While runing Combofix, waning appeared: "real time scanner: Norton Internet Security" is running, however I have no Norton AV.
Also while scan was on a warning appered: PEV.cfxxe-Bad Image: c:\windows\system32\SensApi.dll is not a valid windows image"
Same warning reappered when combofix was preparing Log report:
The combofix report follows:
ComboFix 10-09-29.03 - ANALAB 09/30/2010 12:19:19.6.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2036.1528 [GMT 5.5:30]
Running from: c:\documents and settings\ANALAB\Desktop\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
((((((((((((((((((((((((( Files Created from 2010-08-28 to 2010-09-30 )))))))))))))))))))))))))))))))
.
2010-09-29 16:03 . 2010-09-29 16:03 -------- d-----w- c:\windows\system32\wbem\Repository
2010-09-26 15:12 . 2010-09-29 16:02 -------- d-----w- C:\xml-menu
2010-09-22 15:48 . 2010-09-22 15:48 -------- d-----w- C:\found.001
2010-09-22 12:15 . 2010-09-22 12:15 -------- d-----w- c:\documents and settings\ANALAB\Application Data\CyberLink
2010-09-22 11:24 . 2010-09-22 11:24 -------- d-----w- c:\program files\Microsoft SQL Server
2010-09-22 11:18 . 2010-09-22 11:18 -------- d-----w- c:\program files\Microsoft Works
2010-09-22 11:12 . 2010-09-22 11:17 -------- d-----w- c:\windows\SHELLNEW
2010-09-22 11:12 . 2010-09-22 11:12 -------- d-----w- c:\documents and settings\ANALAB\Local Settings\Application Data\Microsoft Help
2010-09-22 11:11 . 2010-09-22 13:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-09-22 11:09 . 2010-09-22 11:09 -------- d-----r- C:\MSOCache
2010-09-18 11:43 . 2010-04-29 10:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-18 11:43 . 2010-04-29 10:09 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-17 05:40 . 2010-09-17 05:40 503808 ----a-w- c:\documents and settings\ANALAB\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-32efe8a6-n\msvcp71.dll
2010-09-17 05:40 . 2010-09-17 05:40 499712 ----a-w- c:\documents and settings\ANALAB\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-32efe8a6-n\jmc.dll
2010-09-17 05:40 . 2010-09-17 05:40 348160 ----a-w- c:\documents and settings\ANALAB\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-32efe8a6-n\msvcr71.dll
2010-09-17 05:40 . 2010-09-17 05:40 -------- d-----w- c:\program files\Common Files\Java
2010-09-17 05:40 . 2010-09-17 05:40 61440 ----a-w- c:\documents and settings\ANALAB\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-22e77ddf-n\decora-sse.dll
2010-09-17 05:40 . 2010-09-17 05:40 12800 ----a-w- c:\documents and settings\ANALAB\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-22e77ddf-n\decora-d3d.dll
2010-09-17 05:40 . 2010-07-16 23:30 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-15 07:05 . 2010-09-25 17:56 63488 ----a-w- c:\documents and settings\ANALAB\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-09-15 07:05 . 2010-09-15 07:05 52224 ----a-w- c:\documents and settings\ANALAB\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-09-15 07:05 . 2010-09-25 17:56 117760 ----a-w- c:\documents and settings\ANALAB\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-09-15 06:41 . 2010-09-15 06:41 -------- d-----w- c:\documents and settings\ANALAB\Application Data\SUPERAntiSpyware.com
2010-09-15 06:41 . 2010-09-15 06:41 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-09-15 06:40 . 2010-09-15 16:31 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-09-12 17:12 . 2010-09-29 16:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-09-12 17:12 . 2010-09-12 17:17 -------- d-----w- c:\program files\Spybot - Search & Destroy
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-30 04:00 . 2010-01-08 13:25 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2010-09-30 04:00 . 2010-01-08 13:25 0 ----a-w- c:\windows\system32\drivers\logiflt.iad
2010-09-29 16:00 . 2010-09-29 16:00 -------- d-----w- c:\program files\BSNL SelfSupport
2010-09-29 16:00 . 2010-09-29 16:00 -------- d-----w- c:\program files\Free Medical Dictionary
2010-09-29 16:00 . 2010-09-29 16:00 -------- d-----w- c:\program files\Rising
2010-09-29 16:00 . 2010-09-29 16:00 -------- d-----w- c:\program files\Skype
2010-09-29 16:00 . 2010-09-29 16:00 -------- d-----w- c:\program files\Panda Security
2010-09-29 16:00 . 2010-09-29 16:00 -------- d-----w- c:\program files\Logia
2010-09-29 16:00 . 2010-09-29 16:00 -------- d-----w- c:\program files\Golden K star
2010-09-29 16:00 . 2010-09-29 16:00 -------- d-----w- c:\program files\Ethalone
2010-09-29 16:00 . 2010-09-29 16:00 -------- d-----w- c:\program files\Driver-Soft
2010-09-27 16:28 . 2010-08-30 12:48 -------- d-----w- c:\documents and settings\ANALAB\Application Data\Logia
2010-09-27 16:21 . 2010-03-24 15:35 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-09-22 12:18 . 2010-01-04 07:47 -------- d-----w- c:\program files\Common Files\InstallShield
2010-09-22 12:18 . 2010-01-04 08:08 -------- d-----w- c:\program files\CyberLink
2010-09-22 12:17 . 2010-01-04 07:47 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-09-22 12:05 . 2010-02-01 12:48 -------- d-----w- c:\program files\Windows Media Connect 2
2010-09-22 11:25 . 2010-02-10 11:49 -------- d-----w- c:\program files\QuickTime
2010-09-22 11:22 . 2010-01-04 07:18 118384 ----a-w- c:\documents and settings\ANALAB\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-09-18 11:43 . 2010-03-24 12:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-17 05:40 . 2010-01-08 17:31 -------- d-----w- c:\program files\Java
2010-09-12 16:45 . 2010-03-24 16:28 -------- d-----w- c:\program files\a-squared Free
2010-09-12 06:29 . 2010-07-12 12:24 -------- d-----w- c:\program files\CCleaner
2010-09-07 16:13 . 2010-01-04 08:46 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-09-07 15:12 . 2010-07-01 07:25 38848 ----a-w- c:\windows\avastSS.scr
2010-09-07 15:11 . 2010-01-07 14:41 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-07 14:52 . 2010-01-07 14:41 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 14:52 . 2010-01-07 14:41 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 14:47 . 2010-01-07 14:41 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 14:47 . 2010-01-07 14:41 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-07 14:47 . 2010-01-07 14:41 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-07 14:47 . 2010-01-07 14:41 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-07 14:46 . 2010-01-07 14:41 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-08-30 05:45 . 2010-08-30 05:16 -------- d-----w- c:\program files\Free RAR Extract Frog
2010-08-30 05:16 . 2010-08-30 05:16 -------- d-----w- c:\documents and settings\ANALAB\Application Data\Philipp Winterberg
2010-07-25 04:25 . 2010-07-25 04:25 2829 ----a-w- c:\documents and settings\ANALAB\Application Data\Microsoft\Internet Explorer\Quick Launch\WS.pif
.
((((((((((((((((((((((((((((( SnapShot_2010-09-12_06.10.43 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-10-26 08:10 . 2006-10-26 08:10 49152 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80KOR.dll
+ 2006-10-26 08:10 . 2006-10-26 08:10 49152 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80JPN.dll
+ 2006-10-26 08:10 . 2006-10-26 08:10 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ITA.dll
+ 2006-10-26 08:10 . 2006-10-26 08:10 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80FRA.dll
+ 2006-10-26 08:10 . 2006-10-26 08:10 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ESP.dll
+ 2006-10-26 08:10 . 2006-10-26 08:10 57344 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ENU.dll
+ 2006-10-26 08:10 . 2006-10-26 08:10 65536 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80DEU.dll
+ 2006-10-26 08:10 . 2006-10-26 08:10 45056 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80CHT.dll
+ 2006-10-26 08:10 . 2006-10-26 08:10 40960 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80CHS.dll
+ 2006-10-26 08:10 . 2006-10-26 08:10 57344 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfcm80u.dll
+ 2006-10-26 08:10 . 2006-10-26 08:10 69632 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfcm80.dll
+ 2006-10-26 08:10 . 2006-10-26 08:10 95744 c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841\ATL80.dll
+ 2006-07-24 05:20 . 2006-07-24 05:20 47920 c:\windows\system32\VBAME.DLL
+ 2010-09-22 11:53 . 2006-09-25 12:28 14640 c:\windows\system32\spmsg.dll
+ 2006-10-26 08:40 . 2006-10-26 08:40 33088 c:\windows\system32\FM20ENU.DLL
+ 2010-09-22 10:54 . 2008-07-25 05:47 77824 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Web.RegularExpressions.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Drawing.Design.dll
+ 2010-09-22 10:55 . 2008-07-25 05:47 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Configuration.Install.dll
+ 2010-09-22 10:55 . 2008-07-25 05:46 12800 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2010-09-22 10:54 . 2008-07-25 05:46 32768 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\Microsoft.Vsa.dll
+ 2010-09-22 10:55 . 2008-07-25 05:46 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\Microsoft.VisualBasic.Vsa.dll
+ 2010-09-22 10:55 . 2008-07-25 05:46 77824 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\Microsoft.Build.Utilities.dll
+ 2010-09-22 10:55 . 2008-07-25 05:46 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\Microsoft.Build.Framework.dll
+ 2010-09-22 10:55 . 2008-07-25 05:47 72192 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\ISymWrapper.dll
+ 2010-09-22 10:55 . 2008-07-25 05:47 77824 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\IEHost.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 69120 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\CustomMarshalers.dll
+ 2010-09-22 10:54 . 2008-07-25 05:46 13312 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\cscompmgd.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 10752 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\Accessibility.dll
+ 2010-09-22 11:13 . 2010-09-22 11:13 48128 c:\windows\Installer\4e83a.msi
+ 2010-09-22 11:19 . 2010-09-22 11:19 35088 c:\windows\Installer\{91120000-0014-0000-0000-0000000FF1CE}\oisicon.exe
+ 2010-09-22 11:19 . 2010-09-22 11:19 18704 c:\windows\Installer\{91120000-0014-0000-0000-0000000FF1CE}\mspicons.exe
+ 2010-09-22 11:19 . 2010-09-22 11:19 20240 c:\windows\Installer\{91120000-0014-0000-0000-0000000FF1CE}\cagicon.exe
+ 2010-09-22 11:19 . 2010-09-22 11:19 65024 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\36dbc4689f7c51e393504230004c9dec\Microsoft.Build.Framework.ni.dll
- 2010-07-04 03:06 . 2010-07-04 03:06 65024 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\36dbc4689f7c51e393504230004c9dec\Microsoft.Build.Framework.ni.dll
- 2010-07-04 03:06 . 2010-07-04 03:06 14336 c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\dfsvc.ni.exe
+ 2010-09-22 11:18 . 2010-09-22 11:18 14336 c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\dfsvc.ni.exe
+ 2010-09-22 11:17 . 2010-09-22 11:17 25600 c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\c2af7cfbb47c077029a2645930b4eeac\Accessibility.ni.dll
- 2010-07-04 03:06 . 2010-07-04 03:06 25600 c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\c2af7cfbb47c077029a2645930b4eeac\Accessibility.ni.dll
+ 2010-09-22 10:54 . 2008-07-25 05:46 7168 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\Microsoft_VsaVb.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 5632 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\Microsoft.VisualC.Dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 6656 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\IIEHost.dll
+ 2010-09-22 10:55 . 2008-07-25 05:47 8192 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\IEExecRemote.dll
+ 2006-10-26 08:10 . 2006-10-26 08:10 626688 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll
+ 2006-10-26 08:10 . 2006-10-26 08:10 548864 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll
+ 2006-10-26 08:10 . 2006-10-26 08:10 479232 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll
+ 2006-10-26 08:15 . 2006-10-26 08:15 293376 c:\windows\system32\WISPTIS.EXE
+ 2010-09-29 15:59 . 2010-09-29 16:04 933636 c:\windows\system32\Restore\rstrlog.dat
+ 2010-09-17 05:40 . 2010-07-16 23:30 153376 c:\windows\system32\javaws.exe
- 2010-01-08 17:32 . 2010-01-08 17:31 145184 c:\windows\system32\javaw.exe
+ 2010-09-17 05:40 . 2010-07-16 23:30 145184 c:\windows\system32\javaw.exe
- 2010-01-08 17:32 . 2010-01-08 17:31 145184 c:\windows\system32\java.exe
+ 2010-09-17 05:40 . 2010-07-16 23:30 145184 c:\windows\system32\java.exe
+ 2006-10-26 08:15 . 2006-10-26 08:15 207360 c:\windows\system32\INKED.DLL
+ 2010-01-04 12:37 . 2010-09-22 11:57 412672 c:\windows\system32\FNTCACHE.DAT
+ 2010-09-22 10:54 . 2008-07-25 05:47 839680 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Web.Services.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 835584 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Web.Mobile.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 261632 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Transactions.dll
+ 2010-09-22 10:55 . 2008-07-25 05:47 114688 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.ServiceProcess.dll
+ 2010-09-22 10:55 . 2008-07-25 05:47 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Security.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 131072 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Runtime.Serialization.Formatters.Soap.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 303104 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Runtime.Remoting.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Messaging.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 372736 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Management.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 113664 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.EnterpriseServices.Wrapper.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.EnterpriseServices.dll
+ 2010-09-22 10:55 . 2008-07-25 05:47 626688 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Drawing.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 188416 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.DirectoryServices.Protocols.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 401408 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.DirectoryServices.dll
+ 2010-09-22 10:55 . 2008-07-25 05:46 970752 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Deployment.dll
+ 2010-09-22 10:55 . 2008-07-25 05:47 745472 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Data.SqlXml.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 486400 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Data.OracleClient.dll
+ 2010-09-22 10:55 . 2008-07-25 05:47 425984 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.configuration.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 110592 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\sysglobl.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 659456 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\Microsoft.VisualBasic.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 372736 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\Microsoft.VisualBasic.Compatibility.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 110592 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2010-09-22 10:54 . 2008-07-25 05:46 749568 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\Microsoft.JScript.dll
+ 2010-09-22 10:54 . 2008-07-25 05:46 655360 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\Microsoft.Build.Tasks.dll
+ 2010-09-22 10:55 . 2008-07-25 05:46 348160 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\Microsoft.Build.Engine.dll
+ 2010-09-22 10:54 . 2008-07-25 05:46 507904 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\AspNetMMCExt.dll
+ 2010-02-24 18:44 . 2010-02-24 18:44 543232 c:\windows\Installer\79ae6.msp
+ 2010-09-22 11:15 . 2010-09-22 11:15 501248 c:\windows\Installer\4e87c.msi
+ 2010-09-22 11:14 . 2010-09-22 11:14 501248 c:\windows\Installer\4e85c.msi
+ 2010-09-22 11:14 . 2010-09-22 11:14 506880 c:\windows\Installer\4e854.msi
+ 2010-09-22 11:13 . 2010-09-22 11:13 516608 c:\windows\Installer\4e84b.msi
+ 2010-09-22 11:13 . 2010-09-22 11:13 513024 c:\windows\Installer\4e842.msi
+ 2010-09-22 11:12 . 2010-09-22 11:12 501248 c:\windows\Installer\4e816.msi
+ 2010-09-17 05:40 . 2010-09-17 05:40 180224 c:\windows\Installer\225b3a.msi
+ 2010-09-22 11:19 . 2010-09-22 11:19 888080 c:\windows\Installer\{91120000-0014-0000-0000-0000000FF1CE}\wordicon.exe
+ 2010-09-22 11:19 . 2010-09-22 11:19 272648 c:\windows\Installer\{91120000-0014-0000-0000-0000000FF1CE}\pubs.exe
+ 2010-09-22 11:19 . 2010-09-22 11:19 922384 c:\windows\Installer\{91120000-0014-0000-0000-0000000FF1CE}\pptico.exe
+ 2010-09-22 11:19 . 2010-09-22 11:19 845584 c:\windows\Installer\{91120000-0014-0000-0000-0000000FF1CE}\outicon.exe
+ 2010-09-22 11:19 . 2010-09-22 11:19 217864 c:\windows\Installer\{91120000-0014-0000-0000-0000000FF1CE}\misc.exe
+ 2010-09-22 11:12 . 2010-09-22 11:12 217864 c:\windows\Installer\{90120000-006E-0409-0000-0000000FF1CE}\misc.exe
+ 2006-07-24 05:20 . 2006-07-24 05:20 125744 c:\windows\Installer\$PatchCache$\Managed\00002119410000000000000000F01FEC\12.0.4518\MSSTDFMT.DLL
+ 2004-11-17 12:03 . 2004-11-17 12:03 450669 c:\windows\Installer\$PatchCache$\Managed\00002109010090400000000000F01FEC\12.0.4518\FP4AWEC.DLL
+ 2004-11-17 12:03 . 2004-11-17 12:03 589880 c:\windows\Installer\$PatchCache$\Managed\00002109010090400000000000F01FEC\12.0.4518\FP4AUTL.DLL
+ 2009-01-05 10:14 . 2009-01-05 10:14 741376 c:\windows\Downloaded Program Files\ipsupd.dll
+ 2010-09-22 11:20 . 2010-09-22 11:20 202240 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\70764208219715962d310336b5959dfa\System.Web.RegularExpressions.ni.dll
- 2010-07-04 03:07 . 2010-07-04 03:07 202240 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\70764208219715962d310336b5959dfa\System.Web.RegularExpressions.ni.dll
- 2010-07-04 03:07 . 2010-07-04 03:07 627200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\12903c3843fe923d1977801ffa3cf26c\System.Transactions.ni.dll
+ 2010-09-22 11:19 . 2010-09-22 11:19 627200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\12903c3843fe923d1977801ffa3cf26c\System.Transactions.ni.dll
+ 2010-09-22 11:19 . 2010-09-22 11:19 212992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\a9e71dda6389403be4db7b567592e3b8\System.ServiceProcess.ni.dll
- 2010-07-04 03:07 . 2010-07-04 03:07 212992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\a9e71dda6389403be4db7b567592e3b8\System.ServiceProcess.ni.dll
+ 2010-09-22 11:19 . 2010-09-22 11:19 676352 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\0418eb6dbffe9b46aa4c989153d6a3b5\System.Security.ni.dll
- 2010-07-04 03:07 . 2010-07-04 03:07 676352 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\0418eb6dbffe9b46aa4c989153d6a3b5\System.Security.ni.dll
- 2010-07-04 03:07 . 2010-07-04 03:07 280064 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\5f9cd5bfebcb94175d440ebab3aa412f\System.EnterpriseServices.Wrapper.dll
+ 2010-09-22 11:19 . 2010-09-22 11:19 280064 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\5f9cd5bfebcb94175d440ebab3aa412f\System.EnterpriseServices.Wrapper.dll
- 2010-07-04 03:07 . 2010-07-04 03:07 627712 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\5f9cd5bfebcb94175d440ebab3aa412f\System.EnterpriseServices.ni.dll
+ 2010-09-22 11:19 . 2010-09-22 11:19 627712 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\5f9cd5bfebcb94175d440ebab3aa412f\System.EnterpriseServices.ni.dll
- 2010-07-03 14:47 . 2010-07-03 14:47 208384 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\5f5d64dd0e7991aaaad2d98ee52afe42\System.Drawing.Design.ni.dll
+ 2010-09-22 10:47 . 2010-09-22 10:47 208384 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\5f5d64dd0e7991aaaad2d98ee52afe42\System.Drawing.Design.ni.dll
+ 2010-09-22 11:19 . 2010-09-22 11:19 455680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\44de75caba2b9711b3d9030a30767f8b\System.DirectoryServices.Protocols.ni.dll
- 2010-07-04 03:07 . 2010-07-04 03:07 455680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\44de75caba2b9711b3d9030a30767f8b\System.DirectoryServices.Protocols.ni.dll
- 2010-07-04 03:06 . 2010-07-04 03:06 970752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb4cb21d14767292e079366a5d3d76cd\System.Configuration.ni.dll
+ 2010-09-22 11:19 . 2010-09-22 11:19 970752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb4cb21d14767292e079366a5d3d76cd\System.Configuration.ni.dll
+ 2010-09-22 11:19 . 2010-09-22 11:19 144384 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\43dceeb2d0601d79af40752fb20283c2\Microsoft.Build.Utilities.ni.dll
- 2010-07-04 03:06 . 2010-07-04 03:06 144384 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\43dceeb2d0601d79af40752fb20283c2\Microsoft.Build.Utilities.ni.dll
+ 2010-09-22 11:18 . 2010-09-22 11:18 838656 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\daf5ff5e06c80eefa80c6fcc79aec963\Microsoft.Build.Engine.ni.dll
- 2010-07-04 03:06 . 2010-07-04 03:06 838656 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\daf5ff5e06c80eefa80c6fcc79aec963\Microsoft.Build.Engine.ni.dll
+ 2010-09-22 11:18 . 2010-09-22 11:18 220672 c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\e148983beeb0f30918b0564849a16456\CustomMarshalers.ni.dll
- 2010-07-04 03:06 . 2010-07-04 03:06 220672 c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\e148983beeb0f30918b0564849a16456\CustomMarshalers.ni.dll
+ 2010-09-22 11:18 . 2010-09-22 11:18 842240 c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\c7ffd8c23e8de4018a88185b3b60631e\AspNetMMCExt.ni.dll
- 2010-07-04 03:06 . 2010-07-04 03:06 842240 c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\c7ffd8c23e8de4018a88185b3b60631e\AspNetMMCExt.ni.dll
+ 2006-10-26 08:10 . 2006-10-26 08:10 1079808 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfc80u.dll
+ 2006-10-26 08:10 . 2006-10-26 08:10 1093632 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfc80.dll
+ 2006-10-26 08:40 . 2006-10-26 08:40 1190688 c:\windows\system32\FM20.DLL
+ 2010-09-22 10:55 . 2008-07-25 05:47 2048000 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.XML.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 5025792 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Windows.Forms.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 5238784 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Web.dll
+ 2010-09-22 10:55 . 2008-07-25 05:47 3149824 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 5062656 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Design.dll
+ 2010-09-22 10:55 . 2008-07-25 05:47 2933248 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\System.Data.dll
+ 2010-09-22 10:54 . 2008-07-25 05:47 4546560 c:\windows\Microsoft.NET\Framework\v2.0.50727\GAC16692\mscorlib.dll
+ 2010-09-22 11:15 . 2010-09-22 11:15 1652736 c:\windows\Installer\4e874.msi
+ 2010-09-22 11:14 . 2010-09-22 11:14 1652736 c:\windows\Installer\4e86c.msi
+ 2010-09-22 11:14 . 2010-09-22 11:14 1652736 c:\windows\Installer\4e864.msi
+ 2010-09-22 11:13 . 2010-09-22 11:13 1640960 c:\windows\Installer\4e82e.msi
+ 2010-09-22 11:13 . 2010-09-22 11:13 2022912 c:\windows\Installer\4e826.msi
+ 2010-09-22 11:12 . 2010-09-22 11:12 1713152 c:\windows\Installer\4e81e.msi
+ 2010-09-22 11:12 . 2010-09-22 11:12 2397184 c:\windows\Installer\4e80e.msi
+ 2010-09-22 11:19 . 2010-09-22 11:19 1172240 c:\windows\Installer\{91120000-0014-0000-0000-0000000FF1CE}\xlicons.exe
+ 2010-09-22 11:19 . 2010-09-22 11:19 1165584 c:\windows\Installer\{91120000-0014-0000-0000-0000000FF1CE}\accicons.exe
+ 2010-09-22 10:46 . 2010-09-22 10:46 7867392 c:\windows\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll
- 2010-07-03 14:46 . 2010-07-03 14:46 7867392 c:\windows\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll
+ 2010-09-22 10:48 . 2010-09-22 10:48 5449728 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\36f3953f24d4f0b767bf172331ad6f3e\System.Xml.ni.dll
- 2010-07-03 14:48 . 2010-07-03 14:48 5449728 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\36f3953f24d4f0b767bf172331ad6f3e\System.Xml.ni.dll
- 2010-07-04 03:07 . 2010-07-04 03:07 1840128 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\1dad08772eb89d48a8a0cfe9b0467eb0\System.Web.Services.ni.dll
+ 2010-09-22 11:20 . 2010-09-22 11:20 1840128 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\1dad08772eb89d48a8a0cfe9b0467eb0\System.Web.Services.ni.dll
+ 2010-09-22 11:20 . 2010-09-22 11:20 2209280 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\e5995a34d44ad5af7d9f335075bded4d\System.Web.Mobile.ni.dll
- 2010-07-04 03:07 . 2010-07-04 03:07 2209280 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\e5995a34d44ad5af7d9f335075bded4d\System.Web.Mobile.ni.dll
- 2010-07-03 14:47 . 2010-07-03 14:47 1587200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll
+ 2010-09-22 10:47 . 2010-09-22 10:47 1587200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll
- 2010-07-04 03:07 . 2010-07-04 03:07 1116672 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\6bcc481030a56c24d5990d199812c594\System.DirectoryServices.ni.dll
+ 2010-09-22 11:19 . 2010-09-22 11:19 1116672 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\6bcc481030a56c24d5990d199812c594\System.DirectoryServices.ni.dll
- 2010-07-04 03:07 . 2010-07-04 03:07 1800704 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\df1efcbac5973454c608890f72eb994d\System.Deployment.ni.dll
+ 2010-09-22 11:19 . 2010-09-22 11:19 1800704 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\df1efcbac5973454c608890f72eb994d\System.Deployment.ni.dll
- 2010-07-03 14:46 . 2010-07-03 14:46 6614016 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\0b40341027c01716cec1dd97592698e0\System.Data.ni.dll
+ 2010-09-22 10:47 . 2010-09-22 10:47 6614016 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\0b40341027c01716cec1dd97592698e0\System.Data.ni.dll
+ 2010-09-22 11:19 . 2010-09-22 11:19 1711104 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\5b3d048d8c003d743ea5e72caf07773a\Microsoft.VisualBasic.ni.dll
- 2010-07-04 03:06 . 2010-07-04 03:06 1711104 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\5b3d048d8c003d743ea5e72caf07773a\Microsoft.VisualBasic.ni.dll
- 2010-07-04 03:06 . 2010-07-04 03:06 1620480 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\152cf75db013f0523933ac45177b4217\Microsoft.Build.Tasks.ni.dll
+ 2010-09-22 11:19 . 2010-09-22 11:19 1620480 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\152cf75db013f0523933ac45177b4217\Microsoft.Build.Tasks.ni.dll
+ 2010-09-22 11:19 . 2010-09-22 11:19 12836352 c:\windows\Installer\4e89f.msi
+ 2010-09-12 06:35 . 2010-09-12 06:35 11485184 c:\windows\assembly\temp\CCHX3E56MN\mscorlib.ni.dll
+ 2010-09-22 10:47 . 2010-09-22 10:47 12428800 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll
- 2010-07-03 14:47 . 2010-07-03 14:47 12428800 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll
- 2010-07-04 03:07 . 2010-07-04 03:07 11791360 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\50ea744ffc3cb7f09b027fd6c5c93b2b\System.Web.ni.dll
+ 2010-09-22 11:19 . 2010-09-22 11:19 11791360 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\50ea744ffc3cb7f09b027fd6c5c93b2b\System.Web.ni.dll
+ 2010-09-22 10:47 . 2010-09-22 10:47 10681344 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\204db7071fb26343b0fd3f3d140c0bf8\System.Design.ni.dll
- 2010-07-03 14:47 . 2010-07-03 14:47 10681344 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\204db7071fb26343b0fd3f3d140c0bf8\System.Design.ni.dll
+ 2010-09-22 10:46 . 2010-09-22 10:46 11485184 c:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll
- 2010-07-03 14:44 . 2010-07-03 14:44 11485184 c:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Magnify"="Magnify.exe" [2004-08-03 72704]
"RunNarrator"="Narrator.exe" [2004-08-03 53760]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^License Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\License Manager.lnk
backup=c:\windows\pss\License Manager.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Lotus QuickStart.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Lotus QuickStart.lnk
backup=c:\windows\pss\Lotus QuickStart.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Lotus SuiteStart 97.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Lotus SuiteStart 97.lnk
backup=c:\windows\pss\Lotus SuiteStart 97.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^ANALAB^Start Menu^Programs^Startup^Logicool . Product Registration.lnk]
path=c:\documents and settings\ANALAB\Start Menu\Programs\Startup\Logicool . Product Registration.lnk
backup=c:\windows\pss\Logicool . Product Registration.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^ANALAB^Start Menu^Programs^Startup^Lotus SmartSuite 97 Registration.lnk]
path=c:\documents and settings\ANALAB\Start Menu\Programs\Startup\Lotus SmartSuite 97 Registration.lnk
backup=c:\windows\pss\Lotus SmartSuite 97 Registration.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^ANALAB^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
path=c:\documents and settings\ANALAB\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
backup=c:\windows\pss\Microsoft Find Fast.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^ANALAB^Start Menu^Programs^Startup^Office Startup.lnk]
path=c:\documents and settings\ANALAB\Start Menu\Programs\Startup\Office Startup.lnk
backup=c:\windows\pss\Office Startup.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2009-12-08 10:29 64032 ----a-w- c:\windows\ALCMTR.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bsnlTrayApp]
2010-03-25 13:54 921088 ------w- c:\program files\BSNL SelfSupport\bin\McciTrayApp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ContactKeeper Birthday reminder]
2005-02-13 05:45 647168 ----a-w- d:\myprog\ContactKeeper\ContactKeeper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeviceDiscovery]
2002-12-02 15:26 40960 ----a-w- c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
2006-10-26 14:18 434528 ----a-w- c:\progra~1\COMMON~1\MICROS~1\DW\DWTRIG20.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eSnips_Downloader]
2010-05-24 11:30 1234432 ----a-w- c:\program files\Logia\eSnipsDownloader\eSnips_Downloader.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-03-18 04:23 159744 ----a-r- c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2002-12-17 06:10 49152 ----a-r- c:\program files\Hewlett-Packard\HP Software Update\hpwuSchd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2003-03-11 08:08 172032 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\hpztsb08.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-03-18 04:23 135168 ----a-r- c:\windows\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2008-02-13 07:32 563984 ----a-w- c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2008-02-13 07:36 2195216 ----a-w- c:\program files\Logicool\Qcam\Qcam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
2006-04-21 10:11 438359 ----a-w- c:\progra~1\BSNLSE~1\SMARTB~1\MotiveSB.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MotiveReportAgent]
2010-03-25 13:56 202240 ----a-w- c:\program files\Common Files\Motive\McciBootStrapper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 06:20 155648 ----a-w- c:\windows\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-03-18 04:23 131072 ----a-r- c:\windows\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2009-12-08 10:29 18789920 ----a-w- c:\windows\RTHDCPL.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 06:14 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2003-12-13 00:50 33792 ----a-w- c:\program files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"CLTNetCnService"=2 (0x2)
"ccSetMgr"=2 (0x2)
"SymAppCore"=2 (0x2)
"Symantec Core LC"=3 (0x3)
"RichVideo"=2 (0x2)
"ose"=3 (0x3)
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"LiveUpdate"=3 (0x3)
"ISPwdSvc"=3 (0x3)
"comHost"=3 (0x3)
"ccEvtMgr"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
"gupdate"=2 (0x2)
"wuauserv"=2 (0x2)
"SysmonLog"=3 (0x3)
"SwPrv"=3 (0x3)
"SENS"=2 (0x2)
"SCardSvr"=3 (0x3)
"RemoteRegistry"=2 (0x2)
"RDSessMgr"=3 (0x3)
"RasAuto"=3 (0x3)
"NtmsSvc"=3 (0x3)
"NtLmSsp"=3 (0x3)
"Netlogon"=3 (0x3)
"MSIServer"=3 (0x3)
"MSDTC"=3 (0x3)
"mnmsrvc"=3 (0x3)
"ERSvc"=2 (0x2)
"COMSysApp"=3 (0x3)
"ClipSrv"=3 (0x3)
"CiSvc"=3 (0x3)
"BITS"=2 (0x2)
"AppMgmt"=3 (0x3)
"dmadmin"=3 (0x3)
"LVSrvLauncher"=2 (0x2)
"LVPrcSrv"=2 (0x2)
"LVCOMSer"=2 (0x2)
"Lavasoft Ad-Aware Service"=2 (0x2)
"a2free"=2 (0x2)
"odserv"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"avast! Mail Scanner"=3 (0x3)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1/7/2010 8:11 PM 165584]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:55 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/11/2010 12:11 AM 67656]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1/7/2010 8:11 PM 17744]
S2 Sentry;Sentry;c:\windows\system32\drivers\sentry.sys [1/24/2010 1:07 PM 9180]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2/16/2010 8:38 AM 1691480]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [?]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - COMHOST
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.rediff.com/
mSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {9FAFB576-6933-4CCC-AB3D-B988EC43D04E} - hxxp://rsdownload.rising.com.cn/rs2010/online/ravolctl.cab
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-LanguageShortcut - c:\program files\CyberLink\PowerDVD\Language\Language.exe
MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\qttask.exe
MSConfigStartUp-RemoteControl - c:\program files\CyberLink\PowerDVD\PDVDServ.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-09-30 12:22
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1547161642-602162358-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(584)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
- - - - - - - > 'explorer.exe'(2596)
c:\windows\system32\browselc.dll
c:\windows\system32\msi.dll
.
Completion time: 2010-09-30 12:25:10
ComboFix-quarantined-files.txt 2010-09-30 06:55
ComboFix2.txt 2010-09-12 06:12
ComboFix3.txt 2010-03-27 14:48
ComboFix4.txt 2010-03-25 09:45
Pre-Run: 57,767,342,080 bytes free
Post-Run: 57,917,681,664 bytes free
- - End Of File - - 6CDCD744F39D2FF5CD101A45E325C6DA