Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Connection reset on windows update, browser redirects/new tabs, and apparent rootkit infection.


  • This topic is locked This topic is locked
26 replies to this topic

#1 Snakebyte

Snakebyte

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:05:17 PM

Posted 31 March 2011 - 06:02 PM

First of all, I'd like to apologize. I jumped the gun and ran ComboFix once my computer started exploding, several times until the thing ran properly, after my usual antivirus program failed to reboot properly to remove the trojans it had detected. I've since run everything requested, but did so afterwards. This is also a fairly old machine, but I've had no insurmountable problems with viruses etc, up to this point. I have no idea what triggered it, and I absolutely cannot afford to do without right now, so any assistance would be sincerely welcomed. Oh, and this is a legitimate version of Windows XP Home Edition, and I have access to the serial key but not the CD. I purchased the computer with the operating system pre-installed and never had the CD, and despite how spurious that sounds it has passed windows verification at every step.

I'm not sure what additional information you require, please just ask if I'm missing anything.

Two successful ComboFix logs are also attached. log.txt comes before COMBOFIX.txt, chronologically. GMER log will be edited in, I have not yet managed to pull a successful run off of it and cannot run it in safe mode. GMER log is now attached.

EDIT: To explain further, there now seems to be something wrong with an svchost.exe process. When left on in normal mode, it will gradually consume all memory and not allow me to open anything or even properly shut down, and eventually crash with a typical XP error report box thing. GMER was not finishing the scan before this occurred. Keeping the task manager open at all times and killing it periodically seems to be helping. Whatever the hell this was also installed some malware 'antivirus' thing all over the place, but I killed that, as well as some malevolent Firefox (my primary browser) addon. I genuinely have no idea where all this came from.
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Owner at 17:57:26.26 on Thu 03/31/2011
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_24
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1364 [GMT -4:00]
.
AV: Norton Internet Security *Disabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *Disabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\libusbd-nt.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Owner\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.ca/
mStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com
BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 9\SnagitBHO.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Snagit: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 9\SnagitIEAddin.dll
TB: {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No File
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [LVCOMS] c:\program files\common files\logitech\qcdriver3\LVCOMS.EXE
mRun: [BigDog305] c:\windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe" -H
mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll"
mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe"
mRun: [Linksys Wireless Manager] "c:\program files\linksys\linksys wireless manager\LinksysWirelessManager.exe" /cm /min /lcid 1033
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [QuickTime Task] "c:\program files\k-lite codec pack\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
StartupFolder: c:\docume~1\owner\startm~1\programs\startup\wordweb.lnk - c:\program files\wordweb\wweb32.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ieee80~1.lnk - c:\program files\ieee 802.11g usb wireless lan\wireless lan\WlanUtil.exe
IE: &WordWeb... - c:\windows\wweb32.dll/lookup.html
IE: Download Link Using Mega Manager... - c:\program files\megaupload\mega manager\mm_file.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\owner\start menu\programs\imvu\Run IMVU.lnk
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {25365FF3-2746-4230-9DA7-163CCA318309} - hxxp://inst.c-wss.com/n019p/EN/install/gtdownlr.cab
DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.0.97.cab
DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9563.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1252010297343
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1252010288859
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - hxxp://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} - hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
Handler: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} -
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp4.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: igfxcui - igfxsrvc.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\jx94mvem.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: Hide Google Options: googleoptions@bruceclay.com - %profile%\extensions\googleoptions@bruceclay.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
.
============= SERVICES / DRIVERS ===============
.
.
=============== Created Last 30 ================
.
.
==================== Find3M ====================
.
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: MDT_MD400BB-00JHA0 rev.05.01C05 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-c
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x8A662439]<<
c:\docume~1\owner\locals~1\temp\catchme.sys
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8a6687d0]; MOV EAX, [0x8a66884c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x8A76BAB8]
3 CLASSPNP[0xF7637FD7] -> nt!IofCallDriver[0x804E37D5] -> [0x8A767868]
\Driver\atapi[0x8A771F38] -> IRP_MJ_CREATE -> 0x8A662439
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\Ide\IdeDeviceP0T0L0-4 -> \??\IDE#DiskMDT_MD400BB-00JHA0______________________05.01C05#5&27d7eb1e&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x8A66227F
user != kernel MBR !!!
sectors 78165358 (+255): user != kernel
Warning: possible TDL4 rootkit infection !
TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.
.
============= FINISH: 18:00:09.87 ===============

Attached Files


Edited by Snakebyte, 31 March 2011 - 06:14 PM.


BC AdBot (Login to Remove)

 


#2 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:05:17 PM

Posted 31 March 2011 - 08:18 PM

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you. :)

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

  • Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
  • Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
  • If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  • In Windows Vista and Windows 7, all tools need to be started by right clicking and selecting Run as Administrator!
  • Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  • Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  • I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
    Because of this, you must reply within three days
    failure to reply will result in the topic being closed!
  • Please do not PM me directly for help. If you have any questions, post them in this topic.
  • Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
    Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________


Posted Image One or more of the identified infections is a backdoor trojan and password stealer.

This type of infection allows hackers to access and remotely control your computer, log keystrokes, steal critical system information, and download and execute files without your knowledge.
If you do any banking or other financial transactions on the PC or if it contains any other sensitive information, then from a clean computer, change all passwords where applicable.
It would also be wise to contact those same financial institutions to appraise them of your situation.


I highly suggest you take a look at the two links provided below:
1. How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud?
2. When should I re-format? How should I reinstall?


We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.



NEXT:



Running TDSSKiller

Please read carefully and follow these steps.
  • Download TDSSKiller and save it to your Desktop.
  • Extract its contents to your desktop.
  • Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.


    Posted Image

  • If an infected file is detected, the default action will be Cure, click on Continue.


    Posted Image

  • If a suspicious file is detected, the default action will be Skip, click on Continue.


    Posted Image

  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.


    Posted Image

  • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.


NEXT:



Running OTL

We need to create an OTL Report
  • Please download OTL from one of the following mirrors:
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Push the Posted Image button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extra.txt <-- Will be minimized


NEXT:


Please provide an update on how things are running in your next reply.

Edited by SweetTech, 31 March 2011 - 08:19 PM.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#3 Snakebyte

Snakebyte
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:05:17 PM

Posted 31 March 2011 - 11:15 PM

Honestly, I did some nosing around and found TDSSKiller prior to your response. It seems to have removed the rootkit. I realize that it's just a disclaimer, but please be aware that reformatting this drive is not an option. I'd absolutely rather have everything on it compromised than lose access to a computer for the next several months, and I have no means of replacing it or buying a new copy of windows or anything like that.

Any other advice you can offer is more than welcomed, but to my inexpert eyes, the thing appears to be in working order.

Also, a few further questions about the small changes that seem to have resulted from running my computer through such harsh paces: I use Pidgin for instant messaging, and its logs are located under C:\Documents and Settings\Owner\Application Data\ (etc.) Previously, I was able to access that from Windows Explorer. I was not, afterwards. I assumed it had reset the Show Hidden Files and Folders option, so I set it back, but now I'm seeing OTHER things I WASN'T before. Is it possible that that, or something else I did, somehow reset the Hidden setting on specific folders?

Secondly, may I safely delete the C:\ComboFix and C:\Qoobox folders, assuming nothing else goes wrong?

EDIT: Also, I have successfully ran Windows Update since.

Logs are as follows:

2011/03/31 19:34:29.0031 3224 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/03/31 19:34:29.0218 3224 ================================================================================
2011/03/31 19:34:29.0218 3224 SystemInfo:
2011/03/31 19:34:29.0218 3224
2011/03/31 19:34:29.0218 3224 OS Version: 5.1.2600 ServicePack: 3.0
2011/03/31 19:34:29.0218 3224 Product type: Workstation
2011/03/31 19:34:29.0218 3224 ComputerName: USER-673CA695B4
2011/03/31 19:34:29.0218 3224 UserName: Owner
2011/03/31 19:34:29.0218 3224 Windows directory: C:\WINDOWS
2011/03/31 19:34:29.0218 3224 System windows directory: C:\WINDOWS
2011/03/31 19:34:29.0218 3224 Processor architecture: Intel x86
2011/03/31 19:34:29.0218 3224 Number of processors: 1
2011/03/31 19:34:29.0218 3224 Page size: 0x1000
2011/03/31 19:34:29.0218 3224 Boot type: Normal boot
2011/03/31 19:34:29.0218 3224 ================================================================================
2011/03/31 19:34:31.0156 3224 Initialize success
2011/03/31 19:34:33.0125 1856 ================================================================================
2011/03/31 19:34:33.0125 1856 Scan started
2011/03/31 19:34:33.0125 1856 Mode: Manual;
2011/03/31 19:34:33.0125 1856 ================================================================================
2011/03/31 19:34:35.0812 1856 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/03/31 19:34:36.0281 1856 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/03/31 19:34:37.0625 1856 aeaudio (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys
2011/03/31 19:34:38.0281 1856 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/03/31 19:34:38.0921 1856 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2011/03/31 19:34:39.0390 1856 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2011/03/31 19:34:43.0031 1856 ASPI (54ab078660e536da72b21a27f56b035b) C:\WINDOWS\System32\DRIVERS\ASPI32.sys
2011/03/31 19:34:43.0453 1856 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/03/31 19:34:44.0109 1856 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/03/31 19:34:45.0000 1856 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/03/31 19:34:45.0453 1856 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/03/31 19:34:45.0890 1856 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/03/31 19:34:46.0546 1856 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/03/31 19:34:47.0015 1856 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/03/31 19:34:47.0906 1856 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/03/31 19:34:48.0343 1856 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/03/31 19:34:48.0781 1856 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/03/31 19:34:50.0750 1856 ctljystk (71007bd2e1e26927fe3e4eb00c0beedf) C:\WINDOWS\system32\DRIVERS\ctljystk.sys
2011/03/31 19:34:51.0312 1856 d347bus (5776322f93cdb91086111f5ffbfda2a0) C:\WINDOWS\system32\DRIVERS\d347bus.sys
2011/03/31 19:34:51.0875 1856 d347prt (b49f79ace459763f4e0380071be9cb45) C:\WINDOWS\system32\Drivers\d347prt.sys
2011/03/31 19:34:53.0062 1856 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/03/31 19:34:53.0859 1856 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/03/31 19:34:54.0375 1856 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/03/31 19:34:54.0859 1856 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/03/31 19:34:55.0359 1856 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/03/31 19:34:56.0250 1856 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/03/31 19:34:56.0765 1856 dtsoftbus01 (b672b993207dd5e2f73fcda8c0427b0f) C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys
2011/03/31 19:34:57.0265 1856 E1000 (854293999e91bf2eb9e786166de4a35f) C:\WINDOWS\system32\DRIVERS\e1000325.sys
2011/03/31 19:34:57.0890 1856 emu10k (01f83e1b5dce05f5cb7d99113ca9e890) C:\WINDOWS\system32\drivers\emu10k1m.sys
2011/03/31 19:34:58.0421 1856 emu10k1 (7ffa171cce6a8bfc774862a578ba39a2) C:\WINDOWS\system32\drivers\ctlfacem.sys
2011/03/31 19:34:58.0859 1856 ENETHUSB (8930f2199bcb0d8ee92103510f895abf) C:\WINDOWS\system32\DRIVERS\enethusb.sys
2011/03/31 19:34:59.0625 1856 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/03/31 19:35:00.0093 1856 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/03/31 19:35:00.0546 1856 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/03/31 19:35:01.0031 1856 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/03/31 19:35:01.0515 1856 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/03/31 19:35:02.0000 1856 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/03/31 19:35:02.0609 1856 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/03/31 19:35:03.0140 1856 gameenum (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys
2011/03/31 19:35:03.0640 1856 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/03/31 19:35:04.0203 1856 hamachi (7929a161f9951d173ca9900fe7067391) C:\WINDOWS\system32\DRIVERS\hamachi.sys
2011/03/31 19:35:04.0828 1856 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/03/31 19:35:05.0859 1856 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/03/31 19:35:07.0171 1856 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/03/31 19:35:07.0968 1856 ialm (44b7d5a4f2bd9fe21aea0bb0bace38c4) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
2011/03/31 19:35:08.0453 1856 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/03/31 19:35:09.0359 1856 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/03/31 19:35:09.0875 1856 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/03/31 19:35:10.0343 1856 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/03/31 19:35:10.0953 1856 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/03/31 19:35:11.0703 1856 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/03/31 19:35:12.0468 1856 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/03/31 19:35:12.0906 1856 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/03/31 19:35:13.0343 1856 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/03/31 19:35:13.0750 1856 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/03/31 19:35:14.0468 1856 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/03/31 19:35:15.0187 1856 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/03/31 19:35:15.0828 1856 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/03/31 19:35:16.0390 1856 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/03/31 19:35:17.0250 1856 LCcfltr (753c8202c18e118b5863f81d4af50588) C:\WINDOWS\system32\drivers\lccfltr.sys
2011/03/31 19:35:18.0187 1856 LHidUsb (85fea0f9ea1a406d00e2bc175f50bfa3) C:\WINDOWS\system32\drivers\lhidusb.sys
2011/03/31 19:35:18.0671 1856 libusb0 (e2f1dcf4a68cc6cf694fbfba1842f4cd) C:\WINDOWS\system32\drivers\libusb0.sys
2011/03/31 19:35:19.0359 1856 LVBulk (eb17c2146d2bafa79c67e35229f4297c) C:\WINDOWS\system32\DRIVERS\LVBulk.sys
2011/03/31 19:35:19.0890 1856 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/03/31 19:35:20.0515 1856 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/03/31 19:35:21.0656 1856 MotioninJoyXFilter (2711ff575578e1c4abb057256fcf9a77) C:\WINDOWS\system32\DRIVERS\MijXfilt.sys
2011/03/31 19:35:22.0640 1856 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/03/31 19:35:23.0562 1856 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/03/31 19:35:24.0671 1856 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/03/31 19:35:26.0015 1856 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/03/31 19:35:26.0687 1856 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/03/31 19:35:27.0265 1856 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/03/31 19:35:27.0718 1856 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/03/31 19:35:28.0375 1856 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/03/31 19:35:28.0843 1856 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/03/31 19:35:29.0390 1856 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/03/31 19:35:30.0062 1856 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/03/31 19:35:30.0828 1856 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/03/31 19:35:31.0453 1856 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/03/31 19:35:32.0078 1856 NAVENG (22d00304e1a8a381c3e765f451424d8c) C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080128.018\NAVENG.SYS
2011/03/31 19:35:32.0750 1856 NAVEX15 (414701fbbc3cba701d5dda2e295d53a0) C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080128.018\NAVEX15.SYS
2011/03/31 19:35:33.0312 1856 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/03/31 19:35:33.0859 1856 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/03/31 19:35:34.0312 1856 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/03/31 19:35:34.0906 1856 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/03/31 19:35:35.0406 1856 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/03/31 19:35:35.0843 1856 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/03/31 19:35:36.0328 1856 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/03/31 19:35:36.0921 1856 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/03/31 19:35:37.0718 1856 nm (1e421a6bcf2203cc61b821ada9de878b) C:\WINDOWS\system32\DRIVERS\NMnt.sys
2011/03/31 19:35:38.0562 1856 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/03/31 19:35:39.0265 1856 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/03/31 19:35:39.0718 1856 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/03/31 19:35:41.0093 1856 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/03/31 19:35:41.0578 1856 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/03/31 19:35:42.0046 1856 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/03/31 19:35:42.0546 1856 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/03/31 19:35:42.0968 1856 Partizan (8d2a7bd923a2c593d2db02ac48f76826) C:\WINDOWS\system32\drivers\Partizan.sys
2011/03/31 19:35:43.0437 1856 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/03/31 19:35:43.0875 1856 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/03/31 19:35:44.0375 1856 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/03/31 19:35:45.0390 1856 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\drivers\PCIIde.sys
2011/03/31 19:35:45.0906 1856 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/03/31 19:35:48.0875 1856 PID_0900_V (20804bb4f81c9869b38310837fa8ed2f) C:\WINDOWS\system32\DRIVERS\LV551AV.sys
2011/03/31 19:35:49.0578 1856 pnarp (ce27fc8bdc54b3ac63d53e2d5f6cc929) C:\WINDOWS\system32\DRIVERS\pnarp.sys
2011/03/31 19:35:50.0046 1856 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/03/31 19:35:50.0671 1856 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/03/31 19:35:51.0093 1856 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/03/31 19:35:51.0562 1856 purendis (f4fd591e86ecb6b5d000c7d6c987416b) C:\WINDOWS\system32\DRIVERS\purendis.sys
2011/03/31 19:35:54.0031 1856 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/03/31 19:35:54.0625 1856 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/03/31 19:35:55.0234 1856 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/03/31 19:35:55.0703 1856 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/03/31 19:35:56.0203 1856 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/03/31 19:35:56.0734 1856 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/03/31 19:35:57.0281 1856 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/03/31 19:35:57.0984 1856 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/03/31 19:35:58.0218 1856 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
2011/03/31 19:35:58.0312 1856 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
2011/03/31 19:35:58.0828 1856 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/03/31 19:35:59.0296 1856 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/03/31 19:35:59.0781 1856 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/03/31 19:36:00.0218 1856 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/03/31 19:36:00.0750 1856 sfman (0b1a5e9cacb5cdd54a2815107bd7c772) C:\WINDOWS\system32\drivers\sfmanm.sys
2011/03/31 19:36:01.0484 1856 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/03/31 19:36:02.0125 1856 smwdm (70b8dd8707dbf6142530c106365df67d) C:\WINDOWS\system32\drivers\smwdm.sys
2011/03/31 19:36:02.0937 1856 SPBBCDrv (cdea9a0a0e547fef4c44ccae35a9b09c) C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys
2011/03/31 19:36:03.0625 1856 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/03/31 19:36:04.0859 1856 sptd (d15da1ba189770d93eea2d7e18f95af9) C:\WINDOWS\system32\Drivers\sptd.sys
2011/03/31 19:36:04.0875 1856 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: d15da1ba189770d93eea2d7e18f95af9
2011/03/31 19:36:04.0890 1856 sptd - detected Locked file (1)
2011/03/31 19:36:05.0609 1856 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/03/31 19:36:06.0453 1856 SRTSP (655773f2f1a3730c6cf20280a49f4ee1) C:\WINDOWS\system32\Drivers\SRTSP.SYS
2011/03/31 19:36:07.0250 1856 SRTSPL (2a0aaf370d4c6574a34ae2f4a0709cae) C:\WINDOWS\system32\Drivers\SRTSPL.SYS
2011/03/31 19:36:07.0906 1856 SRTSPX (3104bdceace2d5710776dd05e6a286c1) C:\WINDOWS\system32\Drivers\SRTSPX.SYS
2011/03/31 19:36:08.0781 1856 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/03/31 19:36:09.0437 1856 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/03/31 19:36:10.0046 1856 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/03/31 19:36:10.0734 1856 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/03/31 19:36:12.0515 1856 SYMDNS (1d8fb1e5d6859d38e3ebca5febc6839f) C:\WINDOWS\System32\Drivers\SYMDNS.SYS
2011/03/31 19:36:13.0187 1856 SymEvent (9e4188476848b2ef86f9c44d5164e724) C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
2011/03/31 19:36:13.0968 1856 SYMFW (91fcddf2cbaf898126ae7dfa5ce570ed) C:\WINDOWS\System32\Drivers\SYMFW.SYS
2011/03/31 19:36:14.0671 1856 SYMIDS (9584e278787ad65e82eec5694f77cb54) C:\WINDOWS\System32\Drivers\SYMIDS.SYS
2011/03/31 19:36:15.0078 1856 SYMIDSCO (5ea7a6b3f5bcfe67097f059aa36ddf60) C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\idsdefs\20080122.002\SymIDSCo.sys
2011/03/31 19:36:15.0843 1856 SYMNDIS (ceadd29bd10fe8775775e5707790dd6c) C:\WINDOWS\System32\Drivers\SYMNDIS.SYS
2011/03/31 19:36:16.0515 1856 SYMREDRV (9181892e5af5df8d2ac3d9d2cea48afd) C:\WINDOWS\System32\Drivers\SYMREDRV.SYS
2011/03/31 19:36:17.0203 1856 SYMTDI (d539f317e6caaa4e08911a84c2180938) C:\WINDOWS\System32\Drivers\SYMTDI.SYS
2011/03/31 19:36:19.0093 1856 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/03/31 19:36:20.0265 1856 tapvpn (27a2c318cd28cfb3eb2200fd96af1e58) C:\WINDOWS\system32\DRIVERS\tapvpn.sys
2011/03/31 19:36:21.0125 1856 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/03/31 19:36:21.0796 1856 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/03/31 19:36:22.0328 1856 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/03/31 19:36:23.0140 1856 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/03/31 19:36:24.0171 1856 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/03/31 19:36:25.0250 1856 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/03/31 19:36:26.0906 1856 USB-100 (c0b1e90ad34662c3d06b157887a1bba1) C:\WINDOWS\system32\DRIVERS\RTL8150.SYS
2011/03/31 19:36:27.0437 1856 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/03/31 19:36:27.0953 1856 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/03/31 19:36:28.0406 1856 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/03/31 19:36:28.0843 1856 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/03/31 19:36:29.0328 1856 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/03/31 19:36:29.0812 1856 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/03/31 19:36:30.0328 1856 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/03/31 19:36:31.0343 1856 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/03/31 19:36:31.0906 1856 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/03/31 19:36:32.0531 1856 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
2011/03/31 19:36:33.0531 1856 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/03/31 19:36:34.0296 1856 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/03/31 19:36:35.0109 1856 WUSB54GCv3 (326c012c7fe573829871fe9c9e41cf9b) C:\WINDOWS\system32\DRIVERS\WUSB54GCv3.sys
2011/03/31 19:36:35.0656 1856 xusb21 (ee9144207ee0211eb5656ba6808ac4a0) C:\WINDOWS\system32\DRIVERS\xusb21.sys
2011/03/31 19:36:36.0437 1856 ZD1211BU(WLAN) (478b4415dfb3a45b6fe61ec781e07d7b) C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys
2011/03/31 19:36:36.0921 1856 ZDPSp50 (00ae175b903d45ed4a62384d3315dc2a) C:\WINDOWS\system32\Drivers\ZDPSp50.sys
2011/03/31 19:36:37.0828 1856 ZSMC0305 (b817df177de2a8d34b19883230dc669c) C:\WINDOWS\system32\Drivers\usbVM305.sys
2011/03/31 19:36:38.0531 1856 \HardDisk2 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/03/31 19:36:38.0640 1856 ================================================================================
2011/03/31 19:36:38.0640 1856 Scan finished
2011/03/31 19:36:38.0640 1856 ================================================================================
2011/03/31 19:36:38.0687 0540 Detected object count: 2
2011/03/31 19:36:54.0609 0540 Locked file(sptd) - User select action: Skip
2011/03/31 19:36:54.0671 0540 \HardDisk2 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot
2011/03/31 19:36:54.0671 0540 \HardDisk2 - ok
2011/03/31 19:36:54.0671 0540 Rootkit.Win32.TDSS.tdl4(\HardDisk2) - User select action: Cure
2011/03/31 19:38:26.0796 0928 Deinitialize success


OTL logfile created on: 4/1/2011 12:03:02 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 54.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 77.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 16.19 Gb Free Space | 43.46% Space Free | Partition Type: NTFS
Drive E: | 55.91 Gb Total Space | 26.33 Gb Free Space | 47.10% Space Free | Partition Type: NTFS
Drive F: | 149.05 Gb Total Space | 15.74 Gb Free Space | 10.56% Space Free | Partition Type: NTFS
Drive I: | 3.64 Gb Total Space | 2.53 Gb Free Space | 69.41% Space Free | Partition Type: FAT32

Computer Name: USER-673CA695B4 | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/03/31 23:54:19 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
PRC - [2011/03/31 01:04:43 | 002,423,752 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
PRC - [2011/03/31 01:01:30 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/01/25 18:42:10 | 000,083,440 | ---- | M] (Google) -- C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe
PRC - [2010/02/16 10:05:08 | 000,045,603 | ---- | M] (The Pidgin developer community) -- C:\Program Files\Pidgin\pidgin.exe
PRC - [2009/10/26 03:33:41 | 000,015,872 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerAssistant.exe
PRC - [2009/02/16 05:44:55 | 001,358,384 | R--- | M] (Linksys, LLC) -- C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
PRC - [2008/12/12 18:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
PRC - [2008/12/12 18:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/11/28 20:51:10 | 000,583,048 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
PRC - [2006/12/25 19:18:03 | 000,214,560 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\realplay.exe
PRC - [2006/12/25 19:17:57 | 000,185,896 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2006/02/21 20:16:46 | 000,479,232 | ---- | M] () -- C:\Program Files\IEEE 802.11g USB Wireless LAN\Wireless LAN\WlanUtil.exe
PRC - [2005/08/29 16:10:34 | 000,019,968 | ---- | M] (Antony Lewis) -- C:\Program Files\WordWeb\wweb32.exe
PRC - [2005/08/05 15:15:04 | 000,061,440 | ---- | M] (Vimicro) -- C:\WINDOWS\VM305_STI.EXE
PRC - [2005/03/09 20:50:18 | 000,018,944 | ---- | M] (http://libusb-win32.sourceforge.net) -- C:\WINDOWS\system32\libusbd-nt.exe
PRC - [2001/08/17 23:36:42 | 000,024,064 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\devldr32.exe


========== Modules (SafeList) ==========

MOD - [2011/03/31 23:54:19 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
MOD - [2010/08/23 12:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2006/09/07 13:18:56 | 000,004,608 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerHook.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (ISPwdSvc)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2008/12/12 18:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
SRV - [2008/02/11 19:58:48 | 001,251,720 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC)
SRV - [2007/11/28 20:51:10 | 000,583,048 | ---- | M] (Symantec Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service)
SRV - [2007/01/09 22:59:32 | 000,108,648 | ---- | M] (Symantec Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (LiveUpdate Notice Ex)
SRV - [2007/01/09 22:59:32 | 000,108,648 | ---- | M] (Symantec Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (CLTNetCnService)
SRV - [2007/01/09 22:59:32 | 000,108,648 | ---- | M] (Symantec Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)
SRV - [2007/01/09 22:59:32 | 000,108,648 | ---- | M] (Symantec Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)
SRV - [2006/09/03 03:54:52 | 000,048,272 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe -- (comHost)
SRV - [2006/09/02 00:33:40 | 000,046,736 | ---- | M] (Symantec Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe -- (SymAppCore)
SRV - [2005/03/09 20:50:18 | 000,018,944 | ---- | M] (http://libusb-win32.sourceforge.net) [Auto | Running] -- C:\WINDOWS\system32\libusbd-nt.exe -- (libusbd)


========== Driver Services (SafeList) ==========

DRV - [2011/01/06 02:44:44 | 000,218,176 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2010/08/13 13:54:00 | 000,058,368 | ---- | M] (MotioninJoy) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MijXfilt.sys -- (MotioninJoyXFilter)
DRV - [2010/05/10 14:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/02/17 14:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009/06/29 02:37:58 | 000,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2008/12/12 18:05:20 | 000,025,264 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\purendis.sys -- (purendis)
DRV - [2008/12/12 18:05:18 | 000,023,984 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\pnarp.sys -- (pnarp)
DRV - [2008/12/04 09:17:15 | 000,627,072 | R--- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WUSB54GCv3.sys -- (WUSB54GCv3)
DRV - [2008/04/13 14:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2008/04/13 14:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2008/02/07 16:01:10 | 000,025,280 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi)
DRV - [2008/01/21 05:00:00 | 000,895,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080128.018\NAVEX15.SYS -- (NAVEX15)
DRV - [2008/01/21 05:00:00 | 000,082,256 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080128.018\NAVENG.SYS -- (NAVENG)
DRV - [2008/01/14 16:37:01 | 000,031,074 | ---- | M] (Greatis Software) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Partizan.sys -- (Partizan)
DRV - [2007/12/09 16:22:58 | 000,123,952 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2007/12/01 00:57:12 | 000,317,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\srtspl.sys -- (SRTSPL)
DRV - [2007/12/01 00:57:12 | 000,279,088 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\srtsp.sys -- (SRTSP)
DRV - [2007/12/01 00:57:12 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srtspx.sys -- (SRTSPX)
DRV - [2007/11/06 12:07:07 | 000,158,064 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080122.002\SymIDSCo.sys -- (SYMIDSCO)
DRV - [2007/10/30 20:55:38 | 000,191,536 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV - [2007/10/30 20:55:34 | 000,027,696 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)
DRV - [2007/10/30 20:55:28 | 000,039,856 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMIDS.SYS -- (SYMIDS)
DRV - [2007/10/30 20:55:24 | 000,035,120 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMNDIS.SYS -- (SYMNDIS)
DRV - [2007/10/30 20:55:20 | 000,145,968 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMFW.SYS -- (SYMFW)
DRV - [2007/10/30 20:55:14 | 000,012,848 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMDNS.SYS -- (SYMDNS)
DRV - [2007/04/14 02:49:32 | 000,418,104 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
DRV - [2006/10/26 04:48:38 | 000,027,136 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tapvpn.sys -- (tapvpn)
DRV - [2006/05/10 15:22:26 | 000,022,842 | ---- | M] (Realtek ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8150.SYS -- (USB-100)
DRV - [2005/11/05 12:23:16 | 000,391,615 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usbVM305.sys -- (ZSMC0305)
DRV - [2005/10/28 11:38:18 | 000,402,432 | ---- | M] (ZyDAS Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZD1211BU.sys -- (ZD1211BU(WLAN)) IEEE 802.11g USB Wireless LAN(WLAN)
DRV - [2005/03/09 20:50:16 | 000,033,792 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\libusb0.sys -- (libusb0)
DRV - [2004/10/25 13:40:58 | 000,017,664 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ZDPSp50.sys -- (ZDPSp50)
DRV - [2004/08/26 18:31:42 | 000,028,857 | ---- | M] (Siemens Subscriber Networks, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\enethusb.sys -- (ENETHUSB)
DRV - [2002/07/17 10:05:10 | 000,016,512 | ---- | M] (Adaptec) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ASPI32.SYS -- (ASPI)
DRV - [2002/06/10 14:24:38 | 000,220,079 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LV551AV.sys -- (PID_0900_V) Logitech ClickSmart 310(PID_0900_V)
DRV - [2002/06/10 14:21:02 | 000,010,254 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVBULK.sys -- (LVBulk)
DRV - [2001/12/17 05:42:00 | 000,039,932 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LHidUsb.sys -- (LHidUsb)
DRV - [2001/12/17 05:42:00 | 000,013,052 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LCcfltr.sys -- (LCcfltr)
DRV - [2001/08/17 13:19:34 | 000,036,480 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sfmanm.sys -- (sfman) Creative SoundFont Manager Driver (WDM)
DRV - [2001/08/17 13:19:28 | 000,006,912 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctlfacem.sys -- (emu10k1) Creative Interface Manager Driver (WDM)
DRV - [2001/08/17 13:19:26 | 000,283,904 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\emu10k1m.sys -- (emu10k) Creative SB Live! (WDM)
DRV - [2001/08/17 13:19:20 | 000,003,712 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctljystk.sys -- (ctljystk)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: googleoptions@bruceclay.com:1.0b8
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24


FF - HKLM\software\mozilla\Mozilla Firefox 3.6.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/31 01:01:43 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/31 01:01:42 | 000,000,000 | ---D | M]

[2008/06/13 05:15:17 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2011/03/31 20:29:18 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jx94mvem.default\extensions
[2010/08/18 19:22:57 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jx94mvem.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/05/11 15:13:40 | 000,000,000 | ---D | M] (Hide Google Options) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jx94mvem.default\extensions\googleoptions@bruceclay.com
[2011/03/31 20:29:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/04/17 13:48:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/09/11 01:35:53 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/12/16 00:50:57 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/03/31 15:26:25 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2009/06/15 20:59:23 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/02/02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/04/30 09:14:27 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Program Files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll

O1 HOSTS File: ([2011/03/31 21:19:06 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\Snagit 9\SnagitBHO.dll (TechSmith Corporation)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Snagit) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 9\SnagitIEAddin.dll (TechSmith Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No CLSID value found.
O4 - HKLM..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE (Vimicro)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [Linksys Wireless Manager] C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe (Linksys, LLC)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\IEEE 802.11g USB Wireless LAN Utility.lnk = C:\Program Files\IEEE 802.11g USB Wireless LAN\Wireless LAN\WlanUtil.exe ()
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe (Antony Lewis)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: &WordWeb... - C:\WINDOWS\wweb32.dll (Antony Lewis)
O9 - Extra Button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab (Checkers Class)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} http://inst.c-wss.com/n019p/EN/install/gtdownlr.cab (Automatic Driver Installation Control)
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.0.97.cab (Reg Error: Key error.)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc3.cab (Office Update Installation Engine)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9563.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1252010297343 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1252010288859 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab (MessengerStatsClient Class)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab (Solitaire Showdown Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/08/26 16:38:03 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010/06/27 02:50:34 | 000,000,000 | ---D | M] - F:\Automatic Loveletter -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (Partizan) - C:\WINDOWS\System32\Partizan.exe (Greatis Software)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/03/31 23:54:17 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/03/31 21:34:53 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/03/31 21:01:18 | 000,000,000 | ---D | C] -- C:\ComboFix
[2011/03/31 19:56:35 | 000,102,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\binlsvc.dll
[2011/03/31 19:56:21 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bdasup.sys
[2011/03/31 19:56:20 | 000,018,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bdaplgin.ax
[2011/03/31 19:56:19 | 000,871,388 | ---- | C] (BCM) -- C:\WINDOWS\System32\dllcache\bcmdm.sys
[2011/03/31 19:56:18 | 000,026,568 | ---- | C] (Broadcom Corporation) -- C:\WINDOWS\System32\dllcache\bcm4e5.sys
[2011/03/31 19:56:17 | 000,054,271 | ---- | C] (Broadcom Corporation) -- C:\WINDOWS\System32\dllcache\bcm42xx5.sys
[2011/03/31 19:56:16 | 000,066,557 | ---- | C] (Broadcom Corporation) -- C:\WINDOWS\System32\dllcache\bcm42u.sys
[2011/03/31 19:56:12 | 000,014,208 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\battc.sys
[2011/03/31 19:56:10 | 000,036,128 | ---- | C] (3Dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\banshee.sys
[2011/03/31 19:56:09 | 000,342,336 | ---- | C] (3Dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\banshee.dll
[2011/03/31 19:56:08 | 000,096,640 | ---- | C] (Broadcom Corporation) -- C:\WINDOWS\System32\dllcache\b57xp32.sys
[2011/03/31 19:56:08 | 000,089,952 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\b1cbase.sys
[2011/03/31 19:56:07 | 000,036,992 | ---- | C] (Aztech Systems Ltd) -- C:\WINDOWS\System32\dllcache\aztw2320.sys
[2011/03/31 19:56:04 | 000,037,568 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\avmwan.sys
[2011/03/31 19:56:03 | 000,144,384 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\avmenum.dll
[2011/03/31 19:56:02 | 000,087,552 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\avmcoxp.dll
[2011/03/31 19:55:57 | 000,013,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\avcstrm.sys
[2011/03/31 19:55:56 | 000,036,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\avcaudio.sys
[2011/03/31 19:55:54 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\avc.sys
[2011/03/31 19:55:35 | 000,070,528 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\dllcache\atiragem.sys
[2011/03/31 19:55:34 | 000,104,832 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\dllcache\atiraged.dll
[2011/03/31 19:55:32 | 000,281,600 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\dllcache\atimtai.sys
[2011/03/31 19:55:31 | 000,075,136 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\dllcache\atimpae.sys
[2011/03/31 19:55:30 | 000,289,664 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\dllcache\atimpab.sys
[2011/03/31 19:55:29 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\atievxx.exe
[2011/03/31 19:55:28 | 000,268,160 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\dllcache\atidvai.dll
[2011/03/31 19:55:27 | 000,137,216 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\dllcache\atidrae.dll
[2011/03/31 19:55:26 | 000,382,592 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\dllcache\atidrab.dll
[2011/03/31 19:55:18 | 000,077,568 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\dllcache\ati.sys
[2011/03/31 19:55:17 | 000,097,354 | ---- | C] (Bay Networks, Inc.) -- C:\WINDOWS\System32\dllcache\aspndis3.sys
[2011/03/31 19:55:17 | 000,096,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ati.dll
[2011/03/31 19:55:14 | 000,022,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\asc3350p.sys
[2011/03/31 19:55:14 | 000,014,848 | ---- | C] (Advanced System Products, Inc.) -- C:\WINDOWS\System32\dllcache\asc3550.sys
[2011/03/31 19:55:13 | 000,026,496 | ---- | C] (Advanced System Products, Inc.) -- C:\WINDOWS\System32\dllcache\asc.sys
[2011/03/31 19:55:01 | 000,006,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\apmbatt.sys
[2011/03/31 19:54:57 | 000,036,224 | ---- | C] (ADMtek Incorporated.) -- C:\WINDOWS\System32\dllcache\an983.sys
[2011/03/31 19:54:57 | 000,012,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\amsint.sys
[2011/03/31 19:54:56 | 000,016,969 | ---- | C] (AmbiCom, Inc.) -- C:\WINDOWS\System32\dllcache\amb8002.sys
[2011/03/31 19:54:55 | 000,005,248 | ---- | C] (Acer Laboratories Inc.) -- C:\WINDOWS\System32\dllcache\aliide.sys
[2011/03/31 19:54:54 | 000,026,624 | ---- | C] (Acer Laboratories Inc.) -- C:\WINDOWS\System32\dllcache\alifir.sys
[2011/03/31 19:54:53 | 000,027,678 | ---- | C] (Acer Laboratories Inc.) -- C:\WINDOWS\System32\dllcache\ali5261.sys
[2011/03/31 19:54:51 | 000,056,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\aic78xx.sys
[2011/03/31 19:54:50 | 000,055,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\aic78u2.sys
[2011/03/31 19:54:49 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\aha154x.sys
[2011/03/31 19:54:38 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\agcgauge.ax
[2011/03/31 19:54:14 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\adpu160m.sys
[2011/03/31 19:54:13 | 000,046,112 | ---- | C] (Adaptec, Inc ) -- C:\WINDOWS\System32\dllcache\adptsf50.sys
[2011/03/31 19:54:10 | 000,747,392 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8830.sys
[2011/03/31 19:54:10 | 000,010,880 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\admjoy.sys
[2011/03/31 19:54:09 | 000,553,984 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8820.sys
[2011/03/31 19:54:07 | 000,584,448 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8810.sys
[2011/03/31 19:54:06 | 000,020,160 | ---- | C] (ADMtek Incorporated) -- C:\WINDOWS\System32\dllcache\adm8511.sys
[2011/03/31 19:54:05 | 000,007,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\adicvls.sys
[2011/03/31 19:54:02 | 000,061,440 | ---- | C] (Color Flatbed Scanner) -- C:\WINDOWS\System32\dllcache\acerscad.dll
[2011/03/31 19:53:56 | 000,084,480 | ---- | C] (VIA Technologies, Inc.) -- C:\WINDOWS\System32\dllcache\ac97via.sys
[2011/03/31 19:53:55 | 000,297,728 | ---- | C] (Silicon Integrated Systems Corp.) -- C:\WINDOWS\System32\dllcache\ac97sis.sys
[2011/03/31 19:53:54 | 000,231,552 | ---- | C] (Acer Laboratories Inc.) -- C:\WINDOWS\System32\dllcache\ac97ali.sys
[2011/03/31 19:53:54 | 000,096,256 | ---- | C] (Intel Corporation) -- C:\WINDOWS\System32\dllcache\ac97intc.sys
[2011/03/31 19:53:53 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\abp480n5.sys
[2011/03/31 19:53:50 | 000,462,848 | ---- | C] (Aureal Inc.) -- C:\WINDOWS\System32\dllcache\a3dapi.dll
[2011/03/31 19:53:44 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\61883.sys
[2011/03/31 19:53:44 | 000,038,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\8514a.dll
[2011/03/31 19:53:43 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\4mmdat.sys
[2011/03/31 19:53:42 | 000,689,216 | ---- | C] (3dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\3dfxvs.dll
[2011/03/31 19:53:42 | 000,148,352 | ---- | C] (3dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\3dfxvsm.sys
[2011/03/31 19:53:41 | 000,762,780 | ---- | C] (3Com, Inc.) -- C:\WINDOWS\System32\dllcache\3cwmcru.sys
[2011/03/31 19:53:40 | 000,053,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\1394bus.sys
[2011/03/31 19:53:40 | 000,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\1394vdbg.sys
[2011/03/31 19:51:31 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\s3legacy.dll
[2011/03/31 19:23:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/03/31 19:23:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/03/31 16:21:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2011/03/31 15:56:26 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/03/31 15:49:45 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/03/31 15:40:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2011/03/31 15:26:22 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011/03/31 15:26:22 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011/03/31 15:26:22 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011/03/31 00:50:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/03/31 00:50:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/03/31 00:40:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{572E5ED0-B6E0-43C8-A99A-A896A0F0FEB0}
[2011/03/20 21:51:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\Blood Pressures
[2011/03/15 02:59:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com
[2011/03/15 02:58:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SUPERAntiSpyware
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/03/31 23:54:19 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/03/31 23:26:00 | 000,000,978 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-602162358-790525478-725345543-1003UA.job
[2011/03/31 23:26:00 | 000,000,926 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-602162358-790525478-725345543-1003Core.job
[2011/03/31 21:27:23 | 000,444,494 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/03/31 21:27:23 | 000,072,370 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/03/31 21:23:36 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/03/31 21:23:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/03/31 21:19:06 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/03/31 20:27:17 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/03/31 20:03:15 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/03/31 19:25:40 | 000,089,088 | ---- | M] () -- C:\mbr.exe
[2011/03/31 12:44:32 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/03/31 00:40:32 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Scipu.dat
[2011/03/31 00:40:32 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Cqayeyeguwi.bin
[2011/03/30 21:27:53 | 008,052,673 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\myzuka.ru_4._Brand_New_-_Deja_Entendu_-_Okay_I_Believe_You_But_My_Tommy_Gun_Don't.mp3
[2011/03/21 17:53:10 | 042,504,101 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Forgotten Realms - Magic of Faerûn.pdf
[2011/03/21 17:42:40 | 007,582,175 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Heroes_Of_Horror.pdf
[2011/03/15 02:58:15 | 000,000,218 | ---- | M] () -- C:\Documents and Settings\Owner\.recently-used.xbel
[2011/03/10 16:55:00 | 006,585,121 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\thekills_DNA.mp3
[2011/03/03 02:04:51 | 017,092,618 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\George Acosta feat Fisher - Love Rain Down (Original Mix)www.clubkings.eu.mp3
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/03/31 19:55:43 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atixbar.sys
[2011/03/31 19:55:42 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ativxbar.sys
[2011/03/31 19:55:41 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ativttxx.sys
[2011/03/31 19:55:39 | 000,017,152 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atitvsnd.sys
[2011/03/31 19:55:39 | 000,009,472 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ativmdcd.sys
[2011/03/31 19:55:38 | 000,017,152 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atitunep.sys
[2011/03/31 19:55:37 | 000,026,880 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atirtsnd.sys
[2011/03/31 19:55:36 | 000,049,920 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atirtcap.sys
[2011/03/31 19:55:33 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atipcxxx.sys
[2011/03/31 19:55:25 | 000,046,464 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atibt829.sys
[2011/03/31 19:25:36 | 000,089,088 | ---- | C] () -- C:\mbr.exe
[2011/03/31 15:56:33 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011/03/31 15:56:30 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/03/31 15:50:26 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/03/31 15:50:26 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/03/31 04:20:09 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/03/31 00:40:32 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Scipu.dat
[2011/03/31 00:40:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Cqayeyeguwi.bin
[2011/03/30 21:25:50 | 008,052,673 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\myzuka.ru_4._Brand_New_-_Deja_Entendu_-_Okay_I_Believe_You_But_My_Tommy_Gun_Don't.mp3
[2011/03/21 17:47:35 | 042,504,101 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Forgotten Realms - Magic of Faerûn.pdf
[2011/03/21 17:40:30 | 007,582,175 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Heroes_Of_Horror.pdf
[2011/03/15 02:58:15 | 000,000,218 | ---- | C] () -- C:\Documents and Settings\Owner\.recently-used.xbel
[2011/03/13 18:33:18 | 006,585,121 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\thekills_DNA.mp3
[2011/03/03 02:02:11 | 017,092,618 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\George Acosta feat Fisher - Love Rain Down (Original Mix)www.clubkings.eu.mp3
[2010/11/09 05:49:33 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2010/09/15 21:00:46 | 000,033,792 | ---- | C] () -- C:\WINDOWS\System32\drivers\libusb0.sys
[2010/08/21 22:12:56 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\housecall.guid.cache
[2010/08/09 23:16:38 | 000,000,127 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2009/09/01 13:25:52 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\cd.dat
[2009/07/28 13:56:33 | 000,015,312 | R--- | C] () -- C:\WINDOWS\System32\RaCoInst.dat
[2009/01/26 03:32:48 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2009/01/23 17:31:25 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2008/06/10 12:40:13 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2008/06/10 12:40:13 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2008/06/10 12:40:13 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2008/06/10 11:46:12 | 000,000,153 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2008/06/03 02:34:45 | 000,000,041 | RHS- | C] () -- C:\Documents and Settings\All Users\Application Data\.zreglib
[2007/11/15 14:02:20 | 000,000,032 | R--- | C] () -- C:\Documents and Settings\All Users\Application Data\ezsid.dat
[2007/09/09 15:32:55 | 001,936,528 | ---- | C] () -- C:\WINDOWS\System32\ltmm15.dll
[2007/07/23 10:03:32 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2007/07/23 10:03:32 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2007/07/23 10:03:32 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2007/07/23 10:03:30 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2007/07/23 10:03:30 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2007/07/23 10:03:30 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2007/07/23 10:03:30 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2007/07/23 10:03:30 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2007/07/23 10:03:30 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2007/05/30 20:17:14 | 000,001,362 | R--- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/04/07 22:35:40 | 000,000,148 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\turing_files.ini
[2007/03/17 20:12:25 | 000,034,308 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2007/01/31 01:56:06 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI
[2006/12/09 16:35:16 | 000,000,050 | ---- | C] () -- C:\WINDOWS\MegaManager.INI
[2006/12/02 21:49:08 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\libssl32.dll
[2006/10/27 23:18:21 | 000,027,805 | ---- | C] () -- C:\WINDOWS\scunin.dat
[2006/10/27 23:13:59 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2006/10/27 23:03:01 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2006/10/27 23:03:01 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2006/10/27 23:03:01 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2006/10/27 23:01:45 | 000,028,366 | ---- | C] () -- C:\WINDOWS\DIIUnin.dat
[2006/10/27 21:49:48 | 000,085,972 | ---- | C] () -- C:\WINDOWS\War3Unin.dat
[2006/10/24 16:54:48 | 000,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
[2006/10/16 22:48:39 | 000,000,044 | ---- | C] () -- C:\WINDOWS\liveup.ini
[2006/10/04 16:57:00 | 000,002,515 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2006/10/04 15:13:49 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2006/10/01 15:44:29 | 000,107,008 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/09/25 19:10:13 | 000,593,938 | ---- | C] () -- C:\WINDOWS\System32\x264vfw.dll
[2006/09/25 19:10:12 | 000,856,064 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2006/09/25 19:10:12 | 000,217,088 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2006/09/25 19:10:11 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2006/09/25 19:10:06 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll
[2006/09/25 15:19:05 | 000,013,344 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/09/24 23:23:26 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\CNMVS3m.DLL
[2006/09/22 20:01:29 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006/09/22 19:35:56 | 000,000,241 | ---- | C] () -- C:\WINDOWS\QSync.INI
[2006/09/22 19:33:57 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\liplW7.dll
[2006/09/22 19:33:57 | 000,290,816 | ---- | C] () -- C:\WINDOWS\System32\liplA6.dll
[2006/09/22 19:33:57 | 000,278,528 | ---- | C] () -- C:\WINDOWS\System32\liplPX.dll
[2006/09/22 19:33:57 | 000,278,528 | ---- | C] () -- C:\WINDOWS\System32\liplP6.dll
[2006/09/22 19:33:57 | 000,278,528 | ---- | C] () -- C:\WINDOWS\System32\liplM6.dll
[2006/09/22 19:33:57 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\lipl.dll
[2006/09/22 19:33:57 | 000,005,187 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2006/09/22 19:33:26 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\MimicICM.dll
[2006/09/22 17:36:48 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/09/22 15:09:24 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\ZyDelReg.exe
[2006/09/22 15:09:23 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\InsDrvZD.dll
[2006/09/22 15:09:23 | 000,015,872 | ---- | C] () -- C:\WINDOWS\System32\InsDrvZD64.DLL
[2006/09/22 15:07:22 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006/09/22 15:07:22 | 001,519,616 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2006/09/22 15:07:22 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006/09/22 15:07:22 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2006/09/22 15:07:22 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006/09/22 15:07:22 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006/09/22 15:07:22 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2006/09/22 15:07:22 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2006/09/22 15:07:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2006/09/22 15:06:58 | 000,573,440 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2006/09/22 15:06:47 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2006/08/26 16:40:49 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2006/08/26 16:34:42 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2006/08/26 11:48:58 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006/08/26 11:47:43 | 000,208,104 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/04 08:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/04 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 08:00:00 | 000,444,494 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/04 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 08:00:00 | 000,072,370 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/04 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 08:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 08:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/04 08:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/04 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/03/18 19:40:32 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2004/03/18 19:40:24 | 000,667,648 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/03/21 15:39:02 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[1999/01/27 13:39:06 | 000,065,024 | ---- | C] () -- C:\WINDOWS\System32\indounin.dll
[1997/06/13 07:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

OTL Extras logfile created on: 4/1/2011 12:03:02 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 54.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 77.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 16.19 Gb Free Space | 43.46% Space Free | Partition Type: NTFS
Drive E: | 55.91 Gb Total Space | 26.33 Gb Free Space | 47.10% Space Free | Partition Type: NTFS
Drive F: | 149.05 Gb Total Space | 15.74 Gb Free Space | 10.56% Space Free | Partition Type: NTFS
Drive I: | 3.64 Gb Total Space | 2.53 Gb Free Space | 69.41% Space Free | Partition Type: FAT32

Computer Name: USER-673CA695B4 | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDBrowse] -- "C:\Program Files\ACD Systems\ACDSee\7.0\ACDSee7.exe" "%1" (ACD Systems Ltd.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusOverride" = 1
"FirewallOverride" = 0
"ANTIVIRUSDISABLENOTIFY" = 0
"UPDATESDISABLENOTIFY" = 0
"FIREWALLDISABLENOTIFY" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\winver.exe" = C:\WINDOWS\system32\winver.exe:*:Enabled:winver -- (Microsoft Corporation)
"C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin -- (Google)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{005F78AF-110D-398A-8430-BE98950A1E22}" = Google Talk Plugin
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java™ 6 Update 24
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1" = MotioninJoy ds3 driver version 0.5.0000
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}" = ccCommon
"{45235788-142C-44BE-8A4D-DDE9A84492E5}" = AGEIA PhysX v7.09.13
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{48185814-A224-447a-81DA-71BD20580E1B}" = Norton Internet Security
"{4843B611-8FCB-4428-8C23-31D0A5EAE164}" = Norton Confidential Browser Component
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{54F6C98F-94A0-421C-B90E-0B6A2A96A9CF}" = Pure Networks Platform
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{581CE7EA-A30D-0000-1211-088635773309}" = IEEE 802.11g USB Wireless LAN Adapter
"{5A24DD7E-7B01-41AC-ADA8-F1776177A3BA}" = Logitech ImageStudio
"{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}" = Norton Internet Security
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.6
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{68DE22FC-F2BD-43D7-AA15-27AC05831403}" = Symantec Real Time Storage Protection Component
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77772678-817F-4401-9301-ED1D01A8DA56}" = SPBBC 32bit
"{8795CBED-55E2-4693-9F14-84EC446935BE}" = SpeechRedist
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics Driver
"{8AD824A5-1CCC-4BB7-82C9-E6FB25CC0479}" = VIMICRO USB PC Camera VC0305
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{984F10FD-11FD-4BED-8163-92DB81E6A825}" = Logitech IM Video Companion
"{9A129ABC-A53A-4209-A21E-D5DEDFB7CCA8}" = Norton Protection Center
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A22A9A6D-5964-49A2-BF9C-31A37300201C}" = SymNet
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1033-7B44-A70800000002}" = Adobe Reader 7.0.8
"{B0625F16-B742-4F75-9FD8-20B47ACC7DE2}" = ACDSee 7.0 PowerPack
"{B440D659-FECA-4BDD-A12B-5C9F05790FF3}" = Snagit 9.1.2
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7C61755-DB48-4003-948F-3D34DB8EAF69}" = MSRedist
"{BEF3EFE7-5159-436D-9BF0-CCC633179EB4}" = EVGA Display Driver
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D353CC51-430D-4C6F-9B7E-52003DA1E05A}" = Norton Confidential Web Protection Component
"{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}" = Norton Internet Security
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{EEC2DAFD-5558-40AC-8E9C-5005C8F810E8}" = Microsoft Plus! for Windows XP
"{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}" = AppCore
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F4DB525F-A986-4249-B98B-42A8066251CA}" = AV
"{F843C6A3-224D-4615-94F8-3C461BD9AEA0}" = Jasc Paint Shop Pro 9
"7-Zip" = 7-Zip 4.42
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"Batch Image Resizer_is1" = Batch Image Resizer 2.87
"CDisplay_is1" = CDisplay 1.8
"DAEMON Tools Lite" = DAEMON Tools Lite
"Diablo II" = Diablo II
"DivX Content Uploader" = DivX Content Uploader
"EfntSSDSL" = Siemens Subscriber Networks SpeedStream DSL
"Foxit Reader" = Foxit Reader
"GTK 2.0" = GTK+ Runtime 2.14.7 rev a (remove only)
"Helix Xiph Plugins 0.7" = Helix Xiph Plugins 0.7
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"IrfanView" = IrfanView (remove only)
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 1.59
"LibUSB-Win32_is1" = LibUSB-Win32-0.1.10.1
"Linksys Wireless Manager" = Linksys Wireless Manager
"Magic Workstation_is1" = Magic Workstation 0.94f
"Messenger Plus! Live" = Messenger Plus! Live
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"mIRC" = mIRC
"Mozilla Firefox (3.6.14)" = Mozilla Firefox (3.6.14)
"MTG GamePack for Magic Workstation_is1" = MTG GamePack for Magic Workstation
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Pidgin" = Pidgin
"PROSet" = Intel® PRO Ethernet Adapter and Software
"RealPlayer 6.0" = RealPlayer
"Starcraft" = Starcraft
"StrongDC++" = StrongDC++ 2.41
"System Requirements Lab" = System Requirements Lab
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"Unlocker" = Unlocker 1.8.8
"UnrealTournament" = Unreal Tournament
"ViewpointMediaPlayer" = Viewpoint Media Player
"VirtuallTek Fighter Factory_is1" = Fighter Factory 1.0.9.2005 + Update Pack 1
"WavePad" = WavePad Sound Editor
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"WIC" = Windows Imaging Component
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WordWeb" = WordWeb

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Warcraft III" = Warcraft III: All Products

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/31/2011 5:44:21 PM | Computer Name = USER-673CA695B4 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 3/31/2011 5:54:22 PM | Computer Name = USER-673CA695B4 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The connection with the server was terminated abnormally

Error - 3/31/2011 5:54:22 PM | Computer Name = USER-673CA695B4 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 3/31/2011 6:04:28 PM | Computer Name = USER-673CA695B4 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The connection with the server was terminated abnormally

Error - 3/31/2011 6:04:29 PM | Computer Name = USER-673CA695B4 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 3/31/2011 6:04:45 PM | Computer Name = USER-673CA695B4 | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting
module shlwapi.dll, version 6.0.2900.5912, fault address 0x0002c4d1.

Error - 3/31/2011 7:11:07 PM | Computer Name = USER-673CA695B4 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The connection with the server was terminated abnormally

Error - 3/31/2011 7:11:08 PM | Computer Name = USER-673CA695B4 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 3/31/2011 7:34:26 PM | Computer Name = USER-673CA695B4 | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5.crt>
with error: The connection with the server was terminated abnormally

Error - 3/31/2011 7:34:26 PM | Computer Name = USER-673CA695B4 | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5.crt>
with error: This network connection does not exist.

[ System Events ]
Error - 3/31/2011 8:33:41 PM | Computer Name = USER-673CA695B4 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 3/31/2011 8:33:42 PM | Computer Name = USER-673CA695B4 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 3/31/2011 8:33:42 PM | Computer Name = USER-673CA695B4 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 3/31/2011 8:33:42 PM | Computer Name = USER-673CA695B4 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 3/31/2011 8:33:42 PM | Computer Name = USER-673CA695B4 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 3/31/2011 8:33:42 PM | Computer Name = USER-673CA695B4 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 3/31/2011 8:33:42 PM | Computer Name = USER-673CA695B4 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 3/31/2011 8:33:42 PM | Computer Name = USER-673CA695B4 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 3/31/2011 8:33:42 PM | Computer Name = USER-673CA695B4 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 3/31/2011 8:33:43 PM | Computer Name = USER-673CA695B4 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126


< End of report >

EDIT: Please explain what on earth
========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Warcraft III" = Warcraft III: All Products

...means?

I most assuredly did not uninstall warcraft and that would not be a good thing at all...

SECOND EDIT: Also, I am somewhat curious what the security risks are, beyond basic disclaimer status.

Edited by Snakebyte, 01 April 2011 - 01:45 AM.


#4 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:05:17 PM

Posted 01 April 2011 - 08:03 AM

Snakebyte,

Is it possible that that, or something else I did, somehow reset the Hidden setting on specific folders?

That is a possibility.

Secondly, may I safely delete the C:\ComboFix and C:\Qoobox folders, assuming nothing else goes wrong?

No, we have a special method for uninstall ComboFix. We will remove the tools we have used later on.

EDIT: Please explain what on earth
========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Warcraft III" = Warcraft III: All Products

...means?

If you didn't install it then I'd go ahead and install it.

____________________________________________________

The main infection that you were infected with is called TDL4.

See the snippet of text below:

2011/03/31 19:36:38.0687 0540 Detected object count: 2
2011/03/31 19:36:54.0609 0540 Locked file(sptd) - User select action: Skip
2011/03/31 19:36:54.0671 0540 \HardDisk2 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot
2011/03/31 19:36:54.0671 0540 \HardDisk2 - ok
2011/03/31 19:36:54.0671 0540 Rootkit.Win32.TDSS.tdl4(\HardDisk2) - User select action: Cure
2011/03/31 19:38:26.0796 0928 Deinitialize success


You can read more about this infection here:

Special thanks to quietman7 for providing the above links.



NEXT:



OTL Fix

We need to run an OTL Fix
  • Please reopen Posted Image on your desktop.
  • Copy and Paste the following code into the Posted Image textbox.

    :Services
    :OTL
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
    O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No CLSID value found.
    O9 - Extra Button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - File not found
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.0.97.cab (Reg Error: Key error.)
    [2011/03/31 00:40:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{572E5ED0-B6E0-43C8-A99A-A896A0F0FEB0}
    [7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
    [2011/03/31 00:40:32 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Scipu.dat
    [2011/03/31 00:40:32 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Cqayeyeguwi.bin
    [2011/03/30 21:27:53 | 008,052,673 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\myzuka.ru_4._Brand_New_-_Deja_Entendu_-_Okay_I_Believe_You_But_My_Tommy_Gun_Don't.mp3
    [2011/03/03 02:04:51 | 017,092,618 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\George Acosta feat Fisher - Love Rain Down (Original Mix)www.clubkings.eu.mp3
    [7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
    [2011/03/31 00:40:32 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Scipu.dat
    [2011/03/31 00:40:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Cqayeyeguwi.bin
    
    :Reg
    
    :Files
    ipconfig /flushdns /c
    :Commands
    [purity]
    [resethosts]
    [CreateRestorePoint]
    [emptytemp]
    [EMPTYFLASH]
    
  • Push Posted Image
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click Posted Image.
  • A report will open. Copy and Paste that report in your next reply.
  • If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.


NEXT:



Running aswMBR.exe

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Posted Image
Click the "Scan" button to start scan


Posted Image
On completion of the scan click save log, save it to your desktop and post in your next reply.



NEXT:



Scanning with MalwareBytes' Anti-Malware

Please download Malwarebytes' Anti-Malware (v1.50) and save it to your desktop.
Download Link 1
Download Link 2Malwarebytes' may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

  • Make sure you are connected to the Internet and double-click on mbam-setup.exe to install the application.
    For instructions with screenshots, please refer to this Guide.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • Malwarebytes will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • Under the Scanner tab, make sure the "Perform Quick Scan" option is selected.
  • Click on the Scan button.
  • When finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box, then click the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked and then click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows the database version and your operating system.
  • Exit Malwarebytes' when done.
Note: If Malwarebytes' encounters a file that is difficult to remove, you will be asked to reboot your computer so it can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally will prevent Malwarebytes' from removing all the malware.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#5 Snakebyte

Snakebyte
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:05:17 PM

Posted 01 April 2011 - 01:01 PM

That is a possibility.


Would that perhaps be because I have changed the settings in the past and they have reverted to default? If not, how else could this occur? Simply trying to further my understanding. :)

If you didn't install it then I'd go ahead and install it.


Eh? It is installed. I am wondering why it appears near something in the registry called 'Uninstall List.' I do not want to uninstall it, and have made no attempts to do so.

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{d9288080-1baa-4bc4-9cf8-a92d743db949}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d9288080-1baa-4bc4-9cf8-a92d743db949}\ not found.
Starting removal of ActiveX control {39B0684F-D7BF-4743-B050-FDC3F48F7E3B}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{39B0684F-D7BF-4743-B050-FDC3F48F7E3B}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{39B0684F-D7BF-4743-B050-FDC3F48F7E3B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{39B0684F-D7BF-4743-B050-FDC3F48F7E3B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{39B0684F-D7BF-4743-B050-FDC3F48F7E3B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{39B0684F-D7BF-4743-B050-FDC3F48F7E3B}\ not found.
C:\Documents and Settings\Owner\Local Settings\Application Data\{572E5ED0-B6E0-43C8-A99A-A896A0F0FEB0}\chrome\content folder moved successfully.
C:\Documents and Settings\Owner\Local Settings\Application Data\{572E5ED0-B6E0-43C8-A99A-A896A0F0FEB0}\chrome folder moved successfully.
C:\Documents and Settings\Owner\Local Settings\Application Data\{572E5ED0-B6E0-43C8-A99A-A896A0F0FEB0} folder moved successfully.
C:\WINDOWS\002974_.tmp deleted successfully.
C:\WINDOWS\B440D659FECA4BDDA12B5C9F05790FF3.TMP\WiseCustomCalla.dll deleted successfully.
C:\WINDOWS\B440D659FECA4BDDA12B5C9F05790FF3.TMP\WiseCustomCalla2.dll deleted successfully.
C:\WINDOWS\B440D659FECA4BDDA12B5C9F05790FF3.TMP folder deleted successfully.
C:\WINDOWS\msdownld.tmp folder deleted successfully.
C:\WINDOWS\S321C4255.tmp deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET4.tmp deleted successfully.
C:\WINDOWS\SET8.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\Scipu.dat moved successfully.
C:\WINDOWS\Cqayeyeguwi.bin moved successfully.
C:\Documents and Settings\Owner\Desktop\myzuka.ru_4._Brand_New_-_Deja_Entendu_-_Okay_I_Believe_You_But_My_Tommy_Gun_Don't.mp3 moved successfully.
C:\Documents and Settings\Owner\Desktop\George Acosta feat Fisher - Love Rain Down (Original Mix)www.clubkings.eu.mp3 moved successfully.
File C:\WINDOWS\Scipu.dat not found.
File C:\WINDOWS\Cqayeyeguwi.bin not found.
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Owner\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Owner\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Restore point Set: OTL Restore Point (0)

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 131206 bytes
->Flash cache emptied: 456 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 3104 bytes

User: Owner
->Temp folder emptied: 417146 bytes
->Temporary Internet Files folder emptied: 520142 bytes
->Java cache emptied: 103046078 bytes
->FireFox cache emptied: 116227242 bytes
->Flash cache emptied: 1773251 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 7084559 bytes

Total Files Cleaned = 219.00 mb


[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 0 bytes

User: Owner
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.22.3 log created on 04012011_132922

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

aswMBR version 0.9.4 Copyright© 2011 AVAST Software
Run date: 2011-04-01 13:42:56
-----------------------------
13:42:56.515 OS Version: Windows 5.1.2600 Service Pack 3
13:42:56.515 Number of processors: 1 586 0x207
13:42:56.515 ComputerName: USER-673CA695B4 UserName: Owner
13:43:04.968 Initialize success
13:43:15.031 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
13:43:15.031 Disk 0 Vendor: MDT_MD400BB-00JHA0 05.01C05 Size: 38166MB BusType: 3
13:43:15.031 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-c
13:43:15.031 Disk 1 Vendor: MAXTOR_6L060J3 A93.0500 Size: 57259MB BusType: 3
13:43:15.031 Disk 2 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP1T1L0-20
13:43:15.031 Disk 2 Vendor: WDC_WD1600JB-00REA0 20.00K20 Size: 152627MB BusType: 3
13:43:15.031 Disk 0 MBR read error
13:43:15.031 Disk 0 MBR scan
13:43:15.031 MBR BIOS signature not found 0
13:43:15.046 Disk 0 scanning sectors +78156225
13:43:15.046 Disk 0 scanning C:\WINDOWS\system32\drivers
13:43:42.593 Service scanning
13:43:48.359 Disk 0 trace - called modules:
13:43:48.468 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys sphz.sys hal.dll >>UNKNOWN [0x8a7c3938]<<
13:43:48.531 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a771ab8]
13:43:48.625 3 CLASSPNP.SYS[f7637fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-4[0x8a78fb00]
13:43:48.625 Scan finished successfully

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6239

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

4/1/2011 2:00:38 PM
mbam-log-2011-04-01 (14-00-38).txt

Scan type: Quick scan
Objects scanned: 141680
Time elapsed: 11 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Typelib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356} (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
c:\WINDOWS\bmbbde2aa0.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
c:\WINDOWS\bmbbde2aa0.xml (Trojan.Vundo) -> Quarantined and deleted successfully.


Also... Why on earth did you tell OTL to move two mp3 files from my desktop...? They certainly shouldn't contain viruses... The download/modification dates are correct.

Secondly, MalwareBytes' AntiMalware is not a program I've come across before. Would you recommend it for casual antivirus use over what I'm currently using? (SUPERAntiSpyware Free Version, which has served me well up until this thing, at least to the best of my knowledge?)

#6 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:05:17 PM

Posted 01 April 2011 - 01:12 PM

If you didn't install it then I'd go ahead and install it.



Eh? It is installed. I am wondering why it appears near something in the registry called 'Uninstall List.' I do not want to uninstall it, and have made no attempts to do so.

I should clarify this. What I meant to say was this: If you didn't install it yourself, then I would go ahead and remove it. I know that sometimes installation files that you download come bundled with tihngs prechecked, and if you don't uncheck them then they will get installed on your computer.

I would recommend MalwareBytes' Anti-Malware to be used as your Anti-Malware program and run scans with it a few times a month.

Please run this scan. Something still doesn't look right in your logs:



Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
  • IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

    Note: If AVG or CA Internet Security Suite is installed, you must remove these programs before using Combofix. If for some reason these applications will not uninstall, try uninstalling with AppRemover by Opswat.
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#7 Snakebyte

Snakebyte
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:05:17 PM

Posted 01 April 2011 - 02:03 PM

No, it is a PC game that I purchased retail and have since registered and legally reinstalled digitally after my discs failed. I do not know why it would appear under my registry 'Uninstall List' and am asking why.

And re-asking regarding clarification about the unhidden files and two moved mp3 files.

ComboFix seemingly froze during the 'producing log' step, I imagine due to it failing to close all programs automatically, and my doing so manually would fix the problem. I had to manually restart.

I will await your input before scanning again, however.

Edited by Snakebyte, 01 April 2011 - 02:03 PM.


#8 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:05:17 PM

Posted 01 April 2011 - 02:22 PM

No, it is a PC game that I purchased retail and have since registered and legally reinstalled digitally after my discs failed. I do not know why it would appear under my registry 'Uninstall List' and am asking why.

I have no idea.

Malware has been known to mess with various settings.

Also... Why on earth did you tell OTL to move two mp3 files from my desktop...? They certainly shouldn't contain viruses... The download/modification dates are correct.

They were removed because they appear to be downloaded from some sort of online site. When people download files from suspicious sites the possibility for the files to be infected is quite high.

Thus I removed them.


See if ComboFIx was able to create the logfile:

Locating ComboFix Log
  • Right click on START on the left end of your Windows toolbar (lower left corner of your screen)
  • Click on Explore
  • Click on Local Disk (C:) in the left-hand window pane
  • Look for ComboFix.txt in the right-hand window pane and right click on it
  • Put your cursor (arrow) on Open With
  • Move your cursor to the new menu that opens and click on Choose Program...
  • Click on Notepad

When file opens, Copy/Paste text here.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#9 Snakebyte

Snakebyte
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:05:17 PM

Posted 01 April 2011 - 02:38 PM

It was not. I checked. However, I ran it again, closing the programs that I should have closed in the first place, and here.

ComboFix 11-04-01.01 - Owner 04/01/2011 15:18:55.7.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1654 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *Disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_Darkness
-------\Service_Engine
-------\Service_sysrest.sys
.
.
((((((((((((((((((((((((( Files Created from 2011-03-01 to 2011-04-01 )))))))))))))))))))))))))))))))
.
.
2011-04-01 17:48 . 2011-04-01 17:48 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2011-04-01 17:47 . 2010-12-20 22:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-01 17:47 . 2011-04-01 17:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-04-01 17:47 . 2011-04-01 17:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-04-01 17:47 . 2010-12-20 22:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-04-01 17:29 . 2011-04-01 17:29 -------- d-----w- C:\_OTL
2011-03-31 23:55 . 2008-04-13 18:46 13696 -c--a-w- c:\windows\system32\dllcache\avcstrm.sys
2011-03-31 23:54 . 2004-08-04 02:31 36224 -c--a-w- c:\windows\system32\dllcache\an983.sys
2011-03-31 23:53 . 2004-08-04 02:32 84480 -c--a-w- c:\windows\system32\dllcache\ac97via.sys
2011-03-31 23:51 . 2001-08-17 18:56 66048 -c--a-w- c:\windows\system32\dllcache\s3legacy.dll
2011-03-31 23:25 . 2011-03-31 23:25 89088 ----a-w- C:\mbr.exe
2011-03-31 19:40 . 2011-03-31 19:40 -------- d-----w- c:\program files\Common Files\Java
2011-03-15 06:59 . 2011-03-15 06:59 -------- d-----w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-09 13:53 . 2004-08-04 12:00 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2004-08-04 12:00 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-03 01:40 . 2010-04-17 17:48 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-02-02 23:19 . 2009-06-16 00:59 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-02-02 07:58 . 2006-08-26 20:32 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2006-08-26 20:32 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2004-08-04 12:00 439296 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2004-08-04 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2011-01-06 06:44 . 2011-01-06 06:44 218176 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-03-31_21.06.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-04-01 18:59 . 2011-04-01 18:59 16384 c:\windows\temp\Perflib_Perfdata_4e8.dat
- 2004-08-04 12:00 . 2011-03-31 20:53 72370 c:\windows\system32\perfc009.dat
+ 2004-08-04 12:00 . 2011-04-01 19:03 72370 c:\windows\system32\perfc009.dat
+ 2004-08-04 12:00 . 2008-04-14 00:12 30749 c:\windows\system32\dllcache\vbajet32.dll
+ 2010-08-10 01:40 . 2007-04-02 16:36 16384 c:\windows\system32\dllcache\tcptsat.dll
+ 2010-08-10 01:40 . 2008-04-14 00:12 32827 c:\windows\system32\dllcache\tcptest.exe
+ 2004-08-04 12:00 . 2008-04-14 00:12 25088 c:\windows\system32\dllcache\slayerxp.dll
+ 2010-08-10 01:40 . 2008-04-14 00:12 16437 c:\windows\system32\dllcache\shtml.exe
+ 2010-08-10 01:40 . 2008-04-14 00:12 20536 c:\windows\system32\dllcache\shtml.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 65024 c:\windows\system32\dllcache\shimeng.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 77312 c:\windows\system32\dllcache\sdbinst.exe
+ 2004-08-04 12:00 . 2008-04-14 00:12 64000 c:\windows\system32\dllcache\samlib.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 84992 c:\windows\system32\dllcache\olepro32.dll
+ 2006-08-26 20:34 . 2008-04-14 00:12 65536 c:\windows\system32\dllcache\oledb32r.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 20511 c:\windows\system32\dllcache\odtext32.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 20510 c:\windows\system32\dllcache\odpdx32.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 20510 c:\windows\system32\dllcache\odfox32.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 20510 c:\windows\system32\dllcache\odexl32.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 20511 c:\windows\system32\dllcache\oddbse32.dll
+ 2004-08-04 12:00 . 2008-04-14 00:10 53279 c:\windows\system32\dllcache\odbcji32.dll
+ 2004-08-04 12:00 . 2008-04-13 17:26 94208 c:\windows\system32\dllcache\odbcint.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 65536 c:\windows\system32\dllcache\odbccu32.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 65536 c:\windows\system32\dllcache\odbccr32.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 69632 c:\windows\system32\dllcache\odbcconf.exe
+ 2004-08-04 12:00 . 2008-04-14 00:12 32768 c:\windows\system32\dllcache\odbcad32.exe
+ 2004-08-04 12:00 . 2008-04-14 00:12 16384 c:\windows\system32\dllcache\odbc32gt.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 67584 c:\windows\system32\dllcache\ocmanage.dll
+ 2004-08-04 12:00 . 2008-04-13 19:20 91520 c:\windows\system32\dllcache\ndiswan.sys
+ 2006-08-26 20:34 . 2008-04-14 00:12 24576 c:\windows\system32\dllcache\msxactps.dll
+ 2004-08-04 12:00 . 2008-04-13 18:30 61440 c:\windows\system32\dllcache\msvcrt40.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 36864 c:\windows\system32\dllcache\msdfmap.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 20480 c:\windows\system32\dllcache\msdatt.dll
+ 2006-08-26 20:34 . 2008-04-13 17:26 16384 c:\windows\system32\dllcache\msdasqlr.dll
+ 2006-08-26 20:34 . 2008-04-13 17:25 16384 c:\windows\system32\dllcache\msdaremr.dll
+ 2006-08-26 20:34 . 2008-04-13 17:25 16384 c:\windows\system32\dllcache\msdaprsr.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 77824 c:\windows\system32\dllcache\msdaosp.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 36864 c:\windows\system32\dllcache\mscpxl32.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 57344 c:\windows\system32\dllcache\msadrh15.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 57344 c:\windows\system32\dllcache\msador15.dll
+ 2006-08-26 20:34 . 2008-04-13 17:26 24576 c:\windows\system32\dllcache\msader15.dll
+ 2006-08-26 20:34 . 2008-04-13 17:25 24576 c:\windows\system32\dllcache\msaddsr.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 53248 c:\windows\system32\dllcache\msadcs.dll
+ 2006-08-26 20:34 . 2008-04-13 17:25 16384 c:\windows\system32\dllcache\msadcor.dll
+ 2006-08-26 20:34 . 2008-04-13 17:25 16384 c:\windows\system32\dllcache\msadcfr.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 61440 c:\windows\system32\dllcache\msadcf.dll
+ 2006-08-26 20:34 . 2008-04-13 17:25 20480 c:\windows\system32\dllcache\msadcer.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 22528 c:\windows\system32\dllcache\mfcsubs.dll
+ 2004-08-04 12:00 . 2008-04-13 19:19 75264 c:\windows\system32\dllcache\ipsec.sys
+ 2004-08-04 12:00 . 2008-04-14 00:11 36921 c:\windows\system32\dllcache\imeshare.dll
+ 2010-08-10 01:39 . 2008-04-14 00:12 20538 c:\windows\system32\dllcache\fpremadm.exe
+ 2010-08-10 01:39 . 2008-04-14 00:11 20541 c:\windows\system32\dllcache\fpexedll.dll
+ 2010-08-10 01:39 . 2008-04-14 00:12 15120 c:\windows\system32\dllcache\fp98sadm.exe
+ 2010-08-10 01:39 . 2008-04-14 00:11 49212 c:\windows\system32\dllcache\fp4awebs.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 32826 c:\windows\system32\dllcache\fp4avss.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 41020 c:\windows\system32\dllcache\fp4avnb.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 49210 c:\windows\system32\dllcache\fp4areg.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 82035 c:\windows\system32\dllcache\fp4anscp.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 16384 c:\windows\system32\dllcache\ds32gt.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 32768 c:\windows\system32\dllcache\dispex.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 39936 c:\windows\system32\dllcache\dimsroam.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 19456 c:\windows\system32\dllcache\dimsntfy.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 62464 c:\windows\system32\dllcache\cryptsvc.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 64512 c:\windows\system32\dllcache\cryptnet.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 53760 c:\windows\system32\dllcache\cryptext.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 33280 c:\windows\system32\dllcache\cryptdll.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 74752 c:\windows\system32\dllcache\cryptdlg.dll
+ 2004-08-04 12:00 . 2008-04-14 00:09 16896 c:\windows\system32\dllcache\cfgmgr32.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 17408 c:\windows\system32\dllcache\bidispl.dll
+ 2011-03-31 23:56 . 2008-04-13 18:46 11776 c:\windows\system32\dllcache\bdasup.sys
+ 2011-03-31 23:56 . 2001-08-17 16:11 26568 c:\windows\system32\dllcache\bcm4e5.sys
+ 2011-03-31 23:56 . 2001-08-17 16:11 54271 c:\windows\system32\dllcache\bcm42xx5.sys
+ 2011-03-31 23:56 . 2001-08-17 16:11 66557 c:\windows\system32\dllcache\bcm42u.sys
+ 2011-03-31 23:56 . 2008-04-13 18:36 14208 c:\windows\system32\dllcache\battc.sys
+ 2004-08-04 12:00 . 2008-04-14 00:11 29184 c:\windows\system32\dllcache\batmeter.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 52736 c:\windows\system32\dllcache\basesrv.dll
+ 2011-03-31 23:56 . 2001-08-17 16:48 36128 c:\windows\system32\dllcache\banshee.sys
+ 2011-03-31 23:56 . 2001-08-17 16:11 96640 c:\windows\system32\dllcache\b57xp32.sys
+ 2011-03-31 23:56 . 2001-08-17 16:13 89952 c:\windows\system32\dllcache\b1cbase.sys
+ 2011-03-31 23:56 . 2001-08-17 16:19 36992 c:\windows\system32\dllcache\aztw2320.sys
+ 2011-03-31 23:56 . 2001-08-17 16:13 37568 c:\windows\system32\dllcache\avmwan.sys
+ 2011-03-31 23:56 . 2001-08-18 02:36 87552 c:\windows\system32\dllcache\avmcoxp.dll
- 2009-11-27 16:07 . 2009-11-27 16:07 84992 c:\windows\system32\dllcache\avifil32.dll
+ 2004-08-04 12:00 . 2009-11-27 16:07 84992 c:\windows\system32\dllcache\avifil32.dll
+ 2011-03-31 23:55 . 2001-08-17 18:01 36096 c:\windows\system32\dllcache\avcaudio.sys
+ 2011-03-31 23:55 . 2008-04-13 18:46 38912 c:\windows\system32\dllcache\avc.sys
+ 2004-08-04 12:00 . 2008-04-14 00:12 11264 c:\windows\system32\dllcache\autolfn.exe
+ 2004-08-04 12:00 . 2008-04-14 00:11 62464 c:\windows\system32\dllcache\authz.dll
+ 2010-08-10 01:39 . 2008-04-14 00:12 16439 c:\windows\system32\dllcache\author.exe
+ 2010-08-10 01:39 . 2008-04-14 00:11 20540 c:\windows\system32\dllcache\author.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 14336 c:\windows\system32\dllcache\auditusr.exe
+ 2004-08-04 12:00 . 2008-04-14 00:11 42496 c:\windows\system32\dllcache\audiosrv.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 17279 c:\windows\system32\dllcache\atv10nt5.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 14143 c:\windows\system32\dllcache\atv06nt5.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 25471 c:\windows\system32\dllcache\atv04nt5.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 11359 c:\windows\system32\dllcache\atv02nt5.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 21183 c:\windows\system32\dllcache\atv01nt5.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 12288 c:\windows\system32\dllcache\attrib.exe
+ 2004-08-04 12:00 . 2008-04-14 00:11 30208 c:\windows\system32\dllcache\atmlib.dll
+ 2004-08-04 12:00 . 2008-04-13 18:51 55808 c:\windows\system32\dllcache\atmlane.sys
+ 2004-08-04 12:00 . 2008-04-13 18:51 59904 c:\windows\system32\dllcache\atmarpc.sys
+ 2004-08-04 12:00 . 2008-04-14 00:12 11264 c:\windows\system32\dllcache\atmadm.exe
+ 2011-03-31 23:55 . 2001-08-17 16:49 23552 c:\windows\system32\dllcache\atixbar.sys
+ 2011-03-31 23:55 . 2001-08-17 16:49 26624 c:\windows\system32\dllcache\ativxbar.sys
+ 2011-03-31 23:55 . 2001-08-17 16:49 19456 c:\windows\system32\dllcache\ativttxx.sys
+ 2010-08-10 01:39 . 2008-04-14 00:11 32768 c:\windows\system32\dllcache\ativtmxx.dll
+ 2011-03-31 23:55 . 2001-08-17 16:49 17152 c:\windows\system32\dllcache\atitvsnd.sys
+ 2011-03-31 23:55 . 2001-08-17 16:49 17152 c:\windows\system32\dllcache\atitunep.sys
+ 2011-03-31 23:55 . 2001-08-17 16:49 26880 c:\windows\system32\dllcache\atirtsnd.sys
+ 2011-03-31 23:55 . 2001-08-17 16:49 49920 c:\windows\system32\dllcache\atirtcap.sys
+ 2011-03-31 23:55 . 2001-08-17 16:48 70528 c:\windows\system32\dllcache\atiragem.sys
+ 2011-03-31 23:55 . 2001-08-17 16:49 10240 c:\windows\system32\dllcache\atipcxxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 63488 c:\windows\system32\dllcache\atinxsxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 31744 c:\windows\system32\dllcache\atinxbxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 73216 c:\windows\system32\dllcache\atintuxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 13824 c:\windows\system32\dllcache\atinttxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 28672 c:\windows\system32\dllcache\atinsnxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 52224 c:\windows\system32\dllcache\atinraxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 14336 c:\windows\system32\dllcache\atinpdxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 13824 c:\windows\system32\dllcache\atinmdxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 57856 c:\windows\system32\dllcache\atinbtxx.sys
+ 2011-03-31 23:55 . 2001-08-17 16:49 75136 c:\windows\system32\dllcache\atimpae.sys
+ 2011-03-31 23:55 . 2001-08-18 02:36 37376 c:\windows\system32\dllcache\atievxx.exe
+ 2011-03-31 23:55 . 2001-08-17 16:49 46464 c:\windows\system32\dllcache\atibt829.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 34735 c:\windows\system32\dllcache\ati1xsxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 29455 c:\windows\system32\dllcache\ati1xbxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 36463 c:\windows\system32\dllcache\ati1tuxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 21343 c:\windows\system32\dllcache\ati1ttxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 26367 c:\windows\system32\dllcache\ati1snxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 63663 c:\windows\system32\dllcache\ati1rvxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 30671 c:\windows\system32\dllcache\ati1raxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 12047 c:\windows\system32\dllcache\ati1pdxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 11615 c:\windows\system32\dllcache\ati1mdxx.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 56623 c:\windows\system32\dllcache\ati1btxx.sys
+ 2011-03-31 23:55 . 2001-08-17 17:57 77568 c:\windows\system32\dllcache\ati.sys
+ 2011-03-31 23:55 . 2001-08-17 18:55 96128 c:\windows\system32\dllcache\ati.dll
+ 2004-08-04 12:00 . 2008-04-13 18:40 96512 c:\windows\system32\dllcache\atapi.sys
+ 2004-08-04 12:00 . 2008-04-14 00:12 25088 c:\windows\system32\dllcache\at.exe
+ 2004-08-04 12:00 . 2008-04-13 18:57 14336 c:\windows\system32\dllcache\asyncmac.sys
+ 2004-08-04 12:00 . 2010-03-05 14:37 65536 c:\windows\system32\dllcache\asycfilt.dll
- 2010-03-05 14:37 . 2010-03-05 14:37 65536 c:\windows\system32\dllcache\asycfilt.dll
+ 2011-03-31 23:55 . 2001-08-17 16:12 97354 c:\windows\system32\dllcache\aspndis3.sys
+ 2011-03-31 23:55 . 2001-08-17 17:51 14848 c:\windows\system32\dllcache\asc3550.sys
+ 2011-03-31 23:55 . 2001-08-17 17:52 22400 c:\windows\system32\dllcache\asc3350p.sys
+ 2011-03-31 23:55 . 2001-08-17 17:52 26496 c:\windows\system32\dllcache\asc.sys
+ 2004-08-03 22:58 . 2008-04-13 18:51 60800 c:\windows\system32\dllcache\arp1394.sys
+ 2004-08-04 12:00 . 2008-04-14 00:11 70656 c:\windows\system32\dllcache\amstream.dll
+ 2011-03-31 23:54 . 2001-08-17 17:52 12032 c:\windows\system32\dllcache\amsint.sys
+ 2004-08-03 22:59 . 2008-04-13 18:31 37760 c:\windows\system32\dllcache\amdk7.sys
+ 2004-08-03 22:59 . 2008-04-13 18:31 37376 c:\windows\system32\dllcache\amdk6.sys
+ 2010-08-10 01:39 . 2008-04-13 18:36 43008 c:\windows\system32\dllcache\amdagp.sys
+ 2011-03-31 23:54 . 2001-08-17 16:11 16969 c:\windows\system32\dllcache\amb8002.sys
+ 2004-08-04 12:00 . 2008-04-14 00:11 17408 c:\windows\system32\dllcache\alrsvc.dll
+ 2010-08-10 01:39 . 2008-04-13 18:36 42752 c:\windows\system32\dllcache\alim1541.sys
+ 2011-03-31 23:54 . 2001-08-17 17:49 26624 c:\windows\system32\dllcache\alifir.sys
+ 2011-03-31 23:54 . 2001-08-17 16:11 27678 c:\windows\system32\dllcache\ali5261.sys
+ 2004-08-04 12:00 . 2008-04-14 00:12 44544 c:\windows\system32\dllcache\alg.exe
+ 2011-03-31 23:54 . 2001-08-17 18:07 56960 c:\windows\system32\dllcache\aic78xx.sys
+ 2011-03-31 23:54 . 2001-08-17 18:07 55168 c:\windows\system32\dllcache\aic78u2.sys
+ 2004-08-04 12:00 . 2008-04-14 00:12 98304 c:\windows\system32\dllcache\ahui.exe
+ 2011-03-31 23:54 . 2001-08-17 17:52 12800 c:\windows\system32\dllcache\aha154x.sys
+ 2004-08-04 12:00 . 2008-04-14 00:11 24064 c:\windows\system32\dllcache\agtintl.dll
+ 2004-08-04 12:00 . 2007-04-02 18:26 20480 c:\windows\system32\dllcache\agt0c0a.dll
+ 2004-08-04 12:00 . 2007-04-02 18:26 20992 c:\windows\system32\dllcache\agt0816.dll
+ 2010-08-10 01:39 . 2007-04-02 18:26 19456 c:\windows\system32\dllcache\agt0804.dll
+ 2006-08-26 15:48 . 2007-04-02 18:26 19456 c:\windows\system32\dllcache\agt041f.dll
+ 2004-08-04 12:00 . 2007-04-02 18:26 19456 c:\windows\system32\dllcache\agt041d.dll
+ 2006-08-26 15:48 . 2007-04-02 18:26 19456 c:\windows\system32\dllcache\agt0419.dll
+ 2004-08-04 12:00 . 2007-04-02 18:26 20480 c:\windows\system32\dllcache\agt0416.dll
+ 2006-08-26 15:48 . 2007-04-02 18:26 19456 c:\windows\system32\dllcache\agt0415.dll
+ 2004-08-04 12:00 . 2007-04-02 18:26 19456 c:\windows\system32\dllcache\agt0414.dll
+ 2004-08-04 12:00 . 2007-04-02 18:26 20992 c:\windows\system32\dllcache\agt0413.dll
+ 2010-08-10 01:39 . 2007-04-02 18:26 19456 c:\windows\system32\dllcache\agt0412.dll
+ 2010-08-10 01:39 . 2007-04-02 18:26 19456 c:\windows\system32\dllcache\agt0411.dll
+ 2004-08-04 12:00 . 2007-04-02 18:26 20992 c:\windows\system32\dllcache\agt0410.dll
+ 2006-08-26 15:48 . 2007-04-02 18:26 19968 c:\windows\system32\dllcache\agt040e.dll
+ 2010-08-10 01:39 . 2007-04-02 18:26 19456 c:\windows\system32\dllcache\agt040d.dll
+ 2004-08-04 12:00 . 2007-04-02 18:26 21504 c:\windows\system32\dllcache\agt040c.dll
+ 2004-08-04 12:00 . 2007-04-02 18:26 19456 c:\windows\system32\dllcache\agt040b.dll
+ 2004-08-04 12:00 . 2008-04-13 17:32 19968 c:\windows\system32\dllcache\agt0409.dll
+ 2006-08-26 15:48 . 2007-04-02 18:26 22016 c:\windows\system32\dllcache\agt0408.dll
+ 2004-08-04 12:00 . 2007-04-02 18:26 21504 c:\windows\system32\dllcache\agt0407.dll
+ 2004-08-04 12:00 . 2007-04-02 18:25 19456 c:\windows\system32\dllcache\agt0406.dll
+ 2006-08-26 15:48 . 2007-04-02 18:25 19456 c:\windows\system32\dllcache\agt0405.dll
+ 2010-08-10 01:39 . 2007-04-02 18:25 19456 c:\windows\system32\dllcache\agt0404.dll
+ 2010-08-10 01:39 . 2007-04-02 18:25 19456 c:\windows\system32\dllcache\agt0401.dll
+ 2010-08-10 01:39 . 2008-04-13 18:36 44928 c:\windows\system32\dllcache\agpcpq.sys
+ 2006-09-22 19:04 . 2008-04-13 18:36 42368 c:\windows\system32\dllcache\agp440.sys
+ 2004-08-04 12:00 . 2008-04-14 00:11 44032 c:\windows\system32\dllcache\agentsr.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 24064 c:\windows\system32\dllcache\agentpsh.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 49152 c:\windows\system32\dllcache\agentmpx.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 57344 c:\windows\system32\dllcache\agentdpv.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 42496 c:\windows\system32\dllcache\agentdp2.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 24064 c:\windows\system32\dllcache\agentanm.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 68096 c:\windows\system32\dllcache\adsmsext.dll
+ 2011-03-31 23:54 . 2001-08-17 16:11 46112 c:\windows\system32\dllcache\adptsf50.sys
+ 2011-03-31 23:54 . 2004-08-04 02:32 10880 c:\windows\system32\dllcache\admjoy.sys
+ 2010-08-10 01:39 . 2008-04-14 00:12 16439 c:\windows\system32\dllcache\admin.exe
+ 2010-08-10 01:39 . 2008-04-14 00:11 20540 c:\windows\system32\dllcache\admin.dll
+ 2011-03-31 23:54 . 2001-08-17 16:11 20160 c:\windows\system32\dllcache\adm8511.sys
+ 2004-08-04 12:00 . 2008-04-14 00:11 98304 c:\windows\system32\dllcache\actxprxy.dll
+ 2004-08-04 12:00 . 2004-08-04 12:00 11648 c:\windows\system32\dllcache\acpiec.sys
+ 2011-03-31 23:54 . 2001-08-18 02:36 61440 c:\windows\system32\dllcache\acerscad.dll
+ 2011-03-31 23:53 . 2001-08-17 16:20 96256 c:\windows\system32\dllcache\ac97intc.sys
+ 2011-03-31 23:53 . 2001-08-17 17:52 23552 c:\windows\system32\dllcache\abp480n5.sys
+ 2011-03-31 23:53 . 2001-08-17 18:55 38400 c:\windows\system32\dllcache\8514a.dll
+ 2011-03-31 23:53 . 2008-04-13 18:46 48128 c:\windows\system32\dllcache\61883.sys
+ 2011-03-31 23:53 . 2008-04-13 18:40 12288 c:\windows\system32\dllcache\4mmdat.sys
+ 2011-03-31 23:53 . 2001-08-17 18:06 11264 c:\windows\system32\dllcache\1394vdbg.sys
+ 2011-03-31 23:53 . 2008-04-13 18:46 53376 c:\windows\system32\dllcache\1394bus.sys
+ 2004-08-04 12:00 . 2008-04-14 00:12 5120 c:\windows\system32\dllcache\sfc.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 4096 c:\windows\system32\dllcache\msdaurl.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 4096 c:\windows\system32\dllcache\msdasc.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 4096 c:\windows\system32\dllcache\msdaer.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 4096 c:\windows\system32\dllcache\msdaenum.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 4096 c:\windows\system32\dllcache\msdadc.dll
+ 2010-08-10 01:39 . 2008-04-14 00:09 6144 c:\windows\system32\dllcache\kbdpash.dll
+ 2010-08-10 01:39 . 2008-04-14 00:09 6144 c:\windows\system32\dllcache\kbdnepr.dll
+ 2010-08-10 01:39 . 2008-04-14 00:09 6144 c:\windows\system32\dllcache\kbdiultn.dll
+ 2010-08-10 01:39 . 2008-04-14 00:09 6144 c:\windows\system32\dllcache\kbdbhc.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 7168 c:\windows\system32\dllcache\bitsprx4.dll
+ 2006-08-26 20:35 . 2008-04-14 00:11 8192 c:\windows\system32\dllcache\bitsprx2.dll
+ 2006-08-26 15:48 . 2008-04-14 00:11 8704 c:\windows\system32\dllcache\batt.dll
+ 2006-08-26 15:51 . 2001-08-17 13:59 3072 c:\windows\system32\dllcache\audstub.sys
+ 2011-03-31 23:55 . 2001-08-17 16:49 9472 c:\windows\system32\dllcache\ativmdcd.sys
+ 2011-03-31 23:55 . 2001-08-17 17:47 6272 c:\windows\system32\dllcache\apmbatt.sys
+ 2011-03-31 23:54 . 2001-08-17 17:51 5248 c:\windows\system32\dllcache\aliide.sys
+ 2010-08-10 01:39 . 2008-04-14 00:11 3775 c:\windows\system32\dllcache\adv11nt5.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 3711 c:\windows\system32\dllcache\adv09nt5.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 3135 c:\windows\system32\dllcache\adv08nt5.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 3647 c:\windows\system32\dllcache\adv07nt5.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 3615 c:\windows\system32\dllcache\adv05nt5.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 3967 c:\windows\system32\dllcache\adv02nt5.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 4255 c:\windows\system32\dllcache\adv01nt5.dll
+ 2011-03-31 23:54 . 2001-08-17 17:53 7424 c:\windows\system32\dllcache\adicvls.sys
+ 2004-08-04 12:00 . 2008-04-14 00:12 4096 c:\windows\system32\dllcache\actmovie.exe
- 2004-08-04 12:00 . 2008-04-14 00:12 135168 c:\windows\system32\shsvcs.dll
+ 2004-08-04 12:00 . 2009-07-27 23:17 135168 c:\windows\system32\shsvcs.dll
+ 2004-08-04 12:00 . 2011-04-01 19:03 444494 c:\windows\system32\perfh009.dat
- 2004-08-04 12:00 . 2011-03-31 20:54 444494 c:\windows\system32\perfh009.dat
- 2009-12-24 06:59 . 2009-12-24 06:59 177664 c:\windows\system32\dllcache\wintrust.dll
+ 2004-08-04 12:00 . 2009-12-24 06:59 177664 c:\windows\system32\dllcache\wintrust.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 507904 c:\windows\system32\dllcache\winlogon.exe
+ 2004-08-04 12:00 . 2008-04-14 00:12 123392 c:\windows\system32\dllcache\umpnpmgr.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 106496 c:\windows\system32\dllcache\sysocmgr.exe
+ 2009-07-27 23:17 . 2009-07-27 23:17 135168 c:\windows\system32\dllcache\shsvcs.dll
+ 2004-08-04 12:00 . 2008-04-14 09:42 985088 c:\windows\system32\dllcache\setupapi.dll
+ 2004-08-04 12:00 . 2008-05-09 10:53 172032 c:\windows\system32\dllcache\scrrun.dll
- 2008-05-09 10:53 . 2008-05-09 10:53 172032 c:\windows\system32\dllcache\scrrun.dll
- 2008-05-09 10:53 . 2008-05-09 10:53 180224 c:\windows\system32\dllcache\scrobj.dll
+ 2004-08-04 12:00 . 2008-05-09 10:53 180224 c:\windows\system32\dllcache\scrobj.dll
- 2008-12-05 06:54 . 2010-06-30 12:31 149504 c:\windows\system32\dllcache\schannel.dll
+ 2004-08-04 12:00 . 2010-06-30 12:31 149504 c:\windows\system32\dllcache\schannel.dll
+ 2011-02-09 13:53 . 2011-02-09 13:53 270848 c:\windows\system32\dllcache\sbe.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 415744 c:\windows\system32\dllcache\samsrv.dll
+ 2004-08-04 12:00 . 2008-04-13 17:37 208384 c:\windows\system32\dllcache\rsaenh.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 433664 c:\windows\system32\dllcache\riched20.dll
+ 2006-08-26 20:34 . 2008-04-14 00:12 487424 c:\windows\system32\dllcache\oledb32.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 551936 c:\windows\system32\dllcache\oleaut32.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 147456 c:\windows\system32\dllcache\odbctrac.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 278559 c:\windows\system32\dllcache\odbcjt32.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 106496 c:\windows\system32\dllcache\odbccp32.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 135168 c:\windows\system32\dllcache\odbcconf.dll
- 2010-11-09 14:52 . 2010-11-09 14:52 249856 c:\windows\system32\dllcache\odbc32.dll
+ 2004-08-04 12:00 . 2010-11-09 14:52 249856 c:\windows\system32\dllcache\odbc32.dll
+ 2004-08-04 12:00 . 2008-04-13 19:15 574976 c:\windows\system32\dllcache\ntfs.sys
+ 2004-08-04 12:00 . 2010-12-09 15:15 718336 c:\windows\system32\dllcache\ntdll.dll
- 2010-08-10 01:05 . 2010-12-09 15:15 718336 c:\windows\system32\dllcache\ntdll.dll
+ 2004-08-04 12:00 . 2008-10-15 16:34 337408 c:\windows\system32\dllcache\netapi32.dll
- 2010-08-10 00:57 . 2008-10-15 16:34 337408 c:\windows\system32\dllcache\netapi32.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 343040 c:\windows\system32\dllcache\msvcrt.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 143360 c:\windows\system32\dllcache\msorcl32.dll
+ 2006-08-26 20:34 . 2010-11-09 14:52 102400 c:\windows\system32\dllcache\msjro.dll
- 2010-11-09 14:52 . 2010-11-09 14:52 102400 c:\windows\system32\dllcache\msjro.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 151583 c:\windows\system32\dllcache\msjint40.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 315392 c:\windows\system32\dllcache\msdasql.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 118784 c:\windows\system32\dllcache\msdarem.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 204800 c:\windows\system32\dllcache\msdaps.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 200704 c:\windows\system32\dllcache\msdaprst.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 233472 c:\windows\system32\dllcache\msdaora.dll
+ 2006-08-26 20:34 . 2010-11-09 14:52 200704 c:\windows\system32\dllcache\msadox.dll
- 2010-11-09 14:52 . 2010-11-09 14:52 200704 c:\windows\system32\dllcache\msadox.dll
+ 2006-08-26 20:34 . 2010-11-09 14:52 180224 c:\windows\system32\dllcache\msadomd.dll
- 2010-11-09 14:52 . 2010-11-09 14:52 180224 c:\windows\system32\dllcache\msadomd.dll
- 2010-11-09 14:52 . 2010-11-09 14:52 536576 c:\windows\system32\dllcache\msado15.dll
+ 2006-08-26 20:34 . 2010-11-09 14:52 536576 c:\windows\system32\dllcache\msado15.dll
+ 2006-08-26 20:34 . 2008-04-14 00:11 155648 c:\windows\system32\dllcache\msadds.dll
+ 2006-08-26 20:34 . 2010-11-09 14:52 143360 c:\windows\system32\dllcache\msadco.dll
- 2010-11-09 14:52 . 2010-11-09 14:52 143360 c:\windows\system32\dllcache\msadco.dll
+ 2004-08-04 12:00 . 2010-09-18 06:53 974848 c:\windows\system32\dllcache\mfc42.dll
- 2010-10-14 05:04 . 2010-09-18 06:53 974848 c:\windows\system32\dllcache\mfc42.dll
- 2010-10-14 05:04 . 2010-09-18 06:53 953856 c:\windows\system32\dllcache\mfc40u.dll
+ 2004-08-04 12:00 . 2010-09-18 06:53 953856 c:\windows\system32\dllcache\mfc40u.dll
+ 2004-08-04 12:00 . 2010-12-20 17:26 730112 c:\windows\system32\dllcache\lsasrv.dll
- 2010-08-10 01:05 . 2010-12-20 17:26 730112 c:\windows\system32\dllcache\lsasrv.dll
+ 2011-01-27 11:57 . 2011-01-27 11:57 677888 c:\windows\system32\dllcache\lhmstsc.exe
- 2009-03-21 14:06 . 2009-03-21 14:06 989696 c:\windows\system32\dllcache\kernel32.dll
+ 2004-08-04 12:00 . 2009-03-21 14:06 989696 c:\windows\system32\dllcache\kernel32.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 138240 c:\windows\system32\dllcache\itss.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 155136 c:\windows\system32\dllcache\itircl.dll
+ 2010-08-10 01:39 . 2007-04-02 16:36 208896 c:\windows\system32\dllcache\fpmmcsat.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 598071 c:\windows\system32\dllcache\fpmmc.dll
+ 2010-08-10 01:39 . 2008-04-14 00:12 188494 c:\windows\system32\dllcache\fpcount.exe
+ 2010-08-10 01:39 . 2008-04-14 00:12 109840 c:\windows\system32\dllcache\fp98swin.exe
+ 2010-08-10 01:39 . 2008-04-14 00:11 876653 c:\windows\system32\dllcache\fp4awel.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 102509 c:\windows\system32\dllcache\fp4atxt.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 147513 c:\windows\system32\dllcache\fp4apws.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 184435 c:\windows\system32\dllcache\fp4amsft.dll
+ 2004-08-04 12:00 . 2008-04-13 19:14 143744 c:\windows\system32\dllcache\fastfat.sys
+ 2004-08-04 12:00 . 2008-04-14 00:11 380445 c:\windows\system32\dllcache\expsrv.dll
+ 2011-02-09 13:53 . 2011-02-09 13:53 186880 c:\windows\system32\dllcache\encdec.dll
+ 2004-08-04 12:00 . 2008-04-13 17:37 138752 c:\windows\system32\dllcache\dssenh.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 512512 c:\windows\system32\dllcache\cryptui.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 599040 c:\windows\system32\dllcache\crypt32.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 252928 c:\windows\system32\dllcache\compatui.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 276992 c:\windows\system32\dllcache\comdlg32.dll
- 2010-10-14 05:04 . 2010-08-23 16:12 617472 c:\windows\system32\dllcache\comctl32.dll
+ 2004-08-04 12:00 . 2010-08-23 16:12 617472 c:\windows\system32\dllcache\comctl32.dll
+ 2010-08-10 01:39 . 2008-04-14 00:12 188480 c:\windows\system32\dllcache\cfgwiz.exe
+ 2011-03-31 23:56 . 2001-08-18 02:36 102400 c:\windows\system32\dllcache\binlsvc.dll
+ 2011-03-31 23:56 . 2001-08-17 17:28 871388 c:\windows\system32\dllcache\bcmdm.sys
+ 2011-03-31 23:56 . 2001-08-17 18:56 342336 c:\windows\system32\dllcache\banshee.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 233472 c:\windows\system32\dllcache\azroles.dll
+ 2011-03-31 23:56 . 2001-08-18 02:36 144384 c:\windows\system32\dllcache\avmenum.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 580608 c:\windows\system32\dllcache\autofmt.exe
+ 2004-08-04 12:00 . 2008-04-14 00:12 602624 c:\windows\system32\dllcache\autoconv.exe
+ 2004-08-04 12:00 . 2008-04-14 00:12 588800 c:\windows\system32\dllcache\autochk.exe
+ 2010-08-10 01:39 . 2008-04-14 00:11 516768 c:\windows\system32\dllcache\ativvaxx.dll
+ 2011-03-31 23:55 . 2001-08-17 18:56 104832 c:\windows\system32\dllcache\atiraged.dll
+ 2010-08-10 01:39 . 2004-08-04 02:29 104960 c:\windows\system32\dllcache\atinrvxx.sys
+ 2011-03-31 23:55 . 2001-08-17 16:48 281600 c:\windows\system32\dllcache\atimtai.sys
+ 2011-03-31 23:55 . 2001-08-17 16:48 289664 c:\windows\system32\dllcache\atimpab.sys
+ 2011-03-31 23:55 . 2001-08-17 18:56 268160 c:\windows\system32\dllcache\atidvai.dll
+ 2011-03-31 23:55 . 2001-08-17 18:56 137216 c:\windows\system32\dllcache\atidrae.dll
+ 2011-03-31 23:55 . 2001-08-17 18:55 382592 c:\windows\system32\dllcache\atidrab.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 870784 c:\windows\system32\dllcache\ati3d1ag.dll
+ 2010-08-10 01:39 . 2004-08-04 02:29 701440 c:\windows\system32\dllcache\ati2mtag.sys
+ 2010-08-10 01:39 . 2004-08-04 02:29 327040 c:\windows\system32\dllcache\ati2mtaa.sys
+ 2010-08-10 01:39 . 2008-04-14 00:11 201728 c:\windows\system32\dllcache\ati2dvag.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 377984 c:\windows\system32\dllcache\ati2dvaa.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 229376 c:\windows\system32\dllcache\ati2cqag.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 331264 c:\windows\system32\dllcache\aqueue.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 125952 c:\windows\system32\dllcache\apphelp.dll
+ 2004-08-04 12:00 . 2008-04-14 00:12 256512 c:\windows\system32\dllcache\agentsvr.exe
+ 2004-08-04 12:00 . 2008-04-14 00:11 214016 c:\windows\system32\dllcache\agentctl.dll
+ 2004-08-04 12:00 . 2008-08-14 10:04 138496 c:\windows\system32\dllcache\afd.sys
- 2008-06-20 11:40 . 2008-08-14 10:04 138496 c:\windows\system32\dllcache\afd.sys
+ 2006-08-28 17:16 . 2008-04-13 16:39 142592 c:\windows\system32\dllcache\aec.sys
+ 2004-08-04 12:00 . 2009-02-09 12:10 617472 c:\windows\system32\dllcache\advapi32.dll
- 2010-08-10 01:05 . 2009-02-09 12:10 617472 c:\windows\system32\dllcache\advapi32.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 263680 c:\windows\system32\dllcache\adsnt.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 143360 c:\windows\system32\dllcache\adsldpc.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 175616 c:\windows\system32\dllcache\adsldp.dll
+ 2011-03-31 23:54 . 2001-08-17 18:07 101888 c:\windows\system32\dllcache\adpu160m.sys
+ 2011-03-31 23:54 . 2001-08-17 16:19 747392 c:\windows\system32\dllcache\adm8830.sys
+ 2011-03-31 23:54 . 2001-08-17 16:19 553984 c:\windows\system32\dllcache\adm8820.sys
+ 2011-03-31 23:54 . 2001-08-17 16:19 584448 c:\windows\system32\dllcache\adm8810.sys
+ 2004-08-04 12:00 . 2008-04-14 00:11 116224 c:\windows\system32\dllcache\acxtrnal.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 193536 c:\windows\system32\dllcache\activeds.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 245248 c:\windows\system32\dllcache\acspecfc.dll
+ 2004-08-04 12:00 . 2008-04-13 18:36 187776 c:\windows\system32\dllcache\acpi.sys
+ 2004-08-04 12:00 . 2008-04-14 00:11 115712 c:\windows\system32\dllcache\aclui.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 141312 c:\windows\system32\dllcache\aclua.dll
+ 2004-08-04 12:00 . 2009-11-21 15:51 471552 c:\windows\system32\dllcache\aclayers.dll
- 2010-08-10 01:12 . 2009-11-21 15:51 471552 c:\windows\system32\dllcache\aclayers.dll
+ 2006-08-26 20:32 . 2008-04-14 00:12 184320 c:\windows\system32\dllcache\accwiz.exe
+ 2011-03-31 23:53 . 2001-08-17 16:20 297728 c:\windows\system32\dllcache\ac97sis.sys
+ 2011-03-31 23:53 . 2004-08-04 02:32 231552 c:\windows\system32\dllcache\ac97ali.sys
+ 2010-08-10 01:39 . 2008-04-14 00:11 136192 c:\windows\system32\dllcache\aaclient.dll
+ 2011-03-31 23:53 . 2001-08-18 02:36 462848 c:\windows\system32\dllcache\a3dapi.dll
+ 2004-08-04 12:00 . 2010-02-12 04:33 100864 c:\windows\system32\dllcache\6to4svc.dll
- 2010-02-12 04:33 . 2010-02-12 04:33 100864 c:\windows\system32\dllcache\6to4svc.dll
+ 2011-03-31 23:53 . 2001-08-17 16:48 148352 c:\windows\system32\dllcache\3dfxvsm.sys
+ 2011-03-31 23:53 . 2001-08-17 18:55 689216 c:\windows\system32\dllcache\3dfxvs.dll
+ 2011-03-31 23:53 . 2001-08-17 17:28 762780 c:\windows\system32\dllcache\3cwmcru.sys
+ 2004-08-04 12:00 . 2008-04-14 00:12 1614848 c:\windows\system32\dllcache\sfcfiles.dll
+ 2004-08-04 12:00 . 2010-07-16 12:05 1288192 c:\windows\system32\dllcache\ole32.dll
- 2010-07-16 12:05 . 2010-07-16 12:05 1288192 c:\windows\system32\dllcache\ole32.dll
- 2010-08-10 01:05 . 2010-12-09 13:38 2192768 c:\windows\system32\dllcache\ntoskrnl.exe
+ 2004-08-04 12:00 . 2010-12-09 13:38 2192768 c:\windows\system32\dllcache\ntoskrnl.exe
+ 2011-02-02 07:58 . 2011-02-02 07:58 2067456 c:\windows\system32\dllcache\lhmstscx.dll
+ 2010-08-10 01:39 . 2008-04-14 00:11 1888992 c:\windows\system32\dllcache\ati3duag.dll
+ 2004-08-04 12:00 . 2008-04-14 00:11 1852928 c:\windows\system32\dllcache\acgenral.dll
+ 2006-08-28 17:00 . 2011-03-02 23:56 37943240 c:\windows\system32\MRT.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-03-31 2423752]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-10-19 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-10-19 126976]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]
"BigDog305"="c:\windows\VM305_STI.EXE" [2005-08-05 61440]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 115816]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2009-10-26 15872]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-29 583048]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]
"Linksys Wireless Manager"="c:\program files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" [2009-02-16 1358384]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-12-25 185896]
"QuickTime Task"="c:\program files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2010-03-18 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
c:\documents and settings\Owner\Start Menu\Programs\Startup\
WordWeb.lnk - c:\program files\WordWeb\wweb32.exe [2007-2-3 19968]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
IEEE 802.11g USB Wireless LAN Utility.lnk - c:\program files\IEEE 802.11g USB Wireless LAN\Wireless LAN\WlanUtil.exe [2006-9-22 479232]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=APTRRNTm.dll
"wave"=APTRRNTm.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0Partizan
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2009-04-24 03:16 203928 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2011-01-05 09:09 1305408 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-12-26 04:21 136176 ----atw- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2010-04-17 03:12 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2006-04-28 19:47 86016 ----a-w- c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2007-11-12 20:48 21760296 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2011-01-23 19:39 1242448 ----a-w- e:\steam\Steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2006-12-25 23:17 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WordWeb]
2005-08-29 20:10 19968 ----a-w- c:\program files\WordWeb\wweb32.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SymAppCore"=2 (0x2)
"Symantec Core LC"=3 (0x3)
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"ISPwdSvc"=3 (0x3)
"HssTrayService"=3 (0x3)
"HssSrv"=2 (0x2)
"HotspotShieldService"=2 (0x2)
"Darkness"=2 (0x2)
"CLTNetCnService"=2 (0x2)
"ccSetMgr"=2 (0x2)
"ccEvtMgr"=2 (0x2)
"idsvc"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"nwiz"=nwiz.exe /install
"LogitechImageStudioTray"=c:\program files\Logitech\ImageStudio\LogiTray.exe
"LogitechGalleryRepair"=c:\program files\Logitech\ImageStudio\ISStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\winver.exe"=
"c:\\Documents and Settings\\Owner\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11/23/2006 9:46 PM 721904]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [1/6/2011 2:44 AM 218176]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe --> system32\libusbd-nt.exe [?]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [9/15/2010 9:00 PM 33792]
R3 WUSB54GCv3;Compact Wireless-G USB Network Adapter;c:\windows\system32\drivers\WUSB54GCv3.sys [7/28/2009 1:56 PM 627072]
R3 ZSMC0305;VIMICRO USB PC Camera VC0305;c:\windows\system32\drivers\usbVM305.sys [10/5/2006 7:58 PM 391615]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [12/21/2007 7:58 PM 16512]
S3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\drivers\MijXfilt.sys [9/15/2010 8:37 PM 58368]
S3 Normandy;Normandy SR2; [x]
S3 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys [1/14/2008 4:37 PM 31074]
S3 PID_0900_V;Logitech ClickSmart 310(PID_0900_V);c:\windows\system32\drivers\LV551AV.sys [9/22/2006 7:33 PM 220079]
S3 USB-100;Realtek RTL8150 USB 10/100 Fast Ethernet Adapter;c:\windows\system32\drivers\RTL8150.SYS [8/28/2006 12:19 PM 22842]
S3 ZD1211BU(WLAN);IEEE 802.11g USB Wireless LAN(WLAN);c:\windows\system32\drivers\ZD1211BU.sys [9/22/2006 3:09 PM 402432]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-790525478-725345543-1003Core.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-12-26 04:21]
.
2011-04-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-790525478-725345543-1003UA.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-12-26 04:21]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
mStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com
IE: &WordWeb... - c:\windows\wweb32.dll/lookup.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Handler: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} -
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\jx94mvem.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Hide Google Options: googleoptions@bruceclay.com - %profile%\extensions\googleoptions@bruceclay.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - user.js: yahoo.homepage.dontask - true
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-DAEMON Tools-1033 - c:\program files\D-Tools\daemon.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-01 15:29
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
BigDog305 = c:\windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)???????????????????0?????????@??????????????
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-602162358-790525478-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{41ABCEB8-EA4D-BC4F-A5C6-93444AD14CB8}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"jahhhgakdifbgminhleg"=hex:62,61,64,66,00,00
"jahhhgakdifbgminhlag"=hex:62,61,6a,66,00,00
"iahgekgkfllmhjnnob"=hex:6b,61,65,66,65,6a,69,70,6b,6b,61,6d,70,6c,6f,61,6a,61,
61,6a,62,68,00,00
"habgomapcmaokbdi"=hex:6b,61,65,66,65,6a,6c,70,62,6c,65,62,6b,65,63,70,61,6c,
6a,6f,69,66,00,00
"hadhepkbkdhecnno"=hex:69,61,6a,69,6d,6b,63,6f,69,61,68,67,6f,61,70,70,65,67,
00,00
"jachnocfhdpokecbjiik"=hex:66,61,67,69,65,66,70,69,6c,6a,6b,63,00,61
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(460)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(3032)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
.
Completion time: 2011-04-01 15:35:06
ComboFix-quarantined-files.txt 2011-04-01 19:34
ComboFix2.txt 2011-03-31 21:42
ComboFix3.txt 2011-03-31 21:15
ComboFix4.txt 2008-06-10 17:00
.
Pre-Run: 17,819,611,136 bytes free
Post-Run: 17,805,221,888 bytes free
.
- - End Of File - - AAB956CB8F44380E69070790A682E986

Unless you have some reason to believe that the files are infected beyond their filenames, I can assure you they are not and will be un-moving them.

#10 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:05:17 PM

Posted 01 April 2011 - 02:42 PM

Unless you have some reason to believe that the files are infected beyond their filenames, I can assure you they are not and will be un-moving them.

I can't stop you from doing that.


Locating ComboFix Log
  • Right click on START on the left end of your Windows toolbar (lower left corner of your screen)
  • Click on Explore
  • Click on Local Disk (C:) in the left-hand window pane
  • Click on Qoobox in the left-hand window pane
  • Look for ComboFix2.txt in the right-hand window pane and right click on it
  • Put your cursor (arrow) on Open With
  • Move your cursor to the new menu that opens and click on Choose Program...
  • Click on Notepad

When file opens, Copy/Paste text here.

Repeat the above process for locating ComboFix3.txt.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#11 Snakebyte

Snakebyte
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:05:17 PM

Posted 01 April 2011 - 02:47 PM

ComboFix 11-03-31.01 - Owner 03/31/2011 17:25:39.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1681 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *Disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
\\.\PhysicalDrive0 - Bootkit TDL4 was found and disinfected
.
((((((((((((((((((((((((( Files Created from 2011-02-28 to 2011-03-31 )))))))))))))))))))))))))))))))
.
.
2011-03-31 21:16 . 2011-03-31 21:17 -------- d-----w- C:\32788R22FWJFW
2011-03-31 19:40 . 2011-03-31 19:40 -------- d-----w- c:\program files\Common Files\Java
2011-03-31 04:40 . 2011-03-31 04:40 0 ----a-w- c:\windows\Cqayeyeguwi.bin
2011-03-31 04:40 . 2011-03-31 20:20 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\{572E5ED0-B6E0-43C8-A99A-A896A0F0FEB0}
2011-03-15 06:59 . 2011-03-15 06:59 -------- d-----w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2011-03-14 06:32 . 2011-03-31 20:20 -------- d-----w- C:\Pesterchum
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((( SnapShot@2011-03-31_21.06.54 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-03-31 2423752]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-10-19 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-10-19 126976]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]
"BigDog305"="c:\windows\VM305_STI.EXE" [2005-08-05 61440]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 115816]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2009-10-26 15872]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-29 583048]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]
"Linksys Wireless Manager"="c:\program files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" [2009-02-16 1358384]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-12-25 185896]
"QuickTime Task"="c:\program files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2010-03-18 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
c:\documents and settings\Owner\Start Menu\Programs\Startup\
WordWeb.lnk - c:\program files\WordWeb\wweb32.exe [2007-2-3 19968]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
IEEE 802.11g USB Wireless LAN Utility.lnk - c:\program files\IEEE 802.11g USB Wireless LAN\Wireless LAN\WlanUtil.exe [2006-9-22 479232]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=APTRRNTm.dll
"wave"=APTRRNTm.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0Partizan
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2009-04-24 03:16 203928 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2011-01-05 09:09 1305408 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
2004-08-22 21:05 81920 ----a-w- c:\program files\D-Tools\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-12-26 04:21 136176 ----atw- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2010-04-17 03:12 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2006-04-28 19:47 86016 ----a-w- c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2007-11-12 20:48 21760296 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2011-01-23 19:39 1242448 ----a-w- e:\steam\Steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2006-12-25 23:17 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WordWeb]
2005-08-29 20:10 19968 ----a-w- c:\program files\WordWeb\wweb32.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SymAppCore"=2 (0x2)
"Symantec Core LC"=3 (0x3)
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"ISPwdSvc"=3 (0x3)
"HssTrayService"=3 (0x3)
"HssSrv"=2 (0x2)
"HotspotShieldService"=2 (0x2)
"Darkness"=2 (0x2)
"CLTNetCnService"=2 (0x2)
"ccSetMgr"=2 (0x2)
"ccEvtMgr"=2 (0x2)
"idsvc"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"nwiz"=nwiz.exe /install
"LogitechImageStudioTray"=c:\program files\Logitech\ImageStudio\LogiTray.exe
"LogitechGalleryRepair"=c:\program files\Logitech\ImageStudio\ISStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\winver.exe"=
"c:\\Documents and Settings\\Owner\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
.
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 16512]
R3 Engine;Engine;c:\docume~1\Owner\LOCALS~1\Temp\Rar$EX00.828\Quick Unpack 2.2\Engine.sys [x]
R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys [2010-08-13 58368]
R3 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys [2008-01-14 31074]
R3 PID_0900_V;Logitech ClickSmart 310(PID_0900_V);c:\windows\system32\DRIVERS\LV551AV.sys [2002-06-10 220079]
R3 sysrest.sys;sysrest.sys;c:\windows\system32\sysrest.sys [x]
R3 USB-100;Realtek RTL8150 USB 10/100 Fast Ethernet Adapter;c:\windows\system32\DRIVERS\RTL8150.SYS [2006-05-10 22842]
R3 ZD1211BU(WLAN);IEEE 802.11g USB Wireless LAN(WLAN);c:\windows\system32\DRIVERS\zd1211Bu.sys [2005-10-28 402432]
R4 Darkness;Darkness;c:\windows\system\svchost.exe [x]
S0 d347bus;d347bus;c:\windows\system32\DRIVERS\d347bus.sys [2004-08-22 155136]
S0 d347prt;d347prt;c:\windows\System32\Drivers\d347prt.sys [2004-08-22 5248]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-06-29 721904]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-01-06 218176]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;c:\windows\system32\libusbd-nt.exe [2005-03-10 18944]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2005-03-10 33792]
S3 WUSB54GCv3;Compact Wireless-G USB Network Adapter;c:\windows\system32\DRIVERS\WUSB54GCv3.sys [2008-12-04 627072]
S3 ZSMC0305;VIMICRO USB PC Camera VC0305;c:\windows\system32\Drivers\usbVM305.sys [2005-11-05 391615]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-790525478-725345543-1003Core.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-12-26 04:21]
.
2011-03-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-790525478-725345543-1003UA.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-12-26 04:21]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
mStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com
IE: &WordWeb... - c:\windows\wweb32.dll/lookup.html
IE: Download Link Using Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Owner\Start Menu\Programs\IMVU\Run IMVU.lnk
Handler: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} -
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\jx94mvem.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Hide Google Options: googleoptions@bruceclay.com - %profile%\extensions\googleoptions@bruceclay.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - user.js: yahoo.homepage.dontask - true
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-31 17:37
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
BigDog305 = c:\windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)???????????????????0?????????@??????????????
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: MDT_MD400BB-00JHA0 rev.05.01C05 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-c
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x8A662439]<<
c:\docume~1\Owner\LOCALS~1\Temp\catchme.sys
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8a6687d0]; MOV EAX, [0x8a66884c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x8A76BAB8]
3 CLASSPNP[0xF7637FD7] -> nt!IofCallDriver[0x804E37D5] -> [0x8A767868]
\Driver\atapi[0x8A771F38] -> IRP_MJ_CREATE -> 0x8A662439
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\Ide\IdeDeviceP0T0L0-4 -> \??\IDE#DiskMDT_MD400BB-00JHA0______________________05.01C05#5&27d7eb1e&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x8A66227F
user != kernel MBR !!!
sectors 78165358 (+255): user != kernel
Warning: possible TDL4 rootkit infection !
TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-602162358-790525478-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{41ABCEB8-EA4D-BC4F-A5C6-93444AD14CB8}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"jahhhgakdifbgminhleg"=hex:62,61,64,66,00,00
"jahhhgakdifbgminhlag"=hex:62,61,6a,66,00,00
"iahgekgkfllmhjnnob"=hex:6b,61,65,66,65,6a,69,70,6b,6b,61,6d,70,6c,6f,61,6a,61,
61,6a,62,68,00,00
"habgomapcmaokbdi"=hex:6b,61,65,66,65,6a,6c,70,62,6c,65,62,6b,65,63,70,61,6c,
6a,6f,69,66,00,00
"hadhepkbkdhecnno"=hex:69,61,6a,69,6d,6b,63,6f,69,61,68,67,6f,61,70,70,65,67,
00,00
"jachnocfhdpokecbjiik"=hex:66,61,67,69,65,66,70,69,6c,6a,6b,63,00,61
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(468)
c:\windows\system32\WININET.dll
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
- - - - - - - > 'lsass.exe'(528)
c:\windows\system32\WININET.dll
.
Completion time: 2011-03-31 17:42:00
ComboFix-quarantined-files.txt 2011-03-31 21:41
ComboFix2.txt 2011-03-31 21:15
ComboFix3.txt 2008-06-10 17:00
.
Pre-Run: 17,107,701,760 bytes free
Post-Run: 17,096,818,688 bytes free
.
- - End Of File - - B67A7563F203790391F9DD65165821CB

ComboFix 11-03-31.01 - Owner 03/31/2011 16:54:02.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1673 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *Disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
PEV Error: AppFile
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\documents and settings\All Users\Application Data\Microsoft\id.txt
c:\documents and settings\Owner\Local Settings\Application Data\{572E5ED0-B6E0-43C8-A99A-A896A0F0FEB0}\chrome.manifest
c:\documents and settings\Owner\Local Settings\Application Data\{572E5ED0-B6E0-43C8-A99A-A896A0F0FEB0}\chrome\content\_cfg.js
c:\documents and settings\Owner\Local Settings\Application Data\{572E5ED0-B6E0-43C8-A99A-A896A0F0FEB0}\chrome\content\overlay.xul
c:\documents and settings\Owner\Local Settings\Application Data\{572E5ED0-B6E0-43C8-A99A-A896A0F0FEB0}\install.rdf
c:\documents and settings\Owner\Start Menu\Programs\Startup\Antimalware Doctor.lnk
c:\documents and settings\Owner\timeseal.exe
C:\Documents
c:\pesterchum\Pesterchum.exe
c:\program files\Common Files\time.cv
c:\program files\Internet Explorer\rasadhlp.dll
c:\windows\cookies.ini
c:\windows\daemon.dll
c:\windows\ekudurexu.dll
c:\windows\pskt.ini
c:\windows\system32\keygen.exe
c:\windows\system32\winlogon.bak
c:\windows\uenhad.dll
c:\windows\VM305Cap.exe
.
.
\\.\PhysicalDrive0 - Bootkit TDL4 was found and disinfected
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_DARKNESS
-------\Legacy_ENGINE
-------\Legacy_NUPS
.
.
((((((((((((((((((((((((( Files Created from 2011-02-28 to 2011-03-31 )))))))))))))))))))))))))))))))
.
.
2011-03-31 19:40 . 2011-03-31 19:40 -------- d-----w- c:\program files\Common Files\Java
2011-03-31 04:40 . 2011-03-31 04:40 0 ----a-w- c:\windows\Cqayeyeguwi.bin
2011-03-31 04:40 . 2011-03-31 20:20 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\{572E5ED0-B6E0-43C8-A99A-A896A0F0FEB0}
2011-03-15 06:59 . 2011-03-15 06:59 -------- d-----w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2011-03-14 06:32 . 2011-03-31 20:20 -------- d-----w- C:\Pesterchum
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-03-31 2423752]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-10-19 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-10-19 126976]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]
"BigDog305"="c:\windows\VM305_STI.EXE" [2005-08-05 61440]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 115816]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2009-10-26 15872]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-29 583048]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]
"Linksys Wireless Manager"="c:\program files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" [2009-02-16 1358384]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-12-25 185896]
"QuickTime Task"="c:\program files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2010-03-18 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
c:\documents and settings\Owner\Start Menu\Programs\Startup\
WordWeb.lnk - c:\program files\WordWeb\wweb32.exe [2007-2-3 19968]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
IEEE 802.11g USB Wireless LAN Utility.lnk - c:\program files\IEEE 802.11g USB Wireless LAN\Wireless LAN\WlanUtil.exe [2006-9-22 479232]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=APTRRNTm.dll
"wave"=APTRRNTm.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0Partizan
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2009-04-24 03:16 203928 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2011-01-05 09:09 1305408 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
2004-08-22 21:05 81920 ----a-w- c:\program files\D-Tools\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-12-26 04:21 136176 ----atw- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2010-04-17 03:12 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2006-04-28 19:47 86016 ----a-w- c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2007-11-12 20:48 21760296 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2011-01-23 19:39 1242448 ----a-w- e:\steam\Steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2006-12-25 23:17 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WordWeb]
2005-08-29 20:10 19968 ----a-w- c:\program files\WordWeb\wweb32.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SymAppCore"=2 (0x2)
"Symantec Core LC"=3 (0x3)
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"ISPwdSvc"=3 (0x3)
"HssTrayService"=3 (0x3)
"HssSrv"=2 (0x2)
"HotspotShieldService"=2 (0x2)
"Darkness"=2 (0x2)
"CLTNetCnService"=2 (0x2)
"ccSetMgr"=2 (0x2)
"ccEvtMgr"=2 (0x2)
"idsvc"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"nwiz"=nwiz.exe /install
"LogitechImageStudioTray"=c:\program files\Logitech\ImageStudio\LogiTray.exe
"LogitechGalleryRepair"=c:\program files\Logitech\ImageStudio\ISStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\winver.exe"=
"c:\\Documents and Settings\\Owner\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
.
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 16512]
R3 Engine;Engine;c:\docume~1\Owner\LOCALS~1\Temp\Rar$EX00.828\Quick Unpack 2.2\Engine.sys [x]
R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys [2010-08-13 58368]
R3 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys [2008-01-14 31074]
R3 PID_0900_V;Logitech ClickSmart 310(PID_0900_V);c:\windows\system32\DRIVERS\LV551AV.sys [2002-06-10 220079]
R3 sysrest.sys;sysrest.sys;c:\windows\system32\sysrest.sys [x]
R3 USB-100;Realtek RTL8150 USB 10/100 Fast Ethernet Adapter;c:\windows\system32\DRIVERS\RTL8150.SYS [2006-05-10 22842]
R3 ZD1211BU(WLAN);IEEE 802.11g USB Wireless LAN(WLAN);c:\windows\system32\DRIVERS\zd1211Bu.sys [2005-10-28 402432]
R4 Darkness;Darkness;c:\windows\system\svchost.exe [x]
S0 d347bus;d347bus;c:\windows\system32\DRIVERS\d347bus.sys [2004-08-22 155136]
S0 d347prt;d347prt;c:\windows\System32\Drivers\d347prt.sys [2004-08-22 5248]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-06-29 721904]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-01-06 218176]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;c:\windows\system32\libusbd-nt.exe [2005-03-10 18944]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2005-03-10 33792]
S3 WUSB54GCv3;Compact Wireless-G USB Network Adapter;c:\windows\system32\DRIVERS\WUSB54GCv3.sys [2008-12-04 627072]
S3 ZSMC0305;VIMICRO USB PC Camera VC0305;c:\windows\system32\Drivers\usbVM305.sys [2005-11-05 391615]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-790525478-725345543-1003Core.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-12-26 04:21]
.
2011-03-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-790525478-725345543-1003UA.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-12-26 04:21]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
mStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com
IE: &WordWeb... - c:\windows\wweb32.dll/lookup.html
IE: Download Link Using Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Owner\Start Menu\Programs\IMVU\Run IMVU.lnk
Handler: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} -
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\jx94mvem.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Hide Google Options: googleoptions@bruceclay.com - %profile%\extensions\googleoptions@bruceclay.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - user.js: yahoo.homepage.dontask - true
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
HKLM-Run-JavaCpl - c:\program files\Java\jre1.6.2\java.exe
Notify-ddcBRKEu - ddcBRKEu.dll
Notify-jkkHwWqO - (no file)
MSConfigStartUp-CloneCDTray - c:\program files\SlySoft\CloneCD\CloneCDTray.exe
MSConfigStartUp-EM_EXEC - c:\progra~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
MSConfigStartUp-googletalk - c:\program files\Google\Google Talk\googletalk.exe
MSConfigStartUp-LDM - c:\program files\Desktop Messenger\8876480\Program\backWeb-8876480.exe
MSConfigStartUp-lphc5qcj0eret - c:\windows\system32\lphc5qcj0eret.exe
MSConfigStartUp-Mrifapi - c:\windows\uenhad.dll
MSConfigStartUp-NeroFilterCheck - c:\windows\system32\NeroCheck.exe
MSConfigStartUp-Oqogo - c:\windows\ekudurexu.dll
MSConfigStartUp-sysrest32 - c:\windows\system32\sysrest32.exe
MSConfigStartUp-systme - c:\windows\system32\AC5F.exe
MSConfigStartUp-zBrowser Launcher - c:\program files\Logitech\iTouch\iTouch.exe
AddRemove-MKV Minimum Set (LD-Anime) - MatroskaSplitter & VSFilter_is1 - c:\program files\LD-Anime\unins000.exe
AddRemove-OpenSSL_is1 - c:\openssl\unins000.exe
AddRemove-PlayFLV - c:\program files\PlayFLV\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-31 17:06
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
BigDog305 = c:\windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)???????????????????0?????????@??????????????
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: MDT_MD400BB-00JHA0 rev.05.01C05 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-c
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x8A662439]<<
c:\docume~1\Owner\LOCALS~1\Temp\catchme.sys
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8a6687d0]; MOV EAX, [0x8a66884c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x8A76BAB8]
3 CLASSPNP[0xF7637FD7] -> nt!IofCallDriver[0x804E37D5] -> [0x8A767570]
\Driver\atapi[0x8A771F38] -> IRP_MJ_CREATE -> 0x8A662439
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\Ide\IdeDeviceP0T0L0-4 -> \??\IDE#DiskMDT_MD400BB-00JHA0______________________05.01C05#5&27d7eb1e&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x8A66227F
user != kernel MBR !!!
sectors 78165358 (+255): user != kernel
Warning: possible TDL4 rootkit infection !
TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-602162358-790525478-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{41ABCEB8-EA4D-BC4F-A5C6-93444AD14CB8}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"jahhhgakdifbgminhleg"=hex:62,61,64,66,00,00
"jahhhgakdifbgminhlag"=hex:62,61,6a,66,00,00
"iahgekgkfllmhjnnob"=hex:6b,61,65,66,65,6a,69,70,6b,6b,61,6d,70,6c,6f,61,6a,61,
61,6a,62,68,00,00
"habgomapcmaokbdi"=hex:6b,61,65,66,65,6a,6c,70,62,6c,65,62,6b,65,63,70,61,6c,
6a,6f,69,66,00,00
"hadhepkbkdhecnno"=hex:69,61,6a,69,6d,6b,63,6f,69,61,68,67,6f,61,70,70,65,67,
00,00
"jachnocfhdpokecbjiik"=hex:66,61,67,69,65,66,70,69,6c,6a,6b,63,00,61
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(468)
c:\windows\system32\WININET.dll
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
- - - - - - - > 'lsass.exe'(528)
c:\windows\system32\WININET.dll
.
Completion time: 2011-03-31 17:14:58
ComboFix-quarantined-files.txt 2011-03-31 21:14
ComboFix2.txt 2008-06-10 17:00
.
Pre-Run: 17,114,279,936 bytes free
Post-Run: 17,104,551,936 bytes free
.
- - End Of File - - E148A6850A2BEB178F016CDB312D94C0

I freely admit I understand very little of this... I was trying to ascertain that you DIDN'T have some reason to believe they were infected beyond their filenames. There could well have been some other data in the logs I've provided, as far as I knew.

Edited by Snakebyte, 01 April 2011 - 02:49 PM.


#12 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:05:17 PM

Posted 01 April 2011 - 02:52 PM

I'm not liking the looks of those 2 ComboFix logs.

Do you have a USB drive?

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#13 Snakebyte

Snakebyte
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:05:17 PM

Posted 01 April 2011 - 02:53 PM

There was an MP3 player charging via USB cable at the times of some of the scans.

#14 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:05:17 PM

Posted 01 April 2011 - 03:00 PM

Okay.

Run this online scan:


ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.



  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Make sure that the option "Remove found threats" is Unchecked
  • When the Computer scan settings display shows, click the Advanced option, the place a check next to the following (if it is not already checked):
    • Enable Anti-Stealth technology
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#15 Snakebyte

Snakebyte
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:05:17 PM

Posted 01 April 2011 - 06:03 PM

It somehow got it into its head to scan all three hard drives, and there are things on my F drive that are going to take it a further three hours. It's already been going for three, and I can guarantee that what it's scanning is virus-free. Will I be able to pull a log off if I abort the scan partway through? I'm getting rather tired of sitting here unproductively.

It's found six threats so far, incidentally.

EDIT: Yes, evidently I can.

C:\Documents and Settings\Owner\Desktop\odbg110\MoleBox 2.xx Unpacker + OEP Finder v1.11.rar probably a variant of Win32/TrojanDropper.Agent.JVNUWAO trojan
C:\Documents and Settings\Owner\Desktop\odbg110\mbunpack\filelen.exe probably a variant of Win32/TrojanDropper.Agent.JVNUWAO trojan
C:\Qoobox\Quarantine\C\Program Files\Internet Explorer\rasadhlp.dll.vir a variant of Win32/Delf.NNT trojan
C:\Qoobox\Quarantine\C\WINDOWS\uenhad.dll.vir a variant of Win32/Cimag.GR trojan
C:\System Volume Information\_restore{CDF77E2A-E911-463E-93A4-304E691188F2}\RP666\A0207722.dll a variant of Win32/Delf.NNT trojan
C:\System Volume Information\_restore{CDF77E2A-E911-463E-93A4-304E691188F2}\RP666\A0207728.dll a variant of Win32/Cimag.GR trojan

I know what the first two are and am not terribly surprised, though given the nature of the files I suppose it could be a false positive. I assume instructions will be to delete.

EDIT: Sorry, I don't mean to be brusque, I just need to be able to do things at my computer for a good chunk of time today that I had intended to do yesterday, which is impossible while I have scans running and am restarting every half hour. I definitely appreciate the help and apologize if the above comment came off as frustration with you as opposed to the situation. To be clear, it scanned the entirety of my C and E drives, and all but one (very large) folder on my F drive. I can run it again overnight if you think it really necessary.

Edited by Snakebyte, 01 April 2011 - 06:53 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users