View Full Version : help.. i can't install/run antivirus programs - HJL included
antivirus programs that i have tried closes while installing.. so far, the only thing that was successfully installed is the Spybot S&D. however, it won't run at all.. when i double-click on the icon, it shows for about a millisecond then closes again.
another problem is that, i can't move/copy any file, my computer hangs when doing so.
here is the hjl i got:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:38:31 AM, on 11/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\WINDOWS\system32\ccPrxy.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\dianne\LOCALS~1\Temp\svpb.exe
C:\DOCUME~1\dianne\LOCALS~1\Temp\gltm.exe
C:\DOCUME~1\dianne\LOCALS~1\Temp\winjyqvb.exe
C:\Documents and Settings\dianne\Desktop\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Service Pack 3 Internet Explorer
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll (file missing)
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [ccPrxy.exe] ccPrxy.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [msnsc] C:\WINDOWS\system32\msnsc.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [msnsc] C:\WINDOWS\system32\msnsc.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [msnsc] C:\WINDOWS\system32\msnsc.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnsc] C:\WINDOWS\system32\msnsc.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
--
End of file - 3787 bytes
P.S.
I downloaded the HijackThis.exe directly into the HijackThis folder located in the desktop for the reason that my pc hangs when moving a file. that's okay..right?
thanks for the help..
Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.
If you think you have similar problems, please post a log in the HJT forum and wait for help.
Hello and welcome to the forums
My name is Katana and I will be helping you to remove any infection(s) that you may have.
Please observe these rules while we work:
Please Read All Instructions Carefully
If you don't understand something, stop and ask! Don't keep going on.
Please do not run any other tools or scans whilst I am helping you
Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)
If you can do those few things, everything should go smoothly http://www.countingcows.de/laechel.gif
Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe
----------------------------------------------------------------------------------------
Download and Run RSIT
Please download Random's System Information Tool by random/random from here (http://images.malwareremoval.com/random/RSIT.exe) and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open:
log.txt will be opened maximized.
info.txt will be opened minimized.
Please post the contents of both log.txt and info.txt.
sorry for the late reply.. i stay at a dorm during weekdays so i only get to use this pc during the weekends.
the log.txt: part1
Logfile of random's system information tool 1.04 (written by random/random)
Run by dianne at 2002-05-30 00:57:00
Microsoft Windows XP Professional Service Pack 2
System drive C: has 12 GB (31%) free of 38 GB
Total RAM: 351 MB (41% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:38:31 AM, on 11/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\WINDOWS\system32\ccPrxy.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\dianne\LOCALS~1\Temp\svpb.exe
C:\DOCUME~1\dianne\LOCALS~1\Temp\gltm.exe
C:\DOCUME~1\dianne\LOCALS~1\Temp\winjyqvb.exe
C:\Documents and Settings\dianne\Desktop\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Service Pack 3 Internet Explorer
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll (file missing)
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [ccPrxy.exe] ccPrxy.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [msnsc] C:\WINDOWS\system32\msnsc.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [msnsc] C:\WINDOWS\system32\msnsc.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [msnsc] C:\WINDOWS\system32\msnsc.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnsc] C:\WINDOWS\system32\msnsc.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
--
End of file - 3787 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-23 63136]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-07-07 1562448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{381FFDE8-2394-4f90-B10D-FC6124A40F8C} - BitDefender Toolbar - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"BitDefender Antiphishing Helper"=C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe []
"BDAgent"=C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe [2008-02-16 434176]
"ccPrxy.exe"=C:\WINDOWS\system32\ccPrxy.exe [2002-05-29 90112]
"QuickTime Task"=C:\Program Files\QuickTime Alternative\QTTask.exe [2008-09-06 487424]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"=C:\Program Files\MSN Messenger\MsnMsgr.Exe [2005-12-14 7197744]
"Messenger (Yahoo!)"=C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2008-11-05 4420848]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-07-07 2156368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-05-09 52224]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=1
"DisableRegistryTools"=1
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=159
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\MsnMsgr.Exe:*:Enabled:ipsec"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Documents and Settings\dianne\Templates\ldup.exe"="C:\Documents and Settings\dianne\Templates\ldup.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winomixs.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winomixs.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winitwcfm.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winitwcfm.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\wintgly.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\wintgly.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winexfets.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winexfets.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winmxkwo.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winmxkwo.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winsbwr.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winsbwr.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\jflvqi.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\jflvqi.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winuqecbr.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winuqecbr.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winevfyi.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winevfyi.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winfcqybc.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winfcqybc.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\evxuud.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\evxuud.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\veechf.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\veechf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\wininyj.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\wininyj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winmkuvij.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winmkuvij.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\wincefulg.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\wincefulg.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winqnpe.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winqnpe.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winhwlds.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winhwlds.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\orgnjo.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\orgnjo.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winjvfmnl.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winjvfmnl.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\seko.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\seko.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\ysjnhb.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\ysjnhb.exe:*:Enabled:ipsec"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winrfvihn.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winrfvihn.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winerdrw.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winerdrw.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winguqmr.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winguqmr.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winftvi.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winftvi.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\dfxkr.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\dfxkr.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\syso.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\syso.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\GLB57.tmp"="C:\DOCUME~1\dianne\LOCALS~1\Temp\GLB57.tmp:*:Enabled:ipsec"
"C:\WINDOWS\system32\ccPrxy.exe"="C:\WINDOWS\system32\ccPrxy.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\gucirg.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\gucirg.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\xsfpx.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\xsfpx.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\wintcwun.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\wintcwun.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\oexhso.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\oexhso.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winhvha.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winhvha.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winwjhon.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winwjhon.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winudwyj.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winudwyj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\ulhfyi.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\ulhfyi.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winbavamt.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winbavamt.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winysmp.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winysmp.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winxyxtia.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winxyxtia.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winckvf.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winckvf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\bimibr.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\bimibr.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\wincidwrs.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\wincidwrs.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winvqaadw.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winvqaadw.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\hbey.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\hbey.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winfgkb.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winfgkb.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winegwdk.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winegwdk.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\ignce.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\ignce.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\wjmwbr.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\wjmwbr.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winmauhu.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winmauhu.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winkyrkl.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winkyrkl.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\windxnvoj.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\windxnvoj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\wintxypn.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\wintxypn.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winiing.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winiing.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winfkskns.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winfkskns.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\kpmrf.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\kpmrf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\fmwa.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\fmwa.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\wintkwrnw.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\wintkwrnw.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winkfmggv.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winkfmggv.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\tktk.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\tktk.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\egfmv.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\egfmv.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winrwvk.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winrwvk.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\djjngq.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\djjngq.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\majhix.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\majhix.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winvcpomi.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winvcpomi.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winmfdelg.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winmfdelg.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\qtdt.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\qtdt.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winwrbq.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winwrbq.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\fbbufc.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\fbbufc.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winhlbjb.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winhlbjb.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\hydrhl.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\hydrhl.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\bxvxm.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\bxvxm.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\qyuig.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\qyuig.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winojxtf.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winojxtf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\crmy.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\crmy.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\sienu.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\sienu.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\wininnerp.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\wininnerp.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winqpnij.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winqpnij.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winjdonfi.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winjdonfi.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\lwjso.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\lwjso.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winlyyri.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winlyyri.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winouyt.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winouyt.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\hupve.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\hupve.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\wincaunb.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\wincaunb.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winpxnih.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winpxnih.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winspdl.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winspdl.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\hagee.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\hagee.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\flsjgi.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\flsjgi.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\fixlm.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\fixlm.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\wingfsj.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\wingfsj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\acjcad.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\acjcad.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\wintodpav.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\wintodpav.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\asqij.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\asqij.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\winhlbbnk.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\winhlbbnk.exe:*:Enabled:ipsec"
"C:\DOCUME~1\dianne\LOCALS~1\Temp\bkca.exe"="C:\DOCUME~1\dianne\LOCALS~1\Temp\bkca.exe:*:Enabled:ipsec"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
======List of files/folders created in the last 1 months======
2008-11-17 19:39:26 ----N---- C:\WINDOWS\system32\spmsg.dll
2008-11-17 19:33:03 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-11-17 19:12:24 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-11-17 18:48:29 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-11-17 18:35:35 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$
2008-11-17 18:14:33 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-11-17 17:53:33 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-11-17 17:29:56 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2008-11-17 17:09:59 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-11-17 16:49:19 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2008-11-17 16:26:49 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2008-11-17 16:07:50 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2008-11-17 15:49:12 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-11-17 15:33:38 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-11-17 15:16:01 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-11-17 14:56:50 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2008-11-17 13:11:18 ----HDC---- C:\WINDOWS\$NtUninstallKB956390$
2008-11-17 12:49:04 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$
2008-11-17 10:25:06 ----D---- C:\WINDOWS\Minidump
2008-11-17 02:01:18 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2008-11-17 02:01:14 ----A---- C:\WINDOWS\system32\ntkrnlpa.exe
2008-11-17 01:34:41 ----A---- C:\WINDOWS\system32\msxml3.dll
2008-11-16 21:51:30 ----D---- C:\Program Files\Common Files\INCA Shared
2008-11-16 21:24:54 ----D---- C:\Program Files\Gravity
2008-11-16 21:24:48 ----HD---- C:\Program Files\InstallShield Installation Information
2008-11-16 21:21:52 ----D---- C:\Program Files\Common Files\InstallShield
2008-11-16 12:20:49 ----D---- C:\WINDOWS\system32\DllCache
2008-11-16 12:20:34 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-11-16 12:18:23 ----D---- C:\Program Files\MSXML 4.0
2008-11-16 10:47:04 ----D---- C:\WINDOWS\system32\CatRoot_bak
2008-11-16 10:08:29 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-11-16 10:08:29 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-16 07:19:19 ----HD---- C:\WINDOWS\$hf_mig$
2008-11-15 20:39:38 ----D---- C:\Documents and Settings\dianne\Application Data\Media Player Classic
2008-11-15 20:38:39 ----A---- C:\WINDOWS\system32\rmoc3260.dll
2008-11-15 20:38:39 ----A---- C:\WINDOWS\system32\pndx5032.dll
2008-11-15 20:38:39 ----A---- C:\WINDOWS\system32\pndx5016.dll
2008-11-15 20:38:39 ----A---- C:\WINDOWS\system32\pncrt.dll
2008-11-15 20:38:35 ----D---- C:\Program Files\Real Alternative
2008-11-15 20:38:35 ----D---- C:\Documents and Settings\dianne\Application Data\Real
2008-11-15 20:38:35 ----D---- C:\Documents and Settings\All Users\Application Data\Real
2008-11-15 20:20:56 ----D---- C:\Program Files\Decoder
2008-11-15 20:02:38 ----D---- C:\Program Files\WinAVI Video Converter
2008-11-15 18:39:36 ----D---- C:\Documents and Settings\dianne\Application Data\vlc
2008-11-15 18:33:07 ----D---- C:\Program Files\VideoLAN
2008-11-15 18:06:15 ----D---- C:\Documents and Settings\dianne\Application Data\Apple Computer
2008-11-15 17:31:28 ----D---- C:\Program Files\Common Files\Apple
2008-11-15 17:29:18 ----D---- C:\Program Files\Apple Software Update
2008-11-15 17:29:17 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2008-11-15 16:24:27 ----A---- C:\WINDOWS\system32\unrar.dll
2008-11-15 16:24:27 ----A---- C:\WINDOWS\avisplitter.ini
2008-11-15 16:24:15 ----A---- C:\WINDOWS\system32\yv12vfw.dll
2008-11-15 16:24:04 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest
2008-11-15 16:24:04 ----A---- C:\WINDOWS\system32\ff_vfw.dll
2008-11-15 16:24:01 ----D---- C:\Program Files\K-Lite Codec Pack
2008-11-15 15:02:48 ----RSD---- C:\WINDOWS\assembly
2008-11-15 14:59:11 ----D---- C:\WINDOWS\Microsoft.NET
2008-11-15 14:29:14 ----D---- C:\Program Files\JockerSoft
2008-11-15 13:42:49 ----D---- C:\Program Files\DirectVobSub
2008-11-15 12:25:37 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2008-11-15 12:25:37 ----A---- C:\WINDOWS\system32\mucltui.dll
2008-11-15 12:25:16 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2008-11-15 12:25:16 ----A---- C:\WINDOWS\system32\wucltui.dll.mui
2008-11-15 12:25:16 ----A---- C:\WINDOWS\system32\wuaueng.dll.mui
2008-11-15 12:25:16 ----A---- C:\WINDOWS\system32\wuapi.dll.mui
2008-11-15 12:11:35 ----D---- C:\Documents and Settings\dianne\Application Data\DivX
2008-11-15 12:09:49 ----D---- C:\WINDOWS\system32\appmgmt
2008-11-15 12:07:08 ----N---- C:\WINDOWS\system32\pxcpyi64.exe
2008-11-15 12:07:08 ----N---- C:\WINDOWS\system32\pxcpya64.exe
2008-11-15 12:07:07 ----N---- C:\WINDOWS\system32\vxblock.dll
2008-11-15 12:07:07 ----N---- C:\WINDOWS\system32\pxwave.dll
2008-11-15 12:07:07 ----N---- C:\WINDOWS\system32\pxsfs.dll
2008-11-15 12:07:07 ----N---- C:\WINDOWS\system32\pxmas.dll
2008-11-15 12:07:07 ----N---- C:\WINDOWS\system32\pxinsi64.exe
2008-11-15 12:07:07 ----N---- C:\WINDOWS\system32\pxinsa64.exe
2008-11-15 12:07:07 ----N---- C:\WINDOWS\system32\pxhpinst.exe
2008-11-15 12:07:07 ----N---- C:\WINDOWS\system32\pxdrv.dll
2008-11-15 12:07:07 ----N---- C:\WINDOWS\system32\pxafs.dll
2008-11-15 12:06:57 ----N---- C:\WINDOWS\system32\px.dll
2008-11-15 12:04:49 ----D---- C:\Program Files\DivX
2008-11-15 03:02:06 ----D---- C:\WINDOWS\system32\LogFiles
2008-11-15 03:01:33 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2008-11-15 02:59:55 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2008-11-15 02:54:52 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2008-11-15 02:54:15 ----HDC---- C:\WINDOWS\$NtUninstallwmp11$
2008-10-28 23:36:00 ----A---- C:\WINDOWS\system32\divx_xx0c.dll
2008-10-28 23:36:00 ----A---- C:\WINDOWS\system32\divx_xx07.dll
2008-10-28 23:35:58 ----A---- C:\WINDOWS\system32\divx_xx11.dll
2008-10-28 23:35:58 ----A---- C:\WINDOWS\system32\divx_xx0a.dll
2008-10-28 23:35:56 ----A---- C:\WINDOWS\system32\DivX.dll
2008-09-30 17:43:34 ----A---- C:\WINDOWS\system32\msxml4.dll
2008-09-25 09:03:44 ----A---- C:\WINDOWS\system32\DivXsm.exe
2008-09-25 09:03:38 ----A---- C:\WINDOWS\system32\dtu100.dll
2008-09-25 09:03:38 ----A---- C:\WINDOWS\system32\dpl100.dll
2008-09-25 09:03:34 ----A---- C:\WINDOWS\system32\dpuGUI10.dll
2008-09-25 09:03:32 ----A---- C:\WINDOWS\system32\dpv11.dll
2008-09-25 09:03:32 ----A---- C:\WINDOWS\system32\dpus11.dll
2008-09-25 09:03:32 ----A---- C:\WINDOWS\system32\dpuGUI11.dll
2008-09-25 09:03:30 ----A---- C:\WINDOWS\system32\dpu11.dll
2008-09-25 09:03:30 ----A---- C:\WINDOWS\system32\dpu10.dll
2008-09-25 09:03:18 ----A---- C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-09-19 22:57:34 ----A---- C:\WINDOWS\system32\qt-dx331.dll
2008-09-19 22:55:58 ----A---- C:\WINDOWS\system32\ssldivx.dll
2008-09-19 22:55:58 ----A---- C:\WINDOWS\system32\libdivx.dll
2008-09-19 22:55:10 ----A---- C:\WINDOWS\system32\dtu100.dll.manifest
2008-09-19 22:55:10 ----A---- C:\WINDOWS\system32\dpl100.dll.manifest
2008-09-19 22:54:18 ----A---- C:\WINDOWS\system32\DivXWMPExtType.dll
2008-08-20 06:33:19 ----A---- C:\WINDOWS\system32\mshtmled.dll
2008-08-20 06:33:18 ----A---- C:\WINDOWS\system32\pngfilt.dll
2008-08-20 06:33:18 ----A---- C:\WINDOWS\system32\mstime.dll
2008-08-20 06:33:18 ----A---- C:\WINDOWS\system32\msrating.dll
2008-08-20 06:33:18 ----A---- C:\WINDOWS\system32\inseng.dll
2008-08-20 06:33:18 ----A---- C:\WINDOWS\system32\iepeers.dll
2008-08-20 06:33:18 ----A---- C:\WINDOWS\system32\extmgr.dll
2008-08-20 06:33:18 ----A---- C:\WINDOWS\system32\dxtrans.dll
2008-08-20 06:33:18 ----A---- C:\WINDOWS\system32\dxtmsft.dll
2008-08-20 06:33:18 ----A---- C:\WINDOWS\system32\danim.dll
2008-08-20 06:33:17 ----A---- C:\WINDOWS\system32\cdfview.dll
2008-07-14 12:09:18 ----N---- C:\WINDOWS\system32\tzchange.exe
2008-05-07 05:55:40 ----A---- C:\WINDOWS\system32\quartz.dll
2007-12-18 15:40:58 ----A---- C:\WINDOWS\system32\vbscript.dll
2007-12-18 15:40:58 ----A---- C:\WINDOWS\system32\jscript.dll
2007-11-27 16:46:24 ----A---- C:\WINDOWS\system32\xcomm.dll
2007-06-06 11:53:34 ----A---- C:\WINDOWS\system32\FM20.DLL
2007-03-22 20:17:04 ----A---- C:\WINDOWS\system32\FM20ENU.DLL
2007-01-31 13:50:32 ----A---- C:\WINDOWS\system32\xreglib.dll
2006-05-09 23:26:34 ----N---- C:\WINDOWS\system32\wmpps.dll
2006-05-09 23:26:34 ----N---- C:\WINDOWS\system32\wmpeffects.dll
2006-05-09 22:01:06 ----N---- C:\WINDOWS\system32\WMVSDECD.dll
2006-05-09 22:01:06 ----N---- C:\WINDOWS\system32\WMVDECOD.dll
2006-05-09 22:00:58 ----N---- C:\WINDOWS\system32\WMVSENCD.dll
2006-05-09 22:00:58 ----N---- C:\WINDOWS\system32\WMVENCOD.dll
2006-05-09 22:00:58 ----N---- C:\WINDOWS\system32\MPG4DECD.dll
2006-05-09 22:00:58 ----N---- C:\WINDOWS\system32\MP4SDECD.dll
2006-05-09 22:00:56 ----N---- C:\WINDOWS\system32\WMVXENCD.dll
2006-05-09 22:00:56 ----N---- C:\WINDOWS\system32\MP43DECD.dll
2006-05-09 22:00:22 ----N---- C:\WINDOWS\system32\wmpmde.dll
2006-05-09 21:58:54 ----N---- C:\WINDOWS\system32\WPDShServiceObj.dll
2006-05-09 21:58:54 ----N---- C:\WINDOWS\system32\wpdshextautoplay.exe
2006-05-09 21:58:54 ----N---- C:\WINDOWS\system32\WpdShext.dll
2006-05-09 21:58:50 ----N---- C:\WINDOWS\system32\PortableDeviceWiaCompat.dll
2006-05-09 21:58:48 ----N---- C:\WINDOWS\system32\PortableDeviceWMDRM.dll
2006-05-09 21:58:48 ----N---- C:\WINDOWS\system32\PortableDeviceClassExtension.dll
2006-05-09 21:58:48 ----N---- C:\WINDOWS\system32\PortableDeviceApi.dll
2006-05-09 21:58:38 ----N---- C:\WINDOWS\system32\PortableDeviceTypes.dll
2006-05-09 21:57:06 ----N---- C:\WINDOWS\system32\ehETW.dll
2006-05-09 21:45:20 ----N---- C:\WINDOWS\system32\MSDelta.dll
2006-04-11 15:30:44 ----N---- C:\WINDOWS\system32\WUDFCoinstaller.dll
2006-04-11 15:27:18 ----N---- C:\WINDOWS\system32\WUDFx.dll
2006-04-11 15:27:18 ----N---- C:\WINDOWS\system32\WudfHost.exe
2006-04-11 15:26:56 ----N---- C:\WINDOWS\system32\WudfSvc.dll
2006-04-11 15:26:44 ----N---- C:\WINDOWS\system32\WudfPlatform.dll
2006-01-13 03:05:50 ----A---- C:\WINDOWS\system32\olecli32.dll
2006-01-13 03:05:50 ----A---- C:\WINDOWS\system32\olecli.dll
2006-01-13 03:05:50 ----A---- C:\WINDOWS\system32\oleaut32.dll
2006-01-13 03:05:50 ----A---- C:\WINDOWS\system32\oleaccrc.dll
2006-01-13 03:05:50 ----A---- C:\WINDOWS\system32\oleacc.dll
2006-01-13 03:05:49 ----A---- C:\WINDOWS\system32\ole32.dll
2006-01-13 03:05:45 ----A---- C:\WINDOWS\system32\spnpinst.exe
2006-01-13 03:05:44 ----A---- C:\WINDOWS\system32\ipmontr.dll
2006-01-13 03:05:44 ----A---- C:\WINDOWS\system32\iphlpapi.dll
2006-01-13 03:05:44 ----A---- C:\WINDOWS\system32\ipconfig.exe
2006-01-13 03:05:44 ----A---- C:\WINDOWS\system32\iologmsg.dll
2006-01-13 03:05:42 ----A---- C:\WINDOWS\system32\spiisupd.exe
2006-01-13 03:05:42 ----A---- C:\WINDOWS\system32\es.dll
2006-01-13 03:05:42 ----A---- C:\WINDOWS\system32\ersvc.dll
2006-01-13 03:05:42 ----A---- C:\WINDOWS\system32\encdec.dll
2006-01-13 03:05:42 ----A---- C:\WINDOWS\system32\encapi.dll
2006-01-13 03:05:42 ----A---- C:\WINDOWS\system32\els.dll
2006-01-13 03:05:42 ----A---- C:\WINDOWS\system32\efsadu.dll
2006-01-13 03:05:42 ----A---- C:\WINDOWS\system32\edlin.exe
2006-01-13 03:05:42 ----A---- C:\WINDOWS\system32\edit.com
2006-01-13 03:05:23 ----A---- C:\WINDOWS\system32\fixmapi.exe
2006-01-13 03:05:23 ----A---- C:\WINDOWS\system32\finger.exe
2006-01-13 03:05:23 ----A---- C:\WINDOWS\system32\findstr.exe
2006-01-13 03:05:23 ----A---- C:\WINDOWS\system32\find.exe
2006-01-13 03:05:23 ----A---- C:\WINDOWS\filemon.exe
2006-01-13 03:05:20 ----A---- C:\WINDOWS\system32\services.exe
2006-01-13 03:05:20 ----A---- C:\WINDOWS\system32\serialui.dll
2006-01-13 03:05:20 ----A---- C:\WINDOWS\system32\senscfg.dll
2006-01-13 03:05:20 ----A---- C:\WINDOWS\system32\sensapi.dll
2006-01-13 03:05:20 ----A---- C:\WINDOWS\system32\sens.dll
2006-01-13 03:05:20 ----A---- C:\WINDOWS\system32\sendmail.dll
2006-01-13 03:05:20 ----A---- C:\WINDOWS\system32\sendcmsg.dll
2006-01-13 03:05:20 ----A---- C:\WINDOWS\system32\security.dll
2006-01-13 03:05:20 ----A---- C:\WINDOWS\system32\secur32.dll
2006-01-13 03:05:18 ----A---- C:\WINDOWS\system32\pidgen.dll
2006-01-13 03:05:16 ----A---- C:\WINDOWS\system32\wmploc.dll
2006-01-13 03:05:01 ----A---- C:\WINDOWS\system32\slbrccsp.dll
2006-01-13 03:05:01 ----A---- C:\WINDOWS\system32\slbiop.dll
2006-01-13 03:05:01 ----A---- C:\WINDOWS\system32\slbcsp.dll
2006-01-13 03:05:01 ----A---- C:\WINDOWS\system32\slayerxp.dll
2006-01-13 03:05:01 ----A---- C:\WINDOWS\system32\skeys.exe
2006-01-13 03:05:01 ----A---- C:\WINDOWS\system32\skdll.dll
2006-01-13 03:05:01 ----A---- C:\WINDOWS\system32\pifmgr.dll
2006-01-13 03:05:01 ----A---- C:\WINDOWS\system32\photowiz.dll
2006-01-13 03:04:55 ----A---- C:\WINDOWS\system32\setupdll.dll
2006-01-13 03:04:52 ----A---- C:\WINDOWS\system32\convert.exe
2006-01-13 03:04:52 ----A---- C:\WINDOWS\system32\control.exe
2006-01-13 03:04:52 ----A---- C:\WINDOWS\system32\console.dll
2006-01-13 03:04:52 ----A---- C:\WINDOWS\system32\conime.exe
2006-01-13 03:04:52 ----A---- C:\WINDOWS\system32\confmsp.dll
2006-01-13 03:04:50 ----A---- C:\WINDOWS\system32\SIRENACM.DLL
2006-01-13 03:04:50 ----A---- C:\WINDOWS\system32\sigverif.exe
2006-01-13 03:04:47 ----A---- C:\WINDOWS\system32\sisbkup.dll
2006-01-13 03:04:47 ----A---- C:\WINDOWS\system32\netmsg.dll
2006-01-13 03:04:31 ----A---- C:\WINDOWS\system32\sigtab.dll
2006-01-13 03:04:31 ----A---- C:\WINDOWS\system32\mimefilt.dll
2006-01-13 03:04:17 ----A---- C:\WINDOWS\system32\printui.dll
2006-01-13 03:04:14 ----A---- C:\WINDOWS\system32\prnqctl.vbs
2006-01-13 03:04:14 ----A---- C:\WINDOWS\system32\prnport.vbs
2006-01-13 03:04:14 ----A---- C:\WINDOWS\system32\prnmngr.vbs
2006-01-13 03:04:14 ----A---- C:\WINDOWS\system32\prnjobs.vbs
2006-01-13 03:04:14 ----A---- C:\WINDOWS\system32\prndrvr.vbs
2006-01-13 03:04:14 ----A---- C:\WINDOWS\system32\prncnfg.vbs
2006-01-13 03:04:14 ----A---- C:\WINDOWS\system32\mshtml.dll
2006-01-13 03:04:13 ----A---- C:\WINDOWS\system32\wmsdmoe2.dll
2006-01-13 03:04:13 ----A---- C:\WINDOWS\system32\wmsdmoe.dll
2006-01-13 03:04:13 ----A---- C:\WINDOWS\system32\wmpui.dll
2006-01-13 03:04:13 ----A---- C:\WINDOWS\system32\wmpsrcwp.dll
2006-01-13 03:03:59 ----A---- C:\WINDOWS\system32\ntshrui.dll
2006-01-13 03:03:59 ----A---- C:\WINDOWS\system32\ntsdexts.dll
2006-01-13 03:03:59 ----A---- C:\WINDOWS\system32\ntsd.exe
2006-01-13 03:03:47 ----A---- C:\WINDOWS\system32\pubprn.vbs
2006-01-13 03:03:47 ----A---- C:\WINDOWS\system32\pstorsvc.dll
2006-01-13 03:03:47 ----A---- C:\WINDOWS\system32\pstorec.dll
2006-01-13 03:03:47 ----A---- C:\WINDOWS\system32\psnppagn.dll
2006-01-13 03:03:47 ----A---- C:\WINDOWS\system32\pschdprf.ini
2006-01-13 03:03:47 ----A---- C:\WINDOWS\system32\pschdprf.dll
2006-01-13 03:03:47 ----A---- C:\WINDOWS\system32\psbase.dll
2006-01-13 03:03:47 ----A---- C:\WINDOWS\system32\psapi.dll
2006-01-13 03:03:47 ----A---- C:\WINDOWS\system32\proxycfg.exe
2006-01-13 03:03:47 ----A---- C:\WINDOWS\system32\proquota.exe
2006-01-13 03:03:47 ----A---- C:\WINDOWS\system32\progman.exe
2006-01-13 03:03:47 ----A---- C:\WINDOWS\system32\profmap.dll
2006-01-13 03:03:47 ----A---- C:\WINDOWS\system32\prodspec.ini
2006-01-13 03:03:47 ----A---- C:\WINDOWS\system32\print.exe
2006-01-13 03:03:47 ----A---- C:\WINDOWS\system32\prflbmsg.dll
2006-01-13 03:03:47 ----A---- C:\WINDOWS\system32\presetup.cmd
2006-01-13 03:03:47 ----A---- C:\WINDOWS\system32\msgsvc.dll
2006-01-13 03:03:47 ----A---- C:\WINDOWS\procexp.exe
2006-01-13 03:03:31 ----A---- C:\WINDOWS\system32\winbrand.dll
2006-01-13 03:03:31 ----A---- C:\WINDOWS\system32\tcmsetup.exe
2006-01-13 03:03:31 ----A---- C:\WINDOWS\system32\taskmgr.exe
2006-01-13 03:03:31 ----A---- C:\WINDOWS\system32\taskman.exe
2006-01-13 03:03:31 ----A---- C:\WINDOWS\system32\tasklist.exe
2006-01-13 03:03:31 ----A---- C:\WINDOWS\system32\taskkill.exe
2006-01-13 03:03:31 ----A---- C:\WINDOWS\system32\tapiui.dll
2006-01-13 03:03:31 ----A---- C:\WINDOWS\system32\tapisrv.dll
2006-01-13 03:03:14 ----A---- C:\WINDOWS\system32\msvbvm60.dll
2006-01-13 03:03:14 ----A---- C:\WINDOWS\system32\msvbvm50.dll
2006-01-13 03:02:51 ----A---- C:\WINDOWS\system32\arp.exe
2006-01-13 03:02:50 ----A---- C:\WINDOWS\system32\mfc40u.dll
2006-01-13 03:02:50 ----A---- C:\WINDOWS\system32\mfc40.dll
2006-01-13 03:02:50 ----A---- C:\WINDOWS\system32\mf3216.dll
2006-01-13 03:02:32 ----A---- C:\WINDOWS\system32\qfecheck.exe
2006-01-13 03:02:32 ----A---- C:\WINDOWS\system32\qedwipes.dll
2006-01-13 03:02:23 ----A---- C:\WINDOWS\system32\ipxsap.dll
2006-01-13 03:02:23 ----A---- C:\WINDOWS\system32\ipxrtmgr.dll
2006-01-13 03:02:21 ----A---- C:\WINDOWS\system32\xvidvfw.dll
2006-01-13 03:02:21 ----A---- C:\desktop.ini
2006-01-13 03:02:21 ----A---- C:\cleanup.cmd
2006-01-13 03:02:20 ----A---- C:\WINDOWS\system32\ntmssvc.dll
2006-01-13 03:02:06 ----A---- C:\WINDOWS\system32\termmgr.dll
2006-01-13 03:02:06 ----A---- C:\WINDOWS\system32\telnet.exe
2006-01-13 03:02:06 ----A---- C:\WINDOWS\system32\tcpsvcs.exe
2006-01-13 03:02:06 ----A---- C:\WINDOWS\system32\tcpmonui.dll
2006-01-13 03:02:06 ----A---- C:\WINDOWS\system32\tcpmon.ini
2006-01-13 03:02:06 ----A---- C:\WINDOWS\system32\tcpmon.dll
2006-01-13 03:02:06 ----A---- C:\WINDOWS\system32\tcpmib.dll
2006-01-13 03:01:38 ----A---- C:\WINDOWS\system32\ipxpromn.dll
2006-01-13 03:01:38 ----A---- C:\WINDOWS\system32\blackbox.dll
2006-01-13 03:01:38 ----A---- C:\WINDOWS\system32\bidispl.dll
2006-01-13 03:01:38 ----A---- C:\WINDOWS\system32\batmeter.dll
2006-01-13 03:01:38 ----A---- C:\WINDOWS\system32\basesrv.dll
2006-01-13 03:01:33 ----A---- C:\WINDOWS\system32\msxml2r.dll
2006-01-13 03:01:33 ----A---- C:\WINDOWS\system32\msxml2.dll
2006-01-13 03:01:09 ----A---- C:\WINDOWS\system32\winntbbu.dll
2006-01-13 03:01:00 ----A---- C:\WINDOWS\system32\winnls.dll
2006-01-13 03:01:00 ----A---- C:\WINDOWS\system32\winmsd.exe
2006-01-13 03:01:00 ----A---- C:\WINDOWS\system32\winmm.dll
2006-01-13 03:01:00 ----A---- C:\WINDOWS\system32\winlogon.exe
2006-01-13 03:00:58 ----A---- C:\WINDOWS\system32\wmdrmdev.dll
2006-01-13 03:00:58 ----A---- C:\WINDOWS\system32\WMDMPS.dll
2006-01-13 03:00:58 ----A---- C:\WINDOWS\system32\WMDMLOG.dll
2006-01-13 03:00:58 ----A---- C:\WINDOWS\system32\WMASF.dll
2006-01-13 03:00:58 ----A---- C:\WINDOWS\system32\WMADMOE.dll
2006-01-13 03:00:58 ----A---- C:\WINDOWS\system32\ole2.dll
2006-01-13 03:00:57 ----A---- C:\WINDOWS\system32\ipxroute.exe
2006-01-13 03:00:56 ----A---- C:\WINDOWS\system32\samsrv.dll
2006-01-13 03:00:56 ----A---- C:\WINDOWS\system32\samlib.dll
2006-01-13 03:00:43 ----A---- C:\WINDOWS\system32\ole2disp.dll
2006-01-13 03:00:43 ----A---- C:\WINDOWS\system32\lsasrv.dll
2006-01-13 03:00:43 ----A---- C:\WINDOWS\system32\lprmonui.dll
2006-01-13 03:00:43 ----A---- C:\WINDOWS\system32\lprhelp.dll
2006-01-13 03:00:43 ----A---- C:\WINDOWS\system32\ipxwan.dll
2006-01-13 03:00:43 ----A---- C:\WINDOWS\system32\ipxrip.dll
2006-01-13 03:00:43 ----A---- C:\WINDOWS\system32\ipxmontr.dll
2006-01-13 03:00:42 ----A---- C:\WINDOWS\system32\offfilt.dll
2006-01-13 03:00:31 ----A---- C:\WINDOWS\system32\logonui.exe
2006-01-13 03:00:22 ----A---- C:\WINDOWS\system32\dpwsockx.dll
2006-01-13 03:00:22 ----A---- C:\WINDOWS\system32\dpwsock.dll
2006-01-13 03:00:22 ----A---- C:\WINDOWS\system32\dpvvox.dll
2006-01-13 03:00:22 ----A---- C:\WINDOWS\system32\dpvsetup.exe
2006-01-13 03:00:22 ----A---- C:\WINDOWS\system32\dpvoice.dll
2006-01-13 03:00:22 ----A---- C:\WINDOWS\system32\dpvacm.dll
2006-01-13 03:00:22 ----A---- C:\WINDOWS\system32\dpserial.dll
2006-01-13 03:00:22 ----A---- C:\WINDOWS\system32\dpnwsock.dll
2006-01-13 03:00:22 ----A---- C:\WINDOWS\system32\dpnsvr.exe
2006-01-13 03:00:22 ----A---- C:\WINDOWS\system32\dpnmodem.dll
2006-01-13 03:00:22 ----A---- C:\WINDOWS\system32\dpnlobby.dll
2006-01-13 03:00:22 ----A---- C:\WINDOWS\system32\dpnhpast.dll
2006-01-13 03:00:22 ----A---- C:\WINDOWS\system32\dpnet.dll
2006-01-13 03:00:21 ----A---- C:\WINDOWS\system32\lpk.dll
2006-01-13 03:00:20 ----A---- C:\WINDOWS\system32\dpnhupnp.dll
2006-01-13 03:00:16 ----A---- C:\WINDOWS\system32\lpr.exe
2006-01-13 03:00:14 ----A---- C:\WINDOWS\system32\lpq.exe
2006-01-13 03:00:08 ----A---- C:\WINDOWS\system32\d3drm.dll
2006-01-13 03:00:08 ----A---- C:\WINDOWS\system32\d3dramp.dll
2006-01-13 03:00:08 ----A---- C:\WINDOWS\system32\d3dpmesh.dll
2006-01-13 03:00:08 ----A---- C:\WINDOWS\system32\d3dim700.dll
2006-01-13 03:00:08 ----A---- C:\WINDOWS\system32\d3dim.dll
2006-01-13 03:00:08 ----A---- C:\WINDOWS\system32\d3d9.dll
2006-01-13 02:59:54 ----A---- C:\WINDOWS\system32\netman.dll
2006-01-13 02:59:53 ----A---- C:\WINDOWS\system32\netlogon.dll
2006-01-13 02:59:53 ----A---- C:\WINDOWS\system32\netid.dll
2006-01-13 02:59:53 ----A---- C:\WINDOWS\system32\neth.dll
2006-01-13 02:59:53 ----A---- C:\WINDOWS\system32\netevent.dll
2006-01-13 02:59:53 ----A---- C:\WINDOWS\system32\netdde.exe
2006-01-13 02:59:43 ----A---- C:\WINDOWS\system32\ddraw.dll
2006-01-13 02:59:43 ----A---- C:\WINDOWS\system32\ddeshare.exe
2006-01-13 02:59:43 ----A---- C:\WINDOWS\system32\ddeml.dll
2006-01-13 02:59:43 ----A---- C:\WINDOWS\system32\dciman32.dll
2006-01-13 02:59:43 ----A---- C:\WINDOWS\system32\dbnmpntw.dll
2006-01-13 02:59:43 ----A---- C:\WINDOWS\system32\dbnetlib.dll
2006-01-13 02:59:43 ----A---- C:\WINDOWS\system32\dbmsrpcn.dll
2006-01-13 02:59:43 ----A---- C:\WINDOWS\system32\dbghelp.dll
2006-01-13 02:59:42 ----A---- C:\WINDOWS\system32\sysocmgr.exe
2006-01-13 02:59:27 ----A---- C:\WINDOWS\system32\netcfgx.dll
2006-01-13 02:58:52 ----A---- C:\WINDOWS\system32\tracert6.exe
2006-01-13 02:58:52 ----A---- C:\WINDOWS\system32\toolhelp.dll
2006-01-13 02:58:52 ----A---- C:\WINDOWS\system32\tlntsess.exe
2006-01-13 02:58:46 ----A---- C:\WINDOWS\system32\Ir41_qc.dll
2006-01-13 02:58:35 ----A---- C:\WINDOWS\system32\tracerpt.exe
2006-01-13 02:58:35 ----A---- C:\WINDOWS\system32\tlntsvr.exe
2006-01-13 02:58:24 ----A---- C:\WINDOWS\system32\tracert.exe
2006-01-13 02:58:24 ----A---- C:\WINDOWS\system32\tlntsvrp.dll
2006-01-13 02:58:24 ----A---- C:\WINDOWS\system32\tlntadmn.exe
2006-01-13 02:58:24 ----A---- C:\WINDOWS\system32\krnl386.exe
2006-01-13 02:58:24 ----A---- C:\WINDOWS\system32\keymgr.dll
2006-01-13 02:58:24 ----A---- C:\WINDOWS\system32\kernel32.dll
2006-01-13 02:58:19 ----A---- C:\WINDOWS\system32\d3d8thk.dll
2006-01-13 02:58:19 ----A---- C:\WINDOWS\system32\d3d8.dll
2006-01-13 02:58:10 ----A---- C:\WINDOWS\system32\win87em.dll
2006-01-13 02:58:10 ----A---- C:\WINDOWS\system32\win32spl.dll
2006-01-13 02:58:10 ----A---- C:\WINDOWS\system32\advpack.dll
2006-01-13 02:58:10 ----A---- C:\WINDOWS\system32\advapi32.dll
2006-01-13 02:58:04 ----A---- C:\WINDOWS\system32\setupold.exe
2006-01-13 02:58:04 ----A---- C:\WINDOWS\system32\setupapi.dll
2006-01-13 02:58:04 ----A---- C:\WINDOWS\system32\setup.exe
2006-01-13 02:58:04 ----A---- C:\WINDOWS\system32\sethc.exe
2006-01-13 02:58:04 ----A---- C:\WINDOWS\system32\serwvdrv.dll
2006-01-13 02:58:04 ----A---- C:\WINDOWS\system32\services.msc
2006-01-13 02:57:59 ----A---- C:\WINDOWS\system32\LegitCheckControl.dll
2006-01-13 02:57:42 ----A---- C:\WINDOWS\system32\xmlprovi.dll
2006-01-13 02:57:42 ----A---- C:\WINDOWS\system32\xmlprov.dll
2006-01-13 02:57:42 ----A---- C:\WINDOWS\system32\xenroll.dll
2006-01-13 02:57:42 ----A---- C:\WINDOWS\system32\xcopy.exe
2006-01-13 02:57:42 ----A---- C:\WINDOWS\system32\xactsrv.dll
2006-01-13 02:57:41 ----A---- C:\WINDOWS\vmmreg32.dll
2006-01-13 02:57:41 ----A---- C:\WINDOWS\system32\vssvc.exe
2006-01-13 02:57:41 ----A---- C:\WINDOWS\system32\vssapi.dll
2006-01-13 02:57:41 ----A---- C:\WINDOWS\system32\vssadmin.exe
2006-01-13 02:57:41 ----A---- C:\WINDOWS\system32\vjoy.dll
2006-01-13 02:57:20 ----A---- C:\WINDOWS\system32\objsel.dll
2006-01-13 02:57:13 ----A---- C:\WINDOWS\system32\webvw.dll
2006-01-13 02:57:13 ----A---- C:\WINDOWS\system32\webhits.dll
2006-01-13 02:57:07 ----A---- C:\WINDOWS\system32\WMSPDMOD.dll
2006-01-13 02:57:07 ----A---- C:\WINDOWS\system32\wmsdmod.dll
2006-01-13 02:57:01 ----A---- C:\WINDOWS\system32\lsass.exe
2006-01-13 02:56:57 ----A---- C:\WINDOWS\system32\trkwks.dll
2006-01-13 02:56:57 ----A---- C:\WINDOWS\system32\tree.com
2006-01-13 02:56:57 ----A---- C:\WINDOWS\system32\traffic.dll
2006-01-13 02:56:56 ----A---- C:\WINDOWS\system32\GWFSPIDGen.dll
2006-01-13 02:56:46 ----A---- C:\WINDOWS\system32\grpconv.exe
2006-01-13 02:56:42 ----A---- C:\WINDOWS\system32\ntmsoprq.msc
2006-01-13 02:56:42 ----A---- C:\WINDOWS\system32\ntmsmgr.msc
2006-01-13 02:56:42 ----A---- C:\WINDOWS\system32\ntmsmgr.dll
2006-01-13 02:56:42 ----A---- C:\WINDOWS\system32\ntmsevt.dll
2006-01-13 02:56:42 ----A---- C:\WINDOWS\system32\ntmsdba.dll
2006-01-13 02:56:42 ----A---- C:\WINDOWS\system32\ntmsapi.dll
2006-01-13 02:56:42 ----A---- C:\WINDOWS\system32\ntmarta.dll
2006-01-13 02:56:42 ----A---- C:\WINDOWS\system32\ntlsapi.dll
2006-01-13 02:56:36 ----A---- C:\WINDOWS\system32\mmcndmgr.dll
2006-01-13 02:56:36 ----A---- C:\WINDOWS\system32\mmcbase.dll
2006-01-13 02:56:36 ----A---- C:\WINDOWS\system32\mmc.exe
2006-01-13 02:56:31 ----A---- C:\WINDOWS\system32\wmp.dll
2006-01-13 02:56:29 ----A---- C:\WINDOWS\system32\WMNetMgr.dll
2006-01-13 02:55:54 ----A---- C:\WINDOWS\system32\ntdsapi.dll
2006-01-13 02:55:54 ----A---- C:\WINDOWS\system32\mydocs.dll
2006-01-13 02:55:54 ----A---- C:\WINDOWS\system32\mycomput.dll
2006-01-13 02:55:54 ----A---- C:\WINDOWS\system32\muweb.dll
2006-01-13 02:55:54 ----A---- C:\WINDOWS\system32\mtxclu.dll
2006-01-13 02:55:54 ----A---- C:\WINDOWS\system32\msxmlr.dll
2006-01-13 02:55:54 ----A---- C:\WINDOWS\system32\msxml5r.dll
2006-01-13 02:55:54 ----A---- C:\WINDOWS\system32\gpupdate.exe
2006-01-13 02:55:52 ----A---- C:\WINDOWS\system32\dmime.dll
2006-01-13 02:55:52 ----A---- C:\WINDOWS\system32\dmdskmgr.dll
2006-01-13 02:55:50 ----A---- C:\WINDOWS\system32\tapiperf.dll
2006-01-13 02:55:50 ----A---- C:\WINDOWS\system32\tapi32.dll
2006-01-13 02:55:50 ----A---- C:\WINDOWS\system32\tapi3.dll
2006-01-13 02:55:50 ----A---- C:\WINDOWS\system32\tapi.dll
2006-01-13 02:55:50 ----A---- C:\WINDOWS\system32\rpcrt4.dll
2006-01-13 02:55:50 ----A---- C:\WINDOWS\system32\rpcns4.dll
2006-01-13 02:55:50 ----A---- C:\WINDOWS\system32\ntdsbcli.dll
2006-01-13 02:55:50 ----A---- C:\WINDOWS\system32\dmdskres.dll
2006-01-13 02:55:41 ----A---- C:\WINDOWS\system32\dmintf.dll
2006-01-13 02:55:39 ----A---- C:\WINDOWS\system32\dmdlgs.dll
2006-01-13 02:55:38 ----A---- C:\WINDOWS\system32\graphics.com
2006-01-13 02:55:33 ----A---- C:\WINDOWS\system32\vp6vfw.dll
2006-01-13 02:55:32 ----A---- C:\WINDOWS\system32\WMADMOD.dll
2006-01-13 02:55:32 ----A---- C:\WINDOWS\system32\hotplug.dll
2006-01-13 02:55:32 ----A---- C:\WINDOWS\system32\hostname.exe
2006-01-13 02:55:32 ----A---- C:\WINDOWS\system32\hnetwiz.dll
2006-01-13 02:55:32 ----A---- C:\WINDOWS\system32\graftabl.com
2006-01-13 02:55:32 ----A---- C:\WINDOWS\system32\gptext.dll
2006-01-13 02:55:32 ----A---- C:\WINDOWS\system32\dmconfig.dll
2006-01-13 02:55:32 ----A---- C:\WINDOWS\system32\dmcompos.dll
2006-01-13 02:55:28 ----A---- C:\WINDOWS\system32\hnetcfg.dll
2006-01-13 02:55:15 ----A---- C:\WINDOWS\system32\iesetup.dll
2006-01-13 02:55:15 ----A---- C:\WINDOWS\system32\iernonce.dll
2006-01-13 02:55:15 ----A---- C:\WINDOWS\system32\ieencode.dll
2006-01-13 02:55:14 ----A---- C:\WINDOWS\system32\hnetmon.dll
2006-01-13 02:55:02 ----A---- C:\WINDOWS\system32\ogg.dll
2006-01-13 02:55:02 ----A---- C:\WINDOWS\system32\mshta.exe
2006-01-13 02:54:59 ----A---- C:\WINDOWS\system32\shdocvw.dll
2006-01-13 02:54:59 ----A---- C:\WINDOWS\system32\shdoclc.dll
2006-01-13 02:54:56 ----A---- C:\WINDOWS\system32\msgina.dll
2006-01-13 02:54:56 ----A---- C:\WINDOWS\system32\msftedit.dll
2006-01-13 02:54:52 ----A---- C:\WINDOWS\system32\powercfg.exe
2006-01-13 02:54:52 ----A---- C:\WINDOWS\system32\pnrpnsp.dll
2006-01-13 02:54:45 ----A---- C:\WINDOWS\system32\oakley.dll
2006-01-13 02:54:45 ----A---- C:\WINDOWS\system32\nwwks.dll
2006-01-13 02:54:45 ----A---- C:\WINDOWS\system32\nwscript.exe
2006-01-13 02:54:45 ----A---- C:\WINDOWS\system32\nwprovau.dll
2006-01-13 02:54:29 ----A---- C:\WINDOWS\system32\untfs.dll
2006-01-13 02:54:29 ----A---- C:\WINDOWS\system32\unlodctr.exe
2006-01-13 02:54:29 ----A---- C:\WINDOWS\system32\uniplat.dll
2006-01-13 02:54:29 ----A---- C:\WINDOWS\system32\unimdmat.dll
2006-01-13 02:54:29 ----A---- C:\WINDOWS\system32\umpnpmgr.dll
2006-01-13 02:54:29 ----A---- C:\WINDOWS\system32\umdmxfrm.dll
2006-01-13 02:54:29 ----A---- C:\WINDOWS\system32\umandlg.dll
2006-01-13 02:54:29 ----A---- C:\WINDOWS\system32\ulib.dll
2006-01-13 02:54:28 ----A---- C:\WINDOWS\system32\mode.com
2006-01-13 02:54:22 ----A---- C:\WINDOWS\system32\ver.dll
2006-01-13 02:54:15 ----A---- C:\WINDOWS\system32\vdmredir.dll
2006-01-13 02:54:15 ----A---- C:\WINDOWS\system32\vdmdbg.dll
2006-01-13 02:54:15 ----A---- C:\WINDOWS\system32\vcdex.dll
2006-01-13 02:54:15 ----A---- C:\WINDOWS\system32\VCdControlTool.exe
2006-01-13 02:54:15 ----A---- C:\WINDOWS\system32\powrprof.dll
2006-01-13 02:54:15 ----A---- C:\WINDOWS\system32\polstore.dll
2006-01-13 02:54:12 ----A---- C:\WINDOWS\system32\msxml3r.dll
2006-01-13 02:54:11 ----A---- C:\WINDOWS\system32\wavemsp.dll
2006-01-13 02:54:11 ----A---- C:\WINDOWS\system32\mountvol.exe
2006-01-13 02:54:11 ----A---- C:\WINDOWS\system32\moricons.dll
2006-01-13 02:54:11 ----A---- C:\WINDOWS\system32\more.com
2006-01-13 02:54:11 ----A---- C:\WINDOWS\system32\igmpagnt.dll
2006-01-13 02:54:11 ----A---- C:\WINDOWS\system32\ifsutil.dll
2006-01-13 02:54:11 ----A---- C:\WINDOWS\system32\ifmon.dll
2006-01-13 02:54:11 ----A---- C:\WINDOWS\system32\iexpress.exe
2006-01-13 02:54:10 ----A---- C:\WINDOWS\system32\themeui.dll
2006-01-13 02:53:55 ----A---- C:\WINDOWS\system32\wzcdlg.dll
2006-01-13 02:53:55 ----A---- C:\WINDOWS\system32\wuweb.dll
2006-01-13 02:53:55 ----A---- C:\WINDOWS\system32\wupdmgr.exe
2006-01-13 02:53:48 ----RASH---- C:\NTDETECT.COM
2006-01-13 02:53:48 ----A---- C:\WINDOWS\system32\ntdll.dll
2006-01-13 02:53:32 ----A---- C:\WINDOWS\system32\shell32.dll
2006-01-13 02:53:16 ----A---- C:\WINDOWS\system32\Ir32_32.dll
2006-01-13 02:53:03 ----A---- C:\WINDOWS\system32\autofmt.exe
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\wups2.dll
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\systeminfo.exe
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\shellstyle.dll
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\pagefileconfig.vbs
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\openfiles.exe
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\msjetoledb40.dll
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\eventtriggers.exe
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\eventquery.vbs
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\eventcreate.exe
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\driverquery.exe
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\CopyToSendTo.dll
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\cidaemon.exe
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\cic.dll
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\ciadv.msc
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\ciadmin.dll
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\chkntfs.exe
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\chkdsk.exe
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\chcp.com
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\cfgmgr32.dll
2006-01-13 02:52:59 ----A---- C:\WINDOWS\system32\CEWMDM.dll
2006-01-13 02:52:52 ----A---- C:\WINDOWS\system32\MRT.exe
2006-01-13 02:52:33 ----A---- C:\WINDOWS\system32\infosoft.dll
2006-01-13 02:52:18 ----A---- C:\WINDOWS\system32\msdmo.dll
2006-01-13 02:52:18 ----A---- C:\WINDOWS\system32\msdart.dll
2006-01-13 02:52:18 ----A---- C:\WINDOWS\msdfmap.ini
2006-01-13 02:52:17 ----A---- C:\WINDOWS\system32\xvidcore.dll
2006-01-13 02:52:17 ----A---- C:\WINDOWS\system32\syssetup.dll
2006-01-13 02:52:07 ----A---- C:\WINDOWS\system32\scrobj.dll
2006-01-13 02:51:41 ----A---- C:\WINDOWS\system32\msexcl40.dll
2006-01-13 02:51:41 ----A---- C:\WINDOWS\system32\msexch40.dll
2006-01-13 02:51:30 ----A---- C:\WINDOWS\system32\msxml5.dll
2006-01-13 02:51:29 ----A---- C:\WINDOWS\system32\riched32.dll
2006-01-13 02:51:29 ----A---- C:\WINDOWS\system32\riched20.dll
2006-01-13 02:51:29 ----A---- C:\WINDOWS\system32\rexec.exe
2006-01-13 02:51:29 ----A---- C:\WINDOWS\system32\resutils.dll
2006-01-13 02:51:29 ----A---- C:\WINDOWS\system32\replace.exe
2006-01-13 02:51:20 ----A---- C:\WINDOWS\system32\mem.exe
2006-01-13 02:51:20 ----A---- C:\WINDOWS\system32\mdminst.dll
2006-01-13 02:51:11 ----A---- C:\WINDOWS\system32\msxml4r.dll
2006-01-13 02:51:11 ----A---- C:\WINDOWS\system32\btpanui.dll
2006-01-13 02:51:11 ----A---- C:\WINDOWS\system32\bthserv.dll
2006-01-13 02:51:11 ----A---- C:\WINDOWS\system32\browsewm.dll
2006-01-13 02:51:11 ----A---- C:\WINDOWS\system32\browseui.dll
2006-01-13 02:51:04 ----A---- C:\WINDOWS\system32\share.exe
2006-01-13 02:51:04 ----A---- C:\WINDOWS\system32\sfmapi.dll
2006-01-13 02:51:04 ----A---- C:\WINDOWS\system32\sfcfiles.dll
2006-01-13 02:51:04 ----A---- C:\WINDOWS\system32\sfc_os.dll
2006-01-13 02:51:04 ----A---- C:\WINDOWS\system32\sfc.exe
2006-01-13 02:51:04 ----A---- C:\WINDOWS\system32\sfc.dll
2006-01-13 02:51:04 ----A---- C:\WINDOWS\system32\setver.exe
2006-01-13 02:51:03 ----A---- C:\WINDOWS\system32\msjint40.dll
2006-01-13 02:51:03 ----A---- C:\WINDOWS\system32\msjet40.dll
2006-01-13 02:50:58 ----A---- C:\WINDOWS\system32\zipfldr.dll
2006-01-13 02:50:44 ----A---- C:\WINDOWS\win.ini
2006-01-13 02:50:44 ----A---- C:\WINDOWS\system32\win.com
2006-01-13 02:50:44 ----A---- C:\WINDOWS\system32\wifeman.dll
2006-01-13 02:50:44 ----A---- C:\WINDOWS\system32\wiavusd.dll
2006-01-13 02:50:44 ----A---- C:\WINDOWS\system32\wiavideo.dll
2006-01-13 02:50:44 ----A---- C:\WINDOWS\system32\wiashext.dll
2006-01-13 02:50:44 ----A---- C:\WINDOWS\system32\wiaservc.dll
2006-01-13 02:50:44 ----A---- C:\WINDOWS\system32\wiascr.dll
2006-01-13 02:50:44 ----A---- C:\WINDOWS\system32\wiadss.dll
2006-01-13 02:50:44 ----A---- C:\WINDOWS\system32\scrrun.dll
2006-01-13 02:50:44 ----A---- C:\WINDOWS\system32\bthci.dll
2006-01-13 02:50:19 ----A---- C:\WINDOWS\system32\mstlsapi.dll
2006-01-13 02:50:19 ----A---- C:\WINDOWS\system32\mstext40.dll
2006-01-13 02:50:12 ----A---- C:\WINDOWS\system32\sclgntfy.dll
2006-01-13 02:50:12 ----A---- C:\WINDOWS\system32\notepad.exe
2006-01-13 02:50:03 ----A---- C:\WINDOWS\system32\input.dll
2006-01-13 02:50:03 ----A---- C:\WINDOWS\system32\initpki.dll
2006-01-13 02:49:37 ----A---- C:\WINDOWS\system32\adsldp.dll
2006-01-13 02:49:37 ----A---- C:\WINDOWS\system32\adptif.dll
2006-01-13 02:49:37 ----A---- C:\WINDOWS\system32\admparse.dll
2006-01-13 02:49:35 ----A---- C:\WINDOWS\system32\WMVADVD.dll
2006-01-13 02:49:35 ----A---- C:\WINDOWS\system32\wmstream.dll
2006-01-13 02:49:34 ----A---- C:\WINDOWS\system32\srvsvc.dll
2006-01-13 02:49:11 ----A---- C:\WINDOWS\system32\cnetcfg.dll
2006-01-13 02:49:11 ----A---- C:\WINDOWS\system32\cmutil.dll
2006-01-13 02:49:11 ----A---- C:\WINDOWS\system32\cmpbk32.dll
2006-01-13 02:49:11 ----A---- C:\WINDOWS\system32\cmmon32.exe
2006-01-13 02:49:11 ----A---- C:\WINDOWS\system32\cmdial32.dll
2006-01-13 02:49:10 ----A---- C:\WINDOWS\system32\scredir.dll
2006-01-13 02:49:10 ----A---- C:\WINDOWS\system32\cmdl32.exe
2006-01-13 02:49:10 ----A---- C:\WINDOWS\system32\cmd.exe
2006-01-13 02:49:10 ----A---- C:\WINDOWS\system32\cdm.dll
2006-01-13 02:49:09 ----A---- C:\WINDOWS\system32\scriptpw.dll
2006-01-13 02:49:09 ----A---- C:\WINDOWS\system32\cnvfat.dll
2006-01-13 02:49:09 ----A---- C:\WINDOWS\system32\cmstp.exe
2006-01-13 02:49:09 ----A---- C:\WINDOWS\system32\cmsetACL.dll
2006-01-13 02:49:09 ----A---- C:\WINDOWS\system32\ccfgnt.dll
2006-01-13 02:48:27 ----A---- C:\WINDOWS\system32\ntlanui2.dll
2006-01-13 02:48:27 ----A---- C:\WINDOWS\system32\ntlanui.dll
2006-01-13 02:48:27 ----A---- C:\WINDOWS\system32\ntlanman.dll
2006-01-13 02:48:24 ----A---- C:\WINDOWS\system32\msls31.dll
2006-01-13 02:48:24 ----A---- C:\WINDOWS\system32\msjtes40.dll
2006-01-13 02:48:24 ----A---- C:\WINDOWS\system32\msjter40.dll
2006-01-13 02:48:18 ----A---- C:\WINDOWS\system32\smss.exe
2006-01-13 02:48:18 ----A---- C:\WINDOWS\system32\smlogsvc.exe
2006-01-13 02:48:18 ----A---- C:\WINDOWS\system32\smlogcfg.dll
2006-01-13 02:48:18 ----A---- C:\WINDOWS\system32\smbinst.exe
2006-01-13 02:48:18 ----A---- C:\WINDOWS\system32\msltus40.dll
2006-01-13 02:48:06 ----A---- C:\WINDOWS\system32\clb.dll
2006-01-13 02:48:06 ----A---- C:\WINDOWS\system32\ckcnv.exe
2006-01-13 02:48:06 ----A---- C:\WINDOWS\system32\cisvc.exe
2006-01-13 02:48:06 ----A---- C:\WINDOWS\system32\cipher.exe
2006-01-13 02:48:06 ----A---- C:\WINDOWS\system32\ciodm.dll
2006-01-13 02:48:01 ----A---- C:\WINDOWS\system32\raschap.dll
2006-01-13 02:48:01 ----A---- C:\WINDOWS\system32\rasautou.exe
2006-01-13 02:48:01 ----A---- C:\WINDOWS\system32\rasauto.dll
2006-01-13 02:48:01 ----A---- C:\WINDOWS\system32\rasapi32.dll
2006-01-13 02:48:01 ----A---- C:\WINDOWS\system32\rasadhlp.dll
2006-01-13 02:48:01 ----A---- C:\WINDOWS\system32\query.dll
2006-01-13 02:47:51 ----A---- C:\WINDOWS\system32\msvidctl.dll
2006-01-13 02:47:51 ----A---- C:\WINDOWS\system32\msvidc32.dll
2006-01-13 02:47:51 ----A---- C:\WINDOWS\system32\msvfw32.dll
2006-01-13 02:47:51 ----A---- C:\WINDOWS\system32\msvcrt40.dll
2006-01-13 02:47:51 ----A---- C:\WINDOWS\system32\msvcrt20.dll
2006-01-13 02:47:51 ----A---- C:\WINDOWS\system32\msvcrt.dll
2006-01-13 02:47:35 ----A---- C:\WINDOWS\system32\wscsvc.dll
2006-01-13 02:47:35 ----A---- C:\WINDOWS\system32\wscript.exe
2006-01-13 02:47:35 ----A---- C:\WINDOWS\system32\wscntfy.exe
2006-01-13 02:47:35 ----A---- C:\WINDOWS\system32\ws2help.dll
2006-01-13 02:47:35 ----A---- C:\WINDOWS\system32\ws2_32.dll
2006-01-13 02:47:35 ----A---- C:\WINDOWS\system32\wpnpinst.exe
2006-01-13 02:47:35 ----A---- C:\WINDOWS\system32\wpdtrace.dll
2006-01-13 02:47:35 ----A---- C:\WINDOWS\system32\WPDSp.dll
2006-01-13 02:47:35 ----A---- C:\WINDOWS\system32\wpdmtpus.dll
2006-01-13 02:47:35 ----A---- C:\WINDOWS\system32\wpd_ci.dll
2006-01-13 02:47:30 ----A---- C:\WINDOWS\system32\dhcpmon.dll
2006-01-13 02:47:30 ----A---- C:\WINDOWS\system32\dhcpcsvc.dll
2006-01-13 02:47:30 ----A---- C:\WINDOWS\system32\dgnet.dll
2006-01-13 02:47:30 ----A---- C:\WINDOWS\system32\dfsshlex.dll
2006-01-13 02:47:30 ----A---- C:\WINDOWS\system32\dfrgui.dll
2006-01-13 02:47:30 ----A---- C:\WINDOWS\system32\dfrgsnap.dll
2006-01-13 02:47:30 ----A---- C:\WINDOWS\system32\dfrgres.dll
2006-01-13 02:47:30 ----A---- C:\WINDOWS\system32\dfrgntfs.exe
2006-01-13 02:47:30 ----A---- C:\WINDOWS\system32\dfrgfat.exe
2006-01-13 02:47:30 ----A---- C:\WINDOWS\system32\dfrg.msc
2006-01-13 02:47:30 ----A---- C:\WINDOWS\system32\devmgr.dll
2006-01-13 02:47:29 ----A---- C:\WINDOWS\system32\iedkcs32.dll
2006-01-13 02:47:29 ----A---- C:\WINDOWS\system32\ieakui.dll
2006-01-13 02:47:29 ----A---- C:\WINDOWS\system32\ieaksie.dll
2006-01-13 02:47:29 ----A---- C:\WINDOWS\system32\ieakeng.dll
2006-01-13 02:47:29 ----A---- C:\WINDOWS\system32\ie4uinit.exe
2006-01-13 02:47:29 ----A---- C:\WINDOWS\system32\idq.dll
2006-01-13 02:47:00 ----A---- C:\WINDOWS\system32\corpol.dll
2006-01-13 02:46:51 ----A---- C:\WINDOWS\system32\cards.dll
2006-01-13 02:46:51 ----A---- C:\WINDOWS\system32\capesnpn.dll
2006-01-13 02:46:51 ----A---- C:\WINDOWS\system32\camocx.dll
2006-01-13 02:46:46 ----A---- C:\WINDOWS\system32\expsrv.dll
2006-01-13 02:46:46 ----A---- C:\WINDOWS\explorer.exe
2006-01-13 02:46:07 ----A---- C:\WINDOWS\system32\migpwd.exe
2006-01-13 02:46:07 ----A---- C:\WINDOWS\system32\miglibnt.dll
2006-01-13 02:46:00 ----A---- C:\WINDOWS\system32\feclient.dll
2006-01-13 02:46:00 ----A---- C:\WINDOWS\system32\fde.dll
2006-01-13 02:46:00 ----A---- C:\WINDOWS\system32\fc.exe
2006-01-13 02:46:00 ----A---- C:\WINDOWS\system32\faultrep.dll
2006-01-13 02:45:41 ----A---- C:\WINDOWS\upx.exe
2006-01-13 02:45:41 ----A---- C:\WINDOWS\system32\urlmon.dll
2006-01-13 02:45:41 ----A---- C:\WINDOWS\system32\url.dll
2006-01-13 02:45:41 ----A---- C:\WINDOWS\system32\ureg.dll
2006-01-13 02:45:41 ----A---- C:\WINDOWS\system32\ups.exe
2006-01-13 02:45:41 ----A---- C:\WINDOWS\system32\upnpui.dll
2006-01-13 02:45:41 ----A---- C:\WINDOWS\system32\upnphost.dll
2006-01-13 02:45:41 ----A---- C:\WINDOWS\system32\upnpcont.exe
2006-01-13 02:45:41 ----A---- C:\WINDOWS\system32\upnp.dll
2006-01-13 02:45:14 ----A---- C:\WINDOWS\system32\wtsapi32.dll
2006-01-13 02:45:14 ----A---- C:\WINDOWS\system32\wstdecod.dll
2006-01-13 02:45:14 ----A---- C:\WINDOWS\system32\fdeploy.dll
2006-01-13 02:44:46 ----A---- C:\WINDOWS\system32\GSpot.exe
2006-01-13 02:44:42 ----A---- C:\WINDOWS\system32\spoolsv.exe
2006-01-13 02:44:42 ----A---- C:\WINDOWS\system32\spoolss.dll
2006-01-13 02:44:41 ----A---- C:\WINDOWS\system32\docprop2.dll
2006-01-13 02:44:41 ----A---- C:\WINDOWS\system32\docprop.dll
2006-01-13 02:44:41 ----A---- C:\WINDOWS\system32\dnsrslvr.dll
2006-01-13 02:44:41 ----A---- C:\WINDOWS\system32\dnsapi.dll
2006-01-13 02:44:41 ----A---- C:\WINDOWS\system32\dmusic.dll
2006-01-13 02:44:41 ----A---- C:\WINDOWS\system32\dmsynth.dll
2006-01-13 02:44:41 ----A---- C:\WINDOWS\system32\dmstyle.dll
2006-01-13 02:44:41 ----A---- C:\WINDOWS\system32\dmserver.dll
2006-01-13 02:44:41 ----A---- C:\WINDOWS\system32\dmscript.dll
2006-01-13 02:44:41 ----A---- C:\WINDOWS\system32\dmremote.exe
2006-01-13 02:44:41 ----A---- C:\WINDOWS\system32\dmocx.dll
2006-01-13 02:44:41 ----A---- C:\WINDOWS\system32\dmloader.dll
2006-01-13 02:44:32 ----A---- C:\WINDOWS\system32\d3dxof.dll
2006-01-13 02:44:15 ----A---- C:\WINDOWS\system32\dvdupgrd.exe
2006-01-13 02:44:15 ----A---- C:\WINDOWS\system32\duser.dll
2006-01-13 02:44:15 ----A---- C:\WINDOWS\system32\dumprep.exe
2006-01-13 02:44:15 ----A---- C:\WINDOWS\system32\dswave.dll
2006-01-13 02:44:15 ----A---- C:\WINDOWS\system32\dssenh.dll
2006-01-13 02:44:15 ----A---- C:\WINDOWS\system32\dssec.dll
2006-01-13 02:44:15 ----A---- C:\WINDOWS\system32\dsquery.dll
2006-01-13 02:44:15 ----A---- C:\WINDOWS\system32\dsprpres.dll
2006-01-13 02:44:15 ----A---- C:\WINDOWS\system32\dsprop.dll
2006-01-13 02:44:10 ----A---- C:\WINDOWS\system32\mfc42.dll
2006-01-13 02:44:10 ----A---- C:\WINDOWS\system32\dsuiext.dll
2006-01-13 02:44:07 ----A---- C:\WINDOWS\system32\asferror.dll
2006-01-13 02:44:03 ----A---- C:\WINDOWS\system32\amstream.dll
2006-01-13 02:44:03 ----A---- C:\WINDOWS\system32\alrsvc.dll
2006-01-13 02:43:49 ----A---- C:\WINDOWS\system32\mrinfo.exe
2006-01-13 02:43:49 ----A---- C:\WINDOWS\system32\mqutil.dll
2006-01-13 02:43:49 ----A---- C:\WINDOWS\system32\mqupgrd.dll
2006-01-13 02:43:49 ----A---- C:\WINDOWS\system32\mqtrig.dll
2006-01-13 02:43:49 ----A---- C:\WINDOWS\system32\mqtgsvc.exe
2006-01-13 02:43:49 ----A---- C:\WINDOWS\system32\mqsvc.exe
2006-01-13 02:43:49 ----A---- C:\WINDOWS\system32\mqsnap.dll
2006-01-13 02:43:42 ----A---- C:\WINDOWS\system32\sqlwoa.dll
2006-01-13 02:43:42 ----A---- C:\WINDOWS\system32\sqlwid.dll
2006-01-13 02:43:42 ----A---- C:\WINDOWS\system32\sqlunirl.dll
2006-01-13 02:43:38 ----A---- C:\WINDOWS\system32\mfc42u.dll
2006-01-13 02:43:10 ----A---- C:\WINDOWS\system32\compatUI.dll
2006-01-13 02:43:08 ----A---- C:\WINDOWS\system32\msxml.dll
2006-01-13 02:43:08 ----A---- C:\WINDOWS\system32\msxbde40.dll
2006-01-13 02:43:03 ----A---- C:\WINDOWS\system32\mswdat10.dll
2006-01-13 02:43:03 ----A---- C:\WINDOWS\system32\msw3prt.dll
2006-01-13 02:43:03 ----A---- C:\WINDOWS\system32\msvideo.dll
2006-01-13 02:42:33 ----A---- C:\WINDOWS\system32\msswchx.exe
2006-01-13 02:42:33 ----A---- C:\WINDOWS\system32\msswch.dll
2006-01-13 02:42:33 ----A---- C:\WINDOWS\system32\mssip32.dll
2006-01-13 02:42:33 ----A---- C:\WINDOWS\system32\mssign32.dll
2006-01-13 02:42:33 ----A---- C:\WINDOWS\system32\MSSCP.dll
2006-01-13 02:42:33 ----A---- C:\WINDOWS\system32\msdadiag.dll
2006-01-13 02:42:33 ----A---- C:\WINDOWS\system32\MSCTFP.dll
2006-01-13 02:42:33 ----A---- C:\WINDOWS\system32\MSCTF.dll
2006-01-13 02:42:33 ----A---- C:\WINDOWS\system32\mscpxl32.dLL
2006-01-13 02:42:33 ----A---- C:\WINDOWS\system32\mscpx32r.dLL
2006-01-13 02:42:03 ----A---- C:\WINDOWS\system32\vga64k.dll
2006-01-13 02:42:03 ----A---- C:\WINDOWS\system32\vga256.dll
2006-01-13 02:42:03 ----A---- C:\WINDOWS\system32\vga.dll
2006-01-13 02:42:03 ----A---- C:\WINDOWS\system32\vfpodbc.dll
2006-01-13 02:42:03 ----A---- C:\WINDOWS\system32\version.dll
2006-01-13 02:42:03 ----A---- C:\WINDOWS\system32\verifier.dll
2006-01-13 02:41:58 ----A---- C:\WINDOWS\system32\WMV9VCM.dll
2006-01-13 02:41:46 ----A---- C:\WINDOWS\system32\wmvcore.dll
2006-01-13 02:41:45 ----A---- C:\WINDOWS\system32\qdvd.dll
2006-01-13 02:41:45 ----A---- C:\WINDOWS\system32\qdv.dll
2006-01-13 02:41:45 ----A---- C:\WINDOWS\system32\qcap.dll
2006-01-13 02:41:45 ----A---- C:\WINDOWS\system32\qasf.dll
2006-01-13 02:41:36 ----A---- C:\WINDOWS\system32\verifier.exe
2006-01-13 02:41:36 ----A---- C:\WINDOWS\system32\jobexec.dll
2006-01-13 02:41:36 ----A---- C:\WINDOWS\system32\jgsh400.dll
2006-01-13 02:41:36 ----A---- C:\WINDOWS\system32\jgsd400.dll
2006-01-13 02:41:36 ----A---- C:\WINDOWS\system32\jgpl400.dll
2006-01-13 02:41:36 ----A---- C:\WINDOWS\system32\jgmd400.dll
2006-01-13 02:41:36 ----A---- C:\WINDOWS\system32\jgdw400.dll
2006-01-13 02:41:36 ----A---- C:\WINDOWS\system32\jgaw400.dll
the log.txt: part2
2006-01-13 02:41:36 ----A---- C:\WINDOWS\system32\jet500.dll
2006-01-13 02:41:36 ----A---- C:\WINDOWS\system32\ixsso.dll
2006-01-13 02:41:36 ----A---- C:\WINDOWS\system32\iuengine.dll
2006-01-13 02:41:21 ----A---- C:\WINDOWS\system32\mqqm.dll
2006-01-13 02:41:21 ----A---- C:\WINDOWS\system32\mqperf.ini
2006-01-13 02:41:21 ----A---- C:\WINDOWS\system32\mqperf.dll
2006-01-13 02:41:21 ----A---- C:\WINDOWS\system32\mqoa.dll
2006-01-13 02:41:21 ----A---- C:\WINDOWS\system32\mqlogmgr.dll
2006-01-13 02:41:21 ----A---- C:\WINDOWS\system32\mqise.dll
2006-01-13 02:41:21 ----A---- C:\WINDOWS\system32\mqgentr.dll
2006-01-13 02:41:21 ----A---- C:\WINDOWS\system32\mqdscli.dll
2006-01-13 02:41:21 ----A---- C:\WINDOWS\system32\mqcertui.dll
2006-01-13 02:41:21 ----A---- C:\WINDOWS\system32\mqbkup.exe
2006-01-13 02:41:21 ----A---- C:\WINDOWS\system32\mqad.dll
2006-01-13 02:41:21 ----A---- C:\WINDOWS\system32\mprui.dll
2006-01-13 02:41:21 ----A---- C:\WINDOWS\system32\mprmsg.dll
2006-01-13 02:41:19 ----A---- C:\WINDOWS\system32\WMVADVE.DLL
2006-01-13 02:41:09 ----A---- C:\WINDOWS\system32\devmgmt.msc
2006-01-13 02:41:06 ----A---- C:\WINDOWS\system32\wmi.dll
2006-01-13 02:41:06 ----A---- C:\WINDOWS\system32\wmerror.dll
2006-01-13 02:41:06 ----A---- C:\WINDOWS\system32\wmerrenu.dll
2006-01-13 02:41:06 ----A---- C:\WINDOWS\system32\wmdrmsdk.dll
2006-01-13 02:41:06 ----A---- C:\WINDOWS\system32\wmdrmnet.dll
2006-01-13 02:40:58 ----A---- C:\WINDOWS\system32\acledit.dll
2006-01-13 02:40:44 ----A---- C:\WINDOWS\system32\vorbis.dll
2006-01-13 02:40:34 ----A---- C:\WINDOWS\system32\hlink.dll
2006-01-13 02:40:28 ----A---- C:\WINDOWS\system32\vorbisenc.dll
2006-01-13 02:40:28 ----A---- C:\WINDOWS\system32\diskcopy.dll
2006-01-13 02:40:28 ----A---- C:\WINDOWS\system32\diskcopy.com
2006-01-13 02:40:28 ----A---- C:\WINDOWS\system32\diskcomp.com
2006-01-13 02:40:28 ----A---- C:\WINDOWS\system32\dinput8.dll
2006-01-13 02:40:28 ----A---- C:\WINDOWS\system32\dinput.dll
2006-01-13 02:40:28 ----A---- C:\WINDOWS\system32\dimap.dll
2006-01-13 02:40:28 ----A---- C:\WINDOWS\system32\digest.dll
2006-01-13 02:40:28 ----A---- C:\WINDOWS\system32\diantz.exe
2006-01-13 02:39:57 ----A---- C:\WINDOWS\system32\compact.exe
2006-01-13 02:39:57 ----A---- C:\WINDOWS\system32\comp.exe
2006-01-13 02:39:57 ----A---- C:\WINDOWS\system32\commdlg.dll
2006-01-13 02:39:57 ----A---- C:\WINDOWS\system32\command.com
2006-01-13 02:39:50 ----A---- C:\WINDOWS\system32\msi.dll
2006-01-13 02:39:48 ----A---- C:\WINDOWS\system32\shlwapi.dll
2006-01-13 02:39:44 ----R---- C:\WINDOWS\system32\perfmon.msc
2006-01-13 02:39:44 ----A---- C:\WINDOWS\system32\perfwci.ini
2006-01-13 02:39:44 ----A---- C:\WINDOWS\system32\perfts.dll
2006-01-13 02:39:44 ----A---- C:\WINDOWS\system32\perfnet.dll
2006-01-13 02:39:44 ----A---- C:\WINDOWS\system32\perfmon.exe
2006-01-13 02:39:44 ----A---- C:\WINDOWS\system32\pentnt.exe
2006-01-13 02:39:43 ----A---- C:\WINDOWS\system32\perfproc.dll
2006-01-13 02:39:43 ----A---- C:\WINDOWS\system32\perfos.dll
2006-01-13 02:39:43 ----A---- C:\WINDOWS\system32\perfnw.dll
2006-01-13 02:39:43 ----A---- C:\WINDOWS\system32\perfci.ini
2006-01-13 02:39:41 ----A---- C:\WINDOWS\system32\perffilt.ini
2006-01-13 02:39:41 ----A---- C:\WINDOWS\system32\perfdisk.dll
2006-01-13 02:39:41 ----A---- C:\WINDOWS\system32\perfctrs.dll
2006-01-13 02:39:39 ----A---- C:\WINDOWS\system32\pdh.dll
2006-01-13 02:39:33 ----A---- C:\WINDOWS\system32\vorbisfile.dll
2006-01-13 02:39:28 ----A---- C:\WINDOWS\system32\mssap.dll
2006-01-13 02:39:28 ----A---- C:\WINDOWS\system32\msrepl40.dll
2006-01-13 02:39:25 ----A---- C:\WINDOWS\system32\shsvcs.dll
2006-01-13 02:39:25 ----A---- C:\WINDOWS\system32\shscrap.dll
2006-01-13 02:39:25 ----A---- C:\WINDOWS\system32\msrle32.dll
2006-01-13 02:39:25 ----A---- C:\WINDOWS\system32\msrecr40.dll
2006-01-13 02:39:25 ----A---- C:\WINDOWS\system32\actxprxy.dll
2006-01-13 02:39:25 ----A---- C:\WINDOWS\system32\actmovie.exe
2006-01-13 02:39:25 ----A---- C:\WINDOWS\system32\activeds.dll
2006-01-13 02:39:25 ----A---- C:\WINDOWS\system32\aclui.dll
2006-01-13 02:39:06 ----A---- C:\WINDOWS\system32\shutdown.exe
2006-01-13 02:39:06 ----A---- C:\WINDOWS\system32\shrpubw.exe
2006-01-13 02:39:06 ----A---- C:\WINDOWS\system32\shmgrate.exe
2006-01-13 02:39:06 ----A---- C:\WINDOWS\system32\shmedia.dll
2006-01-13 02:39:06 ----A---- C:\WINDOWS\system32\msisip.dll
2006-01-13 02:38:42 ----A---- C:\WINDOWS\system32\wmvdmod.dll
2006-01-13 02:38:40 ----A---- C:\WINDOWS\system32\HMTCD.dll
2006-01-13 02:38:40 ----A---- C:\WINDOWS\system32\comres.dll
2006-01-13 02:38:40 ----A---- C:\WINDOWS\system32\compstui.dll
2006-01-13 02:38:40 ----A---- C:\WINDOWS\system32\compobj.dll
2006-01-13 02:38:40 ----A---- C:\WINDOWS\system32\compmgmt.msc
2006-01-13 02:38:32 ----A---- C:\WINDOWS\system32\VSFilter.dll
2006-01-13 02:38:21 ----A---- C:\WINDOWS\system32\wsnmp32.dll
2006-01-13 02:38:21 ----A---- C:\WINDOWS\system32\wshtcpip.dll
2006-01-13 02:38:21 ----A---- C:\WINDOWS\system32\WshRm.dll
2006-01-13 02:38:21 ----A---- C:\WINDOWS\system32\wshnetbs.dll
2006-01-13 02:38:21 ----A---- C:\WINDOWS\system32\wshisn.dll
2006-01-13 02:38:21 ----A---- C:\WINDOWS\system32\wship6.dll
2006-01-13 02:38:21 ----A---- C:\WINDOWS\system32\wshext.dll
2006-01-13 02:38:21 ----A---- C:\WINDOWS\system32\wshcon.dll
2006-01-13 02:38:21 ----A---- C:\WINDOWS\system32\wshbth.dll
2006-01-13 02:38:21 ----A---- C:\WINDOWS\system32\wsecedit.dll
2006-01-13 02:38:21 ----A---- C:\WINDOWS\system32\ole2nls.dll
2006-01-13 02:38:21 ----A---- C:\WINDOWS\system32\bootvrfy.exe
2006-01-13 02:38:21 ----A---- C:\WINDOWS\system32\bootvid.dll
2006-01-13 02:38:21 ----A---- C:\WINDOWS\system32\bootok.exe
2006-01-13 02:38:21 ----A---- C:\WINDOWS\system32\bootcfg.exe
2006-01-13 02:38:19 ----A---- C:\WINDOWS\system32\wshatm.dll
2006-01-13 02:38:13 ----A---- C:\WINDOWS\system32\ntbackup.exe
2006-01-13 02:38:10 ----A---- C:\WINDOWS\twunk_32.exe
2006-01-13 02:38:10 ----A---- C:\WINDOWS\twunk_16.exe
2006-01-13 02:38:10 ----A---- C:\WINDOWS\system32\txflog.dll
2006-01-13 02:38:10 ----A---- C:\WINDOWS\system32\twext.dll
2006-01-13 02:38:08 ----A---- C:\WINDOWS\system32\wsock32.dll
2006-01-13 02:38:02 ----A---- C:\WINDOWS\system32\svchost.exe
2006-01-13 02:37:23 ----A---- C:\WINDOWS\system32\wmiscmgr.dll
2006-01-13 02:37:23 ----A---- C:\WINDOWS\system32\wmiprop.dll
2006-01-13 02:37:21 ----A---- C:\WINDOWS\system32\diactfrm.dll
2006-01-13 02:37:21 ----A---- C:\WINDOWS\system32\dhcpsapi.dll
2006-01-13 02:37:17 ----A---- C:\WINDOWS\system32\Ir50_32.dll
2006-01-13 02:37:17 ----A---- C:\WINDOWS\system32\dpnaddr.dll
2006-01-13 02:37:17 ----A---- C:\WINDOWS\system32\dplayx.dll
2006-01-13 02:37:17 ----A---- C:\WINDOWS\system32\dplay.dll
2006-01-13 02:37:17 ----A---- C:\WINDOWS\system32\dpcdll.dll
2006-01-13 02:37:17 ----A---- C:\WINDOWS\system32\dosx.exe
2006-01-13 02:37:17 ----A---- C:\WINDOWS\system32\doskey.exe
2006-01-13 02:37:12 ----A---- C:\WINDOWS\system32\wiadefui.dll
2006-01-13 02:37:12 ----A---- C:\WINDOWS\system32\wiaacmgr.exe
2006-01-13 02:37:12 ----A---- C:\WINDOWS\system32\wextract.exe
2006-01-13 02:37:12 ----A---- C:\WINDOWS\system32\dpmodemx.dll
2006-01-13 02:37:12 ----A---- C:\WINDOWS\system32\dplaysvr.exe
2006-01-13 02:36:54 ----A---- C:\WINDOWS\system32\drmv2clt.dll
2006-01-13 02:36:54 ----A---- C:\WINDOWS\system32\drmupgds.exe
2006-01-13 02:36:54 ----A---- C:\WINDOWS\system32\drmstor.dll
2006-01-13 02:36:54 ----A---- C:\WINDOWS\system32\drmclien.dll
2006-01-13 02:36:50 ----A---- C:\WINDOWS\system32\rasppp.dll
2006-01-13 02:36:50 ----A---- C:\WINDOWS\system32\rasphone.exe
2006-01-13 02:36:50 ----A---- C:\WINDOWS\system32\rasmxs.dll
2006-01-13 02:36:50 ----A---- C:\WINDOWS\system32\rasmontr.dll
2006-01-13 02:36:50 ----A---- C:\WINDOWS\system32\rasmans.dll
2006-01-13 02:36:50 ----A---- C:\WINDOWS\system32\rasman.dll
2006-01-13 02:36:50 ----A---- C:\WINDOWS\system32\rasdlg.dll
2006-01-13 02:36:50 ----A---- C:\WINDOWS\system32\rasdial.exe
2006-01-13 02:36:50 ----A---- C:\WINDOWS\system32\rasctrs.ini
2006-01-13 02:36:50 ----A---- C:\WINDOWS\system32\rasctrs.dll
2006-01-13 02:36:29 ----A---- C:\WINDOWS\system32\nslookup.exe
2006-01-13 02:36:29 ----A---- C:\WINDOWS\system32\npptools.dll
2006-01-13 02:36:23 ----A---- C:\WINDOWS\system32\newdev.dll
2006-01-13 02:36:23 ----A---- C:\WINDOWS\system32\netui2.dll
2006-01-13 02:36:23 ----A---- C:\WINDOWS\system32\netui1.dll
2006-01-13 02:36:23 ----A---- C:\WINDOWS\system32\netui0.dll
2006-01-13 02:36:23 ----A---- C:\WINDOWS\system32\netstat.exe
2006-01-13 02:36:23 ----A---- C:\WINDOWS\system32\netshell.dll
2006-01-13 02:36:18 ----A---- C:\WINDOWS\system32\sysedit.exe
2006-01-13 02:36:09 ----A---- C:\WINDOWS\system32\msratelc.dll
2006-01-13 02:36:09 ----A---- C:\WINDOWS\system32\msr2cenu.dll
2006-01-13 02:36:09 ----A---- C:\WINDOWS\system32\msr2c.dll
2006-01-13 02:36:09 ----A---- C:\WINDOWS\system32\msprivs.dll
2006-01-13 02:36:09 ----A---- C:\WINDOWS\system32\msports.dll
2006-01-13 02:36:09 ----A---- C:\WINDOWS\system32\MsPMSP.dll
2006-01-13 02:36:09 ----A---- C:\WINDOWS\system32\MsPMSNSv.dll
2006-01-13 02:36:08 ----A---- C:\WINDOWS\system32\mspbde40.dll
2006-01-13 02:36:08 ----A---- C:\WINDOWS\system32\mspatcha.dll
2006-01-13 02:36:08 ----A---- C:\WINDOWS\system32\msnsc.exe
2006-01-13 02:36:08 ----A---- C:\WINDOWS\system32\msnetobj.dll
2006-01-13 02:36:02 ----A---- C:\WINDOWS\system32\stobject.dll
2006-01-13 02:36:02 ----A---- C:\WINDOWS\system32\sti.dll
2006-01-13 02:35:47 ----A---- C:\WINDOWS\system32\stimon.exe
2006-01-13 02:35:47 ----A---- C:\WINDOWS\system32\sti_ci.dll
2006-01-13 02:35:47 ----A---- C:\WINDOWS\system32\licdll.dll
2006-01-13 02:35:46 ----A---- C:\WINDOWS\system32\mshtmler.dll
2006-01-13 02:35:46 ----A---- C:\WINDOWS\system32\modex.dll
2006-01-13 02:35:46 ----A---- C:\WINDOWS\system32\modemui.dll
2006-01-13 02:35:46 ----A---- C:\WINDOWS\modifyPE.exe
2006-01-13 02:35:44 ----A---- C:\WINDOWS\system32\xpsp2res.dll
2006-01-13 02:35:44 ----A---- C:\WINDOWS\system32\xpsp1res.dll
2006-01-13 02:35:43 ----A---- C:\WINDOWS\system32\netapi32.dll
2006-01-13 02:35:29 ----A---- C:\WINDOWS\system32\ipv6mon.dll
2006-01-13 02:35:29 ----A---- C:\WINDOWS\system32\ipv6.exe
2006-01-13 02:35:29 ----A---- C:\WINDOWS\system32\ipsmsnap.dll
2006-01-13 02:35:29 ----A---- C:\WINDOWS\system32\ipsecsvc.dll
2006-01-13 02:35:29 ----A---- C:\WINDOWS\system32\ipsecsnp.dll
2006-01-13 02:35:11 ----A---- C:\WINDOWS\system32\dx8vb.dll
2006-01-13 02:35:11 ----A---- C:\WINDOWS\system32\dx7vb.dll
2006-01-13 02:35:11 ----A---- C:\WINDOWS\system32\dwwin.exe
2006-01-13 02:34:59 ----A---- C:\WINDOWS\system32\nwevent.dll
2006-01-13 02:34:59 ----A---- C:\WINDOWS\system32\nwcfg.dll
2006-01-13 02:34:59 ----A---- C:\WINDOWS\system32\nwapi32.dll
2006-01-13 02:34:59 ----A---- C:\WINDOWS\system32\nwapi16.dll
2006-01-13 02:34:59 ----A---- C:\WINDOWS\system32\nw16.exe
2006-01-13 02:34:51 ----A---- C:\WINDOWS\system32\gdi32.dll
2006-01-13 02:34:51 ----A---- C:\WINDOWS\system32\gdi.exe
2006-01-13 02:34:51 ----A---- C:\WINDOWS\system32\gcdef.dll
2006-01-13 02:34:48 ----A---- C:\WINDOWS\system32\msv1_0.dll
2006-01-13 02:34:35 ----A---- C:\WINDOWS\system32\magnify.exe
2006-01-13 02:34:35 ----A---- C:\WINDOWS\system32\mag_hook.dll
2006-01-13 02:34:35 ----A---- C:\WINDOWS\system32\lzexpand.dll
2006-01-13 02:34:35 ----A---- C:\WINDOWS\system32\lz32.dll
2006-01-13 02:34:33 ----A---- C:\WINDOWS\system32\getmac.exe
2006-01-13 02:34:23 ----A---- C:\WINDOWS\system32\crypt32.dll
2006-01-13 02:34:23 ----A---- C:\WINDOWS\system32\crtdll.dll
2006-01-13 02:34:23 ----A---- C:\WINDOWS\system32\credui.dll
2006-01-13 02:34:15 ----A---- C:\WINDOWS\system32\rend.dll
2006-01-13 02:34:15 ----A---- C:\WINDOWS\system32\relog.exe
2006-01-13 02:34:15 ----A---- C:\WINDOWS\system32\regwizc.dll
2006-01-13 02:34:15 ----A---- C:\WINDOWS\system32\regwiz.exe
2006-01-13 02:34:15 ----A---- C:\WINDOWS\system32\regsvr32.exe
2006-01-13 02:34:15 ----A---- C:\WINDOWS\system32\regsvc.dll
2006-01-13 02:34:15 ----A---- C:\WINDOWS\regmon.exe
2006-01-13 02:34:13 ----A---- C:\WINDOWS\system32\msutb.dll
2006-01-13 02:34:13 ----A---- C:\WINDOWS\system32\lusrmgr.msc
2006-01-13 02:34:13 ----A---- C:\WINDOWS\hh.exe
2006-01-13 02:34:05 ----A---- C:\WINDOWS\system32\lights.exe
2006-01-13 02:33:53 ----A---- C:\WINDOWS\system32\vbajet32.dll
2006-01-13 02:33:53 ----A---- C:\WINDOWS\system32\uxtheme.dll
2006-01-13 02:33:53 ----A---- C:\WINDOWS\system32\shell.dll
2006-01-13 02:33:53 ----A---- C:\WINDOWS\system32\fontsub.dll
2006-01-13 02:33:47 ----A---- C:\WINDOWS\system32\OggDS.dll
2006-01-13 02:33:47 ----A---- C:\WINDOWS\system32\OEMinfo.ini
2006-01-13 02:33:40 ----A---- C:\WINDOWS\system32\imapi.exe
2006-01-13 02:33:40 ----A---- C:\WINDOWS\system32\imagehlp.dll
2006-01-13 02:33:40 ----A---- C:\WINDOWS\system32\iissuba.dll
2006-01-13 02:33:40 ----A---- C:\WINDOWS\system32\fontext.dll
2006-01-13 02:33:36 ----A---- C:\WINDOWS\system32\uWDF.exe
2006-01-13 02:33:36 ----A---- C:\WINDOWS\system32\localspl.dll
2006-01-13 02:33:36 ----A---- C:\WINDOWS\system32\lmhsvc.dll
2006-01-13 02:33:36 ----A---- C:\WINDOWS\system32\linkinfo.dll
2006-01-13 02:33:36 ----A---- C:\WINDOWS\system32\format.com
2006-01-13 02:33:36 ----A---- C:\WINDOWS\system32\fmifs.dll
2006-01-13 02:33:35 ----A---- C:\WINDOWS\system32\forcedos.exe
2006-01-13 02:33:35 ----A---- C:\WINDOWS\system32\fontview.exe
2006-01-13 02:33:31 ----A---- C:\WINDOWS\system32\loadperf.dll
2006-01-13 02:33:31 ----A---- C:\WINDOWS\system32\lmrt.dll
2006-01-13 02:33:26 ----A---- C:\WINDOWS\system32\loadfix.com
2006-01-13 02:33:25 ----A---- C:\WINDOWS\system32\localsec.dll
2006-01-13 02:33:24 ----A---- C:\WINDOWS\system32\lnkstub.exe
2006-01-13 02:33:22 ----A---- C:\WINDOWS\system32\netplwiz.dll
2006-01-13 02:33:22 ----A---- C:\WINDOWS\system32\licmgr10.dll
2006-01-13 02:33:18 ----A---- C:\WINDOWS\system32\ntvdm.exe
2006-01-13 02:33:12 ----A---- C:\WINDOWS\system32\wmpencen.dll
2006-01-13 02:33:09 ----A---- C:\WINDOWS\system32\ntvdmd.dll
2006-01-13 02:33:09 ----A---- C:\WINDOWS\system32\logman.exe
2006-01-13 02:33:09 ----A---- C:\WINDOWS\system32\login.cmd
2006-01-13 02:33:09 ----A---- C:\WINDOWS\system32\logagent.exe
2006-01-13 02:33:09 ----A---- C:\WINDOWS\system32\hdaudres.dll
2006-01-13 02:33:09 ----A---- C:\WINDOWS\system32\hdashcut.exe
2006-01-13 02:33:09 ----A---- C:\WINDOWS\system32\hdaprop.dll
2006-01-13 02:33:05 ----A---- C:\WINDOWS\system32\mprdim.dll
2006-01-13 02:33:05 ----A---- C:\WINDOWS\system32\mprddm.dll
2006-01-13 02:33:05 ----A---- C:\WINDOWS\system32\mprapi.dll
2006-01-13 02:33:05 ----A---- C:\WINDOWS\system32\mpnotify.exe
2006-01-13 02:33:05 ----A---- C:\WINDOWS\system32\MPG4DMOD.dll
2006-01-13 02:33:05 ----A---- C:\WINDOWS\system32\loghours.dll
2006-01-13 02:33:05 ----A---- C:\WINDOWS\system32\locator.exe
2006-01-13 02:33:05 ----A---- C:\WINDOWS\system32\localui.dll
2006-01-13 02:33:05 ----A---- C:\WINDOWS\system32\fwcfg.dll
2006-01-13 02:32:53 ----A---- C:\WINDOWS\system32\netsetup.exe
2006-01-13 02:32:53 ----A---- C:\WINDOWS\system32\mpr.dll
2006-01-13 02:32:53 ----A---- C:\WINDOWS\system32\lodctr.exe
2006-01-13 02:32:47 ----A---- C:\WINDOWS\system32\mswsock.dll
2006-01-13 02:32:45 ----A---- C:\WINDOWS\system32\rtipxmib.dll
2006-01-13 02:32:45 ----A---- C:\WINDOWS\system32\rsvpsp.dll
2006-01-13 02:32:41 ----A---- C:\WINDOWS\system32\certmgr.msc
2006-01-13 02:32:41 ----A---- C:\WINDOWS\system32\certmgr.dll
2006-01-13 02:32:41 ----A---- C:\WINDOWS\system32\certcli.dll
2006-01-13 02:32:40 ----A---- C:\WINDOWS\system32\netrap.dll
2006-01-13 02:32:40 ----A---- C:\WINDOWS\system32\mswstr10.dll
2006-01-13 02:32:27 ----A---- C:\WINDOWS\system32\nlsfunc.exe
2006-01-13 02:32:17 ----A---- C:\WINDOWS\system32\exe2bin.exe
2006-01-13 02:32:14 ----A---- C:\WINDOWS\system32\help.exe
2006-01-13 02:31:59 ----A---- C:\WINDOWS\system32\user32.dll
2006-01-13 02:31:59 ----A---- C:\WINDOWS\system32\user.exe
2006-01-13 02:31:59 ----A---- C:\WINDOWS\system32\usbmon.dll
2006-01-13 02:31:57 ----A---- C:\WINDOWS\system32\expand.exe
2006-01-13 02:31:50 ----A---- C:\WINDOWS\system32\p2psvc.dll
2006-01-13 02:31:40 ----A---- C:\WINDOWS\system32\esentutl.exe
2006-01-13 02:31:40 ----A---- C:\WINDOWS\system32\esentprf.ini
2006-01-13 02:31:40 ----A---- C:\WINDOWS\system32\esentprf.dll
2006-01-13 02:31:40 ----A---- C:\WINDOWS\system32\esent97.dll
2006-01-13 02:31:39 ----A---- C:\WINDOWS\system32\rsvpperf.dll
2006-01-13 02:31:39 ----A---- C:\WINDOWS\system32\rsvpmsg.dll
2006-01-13 02:31:39 ----A---- C:\WINDOWS\system32\p2pgraph.dll
2006-01-13 02:31:39 ----A---- C:\WINDOWS\system32\nlhtml.dll
2006-01-13 02:31:39 ----A---- C:\WINDOWS\system32\eventvwr.msc
2006-01-13 02:31:39 ----A---- C:\WINDOWS\system32\eventvwr.exe
2006-01-13 02:31:39 ----A---- C:\WINDOWS\system32\eventlog.dll
2006-01-13 02:31:39 ----A---- C:\WINDOWS\system32\eventcls.dll
2006-01-13 02:31:39 ----A---- C:\WINDOWS\system32\eula.txt
2006-01-13 02:31:39 ----A---- C:\WINDOWS\system32\eudcedit.exe
2006-01-13 02:31:25 ----A---- C:\WINDOWS\system32\rsvp.ini
2006-01-13 02:31:25 ----A---- C:\WINDOWS\system32\rsvp.exe
2006-01-13 02:31:25 ----A---- C:\WINDOWS\system32\httpapi.dll
2006-01-13 02:31:19 ----A---- C:\WINDOWS\system32\syskey.exe
2006-01-13 02:31:19 ----A---- C:\WINDOWS\system32\sysinv.dll
2006-01-13 02:31:19 ----A---- C:\WINDOWS\system32\p2pgasvc.dll
2006-01-13 02:31:18 ----A---- C:\WINDOWS\system32\p2pnetsh.dll
2006-01-13 02:31:17 ----A---- C:\WINDOWS\system32\p2p.dll
2006-01-13 02:31:17 ----A---- C:\WINDOWS\system32\osuninst.exe
2006-01-13 02:31:17 ----A---- C:\WINDOWS\system32\osuninst.dll
2006-01-13 02:31:14 ----A---- C:\WINDOWS\system32\rtm.dll
2006-01-13 02:31:07 ----A---- C:\WINDOWS\system32\dxmasf.dll
2006-01-13 02:30:58 ----A---- C:\WINDOWS\system32\dbgeng.dll
2006-01-13 02:30:57 ----A---- C:\WINDOWS\system32\xpsp3res.dll
2006-01-13 02:30:44 ----A---- C:\WINDOWS\system32\cmdow.exe
2006-01-13 02:29:49 ----A---- C:\WINDOWS\system32\msencode.dll
2006-01-13 02:29:49 ----A---- C:\WINDOWS\system32\msdxmlc.dll
2006-01-13 02:29:46 ----A---- C:\WINDOWS\system32\packager.exe
2006-01-13 02:29:43 ----A---- C:\WINDOWS\system32\w3ssl.dll
2006-01-13 02:29:43 ----A---- C:\WINDOWS\system32\w32topl.dll
2006-01-13 02:29:43 ----A---- C:\WINDOWS\system32\w32tm.exe
2006-01-13 02:29:43 ----A---- C:\WINDOWS\system32\w32time.dll
2006-01-13 02:29:43 ----A---- C:\WINDOWS\system32\vwipxspx.exe
2006-01-13 02:29:43 ----A---- C:\WINDOWS\system32\vwipxspx.dll
2006-01-13 02:29:43 ----A---- C:\WINDOWS\system32\vss_ps.dll
2006-01-13 02:29:42 ----A---- C:\WINDOWS\system32\dxdiagn.dll
2006-01-13 02:29:31 ----A---- C:\WINDOWS\system32\mciavi32.dll
2006-01-13 02:29:25 ----A---- C:\WINDOWS\system32\icm32.dll
2006-01-13 02:29:25 ----A---- C:\WINDOWS\system32\iccvid.dll
2006-01-13 02:29:20 ----A---- C:\WINDOWS\system32\alg.exe
2006-01-13 02:29:20 ----A---- C:\WINDOWS\system32\ahui.exe
2006-01-13 02:29:19 ----A---- C:\WINDOWS\system.ini
2006-01-13 02:29:17 ----A---- C:\WINDOWS\system32\adsnw.dll
2006-01-13 02:29:17 ----A---- C:\WINDOWS\system32\adsnt.dll
2006-01-13 02:29:17 ----A---- C:\WINDOWS\system32\adsnds.dll
2006-01-13 02:29:17 ----A---- C:\WINDOWS\system32\adsmsext.dll
2006-01-13 02:29:17 ----A---- C:\WINDOWS\system32\adsldpc.dll
2006-01-13 02:29:03 ----A---- C:\WINDOWS\system32\mciqtz32.dll
2006-01-13 02:29:03 ----A---- C:\WINDOWS\system32\icmui.dll
2006-01-13 02:29:03 ----A---- C:\WINDOWS\system32\icmp.dll
2006-01-13 02:29:01 ----A---- C:\WINDOWS\system32\mcdsrv32.dll
2006-01-13 02:28:54 ----A---- C:\WINDOWS\system32\sxs.dll
2006-01-13 02:28:54 ----A---- C:\WINDOWS\system32\swprv.dll
2006-01-13 02:28:54 ----A---- C:\WINDOWS\system32\svcpack.dll
2006-01-13 02:28:52 ----A---- C:\WINDOWS\system32\wow32.dll
2006-01-13 02:28:52 ----A---- C:\WINDOWS\system32\mciole32.dll
2006-01-13 02:28:52 ----A---- C:\WINDOWS\system32\mciole16.dll
2006-01-13 02:28:52 ----A---- C:\WINDOWS\system32\mcicda.dll
2006-01-13 02:28:52 ----A---- C:\WINDOWS\system32\mcd32.dll
2006-01-13 02:28:52 ----A---- C:\WINDOWS\system32\mapistub.dll
2006-01-13 02:28:51 ----A---- C:\WINDOWS\system32\fldrclnr.dll
2006-01-13 02:28:48 ----A---- C:\WINDOWS\system32\mciwave.dll
2006-01-13 02:28:48 ----A---- C:\WINDOWS\system32\appmgr.dll
2006-01-13 02:28:48 ----A---- C:\WINDOWS\system32\appmgmts.dll
2006-01-13 02:28:47 ----A---- C:\WINDOWS\system32\mdhcp.dll
2006-01-13 02:28:47 ----A---- C:\WINDOWS\system32\mcastmib.dll
2006-01-13 02:28:46 ----A---- C:\WINDOWS\system32\mciseq.dll
2006-01-13 02:28:37 ----A---- C:\WINDOWS\system32\qosname.dll
2006-01-13 02:28:23 ----A---- C:\WINDOWS\system32\dsound3d.dll
2006-01-13 02:28:23 ----A---- C:\WINDOWS\system32\dsound.dll
2006-01-13 02:28:23 ----A---- C:\WINDOWS\system32\dskquoui.dll
2006-01-13 02:28:23 ----A---- C:\WINDOWS\system32\dskquota.dll
2006-01-13 02:27:47 ----A---- C:\WINDOWS\system32\htui.dll
2006-01-13 02:27:44 ----A---- C:\WINDOWS\system32\mobsync.dll
2006-01-13 02:27:43 ----A---- C:\WINDOWS\system32\gpresult.exe
2006-01-13 02:27:43 ----A---- C:\WINDOWS\system32\gpkrsrc.dll
2006-01-13 02:27:43 ----A---- C:\WINDOWS\system32\gpkcsp.dll
2006-01-13 02:27:43 ----A---- C:\WINDOWS\system32\gpedit.msc
2006-01-13 02:27:43 ----A---- C:\WINDOWS\system32\gpedit.dll
2006-01-13 02:27:43 ----A---- C:\WINDOWS\desktop.ini
2006-01-13 02:27:41 ----A---- C:\WINDOWS\system32\wpdmtpdr.dll
2006-01-13 02:27:33 ----A---- C:\WINDOWS\system32\cryptui.dll
2006-01-13 02:27:27 ----A---- C:\WINDOWS\system32\cscdll.dll
2006-01-13 02:27:27 ----A---- C:\WINDOWS\system32\cryptnet.dll
2006-01-13 02:27:25 ----A---- C:\WINDOWS\system32\regedt32.exe
2006-01-13 02:27:25 ----A---- C:\WINDOWS\system32\regapi.dll
2006-01-13 02:27:25 ----A---- C:\WINDOWS\system32\reg.exe
2006-01-13 02:27:25 ----A---- C:\WINDOWS\system32\redir.exe
2006-01-13 02:27:25 ----A---- C:\WINDOWS\system32\recover.exe
2006-01-13 02:27:25 ----A---- C:\WINDOWS\regedit.exe
2006-01-13 02:27:20 ----A---- C:\WINDOWS\system32\runonce.exe
2006-01-13 02:27:20 ----A---- C:\WINDOWS\system32\rundll32.exe
2006-01-13 02:27:20 ----A---- C:\WINDOWS\system32\runas.exe
2006-01-13 02:27:20 ----A---- C:\WINDOWS\system32\rtutils.dll
2006-01-13 02:27:17 ----A---- C:\WINDOWS\system32\sccbase.dll
2006-01-13 02:27:17 ----A---- C:\WINDOWS\system32\scardsvr.exe
2006-01-13 02:27:17 ----A---- C:\WINDOWS\system32\scardssp.dll
2006-01-13 02:27:17 ----A---- C:\WINDOWS\system32\scarddlg.dll
2006-01-13 02:27:17 ----A---- C:\WINDOWS\system32\sc.exe
2006-01-13 02:27:17 ----A---- C:\WINDOWS\system32\sbeio.dll
2006-01-13 02:27:17 ----A---- C:\WINDOWS\system32\sbe.dll
2006-01-13 02:27:17 ----A---- C:\WINDOWS\system32\savedump.exe
2006-01-13 02:27:17 ----A---- C:\WINDOWS\system32\cryptext.dll
2006-01-13 02:27:16 ----A---- C:\WINDOWS\system32\cryptsvc.dll
2006-01-13 02:27:16 ----A---- C:\WINDOWS\system32\cryptdll.dll
2006-01-13 02:27:16 ----A---- C:\WINDOWS\system32\cryptdlg.dll
2006-01-13 02:27:00 ----A---- C:\WINDOWS\system32\wpdmtp.dll
2006-01-13 02:26:56 ----A---- C:\WINDOWS\system32\ssdpsrv.dll
2006-01-13 02:26:56 ----A---- C:\WINDOWS\system32\ssdpapi.dll
2006-01-13 02:26:55 ----A---- C:\WINDOWS\system32\wmpasf.dll
2006-01-13 02:26:47 ----A---- C:\WINDOWS\system32\wpabaln.exe
2006-01-13 02:26:46 ----A---- C:\WINDOWS\system32\wpdconns.dll
2006-01-13 02:26:41 ----A---- C:\WINDOWS\system32\wowexec.exe
2006-01-13 02:26:41 ----A---- C:\WINDOWS\system32\wowdeb.exe
2006-01-13 02:26:41 ----A---- C:\WINDOWS\system32\itss.dll
2006-01-13 02:26:41 ----A---- C:\WINDOWS\system32\itircl.dll
2006-01-13 02:26:31 ----A---- C:\WINDOWS\system32\dmband.dll
2006-01-13 02:26:31 ----A---- C:\WINDOWS\system32\dmadmin.exe
2006-01-13 02:26:31 ----A---- C:\WINDOWS\system32\dllhst3g.exe
2006-01-13 02:26:31 ----A---- C:\WINDOWS\system32\dllhost.exe
2006-01-13 02:26:31 ----A---- C:\WINDOWS\system32\dispex.dll
2006-01-13 02:26:31 ----A---- C:\WINDOWS\system32\diskperf.exe
2006-01-13 02:26:31 ----A---- C:\WINDOWS\system32\diskpart.exe
2006-01-13 02:26:27 ----A---- C:\WINDOWS\system32\mscms.dll
2006-01-13 02:26:27 ----A---- C:\WINDOWS\system32\mscdexnt.exe
2006-01-13 02:26:27 ----A---- C:\WINDOWS\system32\mscat32.dll
2006-01-13 02:26:27 ----A---- C:\WINDOWS\system32\msaudite.dll
2006-01-13 02:26:27 ----A---- C:\WINDOWS\system32\msasn1.dll
2006-01-13 02:26:27 ----A---- C:\WINDOWS\system32\msapsspc.dll
2006-01-13 02:26:27 ----A---- C:\WINDOWS\system32\msafd.dll
2006-01-13 02:26:09 ----A---- C:\WINDOWS\system32\winipsec.dll
2006-01-13 02:26:09 ----A---- C:\WINDOWS\system32\wininet.dll
2006-01-13 02:26:09 ----A---- C:\WINDOWS\system32\winhttp.dll
2006-01-13 02:26:07 ----A---- C:\WINDOWS\system32\routetab.dll
2006-01-13 02:26:07 ----A---- C:\WINDOWS\system32\routemon.exe
2006-01-13 02:26:07 ----A---- C:\WINDOWS\system32\route.exe
2006-01-13 02:26:07 ----A---- C:\WINDOWS\system32\rnr20.dll
2006-01-13 02:25:59 ----A---- C:\WINDOWS\system32\tsddd.dll
2006-01-13 02:25:59 ----A---- C:\WINDOWS\system32\tsd32.dll
2006-01-13 02:25:59 ----A---- C:\WINDOWS\system32\tsappcmp.dll
2006-01-13 02:25:46 ----A---- C:\WINDOWS\system32\makecab.exe
2006-01-13 02:25:46 ----A---- C:\WINDOWS\system32\kbdusx.dll
2006-01-13 02:25:46 ----A---- C:\WINDOWS\system32\kbdusr.dll
2006-01-13 02:25:45 ----A---- C:\WINDOWS\system32\kbdpo.dll
2006-01-13 02:25:45 ----A---- C:\WINDOWS\system32\kbdinmal.dll
2006-01-13 02:25:24 ----A---- C:\WINDOWS\system32\WMSPDMOE.dll
2006-01-13 02:25:21 ----A---- C:\WINDOWS\system32\kbdla.dll
2006-01-13 02:25:04 ----A---- C:\WINDOWS\system32\ntprint.dll
2006-01-13 02:24:44 ----A---- C:\WINDOWS\system32\t2embed.dll
2006-01-13 02:24:44 ----A---- C:\WINDOWS\system32\systray.exe
2006-01-13 02:24:43 ----A---- C:\WINDOWS\system32\sprestrt.exe
2006-01-13 02:24:39 ----A---- C:\WINDOWS\system32\kerberos.dll
2006-01-13 02:24:36 ----A---- C:\WINDOWS\system32\wmpshell.dll
2006-01-13 02:24:30 ----A---- C:\WINDOWS\system32\winstrm.dll
2006-01-13 02:24:30 ----A---- C:\WINDOWS\system32\winsta.dll
2006-01-13 02:24:30 ----A---- C:\WINDOWS\system32\winsrv.dll
2006-01-13 02:24:30 ----A---- C:\WINDOWS\system32\winspool.exe
2006-01-13 02:24:30 ----A---- C:\WINDOWS\system32\winsock.dll
2006-01-13 02:24:30 ----A---- C:\WINDOWS\system32\winshfhc.dll
2006-01-13 02:24:30 ----A---- C:\WINDOWS\system32\winscard.dll
2006-01-13 02:24:30 ----A---- C:\WINDOWS\system32\winrnr.dll
2006-01-13 02:24:30 ----A---- C:\WINDOWS\system32\kdcom.dll
2006-01-13 02:24:30 ----A---- C:\WINDOWS\system32\kd1394.dll
2006-01-13 02:24:17 ----A---- C:\WINDOWS\system32\midimap.dll
2006-01-13 02:24:17 ----A---- C:\WINDOWS\system32\kbdusl.dll
2006-01-13 02:24:17 ----A---- C:\WINDOWS\system32\kbdus.dll
2006-01-13 02:24:17 ----A---- C:\WINDOWS\system32\kbdukx.dll
2006-01-13 02:24:17 ----A---- C:\WINDOWS\system32\kbduk.dll
2006-01-13 02:24:14 ----A---- C:\WINDOWS\system32\kbdsw.dll
2006-01-13 02:24:12 ----A---- C:\WINDOWS\system32\kbdsp.dll
2006-01-13 02:23:57 ----A---- C:\WINDOWS\system32\kbdsmsno.dll
2006-01-13 02:23:57 ----A---- C:\WINDOWS\system32\kbdsmsfi.dll
2006-01-13 02:23:57 ----A---- C:\WINDOWS\system32\kbdsg.dll
2006-01-13 02:23:57 ----A---- C:\WINDOWS\system32\kbdsf.dll
2006-01-13 02:23:57 ----A---- C:\WINDOWS\system32\kbdno1.dll
2006-01-13 02:23:57 ----A---- C:\WINDOWS\system32\kbdno.dll
2006-01-13 02:23:57 ----A---- C:\WINDOWS\system32\kbdnec.dll
2006-01-13 02:23:57 ----A---- C:\WINDOWS\system32\kbdne.dll
2006-01-13 02:23:56 ----A---- C:\WINDOWS\system32\utilman.exe
2006-01-13 02:23:56 ----A---- C:\WINDOWS\system32\usp10.dll
2006-01-13 02:23:56 ----A---- C:\WINDOWS\system32\mgmtapi.dll
2006-01-13 02:23:56 ----A---- C:\WINDOWS\system32\MFPLAT.dll
2006-01-13 02:23:56 ----A---- C:\WINDOWS\system32\mfcsubs.dll
2006-01-13 02:23:56 ----A---- C:\WINDOWS\system32\kbdmlt48.dll
2006-01-13 02:23:56 ----A---- C:\WINDOWS\system32\kbdmlt47.dll
2006-01-13 02:23:56 ----A---- C:\WINDOWS\system32\kbdmaori.dll
2006-01-13 02:23:56 ----A---- C:\WINDOWS\system32\kbdmac.dll
2006-01-13 02:23:56 ----A---- C:\WINDOWS\system32\kbdit142.dll
2006-01-13 02:23:56 ----A---- C:\WINDOWS\system32\kbdit.dll
2006-01-13 02:23:56 ----A---- C:\WINDOWS\system32\kbdir.dll
2006-01-13 02:23:56 ----A---- C:\WINDOWS\system32\kbdinben.dll
2006-01-13 02:23:41 ----A---- C:\WINDOWS\system32\netapi.dll
2006-01-13 02:23:41 ----A---- C:\WINDOWS\system32\net1.exe
2006-01-13 02:23:41 ----A---- C:\WINDOWS\system32\net.exe
2006-01-13 02:23:41 ----A---- C:\WINDOWS\system32\nddenb32.dll
2006-01-13 02:23:41 ----A---- C:\WINDOWS\system32\nddeapir.exe
2006-01-13 02:23:41 ----A---- C:\WINDOWS\system32\nddeapi.dll
2006-01-13 02:23:41 ----A---- C:\WINDOWS\system32\ncxpnt.dll
2006-01-13 02:23:41 ----A---- C:\WINDOWS\system32\ncobjapi.dll
2006-01-13 02:23:41 ----A---- C:\WINDOWS\system32\nbtstat.exe
2006-01-13 02:23:41 ----A---- C:\WINDOWS\system32\narrhook.dll
2006-01-13 02:23:41 ----A---- C:\WINDOWS\system32\narrator.exe
2006-01-13 02:23:40 ----A---- C:\WINDOWS\system32\LAPRXY.dll
2006-01-13 02:23:40 ----A---- C:\WINDOWS\system32\langwrbk.dll
2006-01-13 02:23:31 ----A---- C:\WINDOWS\system32\rdpdd.dll
2006-01-13 02:23:31 ----A---- C:\WINDOWS\system32\rcp.exe
2006-01-13 02:23:31 ----A---- C:\WINDOWS\system32\rcimlby.exe
2006-01-13 02:23:31 ----A---- C:\WINDOWS\system32\rcbdyctl.dll
2006-01-13 02:23:31 ----A---- C:\WINDOWS\system32\rastls.dll
2006-01-13 02:23:31 ----A---- C:\WINDOWS\system32\rastapi.dll
2006-01-13 02:23:31 ----A---- C:\WINDOWS\system32\rasser.dll
2006-01-13 02:23:31 ----A---- C:\WINDOWS\system32\rassapi.dll
2006-01-13 02:23:31 ----A---- C:\WINDOWS\system32\rasrad.dll
2006-01-13 02:23:26 ----A---- C:\WINDOWS\system32\utildll.dll
2006-01-13 02:23:18 ----A---- C:\WINDOWS\system32\userinit.exe
2006-01-13 02:23:18 ----A---- C:\WINDOWS\system32\userenv.dll
2006-01-13 02:23:01 ----A---- C:\WINDOWS\system32\cliconfg.exe
2006-01-13 02:23:01 ----A---- C:\WINDOWS\system32\cleanmgr.exe
2006-01-13 02:22:49 ----A---- C:\WINDOWS\system32\ftsrch.dll
2006-01-13 02:22:49 ----A---- C:\WINDOWS\system32\ftp.exe
2006-01-13 02:22:48 ----A---- C:\WINDOWS\system32\fsutil.exe
2006-01-13 02:22:48 ----A---- C:\WINDOWS\system32\fsusd.dll
2006-01-13 02:22:48 ----A---- C:\WINDOWS\system32\fsquirt.exe
2006-01-13 02:22:48 ----A---- C:\WINDOWS\system32\fsmgmt.msc
2006-01-13 02:22:48 ----A---- C:\WINDOWS\system32\framebuf.dll
2006-01-13 02:22:48 ----A---- C:\WINDOWS\system32\clipsrv.exe
2006-01-13 02:22:48 ----A---- C:\WINDOWS\system32\cliconfg.dll
2006-01-13 02:22:40 ----A---- C:\WINDOWS\system32\schannel.dll
2006-01-13 02:22:34 ----A---- C:\WINDOWS\system32\cmcfg32.dll
2006-01-13 02:22:34 ----A---- C:\WINDOWS\system32\6to4svc.dll
2006-01-13 02:22:33 ----A---- C:\WINDOWS\system32\scesrv.dll
2006-01-13 02:22:33 ----A---- C:\WINDOWS\system32\scecli.dll
2006-01-13 02:22:33 ----A---- C:\WINDOWS\system32\sccsccp.dll
2006-01-13 02:22:33 ----A---- C:\WINDOWS\system32\clusapi.dll
2006-01-13 02:22:30 ----A---- C:\WINDOWS\system32\winfax.dll
2006-01-13 02:22:30 ----A---- C:\WINDOWS\system32\datime.dll
2006-01-13 02:22:14 ----A---- C:\WINDOWS\system32\shimgvw.dll
2006-01-13 02:22:14 ----A---- C:\WINDOWS\system32\shimeng.dll
2006-01-13 02:22:14 ----A---- C:\WINDOWS\system32\shgina.dll
2006-01-13 02:22:14 ----A---- C:\WINDOWS\system32\shfolder.dll
2006-01-13 02:21:47 ----A---- C:\WINDOWS\system32\filemgmt.dll
2006-01-13 02:21:46 ----A---- C:\WINDOWS\system32\Ir50_qcx.dll
2006-01-13 02:21:46 ----A---- C:\WINDOWS\system32\Ir50_qc.dll
2006-01-13 02:21:46 ----A---- C:\WINDOWS\system32\Ir50_lcs.dll
2006-01-13 02:21:41 ----A---- C:\WINDOWS\system32\ufat.dll
2006-01-13 02:21:41 ----A---- C:\WINDOWS\system32\udhisapi.dll
2006-01-13 02:21:41 ----A---- C:\WINDOWS\system32\typeperf.exe
2006-01-13 02:21:41 ----A---- C:\WINDOWS\system32\typelib.dll
2006-01-13 02:21:41 ----A---- C:\WINDOWS\system32\imm32.dll
2006-01-13 02:21:41 ----A---- C:\WINDOWS\system32\imgutil.dll
2006-01-13 02:21:41 ----A---- C:\WINDOWS\system32\imeshare.dll
2006-01-13 02:21:39 ----A---- C:\WINDOWS\system32\fastopen.exe
2006-01-13 02:21:38 ----A---- C:\WINDOWS\system32\extrac32.exe
2006-01-13 02:21:38 ----A---- C:\WINDOWS\system32\dataclen.dll
2006-01-13 02:21:37 ----A---- C:\WINDOWS\system32\exts.dll
2006-01-13 02:21:26 ----A---- C:\WINDOWS\system32\sqlsrv32.dll
2006-01-13 02:21:26 ----A---- C:\WINDOWS\system32\davclnt.dll
2006-01-13 02:21:25 ----A---- C:\WINDOWS\winhlp32.exe
2006-01-13 02:21:03 ----A---- C:\WINDOWS\system32\msacm32.dll
2006-01-13 02:21:03 ----A---- C:\WINDOWS\system32\msacm.dll
2006-01-13 02:21:03 ----A---- C:\WINDOWS\system32\msaatext.dll
2006-01-13 02:20:54 ----A---- C:\WINDOWS\winhelp.exe
2006-01-13 02:20:50 ----A---- C:\WINDOWS\system32\snmpsnap.dll
2006-01-13 02:20:50 ----A---- C:\WINDOWS\system32\snmpapi.dll
2006-01-13 02:20:35 ----A---- C:\WINDOWS\system32\devenum.dll
2006-01-13 02:20:35 ----A---- C:\WINDOWS\system32\deskperf.dll
2006-01-13 02:20:35 ----A---- C:\WINDOWS\system32\deskmon.dll
2006-01-13 02:20:35 ----A---- C:\WINDOWS\system32\deskadp.dll
2006-01-13 02:20:35 ----A---- C:\WINDOWS\system32\defrag.exe
2006-01-13 02:20:35 ----A---- C:\WINDOWS\system32\debug.exe
2006-01-13 02:20:35 ----A---- C:\WINDOWS\system32\ddrawex.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\winhlp32.exe
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbdinbe1.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbdic.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbdgr1.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbdgr.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbdgae.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbdfr.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbdfo.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbdfi1.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbdfi.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbdfc.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbdes.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbddv.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbdda.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbdcan.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbdca.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbdbr.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbdbene.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kbdbe.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\kb16.com
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\jsproxy.dll
2006-01-13 02:20:30 ----A---- C:\WINDOWS\system32\apcups.dll
2006-01-13 02:20:25 ----A---- C:\WINDOWS\system32\append.exe
2006-01-13 02:20:22 ----A---- C:\WINDOWS\system32\esent.dll
2006-01-13 02:20:22 ----A---- C:\WINDOWS\system32\apphelp.dll
2006-01-13 02:19:58 ----A---- C:\WINDOWS\system32\MSWMDM.dll
2006-01-13 02:19:58 ----A---- C:\WINDOWS\system32\mswebdvd.dll
2006-01-13 02:19:55 ----A---- C:\WINDOWS\system32\MSIMTF.dll
2006-01-13 02:19:55 ----A---- C:\WINDOWS\system32\msimsg.dll
2006-01-13 02:19:46 ----A---- C:\WINDOWS\system32\msimg32.dll
2006-01-13 02:19:41 ----A---- C:\WINDOWS\system32\browser.dll
2006-01-13 02:19:41 ----A---- C:\WINDOWS\system32\browselc.dll
2006-01-13 02:19:38 ----A---- C:\WINDOWS\system32\MP4SDMOD.dll
2006-01-13 02:19:38 ----A---- C:\WINDOWS\system32\MP43DMOD.dll
2006-01-13 02:18:52 ----A---- C:\WINDOWS\system32\odbc32.dll
2006-01-13 02:18:49 ----A---- C:\WINDOWS\system32\occache.dll
2006-01-13 02:18:49 ----A---- C:\WINDOWS\system32\inetppui.dll
2006-01-13 02:18:49 ----A---- C:\WINDOWS\system32\inetpp.dll
2006-01-13 02:18:49 ----A---- C:\WINDOWS\system32\inetmib1.dll
2006-01-13 02:18:49 ----A---- C:\WINDOWS\system32\inetcplc.dll
2006-01-13 02:18:34 ----A---- C:\WINDOWS\system32\netsh.exe
2006-01-13 02:18:21 ----A---- C:\WINDOWS\system32\msvcp60.dll
2006-01-13 02:18:21 ----A---- C:\WINDOWS\system32\msvcp50.dll
2006-01-13 02:18:21 ----A---- C:\WINDOWS\system32\msvcirt.dll
2006-01-13 02:17:56 ----A---- C:\WINDOWS\system32\odbcconf.exe
2006-01-13 02:17:56 ----A---- C:\WINDOWS\system32\odbc16gt.dll
2006-01-13 02:17:55 ----A---- C:\WINDOWS\system32\odbcconf.dll
2006-01-13 02:17:42 ----A---- C:\WINDOWS\system32\odbcbcp.dll
2006-01-13 02:17:40 ----A---- C:\WINDOWS\system32\odbcad32.exe
2006-01-13 02:17:36 ----A---- C:\WINDOWS\system32\odbc32gt.dll
2006-01-13 02:17:36 ----A---- C:\WINDOWS\system32\ocmanage.dll
2006-01-13 02:16:36 ----A---- C:\WINDOWS\system32\msrd3x40.dll
2006-01-13 02:16:34 ----A---- C:\WINDOWS\system32\pmspl.dll
2006-01-13 02:16:34 ----A---- C:\WINDOWS\system32\plustab.dll
2006-01-13 02:16:34 ----A---- C:\WINDOWS\system32\ping6.exe
2006-01-13 02:16:34 ----A---- C:\WINDOWS\system32\ping.exe
2006-01-13 02:16:21 ----A---- C:\WINDOWS\system32\subst.exe
2006-01-13 02:16:21 ----A---- C:\WINDOWS\system32\strmfilt.dll
2006-01-13 02:16:21 ----A---- C:\WINDOWS\system32\strmdll.dll
2006-01-13 02:16:21 ----A---- C:\WINDOWS\system32\storage.dll
2006-01-13 02:16:15 ----A---- C:\WINDOWS\system32\wmpdxm.dll
2006-01-13 02:16:15 ----A---- C:\WINDOWS\system32\wmpcore.dll
2006-01-13 02:16:15 ----A---- C:\WINDOWS\system32\wmpcd.dll
2006-01-13 02:16:03 ----A---- C:\WINDOWS\system32\dsdmoprp.dll
2006-01-13 02:16:03 ----A---- C:\WINDOWS\system32\dsdmo.dll
2006-01-13 02:16:03 ----A---- C:\WINDOWS\system32\dsauth.dll
2006-01-13 02:16:03 ----A---- C:\WINDOWS\system32\ds32gt.dll
2006-01-13 02:16:03 ----A---- C:\WINDOWS\system32\ds16gt.dLL
2006-01-13 02:16:03 ----A---- C:\WINDOWS\system32\drwtsn32.exe
2006-01-13 02:16:03 ----A---- C:\WINDOWS\system32\drwatson.exe
2006-01-13 02:16:03 ----A---- C:\WINDOWS\system32\drprov.dll
2006-01-13 02:15:59 ----A---- C:\WINDOWS\system32\mll_qic.dll
2006-01-13 02:15:59 ----A---- C:\WINDOWS\system32\mll_mtf.dll
2006-01-13 02:15:59 ----A---- C:\WINDOWS\system32\mll_hp.dll
2006-01-13 02:15:59 ----A---- C:\WINDOWS\system32\mlang.dll
2006-01-13 02:15:56 ----A---- C:\WINDOWS\system32\glu32.dll
2006-01-13 02:15:56 ----A---- C:\WINDOWS\system32\glmf32.dll
2006-01-13 02:15:44 ----A---- C:\WINDOWS\system32\msihnd.dll
2006-01-13 02:15:37 ----A---- C:\WINDOWS\system32\sort.exe
2006-01-13 02:15:37 ----A---- C:\WINDOWS\system32\softpub.dll
2006-01-13 02:15:36 ----A---- C:\WINDOWS\system32\msrclr40.dll
2006-01-13 02:15:31 ----A---- C:\WINDOWS\system32\msrd2x40.dll
2006-01-13 02:15:31 ----A---- C:\WINDOWS\system32\cacls.exe
2006-01-13 02:15:31 ----A---- C:\WINDOWS\system32\cabview.dll
2006-01-13 02:15:31 ----A---- C:\WINDOWS\system32\cabinet.dll
2006-01-13 02:15:31 ----A---- C:\WINDOWS\system32\cabarc.exe
2006-01-13 02:15:23 ----A---- C:\WINDOWS\system32\hhsetup.dll
2006-01-13 02:15:22 ----A---- C:\WINDOWS\system32\wintrust.dll
2006-01-13 02:15:22 ----A---- C:\WINDOWS\system32\msorcl32.dll
2006-01-13 02:15:22 ----A---- C:\WINDOWS\system32\msorc32r.dll
2006-01-13 02:15:22 ----A---- C:\WINDOWS\system32\msobjs.dll
2006-01-13 02:15:22 ----A---- C:\WINDOWS\system32\msnsspc.dll
2006-01-13 02:15:22 ----A---- C:\WINDOWS\system32\diskmgmt.msc
2006-01-13 02:15:21 ----A---- C:\WINDOWS\system32\osk.exe
2006-01-13 02:15:21 ----A---- C:\WINDOWS\system32\opengl32.dll
2006-01-13 02:15:06 ----A---- C:\WINDOWS\system32\wmvdmoe2.dll
2006-01-13 02:15:00 ----A---- C:\WINDOWS\system32\pautoenr.dll
2006-01-13 02:15:00 ----A---- C:\WINDOWS\system32\pathping.exe
2006-01-13 02:15:00 ----A---- C:\WINDOWS\system32\panmap.dll
2006-01-13 02:14:53 ----A---- C:\WINDOWS\system32\iassvcs.dll
2006-01-13 02:14:53 ----A---- C:\WINDOWS\system32\iassdo.dll
2006-01-13 02:14:53 ----A---- C:\WINDOWS\system32\iassam.dll
2006-01-13 02:14:53 ----A---- C:\WINDOWS\system32\iasrecst.dll
2006-01-13 02:14:53 ----A---- C:\WINDOWS\system32\iasrad.dll
2006-01-13 02:14:53 ----A---- C:\WINDOWS\system32\iaspolcy.dll
2006-01-13 02:14:53 ----A---- C:\WINDOWS\system32\iasnap.dll
2006-01-13 02:14:53 ----A---- C:\WINDOWS\system32\iashlpr.dll
2006-01-13 02:14:53 ----A---- C:\WINDOWS\system32\iasads.dll
2006-01-13 02:14:53 ----A---- C:\WINDOWS\system32\iasacct.dll
2006-01-13 02:14:52 ----A---- C:\WINDOWS\system32\wlnotify.dll
2006-01-13 02:14:52 ----A---- C:\WINDOWS\system32\wldap32.dll
2006-01-13 02:14:52 ----A---- C:\WINDOWS\system32\secpol.msc
2006-01-13 02:14:52 ----A---- C:\WINDOWS\system32\seclogon.dll
2006-01-13 02:14:52 ----A---- C:\WINDOWS\system32\secedit.exe
2006-01-13 02:14:52 ----A---- C:\WINDOWS\system32\sdpblb.dll
2006-01-13 02:14:52 ----A---- C:\WINDOWS\system32\sdhcinst.dll
2006-01-13 02:14:52 ----A---- C:\WINDOWS\system32\sdbinst.exe
2006-01-13 02:14:52 ----A---- C:\WINDOWS\system32\schtasks.exe
2006-01-13 02:14:52 ----A---- C:\WINDOWS\system32\olesvr32.dll
2006-01-13 02:14:52 ----A---- C:\WINDOWS\system32\olesvr.dll
2006-01-13 02:14:50 ----A---- C:\WINDOWS\system32\wkssvc.dll
2006-01-13 02:14:47 ----A---- C:\WINDOWS\system32\winver.exe
2006-01-13 02:14:43 ----A---- C:\WINDOWS\system32\msieftp.dll
2006-01-13 02:14:42 ----A---- C:\WINDOWS\system32\msidntld.dll
2006-01-13 02:14:42 ----A---- C:\WINDOWS\system32\msidle.dll
2006-01-13 02:14:40 ----A---- C:\WINDOWS\system32\msident.dll
2006-01-13 02:14:35 ----A---- C:\WINDOWS\system32\msiexec.exe
2006-01-13 02:14:29 ----A---- C:\WINDOWS\system32\mqsec.dll
2006-01-13 02:14:29 ----A---- C:\WINDOWS\system32\mqrtdep.dll
2006-01-13 02:14:29 ----A---- C:\WINDOWS\system32\mqrt.dll
2006-01-13 02:13:56 ----R---- C:\WINDOWS\system32\rsop.msc
2006-01-13 02:13:56 ----A---- C:\WINDOWS\system32\rsopprov.exe
2006-01-13 02:13:56 ----A---- C:\WINDOWS\system32\rsnotify.exe
2006-01-13 02:13:56 ----A---- C:\WINDOWS\system32\rsmui.exe
2006-01-13 02:13:56 ----A---- C:\WINDOWS\system32\rsmsink.exe
2006-01-13 02:13:56 ----A---- C:\WINDOWS\system32\rsmps.dll
2006-01-13 02:13:56 ----A---- C:\WINDOWS\system32\rsm.exe
2006-01-13 02:13:56 ----A---- C:\WINDOWS\system32\rshx32.dll
2006-01-13 02:13:56 ----A---- C:\WINDOWS\system32\rsh.exe
2006-01-13 02:13:56 ----A---- C:\WINDOWS\system32\rsfsaps.dll
2006-01-13 02:13:56 ----A---- C:\WINDOWS\system32\rsaenh.dll
2006-01-13 02:13:56 ----A---- C:\WINDOWS\system32\rpcss.dll
2006-01-13 02:13:54 ----A---- C:\WINDOWS\system32\csrsrv.dll
2006-01-13 02:13:54 ----A---- C:\WINDOWS\system32\cscui.dll
2006-01-13 02:13:54 ----A---- C:\WINDOWS\system32\cscript.exe
2006-01-13 02:13:51 ----A---- C:\WINDOWS\system32\ctl3dv2.dll
2006-01-13 02:13:51 ----A---- C:\WINDOWS\system32\ctl3d32.dll
2006-01-13 02:13:51 ----A---- C:\WINDOWS\system32\ctfmon.exe
2006-01-13 02:13:50 ----A---- C:\WINDOWS\system32\csseqchk.dll
2006-01-13 02:13:50 ----A---- C:\WINDOWS\system32\csrss.exe
2006-01-13 02:13:36 ----A---- C:\WINDOWS\system32\hal.dll
2006-01-13 02:13:36 ----A---- C:\WINDOWS\system32\h323msp.dll
2006-01-13 02:13:32 ----A---- C:\WINDOWS\system32\xpob2res.dll
2006-01-13 02:13:26 ----A---- C:\WINDOWS\system32\Ir41_qcx.dll
2006-01-13 02:13:21 ----A---- C:\WINDOWS\system32\aaaamon.dll
2006-01-13 02:13:18 ----A---- C:\WINDOWS\system32\webclnt.dll
2006-01-13 02:13:18 ----A---- C:\WINDOWS\system32\webcheck.dll
2006-01-13 02:13:18 ----A---- C:\WINDOWS\system32\wdigest.dll
2006-01-13 02:13:18 ----A---- C:\WINDOWS\system32\WdfMgr.exe
2006-01-13 02:13:18 ----A---- C:\WINDOWS\system32\wdfApi.dll
2006-01-13 02:13:16 ----A---- C:\WINDOWS\system32\olepro32.dll
2006-01-13 02:13:03 ----A---- C:\WINDOWS\system32\dxdiag.exe
2006-01-13 02:12:50 ----A---- C:\WINDOWS\system32\label.exe
2006-01-13 02:12:31 ----A---- C:\WINDOWS\system32\comdlg32.dll
2006-01-13 02:12:31 ----A---- C:\WINDOWS\system32\comctl32.dll
2006-01-13 02:12:31 ----A---- C:\WINDOWS\system32\comcat.dll
2006-01-13 02:12:23 ----A---- C:\WINDOWS\system32\ipsec6.exe
2006-01-13 02:12:23 ----A---- C:\WINDOWS\system32\iprtrmgr.dll
2006-01-13 02:12:23 ----A---- C:\WINDOWS\system32\iprtprio.dll
2006-01-13 02:12:23 ----A---- C:\WINDOWS\system32\iprop.dll
2006-01-13 02:12:23 ----A---- C:\WINDOWS\system32\ippromon.dll
2006-01-13 02:12:23 ----A---- C:\WINDOWS\system32\ipnathlp.dll
2006-01-13 02:12:20 ----A---- C:\WINDOWS\system32\olethk32.dll
2006-01-13 02:12:20 ----A---- C:\WINDOWS\system32\oleprn.dll
2006-01-13 02:12:19 ----A---- C:\WINDOWS\system32\oledlg.dll
2006-01-13 02:12:19 ----A---- C:\WINDOWS\system32\olecnv32.dll
2006-01-13 02:12:19 ----A---- C:\WINDOWS\autoruns.exe
2006-01-13 02:12:16 ----A---- C:\WINDOWS\system32\tftp.exe
2006-01-13 02:11:59 ----A---- C:\WINDOWS\system32\mmutilse.dll
2006-01-13 02:11:59 ----A---- C:\WINDOWS\system32\mmsystem.dll
2006-01-13 02:11:59 ----A---- C:\WINDOWS\system32\mmdrv.dll
2006-01-13 02:11:59 ----A---- C:\WINDOWS\system32\mmcshext.dll
2006-01-13 02:11:49 ----A---- C:\WINDOWS\system32\wmidx.dll
2006-01-13 02:11:28 ----A---- C:\WINDOWS\system32\mobsync.exe
2006-01-13 02:11:23 ----A---- C:\WINDOWS\twain_32.dll
2006-01-13 02:11:23 ----A---- C:\WINDOWS\twain.dll
2006-01-13 02:11:23 ----A---- C:\WINDOWS\system32\TweakUI.EXE
2006-01-13 02:11:13 ----A---- C:\WINDOWS\system32\autodisc.dll
2006-01-13 02:11:13 ----A---- C:\WINDOWS\system32\autoconv.exe
2006-01-13 02:11:13 ----A---- C:\WINDOWS\system32\autochk.exe
2006-01-13 02:10:58 ----A---- C:\WINDOWS\system32\odtext32.dll
2006-01-13 02:10:58 ----A---- C:\WINDOWS\system32\odpdx32.dll
2006-01-13 02:10:58 ----A---- C:\WINDOWS\system32\odfox32.dll
2006-01-13 02:10:58 ----A---- C:\WINDOWS\system32\odexl32.dll
2006-01-13 02:10:58 ----A---- C:\WINDOWS\system32\oddbse32.dll
2006-01-13 02:10:58 ----A---- C:\WINDOWS\system32\odbctrac.dll
2006-01-13 02:10:58 ----A---- C:\WINDOWS\system32\odbcp32r.dll
2006-01-13 02:10:58 ----A---- C:\WINDOWS\system32\odbcjt32.dll
2006-01-13 02:10:58 ----A---- C:\WINDOWS\system32\odbcji32.dll
2006-01-13 02:10:58 ----A---- C:\WINDOWS\system32\odbcint.dll
2006-01-13 02:10:58 ----A---- C:\WINDOWS\system32\odbccu32.dll
2006-01-13 02:10:58 ----A---- C:\WINDOWS\system32\odbccr32.dll
2006-01-13 02:10:58 ----A---- C:\WINDOWS\system32\odbccp32.dll
2006-01-13 02:10:53 ----A---- C:\WINDOWS\system32\authz.dll
2006-01-13 02:10:53 ----A---- C:\WINDOWS\system32\auditusr.exe
2006-01-13 02:10:53 ----A---- C:\WINDOWS\system32\audiosrv.dll
2006-01-13 02:10:53 ----A---- C:\WINDOWS\system32\Audiodev.dll
2006-01-13 02:10:45 ----A---- C:\WINDOWS\system32\attrib.exe
2006-01-13 02:10:45 ----A---- C:\WINDOWS\system32\atmpvcno.dll
2006-01-13 02:10:45 ----A---- C:\WINDOWS\system32\atmlib.dll
2006-01-13 02:10:45 ----A---- C:\WINDOWS\system32\atmfd.dll
2006-01-13 02:10:41 ----A---- C:\WINDOWS\system32\avicap.dll
2006-01-13 02:10:41 ----A---- C:\WINDOWS\system32\atmadm.exe
2006-01-13 02:10:41 ----A---- C:\WINDOWS\system32\asycfilt.dll
2006-01-13 02:10:41 ----A---- C:\WINDOWS\system32\asr_pfu.exe
2006-01-13 02:10:41 ----A---- C:\WINDOWS\system32\asr_ldm.exe
2006-01-13 02:10:41 ----A---- C:\WINDOWS\system32\asr_fmt.exe
2006-01-13 02:10:39 ----A---- C:\WINDOWS\system32\atl.dll
2006-01-13 02:10:36 ----A---- C:\WINDOWS\system32\atkctrs.dll
2006-01-13 02:10:36 ----A---- C:\WINDOWS\system32\at.exe
2006-01-13 02:10:32 ----A---- C:\WINDOWS\system32\qedit.dll
2006-01-13 02:10:32 ----A---- C:\WINDOWS\system32\avifil32.dll
2006-01-13 02:10:26 ----A---- C:\WINDOWS\system32\avicap32.dll
2006-01-13 02:10:25 ----A---- C:\WINDOWS\system32\avifile.dll
2006-01-13 02:10:10 ----A---- C:\WINDOWS\system32\autolfn.exe
2006-01-13 02:10:10 ----A---- C:\WINDOWS\RootkitRevealer.exe
2006-01-13 02:10:10 ----A---- C:\WINDOWS\psshutdown.exe
2006-01-13 02:10:10 ----A---- C:\WINDOWS\autorunsc.exe
2006-01-06 16:53:16 ----A---- C:\WINDOWS\system32\hid.dll
2006-01-06 16:53:14 ----A---- C:\WINDOWS\system32\wzcsapi.dll
2006-01-06 16:53:14 ----A---- C:\WINDOWS\system32\msyuv.dll
2006-01-06 16:53:12 ----A---- C:\WINDOWS\system32\wzcsvc.dll
2006-01-06 16:53:12 ----A---- C:\WINDOWS\system32\pid.dll
2006-01-06 16:53:12 ----A---- C:\WINDOWS\system32\iyuv_32.dll
2006-01-06 16:53:12 ----A---- C:\WINDOWS\system32\dmutil.dll
2006-01-06 16:53:04 ----A---- C:\WINDOWS\system32\tsbyuv.dll
2006-01-06 16:53:02 ----A---- C:\WINDOWS\system32\streamci.dll
2006-01-06 16:52:38 ----A---- C:\WINDOWS\system32\dvdplay.exe
2006-01-06 16:52:32 ----A---- C:\WINDOWS\system32\sprio800.dll
2006-01-06 16:52:32 ----A---- C:\WINDOWS\system32\sprio600.dll
2006-01-06 16:52:32 ----A---- C:\WINDOWS\system32\spnike.dll
2006-01-06 16:52:32 ----A---- C:\WINDOWS\system32\paqsp.dll
2006-01-06 16:52:32 ----A---- C:\WINDOWS\system32\mdwmdmsp.dll
2005-09-23 08:28:56 ----A---- C:\WINDOWS\system32\netfxperf.dll
2005-09-23 08:28:52 ----A---- C:\WINDOWS\system32\mscories.dll
2005-09-23 08:28:52 ----A---- C:\WINDOWS\system32\mscorier.dll
2005-09-23 08:28:52 ----A---- C:\WINDOWS\system32\mscoree.dll
2005-09-23 08:28:38 ----A---- C:\WINDOWS\system32\dfshim.dll
2004-03-31 12:28:00 ----A---- C:\WINDOWS\system32\mapi32.dll
2003-03-18 20:20:00 ----A---- C:\WINDOWS\system32\mfc71.dll
2003-03-18 20:12:12 ----A---- C:\WINDOWS\system32\mfc71u.dll
2003-03-18 19:14:52 ----A---- C:\WINDOWS\system32\msvcp71.dll
2003-03-18 19:05:50 ----RA---- C:\WINDOWS\system32\atl71.dll
2003-02-21 03:42:22 ----A---- C:\WINDOWS\system32\msvcr71.dll
2003-01-07 16:05:08 ----A---- C:\WINDOWS\system32\OUTLPERF.INI
2002-08-21 06:13:12 ----A---- C:\WINDOWS\system32\WISPTIS.EXE
2002-08-21 06:10:16 ----A---- C:\WINDOWS\system32\INKED.DLL
2002-06-01 00:43:34 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2002-05-30 01:14:54 ----A---- C:\WINDOWS\bdagent.INI
2002-05-30 00:57:00 ----D---- C:\rsit
2002-05-29 10:46:58 ----D---- C:\Documents and Settings\dianne\Application Data\Adobe
2002-05-29 10:42:18 ----D---- C:\Documents and Settings\All Users\Application Data\Yahoo!
2002-05-29 10:42:13 ----D---- C:\Program Files\Yahoo!
2002-05-29 09:48:58 ----D---- C:\Documents and Settings\dianne\Application Data\Macromedia
2002-05-29 05:19:45 ----SHD---- C:\RECYCLER
2002-05-29 05:11:58 ----A---- C:\WINDOWS\ldjs.txt
2002-05-29 05:11:42 ----N---- C:\WINDOWS\system32\ccPrxy.exe
2002-05-29 04:43:46 ----D---- C:\dianne
2002-05-29 04:43:41 ----D---- C:\mervyn
2002-05-29 04:39:45 ----D---- C:\Program Files\uTorrent
2002-05-29 04:39:42 ----D---- C:\Documents and Settings\dianne\Application Data\uTorrent
2002-05-29 04:38:20 ----A---- C:\WINDOWS\system32\h323log.txt
2002-05-29 04:36:50 ----A---- C:\WINDOWS\system32\ksuser.dll
2002-05-29 04:36:28 ----A---- C:\WINDOWS\system32\usbui.dll
2002-05-29 04:33:30 ----A---- C:\WINDOWS\imsins.BAK
2002-05-29 04:33:25 ----SHD---- C:\WINDOWS\Installer
2002-05-29 04:33:25 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2002-05-29 04:33:24 ----RD---- C:\Program Files
2002-05-29 04:33:24 ----D---- C:\Program Files\Common Files\ODBC
2002-05-29 04:33:24 ----D---- C:\Program Files\Common Files
2002-05-29 04:33:24 ----A---- C:\WINDOWS\ODBCINST.INI
2002-05-29 04:33:19 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2002-05-29 04:33:19 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2002-05-29 04:33:19 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2002-05-29 04:33:17 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2002-05-29 04:33:17 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2002-05-29 04:33:17 ----RA---- C:\WINDOWS\system32\kbdur.dll
2002-05-29 04:33:17 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2002-05-29 04:33:17 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2002-05-29 04:33:17 ----RA---- C:\WINDOWS\system32\kbdru.dll
2002-05-29 04:33:17 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2002-05-29 04:33:17 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2002-05-29 04:33:17 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2002-05-29 04:33:17 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2002-05-29 04:33:17 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2002-05-29 04:33:17 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2002-05-29 04:33:15 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2002-05-29 04:33:15 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2002-05-29 04:33:15 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2002-05-29 04:33:15 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2002-05-29 04:33:15 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2002-05-29 04:33:14 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2002-05-29 04:33:14 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2002-05-29 04:33:13 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2002-05-29 04:33:13 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2002-05-29 04:33:13 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2002-05-29 04:33:13 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2002-05-29 04:33:13 ----RA---- C:\WINDOWS\system32\kbdest.dll
2002-05-29 04:33:11 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2002-05-29 04:33:11 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2002-05-29 04:33:11 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2002-05-29 04:33:11 ----RA---- C:\WINDOWS\system32\kbdro.dll
2002-05-29 04:33:11 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2002-05-29 04:33:11 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2002-05-29 04:33:11 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2002-05-29 04:33:11 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2002-05-29 04:33:11 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2002-05-29 04:33:11 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2002-05-29 04:33:11 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2002-05-29 04:33:11 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2002-05-29 04:33:11 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2002-05-29 04:33:07 ----A---- C:\WINDOWS\system32\spxcoins.dll
2002-05-29 04:33:07 ----A---- C:\WINDOWS\system32\irclass.dll
2002-05-29 04:33:07 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2002-05-29 04:33:07 ----A---- C:\WINDOWS\system32\dgsetup.dll
2002-05-29 04:33:07 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2002-05-29 04:33:05 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2002-05-29 04:33:05 ----A---- C:\WINDOWS\TASKMAN.EXE
2002-05-29 04:33:04 ----A---- C:\WINDOWS\system32\batt.dll
2002-05-29 04:33:04 ----A---- C:\WINDOWS\NOTEPAD.EXE
2002-05-29 04:33:03 ----A---- C:\WINDOWS\system32\storprop.dll
2002-05-29 04:32:49 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2002-05-29 04:31:50 ----RA---- C:\WINDOWS\SET7.tmp
2002-05-29 04:31:47 ----RA---- C:\WINDOWS\SET4.tmp
2002-05-29 04:31:45 ----RA---- C:\WINDOWS\SET3.tmp
2002-05-29 04:31:38 ----D---- C:\WINDOWS\system32\CatRoot2
2002-05-29 04:31:38 ----D---- C:\WINDOWS\system32\CatRoot
2002-05-29 04:31:32 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2002-05-29 04:31:20 ----A---- C:\WINDOWS\setuplog.txt
2002-05-29 04:30:39 ----A---- C:\WINDOWS\system32\vuins32.dll
2002-05-29 04:28:41 ----D---- C:\Documents and Settings
2002-05-29 04:28:40 ----SHD---- C:\System Volume Information
2002-05-29 04:27:57 ----SH---- C:\boot.ini
2002-05-29 04:27:16 ----D---- C:\D
2002-05-29 04:26:15 ----D---- C:\Documents and Settings\dianne\Application Data\BitDefender
2002-05-29 04:24:44 ----D---- C:\Program Files\BitDefender
2002-05-29 04:24:44 ----D---- C:\Documents and Settings\All Users\Application Data\BitDefender
2002-05-29 04:23:39 ----RSD---- C:\WINDOWS\Fonts
2002-05-29 04:23:39 ----RD---- C:\WINDOWS\Web
2002-05-29 04:23:39 ----HD---- C:\WINDOWS\inf
2002-05-29 04:23:39 ----D---- C:\WINDOWS\WinSxS
2002-05-29 04:23:39 ----D---- C:\WINDOWS\twain_32
2002-05-29 04:23:39 ----D---- C:\WINDOWS\Temp
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\wins
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\wbem
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\usmt
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\spool
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\ShellExt
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\Setup
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\ras
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\PreInstall
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\oobe
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\npp
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\mui
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\inetsrv
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\IME
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\icsxml
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\ias
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\export
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\drivers
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\dhcp
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\config
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\3com_dmi
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\3076
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\2052
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\1054
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\1042
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\1041
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\1037
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\1033
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\1031
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\1028
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32\1025
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system32
2002-05-29 04:23:39 ----D---- C:\WINDOWS\system
2002-05-29 04:23:39 ----D---- C:\WINDOWS\SoftwareDistribution
2002-05-29 04:23:39 ----D---- C:\WINDOWS\security
2002-05-29 04:23:39 ----D---- C:\WINDOWS\Resources
2002-05-29 04:23:39 ----D---- C:\WINDOWS\repair
2002-05-29 04:23:39 ----D---- C:\WINDOWS\Provisioning
2002-05-29 04:23:39 ----D---- C:\WINDOWS\PeerNet
2002-05-29 04:23:39 ----D---- C:\WINDOWS\pchealth
2002-05-29 04:23:39 ----D---- C:\WINDOWS\mui
2002-05-29 04:23:39 ----D---- C:\WINDOWS\msapps
2002-05-29 04:23:39 ----D---- C:\WINDOWS\msagent
2002-05-29 04:23:39 ----D---- C:\WINDOWS\Media
2002-05-29 04:23:39 ----D---- C:\WINDOWS\java
2002-05-29 04:23:39 ----D---- C:\WINDOWS\ime
2002-05-29 04:23:39 ----D---- C:\WINDOWS\Help
2002-05-29 04:23:39 ----D---- C:\WINDOWS\ehome
2002-05-29 04:23:39 ----D---- C:\WINDOWS\Driver Cache
2002-05-29 04:23:39 ----D---- C:\WINDOWS\Debug
2002-05-29 04:23:39 ----D---- C:\WINDOWS\Cursors
2002-05-29 04:23:39 ----D---- C:\WINDOWS\Connection Wizard
2002-05-29 04:23:39 ----D---- C:\WINDOWS\Config
2002-05-29 04:23:39 ----D---- C:\WINDOWS\AppPatch
2002-05-29 04:23:39 ----D---- C:\WINDOWS\addins
2002-05-29 04:23:39 ----D---- C:\WINDOWS
2002-05-29 04:23:39 ----ASH---- C:\WINDOWS\ver.txt
2002-05-29 04:23:39 ----ASH---- C:\WINDOWS\sy.exe
2002-05-29 04:23:39 ----ASH---- C:\WINDOWS\mouse.txt
2002-05-29 04:23:39 ----ASH---- C:\WINDOWS\ldup.exe
2002-05-29 04:23:04 ----D---- C:\Program Files\Common Files\BitDefender
2002-05-29 04:16:47 ----D---- C:\Documents and Settings\dianne\Application Data\WinRAR
2002-05-29 04:13:18 ----RA---- C:\WINDOWS\system32\S3Ovrlay.dll
2002-05-29 04:13:17 ----RA---- C:\WINDOWS\system32\S3Gamma2.dll
2002-05-29 04:13:16 ----RA---- C:\WINDOWS\system32\S3uninst.exe
2002-05-29 04:13:15 ----RA---- C:\WINDOWS\system32\S3Info2.dll
2002-05-29 04:13:14 ----RA---- C:\WINDOWS\system32\S3Disply.dll
2002-05-29 04:13:10 ----RA---- C:\WINDOWS\system32\nbicdnt.dll
2002-05-29 04:13:09 ----RA---- C:\WINDOWS\system32\s3gnb.dll
2002-05-29 04:07:09 ----HD---- C:\Program Files\Uninstall Information
2002-05-29 04:01:58 ----A---- C:\WINDOWS\ODBC.INI
2002-05-29 04:01:01 ----D---- C:\Program Files\Microsoft ActiveSync
2002-05-29 04:00:55 ----D---- C:\Program Files\Common Files\DESIGNER
2002-05-29 04:00:30 ----D---- C:\WINDOWS\SHELLNEW
2002-05-29 04:00:29 ----D---- C:\Program Files\Microsoft Office
2002-05-29 03:58:54 ----ASH---- C:\Documents and Settings\dianne\Application Data\desktop.ini
2002-05-29 03:58:52 ----SD---- C:\Documents and Settings\dianne\Application Data\Microsoft
2002-05-29 03:58:52 ----D---- C:\Documents and Settings\dianne\Application Data\Mozilla
2002-05-29 03:56:07 ----D---- C:\WINDOWS\Prefetch
2002-05-29 03:56:06 ----SD---- C:\WINDOWS\system32\Microsoft
2002-05-29 03:56:06 ----A---- C:\WINDOWS\SchedLgU.Txt
2002-05-29 03:53:42 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2002-05-29 03:53:35 ----A---- C:\WINDOWS\UninstallFirefox.exe
2002-05-29 03:53:29 ----D---- C:\Program Files\QuickTime Alternative
2002-05-29 03:53:18 ----D---- C:\Program Files\Mozilla Firefox
2002-05-29 03:53:10 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2002-05-29 03:53:10 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2002-05-29 03:53:09 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2002-05-29 03:53:09 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2002-05-29 03:53:08 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2002-05-29 03:53:08 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2002-05-29 03:52:44 ----D---- C:\Program Files\Common Files\Adobe
2002-05-29 03:52:44 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2002-05-29 03:52:43 ----D---- C:\Program Files\Adobe
2002-05-29 03:52:15 ----A---- C:\WINDOWS\control.ini
the log.txt: part3
2002-05-29 03:52:15 ----A---- C:\AUTOEXEC.BAT
2002-05-29 03:49:55 ----SD---- C:\WINDOWS\Downloaded Program Files
2002-05-29 03:49:55 ----RD---- C:\WINDOWS\Offline Web Pages
2002-05-29 03:49:55 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2002-05-29 03:49:41 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2002-05-29 03:49:29 ----HD---- C:\Program Files\WindowsUpdate
2002-05-29 03:49:22 ----D---- C:\Program Files\Online Services
2002-05-29 03:48:54 ----D---- C:\WINDOWS\system32\DirectX
2002-05-29 03:48:31 ----A---- C:\WINDOWS\system32\atrace.dll
2002-05-29 03:48:30 ----A---- C:\WINDOWS\system32\desktop.ini
2002-05-29 03:48:24 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2002-05-29 03:48:23 ----SD---- C:\WINDOWS\Tasks
2002-05-29 03:48:23 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2002-05-29 03:48:22 ----D---- C:\Program Files\Common Files\MSSoap
2002-05-29 03:48:18 ----D---- C:\WINDOWS\srchasst
2002-05-29 03:48:17 ----D---- C:\WINDOWS\system32\Macromed
2002-05-29 03:48:15 ----A---- C:\WINDOWS\system32\wucltui.dll
2002-05-29 03:48:15 ----A---- C:\WINDOWS\system32\wuauserv.dll
2002-05-29 03:48:14 ----A---- C:\WINDOWS\system32\wups.dll
2002-05-29 03:48:14 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2002-05-29 03:48:14 ----A---- C:\WINDOWS\system32\wuaueng.dll
2002-05-29 03:48:14 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2002-05-29 03:48:14 ----A---- C:\WINDOWS\system32\wuauclt.exe
2002-05-29 03:48:13 ----A---- C:\WINDOWS\system32\wuapi.dll
2002-05-29 03:48:13 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2002-05-29 03:48:13 ----A---- C:\WINDOWS\system32\qmgr.dll
2002-05-29 03:48:13 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2002-05-29 03:48:13 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2002-05-29 03:48:08 ----D---- C:\Program Files\Movie Maker
2002-05-29 03:48:04 ----A---- C:\WINDOWS\system32\safrslv.dll
2002-05-29 03:48:04 ----A---- C:\WINDOWS\system32\safrdm.dll
2002-05-29 03:48:04 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2002-05-29 03:48:04 ----A---- C:\WINDOWS\system32\racpldlg.dll
2002-05-29 03:48:01 ----A---- C:\WINDOWS\system32\fltMc.exe
2002-05-29 03:48:01 ----A---- C:\WINDOWS\system32\fltlib.dll
2002-05-29 03:48:00 ----D---- C:\WINDOWS\system32\Restore
2002-05-29 03:48:00 ----A---- C:\WINDOWS\system32\srsvc.dll
2002-05-29 03:48:00 ----A---- C:\WINDOWS\system32\srrstr.dll
2002-05-29 03:48:00 ----A---- C:\WINDOWS\system32\srclient.dll
2002-05-29 03:47:59 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2002-05-29 03:47:59 ----A---- C:\WINDOWS\system32\msconf.dll
2002-05-29 03:47:59 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2002-05-29 03:47:59 ----A---- C:\WINDOWS\system32\mnmdd.dll
2002-05-29 03:47:59 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2002-05-29 03:47:59 ----A---- C:\WINDOWS\system32\ils.dll
2002-05-29 03:47:57 ----D---- C:\Program Files\NetMeeting
2002-05-29 03:47:56 ----A---- C:\WINDOWS\system32\schedsvc.dll
2002-05-29 03:47:56 ----A---- C:\WINDOWS\system32\mstinit.exe
2002-05-29 03:47:56 ----A---- C:\WINDOWS\system32\mstask.dll
2002-05-29 03:47:56 ----A---- C:\WINDOWS\system32\isign32.dll
2002-05-29 03:47:56 ----A---- C:\WINDOWS\system32\inetcfg.dll
2002-05-29 03:47:56 ----A---- C:\WINDOWS\system32\icwphbk.dll
2002-05-29 03:47:56 ----A---- C:\WINDOWS\system32\icwdial.dll
2002-05-29 03:47:49 ----D---- C:\Program Files\Common Files\System
2002-05-29 03:47:48 ----D---- C:\Program Files\Internet Explorer
2002-05-29 03:47:48 ----D---- C:\Program Files\Common Files\Microsoft Shared
2002-05-29 03:46:26 ----D---- C:\Program Files\ComPlus Applications
2002-05-29 03:46:23 ----A---- C:\WINDOWS\vbaddin.ini
2002-05-29 03:46:23 ----A---- C:\WINDOWS\vb.ini
2002-05-29 03:46:16 ----D---- C:\WINDOWS\Registration
2002-05-29 03:45:48 ----D---- C:\Program Files\Unlocker
2002-05-29 03:45:18 ----D---- C:\Program Files\Windows Media Player
2002-05-29 03:41:55 ----D---- C:\Program Files\WinRAR
2002-05-29 03:41:18 ----D---- C:\Program Files\MSN Messenger
2002-05-29 03:41:18 ----A---- C:\WINDOWS\system32\write.exe
2002-05-29 03:41:06 ----A---- C:\WINDOWS\system32\sndvol32.exe
2002-05-29 03:41:06 ----A---- C:\WINDOWS\system32\hticons.dll
2002-05-29 03:41:06 ----A---- C:\WINDOWS\system32\avwav.dll
2002-05-29 03:41:06 ----A---- C:\WINDOWS\system32\avmeter.dll
2002-05-29 03:41:05 ----A---- C:\WINDOWS\system32\winchat.exe
2002-05-29 03:41:05 ----A---- C:\WINDOWS\system32\avtapi.dll
2002-05-29 03:40:56 ----A---- C:\WINDOWS\system32\getuname.dll
2002-05-29 03:40:55 ----A---- C:\WINDOWS\system32\charmap.exe
2002-05-29 03:40:55 ----A---- C:\WINDOWS\system32\calc.exe
2002-05-29 03:40:54 ----A---- C:\WINDOWS\system32\winmine.exe
2002-05-29 03:40:54 ----A---- C:\WINDOWS\system32\sol.exe
2002-05-29 03:40:53 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2002-05-29 03:40:53 ----A---- C:\WINDOWS\system32\tskill.exe
2002-05-29 03:40:53 ----A---- C:\WINDOWS\system32\reset.exe
2002-05-29 03:40:53 ----A---- C:\WINDOWS\system32\mshearts.exe
2002-05-29 03:40:53 ----A---- C:\WINDOWS\system32\freecell.exe
2002-05-29 03:40:52 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2002-05-29 03:40:52 ----A---- C:\WINDOWS\system32\tslabels.ini
2002-05-29 03:40:52 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2002-05-29 03:40:52 ----A---- C:\WINDOWS\system32\tscon.exe
2002-05-29 03:40:52 ----A---- C:\WINDOWS\system32\shadow.exe
2002-05-29 03:40:52 ----A---- C:\WINDOWS\system32\rwinsta.exe
2002-05-29 03:40:52 ----A---- C:\WINDOWS\system32\regini.exe
2002-05-29 03:40:52 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2002-05-29 03:40:52 ----A---- C:\WINDOWS\system32\qwinsta.exe
2002-05-29 03:40:51 ----A---- C:\WINDOWS\system32\qappsrv.exe
2002-05-29 03:40:51 ----A---- C:\WINDOWS\system32\msg.exe
2002-05-29 03:40:51 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2002-05-29 03:40:51 ----A---- C:\WINDOWS\system32\logoff.exe
2002-05-29 03:40:51 ----A---- C:\WINDOWS\system32\cdmodem.dll
2002-05-29 03:40:50 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2002-05-29 03:40:50 ----A---- C:\WINDOWS\system32\mtxex.dll
2002-05-29 03:40:50 ----A---- C:\WINDOWS\system32\mtxdm.dll
2002-05-29 03:40:50 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2002-05-29 03:40:50 ----A---- C:\WINDOWS\system32\comrepl.dll
2002-05-29 03:40:50 ----A---- C:\WINDOWS\system32\comaddin.dll
2002-05-29 03:40:49 ----A---- C:\WINDOWS\system32\stclient.dll
2002-05-29 03:40:49 ----A---- C:\WINDOWS\system32\comsnap.dll
2002-05-29 03:40:33 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2002-05-29 03:40:32 ----A---- C:\WINDOWS\system32\sndrec32.exe
2002-05-29 03:40:32 ----A---- C:\WINDOWS\system32\mplay32.exe
2002-05-29 03:40:32 ----A---- C:\WINDOWS\system32\accwiz.exe
2002-05-29 03:40:31 ----D---- C:\Program Files\Windows NT
2002-05-29 03:40:31 ----A---- C:\WINDOWS\system32\mspaint.exe
2002-05-29 03:40:31 ----A---- C:\WINDOWS\system32\hypertrm.dll
2002-05-29 03:40:30 ----A---- C:\WINDOWS\system32\clipbrd.exe
2002-05-29 03:40:28 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2002-05-29 03:40:28 ----A---- C:\WINDOWS\system32\spider.exe
2002-05-29 03:40:27 ----A---- C:\WINDOWS\system32\sessmgr.exe
2002-05-29 03:40:27 ----A---- C:\WINDOWS\system32\remotepg.dll
2002-05-29 03:40:27 ----A---- C:\WINDOWS\system32\rdshost.exe
2002-05-29 03:40:27 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2002-05-29 03:40:27 ----A---- C:\WINDOWS\system32\mstscax.dll
2002-05-29 03:40:27 ----A---- C:\WINDOWS\system32\mstsc.exe
2002-05-29 03:40:26 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2002-05-29 03:40:26 ----A---- C:\WINDOWS\system32\termsrv.dll
2002-05-29 03:40:26 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2002-05-29 03:40:26 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2002-05-29 03:40:26 ----A---- C:\WINDOWS\system32\rdpclip.exe
2002-05-29 03:40:26 ----A---- C:\WINDOWS\system32\rdchost.dll
2002-05-29 03:40:26 ----A---- C:\WINDOWS\system32\qprocess.exe
2002-05-29 03:40:26 ----A---- C:\WINDOWS\system32\icaapi.dll
2002-05-29 03:40:26 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2002-05-29 03:40:25 ----D---- C:\WINDOWS\system32\MsDtc
2002-05-29 03:40:25 ----A---- C:\WINDOWS\system32\xolehlp.dll
2002-05-29 03:40:25 ----A---- C:\WINDOWS\system32\mtxoci.dll
2002-05-29 03:40:25 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2002-05-29 03:40:25 ----A---- C:\WINDOWS\system32\msdtctm.dll
2002-05-29 03:40:25 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2002-05-29 03:40:25 ----A---- C:\WINDOWS\system32\msdtclog.dll
2002-05-29 03:40:25 ----A---- C:\WINDOWS\system32\msdtc.exe
2002-05-29 03:40:24 ----D---- C:\WINDOWS\system32\Com
2002-05-29 03:40:24 ----A---- C:\WINDOWS\system32\colbact.dll
2002-05-29 03:40:24 ----A---- C:\WINDOWS\system32\clbcatex.dll
2002-05-29 03:40:24 ----A---- C:\WINDOWS\system32\catsrvps.dll
2002-05-29 03:40:23 ----A---- C:\WINDOWS\system32\comuid.dll
2002-05-29 03:40:23 ----A---- C:\WINDOWS\system32\comsvcs.dll
2002-05-29 03:40:23 ----A---- C:\WINDOWS\system32\catsrvut.dll
2002-05-29 03:40:23 ----A---- C:\WINDOWS\system32\catsrv.dll
2002-05-29 03:40:22 ----A---- C:\WINDOWS\system32\clbcatq.dll
2002-05-29 03:40:15 ----A---- C:\WINDOWS\system32\servdeps.dll
2002-05-29 03:40:15 ----A---- C:\WINDOWS\system32\mmfutil.dll
2002-05-29 03:40:15 ----A---- C:\WINDOWS\system32\licwmi.dll
2002-05-29 03:40:15 ----A---- C:\WINDOWS\system32\cmprops.dll
======List of files/folders modified in the last 1 months======
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2006-01-13 36096]
R3 abp470n5;abp470n5; \??\C:\WINDOWS\system32\drivers\johogi.sys []
R3 FETND5BV;VIA Rhine-Family Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2005-03-18 42496]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2006-01-06 2944]
R3 S3Psddr;S3Psddr; C:\WINDOWS\system32\DRIVERS\s3gnbm.sys [2002-11-07 159104]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2006-01-13 57856]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2006-01-13 20480]
R3 VIAudio;VIA AC'97 Audio Controller (WDM); C:\WINDOWS\system32\drivers\viaudio.sys [2003-08-19 73984]
S3 BDSelfPr;BDSelfPr; \??\C:\Program Files\BitDefender\BitDefender 2008\bdselfpr.sys []
S3 Profos;Profos; \??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\profos.sys []
S3 Trufos;Trufos; \??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\trufos.sys []
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2006-01-06 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-04-11 82944]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-04-11 87808]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 166960]
S3 scan;BitDefender Threat Scanner; C:\WINDOWS\System32\svchost.exe [2006-01-13 14336]
S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2006-05-09 6656]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2006-01-13 14336]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-05-09 893440]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2006-01-13 14336]
-----------------EOF-----------------
the info.txt:
info.txt logfile of random's system information tool 1.04 2002-05-30 00:57:44
======Uninstall list======
-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 7.0.5-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70500000002}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
BitDefender Total Security 2008-->MsiExec.exe /I{92098E58-00AD-4F78-AD6E-807BDB323478}
CodecInstaller 2.10.2-->C:\Program Files\JockerSoft\CodecInstaller\uninst.exe
Decoder-->C:\WINDOWS\ST5UNST.EXE -n "C:\Program Files\Decoder\ST5UNST.LOG"
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
HijackThis 2.0.2-->"C:\Documents and Settings\dianne\Desktop\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
K-Lite Codec Pack 4.3.1 (Full)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.0.0 (Pre-Release 5348)-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (3.0.4)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
QuickTime Alternative 1.67-->"C:\Program Files\QuickTime Alternative\unins000.exe"
QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
RagnarokOnline-Valkyrie-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4C964B9E-F8B0-4E60-8D1D-392CD77FA6F9}\setup.exe" -l0x9 -removeonly
Real Alternative 1.9.0-->"C:\Program Files\Real Alternative\unins000.exe"
S3Display-->s3uninst.exe -reg 5 'HKLM\Software\S3\S3Uninst\S3Display'
S3Gamma2-->s3uninst.exe -reg 5 'HKLM\Software\S3\S3Uninst\S3Gamma2'
S3Info2-->s3uninst.exe -reg 5 'HKLM\Software\S3\S3Uninst\S3Info2'
S3Overlay-->s3uninst.exe -reg 5 'HKLM\Software\S3\S3Uninst\S3Overlay'
Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944338-v2)-->"C:\WINDOWS\$NtUninstallKB944338-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
VIA Rhine-Family Fast Ethernet Adapter-->Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA
VLC media player 0.9.6-->C:\Program Files\VideoLAN\VLC\uninstall.exe
WinAVI Video Converter-->"C:\Program Files\WinAVI Video Converter\unins000.exe"
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
Yahoo! Messenger-->C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
======Hosts File======
127.0.0.1 update.bitdefender.com
======Security center information======
AV: Bitdefender Antivirus
FW: Bitdefender Firewall
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime Alternative\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0209
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\QuickTime Alternative\QTSystem\QTJava.zip
"QTJAVA"=C:\Program Files\QuickTime Alternative\QTSystem\QTJava.zip
-----------------EOF-----------------
Step 1
Malwarebytes' Anti-Malware
Please download Malwarebytes' Anti-Malware (http://www.besttechie.net/tools/mbam-setup.exe) to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to
Update Malwarebytes' Anti-Malware
and Launch Malwarebytes' Anti-Malware
then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply
If you accidently close it, the log file is saved here and will be named like this:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
----------------------------------------------------------- -----------------------------------------------------------
Step 2
Download ComboFix from one of these locations:
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://subs.geekstogo.com/ComboFix.exe)
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See HERE (http://www.bleepingcomputer.com/forums/topic114351.html) for help
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
http://img.photobucket.com/albums/v706/ried7/RcAuto1.gif
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
http://img.photobucket.com/albums/v706/ried7/whatnext.png
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
----------------------------------------------------------- -----------------------------------------------------------
Step 3
Your Adobe Acrobat Reader is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Adobe Reader is a large program and uses unnecessary space.
If you prefer a smaller program you can get Foxit 2.0 from http://www.foxitsoftware.com/pdf/rd_intro.php << Recommended
There is a newer version of Adobe Acrobat Reader available.
Please go to this link Adobe Acrobat Reader Download Link (http://www.adobe.com/products/acrobat/readstep2.html)
Click Download
On the right Untick Adobe Phototshop Album Starter Edition if you do not wish to include this in the installation.
Click the Continue button
Click Run, and click Run again
Next click the Install Now button and follow the on screen prompts
When the installation is complete go to Add/Remove Programs and uninstall all previous versions.
----------------------------------------------------------- -----------------------------------------------------------
Step 4
Logs/Information to Post in Reply
Please post the following logs/Information in your reply
MalwareBytes Log
Combofix Log
How are things running now ?
sorry if this is a stupid question>.< but can i do steps 1, 2 and 3 simultaneously? or should i finish step 1 first before proceeding to step 2?
You need to finish each step before moving on to the next.
sir.. about disabling antivirus and antispyware applications in step 2, the spybot S&D won't run and i can't disable it.. but it's on the system tray.. so is it okay to just right-click and click on exit?
sir.
Ooh Errr, I don't often get called that :eek:
You shall get special service from now on :laugh:
Please do the following first, and then continue with the other instructions
Fix With HJT
Close all other windows and then start HiJack This
Click Do A System Scan Only
When it has finished scanning put a check next to the following lines IF still present
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
- Close ALL open windows (especially Internet Explorer!)-
Now click Fix checked
Click yes to any prompts
Close HijackThis
Ooh Errr, I don't often get called that :eek:
You shall get special service from now on :laugh:
oh. haha. =P
this is the malwarebytes log:
Malwarebytes' Anti-Malware 1.30
Database version: 1415
Windows 5.1.2600 Service Pack 2
5/30/2002 1:58:21 PM
mbam-log-2002-05-30 (13-58-21).txt
Scan type: Full Scan (C:\|E:\|)
Objects scanned: 116708
Time elapsed: 7 hour(s), 27 minute(s), 16 second(s)
Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 2
Memory Processes Infected:
C:\Documents and Settings\dianne\Local Settings\Temp\lcnii.exe (Trojan.Downloader) -> Unloaded process successfully.
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msnsc (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Documents and Settings\dianne\Local Settings\Temp\lcnii.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msnsc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
this is the combofix log:
ComboFix 08-11-22.02 - dianne 2008-11-23 13:58:40.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.186 [GMT 0:00]
Running from: c:\documents and settings\dianne\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\explorer.exe . . . is infected!!
.
((((((((((((((((((((((((( Files Created from 2008-10-23 to 2008-11-23 )))))))))))))))))))))))))))))))
.
2008-11-24 08:25 . 2008-11-24 08:25 <DIR> d-------- c:\program files\AskBarDis
2008-11-24 08:25 . 2008-11-24 08:25 <DIR> d-------- c:\documents and settings\dianne\Application Data\Foxit
2008-11-24 08:24 . 2008-11-24 08:24 <DIR> d-------- c:\program files\Foxit Software
2008-11-17 01:01 . 2008-08-14 09:57 2,185,984 --a------ c:\windows\system32\ntoskrnl.exe
2008-11-17 01:01 . 2008-08-14 09:57 2,185,984 --------- c:\windows\system32\DllCache\ntoskrnl.exe
2008-11-17 01:01 . 2008-08-14 09:55 2,142,720 --------- c:\windows\system32\DllCache\ntkrnlmp.exe
2008-11-17 01:01 . 2008-08-14 09:18 2,062,976 --a------ c:\windows\system32\ntkrnlpa.exe
2008-11-17 01:01 . 2008-08-14 09:18 2,062,976 --------- c:\windows\system32\DllCache\ntkrnlpa.exe
2008-11-17 01:01 . 2008-08-14 09:18 2,020,864 --------- c:\windows\system32\DllCache\ntkrpamp.exe
2008-11-17 00:46 . 2008-06-13 13:10 272,128 --------- c:\windows\system32\drivers\bthport.sys
2008-11-17 00:46 . 2008-06-13 13:10 272,128 --------- c:\windows\system32\DllCache\bthport.sys
2008-11-17 00:34 . 2008-09-04 16:42 1,106,944 --a------ c:\windows\system32\msxml3.dll
2008-11-17 00:34 . 2008-09-04 16:42 1,106,944 --------- c:\windows\system32\DllCache\msxml3.dll
2008-11-17 00:29 . 2008-08-28 10:35 333,056 --a------ c:\windows\system32\drivers\srv.sys
2008-11-17 00:29 . 2008-08-28 10:35 333,056 --------- c:\windows\system32\DllCache\srv.sys
2008-11-17 00:28 . 2008-09-15 12:17 1,846,912 --------- c:\windows\system32\DllCache\win32k.sys
2008-11-16 23:40 . 2008-08-14 09:51 138,368 --a------ c:\windows\system32\drivers\afd.sys
2008-11-16 23:40 . 2008-08-14 09:51 138,368 --------- c:\windows\system32\DllCache\afd.sys
2008-11-16 23:23 . 2008-05-08 12:28 202,752 --a------ c:\windows\system32\drivers\rmcast.sys
2008-11-16 23:23 . 2008-05-08 12:28 202,752 --------- c:\windows\system32\DllCache\rmcast.sys
2008-11-16 23:22 . 2008-10-24 11:25 455,936 --a------ c:\windows\system32\drivers\mrxsmb.sys
2008-11-16 23:22 . 2008-10-24 11:25 455,936 --------- c:\windows\system32\DllCache\mrxsmb.sys
2008-11-16 23:22 . 2008-05-01 14:30 331,776 --------- c:\windows\system32\DllCache\msadce.dll
2008-11-16 20:51 . 2008-11-16 20:51 <DIR> d-------- c:\program files\Common Files\INCA Shared
2008-11-16 20:43 . 2003-07-20 18:17 5,174 --a------ c:\windows\system32\nppt9x.vxd
2008-11-16 20:43 . 2005-01-04 09:43 4,682 --a------ c:\windows\system32\npptNT2.sys
2008-11-16 20:24 . 2008-11-16 20:24 <DIR> d--h----- c:\program files\InstallShield Installation Information
2008-11-16 20:24 . 2008-11-16 20:24 <DIR> d-------- c:\program files\Gravity
2008-11-16 20:21 . 2008-11-16 20:21 <DIR> d-------- c:\program files\Common Files\InstallShield
2008-11-16 11:20 . 2002-05-30 13:12 <DIR> d-------- c:\windows\system32\DllCache
2008-11-16 11:18 . 2008-11-16 11:18 <DIR> d-------- c:\program files\MSXML 4.0
2008-11-16 09:47 . 2008-11-19 03:11 <DIR> d-------- c:\windows\system32\CatRoot_bak
2008-11-16 09:08 . 2008-11-16 09:08 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-11-16 09:08 . 2002-05-30 01:13 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-16 06:19 . 2008-11-17 18:27 <DIR> d--h----- c:\windows\$hf_mig$
2008-11-16 03:41 . 2008-10-15 16:53 339,456 --------- c:\windows\system32\DllCache\netapi32.dll
2008-11-15 19:39 . 2008-11-15 19:40 <DIR> d-------- c:\documents and settings\dianne\Application Data\Media Player Classic
2008-11-15 19:38 . 2008-11-15 19:38 <DIR> d-------- c:\program files\Real Alternative
2008-11-15 19:23 . 2008-11-15 19:23 0 --a------ c:\windows\system32\ddnf95.w95
2008-11-15 19:21 . 1998-05-11 16:40 99,248 --a------ c:\windows\system32\MMAIL32.OCX
2008-11-15 19:20 . 2008-11-15 19:21 <DIR> d-------- c:\program files\Decoder
2008-11-15 19:02 . 2008-11-15 19:02 <DIR> d-------- c:\program files\WinAVI Video Converter
2008-11-15 17:39 . 2008-11-15 18:54 <DIR> d-------- c:\documents and settings\dianne\Application Data\vlc
2008-11-15 17:33 . 2008-11-15 17:33 <DIR> d-------- c:\program files\VideoLAN
2008-11-15 17:06 . 2008-11-15 17:06 <DIR> d-------- c:\documents and settings\dianne\Application Data\Apple Computer
2008-11-15 16:31 . 2008-11-15 16:31 <DIR> d-------- c:\program files\Common Files\Apple
2008-11-15 16:29 . 2008-11-15 16:29 <DIR> d-------- c:\program files\Apple Software Update
2008-11-15 16:29 . 2008-11-15 16:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple
2008-11-15 15:24 . 2008-11-15 16:02 <DIR> d-------- c:\program files\K-Lite Codec Pack
2008-11-15 15:24 . 2008-09-24 18:41 839,680 --a------ c:\windows\system32\lameACM.acm
2008-11-15 15:24 . 2004-01-25 16:18 217,088 --a------ c:\windows\system32\yv12vfw.dll
2008-11-15 15:24 . 2007-09-04 16:56 164,352 --a------ c:\windows\system32\unrar.dll
2008-11-15 15:24 . 2007-09-21 00:52 118,784 --a------ c:\windows\system32\ac3acm.acm
2008-11-15 15:24 . 2008-11-02 14:02 7,680 --a------ c:\windows\system32\ff_vfw.dll
2008-11-15 15:24 . 2007-07-10 16:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
2008-11-15 15:24 . 2008-10-03 12:30 414 --a------ c:\windows\system32\lame_acm.xml
2008-11-15 15:24 . 2008-07-30 19:09 38 --a------ c:\windows\avisplitter.ini
2008-11-15 13:29 . 2008-11-15 13:29 <DIR> d-------- c:\program files\JockerSoft
2008-11-15 12:42 . 2008-11-15 12:42 <DIR> d-------- c:\program files\DirectVobSub
2008-11-15 11:25 . 2008-07-18 21:07 270,880 --a------ c:\windows\system32\mucltui.dll
2008-11-15 11:25 . 2008-10-16 14:09 31,768 --a------ c:\windows\system32\wucltui.dll.mui
2008-11-15 11:25 . 2008-07-18 21:07 29,728 --a------ c:\windows\system32\mucltui.dll.mui
2008-11-15 11:25 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuaucpl.cpl.mui
2008-11-15 11:25 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui
2008-11-15 11:25 . 2008-10-16 14:07 18,456 --a------ c:\windows\system32\wuaueng.dll.mui
2008-11-15 11:11 . 2008-11-15 12:32 <DIR> d-------- c:\documents and settings\dianne\Application Data\DivX
2008-11-15 11:04 . 2008-11-15 17:05 <DIR> d-------- c:\program files\DivX
2008-11-15 02:02 . 2008-11-15 02:02 <DIR> d-------- c:\windows\system32\LogFiles
2008-11-15 02:00 . 2008-11-15 02:02 <DIR> d-------- c:\windows\system32\drivers\umdf
2008-11-15 01:54 . 2006-05-09 20:00 22,752 --a------ c:\windows\system32\spupdsvc.exe
2008-10-28 22:36 . 2008-10-28 22:36 823,296 --a------ c:\windows\system32\divx_xx0c.dll
2008-10-28 22:36 . 2008-10-28 22:36 823,296 --a------ c:\windows\system32\divx_xx07.dll
2008-10-28 22:35 . 2008-10-28 22:35 815,104 --a------ c:\windows\system32\divx_xx0a.dll
2008-10-28 22:35 . 2008-10-28 22:35 802,816 --a------ c:\windows\system32\divx_xx11.dll
2008-10-28 22:35 . 2008-10-28 22:35 729,088 --a------ c:\windows\system32\divxdec.ax
2008-10-28 22:35 . 2008-10-28 22:35 684,032 --a------ c:\windows\system32\DivX.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-24 13:33 --------- d-----w c:\documents and settings\dianne\Application Data\uTorrent
2008-11-15 16:34 --------- d-----w c:\program files\QuickTime Alternative
2008-11-15 16:31 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-10-22 15:10 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2008-10-22 15:10 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2008-10-16 14:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 14:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 14:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 14:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 14:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 14:09 133,144 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 14:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-09-30 16:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-25 08:03 81,920 ----a-w c:\windows\system32\dpl100.dll
2008-09-25 08:03 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-09-25 08:03 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-09-25 08:03 53,248 ----a-w c:\windows\system32\dpuGUI10.dll
2008-09-25 08:03 524,288 ----a-w c:\windows\system32\DivXsm.exe
2008-09-25 08:03 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu10.dll
2008-09-25 08:03 196,608 ----a-w c:\windows\system32\dtu100.dll
2008-09-25 08:03 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe
2008-09-19 21:57 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
2008-09-19 21:55 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-09-19 21:55 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-09-19 21:54 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll
2008-09-15 12:17 1,846,912 ----a-w c:\windows\system32\win32k.sys
2008-09-05 22:30 241,704 ------w c:\windows\system32\DllCache\wgaLogon.dll
2008-09-05 22:29 917,032 ------w c:\windows\system32\DllCache\WgaTray.exe
2002-05-29 03:23 16,384 --sha-w c:\windows\keybd.dat
2002-05-29 03:23 90,112 --sha-w c:\windows\ldup.exe
2002-05-29 03:23 24,576 --sha-w c:\windows\sy.exe
.
((((((((((((((((((((((((((((( snapshot@2008-11-24_ 8.12.21.85 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-01-13 01:46:46 1,075,200 ----a-w c:\windows\explorer.exe
+ 2006-01-13 01:46:46 1,144,832 ----a-w c:\windows\explorer.exe
- 2006-01-13 01:49:10 491,008 ----a-w c:\windows\system32\cmd.exe
+ 2006-01-13 01:49:10 560,640 ----a-w c:\windows\system32\cmd.exe
- 2008-11-03 15:10:26 17,318,336 ----a-w c:\windows\system32\MRT.exe
+ 2008-11-03 15:10:26 17,396,160 ----a-w c:\windows\system32\MRT.exe
- 2002-05-29 00:07:11 58,800 ----a-w c:\windows\system32\perfc009.dat
+ 2008-11-24 08:21:24 58,800 ----a-w c:\windows\system32\perfc009.dat
- 2002-05-29 00:07:12 392,626 ----a-w c:\windows\system32\perfh009.dat
+ 2008-11-24 08:21:25 392,626 ----a-w c:\windows\system32\perfh009.dat
- 2006-01-13 01:34:15 85,504 ----a-w c:\windows\system32\regsvr32.exe
+ 2006-01-13 01:34:15 187,904 ----a-w c:\windows\system32\regsvr32.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-18 12:58 333192 --a------ c:\program files\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2005-12-14 7275568]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2008-11-05 4420848]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BDAgent"="c:\program files\BitDefender\BitDefender 2008\bdagent.exe" [2008-02-16 434176]
"QuickTime Task"="c:\program files\QuickTime Alternative\QTTask.exe" [2008-09-06 487424]
"ccPrxy.exe"="ccPrxy.exe" [2002-05-29 c:\windows\system32\ccPrxy.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="move" [X]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2006-01-13 44544]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i263_32.drv
"msacm.imc"= imc32.acm
"msacm.l3codecp"= l3codecp.acm
"VIDC.i263"= i263_32.drv
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= c:\\Program Files\\MSN Messenger\\MsnMsgr.Exe
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\dianne\\Templates\\ldup.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\ccPrxy.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\wuauclt.exe"=
"c:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbamgui.exe"=
"c:\\WINDOWS\\system32\\netsh.exe"=
"c:\\Program Files\\BitDefender\\BitDefender 2008\\bdagent.exe"=
"c:\\Program Files\\QuickTime Alternative\\QTTask.exe"=
R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\johogi.sys []
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\dianne\Application Data\Mozilla\Firefox\Profiles\v4gzefeq.default\
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF -: plugin - c:\program files\QuickTime Alternative\Plugins\npqtplugin.dll
FF -: plugin - c:\program files\QuickTime Alternative\Plugins\npqtplugin2.dll
FF -: plugin - c:\program files\QuickTime Alternative\Plugins\npqtplugin3.dll
FF -: plugin - c:\program files\QuickTime Alternative\Plugins\npqtplugin4.dll
FF -: plugin - c:\program files\QuickTime Alternative\Plugins\npqtplugin5.dll
FF -: plugin - c:\program files\QuickTime Alternative\Plugins\npqtplugin6.dll
FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-23 14:01:54
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(624)
c:\windows\system32\rsaenh.dll
c:\windows\system32\WgaLogon.dll
- - - - - - - > 'lsass.exe'(680)
c:\windows\system32\msprivs.dll
c:\windows\system32\rsaenh.dll
.
Completion time: 2008-11-23 14:04:42
ComboFix-quarantined-files.txt 2008-11-23 14:04:13
ComboFix2.txt 2008-11-24 08:16:48
Pre-Run: 5,451,952,128 bytes free
Post-Run: 5,435,371,520 bytes free
236 --- E O F --- 2002-05-30 13:14:26
thanks :D
sorry.. i forgot the how-are-things-running-now question.. the spybot S&D still won't run and my pc still hangs when i try to paste a file..
Information
c:\windows\explorer.exe . . . is infected!!
That doesn't look good :(
----------------------------------------------------------- -----------------------------------------------------------
Step 1
Submit a File For Analysis
We need to have the files below Scanned by Uploading them/it to Virus Total
Please visit Virustotal (http://www.virustotal.com/en/indexf.html)
Copy/paste the the following file path into the window
c:\windows\explorer.exe
Click Submit/Send File
Please post back, to let me know the results.
Please do the same for the following file
c:\windows\system32\cmd.exe
If Virustotal is too busy please try Jotti (http://virusscan.jotti.org/)
----------------------------------------------------------- -----------------------------------------------------------
Step 2
Kaspersky Online Scanner .
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- This scan is best done from IE (Internet Explorer)
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html
Read the Requirements and limitations before you click Accept.
Once the database has downloaded, click My Computer in the left pane
Now go and put the kettle on !
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.
**Note**
To optimize scanning time and produce a more sensible report for review: Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.
----------------------------------------------------------- -----------------------------------------------------------
Step 3
Logs/Information to Post in Reply
Please post the following logs/Information in your reply
Virus Total results
Kaspersky Log
Contents of C:\Qoobox\Combofix2.txt
good morning sir, i just woke up.. and i'm on my way now to the dorm.. another BUSY week :(
anway, i was planning to at least complete step 1 and post the results before i leave but for an unknown reason, the pages(virusttotal and jotti) won't load.. so see you again next week =D thank you so much.
virustotal.com and jotti.org won't load..
Please run the Kaspersky scan
virustotal and jottie>> "Loading..." forever
kaspersky>> "Page Load Error"
:(
Upload a File
Download suspicious file packer from here (http://www.safer-networking.org/files/sfp.zip)
Unzip it to desktop, open it & paste in the list of files below, press next & it will create an archive (zip/cab file) on desktop
c:\windows\explorer.exe
Go to spykiller (http://thespykiller.co.uk/index.php?board=1.0)
Please start a new thread Titled File/s for Katana and give the following information
Name:-- Your name
E-mail:-- Your E-mail (this is confidential and will not be displayed)
Subject:-- File for Katana
In the main text window please put the following link
http://forums.spybot.info/showthread.php?t=36488&goto=newpost
you may also add any comments you wish
then press attach and upload the zip/cab file that was created.
Files can be uploaded by anybody but not downloaded at all except for those users that have been given special permissions.
You DO NOT need to be a member to upload, anybody can upload the files
You can now delete SFP (exe and Zip) along with the .cab file that was created
when i clicked on continue, an error message appeared: "Cannot open AVI."
Custom CFScript
Please delete the copy of ComboFix that you have and download an updated copy from one of the links below
ComboFix.exe 1 (http://subs.geekstogo.com/ComboFix.exe)
ComboFix.exe 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
ComboFix.exe 3 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
http://forums.spybot.info/showthread.php?p=260497#post260497
Comment:: Katana
Suspect::[4]
c:\windows\explorer.exe
Save this as CFScript.txt and place it on your desktop.
http://i51.photobucket.com/albums/f387/Katana_1970/CFScriptb.gif
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.
A window will open asking you to ensure you are connected to the internet, this is so a file can be submitted for analysis.
Click OK and follow the instructions to submit the file.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
sorry.. i was on afk mode while the combofix was scanning.. :oops: so i'm not sure whether it finished scanning but my pc did reboot..
the combofix.txt is supposed to be in C:\ right? i can't find it>.<
Download and Run DirLook
Please download DirLook by jpshortstuff from here (http://jpshortstuff.247fixes.com/DirLook.exe).
Double-click DirLook.exe to run it.
Ensure that Show Hidden Files/Folders and BBCode Ouput are both checked.
Copy the content of the following codebox into the textfield labeled "Directory:":
C:\Qoobox /s
Click the DirLook button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. (Note: The log can also be found at C:\dl_log.txt)
Note: Scanning may take longer for large folders
hello.. here it is:
DirLook.exe v2.0 by jpshortstuff
Log created at 21:23 on 30/11/2008
==================================
Contents of "C:\Qoobox"
---FOLDERS---
LastRun (Created on 30/11/2008 at 20:05) d-----
Quarantine (Created on 30/05/2002 at 13:10) d-a---
Test (Created on 30/11/2008 at 20:05) d-----
TestC (Created on 30/11/2008 at 20:05) d-----
---FILES---
Add-Remove Programs.txt (1767 bytes - created on 24/11/2008 at 08:16, modified on 23/11/2008 at 14:04) --a---
BackEnv (10332 bytes - created on 30/11/2008 at 20:08, modified on 30/11/2008 at 20:07) --a---
CF-Submit.htm (1215 bytes - created on 30/11/2008 at 20:08, modified on 30/11/2008 at 20:08) --a---
CFScript_used_2008-11-30@20.08.txt (117 bytes - created on 30/11/2008 at 20:08, modified on 30/11/2008 at 20:02) --a---
ComboFix-quarantined-files.txt (711 bytes - created on 24/11/2008 at 08:16, modified on 23/11/2008 at 14:04) --a---
ComboFix2.txt (15837 bytes - created on 24/11/2008 at 08:16, modified on 23/11/2008 at 14:04) --a---
ComboFix3.txt (14755 bytes - created on 24/11/2008 at 08:16, modified on 24/11/2008 at 08:16) --a---
LogA (552 bytes - created on 30/11/2008 at 20:13, modified on 30/11/2008 at 20:13) --a---
snapshot@2008-11-24_ 8.12.21.85.dat (563606 bytes - created on 24/11/2008 at 08:12, modified on 24/11/2008 at 08:12) --a---
snapshot@2008-11-24_ 8.12.21.85_B.dat (532484 bytes - created on 24/11/2008 at 08:12, modified on 24/11/2008 at 08:12) --a---
---Sub-Directories---
C:\Qoobox\LastRun
CregC.old (0 bytes - created on 30/11/2008 at 20:09, modified on 30/11/2008 at 20:12) --a---
d-del2A.dat (0 bytes - created on 30/11/2008 at 20:10, modified on 30/11/2008 at 20:11) --a---
d-del2AA.dat (0 bytes - created on 30/11/2008 at 20:12, modified on 30/11/2008 at 20:11) --a---
d-del4AV.dat (0 bytes - created on 30/11/2008 at 20:12, modified on 30/11/2008 at 20:12) --a---
drevB.dat (284 bytes - created on 30/11/2008 at 20:09, modified on 30/11/2008 at 20:12) --a---
erunt.dat (10 bytes - created on 30/11/2008 at 20:09, modified on 30/11/2008 at 20:05) --a---
ndis_log.dat (67 bytes - created on 30/11/2008 at 20:12, modified on 30/11/2008 at 20:12) --a---
RenVDel.dat (0 bytes - created on 30/11/2008 at 20:10, modified on 30/11/2008 at 20:11) --a---
SvcTarget.dat (117 bytes - created on 30/11/2008 at 20:09, modified on 30/11/2008 at 20:08) --a---
zhsvc.old (874 bytes - created on 30/11/2008 at 20:09, modified on 30/11/2008 at 20:12) --a---
C:\Qoobox\Quarantine
catchme.log (290 bytes - created on 30/05/2002 at 13:10, modified on 30/11/2008 at 20:05) --a---
[4]-Submit_2008-11-30@20.08.zip (433060 bytes - created on 30/11/2008 at 20:08, modified on 30/11/2008 at 20:08) --a---
C:\Qoobox\Quarantine\C (Created on 24/11/2008 at 08:07) d-----
autorun.inf.vir (643 bytes - created on 29/05/2002 at 11:27, modified on 30/11/2008 at 18:22) --a---
e.cmd.vir (176128 bytes - created on 30/11/2008 at 18:11, modified on 30/11/2008 at 18:10) --a---
i.bat.vir (182272 bytes - created on 29/05/2002 at 11:28, modified on 29/05/2002 at 11:27) --a---
vva0hc0p.cmd.vir (172544 bytes - created on 29/05/2002 at 11:27, modified on 04/10/2008 at 09:25) --a---
C:\Qoobox\Quarantine\C\WINDOWS (Created on 30/11/2008 at 20:09) d-----
explorer.exe.vir (1144832 bytes - created on 13/01/2006 at 01:46, modified on 13/01/2006 at 01:46) --a---
C:\Qoobox\Quarantine\C\WINDOWS\system32 (Created on 30/11/2008 at 20:09) d-----
ckvo.exe.vir (172544 bytes - created on 29/05/2002 at 11:26, modified on 04/10/2008 at 09:25) --a---
ckvo0.dll.vir (85504 bytes - created on 29/05/2002 at 11:27, modified on 29/05/2002 at 11:27) --a---
gasretyw0.dll.vir (85504 bytes - created on 29/05/2002 at 11:27, modified on 30/11/2008 at 18:21) --a---
gasretyw1.dll.vir (85504 bytes - created on 30/11/2008 at 18:11, modified on 30/11/2008 at 18:11) --a---
kamsoft.exe.vir (176128 bytes - created on 29/05/2002 at 11:27, modified on 30/11/2008 at 18:10) --a---
C:\Qoobox\Quarantine\E (Created on 24/11/2008 at 08:12) d-a---
AUTORUN.INF.vir (93 bytes - created on 24/11/2008 at 08:12, modified on 30/05/2002 at 00:32) --a---
C:\Qoobox\Quarantine\Registry_backups (Created on 30/05/2002 at 13:10) d-----
HKLM-Run-BitDefender Antiphishing Helper.reg.dat (182 bytes - created on 24/11/2008 at 08:12, modified on 24/11/2008 at 08:12) --a---
HKLM-Run-CFSServ.exe.reg.dat (0 bytes - created on 24/11/2008 at 08:12, modified on 24/11/2008 at 08:12) --a---
HKLM-Run-NDSTray.exe.reg.dat (0 bytes - created on 24/11/2008 at 08:12, modified on 24/11/2008 at 08:12) --a---
HKLM-Run-TFncKy.reg.dat (0 bytes - created on 24/11/2008 at 08:12, modified on 24/11/2008 at 08:12) --a---
tcpip.reg (4865 bytes - created on 24/11/2008 at 08:10, modified on 30/11/2008 at 20:11) --a---
C:\Qoobox\Test
C:\Qoobox\TestC
==================================
=EOF=
Please open LINK >>> THIS PAGE (http://www.bleepingcomputer.com/submit-malware.php?channel=4) <<<LINK in a new window.
In the box marked Link to topic where this file was requested: please put this text
http://forums.spybot.info/showthread.php?p=260611#post260611
In the box marked Browse to the file you want to submit: please put this text
C:\Qoobox\Quarantine\[4]-Submit_2008-11-30@20.08.zip
In the Largest box please put
Failed CF Submit
Finally click SendFile
hi, i've submitted the file =D
Thanks for that.
Download and Run ComboFix
Please delete the copy of ComboFix that you have and download an updated copy from one of the links below
Please visit this webpage for instructions on using ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
ComboFix.exe 1 (http://subs.geekstogo.com/ComboFix.exe)
ComboFix.exe 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
ComboFix.exe 3 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
ComboFix SHOULD NOT be used unless requested by a forum helper
hello again, this is the log.txt from Combofix:
ComboFix 08-11-30.01 - dianne 2008-12-01 17:24:48.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.148 [GMT 0:00]
Running from: c:\documents and settings\dianne\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
F:\e.cmd
.
---- Previous Run -------
.
C:\autorun.inf
C:\e.cmd
C:\i.bat
C:\vva0hc0p.cmd
c:\windows\system32\ckvo.exe
c:\windows\system32\ckvo0.dll
c:\windows\system32\gasretyw0.dll
c:\windows\system32\gasretyw1.dll
c:\windows\system32\kamsoft.exe
E:\Autorun.inf
E:\i.bat
E:\vva0hc0p.cmd
.
((((((((((((((((((((((((( Files Created from 2008-11-01 to 2008-12-01 )))))))))))))))))))))))))))))))
.
2008-11-30 17:59 . 2002-05-29 02:03 <DIR> d-------- c:\program files\MetaCommander
2008-11-30 10:58 . 2008-11-30 14:15 <DIR> d-------- c:\program files\NOS
2008-11-30 10:58 . 2008-11-30 14:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\NOS
2008-11-24 08:25 . 2008-11-23 13:44 <DIR> d-------- c:\program files\AskBarDis
2008-11-24 08:25 . 2008-11-24 08:25 <DIR> d-------- c:\documents and settings\dianne\Application Data\Foxit
2008-11-24 08:24 . 2008-11-24 08:24 <DIR> d-------- c:\program files\Foxit Software
2008-11-23 11:49 . 2008-11-23 11:49 <DIR> d-------- c:\windows\Sun
2008-11-23 09:11 . 2008-11-23 09:11 <DIR> d-------- c:\documents and settings\dianne\Application Data\com.Multiply.AutoUploader.C7DF09F73C2059D294831784007C5F0856677385.1
2008-11-23 09:10 . 2008-11-23 09:10 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2008-11-23 09:05 . 2008-11-23 09:03 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-11-23 09:03 . 2008-11-23 09:03 <DIR> d-------- c:\program files\Java
2008-11-23 08:57 . 2008-11-23 08:57 <DIR> d-------- c:\program files\Multiply
2008-11-23 08:46 . 2008-11-23 09:03 410,976 --a------ c:\windows\system32\deploytk.dll
2008-11-17 01:01 . 2008-08-14 09:57 2,185,984 --a------ c:\windows\system32\ntoskrnl.exe
2008-11-17 01:01 . 2008-08-14 09:57 2,185,984 --------- c:\windows\system32\DllCache\ntoskrnl.exe
2008-11-17 01:01 . 2008-08-14 09:55 2,142,720 --------- c:\windows\system32\DllCache\ntkrnlmp.exe
2008-11-17 01:01 . 2008-08-14 09:18 2,062,976 --a------ c:\windows\system32\ntkrnlpa.exe
2008-11-17 01:01 . 2008-08-14 09:18 2,062,976 --------- c:\windows\system32\DllCache\ntkrnlpa.exe
2008-11-17 01:01 . 2008-08-14 09:18 2,020,864 --------- c:\windows\system32\DllCache\ntkrpamp.exe
2008-11-17 00:46 . 2008-06-13 13:10 272,128 --------- c:\windows\system32\drivers\bthport.sys
2008-11-17 00:46 . 2008-06-13 13:10 272,128 --------- c:\windows\system32\DllCache\bthport.sys
2008-11-17 00:34 . 2008-09-04 16:42 1,106,944 --a------ c:\windows\system32\msxml3.dll
2008-11-17 00:34 . 2008-09-04 16:42 1,106,944 --------- c:\windows\system32\DllCache\msxml3.dll
2008-11-17 00:29 . 2008-08-28 10:35 333,056 --a------ c:\windows\system32\drivers\srv.sys
2008-11-17 00:29 . 2008-08-28 10:35 333,056 --------- c:\windows\system32\DllCache\srv.sys
2008-11-17 00:28 . 2008-09-15 12:17 1,846,912 --------- c:\windows\system32\DllCache\win32k.sys
2008-11-16 23:40 . 2008-08-14 09:51 138,368 --a------ c:\windows\system32\drivers\afd.sys
2008-11-16 23:40 . 2008-08-14 09:51 138,368 --------- c:\windows\system32\DllCache\afd.sys
2008-11-16 23:23 . 2008-05-08 12:28 202,752 --a------ c:\windows\system32\drivers\rmcast.sys
2008-11-16 23:23 . 2008-05-08 12:28 202,752 --------- c:\windows\system32\DllCache\rmcast.sys
2008-11-16 23:22 . 2008-10-24 11:25 455,936 --a------ c:\windows\system32\drivers\mrxsmb.sys
2008-11-16 23:22 . 2008-10-24 11:25 455,936 --------- c:\windows\system32\DllCache\mrxsmb.sys
2008-11-16 23:22 . 2008-05-01 14:30 331,776 --------- c:\windows\system32\DllCache\msadce.dll
2008-11-16 20:51 . 2008-11-16 20:51 <DIR> d-------- c:\program files\Common Files\INCA Shared
2008-11-16 20:43 . 2003-07-20 18:17 5,174 --a------ c:\windows\system32\nppt9x.vxd
2008-11-16 20:43 . 2005-01-04 09:43 4,682 --a------ c:\windows\system32\npptNT2.sys
2008-11-16 20:24 . 2008-11-16 20:24 <DIR> d--h----- c:\program files\InstallShield Installation Information
2008-11-16 20:24 . 2008-11-16 20:24 <DIR> d-------- c:\program files\Gravity
2008-11-16 20:21 . 2008-11-16 20:21 <DIR> d-------- c:\program files\Common Files\InstallShield
2008-11-16 11:20 . 2002-05-30 13:12 <DIR> d-------- c:\windows\system32\DllCache
2008-11-16 11:18 . 2008-11-16 11:18 <DIR> d-------- c:\program files\MSXML 4.0
2008-11-16 09:47 . 2008-11-19 03:11 <DIR> d-------- c:\windows\system32\CatRoot_bak
2008-11-16 09:08 . 2008-11-16 09:08 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-11-16 09:08 . 2002-05-30 01:13 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-16 06:19 . 2008-11-17 18:27 <DIR> d--h----- c:\windows\$hf_mig$
2008-11-16 03:41 . 2008-10-15 16:53 339,456 --------- c:\windows\system32\DllCache\netapi32.dll
2008-11-15 19:39 . 2008-11-15 19:40 <DIR> d-------- c:\documents and settings\dianne\Application Data\Media Player Classic
2008-11-15 19:38 . 2008-11-15 19:38 <DIR> d-------- c:\program files\Real Alternative
2008-11-15 19:23 . 2008-11-15 19:23 0 --a------ c:\windows\system32\ddnf95.w95
2008-11-15 19:21 . 1998-05-11 16:40 99,248 --a------ c:\windows\system32\MMAIL32.OCX
2008-11-15 19:20 . 2008-11-15 19:21 <DIR> d-------- c:\program files\Decoder
2008-11-15 19:02 . 2008-11-15 19:02 <DIR> d-------- c:\program files\WinAVI Video Converter
2008-11-15 17:33 . 2008-11-15 17:33 <DIR> d-------- c:\program files\VideoLAN
2008-11-15 17:06 . 2008-11-15 17:06 <DIR> d-------- c:\documents and settings\dianne\Application Data\Apple Computer
2008-11-15 16:29 . 2008-11-15 16:29 <DIR> d-------- c:\program files\Apple Software Update
2008-11-15 16:29 . 2008-11-15 16:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple
2008-11-15 15:24 . 2008-11-15 16:02 <DIR> d-------- c:\program files\K-Lite Codec Pack
2008-11-15 15:24 . 2008-09-24 18:41 839,680 --a------ c:\windows\system32\lameACM.acm
2008-11-15 15:24 . 2004-01-25 16:18 217,088 --a------ c:\windows\system32\yv12vfw.dll
2008-11-15 15:24 . 2007-09-04 16:56 164,352 --a------ c:\windows\system32\unrar.dll
2008-11-15 15:24 . 2007-09-21 00:52 118,784 --a------ c:\windows\system32\ac3acm.acm
2008-11-15 15:24 . 2008-11-02 14:02 7,680 --a------ c:\windows\system32\ff_vfw.dll
2008-11-15 15:24 . 2007-07-10 16:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
2008-11-15 15:24 . 2008-10-03 12:30 414 --a------ c:\windows\system32\lame_acm.xml
2008-11-15 15:24 . 2008-07-30 19:09 38 --a------ c:\windows\avisplitter.ini
2008-11-15 13:29 . 2008-11-15 13:29 <DIR> d-------- c:\program files\JockerSoft
2008-11-15 12:42 . 2008-11-15 12:42 <DIR> d-------- c:\program files\DirectVobSub
2008-11-15 11:25 . 2008-10-16 13:06 268,648 --a------ c:\windows\system32\mucltui.dll
2008-11-15 11:25 . 2008-10-16 14:09 31,768 --a------ c:\windows\system32\wucltui.dll.mui
2008-11-15 11:25 . 2008-10-16 13:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
2008-11-15 11:25 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuaucpl.cpl.mui
2008-11-15 11:25 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui
2008-11-15 11:25 . 2008-10-16 14:07 18,456 --a------ c:\windows\system32\wuaueng.dll.mui
2008-11-15 11:11 . 2008-11-15 12:32 <DIR> d-------- c:\documents and settings\dianne\Application Data\DivX
2008-11-15 11:04 . 2008-11-15 17:05 <DIR> d-------- c:\program files\DivX
2008-11-15 02:02 . 2008-11-15 02:02 <DIR> d-------- c:\windows\system32\LogFiles
2008-11-15 02:00 . 2008-11-15 02:02 <DIR> d-------- c:\windows\system32\drivers\umdf
2008-11-15 01:54 . 2006-05-09 20:00 22,752 --a------ c:\windows\system32\spupdsvc.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-01 17:25 --------- d-----w c:\documents and settings\dianne\Application Data\uTorrent
2008-11-30 20:12 1,075,200 ----a-w c:\windows\explorer.exe
2008-11-30 18:04 --------- d-----w c:\program files\QuickTime Alternative
2008-11-30 09:49 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx0c.dll
2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx07.dll
2008-10-28 22:35 815,104 ----a-w c:\windows\system32\divx_xx0a.dll
2008-10-28 22:35 802,816 ----a-w c:\windows\system32\divx_xx11.dll
2008-10-28 22:35 684,032 ----a-w c:\windows\system32\DivX.dll
2008-10-22 15:10 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2008-10-22 15:10 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2008-10-16 14:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 14:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 14:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 14:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 14:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 14:09 133,144 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 14:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-09-30 16:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-25 08:03 81,920 ----a-w c:\windows\system32\dpl100.dll
2008-09-25 08:03 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-09-25 08:03 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-09-25 08:03 53,248 ----a-w c:\windows\system32\dpuGUI10.dll
2008-09-25 08:03 524,288 ----a-w c:\windows\system32\DivXsm.exe
2008-09-25 08:03 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu10.dll
2008-09-25 08:03 196,608 ----a-w c:\windows\system32\dtu100.dll
2008-09-25 08:03 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe
2008-09-19 21:57 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
2008-09-19 21:55 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-09-19 21:55 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-09-19 21:54 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll
2008-09-15 12:17 1,846,912 ----a-w c:\windows\system32\win32k.sys
2008-09-05 22:30 241,704 ------w c:\windows\system32\DllCache\wgaLogon.dll
2008-09-05 22:29 917,032 ------w c:\windows\system32\DllCache\WgaTray.exe
2002-05-29 03:23 16,384 --sha-w c:\windows\keybd.dat
2002-05-29 01:22 90,112 --sha-w c:\windows\ldup.exe
2002-05-29 01:22 24,576 --sha-w c:\windows\sy.exe
.
((((((((((((((((((((((((((((( snapshot@2008-11-24_ 8.12.21.85 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-11-20 11:09:41 593,920 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2008-11-23 11:08:23 593,920 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
- 2008-11-20 11:09:41 12,288 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-11-23 11:08:23 12,288 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-11-20 11:09:41 86,016 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2008-11-23 11:08:23 86,016 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2008-11-20 11:09:41 135,168 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-11-23 11:08:22 135,168 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-11-20 11:09:41 11,264 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-11-23 11:08:23 11,264 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2008-11-20 11:09:41 27,136 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-11-23 11:08:23 27,136 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-11-20 11:09:41 4,096 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-11-23 11:08:23 4,096 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-11-20 11:09:42 794,624 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2008-11-23 11:08:23 794,624 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-11-20 11:09:41 249,856 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-11-23 11:08:22 249,856 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2008-11-20 11:09:41 61,440 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2008-11-23 11:08:22 61,440 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2008-11-20 11:09:42 23,040 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-11-23 11:08:23 23,040 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2008-11-20 11:09:41 286,720 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-11-23 11:08:22 286,720 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-11-20 11:09:41 409,600 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-11-23 11:08:22 409,600 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2006-01-13 01:15:31 956,688 ----a-w c:\windows\system32\calc.exe
+ 2006-01-13 01:15:31 1,026,320 ----a-w c:\windows\system32\calc.exe
- 2006-01-13 01:49:10 491,008 ----a-w c:\windows\system32\cmd.exe
+ 2006-01-13 01:49:10 663,040 ----a-w c:\windows\system32\cmd.exe
+ 2008-11-23 09:03:43 144,792 ----a-w c:\windows\system32\java.exe
+ 2008-11-23 09:03:43 144,792 ----a-w c:\windows\system32\javaw.exe
+ 2008-11-23 09:03:43 148,888 ----a-w c:\windows\system32\javaws.exe
- 2008-11-03 15:10:26 17,318,336 ----a-w c:\windows\system32\MRT.exe
+ 2008-11-03 15:10:26 17,396,160 ----a-w c:\windows\system32\MRT.exe
- 2002-05-29 00:07:11 58,800 ----a-w c:\windows\system32\perfc009.dat
+ 2002-05-29 01:05:27 58,800 ----a-w c:\windows\system32\perfc009.dat
- 2002-05-29 00:07:12 392,626 ----a-w c:\windows\system32\perfh009.dat
+ 2002-05-29 01:05:27 392,626 ----a-w c:\windows\system32\perfh009.dat
- 2006-01-13 01:34:15 85,504 ----a-w c:\windows\system32\regsvr32.exe
+ 2006-01-13 01:34:15 187,904 ----a-w c:\windows\system32\regsvr32.exe
+ 2002-05-29 02:31:19 16,384 ----atw c:\windows\temp\Perflib_Perfdata_72c.dat
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-18 12:58 333192 --a------ c:\program files\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2005-12-14 7275568]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2008-11-05 4424944]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BDAgent"="c:\program files\BitDefender\BitDefender 2008\bdagent.exe" [2008-02-16 434176]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-23 214424]
"ccPrxy.exe"="ccPrxy.exe" [2002-05-29 c:\windows\system32\ccPrxy.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="move" [X]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2006-01-13 44544]
c:\documents and settings\dianne\Start Menu\Programs\Startup\
Multiply AutoUploader.lnk - c:\program files\Multiply\AutoUploader\Multiply AutoUploader\Multiply AutoUploader.exe [2008-11-23 95232]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i263_32.drv
"msacm.imc"= imc32.acm
"msacm.l3codecp"= l3codecp.acm
"VIDC.i263"= i263_32.drv
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= c:\\Program Files\\MSN Messenger\\MsnMsgr.Exe
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\dianne\\Templates\\ldup.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\ccPrxy.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\wuauclt.exe"=
"c:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbamgui.exe"=
"c:\\WINDOWS\\system32\\netsh.exe"=
"c:\\Program Files\\BitDefender\\BitDefender 2008\\bdagent.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jusched.exe"=
R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\johogi.sys []
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-Intelligent Copier - c:\program files\Interdesigner Software\Intelligent Copier\IntelligentCopier.exe
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\dianne\Application Data\Mozilla\Firefox\Profiles\5l0ykisn.default\
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\np_gp.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF -: plugin - c:\program files\QuickTime Alternative\Plugins\npqtplugin.dll
FF -: plugin - c:\program files\QuickTime Alternative\Plugins\npqtplugin2.dll
FF -: plugin - c:\program files\QuickTime Alternative\Plugins\npqtplugin3.dll
FF -: plugin - c:\program files\QuickTime Alternative\Plugins\npqtplugin4.dll
FF -: plugin - c:\program files\QuickTime Alternative\Plugins\npqtplugin5.dll
FF -: plugin - c:\program files\QuickTime Alternative\Plugins\npqtplugin6.dll
FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-01 17:27:48
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-12-01 17:32:40
ComboFix-quarantined-files.txt 2008-12-01 17:32:35
ComboFix2.txt 2008-11-23 14:04:46
ComboFix3.txt 2008-11-24 08:16:48
Pre-Run: 4,964,966,400 bytes free
Post-Run: 4,929,835,008 bytes free
297 --- E O F --- 2008-11-23 11:09:00
and, this is the hijackthis.txt:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:37:30 PM, on 12/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\WINDOWS\system32\ccPrxy.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Multiply\AutoUploader\Multiply AutoUploader\Multiply AutoUploader.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\dianne\Desktop\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll (file missing)
O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [ccPrxy.exe] ccPrxy.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O4 - Startup: Multiply AutoUploader.lnk = C:\Program Files\Multiply\AutoUploader\Multiply AutoUploader\Multiply AutoUploader.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
--
End of file - 3994 bytes
uhmm.. sir, i'm just curious.. how did you learn all this =D i'm thinking that i want to learn too.. but maybe i'm too dumb or young for this :(
uhmm.. sir, i'm just curious.. how did you learn all this =D i'm thinking that i want to learn too.. but maybe i'm too dumb or young for this :(
I started exactly like you, I received help on the forums and got interested in helping :)
There are several "schools" on the net that teach you how to do this.
Have a look HERE (http://forums.spybot.info/showthread.php?t=10777) for more info on them
Step 1
Submit a File For Analysis
We need to have the files below Scanned by Uploading them/it to Virus Total
Please visit Virustotal (http://www.virustotal.com/en/indexf.html)
Copy/paste the the following file path into the window
c:\windows\system32\ddnf95.w95
Click Submit/Send File
Please post back, to let me know the results.
If Virustotal is too busy please try Jotti (http://virusscan.jotti.org/)
----------------------------------------------------------- -----------------------------------------------------------
Step 2
Flash Disinfector by sUBs
Please download Flash_Disinfector.exe (http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe) by sUBs and save it to your desktop:
Double-click Flash_Disinfector.exe to run it.
Follow any prompts that may appear.
Wait until the program has finished scanning, then please exit the program.
The tool may ask you to insert your flash drive, or other removable drives. Please do so and allow the tool to clean it up as well.
Please restart your computer.
----------------------------------------------------------- -----------------------------------------------------------
Step 3
Custom CFScript
Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
File::
c:\windows\system32\ccPrxy.exe
c:\windows\keybd.dat
c:\windows\ldup.exe
c:\windows\sy.exe
c:\windows\system32\drivers\johogi.sys
Driver::
abp470n5
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"=-
[-HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[-HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-
"ccPrxy.exe"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"=-
"tscuninstall"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\uTorrent\\uTorrent.exe"=-
"c:\\WINDOWS\\system32\\ccPrxy.exe"=-
ADS::
Save this as CFScript.txt and place it on your desktop.
http://i51.photobucket.com/albums/f387/Katana_1970/CFScriptb.gif
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper
----------------------------------------------------------- -----------------------------------------------------------
Step 4
Kaspersky Online Scanner .
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- This scan is best done from IE (Internet Explorer)
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html
Read the Requirements and limitations before you click Accept.
Once the database has downloaded, click My Computer in the left pane
Now go and put the kettle on !
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.
**Note**
To optimize scanning time and produce a more sensible report for review: Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.
----------------------------------------------------------- -----------------------------------------------------------
Step 5
Logs/Information to Post in Reply
Please post the following logs/Information in your reply
Virus Total Log
Combofix Log
Kaspersky Log
How are things running now ?
sir, the virustotal and jotti site is not loading.. it's on "Loading..." status forever..
Continue with Combofix, and then see if you can do the Kaspersky scan
Still with us drv1022? :)
Archived, thank you katana. :)