Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Complete Removal of Internet Security 2010


  • This topic is locked This topic is locked
21 replies to this topic

#1 sodina

sodina

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:04:50 PM

Posted 16 February 2010 - 03:23 PM

hey,

i originally started the thread here and one of the admins suggested that i start the new one in this section.
so here are the logs.

DDS

DDS (Ver_09-12-01.01) - NTFSx86
Run by sodina at 14:49:33.25 on 02/16/2010 Tue
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Professional 5.1.2600.3.949.82.1033.18.3063.2684 [GMT -5:00]

AV: 알약 *On-access scanning disabled* (Updated) {B9431E5A-E196-4B6F-843A-10E01DB25461}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
svchost.exe
C:\WINDOWS\system32\fsproflt.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\conime.exe
C:\Documents and Settings\sodina\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://msn.com/
mStart Page = msn.com
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: ALToolbarBho Class: {7f1a79f9-78d1-4186-9f60-ee0b63df042a} - c:\program files\estsoft\altoolbar\ALToolBand_1520.dll
BHO: CoTGT_BHO Class: {c333cf63-767f-4831-94ac-e683d962c63c} - c:\program files\tgtsoft\stylexp\TGT_BHO.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: ALToolBar: {38fbe93d-4ca1-4414-af6a-94920c5bd8da} - c:\program files\estsoft\altoolbar\ALToolBand_1520.dll
uRun: [STYLEXP] c:\program files\tgtsoft\stylexp\StyleXP.exe -Hide
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [HncUpdate] c:\windows\system32\HncUpdate.exe /A
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe"
mRun: [ALYac] "c:\program files\estsoft\alyac\AYUpdate.exe" /run
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
mPolicies-system: EnableLUA = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: 알툴바 빠른검색(&Q) - c:\program files\estsoft\altoolbar\ALToolBand_1520.dll/23/SEARCH.HTML
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
Trusted Zone: buy-security-essentials.com
Trusted Zone: download-soft-package.com
Trusted Zone: download-software-package.com
Trusted Zone: get-key-se10.com
Trusted Zone: is-software-download.com
Trusted Zone: buy-security-essentials.com
Trusted Zone: get-key-se10.com
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {2A2B6809-46C9-4126-BAFC-B352585BD56E} - hxxp://www.kiwidisk.com/mmsv/KiwidiskControl.CAB
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1266271741156
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\sodina\applic~1\mozilla\firefox\profiles\h6rkgo1k.default\
FF - prefs.js: browser.startup.homepage - msn.com
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 FSProFilter;FSPro File Filter;c:\windows\system32\drivers\FSPFltd.sys [2010-2-15 43792]
R2 fsproflt;FSPro Filter Service;c:\windows\system32\fsproflt.exe [2010-2-15 73392]
S0 yzhjc;yzhjc; [x]

=============== Created Last 30 ================

2010-02-16 19:48:51 0 ----a-w- c:\documents and settings\sodina\defogger_reenable
2010-02-16 15:38:02 0 d-----w- c:\program files\common files\Hewlett-Packard
2010-02-16 15:37:31 46592 ----a-w- c:\windows\system32\hpzll43a.dll
2010-02-16 15:37:18 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2010-02-16 15:37:18 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-02-16 15:36:51 0 d-----w- c:\program files\HP
2010-02-16 13:52:14 0 d-----w- c:\program files\QuickPar
2010-02-16 05:55:05 0 d-sh--w- c:\documents and settings\sodina\UserData
2010-02-16 05:34:31 0 d-----w- c:\docume~1\sodina\applic~1\Hnc
2010-02-16 05:00:52 0 d-sha-r- C:\cmdcons
2010-02-16 04:54:39 43520 ---ha-w- C:\xblslwc.exe
2010-02-16 04:36:24 0 d-----w- c:\program files\Kiwidisk
2010-02-16 02:41:39 0 d-----w- c:\docume~1\sodina\applic~1\HD Tune Pro
2010-02-16 02:41:36 0 d-----w- c:\program files\HD Tune Pro
2010-02-16 01:45:42 266360 ----a-w- c:\windows\system32\TweakUI.exe
2010-02-16 01:45:42 160217 ----a-w- c:\windows\system32\PowerToysLicense.rtf
2010-02-16 01:43:11 0 d-----w- c:\program files\Unlocker
2010-02-16 01:21:09 0 d-----w- c:\program files\JDownloader
2010-02-16 01:21:07 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-02-16 01:21:07 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-16 01:11:48 218624 ----a-w- c:\windows\system32\uxtheme.dll.backup
2010-02-16 01:10:25 0 d-----w- c:\program files\mIRC
2010-02-16 01:10:25 0 d-----w- c:\docume~1\sodina\applic~1\mIRC
2010-02-16 01:02:28 0 d-----w- c:\docume~1\sodina\applic~1\EstSoft
2010-02-16 01:02:27 389120 ----a-w- c:\windows\system32\actskn43.ocx
2010-02-16 01:02:27 258352 ----a-w- c:\windows\system32\unicows.dll
2010-02-16 01:01:21 0 d-----w- c:\program files\ESTsoft
2010-02-16 01:01:21 0 d-----w- c:\docume~1\alluse~1\applic~1\ESTsoft
2010-02-16 00:44:30 0 d-----w- c:\docume~1\sodina\applic~1\IPOPMEDIA
2010-02-16 00:42:10 0 d-----w- c:\program files\IPOPMEDIA
2010-02-16 00:29:06 0 d--ha-r- C:\autorun.inf
2010-02-16 00:25:32 0 d-----w- c:\program files\uTorrent
2010-02-16 00:25:21 0 d-----w- c:\docume~1\sodina\applic~1\uTorrent
2010-02-16 00:24:11 0 d-----w- c:\program files\tsMuxeR_1.10.6
2010-02-16 00:23:57 0 d-----w- c:\program files\MKVtoolnix
2010-02-16 00:23:47 0 d-----w- c:\program files\MediaInfo
2010-02-15 23:08:14 0 d-----w- c:\docume~1\sodina\applic~1\Malwarebytes
2010-02-15 23:08:10 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-02-15 23:07:57 32768 ----a-w- c:\windows\system32\23rh46g.4e
2010-02-15 23:07:57 28672 ----a-w- c:\windows\system32\3f5uk.sr
2010-02-15 23:07:56 32768 ----a-w- c:\windows\system32\fe6hbfe1.an
2010-02-15 23:07:56 28672 ----a-w- c:\windows\system32\467.zt
2010-02-15 23:07:55 79360 ----a-w- c:\windows\system32\bb52fkri.few
2010-02-15 22:55:36 0 d-----w- c:\docume~1\alluse~1\applic~1\Toolbar4
2010-02-15 22:55:28 20 ----a-w- c:\windows\system32\crt.dat
2010-02-15 22:53:40 0 d-----w- c:\program files\Haali
2010-02-15 22:50:17 0 d-----w- c:\program files\The KMPlayer
2010-02-15 22:50:03 0 d-----w- c:\program files\CoreCodec
2010-02-15 22:49:39 92 ----a-w- c:\windows\LZOCodec.ini
2010-02-15 22:49:39 46 ----a-w- c:\windows\lagarith.ini
2010-02-15 22:49:39 134 ----a-w- c:\windows\huffyuv.ini
2010-02-15 22:49:38 0 d-----w- c:\program files\WMV9_VCM
2010-02-15 22:49:38 0 d-----w- c:\program files\DivX
2010-02-15 22:49:36 38 ----a-w- c:\windows\AviSplitter.ini
2010-02-15 22:49:36 0 d-----w- c:\program files\Unified Codec Pack
2010-02-15 22:47:21 0 d-----w- c:\program files\TGTSoft
2010-02-15 22:45:48 73392 ----a-w- c:\windows\system32\fsproflt.exe
2010-02-15 22:45:47 43792 ----a-w- c:\windows\system32\drivers\FSPFltd.sys
2010-02-15 22:45:46 0 d-----w- c:\program files\Folders 2009
2010-02-15 22:45:18 32592 ----a-w- c:\windows\system32\msonpmon.dll
2010-02-15 22:44:32 0 d-----w- c:\program files\MPC-HC
2010-02-15 22:44:17 0 d-----w- C:\NZB-O-Matic
2010-02-15 22:43:14 0 d-----w- c:\program files\Microsoft Visual Studio 8
2010-02-15 22:40:31 40 ----a-w- c:\windows\Hjimesv.ini
2010-02-15 22:40:25 0 d-----w- c:\windows\ShellNew
2010-02-15 22:40:20 0 d-----w- c:\program files\eps
2010-02-15 22:40:20 0 d-----w- C:\HNC
2010-02-15 22:40:05 16 ----a-w- c:\windows\system32\winhcfg.ini
2010-02-15 22:38:08 0 d-----w- c:\program files\Lavalys
2010-02-15 22:33:15 361600 ----a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2010-02-15 22:31:24 0 d-----w- c:\program files\TCP
2010-02-15 22:28:09 0 d-----w- c:\program files\OpenAL
2010-02-15 22:28:04 0 d-----w- c:\program files\C-Media PCI Audio
2010-02-15 22:25:39 0 d-----w- c:\program files\Windows Media Connect 2
2010-02-15 22:22:13 0 d-sh--w- c:\documents and settings\sodina\IECompatCache
2010-02-15 22:21:56 0 d-sh--w- c:\documents and settings\sodina\PrivacIE
2010-02-15 22:21:42 0 d-sh--w- c:\documents and settings\sodina\IETldCache
2010-02-15 22:14:59 455424 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-02-15 22:09:59 0 d-----w- c:\windows\system32\PreInstall
2010-02-15 22:09:58 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2010-02-15 22:09:57 0 d--h--w- c:\windows\$hf_mig$
2010-02-15 22:09:16 21728 ----a-w- c:\windows\system32\wucltui.dll.mui
2010-02-15 22:09:16 17632 ----a-w- c:\windows\system32\wuaueng.dll.mui
2010-02-15 22:09:16 15072 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2010-02-15 22:09:16 15064 ----a-w- c:\windows\system32\wuapi.dll.mui
2010-02-15 22:09:16 0 d-----w- c:\windows\system32\SoftwareDistribution
2010-02-15 22:01:59 95232 ----a-w- c:\windows\system32\drivers\AtiHdmi.sys
2010-02-15 22:00:54 0 d-----w- c:\program files\ATI Technologies
2010-02-15 22:00:52 0 d-----w- c:\program files\ATI
2010-02-15 22:00:24 0 d--h--w- C:\ATI
2010-02-15 21:58:23 0 d-----w- c:\program files\Marvell
2010-02-15 21:58:19 0 d-----w- c:\docume~1\sodina\applic~1\TMP
2010-02-15 21:49:01 0 d-sh--w- c:\documents and settings\all users\DRM
2010-02-15 21:48:52 0 d--h--w- c:\program files\WindowsUpdate
2010-02-15 21:48:21 0 d-----w- c:\program files\common files\MSSoap
2010-02-15 21:47:11 0 d-----w- c:\program files\Online Services
2010-02-15 21:47:08 0 d-----w- c:\program files\Messenger
2010-02-15 21:47:05 0 d-----w- c:\program files\MSN Gaming Zone
2010-02-15 21:46:30 0 d-----w- c:\program files\Windows NT
2010-02-15 16:40:04 0 d-----w- c:\program files\common files\ODBC
2010-02-15 16:40:01 0 d-----w- c:\program files\common files\SpeechEngines
2010-02-15 16:39:39 0 d-----r- c:\documents and settings\all users\Documents

==================== Find3M ====================

2010-02-16 15:38:13 103167 ----a-w- c:\windows\hpoins08.dat
2010-02-16 01:15:50 578560 ------w- c:\windows\system32\user32.dll
2010-02-16 01:11:48 218624 ----a-w- c:\windows\system32\uxtheme.dll
2010-02-15 22:48:38 505392 ----a-w- c:\windows\system32\msvcp71.dll
2010-02-15 22:33:15 361600 ----a-w- c:\windows\system32\drivers\TCPIP.SYS
2010-02-15 22:28:09 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2010-02-15 22:28:09 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2010-02-15 21:47:22 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-12-31 16:50:03 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-22 05:20:58 81920 ------w- c:\windows\system32\ieencode.dll
2009-12-21 19:14:05 916480 ------w- c:\windows\system32\wininet.dll
2009-12-16 18:43:27 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08:23 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-11 20:45:06 45056 ----a-w- c:\windows\system32\aticalrt.dll
2009-12-11 20:44:50 45056 ----a-w- c:\windows\system32\aticalcl.dll
2009-12-11 20:43:12 3620864 ----a-w- c:\windows\system32\aticaldd.dll
2009-12-11 20:41:34 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2009-12-11 20:26:24 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll
2009-12-11 20:25:22 300544 ----a-w- c:\windows\system32\ati2dvag.dll
2009-12-11 20:25:08 13434880 ----a-w- c:\windows\system32\atioglxx.dll
2009-12-11 20:23:34 3521408 ----a-w- c:\windows\system32\ati3duag.dll
2009-12-11 20:09:36 208896 ----a-w- c:\windows\system32\atipdlxx.dll
2009-12-11 20:09:18 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2009-12-11 20:09:04 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2009-12-11 20:08:54 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2009-12-11 20:08:38 155648 ----a-w- c:\windows\system32\ati2evxx.dll
2009-12-11 20:07:42 2154752 ----a-w- c:\windows\system32\ativvaxx.dll
2009-12-11 20:07:18 887724 ----a-w- c:\windows\system32\ativva6x.dat
2009-12-11 20:07:16 602112 ----a-w- c:\windows\system32\ati2evxx.exe
2009-12-11 20:05:44 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2009-12-11 20:01:20 565248 ----a-w- c:\windows\system32\atikvmag.dll
2009-12-11 19:59:08 176128 ----a-w- c:\windows\system32\atiadlxx.dll
2009-12-11 19:58:40 17408 ----a-w- c:\windows\system32\atitvo32.dll
2009-12-11 19:57:40 393216 ----a-w- c:\windows\system32\atiok3x2.dll
2009-12-11 19:52:20 638976 ----a-w- c:\windows\system32\ati2cqag.dll
2009-12-11 19:50:40 64512 ----a-w- c:\windows\system32\atimpc32.dll
2009-12-11 19:50:40 64512 ----a-w- c:\windows\system32\amdpcom32.dll
2009-12-08 19:26:15 2145280 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43:51 2023936 ------w- c:\windows\system32\ntkrnlpa.exe
2009-11-30 22:43:52 197982 ----a-w- c:\windows\system32\atiicdxx.dat
2009-11-27 17:11:44 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 17:11:44 1291776 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 16:07:35 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07:35 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07:34 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:07:34 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:07:34 11264 ----a-w- c:\windows\system32\msrle32.dll
2006-06-23 06:48:54 32768 ----a-r- c:\windows\inf\UpdateUSB.exe

============= FINISH: 14:49:41.01 ===============

Gmer log couldnt be posted here because its too long.

http://www.megaupload.com/?d=HRIQD3JP

Merged posts. ~ OB

Edited by Orange Blossom, 16 February 2010 - 07:58 PM.


BC AdBot (Login to Remove)

 


#2 sodina

sodina
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:04:50 PM

Posted 18 February 2010 - 12:24 AM

okay, so i see there are still some remnants under trusted zones.
i can also see some in registry.




please recommend me a proper tool to get rid of any remaining.

thanks.


===========

Hello

While we understand your frustration at having to wait, please note that Bleeping Computer deals with several hundred requests for assistance such as yours on a daily basis. As a result, our backlog is quite large as are other comparable sites that help others with malware issues. Although our HJT Team members work on hundreds of requests each day, they are all volunteers who work logs when they can and are able to do so. No one is paid by Bleeping Computer for their assistance to our members.

Further, our malware removal staff is comprised of team members with various levels of skill and expertise to deal with thousands of malware variants, some more complex than others. Although we try to take DDS/HJT logs in order (starting with the oldest), it is often the skill level of the particular helper and sometimes the operating system that dictates which logs get selected first. Some infections are more complicated than others and require a higher skill level to remove. Without that skill level attempted removal could result in disastrous results. In other instances, the helper may not be familiar with the operating system that you are using, since they use another. In either case, neither of us want someone to assist you who is not familiar with your issue and attempt to fix it.

We ask that once you have posted your log and are waiting, please DO NOT "bump" your thread or make further replies until it has been responded to by a member of the Malware Response Team. The reason we ask this or do not respond to your requests is because that would remove you from the active queue that Techs and Staff have access to. The malware staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response, there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

That is why I have made an edit to your last post, instead of a reply. Please do not multiple post here, as that only pushes you further down the queue and causes confusion to the staff.

Please be patient. It may take several days, up to more than a week, perhaps less, to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

Thank you for understanding.

Elise - forum moderator

Edited by elise025, 18 February 2010 - 06:21 AM.


#3 sempai

sempai

    noypi


  • Malware Response Team
  • 5,288 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:3 stars and a sun
  • Local time:05:50 AM

Posted 19 February 2010 - 10:48 AM

Hello sodina my name is Sempai and welcome to Bleeping Computer.
*We apologize for the delay. Forum have been busy.

* Please stay with me until I declare that your computer is clean as most users don't reply anymore once they found out that their computer is running smoothly, but absence of symptoms does not mean that a computer is free from infection.

*It is important not to make any further changes or run any other tools unless instructed to. This may hinder the cleaning process of your machine.

*You must reply within 5 days otherwise this topic will be closed.



I want to ask you a questions before we begin.

Your log shows that you are using a Korean Anti virus program (알약 or Alyak "if I will translate it"), Is this a legitimate Anti virus program and did you intentionally install it?


1. Your log(s) show that you are using so called peer-to-peer or file-sharing programmes (in your case uTorrent).
These programmes allow to share files between users as the name(s) suggest. In today's world the cyber crime has come to an enormous dimension and any means is used to infect personal computers to make use of their stored data or machine power for further propagation of the malware files. A popular means is the use of file-sharing tools as a tremendous amount of prospective victims can be reached through it.

It is therefore possible to be infected by downloading manipulated files via peer-to-peer tools and thus suggested to be used with intense care. Some further readings on this subject, along the included links, are as follows: "File-Sharing, otherwise known as Peer To Peer" and "Risks of File-Sharing Technology."

It is also important to note that sharing entertainment files and proprietary software infringes the copyright laws in many countries over the world and you are putting yourself at risk of being indicted through organisations watching over the rights of the authors of such files (i.e. the RIAA for music files, or the MPAA for movie files in the USA) or the authors of the files themselves.

Naturally there are also legal ways to use these services, such as downloading Linux distributions or office suites such as "Open Office."





2. Please download Malwarebytes' Anti-Malware from here:
MalwareBytes' AntiMalware download link

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



3. Please perform a new DDS scan and post the log when you reply. Thanks.


Regards,
~Semp




~Semp

btn_donate_LG.gif
You can help me continue the fight against malware by making a donation, Thank you.

If I am helping you and I didn't reply within 48 hours... Please send me a private message.
Topics that are not replied within 5 days will be close. Please don't PM asking for support, post on the Forums instead.

Member of UNITE (Unified Network of Instructors and Trained Eliminators) 


#4 sodina

sodina
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:04:50 PM

Posted 19 February 2010 - 07:45 PM

alyak is a a legitimate anti virus program and i did install it for protection.
virus came in before i installed any p2p program. i just uninstalled them for further protection.

MBAM

Malwarebytes' Anti-Malware 1.44
Database version: 3764
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

2/19/2010 7:20:55 PM
mbam-log-2010-02-19 (19-20-52).txt

Scan type: Quick Scan
Objects scanned: 111941
Time elapsed: 1 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 7
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\TOY5KNQ8OC (Trojan.FakeAlert) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\get-key-se10.com\http (Hijack.TrustedZone) -> Bad: (2) Good: (4) -> No action taken.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\buy-security-essentials.com\http (Hijack.TrustedZone) -> Bad: (2) Good: (4) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\buy-security-essentials.com\http (Hijack.TrustedZone) -> Bad: (2) Good: (4) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\is-software-download.com\http (Hijack.TrustedZone) -> Bad: (2) Good: (4) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\download-soft-package.com\http (Hijack.TrustedZone) -> Bad: (2) Good: (4) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\download-software-package.com\http (Hijack.TrustedZone) -> Bad: (2) Good: (4) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\get-key-se10.com\http (Hijack.TrustedZone) -> Bad: (2) Good: (4) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


DDS


DDS (Ver_09-12-01.01) - NTFSx86
Run by sodina at 19:23:26.87 on 02/19/2010 Fri
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Professional 5.1.2600.3.949.82.1033.18.3063.2627 [GMT -5:00]

AV: 알약 *On-access scanning disabled* (Updated) {B9431E5A-E196-4B6F-843A-10E01DB25461}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\WINDOWS\system32\ctfmon.exe
svchost.exe
C:\WINDOWS\system32\fsproflt.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\conime.exe
C:\Documents and Settings\sodina\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://msn.com/
mStart Page = msn.com
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: ALToolbarBho Class: {7f1a79f9-78d1-4186-9f60-ee0b63df042a} - c:\program files\estsoft\altoolbar\ALToolBand_1520.dll
BHO: CoTGT_BHO Class: {c333cf63-767f-4831-94ac-e683d962c63c} - c:\program files\tgtsoft\stylexp\TGT_BHO.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: ALToolBar: {38fbe93d-4ca1-4414-af6a-94920c5bd8da} - c:\program files\estsoft\altoolbar\ALToolBand_1520.dll
uRun: [STYLEXP] c:\program files\tgtsoft\stylexp\StyleXP.exe -Hide
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [HncUpdate] c:\windows\system32\HncUpdate.exe /A
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [VirtualCloneDrive] "c:\program files\elaborate bytes\virtualclonedrive\VCDDaemon.exe" /s
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\sodina\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
mPolicies-system: EnableLUA = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: 알툴바 빠른검색(&Q) - c:\program files\estsoft\altoolbar\ALToolBand_1520.dll/23/SEARCH.HTML
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {2A2B6809-46C9-4126-BAFC-B352585BD56E} - hxxp://www.kiwidisk.com/mmsv/KiwidiskControl.CAB
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1266271741156
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\sodina\applic~1\mozilla\firefox\profiles\h6rkgo1k.default\
FF - prefs.js: browser.startup.homepage - msn.com
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 FSProFilter;FSPro File Filter;c:\windows\system32\drivers\FSPFltd.sys [2010-2-15 43792]
R2 fsproflt;FSPro Filter Service;c:\windows\system32\fsproflt.exe [2010-2-15 73392]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-2-19 236368]
R2 thdudf;TOSHIBA UDF2.5 Reader File System Driver;c:\windows\system32\drivers\thdudf.sys [2010-2-18 66944]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-2-19 19160]
S0 yzhjc;yzhjc; [x]

=============== Created Last 30 ================

2010-02-20 00:06:59 0 ----a-w- c:\documents and settings\sodina\defogger_reenable
2010-02-19 23:58:47 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-19 23:58:46 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-19 23:58:46 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-19 03:44:54 0 d-----w- c:\windows\system32\NtmsData
2010-02-18 05:44:59 0 d-----w- c:\program files\BDInfo
2010-02-18 05:28:43 0 d-----w- c:\program files\Elaborate Bytes
2010-02-18 05:26:13 66944 ----a-w- c:\windows\system32\drivers\thdudf.sys
2010-02-18 05:26:13 0 d-----w- c:\program files\UDF25
2010-02-18 03:24:15 0 d-----w- c:\docume~1\sodina\applic~1\mkvtoolnix
2010-02-16 23:58:50 0 d-----w- c:\program files\URUSoft
2010-02-16 15:38:02 0 d-----w- c:\program files\common files\Hewlett-Packard
2010-02-16 15:37:31 46592 ----a-w- c:\windows\system32\hpzll43a.dll
2010-02-16 15:37:18 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2010-02-16 15:37:18 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-02-16 15:36:51 0 d-----w- c:\program files\HP
2010-02-16 13:52:14 0 d-----w- c:\program files\QuickPar
2010-02-16 05:55:05 0 d-sh--w- c:\documents and settings\sodina\UserData
2010-02-16 05:34:31 0 d-----w- c:\docume~1\sodina\applic~1\Hnc
2010-02-16 05:00:52 0 d-sha-r- C:\cmdcons
2010-02-16 04:36:24 0 d-----w- c:\program files\Kiwidisk
2010-02-16 02:41:39 0 d-----w- c:\docume~1\sodina\applic~1\HD Tune Pro
2010-02-16 02:41:36 0 d-----w- c:\program files\HD Tune Pro
2010-02-16 01:45:42 266360 ----a-w- c:\windows\system32\TweakUI.exe
2010-02-16 01:45:42 160217 ----a-w- c:\windows\system32\PowerToysLicense.rtf
2010-02-16 01:43:11 0 d-----w- c:\program files\Unlocker
2010-02-16 01:21:09 0 d-----w- c:\program files\JDownloader
2010-02-16 01:21:07 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-02-16 01:21:07 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-16 01:11:48 218624 ----a-w- c:\windows\system32\uxtheme.dll.backup
2010-02-16 01:10:25 0 d-----w- c:\program files\mIRC
2010-02-16 01:10:25 0 d-----w- c:\docume~1\sodina\applic~1\mIRC
2010-02-16 01:02:28 0 d-----w- c:\docume~1\sodina\applic~1\EstSoft
2010-02-16 01:02:27 389120 ----a-w- c:\windows\system32\actskn43.ocx
2010-02-16 01:02:27 258352 ----a-w- c:\windows\system32\unicows.dll
2010-02-16 01:01:21 0 d-----w- c:\program files\ESTsoft
2010-02-16 01:01:21 0 d-----w- c:\docume~1\alluse~1\applic~1\ESTsoft
2010-02-16 00:44:30 0 d-----w- c:\docume~1\sodina\applic~1\IPOPMEDIA
2010-02-16 00:42:10 0 d-----w- c:\program files\IPOPMEDIA
2010-02-16 00:29:06 0 d--ha-r- C:\autorun.inf
2010-02-16 00:24:11 0 d-----w- c:\program files\tsMuxeR_1.10.6
2010-02-16 00:23:57 0 d-----w- c:\program files\MKVtoolnix
2010-02-16 00:23:47 0 d-----w- c:\program files\MediaInfo
2010-02-15 23:08:14 0 d-----w- c:\docume~1\sodina\applic~1\Malwarebytes
2010-02-15 23:08:10 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-02-15 23:07:57 32768 ----a-w- c:\windows\system32\23rh46g.4e
2010-02-15 23:07:57 28672 ----a-w- c:\windows\system32\3f5uk.sr
2010-02-15 23:07:56 32768 ----a-w- c:\windows\system32\fe6hbfe1.an
2010-02-15 23:07:56 28672 ----a-w- c:\windows\system32\467.zt
2010-02-15 23:07:55 79360 ----a-w- c:\windows\system32\bb52fkri.few
2010-02-15 22:55:36 0 d-----w- c:\docume~1\alluse~1\applic~1\Toolbar4
2010-02-15 22:55:28 20 ----a-w- c:\windows\system32\crt.dat
2010-02-15 22:53:40 0 d-----w- c:\program files\Haali
2010-02-15 22:50:17 0 d-----w- c:\program files\The KMPlayer
2010-02-15 22:50:03 0 d-----w- c:\program files\CoreCodec
2010-02-15 22:49:39 92 ----a-w- c:\windows\LZOCodec.ini
2010-02-15 22:49:39 46 ----a-w- c:\windows\lagarith.ini
2010-02-15 22:49:39 134 ----a-w- c:\windows\huffyuv.ini
2010-02-15 22:49:38 0 d-----w- c:\program files\WMV9_VCM
2010-02-15 22:49:38 0 d-----w- c:\program files\DivX
2010-02-15 22:49:36 38 ----a-w- c:\windows\AviSplitter.ini
2010-02-15 22:49:36 0 d-----w- c:\program files\Unified Codec Pack
2010-02-15 22:47:21 0 d-----w- c:\program files\TGTSoft
2010-02-15 22:45:48 73392 ----a-w- c:\windows\system32\fsproflt.exe
2010-02-15 22:45:47 43792 ----a-w- c:\windows\system32\drivers\FSPFltd.sys
2010-02-15 22:45:46 0 d-----w- c:\program files\Folders 2009
2010-02-15 22:45:18 32592 ----a-w- c:\windows\system32\msonpmon.dll
2010-02-15 22:44:32 0 d-----w- c:\program files\MPC-HC
2010-02-15 22:44:17 0 d-----w- C:\Backup
2010-02-15 22:43:14 0 d-----w- c:\program files\Microsoft Visual Studio 8
2010-02-15 22:40:31 40 ----a-w- c:\windows\Hjimesv.ini
2010-02-15 22:40:25 0 d-----w- c:\windows\ShellNew
2010-02-15 22:40:20 0 d-----w- c:\program files\eps
2010-02-15 22:40:20 0 d-----w- C:\HNC
2010-02-15 22:40:05 16 ----a-w- c:\windows\system32\winhcfg.ini
2010-02-15 22:38:08 0 d-----w- c:\program files\Lavalys
2010-02-15 22:33:15 361600 ----a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2010-02-15 22:31:24 0 d-----w- c:\program files\TCP
2010-02-15 22:28:09 0 d-----w- c:\program files\OpenAL
2010-02-15 22:28:04 0 d-----w- c:\program files\C-Media PCI Audio
2010-02-15 22:25:39 0 d-----w- c:\program files\Windows Media Connect 2
2010-02-15 22:22:13 0 d-sh--w- c:\documents and settings\sodina\IECompatCache
2010-02-15 22:21:56 0 d-sh--w- c:\documents and settings\sodina\PrivacIE
2010-02-15 22:21:42 0 d-sh--w- c:\documents and settings\sodina\IETldCache
2010-02-15 22:14:59 455424 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-02-15 22:09:59 0 d-----w- c:\windows\system32\PreInstall
2010-02-15 22:09:58 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2010-02-15 22:09:57 0 d--h--w- c:\windows\$hf_mig$
2010-02-15 22:09:16 21728 ----a-w- c:\windows\system32\wucltui.dll.mui
2010-02-15 22:09:16 17632 ----a-w- c:\windows\system32\wuaueng.dll.mui
2010-02-15 22:09:16 15072 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2010-02-15 22:09:16 15064 ----a-w- c:\windows\system32\wuapi.dll.mui
2010-02-15 22:09:16 0 d-----w- c:\windows\system32\SoftwareDistribution
2010-02-15 22:01:59 95232 ----a-w- c:\windows\system32\drivers\AtiHdmi.sys
2010-02-15 22:00:54 0 d-----w- c:\program files\ATI Technologies
2010-02-15 22:00:52 0 d-----w- c:\program files\ATI
2010-02-15 22:00:24 0 d--h--w- C:\ATI
2010-02-15 21:58:23 0 d-----w- c:\program files\Marvell
2010-02-15 21:58:19 0 d-----w- c:\docume~1\sodina\applic~1\TMP
2010-02-15 21:49:01 0 d-sh--w- c:\documents and settings\all users\DRM
2010-02-15 21:48:52 0 d--h--w- c:\program files\WindowsUpdate
2010-02-15 21:48:21 0 d-----w- c:\program files\common files\MSSoap
2010-02-15 21:47:11 0 d-----w- c:\program files\Online Services
2010-02-15 21:47:08 0 d-----w- c:\program files\Messenger
2010-02-15 21:47:05 0 d-----w- c:\program files\MSN Gaming Zone
2010-02-15 21:46:30 0 d-----w- c:\program files\Windows NT
2010-02-15 16:40:04 0 d-----w- c:\program files\common files\ODBC
2010-02-15 16:40:01 0 d-----w- c:\program files\common files\SpeechEngines
2010-02-15 16:39:39 0 d-----r- c:\documents and settings\all users\Documents

==================== Find3M ====================

2010-02-16 15:38:13 103167 ----a-w- c:\windows\hpoins08.dat
2010-02-16 01:15:50 578560 ------w- c:\windows\system32\user32.dll
2010-02-16 01:11:48 218624 ----a-w- c:\windows\system32\uxtheme.dll
2010-02-15 22:48:38 505392 ----a-w- c:\windows\system32\msvcp71.dll
2010-02-15 22:33:15 361600 ----a-w- c:\windows\system32\drivers\TCPIP.SYS
2010-02-15 22:28:09 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2010-02-15 22:28:09 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2010-02-15 21:47:22 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-12-31 16:50:03 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-22 05:20:58 81920 ------w- c:\windows\system32\ieencode.dll
2009-12-21 19:14:05 916480 ------w- c:\windows\system32\wininet.dll
2009-12-16 18:43:27 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08:23 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-11 20:45:06 45056 ----a-w- c:\windows\system32\aticalrt.dll
2009-12-11 20:44:50 45056 ----a-w- c:\windows\system32\aticalcl.dll
2009-12-11 20:43:12 3620864 ----a-w- c:\windows\system32\aticaldd.dll
2009-12-11 20:41:34 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2009-12-11 20:26:24 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll
2009-12-11 20:25:22 300544 ----a-w- c:\windows\system32\ati2dvag.dll
2009-12-11 20:25:08 13434880 ----a-w- c:\windows\system32\atioglxx.dll
2009-12-11 20:23:34 3521408 ----a-w- c:\windows\system32\ati3duag.dll
2009-12-11 20:09:36 208896 ----a-w- c:\windows\system32\atipdlxx.dll
2009-12-11 20:09:18 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2009-12-11 20:09:04 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2009-12-11 20:08:54 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2009-12-11 20:08:38 155648 ----a-w- c:\windows\system32\ati2evxx.dll
2009-12-11 20:07:42 2154752 ----a-w- c:\windows\system32\ativvaxx.dll
2009-12-11 20:07:18 887724 ----a-w- c:\windows\system32\ativva6x.dat
2009-12-11 20:07:16 602112 ----a-w- c:\windows\system32\ati2evxx.exe
2009-12-11 20:05:44 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2009-12-11 20:01:20 565248 ----a-w- c:\windows\system32\atikvmag.dll
2009-12-11 19:59:08 176128 ----a-w- c:\windows\system32\atiadlxx.dll
2009-12-11 19:58:40 17408 ----a-w- c:\windows\system32\atitvo32.dll
2009-12-11 19:57:40 393216 ----a-w- c:\windows\system32\atiok3x2.dll
2009-12-11 19:52:20 638976 ----a-w- c:\windows\system32\ati2cqag.dll
2009-12-11 19:50:40 64512 ----a-w- c:\windows\system32\atimpc32.dll
2009-12-11 19:50:40 64512 ----a-w- c:\windows\system32\amdpcom32.dll
2009-12-08 19:26:15 2145280 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43:51 2023936 ------w- c:\windows\system32\ntkrnlpa.exe
2009-11-30 22:43:52 197982 ----a-w- c:\windows\system32\atiicdxx.dat
2009-11-27 17:11:44 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 17:11:44 1291776 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 16:07:35 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07:35 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07:34 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:07:34 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:07:34 11264 ----a-w- c:\windows\system32\msrle32.dll
2006-06-23 06:48:54 32768 ----a-r- c:\windows\inf\UpdateUSB.exe

============= FINISH: 19:23:35.92 ===============

autorun.inf was created by flash disinfector and i just left it there.
looks like mbam found remaining of security essential that was in registry, so i removed them and rebooted.
however, im still seeing them under registry like the linked picture in my previous reply.
also, id like to know why mbam constantly blocks ips with the warning popups even when i dont have browser on.

thanks.

Edited by sodina, 19 February 2010 - 11:02 PM.


#5 sempai

sempai

    noypi


  • Malware Response Team
  • 5,288 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:3 stars and a sun
  • Local time:05:50 AM

Posted 20 February 2010 - 05:00 AM

Hi sodina,

QUOTE
alyak is a a legitimate anti virus program and i did install it for protection.

The reason I asked is because the log is showing alyak in korean characters, and It will be hard for me to search some information about it. By the way are you a Korean? smile.gif


QUOTE
id like to know why mbam constantly blocks ips with the warning popups even when i dont have browser on.

Possibly because the malware is trying to inject some process and MBAM is doing its job.



1. We need to download and run ComboFix (by sUBs)
Download Combofix from any of the links below, and save it to your desktop.

Link 1
Link 2
  • Temporary disable your anti-virus and anti-malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are not sure how.
  • Close any open windows, including this one.
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • If you did not have it installed, you will see the prompt below. Choose YES.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note**:
*If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
*The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you
should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

  • Click on Yes, to continue scanning for malware.
  • When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).
Leave your computer alone while ComboFix is running.
ComboFix will restart your computer if malware is found; allow it to do so.


Note: Please Do NOT mouseclick combofix's window while its running because it may call it to stall.


Warning!
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper, *** If your are not the topic starter DO NOT run this tool as it could cause irreversible damage to your computer.


If you need help, see this link:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix



~Semp

~Semp

btn_donate_LG.gif
You can help me continue the fight against malware by making a donation, Thank you.

If I am helping you and I didn't reply within 48 hours... Please send me a private message.
Topics that are not replied within 5 days will be close. Please don't PM asking for support, post on the Forums instead.

Member of UNITE (Unified Network of Instructors and Trained Eliminators) 


#6 sodina

sodina
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:04:50 PM

Posted 20 February 2010 - 09:12 AM

um, combo fix was the first tool i used to get rid of this thing. then i used mbam to clear out any remaining.
do you recommend that i run combo fix again here?
and yes, i am a korean.


#7 sempai

sempai

    noypi


  • Malware Response Team
  • 5,288 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:3 stars and a sun
  • Local time:05:50 AM

Posted 20 February 2010 - 09:19 AM

Sodina Annyong, smile.gif

Yes please run Combofix again and post the log for me. smile.gif


~Semp

~Semp

btn_donate_LG.gif
You can help me continue the fight against malware by making a donation, Thank you.

If I am helping you and I didn't reply within 48 hours... Please send me a private message.
Topics that are not replied within 5 days will be close. Please don't PM asking for support, post on the Forums instead.

Member of UNITE (Unified Network of Instructors and Trained Eliminators) 


#8 sodina

sodina
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:04:50 PM

Posted 20 February 2010 - 04:55 PM

Combofix

ComboFix 10-02-20.03 - sodina 0/2010 Sat 16:42:34.4.8 - x86
Microsoft Windows XP Professional 5.1.2600.3.949.82.1033.18.3063.2685 [GMT -5:00]
Running from: c:\documents and settings\sodina\Desktop\ComboFix.exe
AV: 알약 *On-access scanning disabled* (Updated) {B9431E5A-E196-4B6F-843A-10E01DB25461}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\23rh46g.4e
c:\windows\system32\3f5uk.sr
c:\windows\system32\467.zt
c:\windows\system32\bb52fkri.few
c:\windows\system32\crt.dat
c:\windows\system32\fe6hbfe1.an

.
((((((((((((((((((((((((( Files Created from 2010-01-20 to 2010-02-20 )))))))))))))))))))))))))))))))
.

2010-02-20 05:11 . 2010-02-20 05:11 -------- d-----w- c:\program files\CPUID
2010-02-20 05:11 . 2009-03-27 06:16 12672 ----a-w- c:\windows\system32\drivers\cpuz132_x32.sys
2010-02-20 01:50 . 2010-02-20 01:54 -------- d-----w- c:\program files\Gabest
2010-02-20 01:49 . 2010-02-20 01:49 -------- d--h--w- c:\windows\PIF
2010-02-20 01:49 . 2010-02-20 01:49 -------- d-----w- c:\documents and settings\sodina\Application Data\GetRightToGo
2010-02-19 03:44 . 2010-02-19 03:45 -------- d-----w- c:\windows\system32\NtmsData
2010-02-18 05:55 . 2010-02-18 05:55 -------- d-----w- c:\documents and settings\sodina\Local Settings\Application Data\Cinema_Squid
2010-02-18 05:44 . 2010-02-18 05:45 -------- d-----w- c:\program files\BDInfo
2010-02-18 05:28 . 2010-02-18 05:28 -------- d-----w- c:\program files\Elaborate Bytes
2010-02-18 05:26 . 2010-02-18 05:26 -------- d-----w- c:\program files\UDF25
2010-02-18 05:26 . 2006-11-11 07:25 66944 ----a-w- c:\windows\system32\drivers\thdudf.sys
2010-02-18 03:24 . 2010-02-18 03:24 -------- d-----w- c:\documents and settings\sodina\Application Data\mkvtoolnix
2010-02-16 23:58 . 2010-02-16 23:58 -------- d-----w- c:\program files\URUSoft
2010-02-16 15:38 . 2010-02-16 15:38 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2010-02-16 15:37 . 2005-10-15 03:42 46592 ----a-w- c:\windows\system32\hpzll43a.dll
2010-02-16 15:37 . 2005-10-15 03:41 72192 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzpp43a.dll
2010-02-16 15:37 . 2008-04-14 05:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2010-02-16 15:37 . 2008-04-14 05:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-02-16 15:33 . 2010-02-16 15:33 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-16 13:52 . 2010-02-18 23:07 -------- d-----w- c:\documents and settings\sodina\Local Settings\Application Data\QuickPar
2010-02-16 13:52 . 2010-02-16 13:52 -------- d-----w- c:\program files\QuickPar
2010-02-16 06:09 . 2010-02-16 06:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2010-02-16 05:55 . 2010-02-16 05:55 -------- d-sh--w- c:\documents and settings\sodina\UserData
2010-02-16 05:34 . 2010-02-16 05:34 -------- d-----w- c:\documents and settings\sodina\Application Data\Hnc
2010-02-16 04:36 . 2010-02-16 04:36 -------- d-----w- c:\program files\Kiwidisk
2010-02-16 02:41 . 2010-02-19 03:53 -------- d-----w- c:\documents and settings\sodina\Application Data\HD Tune Pro
2010-02-16 02:41 . 2010-02-16 02:41 -------- d-----w- c:\program files\HD Tune Pro
2010-02-16 02:37 . 2010-02-16 02:37 -------- d-----w- c:\documents and settings\sodina\Application Data\Media Player Classic
2010-02-16 02:37 . 2010-02-16 02:37 -------- d-----w- c:\documents and settings\sodina\Application Data\DivX
2010-02-16 01:45 . 2003-06-25 21:05 266360 ----a-w- c:\windows\system32\TweakUI.exe
2010-02-16 01:43 . 2010-02-16 02:50 -------- d-----w- c:\program files\Unlocker
2010-02-16 01:21 . 2010-02-16 01:24 -------- d-----w- c:\program files\JDownloader
2010-02-16 01:21 . 2010-02-16 01:21 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-16 01:21 . 2010-02-16 01:21 -------- d-----w- c:\program files\Java
2010-02-16 01:20 . 2010-02-16 01:20 152576 ----a-w- c:\documents and settings\sodina\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2010-02-16 01:10 . 2010-02-20 13:55 -------- d-----w- c:\documents and settings\sodina\Application Data\mIRC
2010-02-16 01:10 . 2010-02-20 12:35 -------- d-----w- c:\program files\mIRC
2010-02-16 01:02 . 2010-02-16 06:21 -------- d-----w- c:\documents and settings\sodina\Application Data\EstSoft
2010-02-16 01:02 . 2008-09-03 23:35 258352 ----a-w- c:\windows\system32\unicows.dll
2010-02-16 01:02 . 2010-02-16 01:02 -------- d-----w- c:\documents and settings\sodina\Local Settings\Application Data\assembly
2010-02-16 01:01 . 2010-02-16 06:21 -------- d-----w- c:\documents and settings\All Users\Application Data\ESTsoft
2010-02-16 01:01 . 2010-02-16 06:21 -------- d-----w- c:\program files\ESTsoft
2010-02-16 00:44 . 2010-02-19 23:16 196608 ----a-w- c:\documents and settings\sodina\Application Data\IPOPMEDIA\PopRecv\rcvsvr.exe
2010-02-16 00:44 . 2010-02-16 00:44 -------- d-----w- c:\documents and settings\sodina\Application Data\IPOPMEDIA
2010-02-16 00:42 . 2010-02-16 00:42 -------- d-----w- c:\program files\IPOPMEDIA
2010-02-16 00:24 . 2010-02-16 00:24 -------- d-----w- c:\program files\tsMuxeR_1.10.6
2010-02-16 00:23 . 2010-02-16 00:25 -------- d-----w- c:\program files\MKVtoolnix
2010-02-16 00:23 . 2010-02-16 00:23 -------- d-----w- c:\program files\MediaInfo
2010-02-16 00:18 . 2010-02-16 00:18 0 ----a-w- c:\windows\nsreg.dat
2010-02-16 00:18 . 2010-02-16 00:18 -------- d-----w- c:\documents and settings\sodina\Local Settings\Application Data\Mozilla
2010-02-15 23:10 . 2010-02-15 23:10 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-02-15 23:08 . 2010-02-15 23:08 -------- d-----w- c:\documents and settings\sodina\Application Data\Malwarebytes
2010-02-15 23:08 . 2010-02-15 23:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-15 23:05 . 2010-02-15 23:05 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-02-15 22:55 . 2010-02-15 22:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Toolbar4
2010-02-15 22:55 . 2010-01-27 02:04 60592 ----a-w- c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\update.exe
2010-02-15 22:55 . 2010-01-27 02:04 46256 ----a-w- c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\uninstall.exe
2010-02-15 22:53 . 2010-02-15 22:53 -------- d-----w- c:\program files\Haali
2010-02-15 22:50 . 2010-02-15 22:52 -------- d-----w- c:\program files\The KMPlayer
2010-02-15 22:50 . 2010-02-15 22:50 -------- d-----w- c:\program files\CoreCodec
2010-02-15 22:49 . 2010-02-15 22:49 -------- d-----w- c:\program files\WMV9_VCM
2010-02-15 22:49 . 2010-02-15 22:49 -------- d-----w- c:\program files\DivX
2010-02-15 22:49 . 2010-02-15 22:49 -------- d-----w- c:\program files\Unified Codec Pack
2010-02-15 22:48 . 2010-02-15 22:48 -------- d-----w- c:\program files\InstallShield Installation Information
2010-02-15 22:48 . 2010-02-15 22:48 -------- d-----w- c:\program files\CyberLink
2010-02-15 22:47 . 2010-02-16 20:53 -------- d-----w- c:\program files\TGTSoft
2010-02-15 22:45 . 2009-03-09 16:46 73392 ----a-w- c:\windows\system32\fsproflt.exe
2010-02-15 22:45 . 2008-06-05 23:37 43792 ----a-w- c:\windows\system32\drivers\FSPFltd.sys
2010-02-15 22:42 . 2010-02-15 22:42 -------- d-----r- C:\MSOCache
2010-02-15 22:40 . 2010-02-15 22:43 -------- d-----w- c:\windows\ShellNew
2010-02-15 22:40 . 2010-02-15 22:40 -------- d-----w- C:\HNC
2010-02-15 22:40 . 2010-02-15 22:40 -------- d-----w- c:\program files\eps
2010-02-15 22:38 . 2010-02-15 22:38 -------- d-----w- c:\program files\Lavalys
2010-02-15 22:37 . 2010-02-15 22:37 -------- d-----w- c:\documents and settings\sodina\Local Settings\Application Data\Downloaded Installations
2010-02-15 22:31 . 2010-02-15 22:31 -------- d-----w- c:\program files\TCP
2010-02-15 22:27 . 2010-02-15 22:27 -------- d-----w- c:\program files\Common Files\InstallShield
2010-02-15 22:27 . 2008-04-14 03:42 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2010-02-15 22:25 . 2010-02-15 22:25 -------- d-----w- c:\program files\Windows Media Connect 2
2010-02-15 22:25 . 2010-02-15 22:25 -------- d-----w- c:\windows\system32\drivers\UMDF
2010-02-15 22:25 . 2010-02-15 22:25 -------- d-----w- c:\windows\system32\LogFiles
2010-02-15 22:22 . 2010-02-15 22:22 -------- d-sh--w- c:\documents and settings\sodina\IECompatCache
2010-02-15 22:21 . 2010-02-15 22:21 -------- d-sh--w- c:\documents and settings\sodina\PrivacIE
2010-02-15 22:21 . 2010-02-15 22:21 -------- d-sh--w- c:\documents and settings\sodina\IETldCache
2010-02-15 22:18 . 2009-12-11 08:38 69120 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-02-15 22:18 . 2010-02-15 22:18 -------- d-----w- c:\windows\ie8updates
2010-02-15 22:18 . 2009-12-21 19:14 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-02-15 22:18 . 2009-12-21 19:14 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-02-15 22:18 . 2009-12-21 19:14 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-02-15 22:18 . 2009-12-21 19:14 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-02-15 22:18 . 2009-12-21 19:14 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-02-15 22:18 . 2009-12-21 19:14 11070464 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-02-15 22:18 . 2010-02-15 22:18 -------- dc-h--w- c:\windows\ie8
2010-02-15 22:14 . 2009-12-04 18:22 455424 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-02-15 22:12 . 2009-12-08 19:26 2145280 -c--a-w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-02-15 22:12 . 2009-12-08 19:26 2145280 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-02-15 22:12 . 2009-12-08 18:43 2023936 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-02-15 22:12 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll
2010-02-15 22:12 . 2008-06-13 11:05 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-02-15 22:12 . 2008-06-13 11:05 272128 ------w- c:\windows\system32\drivers\bthport.sys
2010-02-15 22:09 . 2009-01-07 23:21 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2010-02-15 22:09 . 2010-02-15 22:26 -------- d--h--w- c:\windows\$hf_mig$
2010-02-15 22:09 . 2009-08-07 00:24 44768 ----a-w- c:\windows\system32\wups2.dll
2010-02-15 22:03 . 2010-02-15 22:03 -------- d-----w- c:\documents and settings\sodina\Local Settings\Application Data\ATI
2010-02-15 22:03 . 2010-02-15 22:03 -------- d-----w- c:\documents and settings\sodina\Application Data\ATI
2010-02-15 22:03 . 2010-02-15 22:03 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2010-02-15 22:01 . 2009-11-18 23:24 95232 ----a-w- c:\windows\system32\drivers\AtiHdmi.sys
2010-02-15 22:00 . 2010-02-15 22:02 -------- d-----w- c:\program files\ATI Technologies
2010-02-15 22:00 . 2010-02-15 22:00 -------- d-----w- c:\program files\ATI
2010-02-15 22:00 . 2010-02-15 22:00 -------- d-----w- C:\ATI

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-16 15:38 . 2010-02-16 15:36 103167 ----a-w- c:\windows\hpoins08.dat
2010-02-16 15:36 . 2010-02-16 15:36 -------- d-----w- c:\program files\HP
2010-02-16 01:15 . 2008-04-14 03:42 578560 ------w- c:\windows\system32\user32.dll
2010-02-16 01:11 . 2008-04-14 03:42 218624 ----a-w- c:\windows\system32\uxtheme.dll
2010-02-15 22:55 . 2010-02-15 21:52 86592 ----a-w- c:\documents and settings\sodina\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-15 22:48 . 2005-07-31 21:07 505392 ----a-w- c:\windows\system32\msvcp71.dll
2010-02-15 22:45 . 2010-02-15 22:45 -------- d-----w- c:\program files\Folders 2009
2010-02-15 22:45 . 2010-02-15 22:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-02-15 22:44 . 2010-02-15 22:44 -------- d-----w- c:\program files\Microsoft Works
2010-02-15 22:44 . 2010-02-15 22:44 -------- d-----w- c:\program files\MSBuild
2010-02-15 22:44 . 2010-02-15 22:44 -------- d-----w- c:\program files\MPC-HC
2010-02-15 22:44 . 2010-02-15 22:44 -------- d-----w- c:\program files\Microsoft.NET
2010-02-15 22:43 . 2010-02-15 22:43 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-02-15 22:37 . 2010-02-15 21:49 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-02-15 22:33 . 2010-02-15 22:33 361600 ----a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2010-02-15 22:33 . 2008-04-13 22:50 361600 ----a-w- c:\windows\system32\drivers\TCPIP.SYS
2010-02-15 22:28 . 2010-02-15 22:28 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2010-02-15 22:28 . 2010-02-15 22:28 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2010-02-15 22:28 . 2010-02-15 22:28 -------- d-----w- c:\program files\OpenAL
2010-02-15 22:28 . 2010-02-15 22:28 -------- d-----w- c:\program files\C-Media PCI Audio
2010-02-15 22:01 . 2010-02-15 22:01 0 ----a-w- c:\windows\ativpsrm.bin
2009-12-08 19:26 . 2008-04-13 22:54 2145280 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 2008-04-14 00:01 2023936 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2008-04-13 22:47 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-30 22:43 . 2010-02-15 22:01 197982 ----a-w- c:\windows\system32\atiicdxx.dat
2009-11-27 17:11 . 2008-04-14 05:42 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 17:11 . 2008-04-14 03:42 1291776 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 16:07 . 2001-08-23 12:00 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07 . 2001-08-17 22:36 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07 . 2008-04-14 05:41 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:07 . 2008-04-14 03:42 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:07 . 2008-04-14 03:41 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-11-27 05:37 . 2009-11-27 05:37 521560 ----a-w- c:\documents and settings\All Users\Application Data\ESTsoft\ALSee\ALAd.dll
.

------- Sigcheck -------

[-] 2010-02-15 . D24EA301E2B36C4E975FD216CA85D8E7 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\TCPIP.SYS
[-] 2010-02-15 . D24EA301E2B36C4E975FD216CA85D8E7 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\TCPIP.SYS
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp3qfe\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp3gdr\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"STYLEXP"="c:\program files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 1372160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-13 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-12-11 98304]
"HncUpdate"="c:\windows\system32\HncUpdate.exe" [2005-07-31 241664]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-15 71216]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-03-15 54832]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\sodina\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=


R0 FSProFilter;FSPro File Filter;c:\windows\system32\drivers\FSPFltd.sys [2/15/2010 5:45 PM 43792]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2/20/2010 12:11 AM 12672]
R2 fsproflt;FSPro Filter Service;c:\windows\system32\fsproflt.exe [2/15/2010 5:45 PM 73392]
R2 thdudf;TOSHIBA UDF2.5 Reader File System Driver;c:\windows\system32\drivers\thdudf.sys [2/18/2010 12:26 AM 66944]
S0 yzhjc;yzhjc; [x]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://msn.com/
mStart Page = msn.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: 알툴바 빠른검색(&Q) - c:\program files\ESTsoft\ALToolBar\ALToolBand_1520.dll/23/SEARCH.HTML
DPF: {2A2B6809-46C9-4126-BAFC-B352585BD56E} - hxxp://www.kiwidisk.com/mmsv/KiwidiskControl.CAB
FF - ProfilePath - c:\documents and settings\sodina\Application Data\Mozilla\Firefox\Profiles\h6rkgo1k.default\
FF - prefs.js: browser.startup.homepage - msn.com

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-20 16:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ALYac_PZSrv]
"ImagePath"="c:\program files\ESTsoft\ALYac\AYServiceNt.aye"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(788)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-02-20 16:44:28
ComboFix-quarantined-files.txt 2010-02-20 21:44

Pre-Run: 266,772,381,696 bytes free
Post-Run: 266,754,420,736 bytes free

- - End Of File - - AF47DBAA1E0B42886377C65B89AA41D6


well, im still seeing security essentials in registry.
also, chkdsk fails on my os drive. i believe this was caused by the virus as the drive has only been used for a few days.
i ran it through a couple of tools and none of them reported any bad sector, so i dont know..
should i just give up and reformat the drive?

sempai, na jom do wa ju se yup ohmy.gif

Edited by sodina, 20 February 2010 - 08:47 PM.


#9 sempai

sempai

    noypi


  • Malware Response Team
  • 5,288 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:3 stars and a sun
  • Local time:05:50 AM

Posted 20 February 2010 - 11:39 PM

Hi sodina,

Well, the decision of reformatting is all yours and I am here to give any assistance needed. Though doing reformat and reinstalling the OS is always the best choice once you get infected, it will be useless if you keep re-installing some programs that causes the infection.

If you will reformat and re-install OS. Do not backup any programs/applications/installers like .exe, .scr, .htm, .html, .xml, .zip/.rar files...
The reason for this is because these files may be infected also. If you replace them after the re installation of OS, it will surely reinfect you again.


Please tell me if you wish to reformat. If you want me to continue the cleaning process please follow the next instructions. smile.gif



1. We need to execute a ComboFix script. (Tutorials on how to disable your anti virus and anti malware programs can be found
HERE.)

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the code box below into it:

CODE
Domains::

DirLook::
c:\program files\Folders 2009

FCopy::
c:\windows\$NtUninstallKB951748$\tcpip.sys | c:\windows\system32\dllcache\TCPIP.SYS
c:\windows\$NtUninstallKB951748$\tcpip.sys | c:\windows\system32\drivers\TCPIP.SYS

Driver::
yzhjc


Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.



2. Please run your Malwarebytes Anti-Malware. Go to update tab and download all updates and then perform a full scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



3. Download OTL to your Desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Copy and Paste the following code into the Custom Scan box. Do not include the word "Code"

    CODE
    netsvcs
    msconfig
    safebootminimal
    safebootnetwork
    activex
    drivers32
    %ALLUSERSPROFILE%\Application Data\*.
    %ALLUSERSPROFILE%\Application Data\*.exe /s
    %APPDATA%\*.
    %APPDATA%\*.exe /s
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    /md5stop
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    CREATERESTOREPOINT



  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them when you reply.


------------------------
sodina, I'm not a Korean but I do live in Korea. smile.gif


~Semp

~Semp

btn_donate_LG.gif
You can help me continue the fight against malware by making a donation, Thank you.

If I am helping you and I didn't reply within 48 hours... Please send me a private message.
Topics that are not replied within 5 days will be close. Please don't PM asking for support, post on the Forums instead.

Member of UNITE (Unified Network of Instructors and Trained Eliminators) 


#10 sodina

sodina
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:04:50 PM

Posted 21 February 2010 - 01:14 AM

combofix

ComboFix 10-02-20.04 - sodina 1/2010 Sun 0:43.5.8 - x86
Microsoft Windows XP Professional 5.1.2600.3.949.82.1033.18.3063.2678 [GMT -5:00]
Running from: c:\documents and settings\sodina\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\sodina\Desktop\CFScript.txt
AV: 알약 *On-access scanning disabled* (Updated) {B9431E5A-E196-4B6F-843A-10E01DB25461}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
--------------- FCopy ---------------

c:\windows\$NtUninstallKB951748$\tcpip.sys --> c:\windows\system32\dllcache\TCPIP.SYS
c:\windows\$NtUninstallKB951748$\tcpip.sys --> c:\windows\system32\drivers\TCPIP.SYS
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_YZHJC
-------\Service_yzhjc


((((((((((((((((((((((((( Files Created from 2010-01-21 to 2010-02-21 )))))))))))))))))))))))))))))))
.

2010-02-20 05:11 . 2010-02-20 05:11 -------- d-----w- c:\program files\CPUID
2010-02-20 05:11 . 2009-03-27 06:16 12672 ----a-w- c:\windows\system32\drivers\cpuz132_x32.sys
2010-02-20 01:50 . 2010-02-20 01:54 -------- d-----w- c:\program files\Gabest
2010-02-20 01:49 . 2010-02-20 01:49 -------- d--h--w- c:\windows\PIF
2010-02-20 01:49 . 2010-02-20 01:49 -------- d-----w- c:\documents and settings\sodina\Application Data\GetRightToGo
2010-02-19 03:44 . 2010-02-19 03:45 -------- d-----w- c:\windows\system32\NtmsData
2010-02-18 05:55 . 2010-02-18 05:55 -------- d-----w- c:\documents and settings\sodina\Local Settings\Application Data\Cinema_Squid
2010-02-18 05:44 . 2010-02-18 05:45 -------- d-----w- c:\program files\BDInfo
2010-02-18 05:28 . 2010-02-18 05:28 -------- d-----w- c:\program files\Elaborate Bytes
2010-02-18 05:26 . 2010-02-18 05:26 -------- d-----w- c:\program files\UDF25
2010-02-18 05:26 . 2006-11-11 07:25 66944 ----a-w- c:\windows\system32\drivers\thdudf.sys
2010-02-18 03:24 . 2010-02-18 03:24 -------- d-----w- c:\documents and settings\sodina\Application Data\mkvtoolnix
2010-02-16 23:58 . 2010-02-16 23:58 -------- d-----w- c:\program files\URUSoft
2010-02-16 15:38 . 2010-02-16 15:38 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2010-02-16 15:37 . 2005-10-15 03:42 46592 ----a-w- c:\windows\system32\hpzll43a.dll
2010-02-16 15:37 . 2005-10-15 03:41 72192 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzpp43a.dll
2010-02-16 15:37 . 2008-04-14 05:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2010-02-16 15:37 . 2008-04-14 05:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-02-16 15:33 . 2010-02-16 15:33 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-16 13:52 . 2010-02-18 23:07 -------- d-----w- c:\documents and settings\sodina\Local Settings\Application Data\QuickPar
2010-02-16 13:52 . 2010-02-16 13:52 -------- d-----w- c:\program files\QuickPar
2010-02-16 06:09 . 2010-02-16 06:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2010-02-16 05:55 . 2010-02-16 05:55 -------- d-sh--w- c:\documents and settings\sodina\UserData
2010-02-16 05:34 . 2010-02-16 05:34 -------- d-----w- c:\documents and settings\sodina\Application Data\Hnc
2010-02-16 04:36 . 2010-02-16 04:36 -------- d-----w- c:\program files\Kiwidisk
2010-02-16 02:41 . 2010-02-19 03:53 -------- d-----w- c:\documents and settings\sodina\Application Data\HD Tune Pro
2010-02-16 02:41 . 2010-02-16 02:41 -------- d-----w- c:\program files\HD Tune Pro
2010-02-16 02:37 . 2010-02-16 02:37 -------- d-----w- c:\documents and settings\sodina\Application Data\Media Player Classic
2010-02-16 02:37 . 2010-02-16 02:37 -------- d-----w- c:\documents and settings\sodina\Application Data\DivX
2010-02-16 01:45 . 2003-06-25 21:05 266360 ----a-w- c:\windows\system32\TweakUI.exe
2010-02-16 01:43 . 2010-02-16 02:50 -------- d-----w- c:\program files\Unlocker
2010-02-16 01:21 . 2010-02-20 22:25 -------- d-----w- c:\program files\JDownloader
2010-02-16 01:21 . 2010-02-16 01:21 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-16 01:21 . 2010-02-16 01:21 -------- d-----w- c:\program files\Java
2010-02-16 01:20 . 2010-02-16 01:20 152576 ----a-w- c:\documents and settings\sodina\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2010-02-16 01:10 . 2010-02-21 05:39 -------- d-----w- c:\documents and settings\sodina\Application Data\mIRC
2010-02-16 01:10 . 2010-02-21 05:13 -------- d-----w- c:\program files\mIRC
2010-02-16 01:02 . 2010-02-16 06:21 -------- d-----w- c:\documents and settings\sodina\Application Data\EstSoft
2010-02-16 01:02 . 2008-09-03 23:35 258352 ----a-w- c:\windows\system32\unicows.dll
2010-02-16 01:02 . 2010-02-16 01:02 -------- d-----w- c:\documents and settings\sodina\Local Settings\Application Data\assembly
2010-02-16 01:01 . 2010-02-16 06:21 -------- d-----w- c:\documents and settings\All Users\Application Data\ESTsoft
2010-02-16 01:01 . 2010-02-16 06:21 -------- d-----w- c:\program files\ESTsoft
2010-02-16 00:44 . 2010-02-19 23:16 196608 ----a-w- c:\documents and settings\sodina\Application Data\IPOPMEDIA\PopRecv\rcvsvr.exe
2010-02-16 00:44 . 2010-02-16 00:44 -------- d-----w- c:\documents and settings\sodina\Application Data\IPOPMEDIA
2010-02-16 00:42 . 2010-02-16 00:42 -------- d-----w- c:\program files\IPOPMEDIA
2010-02-16 00:24 . 2010-02-16 00:24 -------- d-----w- c:\program files\tsMuxeR_1.10.6
2010-02-16 00:23 . 2010-02-16 00:25 -------- d-----w- c:\program files\MKVtoolnix
2010-02-16 00:23 . 2010-02-16 00:23 -------- d-----w- c:\program files\MediaInfo
2010-02-16 00:18 . 2010-02-16 00:18 0 ----a-w- c:\windows\nsreg.dat
2010-02-16 00:18 . 2010-02-16 00:18 -------- d-----w- c:\documents and settings\sodina\Local Settings\Application Data\Mozilla
2010-02-15 23:10 . 2010-02-15 23:10 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-02-15 23:08 . 2010-02-15 23:08 -------- d-----w- c:\documents and settings\sodina\Application Data\Malwarebytes
2010-02-15 23:08 . 2010-02-15 23:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-15 23:05 . 2010-02-15 23:05 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-02-15 22:55 . 2010-02-15 22:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Toolbar4
2010-02-15 22:55 . 2010-01-27 02:04 60592 ----a-w- c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\update.exe
2010-02-15 22:55 . 2010-01-27 02:04 46256 ----a-w- c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\uninstall.exe
2010-02-15 22:53 . 2010-02-15 22:53 -------- d-----w- c:\program files\Haali
2010-02-15 22:50 . 2010-02-15 22:52 -------- d-----w- c:\program files\The KMPlayer
2010-02-15 22:50 . 2010-02-15 22:50 -------- d-----w- c:\program files\CoreCodec
2010-02-15 22:49 . 2010-02-15 22:49 -------- d-----w- c:\program files\WMV9_VCM
2010-02-15 22:49 . 2010-02-15 22:49 -------- d-----w- c:\program files\DivX
2010-02-15 22:49 . 2010-02-15 22:49 -------- d-----w- c:\program files\Unified Codec Pack
2010-02-15 22:48 . 2010-02-15 22:48 -------- d-----w- c:\program files\InstallShield Installation Information
2010-02-15 22:48 . 2010-02-15 22:48 -------- d-----w- c:\program files\CyberLink
2010-02-15 22:47 . 2010-02-16 20:53 -------- d-----w- c:\program files\TGTSoft
2010-02-15 22:45 . 2009-03-09 16:46 73392 ----a-w- c:\windows\system32\fsproflt.exe
2010-02-15 22:45 . 2008-06-05 23:37 43792 ----a-w- c:\windows\system32\drivers\FSPFltd.sys
2010-02-15 22:42 . 2010-02-15 22:42 -------- d-----r- C:\MSOCache
2010-02-15 22:40 . 2010-02-15 22:43 -------- d-----w- c:\windows\ShellNew
2010-02-15 22:40 . 2010-02-15 22:40 -------- d-----w- C:\HNC
2010-02-15 22:40 . 2010-02-15 22:40 -------- d-----w- c:\program files\eps
2010-02-15 22:38 . 2010-02-15 22:38 -------- d-----w- c:\program files\Lavalys
2010-02-15 22:37 . 2010-02-15 22:37 -------- d-----w- c:\documents and settings\sodina\Local Settings\Application Data\Downloaded Installations
2010-02-15 22:31 . 2010-02-15 22:31 -------- d-----w- c:\program files\TCP
2010-02-15 22:27 . 2010-02-15 22:27 -------- d-----w- c:\program files\Common Files\InstallShield
2010-02-15 22:27 . 2008-04-14 03:42 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2010-02-15 22:25 . 2010-02-15 22:25 -------- d-----w- c:\program files\Windows Media Connect 2
2010-02-15 22:25 . 2010-02-15 22:25 -------- d-----w- c:\windows\system32\drivers\UMDF
2010-02-15 22:25 . 2010-02-15 22:25 -------- d-----w- c:\windows\system32\LogFiles
2010-02-15 22:22 . 2010-02-15 22:22 -------- d-sh--w- c:\documents and settings\sodina\IECompatCache
2010-02-15 22:21 . 2010-02-15 22:21 -------- d-sh--w- c:\documents and settings\sodina\PrivacIE
2010-02-15 22:21 . 2010-02-15 22:21 -------- d-sh--w- c:\documents and settings\sodina\IETldCache
2010-02-15 22:18 . 2009-12-11 08:38 69120 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-02-15 22:18 . 2010-02-15 22:18 -------- d-----w- c:\windows\ie8updates
2010-02-15 22:18 . 2009-12-21 19:14 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-02-15 22:18 . 2009-12-21 19:14 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-02-15 22:18 . 2009-12-21 19:14 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-02-15 22:18 . 2009-12-21 19:14 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-02-15 22:18 . 2009-12-21 19:14 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-02-15 22:18 . 2009-12-21 19:14 11070464 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-02-15 22:18 . 2010-02-15 22:18 -------- dc-h--w- c:\windows\ie8
2010-02-15 22:14 . 2009-12-04 18:22 455424 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-02-15 22:12 . 2009-12-08 19:26 2145280 -c--a-w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-02-15 22:12 . 2009-12-08 19:26 2145280 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-02-15 22:12 . 2009-12-08 18:43 2023936 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-02-15 22:12 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll
2010-02-15 22:12 . 2008-06-13 11:05 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-02-15 22:12 . 2008-06-13 11:05 272128 ------w- c:\windows\system32\drivers\bthport.sys
2010-02-15 22:09 . 2009-01-07 23:21 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2010-02-15 22:09 . 2010-02-15 22:26 -------- d--h--w- c:\windows\$hf_mig$
2010-02-15 22:09 . 2009-08-07 00:24 44768 ----a-w- c:\windows\system32\wups2.dll
2010-02-15 22:03 . 2010-02-15 22:03 -------- d-----w- c:\documents and settings\sodina\Local Settings\Application Data\ATI
2010-02-15 22:03 . 2010-02-15 22:03 -------- d-----w- c:\documents and settings\sodina\Application Data\ATI
2010-02-15 22:03 . 2010-02-15 22:03 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2010-02-15 22:01 . 2009-11-18 23:24 95232 ----a-w- c:\windows\system32\drivers\AtiHdmi.sys
2010-02-15 22:00 . 2010-02-15 22:02 -------- d-----w- c:\program files\ATI Technologies
2010-02-15 22:00 . 2010-02-15 22:00 -------- d-----w- c:\program files\ATI
2010-02-15 22:00 . 2010-02-15 22:00 -------- d-----w- C:\ATI

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-16 15:38 . 2010-02-16 15:36 103167 ----a-w- c:\windows\hpoins08.dat
2010-02-16 15:36 . 2010-02-16 15:36 -------- d-----w- c:\program files\HP
2010-02-16 01:15 . 2008-04-14 03:42 578560 ------w- c:\windows\system32\user32.dll
2010-02-16 01:11 . 2008-04-14 03:42 218624 ----a-w- c:\windows\system32\uxtheme.dll
2010-02-15 22:55 . 2010-02-15 21:52 86592 ----a-w- c:\documents and settings\sodina\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-15 22:48 . 2005-07-31 21:07 505392 ----a-w- c:\windows\system32\msvcp71.dll
2010-02-15 22:45 . 2010-02-15 22:45 -------- d-----w- c:\program files\Folders 2009
2010-02-15 22:45 . 2010-02-15 22:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-02-15 22:44 . 2010-02-15 22:44 -------- d-----w- c:\program files\Microsoft Works
2010-02-15 22:44 . 2010-02-15 22:44 -------- d-----w- c:\program files\MSBuild
2010-02-15 22:44 . 2010-02-15 22:44 -------- d-----w- c:\program files\MPC-HC
2010-02-15 22:44 . 2010-02-15 22:44 -------- d-----w- c:\program files\Microsoft.NET
2010-02-15 22:43 . 2010-02-15 22:43 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-02-15 22:37 . 2010-02-15 21:49 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-02-15 22:33 . 2010-02-15 22:33 361600 ----a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2010-02-15 22:28 . 2010-02-15 22:28 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2010-02-15 22:28 . 2010-02-15 22:28 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2010-02-15 22:28 . 2010-02-15 22:28 -------- d-----w- c:\program files\OpenAL
2010-02-15 22:28 . 2010-02-15 22:28 -------- d-----w- c:\program files\C-Media PCI Audio
2010-02-15 22:01 . 2010-02-15 22:01 0 ----a-w- c:\windows\ativpsrm.bin
2009-12-08 19:26 . 2008-04-13 22:54 2145280 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 2008-04-14 00:01 2023936 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2008-04-13 22:47 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-30 22:43 . 2010-02-15 22:01 197982 ----a-w- c:\windows\system32\atiicdxx.dat
2009-11-27 17:11 . 2008-04-14 05:42 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 17:11 . 2008-04-14 03:42 1291776 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 16:07 . 2001-08-23 12:00 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07 . 2001-08-17 22:36 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07 . 2008-04-14 05:41 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:07 . 2008-04-14 03:42 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:07 . 2008-04-14 03:41 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-11-27 05:37 . 2009-11-27 05:37 521560 ----a-w- c:\documents and settings\All Users\Application Data\ESTsoft\ALSee\ALAd.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\program files\Folders 2009 ----

2010-02-15 22:45 . 2010-02-15 22:45 10562 ----a-w- c:\program files\Folders 2009\unins000.msg
2010-02-15 22:45 . 2008-12-30 05:49 18578 ----a-w- c:\program files\Folders 2009\langs\Danish.lng
2010-02-15 22:45 . 2008-11-27 20:15 18495 ----a-w- c:\program files\Folders 2009\langs\English.lng
2010-02-15 22:45 . 2009-01-03 16:55 19608 ----a-w- c:\program files\Folders 2009\langs\Finnish.lng
2010-02-15 22:45 . 2009-02-04 19:35 21337 ----a-w- c:\program files\Folders 2009\langs\French.lng
2010-02-15 22:45 . 2008-12-01 05:09 21183 ----a-w- c:\program files\Folders 2009\langs\German.lng
2010-02-15 22:45 . 2009-02-11 22:37 20626 ----a-w- c:\program files\Folders 2009\langs\Portuguese.lng
2010-02-15 22:45 . 2008-12-01 06:23 19186 ----a-w- c:\program files\Folders 2009\langs\Russian.lng
2010-02-15 22:45 . 2008-11-28 02:43 20851 ----a-w- c:\program files\Folders 2009\langs\Spanish.lng
2010-02-15 22:45 . 2009-02-17 23:09 20878 ----a-w- c:\program files\Folders 2009\langs\Spanish[LA].lng
2010-02-15 22:45 . 2009-03-03 16:08 35166 ----a-w- c:\program files\Folders 2009\langs\Arabic.lng
2010-02-15 22:45 . 2008-11-29 06:59 143 ----a-w- c:\program files\Folders 2009\Buynow.url
2010-02-15 22:45 . 2008-05-19 03:08 12800 ----a-w- c:\program files\Folders 2009\FSPFlt.dll
2010-02-15 22:45 . 2008-11-29 06:50 75339 ----a-w- c:\program files\Folders 2009\hf.chm
2010-02-15 22:45 . 2004-01-07 19:49 87 ----a-w- c:\program files\Folders 2009\Homepage.url
2010-02-15 22:45 . 2008-11-29 00:28 1819 ----a-w- c:\program files\Folders 2009\license.txt
2010-02-15 22:45 . 2009-03-09 18:19 5310 ----a-w- c:\program files\Folders 2009\whatsnew.txt
2010-02-15 22:45 . 2009-03-19 14:44 2072576 ----a-w- c:\program files\Folders 2009\hf.exe
2010-02-15 22:45 . 2010-02-15 22:45 23255 ----a-w- c:\program files\Folders 2009\unins000.dat
2010-02-15 22:45 . 2010-02-15 22:45 688768 ----a-w- c:\program files\Folders 2009\unins000.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"STYLEXP"="c:\program files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 1372160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-13 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-12-11 98304]
"HncUpdate"="c:\windows\system32\HncUpdate.exe" [2005-07-31 241664]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-15 71216]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-03-15 54832]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\sodina\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

R0 FSProFilter;FSPro File Filter;c:\windows\system32\drivers\FSPFltd.sys [2/15/2010 5:45 PM 43792]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2/20/2010 12:11 AM 12672]
R2 fsproflt;FSPro Filter Service;c:\windows\system32\fsproflt.exe [2/15/2010 5:45 PM 73392]
R2 thdudf;TOSHIBA UDF2.5 Reader File System Driver;c:\windows\system32\drivers\thdudf.sys [2/18/2010 12:26 AM 66944]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://msn.com/
mStart Page = msn.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: 알툴바 빠른검색(&Q) - c:\program files\ESTsoft\ALToolBar\ALToolBand_1520.dll/23/SEARCH.HTML
DPF: {2A2B6809-46C9-4126-BAFC-B352585BD56E} - hxxp://www.kiwidisk.com/mmsv/KiwidiskControl.CAB
FF - ProfilePath - c:\documents and settings\sodina\Application Data\Mozilla\Firefox\Profiles\h6rkgo1k.default\
FF - prefs.js: browser.startup.homepage - msn.com

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-21 00:46
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ALYac_PZSrv]
"ImagePath"="c:\program files\ESTsoft\ALYac\AYServiceNt.aye"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(792)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3376)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\WgaTray.exe
c:\windows\system32\conime.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-02-21 00:48:10 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-21 05:48

Pre-Run: 290,426,503,168 bytes free
Post-Run: 290,355,548,160 bytes free

- - End Of File - - 42E7B9D8ED9282F7FD95ACDAA833F0AE

mbam

Malwarebytes' Anti-Malware 1.44
Database version: 3769
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

2/21/2010 1:06:45 AM
mbam-log-2010-02-21 (01-06-45).txt

Scan type: Full Scan (C:\|X:\|)
Objects scanned: 149699
Time elapsed: 6 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

otl

OTL logfile created on: 2/21/2010 1:08:00 AM - Run 1
OTL by OldTimer - Version 3.1.30.1 Folder = C:\Documents and Settings\sodina\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 81.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 91.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 279.46 Gb Total Space | 270.46 Gb Free Space | 96.78% Space Free | Partition Type: NTFS
Drive D: | 1397.26 Gb Total Space | 401.02 Gb Free Space | 28.70% Space Free | Partition Type: NTFS
Drive E: | 1397.26 Gb Total Space | 401.02 Gb Free Space | 28.70% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive X: | 931.51 Gb Total Space | 630.81 Gb Free Space | 67.72% Space Free | Partition Type: NTFS

Computer Name: THOUSAND_ARMS
Current User Name: sodina
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/02/21 01:07:27 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\sodina\Desktop\OTL.exe
PRC - [2010/02/15 20:21:03 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2010/01/15 22:09:37 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/12/11 15:07:16 | 000,602,112 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe
PRC - [2009/06/17 06:44:11 | 000,085,160 | ---- | M] (Elaborate Bytes AG) -- C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
PRC - [2009/04/22 17:38:50 | 000,065,536 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
PRC - [2009/04/22 17:37:16 | 000,065,536 | ---- | M] (ATI Technologies Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
PRC - [2009/03/09 11:46:46 | 000,073,392 | ---- | M] (FSPro Labs) -- C:\WINDOWS\system32\fsproflt.exe
PRC - [2008/04/13 22:42:42 | 000,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe
PRC - [2008/04/13 22:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/03/14 21:01:30 | 000,071,216 | ---- | M] (Cyberlink Corp.) -- C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
PRC - [2006/10/27 00:47:42 | 000,031,016 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2005/03/14 12:05:02 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe


========== Modules (SafeList) ==========

MOD - [2010/02/21 01:07:27 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\sodina\Desktop\OTL.exe


========== Win32 Services (SafeList) ==========

SRV - [2010/02/15 20:21:03 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2010/01/14 00:44:24 | 000,886,648 | ---- | M] (ESTsoft Corp) [Auto | Stopped] -- C:\Program Files\ESTsoft\ALYac\AYServiceNT.aye -- (ALYac_PZSrv)
SRV - [2009/12/11 15:07:16 | 000,602,112 | ---- | M] (ATI Technologies Inc.) [Auto | Running] -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller)
SRV - [2009/03/09 11:46:46 | 000,073,392 | ---- | M] (FSPro Labs) [Auto | Running] -- C:\WINDOWS\system32\fsproflt.exe -- (fsproflt)
SRV - [2006/10/27 00:47:54 | 000,065,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2006/10/26 19:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006/10/26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006/05/24 13:31:06 | 000,372,736 | ---- | M] () [Auto | Stopped] -- C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe -- (StyleXPService)
SRV - [2005/03/14 12:05:02 | 000,069,632 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = msn.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://bing.zugo.com/?cfg=2-80-0-nb2N
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "msn.com"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/15 19:18:48 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/16 10:33:46 | 000,000,000 | ---D | M]

[2010/02/15 19:18:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\Mozilla\Extensions
[2010/02/19 21:53:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\Mozilla\Firefox\Profiles\h6rkgo1k.default\extensions
[2010/02/15 19:38:05 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\sodina\Application Data\Mozilla\Firefox\Profiles\h6rkgo1k.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/02/19 21:53:58 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/02/21 00:55:39 | 000,000,074 | RHS- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (ALToolbarBho Class) - {7F1A79F9-78D1-4186-9F60-EE0B63DF042A} - C:\Program Files\ESTsoft\ALToolBar\ALToolBand_1520.dll (ESTsoft Corporation)
O2 - BHO: (CoTGT_BHO Class) - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (ALToolBar) - {38FBE93D-4CA1-4414-AF6A-94920C5BD8DA} - C:\Program Files\ESTsoft\ALToolBar\ALToolBand_1520.dll (ESTsoft Corporation)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [HncUpdate] C:\WINDOWS\System32\HncUpdate.exe ()
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe (Cyberlink Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [VirtualCloneDrive] C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
O4 - HKCU..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe ()
O4 - Startup: C:\Documents and Settings\sodina\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: 알툴바 빠른검색(&Q) - C:\Program Files\ESTsoft\ALToolBar\ALToolBand_1520.dll (ESTsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {2A2B6809-46C9-4126-BAFC-B352585BD56E} http://www.kiwidisk.com/mmsv/KiwidiskControl.CAB (Kiwidisk File Share Control 5)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/...b?1266271741156 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.1.10.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\sodina\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\sodina\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/15 16:49:27 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010/02/15 19:29:06 | 000,000,000 | RH-D | M] - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010/02/15 19:29:06 | 000,000,000 | R--D | M] - X:\autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

NetSvcs: Ias - C:\WINDOWS\system32\ias [2010/02/15 11:33:44 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found


SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {1a3e09be-1e45-494b-9174-d7385b45bbf5} - Reg Error: Value error.
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Security Update for Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.ac3filter - C:\WINDOWS\System32\AC3Filter.acm (Alexander Vigovsky)
Drivers32: msacm.avis - C:\WINDOWS\System32\ff_acm32.acm (Milan Cutka)
Drivers32: msacm.divxa32 - C:\WINDOWS\System32\divxa32.acm (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lame398 - C:\WINDOWS\System32\lame398.acm (http://lame.sourceforge.net/)
Drivers32: msacm.lameacm - C:\WINDOWS\System32\lame397.acm (http://www.mp3dev.org/)
Drivers32: msacm.mp3acm1 - C:\WINDOWS\System32\mp3acm1.dll (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.mp3acm2 - C:\WINDOWS\System32\mp3acm2.dll (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.mp3acm3 - C:\WINDOWS\System32\mp3acm3.dll (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.vorbis - C:\WINDOWS\System32\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
Drivers32: vidc.CSCD - C:\WINDOWS\System32\camcodec.dll (RenderSoft Software.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DARC - C:\WINDOWS\System32\DivX651.dll (DivX, Inc.)
Drivers32: vidc.DIV3 - C:\WINDOWS\System32\DivXc32.dll (Hacked with Joy !)
Drivers32: vidc.DIV4 - C:\WINDOWS\System32\DivXc32f.dll (Hacked with Joy !)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.dvsd - C:\WINDOWS\System32\cedocida.dll ()
Drivers32: vidc.DX45 - C:\WINDOWS\System32\DivX511.dll (DivXNetworks, Inc.)
Drivers32: vidc.DX50 - C:\WINDOWS\System32\DivX661.dll (DivX, Inc.)
Drivers32: vidc.DXGM - C:\WINDOWS\System32\DivX521.dll (DivXNetworks, Inc.)
Drivers32: vidc.dyuv - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.ffds - C:\WINDOWS\System32\ff_vfw32.dll ()
Drivers32: vidc.fmp4 - C:\WINDOWS\System32\ff_vfw32.dll ()
Drivers32: vidc.fps1 - C:\WINDOWS\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.fvfw - C:\WINDOWS\System32\ff_vfw32.dll ()
Drivers32: vidc.HFYU - C:\WINDOWS\System32\huffyuv.dll (Disappearing Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.LAGS - C:\WINDOWS\System32\lagarith.dll ( )
Drivers32: vidc.LZOC - C:\WINDOWS\System32\LZOcodec.dll (No company)
Drivers32: vidc.MP42 - C:\WINDOWS\System32\mpg4c32a.dll (Microsoft Corporation)
Drivers32: vidc.MP43 - C:\WINDOWS\System32\mpg4c32a.dll (Microsoft Corporation)
Drivers32: vidc.MP4V - C:\WINDOWS\System32\xvidvfw2.dll (XviD.org Foundation)
Drivers32: vidc.MPG4 - C:\WINDOWS\System32\mpg4c32a.dll (Microsoft Corporation)
Drivers32: vidc.RMP4 - C:\WINDOWS\System32\xvidvfw1.dll (XviD.org Foundation)
Drivers32: vidc.SCLS - C:\WINDOWS\System32\scls.dll ()
Drivers32: vidc.sedg - C:\WINDOWS\System32\ff_vfw32.dll ()
Drivers32: vidc.tscc - C:\WINDOWS\System32\tsccvid.dll (TechSmith Corporation)
Drivers32: vidc.VP60 - C:\WINDOWS\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\WINDOWS\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP62 - C:\WINDOWS\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP70 - C:\WINDOWS\System32\vp7vfw.dll (On2.com)
Drivers32: vidc.VP71 - C:\WINDOWS\System32\vp7vfw.dll (On2.com)
Drivers32: vidc.wmv3 - C:\WINDOWS\System32\WMV9VCM.dll (Microsoft Corporation)
Drivers32: vidc.X264 - C:\WINDOWS\System32\x264vfw.dll ()
Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll (XviD.org Foundation)
Drivers32: vidc.Y264 - C:\WINDOWS\System32\x264vfw1.dll (http://www.videolan.org/developers/x264.html)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.Z264 - C:\WINDOWS\System32\x264vfw2.dll (http://www.videolan.org/developers/x264.html)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (55735438412873728)

========== Files/Folders - Created Within 14 Days ==========

[2010/02/21 01:07:27 | 000,549,376 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\sodina\Desktop\OTL.exe
[2010/02/21 00:59:16 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/02/21 00:56:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Desktop\New Folder
[2010/02/21 00:55:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
[2010/02/21 00:55:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2010/02/20 00:11:41 | 000,012,672 | ---- | C] (Windows Codename Longhorn DDK provider) -- C:\WINDOWS\System32\drivers\cpuz132_x32.sys
[2010/02/20 00:11:41 | 000,000,000 | ---D | C] -- C:\Program Files\CPUID
[2010/02/19 22:42:09 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\sodina\Recent
[2010/02/19 20:50:34 | 000,000,000 | ---D | C] -- C:\Program Files\Gabest
[2010/02/19 20:49:25 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2010/02/19 20:49:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\GetRightToGo
[2010/02/18 22:44:54 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2010/02/18 00:55:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Local Settings\Application Data\Cinema_Squid
[2010/02/18 00:44:59 | 000,000,000 | ---D | C] -- C:\Program Files\BDInfo
[2010/02/18 00:28:43 | 000,000,000 | ---D | C] -- C:\Program Files\Elaborate Bytes
[2010/02/18 00:26:13 | 000,000,000 | ---D | C] -- C:\Program Files\UDF25
[2010/02/17 22:24:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\mkvtoolnix
[2010/02/16 18:58:50 | 000,000,000 | ---D | C] -- C:\Program Files\URUSoft
[2010/02/16 18:45:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\My Documents\OneNote Notebooks
[2010/02/16 10:38:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Hewlett-Packard
[2010/02/16 10:36:51 | 000,000,000 | ---D | C] -- C:\Program Files\HP
[2010/02/16 10:36:21 | 000,098,304 | ---- | C] (Hewlett Packard Company) -- C:\WINDOWS\System32\hpzjsn01.dll
[2010/02/16 10:33:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2010/02/16 10:33:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2010/02/16 10:33:39 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2010/02/16 08:52:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Local Settings\Application Data\QuickPar
[2010/02/16 08:52:14 | 000,000,000 | ---D | C] -- C:\Program Files\QuickPar
[2010/02/16 00:55:05 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\sodina\UserData
[2010/02/16 00:34:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\Hnc
[2010/02/16 00:00:52 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/02/15 23:55:58 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2010/02/15 23:36:24 | 000,000,000 | ---D | C] -- C:\Program Files\Kiwidisk
[2010/02/15 21:41:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\HD Tune Pro
[2010/02/15 21:41:36 | 000,000,000 | ---D | C] -- C:\Program Files\HD Tune Pro
[2010/02/15 21:37:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\Media Player Classic
[2010/02/15 21:37:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\DivX
[2010/02/15 20:43:11 | 000,000,000 | ---D | C] -- C:\Program Files\Unlocker
[2010/02/15 20:21:09 | 000,000,000 | ---D | C] -- C:\Program Files\JDownloader
[2010/02/15 20:21:02 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2010/02/15 20:20:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\Sun
[2010/02/15 20:10:25 | 000,000,000 | ---D | C] -- C:\Program Files\mIRC
[2010/02/15 20:10:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\mIRC
[2010/02/15 20:02:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\EstSoft
[2010/02/15 20:02:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Local Settings\Application Data\assembly
[2010/02/15 20:01:21 | 000,000,000 | ---D | C] -- C:\Program Files\ESTsoft
[2010/02/15 20:01:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\ESTsoft
[2010/02/15 19:44:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\IPOPMEDIA
[2010/02/15 19:42:10 | 000,000,000 | ---D | C] -- C:\Program Files\IPOPMEDIA
[2010/02/15 19:29:06 | 000,000,000 | RH-D | C] -- C:\autorun.inf
[2010/02/15 19:24:11 | 000,000,000 | ---D | C] -- C:\Program Files\tsMuxeR_1.10.6
[2010/02/15 19:23:57 | 000,000,000 | ---D | C] -- C:\Program Files\MKVtoolnix
[2010/02/15 19:23:47 | 000,000,000 | ---D | C] -- C:\Program Files\MediaInfo
[2010/02/15 19:19:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\My Documents\Downloads
[2010/02/15 19:18:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Local Settings\Application Data\Mozilla
[2010/02/15 19:18:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\Mozilla
[2010/02/15 19:18:45 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2010/02/15 19:06:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\Macromedia
[2010/02/15 19:06:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\Adobe
[2010/02/15 18:52:20 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/02/15 18:44:51 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/02/15 18:08:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\Malwarebytes
[2010/02/15 18:08:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/02/15 17:55:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Toolbar4
[2010/02/15 17:53:40 | 000,000,000 | ---D | C] -- C:\Program Files\Haali
[2010/02/15 17:52:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\My Documents\The KMPlayer
[2010/02/15 17:50:17 | 000,000,000 | ---D | C] -- C:\Program Files\The KMPlayer
[2010/02/15 17:50:03 | 000,000,000 | ---D | C] -- C:\Program Files\CoreCodec
[2010/02/15 17:49:38 | 000,000,000 | ---D | C] -- C:\Program Files\WMV9_VCM
[2010/02/15 17:49:38 | 000,000,000 | ---D | C] -- C:\Program Files\DivX
[2010/02/15 17:49:36 | 000,000,000 | ---D | C] -- C:\Program Files\Unified Codec Pack
[2010/02/15 17:48:57 | 000,000,000 | ---D | C] -- C:\Program Files\InstallShield Installation Information
[2010/02/15 17:48:41 | 000,000,000 | ---D | C] -- C:\Program Files\CyberLink
[2010/02/15 17:47:21 | 000,000,000 | ---D | C] -- C:\Program Files\TGTSoft
[2010/02/15 17:45:48 | 000,073,392 | ---- | C] (FSPro Labs) -- C:\WINDOWS\System32\fsproflt.exe
[2010/02/15 17:45:47 | 000,043,792 | ---- | C] (FSPro Labs) -- C:\WINDOWS\System32\drivers\FSPFltd.sys
[2010/02/15 17:45:46 | 000,000,000 | ---D | C] -- C:\Program Files\Folders 2009
[2010/02/15 17:44:55 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Works
[2010/02/15 17:44:52 | 000,000,000 | ---D | C] -- C:\Program Files\MSBuild
[2010/02/15 17:44:43 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio
[2010/02/15 17:44:43 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2010/02/15 17:44:32 | 000,000,000 | ---D | C] -- C:\Program Files\MPC-HC
[2010/02/15 17:44:30 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2010/02/15 17:44:17 | 000,000,000 | ---D | C] -- C:\NZB-O-Matic
[2010/02/15 17:43:14 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio 8
[2010/02/15 17:42:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Local Settings\Application Data\Microsoft Help
[2010/02/15 17:42:47 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2010/02/15 17:42:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Microsoft Help
[2010/02/15 17:42:37 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2010/02/15 17:40:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\ShellNew
[2010/02/15 17:40:20 | 000,000,000 | ---D | C] -- C:\HNC
[2010/02/15 17:40:20 | 000,000,000 | ---D | C] -- C:\Program Files\eps
[2010/02/15 17:38:08 | 000,000,000 | ---D | C] -- C:\Program Files\Lavalys
[2010/02/15 17:37:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Local Settings\Application Data\Downloaded Installations
[2010/02/15 17:31:24 | 000,000,000 | ---D | C] -- C:\Program Files\TCP
[2010/02/15 17:28:27 | 006,914,048 | ---- | C] (C-Media Corporation) -- C:\WINDOWS\System\CMICNFG3.cpl
[2010/02/15 17:28:27 | 000,917,504 | ---- | C] (C-Media Electronics Inc.) -- C:\WINDOWS\System\CMDS3D3.dll
[2010/02/15 17:28:27 | 000,262,144 | ---- | C] (C-Media Corporation) -- C:\WINDOWS\System32\CMRMDRV3.exe
[2010/02/15 17:28:27 | 000,032,768 | ---- | C] (C-Media Corporation) -- C:\WINDOWS\System32\CMUdaProp3.dll
[2010/02/15 17:28:09 | 000,413,696 | ---- | C] (Creative Labs) -- C:\WINDOWS\System32\wrap_oal.dll
[2010/02/15 17:28:09 | 000,274,432 | ---- | C] (C-Media Corporation) -- C:\WINDOWS\CmiPCIUninstall.exe
[2010/02/15 17:28:09 | 000,110,592 | ---- | C] (Portions Creative Labs Inc. and NVIDIA Corp.) -- C:\WINDOWS\System32\OpenAL32.dll
[2010/02/15 17:28:09 | 000,000,000 | ---D | C] -- C:\Program Files\OpenAL
[2010/02/15 17:28:04 | 001,405,696 | ---- | C] (C-Media Inc) -- C:\WINDOWS\System32\drivers\cmudax3.sys
[2010/02/15 17:28:04 | 000,036,864 | ---- | C] (C-Media Electronics Ins.) -- C:\WINDOWS\System32\cmudax3.DLL
[2010/02/15 17:28:04 | 000,000,000 | ---D | C] -- C:\Program Files\C-Media PCI Audio
[2010/02/15 17:27:56 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[2010/02/15 17:27:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\WinRAR
[2010/02/15 17:25:39 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Media Connect 2
[2010/02/15 17:25:10 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\UMDF
[2010/02/15 17:25:10 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles
[2010/02/15 17:22:13 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\sodina\IECompatCache
[2010/02/15 17:21:56 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\sodina\PrivacIE
[2010/02/15 17:21:42 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\sodina\IETldCache
[2010/02/15 17:18:43 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
[2010/02/15 17:18:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\WBEM
[2010/02/15 17:18:09 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2010/02/15 17:09:59 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\PreInstall
[2010/02/15 17:09:57 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$hf_mig$
[2010/02/15 17:09:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\SoftwareDistribution
[2010/02/15 17:08:17 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2010/02/15 17:03:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Local Settings\Application Data\ATI
[2010/02/15 17:03:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\ATI
[2010/02/15 17:03:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\ATI
[2010/02/15 17:01:59 | 000,095,232 | ---- | C] (ATI Research Inc.) -- C:\WINDOWS\System32\drivers\AtiHdmi.sys
[2010/02/15 17:01:53 | 000,208,896 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\atipdlxx.dll
[2010/02/15 17:01:53 | 000,155,648 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\Oemdspif.dll
[2010/02/15 17:01:53 | 000,043,520 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\ati2edxx.dll
[2010/02/15 17:01:53 | 000,026,112 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\Ati2mdxx.exe
[2010/02/15 17:01:53 | 000,024,064 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\ativcoxx.dll
[2010/02/15 17:01:14 | 000,000,000 | R-SD | C] -- C:\WINDOWS\assembly
[2010/02/15 17:01:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET
[2010/02/15 17:00:54 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2010/02/15 17:00:52 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2010/02/15 17:00:24 | 000,000,000 | -H-D | C] -- C:\ATI
[2010/02/15 16:58:23 | 000,000,000 | ---D | C] -- C:\Program Files\Marvell
[2010/02/15 16:58:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\TMP
[2010/02/15 16:55:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ReinstallBackups
[2010/02/15 16:55:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\DRVSTORE
[2010/02/15 16:54:58 | 000,053,248 | R--- | C] (Windows XP Bundled build C-Centric Single User) -- C:\WINDOWS\System32\CSVer.dll
[2010/02/15 16:54:58 | 000,000,000 | ---D | C] -- C:\Program Files\Intel
[2010/02/15 16:54:38 | 000,000,000 | -H-D | C] -- C:\Intel
[2010/02/15 16:52:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Application Data\Identities
[2010/02/15 16:52:17 | 000,000,000 | -H-D | C] -- C:\Program Files\Uninstall Information
[2010/02/15 16:52:16 | 000,000,000 | R--D | C] -- C:\Documents and Settings\sodina\My Documents\My Pictures
[2010/02/15 16:52:16 | 000,000,000 | R--D | C] -- C:\Documents and Settings\sodina\My Documents\My Music
[2010/02/15 16:52:09 | 000,000,000 | --SD | C] -- C:\Documents and Settings\sodina\Application Data\Microsoft
[2010/02/15 16:52:09 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\sodina\SendTo
[2010/02/15 16:52:09 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\sodina\Application Data
[2010/02/15 16:52:09 | 000,000,000 | R--D | C] -- C:\Documents and Settings\sodina\Start Menu
[2010/02/15 16:52:09 | 000,000,000 | R--D | C] -- C:\Documents and Settings\sodina\My Documents
[2010/02/15 16:52:09 | 000,000,000 | R--D | C] -- C:\Documents and Settings\sodina\Favorites
[2010/02/15 16:52:09 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\sodina\Cookies
[2010/02/15 16:52:09 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\sodina\Templates
[2010/02/15 16:52:09 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\sodina\PrintHood
[2010/02/15 16:52:09 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\sodina\NetHood
[2010/02/15 16:52:09 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\sodina\Local Settings
[2010/02/15 16:52:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Local Settings\Application Data\Microsoft
[2010/02/15 16:52:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\sodina\Desktop
[2010/02/15 16:51:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\SoftwareDistribution
[2010/02/15 16:51:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2010/02/15 16:51:34 | 000,000,000 | --SD | C] -- C:\WINDOWS\System32\Microsoft
[2010/02/15 16:51:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2010/02/15 16:51:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/02/15 16:50:13 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia330.dll
[2010/02/15 16:50:13 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia001.dll
[2010/02/15 16:50:13 | 000,029,184 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rw330ext.dll
[2010/02/15 16:49:57 | 000,057,856 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esuimgd.dll
[2010/02/15 16:49:57 | 000,045,056 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esunid.dll
[2010/02/15 16:49:57 | 000,031,744 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esucmd.dll
[2010/02/15 16:49:53 | 000,054,528 | ---- | C] (Philips Semiconductors GmbH) -- C:\WINDOWS\System32\dllcache\cap7146.sys
[2010/02/15 16:49:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\xircom
[2010/02/15 16:49:39 | 000,000,000 | ---D | C] -- C:\Program Files\xerox
[2010/02/15 16:49:39 | 000,000,000 | ---D | C] -- C:\Program Files\microsoft frontpage
[2010/02/15 16:49:25 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2010/02/15 16:49:25 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2010/02/15 16:49:01 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\All Users\DRM
[2010/02/15 16:48:57 | 000,000,000 | --SD | C] -- C:\WINDOWS\Downloaded Program Files
[2010/02/15 16:48:57 | 000,000,000 | R--D | C] -- C:\WINDOWS\Offline Web Pages
[2010/02/15 16:48:52 | 000,000,000 | -H-D | C] -- C:\Program Files\WindowsUpdate
[2010/02/15 16:48:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\DirectX
[2010/02/15 16:48:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Services
[2010/02/15 16:48:22 | 000,000,000 | --SD | C] -- C:\WINDOWS\Tasks
[2010/02/15 16:48:21 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\MSSoap
[2010/02/15 16:48:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\srchasst
[2010/02/15 16:48:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Macromed
[2010/02/15 16:48:10 | 000,000,000 | ---D | C] -- C:\Program Files\Movie Maker
[2010/02/15 16:47:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Restore
[2010/02/15 16:47:45 | 000,000,000 | ---D | C] -- C:\Program Files\NetMeeting
[2010/02/15 16:47:41 | 000,000,000 | ---D | C] -- C:\Program Files\Outlook Express
[2010/02/15 16:47:34 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\System
[2010/02/15 16:47:33 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Pictures
[2010/02/15 16:47:33 | 000,000,000 | ---D | C] -- C:\Program Files\Internet Explorer
[2010/02/15 16:47:18 | 000,000,000 | ---D | C] -- C:\Program Files\ComPlus Applications
[2010/02/15 16:47:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\Registration
[2010/02/15 16:47:11 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Music
[2010/02/15 16:47:11 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Media Player
[2010/02/15 16:47:11 | 000,000,000 | ---D | C] -- C:\Program Files\Online Services
[2010/02/15 16:47:08 | 000,000,000 | ---D | C] -- C:\Program Files\Messenger
[2010/02/15 16:47:05 | 000,000,000 | ---D | C] -- C:\Program Files\MSN Gaming Zone
[2010/02/15 16:46:32 | 000,000,000 | ---D | C] -- C:\Program Files\MSN
[2010/02/15 16:46:31 | 000,281,088 | ---- | C] (Cinematronics) -- C:\WINDOWS\System32\dllcache\pinball.exe
[2010/02/15 16:46:30 | 000,000,000 | ---D | C] -- C:\Program Files\Windows NT
[2010/02/15 16:46:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en-US
[2010/02/15 16:46:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\MsDtc
[2010/02/15 16:46:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Com
[2010/02/15 16:46:13 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Videos
[2010/02/15 11:40:04 | 000,000,000 | -HSD | C] -- C:\WINDOWS\Installer
[2010/02/15 11:40:04 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ODBC
[2010/02/15 11:40:01 | 000,000,000 | R--D | C] -- C:\Program Files
[2010/02/15 11:40:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\SpeechEngines
[2010/02/15 11:40:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Microsoft Shared
[2010/02/15 11:40:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files
[2010/02/15 11:39:39 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu
[2010/02/15 11:39:39 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents
[2010/02/15 11:39:39 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Templates
[2010/02/15 11:39:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Favorites
[2010/02/15 11:39:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Desktop
[2010/02/15 11:37:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot2
[2010/02/15 11:37:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot
[2010/02/15 11:37:45 | 000,000,000 | --SD | C] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2010/02/15 11:37:45 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\All Users\Application Data
[2010/02/15 11:37:26 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2010/02/15 11:37:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings
[2010/02/15 11:32:56 | 000,000,000 | R-SD | C] -- C:\WINDOWS\Fonts
[2010/02/15 11:32:56 | 000,000,000 | RHSD | C] -- C:\WINDOWS\System32\dllcache
[2010/02/15 11:32:56 | 000,000,000 | R--D | C] -- C:\WINDOWS\Web
[2010/02/15 11:32:56 | 000,000,000 | -H-D | C] -- C:\WINDOWS\inf
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\WinSxS
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\wins
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\wbem
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\usmt
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\twain_32
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\system32
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\system
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\spool
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ShellExt
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Setup
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\security
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\scripting
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\Resources
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\repair
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ras
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\Provisioning
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\PeerNet
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\pchealth
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\oobe
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\npp
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\Network Diagnostic
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\mui
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\mui
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\msapps
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\msagent
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\Media
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\L2Schemas
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\java
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\inetsrv
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\IME
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\ime
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\icsxml
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ias
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\Help
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\export
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\etc
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\ehome
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\Driver Cache
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\disdn
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\dhcp
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\Debug
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\Cursors
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\Connection Wizard
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\config
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\Config
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\AppPatch
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\addins
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\3com_dmi
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\3076
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\2052
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1054
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1042
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1041
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1037
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1033
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1031
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1028
[2010/02/15 11:32:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1025
[2007/09/30 08:10:58 | 000,096,768 | ---- | C] ( ) -- C:\WINDOWS\System32\lagarith.dll
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/02/21 01:07:27 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\sodina\Desktop\OTL.exe
[2010/02/21 01:02:56 | 000,458,340 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/02/21 01:02:56 | 000,392,296 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/02/21 01:02:56 | 000,058,596 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/02/21 00:59:00 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/02/21 00:58:41 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/02/21 00:58:38 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/02/21 00:57:28 | 003,145,728 | -H-- | M] () -- C:\Documents and Settings\sodina\NTUSER.DAT
[2010/02/21 00:57:28 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\sodina\ntuser.ini
[2010/02/21 00:57:23 | 004,292,660 | -H-- | M] () -- C:\Documents and Settings\sodina\Local Settings\Application Data\IconCache.db
[2010/02/21 00:55:39 | 000,000,074 | RHS- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/02/21 00:46:43 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/02/21 00:46:37 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts4.bak
[2010/02/20 22:18:02 | 000,022,528 | ---- | M] () -- C:\Documents and Settings\sodina\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/16 18:45:47 | 000,000,953 | ---- | M] () -- C:\Documents and Settings\sodina\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
[2010/02/16 10:38:13 | 000,103,167 | ---- | M] () -- C:\WINDOWS\hpoins08.dat
[2010/02/16 00:52:07 | 000,000,281 | -HS- | M] () -- C:\boot.ini
[2010/02/16 00:06:08 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts3.bak
[2010/02/15 23:51:30 | 000,001,690 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/02/15 20:17:28 | 000,310,168 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/02/15 19:55:58 | 000,000,918 | ---- | M] () -- C:\Documents and Settings\sodina\Application Data\coreavc.ini
[2010/02/15 19:18:49 | 000,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat
[2010/02/15 18:51:13 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts2.bak
[2010/02/15 18:10:00 | 000,006,456 | -H-- | M] () -- C:\WINDOWS\System32\rawuhila
[2010/02/15 17:55:17 | 000,086,592 | ---- | M] () -- C:\Documents and Settings\sodina\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/02/15 17:49:39 | 000,000,134 | ---- | M] () -- C:\WINDOWS\huffyuv.ini
[2010/02/15 17:49:39 | 000,000,092 | ---- | M] () -- C:\WINDOWS\LZOCodec.ini
[2010/02/15 17:49:39 | 000,000,046 | ---- | M] () -- C:\WINDOWS\lagarith.ini
[2010/02/15 17:49:36 | 000,000,038 | ---- | M] () -- C:\WINDOWS\AviSplitter.ini
[2010/02/15 17:43:00 | 000,000,582 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/02/15 17:40:31 | 000,000,040 | ---- | M] () -- C:\WINDOWS\Hjimesv.ini
[2010/02/15 17:40:27 | 000,000,603 | ---- | M] () -- C:\WINDOWS\System\Cmicnfg3.ini
[2010/02/15 17:40:05 | 000,000,016 | ---- | M] () -- C:\WINDOWS\System32\winhcfg.ini
[2010/02/15 17:28:27 | 000,000,199 | ---- | M] () -- C:\WINDOWS\Cmicnfg3.ini.cfl
[2010/02/15 17:28:09 | 000,413,696 | ---- | M] (Creative Labs) -- C:\WINDOWS\System32\wrap_oal.dll
[2010/02/15 17:28:09 | 000,110,592 | ---- | M] (Portions Creative Labs Inc. and NVIDIA Corp.) -- C:\WINDOWS\System32\OpenAL32.dll
[2010/02/15 17:26:01 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/02/15 17:25:42 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2010/02/15 17:25:42 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2010/02/15 17:25:11 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2010/02/15 17:01:57 | 000,000,000 | ---- | M] () -- C:\WINDOWS\ativpsrm.bin
[2010/02/15 16:57:57 | 000,034,305 | ---- | M] () -- C:\WINDOWS\Ascd_tmp.ini
[2010/02/15 16:51:12 | 000,008,192 | ---- | M] () -- C:\WINDOWS\REGLOCS.OLD
[2010/02/15 16:50:27 | 000,000,261 | ---- | M] () -- C:\WINDOWS\System32\$winnt$.inf
[2010/02/15 16:49:27 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/02/15 16:49:27 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010/02/15 16:49:27 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/02/15 16:49:27 | 000,000,000 | ---- | M] () -- C:\WINDOWS\control.ini
[2010/02/15 16:49:27 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010/02/15 16:49:27 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/02/15 16:49:25 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2010/02/15 16:49:20 | 000,004,161 | ---- | M] () -- C:\WINDOWS\ODBCINST.INI
[2010/02/15 16:48:57 | 000,000,488 | RH-- | M] () -- C:\WINDOWS\System32\WindowsLogon.manifest
[2010/02/15 16:48:57 | 000,000,488 | RH-- | M] () -- C:\WINDOWS\System32\logonui.exe.manifest
[2010/02/15 16:48:54 | 000,000,749 | RH-- | M] () -- C:\WINDOWS\System32\wuaucpl.cpl.manifest
[2010/02/15 16:48:54 | 000,000,749 | RH-- | M] () -- C:\WINDOWS\WindowsShell.Manifest
[2010/02/15 16:48:54 | 000,000,749 | RH-- | M] () -- C:\WINDOWS\System32\sapi.cpl.manifest
[2010/02/15 16:48:54 | 000,000,749 | RH-- | M] () -- C:\WINDOWS\System32\nwc.cpl.manifest
[2010/02/15 16:48:54 | 000,000,749 | RH-- | M] () -- C:\WINDOWS\System32\ncpa.cpl.manifest
[2010/02/15 16:48:54 | 000,000,749 | RH-- | M] () -- C:\WINDOWS\System32\cdplayer.exe.manifest
[2010/02/15 16:47:22 | 000,021,640 | ---- | M] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/02/15 16:47:17 | 000,000,037 | ---- | M] () -- C:\WINDOWS\vbaddin.ini
[2010/02/15 16:47:17 | 000,000,036 | ---- | M] () -- C:\WINDOWS\vb.ini
[2010/02/15 16:45:48 | 000,000,211 | -H-- | M] () -- C:\Boot.bak
[2010/02/15 11:45:21 | 000,004,444 | ---- | M] () -- C:\WINDOWS\System32\pid.PNF
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2099/01/01 12:00:00 | 000,006,456 | -H-- | C] () -- C:\WINDOWS\System32\rawuhila
[2010/02/21 00:55:39 | 000,000,027 | ---- | C] () -- C:\WINDOWS\System32\drivers\etc\hosts4.bak
[2010/02/16 18:45:47 | 000,000,953 | ---- | C] () -- C:\Documents and Settings\sodina\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
[2010/02/16 10:36:25 | 000,103,167 | ---- | C] () -- C:\WINDOWS\hpoins08.dat
[2010/02/16 10:36:25 | 000,004,445 | ---- | C] () -- C:\WINDOWS\hpomdl08.dat
[2010/02/16 10:36:25 | 000,000,334 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2010/02/16 10:36:21 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2010/02/16 08:47:51 | 000,022,528 | ---- | C] () -- C:\Documents and Settings\sodina\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/16 00:59:26 | 000,000,027 | ---- | C] () -- C:\WINDOWS\System32\drivers\etc\hosts3.bak
[2010/02/16 00:00:54 | 000,000,211 | -H-- | C] () -- C:\Boot.bak
[2010/02/16 00:00:52 | 000,260,272 | -H-- | C] () -- C:\cmldr
[2010/02/15 20:45:42 | 000,160,217 | ---- | C] () -- C:\WINDOWS\System32\PowerToysLicense.rtf
[2010/02/15 20:02:27 | 000,389,120 | ---- | C] () -- C:\WINDOWS\System32\actskn43.ocx
[2010/02/15 19:55:58 | 000,000,918 | ---- | C] () -- C:\Documents and Settings\sodina\Application Data\coreavc.ini
[2010/02/15 19:18:49 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/02/15 19:18:46 | 000,001,690 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/02/15 19:15:11 | 000,000,027 | ---- | C] () -- C:\WINDOWS\System32\drivers\etc\hosts2.bak
[2010/02/15 17:49:39 | 000,000,134 | ---- | C] () -- C:\WINDOWS\huffyuv.ini
[2010/02/15 17:49:39 | 000,000,092 | ---- | C] () -- C:\WINDOWS\LZOCodec.ini
[2010/02/15 17:49:39 | 000,000,046 | ---- | C] () -- C:\WINDOWS\lagarith.ini
[2010/02/15 17:49:36 | 000,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.ini
[2010/02/15 17:40:31 | 000,000,040 | ---- | C] () -- C:\WINDOWS\Hjimesv.ini
[2010/02/15 17:40:05 | 000,000,016 | ---- | C] () -- C:\WINDOWS\System32\winhcfg.ini
[2010/02/15 17:28:27 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\CMRMDRV3.dll
[2010/02/15 17:28:27 | 000,000,603 | ---- | C] () -- C:\WINDOWS\System\Cmicnfg3.ini
[2010/02/15 17:28:27 | 000,000,199 | ---- | C] () -- C:\WINDOWS\Cmicnfg3.ini.cfl
[2010/02/15 17:28:09 | 000,003,418 | ---- | C] () -- C:\WINDOWS\Cmicnfg3.ini.cfg
[2010/02/15 17:28:08 | 000,000,012 | ---- | C] () -- C:\WINDOWS\cmudax3.ini
[2010/02/15 17:25:11 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2010/02/15 17:10:58 | 000,000,734 | ---- | C] () -- C:\WINDOWS\System32\drivers\etc\hosts1.bak
[2010/02/15 17:01:57 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2010/02/15 17:01:53 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2010/02/15 17:01:53 | 000,375,648 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.cap
[2010/02/15 17:01:53 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\ATIODE.exe
[2010/02/15 17:01:53 | 000,197,982 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2010/02/15 17:01:53 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ATIODCLI.exe
[2010/02/15 17:01:53 | 000,019,462 | ---- | C] () -- C:\WINDOWS\atiogl.xml
[2010/02/15 17:01:53 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2010/02/15 16:53:54 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2010/02/15 16:53:44 | 000,034,305 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2010/02/15 16:53:43 | 000,010,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2010/02/15 16:52:10 | 000,000,178 | -HS- | C] () -- C:\Documents and Settings\sodina\ntuser.ini
[2010/02/15 16:52:09 | 003,145,728 | -H-- | C] () -- C:\Documents and Settings\sodina\NTUSER.DAT
[2010/02/15 16:51:12 | 000,008,192 | ---- | C] () -- C:\WINDOWS\REGLOCS.OLD
[2010/02/15 16:50:27 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/02/15 16:49:58 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\dllcache\fpencode.dll
[2010/02/15 16:49:53 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_864.nls
[2010/02/15 16:49:53 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_862.nls
[2010/02/15 16:49:53 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_858.nls
[2010/02/15 16:49:53 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_720.nls
[2010/02/15 16:49:53 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_870.nls
[2010/02/15 16:49:53 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_708.nls
[2010/02/15 16:49:53 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28596.nls
[2010/02/15 16:49:53 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_21025.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20924.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20880.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20871.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20838.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20833.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20424.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20423.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20420.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20297.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20285.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20284.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20280.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20278.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20277.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20273.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20269.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20108.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20107.nls
[2010/02/15 16:49:52 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20106.nls
[2010/02/15 16:49:51 | 000,187,938 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20005.nls
[2010/02/15 16:49:51 | 000,186,402 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20001.nls
[2010/02/15 16:49:51 | 000,185,378 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20003.nls
[2010/02/15 16:49:51 | 000,180,258 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20004.nls
[2010/02/15 16:49:51 | 000,173,602 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20002.nls
[2010/02/15 16:49:51 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20105.nls
[2010/02/15 16:49:51 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1149.nls
[2010/02/15 16:49:51 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1148.nls
[2010/02/15 16:49:51 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1147.nls
[2010/02/15 16:49:51 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1146.nls
[2010/02/15 16:49:51 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1145.nls
[2010/02/15 16:49:51 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1144.nls
[2010/02/15 16:49:51 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1143.nls
[2010/02/15 16:49:51 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1142.nls
[2010/02/15 16:49:51 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1141.nls
[2010/02/15 16:49:51 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1140.nls
[2010/02/15 16:49:50 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1047.nls
[2010/02/15 16:49:50 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10021.nls
[2010/02/15 16:49:50 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10005.nls
[2010/02/15 16:49:50 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10004.nls
[2010/02/15 16:49:27 | 000,002,577 | ---- | C] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/02/15 16:49:27 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2010/02/15 16:49:27 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2010/02/15 16:49:27 | 000,000,000 | ---- | C] () -- C:\CONFIG.SYS
[2010/02/15 16:49:27 | 000,000,000 | ---- | C] () -- C:\AUTOEXEC.BAT
[2010/02/15 16:49:25 | 000,023,392 | ---- | C] () -- C:\WINDOWS\System32\nscompat.tlb
[2010/02/15 16:49:25 | 000,016,832 | ---- | C] () -- C:\WINDOWS\System32\amcompat.tlb
[2010/02/15 16:49:24 | 000,316,640 | ---- | C] () -- C:\WINDOWS\WMSysPr9.prx
[2010/02/15 16:48:57 | 000,000,488 | RH-- | C] () -- C:\WINDOWS\System32\WindowsLogon.manifest
[2010/02/15 16:48:57 | 000,000,488 | RH-- | C] () -- C:\WINDOWS\System32\logonui.exe.manifest
[2010/02/15 16:48:54 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\System32\wuaucpl.cpl.manifest
[2010/02/15 16:48:54 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\WindowsShell.Manifest
[2010/02/15 16:48:54 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\System32\sapi.cpl.manifest
[2010/02/15 16:48:54 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\System32\nwc.cpl.manifest
[2010/02/15 16:48:54 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\System32\ncpa.cpl.manifest
[2010/02/15 16:48:54 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\System32\cdplayer.exe.manifest
[2010/02/15 16:48:46 | 004,399,505 | ---- | C] () -- C:\WINDOWS\System32\dllcache\nls302en.lex
[2010/02/15 16:48:32 | 000,048,680 | -HS- | C] () -- C:\WINDOWS\winnt256.bmp
[2010/02/15 16:48:32 | 000,048,680 | -HS- | C] () -- C:\WINDOWS\winnt.bmp
[2010/02/15 16:48:26 | 000,000,984 | ---- | C] () -- C:\WINDOWS\System32\dllcache\srframe.mmf
[2010/02/15 16:47:51 | 000,376,832 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msinfo.dll
[2010/02/15 16:47:22 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/02/15 16:46:50 | 000,065,954 | ---- | C] () -- C:\WINDOWS\Prairie Wind.bmp
[2010/02/15 16:46:50 | 000,065,832 | ---- | C] () -- C:\WINDOWS\Santa Fe Stucco.bmp
[2010/02/15 16:46:50 | 000,026,680 | ---- | C] () -- C:\WINDOWS\River Sumida.bmp
[2010/02/15 16:46:50 | 000,026,582 | ---- | C] () -- C:\WINDOWS\Greenstone.bmp
[2010/02/15 16:46:50 | 000,017,362 | ---- | C] () -- C:\WINDOWS\Rhododendron.bmp
[2010/02/15 16:46:50 | 000,017,336 | ---- | C] () -- C:\WINDOWS\Gone Fishing.bmp
[2010/02/15 16:46:50 | 000,016,730 | ---- | C] () -- C:\WINDOWS\FeatherTexture.bmp
[2010/02/15 16:46:50 | 000,009,522 | ---- | C] () -- C:\WINDOWS\Zapotec.bmp
[2010/02/15 16:46:49 | 000,093,702 | ---- | C] () -- C:\WINDOWS\System32\subrange.uce
[2010/02/15 16:46:49 | 000,065,978 | ---- | C] () -- C:\WINDOWS\Soap Bubbles.bmp
[2010/02/15 16:46:49 | 000,060,458 | ---- | C] () -- C:\WINDOWS\System32\ideograf.uce
[2010/02/15 16:46:49 | 000,017,062 | ---- | C] () -- C:\WINDOWS\Coffee Bean.bmp
[2010/02/15 16:46:49 | 000,016,740 | ---- | C] () -- C:\WINDOWS\System32\shiftjis.uce
[2010/02/15 16:46:49 | 000,012,876 | ---- | C] () -- C:\WINDOWS\System32\korean.uce
[2010/02/15 16:46:49 | 000,008,484 | ---- | C] () -- C:\WINDOWS\System32\kanji_2.uce
[2010/02/15 16:46:49 | 000,006,948 | ---- | C] () -- C:\WINDOWS\System32\kanji_1.uce
[2010/02/15 16:46:49 | 000,001,272 | ---- | C] () -- C:\WINDOWS\Blue Lace 16.bmp
[2010/02/15 16:46:48 | 000,024,006 | ---- | C] () -- C:\WINDOWS\System32\gb2312.uce
[2010/02/15 16:46:48 | 000,022,984 | ---- | C] () -- C:\WINDOWS\System32\bopomofo.uce
[2010/02/15 16:46:47 | 000,003,286 | ---- | C] () -- C:\WINDOWS\System32\tslabels.h
[2010/02/15 16:46:47 | 000,001,161 | ---- | C] () -- C:\WINDOWS\System32\usrlogon.cmd
[2010/02/15 16:46:46 | 000,000,768 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.h
[2010/02/15 16:46:40 | 000,063,488 | ---- | C] () -- C:\WINDOWS\System32\wmimgmt.msc
[2010/02/15 11:45:21 | 000,004,444 | ---- | C] () -- C:\WINDOWS\System32\pid.PNF
[2010/02/15 11:43:39 | 000,173,568 | ---- | C] () -- C:\WINDOWS\System32\dllcache\chtskf.dll
[2010/02/15 11:43:37 | 000,175,104 | ---- | C] () -- C:\WINDOWS\System32\dllcache\pintlcsa.dll
[2010/02/15 11:43:33 | 000,059,392 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imscinst.exe
[2010/02/15 11:43:26 | 013,463,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hwxjpn.dll
[2010/02/15 11:43:25 | 000,196,665 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imjpinst.exe
[2010/02/15 11:43:24 | 001,158,818 | ---- | C] () -- C:\WINDOWS\System32\korwbrkr.lex
[2010/02/15 11:43:24 | 001,158,818 | ---- | C] () -- C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2010/02/15 11:43:24 | 000,002,060 | ---- | C] () -- C:\WINDOWS\System32\noise.jpn
[2010/02/15 11:43:24 | 000,001,486 | ---- | C] () -- C:\WINDOWS\System32\noise.kor
[2010/02/15 11:43:16 | 000,211,938 | ---- | C] () -- C:\WINDOWS\System32\lcphrase.tbl
[2010/02/15 11:43:16 | 000,146,126 | ---- | C] () -- C:\WINDOWS\System32\array30.tab
[2010/02/15 11:43:16 | 000,116,285 | ---- | C] () -- C:\WINDOWS\System32\msdayi.tbl
[2010/02/15 11:43:16 | 000,110,566 | ---- | C] () -- C:\WINDOWS\System32\arphr.tbl
[2010/02/15 11:43:16 | 000,044,370 | ---- | C] () -- C:\WINDOWS\System32\acode.tbl
[2010/02/15 11:43:16 | 000,043,242 | ---- | C] () -- C:\WINDOWS\System32\phoncode.tbl
[2010/02/15 11:43:16 | 000,024,114 | ---- | C] () -- C:\WINDOWS\System32\lcptr.tbl
[2010/02/15 11:43:16 | 000,018,600 | ---- | C] () -- C:\WINDOWS\System32\arrayhw.tab
[2010/02/15 11:43:16 | 000,016,312 | ---- | C] () -- C:\WINDOWS\System32\arptr.tbl
[2010/02/15 11:43:16 | 000,004,071 | ---- | C] () -- C:\WINDOWS\System32\phon.tbl
[2010/02/15 11:43:16 | 000,002,714 | ---- | C] () -- C:\WINDOWS\System32\phonptr.tbl
[2010/02/15 11:43:16 | 000,000,700 | ---- | C] () -- C:\WINDOWS\System32\dayiptr.tbl
[2010/02/15 11:43:16 | 000,000,520 | ---- | C] () -- C:\WINDOWS\System32\dayiphr.tbl
[2010/02/15 11:43:15 | 000,195,618 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10002.nls
[2010/02/15 11:43:15 | 000,195,618 | ---- | C] () -- C:\WINDOWS\System32\c_10002.nls
[2010/02/15 11:43:15 | 000,082,172 | ---- | C] () -- C:\WINDOWS\System32\dllcache\bopomofo.nls
[2010/02/15 11:43:15 | 000,082,172 | ---- | C] () -- C:\WINDOWS\System32\bopomofo.nls
[2010/02/15 11:43:15 | 000,066,728 | ---- | C] () -- C:\WINDOWS\System32\dllcache\big5.nls
[2010/02/15 11:43:15 | 000,066,728 | ---- | C] () -- C:\WINDOWS\System32\big5.nls
[2010/02/15 11:43:15 | 000,044,370 | ---- | C] () -- C:\WINDOWS\System32\a234.tbl
[2010/02/15 11:43:15 | 000,001,460 | ---- | C] () -- C:\WINDOWS\System32\a15.tbl
[2010/02/15 11:43:14 | 000,016,254 | ---- | C] () -- C:\WINDOWS\System32\PINTLPAE.HLP
[2010/02/15 11:43:14 | 000,014,821 | ---- | C] () -- C:\WINDOWS\System32\PINTLPAD.HLP
[2010/02/15 11:43:12 | 001,223,500 | ---- | C] () -- C:\WINDOWS\System32\WINZM.MB
[2010/02/15 11:43:11 | 001,783,864 | ---- | C] () -- C:\WINDOWS\System32\WINPY.MB
[2010/02/15 11:43:11 | 001,564,868 | ---- | C] () -- C:\WINDOWS\System32\WINSP.MB
[2010/02/15 11:43:11 | 000,173,602 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10008.nls
[2010/02/15 11:43:11 | 000,173,602 | ---- | C] () -- C:\WINDOWS\System32\c_10008.nls
[2010/02/15 11:43:11 | 000,083,748 | ---- | C] () -- C:\WINDOWS\System32\prcp.nls
[2010/02/15 11:43:11 | 000,083,748 | ---- | C] () -- C:\WINDOWS\System32\dllcache\prcp.nls
[2010/02/15 11:43:11 | 000,083,748 | ---- | C] () -- C:\WINDOWS\System32\prc.nls
[2010/02/15 11:43:11 | 000,083,748 | ---- | C] () -- C:\WINDOWS\System32\dllcache\prc.nls
[2010/02/15 11:43:08 | 000,134,339 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imekr.lex
[2010/02/15 11:43:08 | 000,108,827 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hanja.lex
[2010/02/15 11:43:04 | 000,177,698 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10003.nls
[2010/02/15 11:43:04 | 000,177,698 | ---- | C] () -- C:\WINDOWS\System32\c_10003.nls
[2010/02/15 11:43:03 | 000,189,986 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1361.nls
[2010/02/15 11:43:03 | 000,189,986 | ---- | C] () -- C:\WINDOWS\System32\c_1361.nls
[2010/02/15 11:43:03 | 000,047,066 | ---- | C] () -- C:\WINDOWS\System32\ksc.nls
[2010/02/15 11:43:03 | 000,047,066 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ksc.nls
[2010/02/15 11:42:46 | 000,180,770 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20932.nls
[2010/02/15 11:42:46 | 000,180,770 | ---- | C] () -- C:\WINDOWS\System32\c_20932.nls
[2010/02/15 11:42:46 | 000,177,698 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20949.nls
[2010/02/15 11:42:46 | 000,177,698 | ---- | C] () -- C:\WINDOWS\System32\c_20949.nls
[2010/02/15 11:42:46 | 000,173,602 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20936.nls
[2010/02/15 11:42:46 | 000,173,602 | ---- | C] () -- C:\WINDOWS\System32\c_20936.nls
[2010/02/15 11:42:45 | 000,180,258 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20000.nls
[2010/02/15 11:42:45 | 000,180,258 | ---- | C] () -- C:\WINDOWS\System32\c_20000.nls
[2010/02/15 11:42:45 | 000,162,850 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10001.nls
[2010/02/15 11:42:45 | 000,162,850 | ---- | C] () -- C:\WINDOWS\System32\c_10001.nls
[2010/02/15 11:42:45 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_21027.nls
[2010/02/15 11:42:45 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_21027.nls
[2010/02/15 11:42:45 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20290.nls
[2010/02/15 11:42:45 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_20290.nls
[2010/02/15 11:42:45 | 000,028,288 | ---- | C] () -- C:\WINDOWS\System32\xjis.nls
[2010/02/15 11:42:45 | 000,028,288 | ---- | C] () -- C:\WINDOWS\System32\dllcache\xjis.nls
[2010/02/15 11:40:06 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2010/02/15 11:40:03 | 001,685,606 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sam.spd
[2010/02/15 11:40:03 | 000,000,888 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sam.sdf
[2010/02/15 11:40:02 | 000,605,050 | ---- | C] () -- C:\WINDOWS\System32\dllcache\r1033tts.lxa
[2010/02/15 11:40:01 | 000,643,717 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ltts1033.lxa
[2010/02/15 11:40:00 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28603.nls
[2010/02/15 11:40:00 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_28603.nls
[2010/02/15 11:39:58 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28599.nls
[2010/02/15 11:39:58 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_28599.nls
[2010/02/15 11:39:57 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_857.nls
[2010/02/15 11:39:57 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_857.nls
[2010/02/15 11:39:57 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10081.nls
[2010/02/15 11:39:57 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10081.nls
[2010/02/15 11:39:55 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28595.nls
[2010/02/15 11:39:55 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\C_28595.NLS
[2010/02/15 11:39:55 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10017.nls
[2010/02/15 11:39:55 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10017.nls
[2010/02/15 11:39:55 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10007.nls
[2010/02/15 11:39:55 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10007.nls
[2010/02/15 11:39:53 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_869.nls
[2010/02/15 11:39:53 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_869.nls
[2010/02/15 11:39:53 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_737.nls
[2010/02/15 11:39:53 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_737.nls
[2010/02/15 11:39:53 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_875.nls
[2010/02/15 11:39:53 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_875.nls
[2010/02/15 11:39:53 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28597.nls
[2010/02/15 11:39:53 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\C_28597.NLS
[2010/02/15 11:39:53 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10006.nls
[2010/02/15 11:39:53 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10006.nls
[2010/02/15 11:39:51 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_866.nls
[2010/02/15 11:39:51 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_866.nls
[2010/02/15 11:39:51 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_855.nls
[2010/02/15 11:39:51 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_855.nls
[2010/02/15 11:39:51 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28594.nls
[2010/02/15 11:39:51 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\C_28594.NLS
[2010/02/15 11:39:49 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_852.nls
[2010/02/15 11:39:49 | 000,066,594 | ---- | C] () -- C:\WINDOWS\System32\c_852.nls
[2010/02/15 11:39:49 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10082.nls
[2010/02/15 11:39:49 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10082.nls
[2010/02/15 11:39:49 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10029.nls
[2010/02/15 11:39:49 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10029.nls
[2010/02/15 11:39:49 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10010.nls
[2010/02/15 11:39:49 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_10010.nls
[2010/02/15 11:39:47 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20127.nls
[2010/02/15 11:39:47 | 000,066,082 | ---- | C] () -- C:\WINDOWS\System32\c_20127.nls
[2010/02/15 11:39:44 | 000,001,688 | ---- | C] () -- C:\WINDOWS\System32\AUTOEXEC.NT
[2010/02/15 11:38:00 | 000,399,645 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MAPIMIG.CAT
[2010/02/15 11:38:00 | 000,144,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\netfx.cat
[2010/02/15 11:38:00 | 000,112,918 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tabletpc.cat
[2010/02/15 11:38:00 | 000,037,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MW770.CAT
[2010/02/15 11:38:00 | 000,034,747 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mediactr.cat
[2010/02/15 11:38:00 | 000,034,063 | ---- | C] () -- C:\WINDOWS\System32\dllcache\FP4.CAT
[2010/02/15 11:38:00 | 000,026,991 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn7.cat
[2010/02/15 11:38:00 | 000,016,535 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IMS.CAT
[2010/02/15 11:38:00 | 000,014,433 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn9.cat
[2010/02/15 11:38:00 | 000,013,472 | ---- | C] () -- C:\WINDOWS\System32\dllcache\HPCRDP.CAT
[2010/02/15 11:38:00 | 000,012,363 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSMSGS.CAT
[2010/02/15 11:38:00 | 000,010,027 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSTSWEB.CAT
[2010/02/15 11:38:00 | 000,008,574 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IASNT4.CAT
[2010/02/15 11:38:00 | 000,007,382 | ---- | C] () -- C:\WINDOWS\System32\dllcache\OEMBIOS.CAT
[2010/02/15 11:38:00 | 000,007,334 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmerrenu.cat
[2010/02/15 11:37:59 | 002,144,487 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5.CAT
[2010/02/15 11:37:59 | 001,296,669 | ---- | C] () -- C:\WINDOWS\System32\dllcache\SP3.CAT
[2010/02/15 11:37:59 | 000,797,189 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5IIS.CAT
[2010/02/15 11:37:59 | 000,522,220 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5INF.CAT
[2010/02/15 11:37:26 | 000,310,168 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/02/15 11:36:33 | 000,000,281 | -HS- | C] () -- C:\boot.ini
[2010/02/15 11:36:31 | 000,000,261 | ---- | C] () -- C:\WINDOWS\System32\$winnt$.inf
[2007/10/12 17:32:58 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw32.dll
[2007/08/20 19:26:52 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2007/08/20 19:26:52 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest
[2007/08/15 17:33:14 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2007/08/15 17:30:26 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2007/03/20 00:57:38 | 000,121,856 | ---- | C] () -- C:\WINDOWS\System32\scls.dll
[2007/02/12 08:06:54 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\cedocida.dll
[2006/09/24 08:56:32 | 000,593,938 | ---- | C] () -- C:\WINDOWS\System32\x264vfw.dll
[2005/01/17 03:39:50 | 000,000,474 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw2.dll.manifest
[2005/01/17 03:39:50 | 000,000,474 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw1.dll.manifest
[2005/01/17 03:39:50 | 000,000,474 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll.manifest
[2005/01/17 03:39:50 | 000,000,474 | ---- | C] () -- C:\WINDOWS\System32\x264vfw2.dll.manifest
[2005/01/17 03:39:50 | 000,000,474 | ---- | C] () -- C:\WINDOWS\System32\x264vfw1.dll.manifest
[2005/01/17 03:39:50 | 000,000,474 | ---- | C] () -- C:\WINDOWS\System32\x264vfw.dll.manifest
[2005/01/17 03:39:50 | 000,000,474 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw32.dll.manifest
[2002/10/15 17:54:04 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll

========== LOP Check ==========

[2010/02/15 17:55:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Toolbar4
[2010/02/19 20:49:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\GetRightToGo
[2010/02/18 22:53:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\HD Tune Pro
[2010/02/16 00:34:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\Hnc
[2010/02/15 19:44:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\IPOPMEDIA
[2010/02/17 22:24:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\mkvtoolnix
[2010/02/15 16:58:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\TMP

========== Purity Check ==========



========== Custom Scans ==========


< %ALLUSERSPROFILE%\Application Data\*. >
[2010/02/16 10:33:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2010/02/15 17:03:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ATI
[2010/02/16 01:21:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ESTsoft
[2010/02/15 18:08:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/02/15 17:44:30 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2010/02/15 17:45:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft Help
[2010/02/21 00:55:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
[2010/02/15 17:55:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Toolbar4
[2010/02/21 00:55:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage

< %ALLUSERSPROFILE%\Application Data\*.exe /s >
[2009/11/18 00:50:04 | 000,361,744 | ---- | M] (ESTsoft corp.) -- C:\Documents and Settings\All Users\Application Data\ESTsoft\ALCM\ALCMUpdate.exe
[2010/01/26 21:04:46 | 000,046,256 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\uninstall.exe
[2010/01/26 21:04:48 | 000,060,592 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\update.exe

< %APPDATA%\*. >
[2010/02/15 19:06:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\Adobe
[2010/02/15 17:03:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\ATI
[2010/02/15 21:37:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\DivX
[2010/02/16 01:21:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\EstSoft
[2010/02/19 20:49:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\GetRightToGo
[2010/02/18 22:53:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\HD Tune Pro
[2010/02/16 00:34:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\Hnc
[2010/02/15 16:52:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\Identities
[2010/02/15 19:44:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\IPOPMEDIA
[2010/02/15 19:06:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\Macromedia
[2010/02/15 18:08:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\Malwarebytes
[2010/02/15 21:37:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\Media Player Classic
[2010/02/16 18:45:49 | 000,000,000 | --SD | M] -- C:\Documents and Settings\sodina\Application Data\Microsoft
[2010/02/21 00:39:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\mIRC
[2010/02/17 22:24:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\mkvtoolnix
[2010/02/15 19:18:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\Mozilla
[2010/02/15 20:20:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\Sun
[2010/02/15 16:58:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\TMP
[2010/02/15 17:27:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\sodina\Application Data\WinRAR

< %APPDATA%\*.exe /s >
[2010/02/19 18:16:09 | 000,196,608 | ---- | M] () -- C:\Documents and Settings\sodina\Application Data\IPOPMEDIA\PopRecv\rcvsvr.exe
[2010/02/15 17:01:50 | 000,010,134 | R--- | M] () -- C:\Documents and Settings\sodina\Application Data\Microsoft\Installer\{B74590A5-82CB-CB87-04A2-4AF9B2C5169D}\ARPPRODUCTICON.exe

< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2008/04/13 22:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/04/13 22:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/14 10:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/14 10:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008/04/14 10:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2008/04/13 17:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 22:41:54 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/13 22:41:54 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008/04/13 22:41:54 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/13 22:42:02 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/13 22:42:02 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008/04/13 22:42:02 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2008/04/13 22:42:06 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/13 22:42:06 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008/04/13 22:42:06 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/12/11 15:26:24 | 000,446,464 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll
[2001/08/23 07:00:00 | 000,006,144 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\kbd101a.dll
[2001/08/17 09:55:56 | 000,005,632 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\kbd103.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< End of report >


i did as you instructed and some of the registry have been cleared. also, chkdsk works fine now.
however, im still seeing security essential 2010 in registry under search assistant.

Edited by sodina, 21 February 2010 - 01:27 AM.


#11 sempai

sempai

    noypi


  • Malware Response Team
  • 5,288 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:3 stars and a sun
  • Local time:05:50 AM

Posted 21 February 2010 - 02:08 AM

Hi,

Ok let's search for possible remnants.


1. Please download the self-extracting version of HijackThis from here: HijackThis Installer Download
  • Save HJTInstall.exe to your desktop.
  • Double-click the file then click the Install button.
  • The file will be extracted to C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  • A shortcut for future use will also be created on your desktop and the Intro Frame of HijackThis will open.
Click Do a system scan and save a log file. Copy the entire contents of that log and post it here by clicking the Add Reply button.



2. Please go to Kaspersky website and perform an online antivirus scan.
  1. Read through the requirements and privacy statement and click on Accept button.
  2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  3. When the downloads have finished, click on Settings.
  4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
  5. Click on My Computer under Scan.
  6. Once the scan is complete, it will display the results. Click on View Scan Report.
  7. You will see a list of infected items there. Click on Save Report As....
  8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  9. Please post this log in your next reply .



~Semp

~Semp

btn_donate_LG.gif
You can help me continue the fight against malware by making a donation, Thank you.

If I am helping you and I didn't reply within 48 hours... Please send me a private message.
Topics that are not replied within 5 days will be close. Please don't PM asking for support, post on the Forums instead.

Member of UNITE (Unified Network of Instructors and Trained Eliminators) 


#12 sodina

sodina
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:04:50 PM

Posted 21 February 2010 - 10:24 AM

Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:19:54 AM, on 2/21/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\fsproflt.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\ESTsoft\ALYac\AYAgent.aye
C:\Program Files\ESTsoft\ALYac\AYServiceNt.aye
C:\Program Files\Java\jre6\bin\javaw.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ALToolBar BHO - {7F1A79F9-78D1-4186-9F60-EE0B63DF042A} - C:\Program Files\ESTsoft\ALToolBar\ALToolBand_1520.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: ALToolBar - {38FBE93D-4CA1-4414-AF6A-94920C5BD8DA} - C:\Program Files\ESTsoft\ALToolBar\ALToolBand_1520.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [HncUpdate] C:\WINDOWS\system32\HncUpdate.exe /A
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: 알툴바 빠른검색(&Q) - res://C:\Program Files\ESTsoft\ALToolBar\ALToolBand_1520.dll/23/SEARCH.HTML
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2A2B6809-46C9-4126-BAFC-B352585BD56E} (Kiwidisk File Share Control 5) - http://www.kiwidisk.com/mmsv/KiwidiskControl.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1266271741156
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: ALYac_PZSrv - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: FSPro Filter Service (fsproflt) - FSPro Labs - C:\WINDOWS\system32\fsproflt.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

--
End of file - 5926 bytes


Kaspersky

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Sunday, February 21, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Sunday, February 21, 2010 14:15:58
Records in database: 3606207
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
H:\
X:\

Scan statistics:
Objects scanned: 42058
Threats found: 1
Infected objects found: 2
Suspicious objects found: 0
Scan duration: 00:44:08


File name / Threat / Threats count
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.g 1
X:\Essential\Utilities\mIRC\mIRC v6.35 (NEW) mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.g 1

Selected area has been scanned.


i just scanned and posted the logs. i didnt remove anything using either one of the tools.
god, that KASPERSKY took forever to complete..

Edited by sodina, 21 February 2010 - 10:27 AM.


#13 sempai

sempai

    noypi


  • Malware Response Team
  • 5,288 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:3 stars and a sun
  • Local time:05:50 AM

Posted 22 February 2010 - 10:29 AM

Hi sodina,

Logs didn't give much information so we will use another scanner, but if you can provide me some information like screen shot to those registry remnants, it will be very helpful. smile.gif

It's up to you if you want to delete the files detected by kaspersky...
QUOTE
File name / Threat / Threats count
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.g 1
X:\Essential\Utilities\mIRC\mIRC v6.35 (NEW) mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.g 1

... they are not really infections, as the report says "not-a-virus" but they are potential treats or Riskware, If you dont use MIRC I suggest you remove it. Please click HERE for details.


Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)


~Semp

~Semp

btn_donate_LG.gif
You can help me continue the fight against malware by making a donation, Thank you.

If I am helping you and I didn't reply within 48 hours... Please send me a private message.
Topics that are not replied within 5 days will be close. Please don't PM asking for support, post on the Forums instead.

Member of UNITE (Unified Network of Instructors and Trained Eliminators) 


#14 sodina

sodina
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:04:50 PM

Posted 22 February 2010 - 10:59 AM

i did link the screenshots of those still remaining in registry. see my reply #2.
the second one has been removed, but the first one still remains under the search assistant.
ill do another scan using the tool you linked above, once i get home.

i also have another question in case i decide to do a format.
which tools can i use to prevent internet security 2010 (security essentials 2010) from getting in.
i mean, viruses these days are nothing like what they used to be. one can get infected by visiting a website or installing a free shareware and whatnot. i dont mind reformatting that much as i dont have anything in my os drive.
however, i cant even begin to tell you how frustrating it is to do a format and get infected by the same virus again.

i live in usa at the moment, so you helping me in person wouldnt be possible.
i really appreciate it. you know, you going out of your way to help out a noob and all thumbup2.gif






#15 sempai

sempai

    noypi


  • Malware Response Team
  • 5,288 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:3 stars and a sun
  • Local time:05:50 AM

Posted 22 February 2010 - 11:23 AM

Hi,

QUOTE
which tools can i use to prevent internet security 2010 (security essentials 2010) from getting in.

OK we usually post the prevention speech at the last part of the cleaning process but since you asked, you can read below on how to prevent this things from happening again.

Please take the time to read below to secure your machine and take the necessary steps to keep it Clean smile.gif
How to prevent Malware: by miekiemoes
How to increase PC speed: by miekiemoes


Microsoft has released the latest upgrades to the XP OS platform, which can be referenced HERE
It is critical to stay up to date with the latest upgrades to your Operating System, as this can help prevent future problems.
Windows XP Service Pack 3 (SP3) includes all previously released updates for the operating system.
I recommend that you visit the link above and apply the SP3 patch.

Visit Microsoft's Windows Update Site Frequently
It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Make sure your applications have all of their updates
It is also possible for other programs on your computer to have security vulnerability that can allow malware to infect you. Therefore, it is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.

Install SpywareBlaster
SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware


Practice Safe Internet
One of the main reasons people get infected in the first place is that they are not practicing Safe Internet. You practice Safe Internet when you educate yourself on how to properly use the Internet through the use of security tools and good practice. Knowing how you can get infected and what types of files and sites to avoid will be the most crucial step in keeping your computer malware free. The reality is that the majority of people who are infected with malware are ones who click on things they shouldn't be clicking on. Whether these things are files or sites it doesn't really matter. If something is out to get you, and you click on it, it most likely will. Below are a list of simple precautions to take to keep your computer clean and running securely:
  1. If you receive an attachment from someone you do not know, DO NOT OPEN IT! Simple as that. Opening attachments from people you do not know is a very common method for viruses or worms to infect your computer.
  2. If you receive an attachment and it ends with a .exe, .com, .bat, or .pif do not open the attachment unless you know for a fact that it is clean. For the casual computer user, you will almost never receive a valid attachment of this type.
  3. If you receive an attachment from someone you know, and it looks suspicious, then it probably is. The email could be from someone you know infected with a malware that is trying to infect everyone in their address book.
  4. If you are browsing the Internet and a popup appears saying that you are infected, ignore it!. These are, as far as I am concerned, scams that are being used to scare you into purchasing a piece of software. For an example of these types of popups, or Foistware, you should read this article: Foistware, And how to avoid it.
    There are also programs that disguise themselves as Anti-Spyware or security products but are instead scams. For a list of these types of programs we recommend you visit this link: Rogue/Suspect Anti-Spyware Products & Web Sites
  5. Another tactic to fool you on the web is when a site displays a popup that looks like a normal Windows message or alert. When you click on them, though, they instead bring you to another site that is trying to push a product on you. We suggest that you close these windows by clicking on the X instead of the OK button. Alternatively, you can check to see if it's a real alert by right-clicking on the window. If there is a menu that comes up saying Add to Favorites... you know it's a fake.
  6. Do not go to adult sites. I know this may bother some of you, but the fact is that a large amount of malware is pushed through these types of sites. I am not saying all adult sites do this, but a lot do.
  7. When using an Instant Messaging program be cautious about clicking on links people send to you. It is not uncommon for infections to send a message to everyone in the infected person's contact list that contains a link to an infection. Instead when you receive a message that contains a link, message back to the person asking if it is legit before you click on it.
  8. Stay away from Warez and Crack sites! In addition to the obvious copyright issues, the downloads from these sites are typically overrun with infections.
  9. Be careful of what you download off of web sites and Peer-2-Peer networks. Some sites disguise malware as legitimate software to trick you into installing them and Peer-2-Peer networks are crawling with it. If you want to download a piece of software a from a site, and are not sure if they are legitimate, you can use McAfee Siteadvisor to look up info on the site.
  10. DO NOT INSTALL any software without first reading the End User License Agreement, otherwise known as the EULA. A tactic that some developers use is to offer their software for free, but have spyware and other programs you do not want bundled with it. This is where they make their money. By reading the agreement there is a good chance you can spot this and not install the software.



With regards,
~ Semp smile.gif

~Semp

btn_donate_LG.gif
You can help me continue the fight against malware by making a donation, Thank you.

If I am helping you and I didn't reply within 48 hours... Please send me a private message.
Topics that are not replied within 5 days will be close. Please don't PM asking for support, post on the Forums instead.

Member of UNITE (Unified Network of Instructors and Trained Eliminators) 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users