 2009-07-01 07:08 101376 ------w- c:\windows\system32\dllcache\iecompat.dll
2009-08-18 19:29 . 2009-08-18 22:34 -------- d-----w- c:\windows\BDOSCAN8
2009-08-18 19:02 . 2009-08-18 19:02 -------- d-----w- c:\program files\TeaTimer (Spybot - Search & Destroy)
2009-08-18 19:02 . 2009-08-18 19:02 -------- d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-08-18 18:08 . 2009-08-18 18:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-18 18:08 . 2009-08-18 18:08 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-18 17:21 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe
2009-08-18 17:21 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\dllcache\proquota.exe
2009-08-18 17:03 . 2009-08-18 17:03 -------- d-----w- c:\program files\Trend Micro
2009-08-18 16:03 . 2009-08-18 22:51 -------- d-----w- c:\program files\SpywareBlaster
2009-08-18 16:03 . 2009-08-18 16:03 -------- d-----w- c:\program files\ERUNT
2009-08-17 23:36 . 2009-08-17 23:36 -------- d--h--w- c:\windows\system32\GroupPolicy
2009-08-17 21:14 . 2009-08-17 21:14 -------- d-----w- C:\_OTM
2009-08-11 22:14 . 2009-08-11 22:22 -------- d-----w- c:\documents and settings\Aaron\Local Settings\Application Data\AskToolbar
2009-08-11 22:14 . 2009-08-11 22:14 -------- d-----w- c:\program files\Ask.com
2009-08-11 21:00 . 2009-08-11 21:01 -------- d-----w- C:\2b055e90dcb7821dbcecf79e
2009-08-11 21:00 . 2009-08-11 21:33 -------- d-----w- c:\windows\SxsCaPendDel
2009-08-11 20:17 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-05 03:20 . 2007-01-19 21:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-08-20 02:22 . 2007-04-13 05:47 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-20 02:20 . 2007-01-19 16:42 -------- d-----w- c:\program files\Google
2009-08-17 22:00 . 2009-04-24 04:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-17 21:56 . 2009-04-30 00:35 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-08-12 01:48 . 2007-02-14 19:08 -------- d-----w- c:\program files\Java
2009-08-12 00:24 . 2007-01-20 05:25 66800 ----a-w- c:\documents and settings\Aaron\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-11 22:21 . 2009-06-03 00:13 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2009-08-11 22:13 . 2009-06-03 00:13 -------- d-----w- c:\program files\DVDVideoSoft
2009-08-05 09:01 . 1980-01-01 08:00 204800 ------w- c:\windows\system32\mswebdvd.dll
2009-08-03 17:36 . 2009-04-24 04:50 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 17:36 . 2009-04-24 04:50 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-31 03:45 . 2008-10-07 18:04 -------- d-----w- c:\documents and settings\Aaron\Application Data\DivX
2009-07-25 09:23 . 2009-03-11 03:45 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:01 . 1980-01-01 08:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 03:43 . 2007-01-20 05:13 286208 ------w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 1980-01-01 08:00 915456 ------w- c:\windows\system32\wininet.dll
2009-06-25 08:25 . 1980-01-01 08:00 730112 ------w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 1980-01-01 08:00 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 1980-01-01 08:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 1980-01-01 08:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:25 . 1980-01-01 08:00 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 1980-01-01 08:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-24 11:18 . 1980-01-01 08:00 92928 ------w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:36 . 1980-01-01 08:00 81920 ------w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 1980-01-01 08:00 119808 ------w- c:\windows\system32\t2embed.dll
2009-06-12 12:31 . 1980-01-01 08:00 80896 ------w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 1980-01-01 08:00 76288 ------w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 1980-01-01 08:00 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 13:19 . 2002-09-27 01:11 2066432 ------w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 1980-01-01 08:00 132096 ------w- c:\windows\system32\wkssvc.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

--- c:\windows\system32\kerberos.dll ---
Company: Microsoft Corporation
File Description: Kerberos Security Package
File Version: 5.1.2600.5834 (xpsp_sp3_gdr.090624-1305)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: kerberos.dll
File size: 301568
Created time: 1980-01-01 08:00
Modified time: 2009-06-25 08:25
MD5: 99EA6AC9B3FEE42E0438A3A24720EE3F
SHA1: C92BC7C31CFBCC5376EA655D4FAD5054E214535D


--- c:\windows\system32\msv1_0.dll ---
Company: Microsoft Corporation
File Description: Microsoft Authentication Package v1.0
File Version: 5.1.2600.5834 (xpsp_sp3_gdr.090624-1305)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: MSV1_0.DLL
File size: 136192
Created time: 1980-01-01 08:00
Modified time: 2009-06-25 08:25
MD5: D2DCC24ACC0350BC61F14ADDDF99AD38
SHA1: 10450F5C0271C675A8F1363CB0F5D1CE7EB20EDC


--- c:\windows\system32\schannel.dll ---
Company: Microsoft Corporation
File Description: TLS / SSL Security Provider
File Version: 5.1.2600.5834 (xpsp_sp3_gdr.090624-1305)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: schannel.dll
File size: 147456
Created time: 1980-01-01 08:00
Modified time: 2009-06-25 08:25
MD5: BFDECE69E293E6DB4E25DEF862418428
SHA1: 413C0298637DB5FD15E55EBE14252B8072B6964D


--- c:\windows\System32\svchost.exe ---
Company: Microsoft Corporation
File Description: Generic Host Process for Win32 Services
File Version: 5.1.2600.5512 (xpsp.080413-2111)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: svchost.exe
File size: 14336
Created time: 1980-01-01 08:00
Modified time: 2008-04-14 00:12
MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18
SHA1: 49083AE3725A0488E0A8FBBE1335C745F70C4667


((((((((((((((((((((((((((((( SnapShot_2009-09-05_22.33.15 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-06 00:45 . 2009-09-06 00:45 16384 c:\windows\temp\Perflib_Perfdata_160.dat
- 2009-09-05 22:32 . 2009-09-05 22:32 16384 c:\windows\temp\Perflib_Perfdata_160.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-06-16 21:22 1144712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-16 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-16 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-06 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PSQLLauncher"="c:\program files\ThinkVantage Fingerprint Software\launcher.exe" [2007-08-14 48904]
"BMMGAG"="c:\progra~1\ThinkPad\UTILIT~1\pwrmonit.dll" [2003-01-17 64000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"BMMLREF"="c:\program files\ThinkPad\Utilities\BMMLREF.EXE" [2003-01-17 20480]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-04-30 315392]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2002-12-24 204800]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-02 185896]
"TPHOTKEY"="c:\progra~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [2003-08-07 94208]
"TPKMAPHELPER"="c:\program files\ThinkPad\Utilities\TpKmapAp.exe" [2003-08-08 897024]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-07-31 512000]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-07-31 110592]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-02-16 282624]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"TpShocks"="TpShocks.exe" - c:\windows\system32\TpShocks.exe [2008-06-06 181536]
"BluetoothAuthenticationAgent"="irprops.cpl" - c:\windows\system32\irprops.cpl [2008-04-14 380416]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2003-06-27 88363]
"S3TRAY2"="S3Tray2.exe" - c:\windows\system32\S3Tray2.exe [2001-10-12 69632]
"TP4EX"="tp4ex.exe" - c:\windows\system32\TP4EX.exe [2002-09-04 53248]

c:\documents and settings\Aaron\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ------w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2007-08-14 19:54 89600 ------w- c:\windows\system32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft Office\\OFFICE11\\WINWORD.EXE"=
"c:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe"=
"c:\\WINDOWS\\system32\\taskmgr.exe"=
"c:\\IBMTOOLS\\Updater\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\Microsoft Office\\OFFICE11\\POWERPNT.EXE"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

R0 ezgmntr;EZ GIG II Backup Archive Explorer;c:\windows\system32\drivers\ezgmntr.sys [4/20/2007 9:54 PM 213696]
R0 Shockprf;Shockprf;c:\windows\system32\drivers\ApsX86.sys [5/14/2008 4:21 PM 114728]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [5/14/2008 4:21 PM 19496]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [4/28/2009 11:33 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [4/28/2009 11:33 AM 74480]
R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [1/20/2007 2:07 AM 15360]
R1 tvtumon;tvtumon;c:\windows\system32\drivers\tvtumon.sys [5/9/2008 5:50 AM 46144]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8/18/2009 10:37 PM 108289]
R2 ezgfsfilt;EZ GIG II FS Filter;c:\windows\system32\drivers\ezgfsfilt.sys [4/20/2007 9:54 PM 28800]
R2 smihlp;SMI Helper Driver (smihlp);c:\program files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys [8/14/2007 3:46 PM 10896]
R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [5/14/2008 4:25 PM 520192]
R2 TVT_UpdateMonitor;TVT Windows Update Monitor;c:\program files\Lenovo\Rescue and Recovery\UpdateMonitor.exe [5/9/2008 5:50 AM 253952]
R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [2/22/2008 4:54 PM 37312]
S3 PCDRDRV;Pcdr Helper Driver;\??\c:\progra~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys --> c:\progra~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys [?]
S3 PCX504;Cisco Systems Wireless LAN Adapter Driver;c:\windows\system32\drivers\PCX504.sys [1/1/1980 4:00 AM 96256]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [4/28/2009 11:33 AM 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-20 c:\windows\Tasks\BMMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\BMMTASK.EXE [2007-01-20 09:32]

2009-09-06 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-19 18:19]

2009-09-06 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-06-16 21:22]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.uscis.gov/
uInternet Connection Wizard,ShellNext = hxxp:///
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Save YouTube Video - c:\program files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP4.htm
IE: Save YouTube Video as MP3 - c:\program files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP3.htm
IE: Subscribe in default RSS reader - c:\documents and settings\Aaron\Application Data\RssBandit\iecontext_subscribefeed.htm
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {036F8A56-0BC8-4607-8F98-D3231E6FF5ED} - hxxp://conference.cpbis.gatech.edu/SiteRoots/main/Install/win32/CentraUpdaterAx.cab
DPF: {897520CD-B1C8-4745-B46D-B03CF8701BB8} - hxxp://jigsaw.com/cab/app/JigsawContactFinder.CAB
FF - ProfilePath - c:\documents and settings\Aaron\Application Data\Mozilla\Firefox\Profiles\uxdqwci5.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - hxxp://www.uscis.gov/
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=
FF - component: c:\program files\Common Files\DVDVideoSoft\Dll\FFContextMenuY\components\FFContextMenu.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-05 20:45
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-759709484-1590946691-836536277-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4C4BAB43-E4FD-4034-8290-50EDB73F7550}\iexplore]
@DACL=(02 0000)
"Type"=dword:00000003
"Flags"=dword:00000000
"Count"=dword:00000021
"Time"=hex:d8,07,0c,00,01,00,1d,00,16,00,16,00,0f,00,02,02

[HKEY_USERS\S-1-5-21-759709484-1590946691-836536277-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F77523C7-A773-4609-BF6B-0BE67D44C646}\iexplore]
@DACL=(02 0000)
"Type"=dword:00000003
"Flags"=dword:00000000
"Count"=dword:0000001b
"Time"=hex:d8,07,0c,00,01,00,1d,00,16,00,16,00,11,00,47,01
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(748)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\psqlpwd.dll
c:\program files\ThinkVantage Fingerprint Software\homefus2.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\program files\ThinkVantage Fingerprint Software\infra.dll
c:\program files\ThinkVantage Fingerprint Software\homepass.dll
c:\program files\ThinkVantage Fingerprint Software\bio.dll
c:\program files\ThinkVantage Fingerprint Software\ps2css.dll
c:\program files\ThinkVantage Fingerprint Software\remote.dll
c:\program files\ThinkVantage Fingerprint Software\pscssint.dll

- - - - - - - > 'lsass.exe'(804)
c:\windows\system32\psqlpwd.dll
c:\program files\ThinkVantage Fingerprint Software\homefus2.dll
c:\program files\ThinkVantage Fingerprint Software\infra.dll

- - - - - - - > 'explorer.exe'(3412)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
c:\progra~1\ThinkPad\UTILIT~1\pwrmonit.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
c:\windows\system32\TPHDEXLG.exe
c:\windows\system32\TpKmpSvc.exe
c:\program files\Lenovo\Rescue and Recovery\rrservice.exe
c:\program files\Common Files\Lenovo\Scheduler\tvtsched.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
c:\program files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
c:\program files\SpywareGuard\sgbhp.exe
.
**************************************************************************
.
Completion time: 2009-09-06 20:50 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-06 00:50
ComboFix2.txt 2009-09-05 22:37
ComboFix3.txt 2009-08-18 17:30

Pre-Run: 43,681,341,440 bytes free
Post-Run: 43,679,256,576 bytes free

351 --- E O F --- 2009-08-26 19:02

#9 nursesoldier

nursesoldier
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:08 AM

Posted 05 September 2009 - 08:03 PM

Malwarebytes' Anti-Malware 1.40
Database version: 2746
Windows 5.1.2600 Service Pack 3

9/5/2009 9:03:15 PM
mbam-log-2009-09-05 (21-03-15).txt

Scan type: Quick Scan
Objects scanned: 102364
Time elapsed: 6 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#10 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:08 AM

Posted 05 September 2009 - 09:25 PM

Hello.

If the GMER log is that long... I don't really want to see it :thumbup2: . It's most likely that ComboFix or MBAM would have detected the rootkits anyways.

Let's get one more scan off.

Run Scan with Kaspersky
Please do a scan with Kaspersky Online Scanner.

If you are using Windows Vista, open your browser by right-clicking on its icon and select Run as administrator to perform this scan.

  • Please disable your realtime protection software before proceeding. Refer to this page if you are unsure how.
  • Open the Kaspersky Scanner page.
  • Click on Accept and install any components it needs.
  • The program will install and then begin downloading the latest definition files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run.
  • Once the scan is complete, click on View scan report
  • Now, click on the Save Report as button.
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
You can refer to this animation by sundavis.

This scanner will only scan. It does not remove any malware it finds.

Please also take a new DDS.txt log after.

Any issues at the moment?

With Regards,
The Panda

#11 nursesoldier

nursesoldier
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:08 AM

Posted 06 September 2009 - 01:43 AM

No issues at the moment. I think the ComboFix did it.
However, the kapersky scan still yield several threats.
Now what?

Thanks for all your help :thumbup2:


Sunday, September 6, 2009
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Sunday, September 06, 2009 04:52:25
Records in database: 2751190
Scan settings
scan using the following database extended
Scan archives yes
Scan e-mail databases yes
Scan area My Computer
C:\
D:\
Scan statistics
Objects scanned 77418
Threats found 1
Infected objects found 16
Suspicious objects found 0
Scan duration 02:35:46

File name Threat Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmamaycono.dll.vir Infected: Packed.Win32.TDSS.z 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmbbshhsqa.dll.vir Infected: Packed.Win32.TDSS.z 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmdcpcrjqv.dll.vir Infected: Packed.Win32.TDSS.z 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmncbqxxmt.dll.vir Infected: Packed.Win32.TDSS.z 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmrnrewwmy.dll.vir Infected: Packed.Win32.TDSS.z 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmthxdnwdk.dll.vir Infected: Packed.Win32.TDSS.z 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmtkltputp.dll.vir Infected: Packed.Win32.TDSS.z 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmvmlfqrss.dll.vir Infected: Packed.Win32.TDSS.z 1
C:\System Volume Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP13\A0000764.dll Infected: Packed.Win32.TDSS.z 1
C:\System Volume Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP13\A0000765.dll Infected: Packed.Win32.TDSS.z 1
C:\System Volume Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP13\A0000766.dll Infected: Packed.Win32.TDSS.z 1
C:\System Volume Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP13\A0000767.dll Infected: Packed.Win32.TDSS.z 1
C:\System Volume Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP13\A0000768.dll Infected: Packed.Win32.TDSS.z 1
C:\System Volume Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP13\A0000769.dll Infected: Packed.Win32.TDSS.z 1
C:\System Volume Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP13\A0000770.dll Infected: Packed.Win32.TDSS.z 1
C:\System Volume Information\_restore{14157744-4FA2-4CAF-BAFB-72CC49941087}\RP13\A0000771.dll Infected: Packed.Win32.TDSS.z 1
Selected area has been scanned.

#12 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:08 AM

Posted 06 September 2009 - 09:19 AM

Hello.

Kaspersky only found items in ComboFix's quarentine and in the System Restore cache, both of which we will clear out.

Unless there are any issues at the moment, we can wrap up.

Uninstall ComboFix
Remove Combofix now that we're done with it.
  • Click on your Start Menu, then Run....
  • Now type the following into the runbox and click OK. Notice the space between the "x" and "/".
    ComboFix /u

    Posted Image
Uninstalling ComboFix will do the following:
  • Delete ComboFix and its components from your computer.
  • Delete other tools commonly used during the malware removal process.
  • Resets clock settings to standard format.
  • Hides file extensions and hidden/system files.
  • Clears System Restore cache and creates new restore point.
Please re-enable any antimalware programs that were disabled during the fix.

Preventing Malware Infection in the Future
Please take some time to look at the following links, giving some advice and suggestions for preventing future infections: For general slowness problems that you may have, take a look at Slow Computer/browser? It May Not Be Malware. Read How to use the Startup Database to identify and disable uneeded processes and increase the amount of available resources.

Do you have any questions or concerns?

With Regards,
The Panda

#13 nursesoldier

nursesoldier
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:08 AM

Posted 06 September 2009 - 09:29 PM

Hello.

Kaspersky only found items in ComboFix's quarentine and in the System Restore cache, both of which we will clear out.

Unless there are any issues at the moment, we can wrap up.


Hello PP,

- how do we clear out those items again?
- I was trying to enter BIOS and it gave the "dmload.sys not found" error

Is it related?

Thanks so much!

#14 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:08 AM

Posted 07 September 2009 - 09:24 AM

Hello.

how do we clear out those items again?

Uninstalling ComboFix will do that.

- I was trying to enter BIOS and it gave the "dmload.sys not found" error

Doesn't quite sound like a malware problem. Let's see if we can find a replacement for the file though.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :filefind
    dmload.sys
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

With Regards,
The Panda

#15 nursesoldier

nursesoldier
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:08 AM

Posted 07 September 2009 - 11:41 AM

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 12:38 on 07/09/2009 by Aaron (Administrator - Elevation successful)

========== filefind ==========

Searching for "dmload.sys"
C:\WINDOWS\system32\drivers\dmload.sys ------ 5888 bytes [08:00 01/01/1980] [13:00 29/08/2002] E9317282A63CA4D188C0DF5E09C6AC5F

-=End Of File=-




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users