Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Homepage Taken Over


  • Please log in to reply
7 replies to this topic

#1 ajhodgki

ajhodgki

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:06:21 PM

Posted 16 October 2006 - 07:05 PM

Hello, my computers homepage has been changed to isaftypage.com and i cannot change it back to what i want. Also some pages are blocked and a notice comes up saying that i need to download spy doctor. Please help. Below is my hijackthis log. Thankyou.

Logfile of HijackThis v1.99.1
Scan saved at 00:58:03, on 17/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\MMediaCodec\isamonitor.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\MMediaCodec\isamini.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {d869742a-e5d2-4624-96c7-aae26170665e} - C:\Program Files\MMediaCodec\isaddon.dll
O4 - HKLM\..\Run: [Workflow] D:\Workflow.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.co.uk
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs:
O21 - SSODL: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} - C:\WINDOWS\system32\dpfwu.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

BC AdBot (Login to Remove)

 


#2 Guest_Cretemonster_*

Guest_Cretemonster_*

  • Guests
  • OFFLINE
  •  

Posted 17 October 2006 - 04:59 AM

Hi ajhodgki and Welcome to the Bleeping Computer!


Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm

#3 ajhodgki

ajhodgki
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  

Posted 17 October 2006 - 06:11 AM

SmitFraudFix v2.110

Scan done at 12:08:15.83, 17/10/2006
Run from C:\Documents and Settings\Administrator\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in normal mode

C:\


C:\WINDOWS


C:\WINDOWS\system


C:\WINDOWS\Web


C:\WINDOWS\system32


C:\Documents and Settings\Administrator


C:\Documents and Settings\Administrator\Application Data


Start Menu


C:\DOCUME~1\ADMINI~1\FAVORI~1


Desktop


C:\Program Files

C:\Program Files\MMediaCodec\ FOUND !

Corrupted keys


Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{dfa61db1-388e-4c87-8d56-540fa229bcb4}"="contrabandists"

[HKEY_CLASSES_ROOT\CLSID\{dfa61db1-388e-4c87-8d56-540fa229bcb4}\InProcServer32]
@="C:\WINDOWS\system32\dpfwu.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{dfa61db1-388e-4c87-8d56-540fa229bcb4}\InProcServer32]
@="C:\WINDOWS\system32\dpfwu.dll"



AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "


pe386-msguard-lzx32


Scanning wininet.dll infection


End

#4 Guest_Cretemonster_*

Guest_Cretemonster_*

  • Guests
  • OFFLINE
  •  

Posted 17 October 2006 - 07:03 AM

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Next, please reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the first option, to run Windows in Safe Mode, then press "Enter".
  • Choose your usual account.
Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.



After posting C:\rapport.txt,Please download Combofix to your desktop.
http://download.bleepingcomputer.com/sUBs/combofix.exe

Doubleclick combo.exe to launch the application.

Follow the prompts that will be displayed on the screen.

Don't click on the window while the fix is running, because that will cause your system to hang.

When finished, it should produce a log, combofix.txt

Please post that log in the next reply.

#5 ajhodgki

ajhodgki
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:06:21 PM

Posted 17 October 2006 - 09:09 AM

Thank you for your help - it is greatly appreciated!

SmitFraudFix v2.110

Scan done at 14:56:17.24, 17/10/2006
Run from C:\Documents and Settings\Administrator\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in safe mode

Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{dfa61db1-388e-4c87-8d56-540fa229bcb4}"="contrabandists"

[HKEY_CLASSES_ROOT\CLSID\{dfa61db1-388e-4c87-8d56-540fa229bcb4}\InProcServer32]
@="C:\WINDOWS\system32\dpfwu.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{dfa61db1-388e-4c87-8d56-540fa229bcb4}\InProcServer32]
@="C:\WINDOWS\system32\dpfwu.dll"


Killing process


Generic Renos Fix

GenericRenosFix by S!Ri


Deleting infected files

C:\Program Files\MMediaCodec\ Deleted

Deleting Temp Files


Registry Cleaning

Registry Cleaning done.

After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


End

#6 Guest_Cretemonster_*

Guest_Cretemonster_*

  • Guests
  • OFFLINE
  •  

Posted 17 October 2006 - 02:33 PM

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Next, please reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the first option, to run Windows in Safe Mode, then press "Enter".
  • Choose your usual account.
Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.



After posting C:\rapport.txt,Please download Combofix to your desktop.
http://download.bleepingcomputer.com/sUBs/combofix.exe

Doubleclick combo.exe to launch the application.

Follow the prompts that will be displayed on the screen.

Don't click on the window while the fix is running, because that will cause your system to hang.

When finished, it should produce a log, combofix.txt

Please post that log in the next reply.

#7 ajhodgki

ajhodgki
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  

Posted 18 October 2006 - 09:08 AM

Below are the reports - again, thank you for your help.

SmitFraudFix v2.110

Scan done at 14:55:00.41, 18/10/2006
Run from C:\Documents and Settings\Administrator\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in safe mode

Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

Killing process


Generic Renos Fix

GenericRenosFix by S!Ri


Deleting infected files


Deleting Temp Files


Registry Cleaning

Registry Cleaning done.

After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


End


Administrator - 06-10-18 15:02:39.66 Service Pack 2
ComboFix 06.10.16 - Running from: "C:\Documents and Settings\Administrator\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-09-18 to 2006-10-18 ))))))))))))))))))))))))))))))))))


2006-10-17 14:56 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-10-17 14:56 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-10-17 14:56 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-10-17 14:56 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-10-14 23:39 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-10-14 22:04 0 --a------ C:\WINDOWS\system32\cmmgr32.exe
2006-10-14 21:24 78,488 --a------ C:\WINDOWS\system32\XMD5.dll
2006-10-14 21:24 101,888 --a------ C:\WINDOWS\system32\vb6stkit.dll
2006-10-13 18:35 67,645 --a------ C:\WINDOWS\system32\drivers\pshook11.sys
2006-10-13 10:15 89,088 --a------ C:\WINDOWS\system32\atl71.dll
2006-10-13 10:15 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
2006-10-01 17:41 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2006-10-01 17:41 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2006-09-30 21:52 26,496 --a------ C:\WINDOWS\system32\drivers\USBSTOR.SYS
2006-09-30 20:04 81,920 --a------ C:\WINDOWS\system32\W32n50.dll
2006-09-30 20:04 69,632 --a------ C:\WINDOWS\system32\MCCDevice.dll
2006-09-30 20:04 6,048 --a------ C:\WINDOWS\system32\mcc16.dll
2006-09-30 20:04 17,162 --a------ C:\WINDOWS\system32\Pcandis5.sys
2006-09-30 20:04 16,848 --a------ C:\WINDOWS\system32\Pcandis4.sys
2006-09-30 20:00 14,336 --a------ C:\WINDOWS\system32\drivers\SACMXP1.sys
2006-09-30 20:00 13,501 --a------ C:\WINDOWS\UNDPX.EXE
2006-09-30 19:56 945,424 --a------ C:\WINDOWS\system32\msjava.dll
2006-09-30 19:56 63,248 --a------ C:\WINDOWS\system32\javaprxy.dll
2006-09-30 19:56 49,424 --a------ C:\WINDOWS\system32\clspack.exe
2006-09-30 19:56 46,352 --a------ C:\WINDOWS\setdebug.exe
2006-09-30 19:56 404,752 --a------ C:\WINDOWS\system32\javart.dll
2006-09-30 19:56 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2006-09-30 19:56 286,992 --a------ C:\WINDOWS\system32\vmhelper.dll
2006-09-30 19:56 21,264 --a------ C:\WINDOWS\system32\msjdbc10.dll
2006-09-30 19:56 187,152 --a------ C:\WINDOWS\system32\javacypt.dll
2006-09-30 19:56 172,304 --a------ C:\WINDOWS\system32\jview.exe
2006-09-30 19:56 171,792 --a------ C:\WINDOWS\system32\wjview.exe
2006-09-30 19:56 171,280 --a------ C:\WINDOWS\system32\jit.dll
2006-09-30 19:56 154,896 --a------ C:\WINDOWS\system32\msawt.dll
2006-09-30 19:56 15,120 --a------ C:\WINDOWS\system32\jdbgmgr.exe
2006-09-30 19:56 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2006-09-30 19:56 113 --a------ C:\WINDOWS\system32\zonedon.reg
2006-09-30 19:56 113 --a------ C:\WINDOWS\system32\zonedoff.reg
2006-09-30 19:38 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2006-09-30 19:38 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2006-09-30 19:38 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2006-09-30 19:38 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2006-09-30 19:38 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2006-09-30 19:38 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2006-09-30 19:38 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys
2006-09-30 19:38 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2006-09-30 19:38 171,776 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2006-09-30 19:38 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys
2006-09-30 19:37 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2006-09-30 19:37 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2006-09-30 19:36 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2006-09-30 19:36 49,182 --a------ C:\WINDOWS\system32\drivers\cem56n5.sys
2006-09-30 19:36 10,624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2006-09-30 19:35 75,392 --a------ C:\WINDOWS\system32\drivers\s3savmxm.sys
2006-09-30 19:35 245,632 --a------ C:\WINDOWS\system32\s3savmx.dll
2006-09-30 19:34 87,424 --a------ C:\WINDOWS\system32\drivers\irda.sys
2006-09-30 19:34 8,192 --a------ C:\WINDOWS\system32\wshirda.dll
2006-09-30 19:34 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2006-09-30 19:34 420,992 --a------ C:\WINDOWS\system32\drivers\ltmdmntt.sys
2006-09-30 19:34 28,232 --a------ C:\WINDOWS\system32\drivers\Tos4mo.sys
2006-09-30 19:34 27,136 --a------ C:\WINDOWS\system32\irmon.dll
2006-09-30 19:34 19,584 --a------ C:\WINDOWS\system32\drivers\rasirda.sys
2006-09-30 19:34 152,576 --a------ C:\WINDOWS\system32\irftp.exe
2006-09-30 19:33 9,344 --a------ C:\WINDOWS\system32\drivers\compbatt.sys
2006-09-30 19:33 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2006-09-30 19:33 42,368 --a------ C:\WINDOWS\system32\drivers\AGP440.SYS
2006-09-30 19:33 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2006-09-30 19:33 334,208 --a------ C:\WINDOWS\system32\drivers\ds1wdm.sys
2006-09-30 19:33 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2006-09-30 19:33 14,080 --a------ C:\WINDOWS\system32\drivers\CmBatt.sys
2006-09-30 19:33 14,080 --a------ C:\WINDOWS\system32\drivers\battc.sys
2006-09-30 19:30 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2006-09-30 19:30 0 -rahs---- C:\MSDOS.SYS
2006-09-30 19:30 0 -rahs---- C:\IO.SYS
2006-09-30 19:30 0 --a------ C:\CONFIG.SYS
2006-09-30 19:30 0 --a------ C:\AUTOEXEC.BAT
2006-09-30 19:25 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2006-09-30 19:24 81,920 --a------ C:\WINDOWS\system32\isign32.dll
2006-09-30 19:24 81,920 --a------ C:\WINDOWS\system32\ils.dll
2006-09-30 19:24 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll
2006-09-30 19:24 73,728 --a------ C:\WINDOWS\system32\icwdial.dll
2006-09-30 19:24 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys
2006-09-30 19:24 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2006-09-30 19:24 69,632 --a------ C:\WINDOWS\system32\msconf.dll
2006-09-30 19:24 678,400 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-09-30 19:24 67,584 --a------ C:\WINDOWS\system32\srclient.dll
2006-09-30 19:24 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll
2006-09-30 19:24 64,512 --a------ C:\WINDOWS\system32\acctres.dll
2006-09-30 19:24 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll
2006-09-30 19:24 48,128 --a------ C:\WINDOWS\system32\inetres.dll
2006-09-30 19:24 45,568 --a------ C:\WINDOWS\system32\safrslv.dll
2006-09-30 19:24 430,592 --a------ C:\WINDOWS\system32\wuapi.dll
2006-09-30 19:24 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2006-09-30 19:24 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll
2006-09-30 19:24 382,464 --a------ C:\WINDOWS\system32\qmgr.dll
2006-09-30 19:24 36,864 --a------ C:\WINDOWS\system32\wups.dll
2006-09-30 19:24 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll
2006-09-30 19:24 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2006-09-30 19:24 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll
2006-09-30 19:24 29,696 --a------ C:\WINDOWS\system32\safrdm.dll
2006-09-30 19:24 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll
2006-09-30 19:24 274,944 --a------ C:\WINDOWS\system32\mstask.dll
2006-09-30 19:24 274,432 --a------ C:\WINDOWS\system32\inetcfg.dll
2006-09-30 19:24 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll
2006-09-30 19:24 239,104 --a------ C:\WINDOWS\system32\srrstr.dll
2006-09-30 19:24 22,528 --a------ C:\WINDOWS\system32\fltMc.exe
2006-09-30 19:24 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll
2006-09-30 19:24 183,296 --a------ C:\WINDOWS\system32\wuaueng1.dll
2006-09-30 19:24 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2006-09-30 19:24 170,496 --a------ C:\WINDOWS\system32\srsvc.dll
2006-09-30 19:24 165,888 --a------ C:\WINDOWS\system32\wuauclt1.exe
2006-09-30 19:24 16,896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-09-30 19:24 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2006-09-30 19:24 124,800 --a------ C:\WINDOWS\system32\drivers\fltMgr.sys
2006-09-30 19:24 120,320 --a------ C:\WINDOWS\system32\wuweb.dll
2006-09-30 19:24 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2006-09-30 19:24 12,288 --a------ C:\WINDOWS\system32\mstinit.exe
2006-09-30 19:24 112,640 --a------ C:\WINDOWS\system32\wucltui.dll
2006-09-30 19:24 111,104 --a------ C:\WINDOWS\system32\wuauclt.exe
2006-09-30 19:24 105,984 --a------ C:\WINDOWS\system32\msoert2.dll
2006-09-30 19:24 1,134,592 --a------ C:\WINDOWS\system32\wuaueng.dll
2006-09-30 19:21 5,632 --a------ C:\WINDOWS\system32\write.exe
2006-09-30 19:20 9,728 --a------ C:\WINDOWS\system32\reset.exe
2006-09-30 19:20 82,432 --a------ C:\WINDOWS\system32\comrepl.dll
2006-09-30 19:20 80,384 --a------ C:\WINDOWS\system32\charmap.exe
2006-09-30 19:20 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2006-09-30 19:20 605,696 --a------ C:\WINDOWS\system32\getuname.dll
2006-09-30 19:20 56,832 --a------ C:\WINDOWS\system32\sol.exe
2006-09-30 19:20 55,296 --a------ C:\WINDOWS\system32\freecell.exe
2006-09-30 19:20 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2006-09-30 19:20 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2006-09-30 19:20 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2006-09-30 19:20 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2006-09-30 19:20 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2006-09-30 19:20 35,328 --a------ C:\WINDOWS\system32\winchat.exe
2006-09-30 19:20 33,792 --a------ C:\WINDOWS\system32\regini.exe
2006-09-30 19:20 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2006-09-30 19:20 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2006-09-30 19:20 227,840 --a------ C:\WINDOWS\system32\avtapi.dll
2006-09-30 19:20 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe
2006-09-30 19:20 20,992 --a------ C:\WINDOWS\system32\msg.exe
2006-09-30 19:20 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2006-09-30 19:20 183,808 --a------ C:\WINDOWS\system32\accwiz.exe
2006-09-30 19:20 16,896 --a------ C:\WINDOWS\system32\tsshutdn.exe
2006-09-30 19:20 16,896 --a------ C:\WINDOWS\system32\qappsrv.exe
2006-09-30 19:20 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2006-09-30 19:20 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2006-09-30 19:20 15,872 --a------ C:\WINDOWS\system32\rwinsta.exe
2006-09-30 19:20 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2006-09-30 19:20 15,360 --a------ C:\WINDOWS\system32\logoff.exe
2006-09-30 19:20 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2006-09-30 19:20 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe
2006-09-30 19:20 14,848 --a------ C:\WINDOWS\system32\tscon.exe
2006-09-30 19:20 14,848 --a------ C:\WINDOWS\system32\shadow.exe
2006-09-30 19:20 138,752 --a------ C:\WINDOWS\system32\sndvol32.exe
2006-09-30 19:20 126,976 --a------ C:\WINDOWS\system32\mshearts.exe
2006-09-30 19:20 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2006-09-30 19:20 114,688 --a------ C:\WINDOWS\system32\calc.exe
2006-09-30 19:20 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd
2006-09-30 19:19 949,248 --a------ C:\WINDOWS\system32\msdtctm.dll
2006-09-30 19:19 93,696 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2006-09-30 19:19 90,112 --a------ C:\WINDOWS\system32\mtxoci.dll
2006-09-30 19:19 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll
2006-09-30 19:19 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2006-09-30 19:19 67,072 --a------ C:\WINDOWS\system32\rdshost.exe
2006-09-30 19:19 655,360 --a------ C:\WINDOWS\system32\mstscax.dll
2006-09-30 19:19 628,224 --a------ C:\WINDOWS\system32\catsrvut.dll
2006-09-30 19:19 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe
2006-09-30 19:19 62,464 --a------ C:\WINDOWS\system32\colbact.dll
2006-09-30 19:19 60,416 --a------ C:\WINDOWS\system32\remotepg.dll
2006-09-30 19:19 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2006-09-30 19:19 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll
2006-09-30 19:19 58,880 --a------ C:\WINDOWS\system32\licwmi.dll
2006-09-30 19:19 56,320 --a------ C:\WINDOWS\system32\servdeps.dll
2006-09-30 19:19 540,160 --a------ C:\WINDOWS\system32\comuid.dll
2006-09-30 19:19 538,624 --a------ C:\WINDOWS\system32\spider.exe
2006-09-30 19:19 501,248 --a------ C:\WINDOWS\system32\clbcatq.dll
2006-09-30 19:19 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe
2006-09-30 19:19 425,472 --a------ C:\WINDOWS\system32\msdtcprx.dll
2006-09-30 19:19 407,552 --a------ C:\WINDOWS\system32\mstsc.exe
2006-09-30 19:19 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2006-09-30 19:19 38,912 --a------ C:\WINDOWS\system32\cfgbkend.dll
2006-09-30 19:19 345,088 --a------ C:\WINDOWS\system32\hypertrm.dll
2006-09-30 19:19 343,040 --a------ C:\WINDOWS\system32\mspaint.exe
2006-09-30 19:19 295,424 --a------ C:\WINDOWS\system32\termsrv.dll
2006-09-30 19:19 229,888 --a------ C:\WINDOWS\system32\catsrv.dll
2006-09-30 19:19 21,896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2006-09-30 19:19 20,480 --a------ C:\WINDOWS\system32\qprocess.exe
2006-09-30 19:19 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2006-09-30 19:19 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll
2006-09-30 19:19 185,344 --a------ C:\WINDOWS\system32\cmprops.dll
2006-09-30 19:19 17,408 --a------ C:\WINDOWS\system32\mmfutil.dll
2006-09-30 19:19 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2006-09-30 19:19 147,968 --a------ C:\WINDOWS\system32\rdchost.dll
2006-09-30 19:19 140,800 --a------ C:\WINDOWS\system32\sessmgr.exe
2006-09-30 19:19 139,400 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2006-09-30 19:19 131,584 --a------ C:\WINDOWS\system32\sndrec32.exe
2006-09-30 19:19 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe
2006-09-30 19:19 123,392 --a------ C:\WINDOWS\system32\mplay32.exe
2006-09-30 19:19 12,040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2006-09-30 19:19 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll
2006-09-30 19:19 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll
2006-09-30 19:19 11,264 --a------ C:\WINDOWS\system32\icaapi.dll
2006-09-30 19:19 102,912 --a------ C:\WINDOWS\system32\clipbrd.exe
2006-09-30 19:19 1,251,840 --a------ C:\WINDOWS\system32\comsvcs.dll
2006-09-30 19:16 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2006-09-30 19:16 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2006-09-30 19:16 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2006-09-30 19:15 85,020 --a------ C:\WINDOWS\system32\dgsetup.dll
2006-09-30 19:15 8,704 --a------ C:\WINDOWS\system32\batt.dll
2006-09-30 19:15 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2006-09-30 19:15 74,752 --a------ C:\WINDOWS\system32\storprop.dll
2006-09-30 19:15 7,168 -ra------ C:\WINDOWS\system32\kbdcz.dll
2006-09-30 19:15 69,120 --a------ C:\WINDOWS\NOTEPAD.EXE
2006-09-30 19:15 6,656 -ra------ C:\WINDOWS\system32\kbdycl.dll
2006-09-30 19:15 6,656 -ra------ C:\WINDOWS\system32\kbdsl1.dll
2006-09-30 19:15 6,656 -ra------ C:\WINDOWS\system32\kbdsl.dll
2006-09-30 19:15 6,656 -ra------ C:\WINDOWS\system32\kbdpl.dll
2006-09-30 19:15 6,656 -ra------ C:\WINDOWS\system32\kbdhu.dll
2006-09-30 19:15 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2006-09-30 19:15 6,656 -ra------ C:\WINDOWS\system32\kbdcz2.dll
2006-09-30 19:15 6,656 -ra------ C:\WINDOWS\system32\kbdcz1.dll
2006-09-30 19:15 6,656 -ra------ C:\WINDOWS\system32\kbdcr.dll
2006-09-30 19:15 6,656 -ra------ C:\WINDOWS\system32\KBDAL.DLL
2006-09-30 19:15 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2006-09-30 19:15 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2006-09-30 19:15 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2006-09-30 19:15 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2006-09-30 19:15 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdycc.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbduzb.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdur.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdtat.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdru1.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdru.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdro.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdpl1.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdkaz.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdhu1.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdbu.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdblr.dll
2006-09-30 19:15 5,632 -ra------ C:\WINDOWS\system32\kbdaze.dll
2006-09-30 19:15 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2006-09-30 19:15 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2006-09-30 19:15 15,360 --a------ C:\WINDOWS\TASKMAN.EXE
2006-09-30 19:15 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2006-09-30 19:15 11,264 --a------ C:\WINDOWS\system32\drivers\irenum.sys
2006-09-30 19:15 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-10-17 14:21 -------- d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2006-10-16 20:04 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Azureus
2006-10-16 16:59 -------- d-------- C:\Program Files\iTunes
2006-10-16 16:24 -------- d-------- C:\Program Files\QuickTime
2006-10-16 12:11 -------- d-------- C:\Program Files\WinRAR
2006-10-15 20:07 -------- d-------- C:\Program Files\Common Files
2006-10-14 23:39 -------- d-------- C:\Program Files\Grisoft
2006-10-14 23:27 -------- d-------- C:\Program Files\xerox
2006-10-14 22:04 -------- d-------- C:\Program Files\Messenger
2006-10-14 20:27 -------- d-------- C:\Program Files\Microsoft ActiveSync
2006-10-14 20:27 -------- d-------- C:\Program Files\Common Files\Designer
2006-10-14 20:26 -------- d-------- C:\Program Files\Microsoft Office
2006-10-14 20:04 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-10-14 13:08 -------- d-------- C:\Program Files\MSN Messenger
2006-10-13 03:42 -------- d-------- C:\Documents and Settings\Administrator\Application Data\DivX
2006-10-11 20:32 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2006-10-11 19:19 -------- d-------- C:\Program Files\iPod
2006-10-11 19:16 -------- d-------- C:\Program Files\Apple Software Update
2006-10-07 18:20 -------- d-------- C:\Documents and Settings\Administrator\Application Data\AdobeUM
2006-10-07 18:19 -------- d-------- C:\Program Files\Common Files\Adobe
2006-10-07 18:19 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Adobe
2006-10-07 18:18 -------- d-------- C:\Program Files\Adobe
2006-10-06 23:37 -------- d-------- C:\Documents and Settings\Administrator\Application Data\dvdcss
2006-10-02 21:51 -------- d-------- C:\Documents and Settings\Administrator\Application Data\vlc
2006-10-02 21:48 -------- d-------- C:\Program Files\VideoLAN
2006-10-02 13:08 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Sun
2006-10-01 18:33 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Sports Interactive
2006-10-01 18:27 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-10-01 17:49 -------- d-------- C:\Program Files\Java
2006-10-01 17:47 -------- d-------- C:\Program Files\Common Files\Java
2006-10-01 17:45 -------- d-------- C:\Program Files\Azureus
2006-09-30 22:51 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia
2006-09-30 20:04 -------- d-------- C:\Program Files\Common Files\Motive
2006-09-30 19:43 -------- d--h----- C:\Program Files\Uninstall Information
2006-09-30 19:32 -------- d-------- C:\Program Files\microsoft frontpage
2006-09-30 19:31 -------- d-------- C:\Program Files\Internet Explorer
2006-09-30 19:31 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Identities
2006-09-30 19:30 -------- d-------- C:\Program Files\Windows Media Player
2006-09-30 19:26 -------- d--h----- C:\Program Files\WindowsUpdate
2006-09-30 19:26 -------- d-------- C:\Program Files\Online Services
2006-09-30 19:24 -------- d-------- C:\Program Files\Outlook Express
2006-09-30 19:24 -------- d-------- C:\Program Files\NetMeeting
2006-09-30 19:24 -------- d-------- C:\Program Files\Movie Maker
2006-09-30 19:24 -------- d-------- C:\Program Files\Common Files\System
2006-09-30 19:24 -------- d-------- C:\Program Files\Common Files\Services
2006-09-30 19:24 -------- d-------- C:\Program Files\Common Files\MSSoap
2006-09-30 19:22 -------- d-------- C:\Program Files\ComPlus Applications
2006-09-30 19:21 -------- d-------- C:\Program Files\MSN Gaming Zone
2006-09-30 19:20 -------- d-------- C:\Program Files\Windows NT
2006-09-30 19:20 -------- d-------- C:\Program Files\MSN
2006-09-30 19:16 -------- d-------- C:\Program Files\Common Files\SpeechEngines
2006-09-30 19:16 -------- d-------- C:\Program Files\Common Files\ODBC
2006-09-30 19:15 62 --ahs---- C:\Documents and Settings\Administrator\Application Data\desktop.ini
2006-07-29 19:32 48936 --a------ C:\WINDOWS\system32\sirenacm.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Workflow"="D:\\Workflow.exe"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVGEMS"=dword:00000002
"Avg7UpdSvc"=dword:00000002
"Avg7Alrt"=dword:00000002

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job

Completion time: 06-10-18 15:03:38.38
C:\ComboFix.txt ... 06-10-18 15:03

#8 Guest_Cretemonster_*

Guest_Cretemonster_*

  • Guests
  • OFFLINE
  •  

Posted 18 October 2006 - 03:22 PM

Sorry for the double post! :thumbsup:


Please run the F-Secure Online Scanner

Note: This Scanner is for Internet Explorer Only!
  • Follow the Instruction on the F-Secure page for proper installation.
  • Accept the License Agreement.
  • Once the ActiveX installs,Click Full System Scan
  • Once the download completes,the scan will begin automatically.
  • The scan will take some time to finish,so please be patient.
  • When the scan completes, click the Automatic cleaning (recommended) button.
  • Click the Show Report button and Copy&Paste the entire report in your next reply.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users