PDA

View Full Version : Virtumonde, me too.


wastabee
2008-09-25, 15:56
Need help for removing Virtumonde. It prevents me from going to some sites ex. google.com and others.

The log from HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:55:58, on 2008.09.25.
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\Explorer.EXE
H:\WINDOWS\system32\RUNDLL32.EXE
H:\Program Files\Tildes Birojs 2008\Pianists.exe
H:\WINDOWS\system32\rundll32.exe
H:\WINDOWS\system32\Rundll32.exe
H:\Program Files\Skype\Phone\Skype.exe
H:\WINDOWS\ATKKBService.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\system32\wscntfy.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Skype\Plugin Manager\skypePM.exe
H:\Program Files\Steam\Steam.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\Documents and Settings\Ritvars\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O3 - Toolbar: Tildes Birojs - {1E6700F0-0F85-40fd-8022-7EB60AB46F10} - H:\Program Files\Tildes Birojs 2008\IEjosla.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Pianists] "H:\Program Files\Tildes Birojs 2008\Pianists.exe" /START
O4 - HKLM\..\Run: [mdiction] "H:\Program Files\Tildes Birojs 2008\mdiction.exe" /startup
O4 - HKLM\..\Run: [MSConfig] H:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: Rundll32.exe "H:\WINDOWS\system32\pfbsdwou.dll",s
O4 - HKCU\..\Run: [Skype] "H:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Steam] "H:\Program Files\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://H:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://H:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://H:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Tulkot ar Tildes Datorvārdnīcu - res://H:\Program Files\Tildes Birojs 2008\TDVLauncher.DLL /201
O8 - Extra context menu item: T&ulkot ar Tildes Tulkotāju - H:\Program Files\Tildes Birojs 2008\LaunchMTS.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - H:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\31E6481A7A624C39BB43E8BF6390376C\Skype4COM.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - H:\WINDOWS\ATKKBService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4718 bytes

[B]I thank you for your time
ken545
2008-09-26, 01:24
Hello wastabee

Welcome to Safer Networking.

Please read Before You Post (http://forums.spybot.info/showthread.php?t=288)
That said, All advice given by anyone volunteering here, is taken at own risk.
While best efforts are made to assist in removing infections safely, unexpected stuff can happen.

You have a few issues on your system that you need to correct before we can proceed.

1.Go to C:\Program Files and create a new folder and name it Hijackthis, then go to where you have Hijackthis currently installed and Cut and Paste it into the new folder, we need to do this for backup purposes so anything we remove with HJT will be there if we need to reinstall it



2. You have windows configured for Selective start up, your log may not be showing everything in this mode, go to Start> Run and type in msconfig and on the main tab select Normal Startup, ok your way out and restart your system.


3.

We have noticed that many people seeking help from us are coming with infections contracted from the use of P2P programs.

Because of this, we changed our malware forum's policy on the use of P2P file sharing programs.


If your helper detects the presence of such programs on your computer he/she will ask you to remove them. Help will be withdrawn should you not agree to their removal.
If we clean your computer of infection, and you return to us a short time later with an infection contracted by the use of P2P programs, volunteer analysts will refuse their help.


We do not ask you to do this without reason.


P2P (File Sharing ) programs form a direct conduit onto your computer, their security measures are easily circumvented, and Malware writers are increasingly exploiting them to spread their wares onto your computer. Further to that, if your P2P program is not configured correctly you may be sharing more files than you realise. There have been cases where people's Passwords, Address Books and other personal, private, and financial details have been exposed to the file sharing network by a badly configured program.

Many of the programs come bundled with other unwanted programs, but even the ones free of any bundled software are not safe to use.

This article from InfoWorld illustrates the dangers of a poorly configured P2P program.
http://www.infoworld.com/article/07/09/06/...ID-theft_1.html (http://www.infoworld.com/article/07/09/06/Seattle-man-arrested-for-p-to-p-ID-theft_1.html)

When you use them you are downloading software from an unknown source directly onto your computer, bypassing your Firewall and Anti-Virus software. Hardly surprising then that many of these Downloads are being targeted to carry infections.


BitComet<--- You can remove this via the Add Remove Programs in the Control Panel


When done post a new HJT log and we can begin the cleaning
wastabee
2008-09-26, 13:58
I did like you said - i uninstalled the Bitcomet and set the startup to normal. And here's the log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:55:35, on 2008.09.26.
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\Explorer.EXE
H:\Program Files\Tildes Birojs 2008\Pianists.exe
H:\WINDOWS\system32\rundll32.exe
H:\WINDOWS\system32\rundll32.exe
H:\Program Files\A4Tech\Mouse\Amoumain.exe
H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
H:\WINDOWS\RTHDCPL.EXE
H:\Program Files\ASUS\GamerOSD\GamerOSD.exe
H:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
H:\WINDOWS\ATKKBService.exe
H:\WINDOWS\system32\Rundll32.exe
H:\Program Files\Skype\Phone\Skype.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\system32\wscntfy.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Skype\Plugin Manager\skypePM.exe
H:\Program Files\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O3 - Toolbar: Tildes Birojs - {1E6700F0-0F85-40fd-8022-7EB60AB46F10} - H:\Program Files\Tildes Birojs 2008\IEjosla.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Pianists] "H:\Program Files\Tildes Birojs 2008\Pianists.exe" /START
O4 - HKLM\..\Run: [mdiction] "H:\Program Files\Tildes Birojs 2008\mdiction.exe" /startup
O4 - HKLM\..\Run: [000000af] rundll32.exe "H:\WINDOWS\system32\gmcybrma.dll",b
O4 - HKLM\..\Run: [WheelMouse] H:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [GEST] m‘|P?
O4 - HKLM\..\Run: [ASUSGamerOSD] H:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BMff2fb25a] Rundll32.exe "H:\WINDOWS\system32\kxbcndlv.dll",s
O4 - HKCU\..\Run: [Skype] "H:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Steam] "H:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [MSMSGS] "H:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "H:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Tulkot ar Tildes Datorvārdnīcu - res://H:\Program Files\Tildes Birojs 2008\TDVLauncher.DLL /201
O8 - Extra context menu item: T&ulkot ar Tildes Tulkotāju - H:\Program Files\Tildes Birojs 2008\LaunchMTS.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - H:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\31E6481A7A624C39BB43E8BF6390376C\Skype4COM.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - H:\WINDOWS\ATKKBService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5211 bytes
ken545
2008-09-26, 15:30
Good Morning,

Thanks for the new log, I also just wanted to make you aware that malware writers are using File Sharing as there latest avenue of attack so I would really shy away from any programs like that.

Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

O4 - HKLM\..\Run: [000000af] rundll32.exe "H:\WINDOWS\system32\gmcybrma.dll",b
O4 - HKLM\..\Run: Rundll32.exe "H:\WINDOWS\system32\kxbcndlv.dll",s





Please download Malwarebytes' Anti-Malware from Here (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html) or Here (http://www.besttechie.net/tools/mbam-setup.exe)

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
[b]Make sure that everything is checked, and click Remove Selected.<-- Don't forget this
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and Paste the entire report in your next reply along with a New Hijackthis log.
wastabee
2008-09-26, 17:07
The computer is working fine for now. Here is the MBAM log.

Malwarebytes' Anti-Malware 1.28
Database version: 1209
Windows 5.1.2600 Service Pack 2

2008.09.26. 16:56:31
mbam-log-2008-09-26 (16-56-31).txt

Scan type: Quick Scan
Objects scanned: 52546
Time elapsed: 3 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 5
Registry Keys Infected: 14
Registry Values Infected: 2
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 24

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
H:\WINDOWS\system32\gmcybrma.dll (Trojan.Vundo.H) -> Delete on reboot.
H:\WINDOWS\system32\ljJDVnli.dll (Trojan.Vundo.H) -> Delete on reboot.
H:\WINDOWS\system32\kxbcndlv.dll (Trojan.Vundo) -> Delete on reboot.
H:\WINDOWS\system32\vtUlJyvT.dll (Trojan.Vundo) -> Delete on reboot.
H:\WINDOWS\system32\winosz32.dll (Dialer) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vtuljyvt (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{89ae82b2-9021-4e77-8e6f-9dc1c6381ad2} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{89ae82b2-9021-4e77-8e6f-9dc1c6381ad2} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winosz32 (Dialer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantin


And here is the HiJackThis log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:05:12, on 2008.09.26.
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\Explorer.EXE
H:\WINDOWS\system32\RUNDLL32.EXE
H:\Program Files\Tildes Birojs 2008\Pianists.exe
H:\Program Files\A4Tech\Mouse\Amoumain.exe
H:\WINDOWS\system32\rundll32.exe
H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
H:\WINDOWS\RTHDCPL.EXE
H:\Program Files\ASUS\GamerOSD\GamerOSD.exe
H:\Program Files\Skype\Phone\Skype.exe
H:\WINDOWS\ATKKBService.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\system32\wscntfy.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Skype\Plugin Manager\skypePM.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\Program Files\HiJackThis\HiJackThis.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Tildes Birojs - {1E6700F0-0F85-40fd-8022-7EB60AB46F10} - H:\Program Files\Tildes Birojs 2008\IEjosla.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - H:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Tildes Birojs - {1E6700F0-0F85-40fd-8022-7EB60AB46F10} - H:\Program Files\Tildes Birojs 2008\IEjosla.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Pianists] "H:\Program Files\Tildes Birojs 2008\Pianists.exe" /START
O4 - HKLM\..\Run: [mdiction] "H:\Program Files\Tildes Birojs 2008\mdiction.exe" /startup
O4 - HKLM\..\Run: [WheelMouse] H:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [GEST] m‘|P?
O4 - HKLM\..\Run: [ASUSGamerOSD] H:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Skype] "H:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Steam] "H:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [MSMSGS] "H:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "H:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Tulkot ar Tildes Datorvārdnīcu - res://H:\Program Files\Tildes Birojs 2008\TDVLauncher.DLL /201
O8 - Extra context menu item: T&ulkot ar Tildes Tulkotāju - H:\Program Files\Tildes Birojs 2008\LaunchMTS.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - H:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\31E6481A7A624C39BB43E8BF6390376C\Skype4COM.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - H:\WINDOWS\ATKKBService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5643 bytes

Everything is great.
I THANK YOU SO MUCH!
ken545
2008-09-26, 17:40
Hi,

Thats great but we may not be done. It looks like you did not post the entire Malwarebytes log??

Do you know what this is ???? Do you have a Gigabite motherboard on this system ??
O4 - HKLM\..\Run: [GEST] m‘|P?



Please download ATF Cleaner (http://www.atribune.org/ccount/click.php?id=1) by Atribune to your desktop.

This program is for XP and Windows 2000 only
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
Please note: If you use online banking or are registered online with any other organizations, ensure you have memorized password and other personal information as removing cookies will temporarily disable the auto-login facility.




Download random's system information tool (RSIT) by random/random from here (http://images.malwareremoval.com/random/RSIT.exe) and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)
wastabee
2008-09-26, 17:59
Yes, i do have a gigabite motherboard.

info.txt logfile of random's system information tool 1.02 2008-09-26 17:56:35

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 H:\WINDOWS\INF\PCHealth.inf
Acrobat.com-->H:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe -uninstall com.adobe.mauby 4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
Acrobat.com-->MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07}
Adobe AIR-->H:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{00203668-8170-44A0-BE44-B632FA4D780F}
Adobe Flash Player ActiveX-->H:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin-->H:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A90000000001}
Assassin's Creed-->H:\Program Files\InstallShield Installation Information\{8CFA9151-6404-409A-AF22-4632D04582FD}\setup.exe -runfromtemp -l0x0009 -removeonly
ASUS Gamer OSD-->RunDll32 H:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "H:\Program Files\InstallShield Installation Information\{315ACD04-BCEB-478B-9B1D-5431D0E6CB11}\setup.exe" -l0x9 -removeonly
ASUS Smart Doctor-->H:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{12E11FBB-7CA6-4A86-834D-5E6390D51009} /l1033
ASUS VideoSecurity Online-->H:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{7A529246-912F-4C40-A82A-E608DB702FD7}
CABAL Online v3.3-->"H:\Program Files\Games-Masters.com\CABAL Online (Europe)\unins000.exe"
Canon i250-->H:\WINDOWS\system32\CNMCP50.exe "-PRINTERNAMECanon i250" "-HELPERDLLH:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon i250 Installer\Inst2\cnmis.dll" "-RCDLLcnmi0409.dll"
Counter-Strike 1.6-->RunDll32 H:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\00\Intel32\Ctor.dll,LaunchSetup "H:\Program Files\InstallShield Installation Information\{9ABFB92D-93DA-49EE-8ABF-F8195DE45CA9}\Setup.exe" -l0x9
DEVIL MAY CRY 4-->MsiExec.exe /I{D4E5A687-797D-44B1-8F96-4FD7A24166A9}
Hellgate: London-->MsiExec.exe /X{A2B4455D-1046-4732-BFBC-0821BEFC07BC}
High Definition Audio Driver Package - KB888111-->"H:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"H:\Documents and Settings\Ritvars\Desktop\HijackThis.exe" /uninstall
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Malwarebytes' Anti-Malware-->"H:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 2.0-->H:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft .NET Framework 3.0-->H:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setup.exe
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
mIRC-->H:\Program Files\mIRC\uninstall.exe _?=H:\Program Files\mIRC
Mozilla Firefox (3.0.1)-->H:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 6.0 Parser (KB925673)-->MsiExec.exe /I{FE9126DB-5F84-495A-BB46-3C724F1C2D08}
NVIDIA Drivers-->H:\WINDOWS\system32\nvudisp.exe UninstallGUI
REALTEK GbE & FE Ethernet PCI-E NIC Driver-->H:\Program Files\InstallShield Installation Information\{C9BED750-1211-4480-B1A5-718A3BE15525}\SETUP.EXE -runfromtemp -l0x0009 -removeonly
Realtek High Definition Audio Driver-->RunDll32 H:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "H:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\SETUP.EXE" -l0x9 -removeonly
Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Smart-X7 7.72-->H:\Program Files\A4Tech\Mouse\Uninst32.exe
Spybot - Search & Destroy-->"H:\Program Files\Spybot - Search & Destroy\unins000.exe"
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
TeamViewer 3-->H:\Program Files\TeamViewer3\uninstall.exe
Tildes Birojs 2008-->MsiExec.exe /I{7AECE063-3FFC-45BA-8B91-01E7E52EB2C0}
Windows Communication Foundation-->MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333}
Windows Imaging Component-->"H:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Installer 3.1 (KB893803)-->"H:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation-->MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}
WinRAR archiver-->H:\Program Files\WinRAR\uninstall.exe
XviD MPEG-4 Video Codec-->H:\WINDOWS\system32\rundll32.exe setupapi,InstallHinfSection Remove_XviD 132 H:\WINDOWS\INF\xvid.inf

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_REVISION"=0f0d
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"HellgateEnv"=H:\Program Files\Flagship Studios\Hellgate London\

-----------------EOF-----------------

The log


Logfile of random's system information tool 1.02 (written by random/random)
Run by Ritvars at 2008-09-26 17:56:24
Microsoft Windows XP Professional Service Pack 2
System drive H: has 632 GB (88%) free of 715 GB
Total RAM: 3070 MB (83% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:56:33, on 2008.09.26.
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\Explorer.EXE
H:\WINDOWS\system32\RUNDLL32.EXE
H:\Program Files\Tildes Birojs 2008\Pianists.exe
H:\Program Files\A4Tech\Mouse\Amoumain.exe
H:\WINDOWS\system32\rundll32.exe
H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
H:\WINDOWS\RTHDCPL.EXE
H:\Program Files\ASUS\GamerOSD\GamerOSD.exe
H:\Program Files\Skype\Phone\Skype.exe
H:\WINDOWS\ATKKBService.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\system32\wscntfy.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Skype\Plugin Manager\skypePM.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\Documents and Settings\Ritvars\Desktop\RSIT.exe
H:\Program Files\HiJackThis\Ritvars.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Tildes Birojs - {1E6700F0-0F85-40fd-8022-7EB60AB46F10} - H:\Program Files\Tildes Birojs 2008\IEjosla.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - H:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Tildes Birojs - {1E6700F0-0F85-40fd-8022-7EB60AB46F10} - H:\Program Files\Tildes Birojs 2008\IEjosla.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Pianists] "H:\Program Files\Tildes Birojs 2008\Pianists.exe" /START
O4 - HKLM\..\Run: [mdiction] "H:\Program Files\Tildes Birojs 2008\mdiction.exe" /startup
O4 - HKLM\..\Run: [WheelMouse] H:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [GEST] m‘|P?
O4 - HKLM\..\Run: [ASUSGamerOSD] H:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Skype] "H:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Steam] "H:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [MSMSGS] "H:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "H:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Tulkot ar Tildes Datorvārdnīcu - res://H:\Program Files\Tildes Birojs 2008\TDVLauncher.DLL /201
O8 - Extra context menu item: T&ulkot ar Tildes Tulkotāju - H:\Program Files\Tildes Birojs 2008\LaunchMTS.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - H:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\31E6481A7A624C39BB43E8BF6390376C\Skype4COM.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - H:\WINDOWS\ATKKBService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5692 bytes

======Scheduled tasks folder======

H:\WINDOWS\tasks\Tilde automatic update.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E6700F0-0F85-40fd-8022-7EB60AB46F10}]
Tildes Birojs - H:\Program Files\Tildes Birojs 2008\IEjosla.dll [2008-02-07 541944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - H:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-08-11 1443112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - H:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-08-14 1562448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{1E6700F0-0F85-40fd-8022-7EB60AB46F10} - Tildes Birojs - H:\Program Files\Tildes Birojs 2008\IEjosla.dll [2008-02-07 541944]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=H:\WINDOWS\system32\NvCpl.dll [2007-09-16 8491008]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=H:\WINDOWS\system32\NvMcTray.dll [2007-09-16 81920]
"Pianists"=H:\Program Files\Tildes Birojs 2008\Pianists.exe [2007-12-21 177400]
"mdiction"=H:\Program Files\Tildes Birojs 2008\mdiction.exe [2008-02-12 193784]
"WheelMouse"=H:\Program Files\A4Tech\Mouse\Amoumain.exe [2006-02-17 163840]
"SunJavaUpdateSched"=H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"RTHDCPL"=H:\WINDOWS\RTHDCPL.EXE [2008-02-13 16857600]
"GEST"=m‘|P? []
"ASUSGamerOSD"=H:\Program Files\ASUS\GamerOSD\GamerOSD.exe [2007-09-13 380928]
"Alcmtr"=H:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"Adobe Reader Speed Launcher"=H:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=H:\Program Files\Skype\Phone\Skype.exe [2008-08-11 21741864]
"Steam"=H:\Program Files\Steam\Steam.exe [2008-09-20 1271032]
"MSMSGS"=H:\Program Files\Messenger\msmsgs.exe [2004-08-04 1667584]
"DAEMON Tools Lite"=H:\Program Files\DAEMON Tools Lite\daemon.exe [2008-08-08 490952]
"ASUS SmartDoctor"=C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - H:\WINDOWS\system32\upnpui.dll [2004-08-04 239616]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"H:\Program Files\BitComet\BitComet.exe"="H:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"H:\Program Files\Valve\hl.exe"="H:\Program Files\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"H:\Program Files\mIRC\mirc.exe"="H:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC"
"H:\Program Files\RevConnect\DCPlusPlus.exe"="H:\Program Files\RevConnect\DCPlusPlus.exe:*:Enabled:DC++"
"H:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe"="H:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:*:Enabled:Assassin's Creed Dx9"
"H:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe"="H:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:*:Enabled:Assassin's Creed Dx10"
"H:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe"="H:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:*:Enabled:Assassin's Creed Update"
"H:\Program Files\Flagship Studios\Hellgate London\Launcher.exe"="H:\Program Files\Flagship Studios\Hellgate London\Launcher.exe:*:Enabled:Hellgate: London"
"H:\Program Files\Skype\Phone\Skype.exe"="H:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
shell\AutoRun\command - G:\setup.exe


======List of files/folders created in the last 1 months======

2008-09-26 17:56:24 ----D---- H:\rsit
2008-09-26 16:56:48 ----A---- H:\WINDOWS\system32\amrbycmg.tmp
2008-09-26 16:37:26 ----D---- H:\Documents and Settings\Ritvars\Application Data\Malwarebytes
2008-09-26 16:37:16 ----D---- H:\Program Files\Malwarebytes' Anti-Malware
2008-09-26 16:37:16 ----D---- H:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-26 13:22:27 ----D---- H:\Program Files\HiJackThis
2008-09-23 18:29:47 ----D---- H:\WINDOWS\pss
2008-09-22 16:57:11 ----D---- H:\Documents and Settings\Ritvars\Application Data\TeamViewer
2008-09-22 16:57:02 ----D---- H:\Program Files\TeamViewer3
2008-09-22 15:38:58 ----A---- H:\WINDOWS\wininit.ini
2008-09-22 14:52:58 ----D---- H:\Program Files\Spybot - Search & Destroy
2008-09-22 14:52:58 ----D---- H:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-21 23:38:50 ----SHD---- H:\Config.Msi
2008-09-21 17:28:43 ----ASH---- H:\WINDOWS\system32\snshkaqs.ini
2008-09-21 11:23:28 ----ASH---- H:\WINDOWS\system32\fhnnootc.ini
2008-09-21 11:22:38 ----A---- H:\WINDOWS\system32\0b23c5f2-.txt
2008-09-21 11:13:10 ----D---- H:\Documents and Settings\Ritvars\Application Data\Symantec
2008-09-21 11:09:14 ----D---- H:\Documents and Settings\All Users\Application Data\Symantec
2008-09-21 11:09:03 ----A---- H:\WINDOWS\IsUninst.exe
2008-09-21 11:08:44 ----D---- H:\Program Files\Common Files\Symantec Shared
2008-09-20 09:12:08 ----D---- H:\Program Files\Steam
2008-09-20 08:58:16 ----D---- H:\Program Files\TF2
2008-09-19 17:46:34 ----D---- H:\Program Files\A4Tech
2008-09-19 17:34:39 ----D---- H:\WINDOWS\Sun
2008-09-19 17:34:39 ----D---- H:\Documents and Settings\Ritvars\Application Data\Sun
2008-09-19 07:44:48 ----D---- H:\Documents and Settings\Ritvars\Application Data\Help
2008-09-18 20:14:43 ----A---- H:\WINDOWS\system32\javaws.exe
2008-09-18 20:14:43 ----A---- H:\WINDOWS\system32\javaw.exe
2008-09-18 20:14:43 ----A---- H:\WINDOWS\system32\java.exe
2008-09-18 20:14:24 ----D---- H:\Program Files\Java
2008-09-18 20:12:46 ----D---- H:\Program Files\Common Files\Java
2008-09-17 18:56:12 ----D---- H:\Documents and Settings\Ritvars\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-09-17 18:52:08 ----D---- H:\Program Files\Common Files\Adobe AIR
2008-09-17 18:51:46 ----D---- H:\Documents and Settings\All Users\Application Data\Adobe
2008-09-17 18:51:41 ----D---- H:\Program Files\Common Files\Adobe
2008-09-17 18:51:41 ----D---- H:\Program Files\Adobe
2008-09-17 18:47:35 ----D---- H:\Program Files\NOS
2008-09-17 18:47:35 ----D---- H:\Documents and Settings\All Users\Application Data\NOS
2008-09-17 18:44:27 ----D---- H:\Documents and Settings\All Users\Application Data\Musicnotes
2008-09-15 13:25:42 ----D---- H:\WINDOWS\system32\LogFiles
2008-09-14 19:10:42 ----D---- H:\Temp
2008-09-14 19:10:42 ----A---- H:\WINDOWS\i250_2KXP_v170 Setup Log.txt
2008-09-14 19:02:56 ----A---- H:\WINDOWS\system32\CNMVS50.DLL
2008-09-14 19:02:56 ----A---- H:\WINDOWS\system32\CNMLM50.DLL
2008-09-14 19:02:54 ----A---- H:\WINDOWS\system32\CNMCP50.exe
2008-09-14 19:02:53 ----HD---- H:\Documents and Settings\All Users\Application Data\CanonBJ
2008-09-12 23:02:36 ----D---- H:\WINDOWS\Minidump
2008-09-09 22:07:12 ----A---- H:\WINDOWS\system32\d3dx10_34.dll
2008-09-09 22:07:12 ----A---- H:\WINDOWS\system32\D3DCompiler_34.dll
2008-09-09 22:07:11 ----A---- H:\WINDOWS\system32\d3dx9_34.dll
2008-09-09 22:02:42 ----D---- H:\Program Files\Flagship Studios
2008-09-07 10:25:44 ----D---- H:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-09-06 00:24:23 ----D---- H:\Program Files\Common Files\INCA Shared
2008-09-05 23:13:10 ----D---- H:\Program Files\Games-Masters.com
2008-09-05 23:12:11 ----D---- H:\Program Files\Cabal
2008-09-04 14:08:56 ----D---- H:\Documents and Settings\Ritvars\Application Data\Ubisoft
2008-09-04 14:08:31 ----A---- H:\WINDOWS\d3dx9_36.dll
2008-09-04 14:04:57 ----D---- H:\Documents and Settings\All Users\Application Data\Ubisoft
2008-09-04 13:58:27 ----D---- H:\Program Files\Ubisoft
2008-09-03 10:25:14 ----A---- H:\WINDOWS\system32\CmdLineExt.dll
2008-09-03 10:25:01 ----A---- H:\WINDOWS\d3dx9_33.dll
2008-09-03 10:24:43 ----A---- H:\WINDOWS\xinput1_3.dll
2008-09-03 10:10:24 ----A---- H:\WINDOWS\ntbtlog.txt
2008-09-03 09:44:29 ----D---- H:\Program Files\CAPCOM
2008-09-03 09:43:21 ----D---- H:\WINDOWS\Logs
2008-09-03 09:28:11 ----D---- H:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2008-09-03 09:22:47 ----D---- H:\WINDOWS\system32\appmgmt
2008-09-02 20:59:58 ----A---- H:\WINDOWS\flag.ini
2008-09-02 20:31:01 ----D---- H:\WINDOWS\speech
2008-09-02 20:28:34 ----D---- H:\Program Files\Tildes Birojs 2008
2008-09-02 20:28:34 ----D---- H:\Program Files\Common Files\Tilde Shared
2008-09-02 20:24:00 ----D---- H:\Program Files\MSBuild
2008-09-02 20:05:02 ----D---- H:\WINDOWS\system32\XPSViewer
2008-09-02 20:05:00 ----D---- H:\WINDOWS\system32\en-us
2008-09-02 20:04:38 ----D---- H:\Program Files\Reference Assemblies
2008-09-02 20:04:23 ----A---- H:\WINDOWS\system32\spmsg2.dll
2008-09-02 20:01:15 ----HDC---- H:\WINDOWS\$MSI31Uninstall_KB893803v2$
2008-09-02 20:00:45 ----RSD---- H:\WINDOWS\assembly
2008-09-02 20:00:26 ----D---- H:\WINDOWS\Microsoft.NET
2008-09-02 20:00:09 ----A---- H:\WINDOWS\system32\spmsg.dll
2008-09-02 20:00:06 ----HDC---- H:\WINDOWS\$NtUninstallWIC$
2008-09-02 14:09:04 ----D---- H:\Downloads
2008-09-02 11:17:07 ----D---- H:\Documents and Settings\Ritvars\Application Data\WinRAR
2008-09-02 11:09:33 ----A---- H:\WINDOWS\War3Unin.exe
2008-09-02 11:08:10 ----D---- H:\Program Files\Warcraft III
2008-09-02 11:06:35 ----D---- H:\Warcrafta faili
2008-09-02 11:05:33 ----D---- H:\Program Files\WinRAR
2008-09-02 11:03:33 ----D---- H:\Program Files\DAEMON Tools Lite
2008-09-02 11:02:00 ----D---- H:\Documents and Settings\Ritvars\Application Data\DAEMON Tools
2008-09-02 09:31:13 ----D---- H:\Program Files\mIRC
2008-09-02 09:31:13 ----D---- H:\Documents and Settings\Ritvars\Application Data\mIRC
2008-09-02 08:47:30 ----D---- H:\Program Files\BitComet
2008-09-01 20:04:18 ----D---- H:\Program Files\Valve
2008-09-01 18:52:27 ----D---- H:\Documents and Settings\Ritvars\Application Data\Macromedia
2008-09-01 18:52:27 ----D---- H:\Documents and Settings\Ritvars\Application Data\Adobe
2008-09-01 18:51:00 ----D---- H:\Documents and Settings\Ritvars\Application Data\Mozilla
2008-09-01 18:50:57 ----D---- H:\Program Files\Mozilla Firefox
2008-09-01 18:37:20 ----D---- H:\Documents and Settings\Ritvars\Application Data\skypePM
2008-09-01 18:36:48 ----D---- H:\Documents and Settings\Ritvars\Application Data\Skype
2008-09-01 18:36:39 ----D---- H:\Program Files\Skype
2008-09-01 18:36:39 ----D---- H:\Program Files\Common Files\Skype
2008-09-01 18:36:35 ----D---- H:\Documents and Settings\All Users\Application Data\Skype
2008-09-01 18:36:14 ----D---- H:\Program Files\RevConnect
2008-08-30 17:01:13 ----A---- H:\WINDOWS\system32\h323log.txt
2008-08-30 12:41:47 ----D---- H:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-08-30 12:39:53 ----SHD---- H:\RECYCLER
2008-08-30 10:05:01 ----A---- H:\WINDOWS\system32\xinput1_2.dll
2008-08-30 10:05:01 ----A---- H:\WINDOWS\system32\xinput1_1.dll
2008-08-30 10:05:01 ----A---- H:\WINDOWS\system32\xactengine2_3.dll
2008-08-30 10:05:01 ----A---- H:\WINDOWS\system32\xactengine2_2.dll
2008-08-30 10:05:00 ----A---- H:\WINDOWS\system32\xactengine2_1.dll
2008-08-30 10:05:00 ----A---- H:\WINDOWS\system32\xactengine2_0.dll
2008-08-30 10:05:00 ----A---- H:\WINDOWS\system32\x3daudio1_0.dll
2008-08-30 10:05:00 ----A---- H:\WINDOWS\system32\d3dx9_30.dll
2008-08-30 10:05:00 ----A---- H:\WINDOWS\system32\d3dx9_29.dll
2008-08-30 10:04:59 ----A---- H:\WINDOWS\system32\xinput9_1_0.dll
2008-08-30 10:04:59 ----A---- H:\WINDOWS\system32\d3dx9_28.dll
2008-08-30 10:04:59 ----A---- H:\WINDOWS\system32\d3dx9_27.dll
2008-08-30 10:04:59 ----A---- H:\WINDOWS\system32\d3dx9_26.dll
2008-08-30 10:04:58 ----A---- H:\WINDOWS\system32\d3dx9_25.dll
2008-08-30 10:04:58 ----A---- H:\WINDOWS\system32\d3dx9_24.dll
2008-08-30 10:04:20 ----A---- H:\WINDOWS\system32\vfwwdm32.dll
2008-08-30 10:04:03 ----A---- H:\WINDOWS\nvgpio.dll
2008-08-30 10:04:03 ----A---- H:\WINDOWS\nVGA_i2c.dll
2008-08-30 10:04:03 ----A---- H:\WINDOWS\nvapi9x.dll
2008-08-30 10:04:03 ----A---- H:\WINDOWS\i2c_i.dll
2008-08-30 10:04:03 ----A---- H:\WINDOWS\i2c.dll
2008-08-30 10:04:03 ----A---- H:\WINDOWS\ATKKBService.exe
2008-08-30 10:04:02 ----D---- H:\Program Files\ASUS
2008-08-30 10:04:02 ----A---- H:\WINDOWS\system32\ATKOSDMini.DLL
2008-08-30 10:04:02 ----A---- H:\WINDOWS\system32\atkid.ini
2008-08-30 10:04:02 ----A---- H:\WINDOWS\R5ClkLib.dll
2008-08-30 10:04:02 ----A---- H:\WINDOWS\OneTouchVga.dll
2008-08-30 10:04:02 ----A---- H:\WINDOWS\HyperDrive.exe
2008-08-30 10:04:02 ----A---- H:\WINDOWS\EIO.dll
2008-08-30 10:04:02 ----A---- H:\WINDOWS\atistclk.dll
2008-08-30 10:04:02 ----A---- H:\WINDOWS\atipdlxx.dll
2008-08-30 10:04:02 ----A---- H:\WINDOWS\aticlocklib.dll
2008-08-30 10:04:02 ----A---- H:\WINDOWS\ASUSRC.dll
2008-08-30 10:04:02 ----A---- H:\WINDOWS\ASMT_CE.dll
2008-08-30 10:04:01 ----A---- H:\WINDOWS\system32\xvidvfw.dll
2008-08-30 10:04:01 ----A---- H:\WINDOWS\system32\xvidcore.dll
2008-08-30 10:04:01 ----A---- H:\WINDOWS\system32\msvcr71.dll
2008-08-30 10:04:01 ----A---- H:\WINDOWS\system32\DPInst.exe
2008-08-30 10:04:01 ----A---- H:\WINDOWS\system32\devcon.exe
2008-08-30 10:04:01 ----A---- H:\WINDOWS\system32\ATKDispCPL.dll
2008-08-30 10:04:01 ----A---- H:\WINDOWS\system32\ATKDISP.dll
2008-08-30 10:04:01 ----A---- H:\WINDOWS\system32\asrussian.dll
2008-08-30 10:04:01 ----A---- H:\WINDOWS\system32\askorean.dll
2008-08-30 10:04:01 ----A---- H:\WINDOWS\system32\asjapan.dll
2008-08-30 10:04:01 ----A---- H:\WINDOWS\system32\asgerman.dll
2008-08-30 10:04:01 ----A---- H:\WINDOWS\system32\asfrench.dll
2008-08-30 10:04:01 ----A---- H:\WINDOWS\system32\aseng.dll
2008-08-30 10:04:01 ----A---- H:\WINDOWS\system32\aschs.dll
2008-08-30 10:04:00 ----A---- H:\WINDOWS\system32\ATKOSDX32.dll
2008-08-30 10:04:00 ----A---- H:\WINDOWS\system32\ATKOGL32.dll
2008-08-30 10:04:00 ----A---- H:\WINDOWS\system32\ASCHT.dll
2008-08-30 10:03:39 ----D---- H:\WINDOWS\nview
2008-08-30 10:03:39 ----A---- H:\WINDOWS\system32\nvudisp.exe
2008-08-30 10:02:55 ----A---- H:\WINDOWS\system32\NVUNINST.EXE
2008-08-30 09:45:30 ----D---- H:\WINDOWS\OPTIONS
2008-08-30 09:45:24 ----D---- H:\Documents and Settings\Ritvars\Application Data\InstallShield
2008-08-30 09:45:10 ----D---- H:\WINDOWS\system32\Lang
2008-08-30 09:44:01 ----RA---- H:\WINDOWS\system32\ChCfg.exe
2008-08-30 09:43:43 ----D---- H:\WINDOWS\system32\RTCOM
2008-08-30 09:43:41 ----A---- H:\WINDOWS\system32\ksuser.dll
2008-08-30 09:43:36 ----R---- H:\WINDOWS\SoundMan.exe
2008-08-30 09:43:35 ----R---- H:\WINDOWS\SkyTel.exe
2008-08-30 09:43:35 ----R---- H:\WINDOWS\RtlUpd.exe
2008-08-30 09:43:34 ----R---- H:\WINDOWS\RTLCPL.exe
2008-08-30 09:43:31 ----R---- H:\WINDOWS\RTHDCPL.exe
2008-08-30 09:43:30 ----R---- H:\WINDOWS\MicCal.exe
2008-08-30 09:43:29 ----R---- H:\WINDOWS\Alcmtr.exe
2008-08-30 09:43:28 ----R---- H:\WINDOWS\alcwzrd.exe
2008-08-30 09:43:28 ----D---- H:\Program Files\Realtek
2008-08-30 09:43:27 ----HD---- H:\Program Files\InstallShield Installation Information
2008-08-30 09:43:26 ----R---- H:\WINDOWS\RtlExUpd.dll
2008-08-30 09:43:26 ----A---- H:\WINDOWS\HideWin.exe
2008-08-30 09:43:22 ----D---- H:\Program Files\Common Files\InstallShield
2008-08-30 09:43:09 ----A---- H:\WINDOWS\system32\spupdsvc.exe
2008-08-30 09:43:08 ----HDC---- H:\WINDOWS\$NtUninstallKB888111WXPSP2$
2008-08-30 09:41:09 ----D---- H:\WINDOWS\system32\ReinstallBackups
2008-08-30 09:41:07 ----RA---- H:\WINDOWS\system32\CSVer.dll
2008-08-30 09:41:07 ----DC---- H:\WINDOWS\system32\DRVSTORE
2008-08-30 09:41:07 ----D---- H:\Program Files\Intel
2008-08-30 09:41:02 ----D---- H:\Intel
2008-08-30 09:27:40 ----D---- H:\Documents and Settings\Ritvars\Application Data\Identities
2008-08-30 09:27:38 ----HD---- H:\Program Files\Uninstall Information
2008-08-30 09:27:34 ----ASH---- H:\Documents and Settings\Ritvars\Application Data\desktop.ini
2008-08-30 09:27:33 ----SD---- H:\Documents and Settings\Ritvars\Application Data\Microsoft
2008-08-30 09:23:02 ----D---- H:\WINDOWS\SoftwareDistribution
2008-08-30 09:23:01 ----SD---- H:\WINDOWS\system32\Microsoft
2008-08-30 09:23:01 ----D---- H:\WINDOWS\Prefetch
2008-08-30 09:23:01 ----A---- H:\WINDOWS\SchedLgU.Txt
2008-08-30 09:20:31 ----D---- H:\WINDOWS\system32\xircom
2008-08-30 09:20:31 ----D---- H:\Program Files\xerox
2008-08-30 09:20:31 ----D---- H:\Program Files\microsoft frontpage
2008-08-30 09:20:12 ----A---- H:\WINDOWS\control.ini
2008-08-30 09:20:03 ----A---- H:\WINDOWS\OEWABLog.txt
2008-08-30 09:19:59 ----A---- H:\WINDOWS\system32\mapi32.dll
2008-08-30 09:19:19 ----RD---- H:\WINDOWS\Offline Web Pages
2008-08-30 09:19:18 ----SD---- H:\WINDOWS\Downloaded Program Files
2008-08-30 09:19:18 ----RAH---- H:\WINDOWS\system32\logonui.exe.manifest
2008-08-30 09:19:14 ----RAH---- H:\WINDOWS\system32\cdplayer.exe.manifest
2008-08-30 09:19:10 ----HD---- H:\Program Files\WindowsUpdate
2008-08-30 09:18:54 ----D---- H:\WINDOWS\system32\DirectX
2008-08-30 09:18:38 ----A---- H:\WINDOWS\system32\atrace.dll
2008-08-30 09:18:36 ----A---- H:\WINDOWS\system32\desktop.ini
2008-08-30 09:18:36 ----A---- H:\WINDOWS\desktop.ini
2008-08-30 09:18:31 ----A---- H:\WINDOWS\system32\nmevtmsg.dll
2008-08-30 09:18:29 ----D---- H:\Program Files\Common Files\Services
2008-08-30 09:18:29 ----A---- H:\WINDOWS\system32\acctres.dll
2008-08-30 09:18:27 ----SD---- H:\WINDOWS\Tasks
2008-08-30 09:18:27 ----A---- H:\WINDOWS\system32\icfgnt5.dll
2008-08-30 09:18:26 ----D---- H:\Program Files\Common Files\MSSoap
2008-08-30 09:18:23 ----D---- H:\WINDOWS\system32\Macromed
2008-08-30 09:18:23 ----D---- H:\WINDOWS\srchasst
2008-08-30 09:18:20 ----A---- H:\WINDOWS\system32\wuweb.dll
2008-08-30 09:18:20 ----A---- H:\WINDOWS\system32\wups.dll
2008-08-30 09:18:20 ----A---- H:\WINDOWS\system32\wucltui.dll
2008-08-30 09:18:20 ----A---- H:\WINDOWS\system32\wuauserv.dll
2008-08-30 09:18:20 ----A---- H:\WINDOWS\system32\wuaueng1.dll
2008-08-30 09:18:20 ----A---- H:\WINDOWS\system32\wuaueng.dll
2008-08-30 09:18:20 ----A---- H:\WINDOWS\system32\wuauclt1.exe
2008-08-30 09:18:20 ----A---- H:\WINDOWS\system32\wuauclt.exe
2008-08-30 09:18:19 ----A---- H:\WINDOWS\system32\wuapi.dll
2008-08-30 09:18:19 ----A---- H:\WINDOWS\system32\qmgrprxy.dll
2008-08-30 09:18:19 ----A---- H:\WINDOWS\system32\qmgr.dll
2008-08-30 09:18:19 ----A---- H:\WINDOWS\system32\bitsprx3.dll
2008-08-30 09:18:19 ----A---- H:\WINDOWS\system32\bitsprx2.dll
2008-08-30 09:18:16 ----D---- H:\Program Files\Movie Maker
2008-08-30 09:18:13 ----A---- H:\WINDOWS\system32\safrslv.dll
2008-08-30 09:18:13 ----A---- H:\WINDOWS\system32\safrdm.dll
2008-08-30 09:18:13 ----A---- H:\WINDOWS\system32\safrcdlg.dll
2008-08-30 09:18:13 ----A---- H:\WINDOWS\system32\racpldlg.dll
2008-08-30 09:18:10 ----A---- H:\WINDOWS\system32\fltMc.exe
2008-08-30 09:18:10 ----A---- H:\WINDOWS\system32\fltlib.dll
2008-08-30 09:18:09 ----D---- H:\WINDOWS\system32\Restore
2008-08-30 09:18:09 ----A---- H:\WINDOWS\system32\srsvc.dll
2008-08-30 09:18:09 ----A---- H:\WINDOWS\system32\srrstr.dll
2008-08-30 09:18:09 ----A---- H:\WINDOWS\system32\srclient.dll
2008-08-30 09:18:09 ----A---- H:\WINDOWS\system32\mnmdd.dll
2008-08-30 09:18:09 ----A---- H:\WINDOWS\system32\isrdbg32.dll
2008-08-30 09:18:09 ----A---- H:\WINDOWS\system32\ils.dll
2008-08-30 09:18:08 ----A---- H:\WINDOWS\system32\nmmkcert.dll
2008-08-30 09:18:08 ----A---- H:\WINDOWS\system32\msconf.dll
2008-08-30 09:18:08 ----A---- H:\WINDOWS\system32\mnmsrvc.exe
2008-08-30 09:18:06 ----D---- H:\Program Files\NetMeeting
2008-08-30 09:18:06 ----A---- H:\WINDOWS\system32\msoert2.dll
2008-08-30 09:18:06 ----A---- H:\WINDOWS\system32\msoeacct.dll
2008-08-30 09:18:05 ----A---- H:\WINDOWS\system32\inetres.dll
2008-08-30 09:18:05 ----A---- H:\WINDOWS\system32\inetcomm.dll
2008-08-30 09:18:04 ----D---- H:\Program Files\Outlook Express
2008-08-30 09:18:04 ----A---- H:\WINDOWS\system32\schedsvc.dll
2008-08-30 09:18:04 ----A---- H:\WINDOWS\system32\mstinit.exe
2008-08-30 09:18:04 ----A---- H:\WINDOWS\system32\mstask.dll
2008-08-30 09:18:03 ----A---- H:\WINDOWS\system32\isign32.dll
2008-08-30 09:18:03 ----A---- H:\WINDOWS\system32\inetcfg.dll
2008-08-30 09:18:03 ----A---- H:\WINDOWS\system32\icwphbk.dll
2008-08-30 09:18:03 ----A---- H:\WINDOWS\system32\icwdial.dll
2008-08-30 09:17:58 ----D---- H:\Program Files\Internet Explorer
2008-08-30 09:17:58 ----D---- H:\Program Files\Common Files\System
2008-08-30 09:17:29 ----D---- H:\Program Files\ComPlus Applications
2008-08-30 09:17:27 ----A---- H:\WINDOWS\vbaddin.ini
2008-08-30 09:17:27 ----A---- H:\WINDOWS\vb.ini
2008-08-30 09:17:23 ----D---- H:\WINDOWS\Registration
2008-08-30 09:17:17 ----D---- H:\Program Files\Windows Media Player
2008-08-30 09:17:17 ----D---- H:\Program Files\Online Services
2008-08-30 09:17:11 ----D---- H:\Program Files\Messenger
2008-08-30 09:17:08 ----D---- H:\Program Files\MSN Gaming Zone
2008-08-30 09:17:08 ----A---- H:\WINDOWS\system32\write.exe
2008-08-30 09:17:01 ----A---- H:\WINDOWS\system32\sndvol32.exe
2008-08-30 09:17:01 ----A---- H:\WINDOWS\system32\hticons.dll
2008-08-30 09:17:01 ----A---- H:\WINDOWS\system32\avwav.dll
2008-08-30 09:17:01 ----A---- H:\WINDOWS\system32\avtapi.dll
2008-08-30 09:17:01 ----A---- H:\WINDOWS\system32\avmeter.dll
2008-08-30 09:17:00 ----A---- H:\WINDOWS\system32\winchat.exe
2008-08-30 09:16:55 ----A---- H:\WINDOWS\system32\getuname.dll
2008-08-30 09:16:55 ----A---- H:\WINDOWS\system32\charmap.exe
2008-08-30 09:16:55 ----A---- H:\WINDOWS\system32\calc.exe
2008-08-30 09:16:54 ----A---- H:\WINDOWS\system32\winmine.exe
2008-08-30 09:16:54 ----A---- H:\WINDOWS\system32\usrlogon.cmd
2008-08-30 09:16:54 ----A---- H:\WINDOWS\system32\tsshutdn.exe
2008-08-30 09:16:54 ----A---- H:\WINDOWS\system32\tslabels.ini
2008-08-30 09:16:54 ----A---- H:\WINDOWS\system32\tskill.exe
2008-08-30 09:16:54 ----A---- H:\WINDOWS\system32\sol.exe
2008-08-30 09:16:54 ----A---- H:\WINDOWS\system32\reset.exe
2008-08-30 09:16:54 ----A---- H:\WINDOWS\system32\mshearts.exe
2008-08-30 09:16:54 ----A---- H:\WINDOWS\system32\freecell.exe
2008-08-30 09:16:53 ----A---- H:\WINDOWS\system32\tsdiscon.exe
2008-08-30 09:16:53 ----A---- H:\WINDOWS\system32\tscon.exe
2008-08-30 09:16:53 ----A---- H:\WINDOWS\system32\shadow.exe
2008-08-30 09:16:53 ----A---- H:\WINDOWS\system32\rwinsta.exe
2008-08-30 09:16:53 ----A---- H:\WINDOWS\system32\regini.exe
2008-08-30 09:16:53 ----A---- H:\WINDOWS\system32\rdpcfgex.dll
2008-08-30 09:16:53 ----A---- H:\WINDOWS\system32\qwinsta.exe
2008-08-30 09:16:53 ----A---- H:\WINDOWS\system32\qappsrv.exe
2008-08-30 09:16:53 ----A---- H:\WINDOWS\system32\msg.exe
2008-08-30 09:16:53 ----A---- H:\WINDOWS\system32\msdtcprf.ini
2008-08-30 09:16:53 ----A---- H:\WINDOWS\system32\logoff.exe
2008-08-30 09:16:53 ----A---- H:\WINDOWS\system32\cdmodem.dll
2008-08-30 09:16:52 ----A---- H:\WINDOWS\system32\stclient.dll
2008-08-30 09:16:52 ----A---- H:\WINDOWS\system32\mtxlegih.dll
2008-08-30 09:16:52 ----A---- H:\WINDOWS\system32\mtxex.dll
2008-08-30 09:16:52 ----A---- H:\WINDOWS\system32\mtxdm.dll
2008-08-30 09:16:52 ----A---- H:\WINDOWS\system32\dcomcnfg.exe
2008-08-30 09:16:52 ----A---- H:\WINDOWS\system32\comrepl.dll
2008-08-30 09:16:52 ----A---- H:\WINDOWS\system32\comaddin.dll
2008-08-30 09:16:51 ----A---- H:\WINDOWS\system32\comsnap.dll
2008-08-30 09:16:48 ----A---- H:\WINDOWS\system32\wmimgmt.msc
2008-08-30 09:16:38 ----D---- H:\Program Files\MSN
2008-08-30 09:16:37 ----D---- H:\Program Files\Windows NT
2008-08-30 09:16:37 ----A---- H:\WINDOWS\system32\sndrec32.exe
2008-08-30 09:16:37 ----A---- H:\WINDOWS\system32\mspaint.exe
2008-08-30 09:16:37 ----A---- H:\WINDOWS\system32\mplay32.exe
2008-08-30 09:16:37 ----A---- H:\WINDOWS\system32\hypertrm.dll
2008-08-30 09:16:37 ----A---- H:\WINDOWS\system32\accwiz.exe
2008-08-30 09:16:36 ----A---- H:\WINDOWS\system32\tscfgwmi.dll
2008-08-30 09:16:36 ----A---- H:\WINDOWS\system32\spider.exe
2008-08-30 09:16:36 ----A---- H:\WINDOWS\system32\clipbrd.exe
2008-08-30 09:16:35 ----A---- H:\WINDOWS\system32\tscupgrd.exe
2008-08-30 09:16:35 ----A---- H:\WINDOWS\system32\termsrv.dll
2008-08-30 09:16:35 ----A---- H:\WINDOWS\system32\sessmgr.exe
2008-08-30 09:16:35 ----A---- H:\WINDOWS\system32\remotepg.dll
2008-08-30 09:16:35 ----A---- H:\WINDOWS\system32\rdshost.exe
2008-08-30 09:16:35 ----A---- H:\WINDOWS\system32\rdsaddin.exe
2008-08-30 09:16:35 ----A---- H:\WINDOWS\system32\rdpwsx.dll
2008-08-30 09:16:35 ----A---- H:\WINDOWS\system32\rdpsnd.dll
2008-08-30 09:16:35 ----A---- H:\WINDOWS\system32\rdpclip.exe
2008-08-30 09:16:35 ----A---- H:\WINDOWS\system32\rdchost.dll
2008-08-30 09:16:35 ----A---- H:\WINDOWS\system32\qprocess.exe
2008-08-30 09:16:35 ----A---- H:\WINDOWS\system32\mstscax.dll
2008-08-30 09:16:35 ----A---- H:\WINDOWS\system32\mstsc.exe
2008-08-30 09:16:34 ----D---- H:\WINDOWS\system32\MsDtc
2008-08-30 09:16:34 ----A---- H:\WINDOWS\system32\xolehlp.dll
2008-08-30 09:16:34 ----A---- H:\WINDOWS\system32\mtxoci.dll
2008-08-30 09:16:34 ----A---- H:\WINDOWS\system32\msdtcuiu.dll
2008-08-30 09:16:34 ----A---- H:\WINDOWS\system32\msdtctm.dll
2008-08-30 09:16:34 ----A---- H:\WINDOWS\system32\msdtcprx.dll
2008-08-30 09:16:34 ----A---- H:\WINDOWS\system32\msdtclog.dll
2008-08-30 09:16:34 ----A---- H:\WINDOWS\system32\icaapi.dll
2008-08-30 09:16:34 ----A---- H:\WINDOWS\system32\cfgbkend.dll
2008-08-30 09:16:33 ----D---- H:\WINDOWS\system32\Com
2008-08-30 09:16:33 ----A---- H:\WINDOWS\system32\msdtc.exe
2008-08-30 09:16:33 ----A---- H:\WINDOWS\system32\colbact.dll
2008-08-30 09:16:33 ----A---- H:\WINDOWS\system32\clbcatex.dll
2008-08-30 09:16:33 ----A---- H:\WINDOWS\system32\catsrvps.dll
2008-08-30 09:16:32 ----A---- H:\WINDOWS\system32\comuid.dll
2008-08-30 09:16:32 ----A---- H:\WINDOWS\system32\comsvcs.dll
2008-08-30 09:16:32 ----A---- H:\WINDOWS\system32\clbcatq.dll
2008-08-30 09:16:32 ----A---- H:\WINDOWS\system32\catsrvut.dll
2008-08-30 09:16:32 ----A---- H:\WINDOWS\system32\catsrv.dll
2008-08-30 09:16:27 ----A---- H:\WINDOWS\system32\servdeps.dll
2008-08-30 09:16:27 ----A---- H:\WINDOWS\system32\mmfutil.dll
2008-08-30 09:16:27 ----A---- H:\WINDOWS\system32\licwmi.dll
2008-08-30 09:16:27 ----A---- H:\WINDOWS\system32\cmprops.dll
2008-08-30 09:02:44 ----A---- H:\WINDOWS\system32\usbui.dll
2008-08-30 09:01:52 ----A---- H:\WINDOWS\imsins.BAK
2008-08-30 09:01:50 ----SHD---- H:\WINDOWS\Installer
2008-08-30 09:01:50 ----A---- H:\WINDOWS\system32\PerfStringBackup.INI
2008-08-30 09:01:49 ----D---- H:\Program Files\Common Files\ODBC
2008-08-30 09:01:49 ----A---- H:\WINDOWS\ODBCINST.INI
2008-08-30 09:01:47 ----D---- H:\Program Files\Common Files\SpeechEngines
2008-08-30 09:01:46 ----RD---- H:\Program Files
2008-08-30 09:01:46 ----D---- H:\Program Files\Common Files\Microsoft Shared
2008-08-30 09:01:46 ----D---- H:\Program Files\Common Files
2008-08-30 09:01:44 ----RA---- H:\WINDOWS\system32\kbdtuq.dll
2008-08-30 09:01:44 ----RA---- H:\WINDOWS\system32\kbdtuf.dll
2008-08-30 09:01:44 ----RA---- H:\WINDOWS\system32\kbdazel.dll
2008-08-30 09:01:43 ----RA---- H:\WINDOWS\system32\kbdycc.dll
2008-08-30 09:01:43 ----RA---- H:\WINDOWS\system32\kbduzb.dll
2008-08-30 09:01:43 ----RA---- H:\WINDOWS\system32\kbdur.dll
2008-08-30 09:01:43 ----RA---- H:\WINDOWS\system32\kbdtat.dll
2008-08-30 09:01:43 ----RA---- H:\WINDOWS\system32\kbdru1.dll
2008-08-30 09:01:43 ----RA---- H:\WINDOWS\system32\kbdru.dll
2008-08-30 09:01:43 ----RA---- H:\WINDOWS\system32\kbdmon.dll
2008-08-30 09:01:43 ----RA---- H:\WINDOWS\system32\kbdkyr.dll
2008-08-30 09:01:43 ----RA---- H:\WINDOWS\system32\kbdkaz.dll
2008-08-30 09:01:43 ----RA---- H:\WINDOWS\system32\kbdbu.dll
2008-08-30 09:01:43 ----RA---- H:\WINDOWS\system32\kbdblr.dll
2008-08-30 09:01:43 ----RA---- H:\WINDOWS\system32\kbdaze.dll
2008-08-30 09:01:41 ----RA---- H:\WINDOWS\system32\kbdhept.dll
2008-08-30 09:01:41 ----RA---- H:\WINDOWS\system32\kbdhela3.dll
2008-08-30 09:01:41 ----RA---- H:\WINDOWS\system32\kbdhela2.dll
2008-08-30 09:01:41 ----RA---- H:\WINDOWS\system32\kbdhe319.dll
2008-08-30 09:01:41 ----RA---- H:\WINDOWS\system32\kbdhe220.dll
2008-08-30 09:01:41 ----RA---- H:\WINDOWS\system32\kbdhe.dll
2008-08-30 09:01:41 ----RA---- H:\WINDOWS\system32\kbdgkl.dll
2008-08-30 09:01:40 ----RA---- H:\WINDOWS\system32\kbdlv1.dll
2008-08-30 09:01:40 ----RA---- H:\WINDOWS\system32\kbdlv.dll
2008-08-30 09:01:40 ----RA---- H:\WINDOWS\system32\kbdlt1.dll
2008-08-30 09:01:40 ----RA---- H:\WINDOWS\system32\kbdlt.dll
2008-08-30 09:01:40 ----RA---- H:\WINDOWS\system32\kbdest.dll
2008-08-30 09:01:38 ----RA---- H:\WINDOWS\system32\kbdycl.dll
2008-08-30 09:01:38 ----RA---- H:\WINDOWS\system32\kbdsl1.dll
2008-08-30 09:01:38 ----RA---- H:\WINDOWS\system32\kbdsl.dll
2008-08-30 09:01:38 ----RA---- H:\WINDOWS\system32\kbdro.dll
2008-08-30 09:01:38 ----RA---- H:\WINDOWS\system32\kbdpl1.dll
2008-08-30 09:01:38 ----RA---- H:\WINDOWS\system32\kbdpl.dll
2008-08-30 09:01:38 ----RA---- H:\WINDOWS\system32\kbdhu1.dll
2008-08-30 09:01:38 ----RA---- H:\WINDOWS\system32\kbdhu.dll
2008-08-30 09:01:38 ----RA---- H:\WINDOWS\system32\kbdcz2.dll
2008-08-30 09:01:38 ----RA---- H:\WINDOWS\system32\kbdcz1.dll
2008-08-30 09:01:38 ----RA---- H:\WINDOWS\system32\kbdcz.dll
2008-08-30 09:01:38 ----RA---- H:\WINDOWS\system32\kbdcr.dll
2008-08-30 09:01:38 ----RA---- H:\WINDOWS\system32\KBDAL.DLL
2008-08-30 09:01:36 ----A---- H:\WINDOWS\system32\spxcoins.dll
2008-08-30 09:01:36 ----A---- H:\WINDOWS\system32\irclass.dll
2008-08-30 09:01:36 ----A---- H:\WINDOWS\system32\EqnClass.Dll
2008-08-30 09:01:36 ----A---- H:\WINDOWS\system32\dgsetup.dll
2008-08-30 09:01:36 ----A---- H:\WINDOWS\system32\dgrpsetu.dll
2008-08-30 09:01:34 ----A---- H:\WINDOWS\TASKMAN.EXE
2008-08-30 09:01:34 ----A---- H:\WINDOWS\system32\batt.dll
2008-08-30 09:01:33 ----A---- H:\WINDOWS\system32\storprop.dll
2008-08-30 09:01:33 ----A---- H:\WINDOWS\NOTEPAD.EXE
2008-08-30 09:01:26 ----ASH---- H:\Documents and Settings\All Users\Application Data\desktop.ini
2008-08-30 09:01:23 ----RA---- H:\WINDOWS\SET8.tmp
2008-08-30 09:01:21 ----RA---- H:\WINDOWS\SET4.tmp
2008-08-30 09:01:20 ----RA---- H:\WINDOWS\SET3.tmp
2008-08-30 09:01:16 ----D---- H:\WINDOWS\system32\CatRoot2
2008-08-30 09:01:16 ----D---- H:\WINDOWS\system32\CatRoot
2008-08-30 09:01:10 ----SD---- H:\Documents and Settings\All Users\Application Data\Microsoft
2008-08-30 09:00:56 ----A---- H:\WINDOWS\setuplog.txt
2008-08-30 09:00:54 ----SHD---- H:\System Volume Information
2008-08-30 09:00:54 ----D---- H:\Documents and Settings
2008-08-30 09:00:03 ----SH---- H:\boot.ini
2008-08-30 08:56:19 ----RSHDC---- H:\WINDOWS\system32\dllcache
2008-08-30 08:56:19 ----RSD---- H:\WINDOWS\Fonts
2008-08-30 08:56:19 ----RD---- H:\WINDOWS\Web
2008-08-30 08:56:19 ----HD---- H:\WINDOWS\inf
2008-08-30 08:56:19 ----D---- H:\WINDOWS\WinSxS
2008-08-30 08:56:19 ----D---- H:\WINDOWS\twain_32
2008-08-30 08:56:19 ----D---- H:\WINDOWS\Temp
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\wins
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\wbem
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\usmt
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\spool
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\ShellExt
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\Setup
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\ras
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\oobe
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\npp
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\mui
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\inetsrv
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\IME
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\icsxml
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\ias
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\export
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\drivers
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\dhcp
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\config
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\3com_dmi
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\3076
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\2052
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\1054
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\1042
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\1041
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\1037
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\1033
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\1031
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\1028
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32\1025
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system32
2008-08-30 08:56:19 ----D---- H:\WINDOWS\system
2008-08-30 08:56:19 ----D---- H:\WINDOWS\security
2008-08-30 08:56:19 ----D---- H:\WINDOWS\Resources
2008-08-30 08:56:19 ----D---- H:\WINDOWS\repair
2008-08-30 08:56:19 ----D---- H:\WINDOWS\Provisioning
2008-08-30 08:56:19 ----D---- H:\WINDOWS\PeerNet
2008-08-30 08:56:19 ----D---- H:\WINDOWS\pchealth
2008-08-30 08:56:19 ----D---- H:\WINDOWS\mui
2008-08-30 08:56:19 ----D---- H:\WINDOWS\msapps
2008-08-30 08:56:19 ----D---- H:\WINDOWS\msagent
2008-08-30 08:56:19 ----D---- H:\WINDOWS\Media
2008-08-30 08:56:19 ----D---- H:\WINDOWS\java
2008-08-30 08:56:19 ----D---- H:\WINDOWS\ime
2008-08-30 08:56:19 ----D---- H:\WINDOWS\Help
2008-08-30 08:56:19 ----D---- H:\WINDOWS\ehome
2008-08-30 08:56:19 ----D---- H:\WINDOWS\Driver Cache
2008-08-30 08:56:19 ----D---- H:\WINDOWS\Debug
2008-08-30 08:56:19 ----D---- H:\WINDOWS\Cursors
2008-08-30 08:56:19 ----D---- H:\WINDOWS\Connection Wizard
2008-08-30 08:56:19 ----D---- H:\WINDOWS\Config
2008-08-30 08:56:19 ----D---- H:\WINDOWS\AppPatch
2008-08-30 08:56:19 ----D---- H:\WINDOWS\addins
2008-08-30 08:56:19 ----D---- H:\WINDOWS

======List of files/folders modified in the last 1 months======

2008-09-26 13:24:05 ----A---- H:\WINDOWS\win.ini
2008-09-26 13:24:05 ----A---- H:\WINDOWS\system.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Amfilter;A4Tech Mouse Filter Driver; H:\WINDOWS\system32\DRIVERS\Amfilter.sys [2006-01-11 8704]
R1 asuskbnt;Enhanced Display Driver Helper Service; H:\WINDOWS\system32\drivers\atkkbnt.sys [2007-09-13 11136]
R1 EIO;EIO; \??\H:\WINDOWS\system32\drivers\EIO.sys []
R1 intelppm;Intel Processor Driver; H:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-03 36096]
R2 tmcomm;tmcomm; \??\H:\WINDOWS\system32\drivers\tmcomm.sys []
R3 asusgsb;ASUS Virtual Video Capture Device Driver; H:\WINDOWS\system32\drivers\asusgsb.sys [2007-09-13 12416]
R3 ASUSVRC;ASUSTeK Virtual Capture Device; H:\WINDOWS\system32\DRIVERS\AsusVRC.sys [2007-01-29 18432]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; H:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); H:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-02-14 4676096]
R3 nv;nv; H:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-09-16 6853088]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; H:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-01-03 105856]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; H:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;USB2 Enabled Hub; H:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbstor;USB Mass Storage Driver; H:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; H:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 Video3D;ASUS Video3D Service; H:\WINDOWS\System32\Drivers\Video3D32.sys [2007-09-13 10752]
S3 Amusbprt;A4Tech HID-compliant Mouse Driver; H:\WINDOWS\system32\DRIVERS\Amusbprt.sys [2006-01-11 13312]
S3 atidgllk;atidgllk; \??\H:\Program Files\ASUS\SmartDoctor\atidgllk.sys []
S3 az5855gg;az5855gg; H:\WINDOWS\system32\drivers\az5855gg.sys []
S3 CCDECODE;Closed Caption Decoder; H:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 gdrv;gdrv; \??\H:\WINDOWS\gdrv.sys []
S3 hidusb;Microsoft HID Class Driver; H:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-23 9600]
S3 mouhid;Mouse HID Driver; H:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; H:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; H:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; H:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 SLIP;BDA Slip De-Framer; H:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; H:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 SymIM;Symantec Network Security Intermediate Filter Service; H:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 SymIMMP;SymIMMP; H:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 usbprint;Microsoft USB PRINTER Class; H:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 WSTCODEC;World Standard Teletext Codec; H:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 IntelIde;IntelIde; H:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ATKKeyboardService;ATK Keyboard Service; H:\WINDOWS\ATKKBService.exe [2007-09-13 258560]
R2 NVSvc;NVIDIA Display Driver Service; H:\WINDOWS\system32\nvsvc32.exe [2007-09-16 155716]
S3 aspnet_state;ASP.NET State Service; H:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; H:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; h:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864]
S3 IDriverT;InstallDriver Table Manager; H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; H:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376]
S3 usprserv;User Privilege Service; H:\WINDOWS\System32\svchost.exe [2004-08-04 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; H:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880]

-----------------EOF-----------------
ken545
2008-09-26, 20:03
Looking good :bigthumb:

H:\Program Files\BitComet <-- You can delete this.


ATF Cleaner <-- Yours to keep, run it now and then to clean out the clutter.

Malwarebytes <-- Yours to keep also, check for updates and run a scan now and then.

Hijackthis <---Your call, hopefully you won't need it again, if you do you can redownload it



How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.
Tutorial for System Restore (http://www.bleepingcomputer.com/tutorials/tutorial56.html) <-- Do this first to prevent yourself from being reinfected.
WhattheTech (http://forums.whatthetech.com/So_how_did_I_get_infected_in_the_first_place_t57817.html)
TonyKlein CastleCops (http://www.castlecops.com/postlite7736-.html)
Grinler BleepingComputer (http://www.bleepingcomputer.com/forums/topic2520.html)
GeeksTo Go (http://www.geekstogo.com/forum/index.php?autocom=custom&page=How_did_I)
Dslreports (http://www.dslreports.com/faq/10002)




Keep in mind if you install some of these programs. Only ONE Anti Virus and only ONE Firewall is recommended, more is overkill and can cause you problems. You can install all the Spyware programs I have listed without any problems. If you install Spyware Blaster, you can still install Spybot Search and Destroy but do not enable the TeaTimer in Spybot.

Here are some free programs to install, all free and highly regarded by the fine people in the Malware Removal Community

Spybot Search and Destroy 1.6 (http://www.safer-networking.org/en/download/)
Check for Updates/ Immunize and run a Full System Scan on a regular basis. If you install Spyware Blaster ( Recommended ) then do not enable the TeaTimer in Spybot Search and Destroy.

Spyware Blaster (http://www.javacoolsoftware.com/spywareblaster.html) It will prevent most spyware from ever being installed. No scan to run, just update about once a week and enable all protection.

Spyware Guard (http://www.javacoolsoftware.com/spywareguard.html) It offers realtime protection from spyware installation attempts, again, no scan to run, just install it and let it do its thing.

IE-Spyad (http://www.pcworld.com/downloads/file/fid,23332-order,1-page,1-c,antispywaretools/description.html)
IE-Spyad places over 6000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.

Firefox 3 (http://www.mozilla.org/products/firefox/) It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.



Safe Surfn
Ken