View Full Version : Virtumonde persists after Spybot run (Solved)
Hello,
I have run Spybot on my laptop and the Virtumonde trojan persists after multiple attempts to fix.
All help is very much appreciated.
Here is the log from HijackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:52:30 PM, on 11/25/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\SYSTEM32\WISPTIS.EXE
C:\WINDOWS\System32\tabbtnu.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\COMMON~1\AOL\122696~1\EE\AOLHOS~1.EXE
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\PROGRA~1\COMMON~1\AOL\122696~1\EE\AOLServiceHost.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\mozilla.org\SeaMonkey\seamonkey.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe
C:\Program Files\SecureFX\SecureFX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gateway.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {B1629D92-AFE4-4B23-A39D-B092F1D1BCBF} - C:\WINDOWS\system32\ljJAtuVp.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [TabletWizard] C:\WINDOWS\help\SplshWrp.exe
O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" /resume
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1226966200\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [Snippet] "C:\Program Files\Microsoft Experience Pack\Snipping Tool\SnippingTool.exe" /i
O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-19\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'NETWORK SERVICE')
O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: winmqx32 - C:\WINDOWS\SYSTEM32\winmqx32.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
--
Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.
If you think you have similar problems, please post a log in the HJT forum and wait for help.
Hello and welcome to the forums
My name is Katana and I will be helping you to remove any infection(s) that you may have.
Please observe these rules while we work:
Please Read All Instructions Carefully
If you don't understand something, stop and ask! Don't keep going on.
Please do not run any other tools or scans whilst I am helping you
Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)
If you can do those few things, everything should go smoothly http://www.countingcows.de/laechel.gif
Please ensure that any USB/Flash/External drives are connected whilst we are cleaning your machine.
Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe
----------------------------------------------------------------------------------------
REMOVE P2P PROGRAMS
IMPORTANT I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.
BitTorrent DNA
Please read the Guidelines for P2P Programs (http://forums.spybot.info/showpost.php?p=218503&postcount=4) where we explain why it's not a good idea to have them.
Note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected.
The bad guys use P2P filesharing as a major conduit to spread their wares.
Go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red) NOW.
Download and Run RSIT
Please download Random's System Information Tool by random/random from here (http://images.malwareremoval.com/random/RSIT.exe) and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open:
log.txt will be opened maximized.
info.txt will be opened minimized.
Please post the contents of both log.txt and info.txt.
Hi Katana,
I truly appreciate the help you are giving me! Happy Thanksgiving to you.
I have removed BitTorrent.DNA as instructed. I am posting the logs in separate posts, as the character length is exceeded when I attempt to post both logs in one post.
Start of log.txt:
Logfile of random's system information tool 1.04 (written by random/random)
Run by Owner at 2008-11-27 11:16:32
Microsoft Windows XP Professional Service Pack 3
System drive C: has 29 GB (42%) free of 69 GB
Total RAM: 1014 MB (7% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:17:31 AM, on 11/27/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\SYSTEM32\WISPTIS.EXE
C:\WINDOWS\System32\tabbtnu.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\COMMON~1\AOL\122696~1\EE\AOLHOS~1.EXE
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\PROGRA~1\COMMON~1\AOL\122696~1\EE\AOLServiceHost.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\mozilla.org\SeaMonkey\seamonkey.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\SecureFX\SecureFX.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spider.exe
C:\Documents and Settings\Owner.YOUR-449DE6425B\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Owner.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gateway.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {B1629D92-AFE4-4B23-A39D-B092F1D1BCBF} - C:\WINDOWS\system32\ljJAtuVp.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [TabletWizard] C:\WINDOWS\help\SplshWrp.exe
O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" /resume
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1226966200\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [Snippet] "C:\Program Files\Microsoft Experience Pack\Snipping Tool\SnippingTool.exe" /i
O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-19\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'NETWORK SERVICE')
O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: winmqx32 - C:\WINDOWS\SYSTEM32\winmqx32.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
--
End of file - 9575 bytes
log.txt continued:
======Scheduled tasks folder======
C:\WINDOWS\tasks\brxuabev.job
C:\WINDOWS\tasks\ISP signup reminder 3.job
C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - Owner.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
AskBar BHO - C:\Program Files\AskBarDis\bar\bin\askBar.dll [2008-09-29 325000]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll [2007-08-24 316784]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll [2008-11-18 116088]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar1.dll [2008-11-17 720896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B1629D92-AFE4-4B23-A39D-B092F1D1BCBF}]
C:\WINDOWS\system32\ljJAtuVp.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll [2008-11-17 720896]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Show Norton Toolbar - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll [2007-08-24 316784]
{3041d03e-fd4b-44e0-b742-2d9b88305f98} - Ask Toolbar - C:\Program Files\AskBarDis\bar\bin\askBar.dll [2008-09-29 325000]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"TabletWizard"=C:\WINDOWS\help\SplshWrp.exe [2008-04-14 16384]
"TabletTip"=C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe [2008-04-14 271872]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2006-01-12 155648]
"SynTPLpr"=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [2004-11-05 98394]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2004-11-05 688218]
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2004-11-02 32768]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2005-05-13 155648]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2005-05-13 126976]
"HostManager"=C:\Program Files\Common Files\AOL\1226966200\EE\AOLHostManager.exe [2004-11-03 125528]
"Snippet"=C:\Program Files\Microsoft Experience Pack\Snipping Tool\SnippingTool.exe [2005-02-25 68296]
"Reminder"=C:\WINDOWS\Creator\Remind_XP.exe [2005-02-25 966656]
"Recguard"=C:\WINDOWS\SMINST\RECGUARD.EXE [2002-09-14 212992]
""= []
"IntelWireless"=C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe [2004-10-15 385024]
"MSKDetectorExe"=C:\Program Files\McAfee\SpamKiller\MSKDetct.exe [2005-08-12 1121792]
"ccApp"=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2008-10-17 51048]
"osCheck"=C:\Program Files\Norton Internet Security\osCheck.exe [2007-08-25 714608]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2008-11-19 342336]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE
C:\Documents and Settings\Owner.YOUR-449DE6425B\Start Menu\Programs\Startup
Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
OpenOffice.org 3.0.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2005-05-13 348160]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll [2004-10-15 110592]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\loginkey]
C:\Program Files\Common Files\Microsoft Shared\Ink\loginkey.dll [2008-04-14 47104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\TabBtnWL]
C:\WINDOWS\system32\TabBtnWL.dll [2002-08-29 11776]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tpgwlnotify]
C:\WINDOWS\system32\tpgwlnot.dll [2008-04-14 32256]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winmqx32]
C:\WINDOWS\system32\winmqx32.dll [2008-11-20 48640]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B1629D92-AFE4-4B23-A39D-B092F1D1BCBF}"=C:\WINDOWS\system32\ljJAtuVp.dll []
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
C:\WINDOWS\system32\ljJCrOig
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
log.txt continued:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Application Loader"
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL"
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe"="C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL"
"C:\Program Files\America Online 9.0\waol.exe"="C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL"
"C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe"="C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe:*:Enabled:AOLTsMon"
"C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe"="C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe:*:Enabled:AOLTopSpeed"
"C:\Program Files\Common Files\AOL\1226966200\EE\AOLServiceHost.exe"="C:\Program Files\Common Files\AOL\1226966200\EE\AOLServiceHost.exe:*:Enabled:AOL"
"C:\Program Files\Common Files\AOL\System Information\sinf.exe"="C:\Program Files\Common Files\AOL\System Information\sinf.exe:*:Enabled:AOL"
"C:\Program Files\Common Files\AOL\AOL Spyware Protection\AOLSP Scheduler.exe"="C:\Program Files\Common Files\AOL\AOL Spyware Protection\AOLSP Scheduler.exe:*:Enabled:AOL"
"C:\Program Files\Common Files\AOL\AOL Spyware Protection\asp.exe"="C:\Program Files\Common Files\AOL\AOL Spyware Protection\asp.exe:*:Enabled:AOL"
"C:\Program Files\Common Files\AolCoach\en_en\player\AOLNySEV.exe"="C:\Program Files\Common Files\AolCoach\en_en\player\AOLNySEV.exe:*:Enabled:AOL"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
shell\AutoRun\command - F:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d1e5490e-b5ca-11dd-9cd7-0013ceb1e790}]
shell\AutoRun\command - F:\LaunchU3.exe -a
======List of files/folders created in the last 1 months======
2008-11-27 11:16:32 ----D---- C:\rsit
2008-11-25 15:30:47 ----D---- C:\Documents and Settings\All Users\Application Data\GIRDAC
2008-11-25 15:28:16 ----D---- C:\archive
2008-11-25 13:51:32 ----D---- C:\Program Files\Trend Micro
2008-11-23 16:25:52 ----D---- C:\WINDOWS\Minidump
2008-11-23 14:27:41 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\CyberLink
2008-11-23 14:26:33 ----D---- C:\Documents and Settings\All Users\Application Data\CyberLink
2008-11-22 14:09:27 ----D---- C:\VundoFix Backups
2008-11-22 14:09:27 ----A---- C:\VundoFix.txt
2008-11-21 22:57:11 ----A---- C:\WINDOWS\ntbtlog.txt
2008-11-21 22:49:42 ----D---- C:\SDFix
2008-11-20 16:11:13 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\OpenOffice.org
2008-11-20 16:08:06 ----D---- C:\Program Files\JRE
2008-11-20 16:07:56 ----D---- C:\Program Files\OpenOffice.org 3
2008-11-20 16:07:16 ----A---- C:\WINDOWS\system32\javaws.exe
2008-11-20 16:07:16 ----A---- C:\WINDOWS\system32\javaw.exe
2008-11-20 16:07:16 ----A---- C:\WINDOWS\system32\java.exe
2008-11-20 16:06:06 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\Sun
2008-11-20 15:18:37 ----A---- C:\WINDOWS\system32\winmqx32.dll
2008-11-20 13:42:41 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2008-11-20 13:42:36 ----D---- C:\Program Files\Nsasoft
2008-11-19 20:10:31 ----D---- C:\Program Files\DNA
2008-11-19 20:10:31 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\DNA
2008-11-19 20:09:59 ----D---- C:\Program Files\AskBarDis
2008-11-19 19:53:21 ----A---- C:\WINDOWS\system32\23da29a9-.txt
2008-11-19 19:52:52 ----ASH---- C:\WINDOWS\system32\giOrCJjl.ini
2008-11-19 19:45:45 ----A---- C:\WINDOWS\system32\winrge32.dll
2008-11-19 19:45:03 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\WinRAR
2008-11-19 19:44:14 ----D---- C:\Program Files\WinRAR
2008-11-19 19:03:26 ----D---- C:\WINDOWS\system32\appmgmt
2008-11-19 17:10:59 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\VanDyke
2008-11-19 17:09:19 ----D---- C:\Program Files\SecureFX
2008-11-19 14:35:12 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\SmartDraw
2008-11-19 14:34:30 ----D---- C:\ISO9001
2008-11-19 14:33:02 ----D---- C:\J. Vernon McGee
2008-11-19 13:51:21 ----D---- C:\Program Files\SmartDraw 2008
2008-11-19 13:47:05 ----D---- C:\Program Files\Common Files\Adobe AIR
2008-11-19 13:47:04 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\Macromedia
2008-11-19 13:41:56 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\AdobeUM
2008-11-19 13:40:55 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\Adobe
2008-11-19 13:39:07 ----D---- C:\Documents and Settings\All Users\Application Data\WinZip
2008-11-19 13:39:03 ----D---- C:\Program Files\WinZip
2008-11-19 13:37:33 ----D---- C:\WINDOWS\system32\Adobe
2008-11-19 13:34:36 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\Real
2008-11-19 13:30:21 ----D---- C:\AQA
2008-11-19 10:45:38 ----D---- C:\Program Files\Common Files\L&H
2008-11-19 10:44:32 ----D---- C:\Program Files\Microsoft Visual Studio
2008-11-18 18:47:18 ----A---- C:\WINDOWS\SeaMonkeyUninstall.exe
2008-11-18 18:47:08 ----A---- C:\WINDOWS\GREUninstall.exe
2008-11-18 18:47:06 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\Mozilla
2008-11-18 18:46:55 ----D---- C:\Program Files\mozilla.org
2008-11-18 18:46:03 ----D---- C:\Download
2008-11-18 15:13:32 ----D---- C:\WINDOWS\ie7updates
2008-11-18 15:12:47 ----D---- C:\WINDOWS\WBEM
2008-11-18 15:12:18 ----HDC---- C:\WINDOWS\ie7
2008-11-18 15:11:59 ----HDC---- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
2008-11-18 15:11:40 ----HDC---- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
2008-11-18 15:07:37 ----A---- C:\WINDOWS\system32\MRT.exe
2008-11-18 15:07:17 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2008-11-18 13:36:47 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-11-18 13:36:41 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-11-18 13:36:34 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2008-11-18 13:36:27 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-11-18 13:36:20 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$
2008-11-18 13:36:14 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-11-18 13:36:05 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2008-11-18 13:35:57 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-11-18 13:35:50 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2008-11-18 13:35:42 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-11-18 13:35:16 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2008-11-18 13:34:05 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$
2008-11-18 13:33:46 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2008-11-18 13:33:39 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2008-11-18 13:33:32 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-11-18 13:33:25 ----HDC---- C:\WINDOWS\$NtUninstallKB923689$
2008-11-18 13:33:04 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-11-18 13:32:58 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2008-11-18 13:32:52 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2008-11-18 13:32:46 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-11-18 13:32:40 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-11-18 13:32:33 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2008-11-18 13:32:20 ----HDC---- C:\WINDOWS\$NtUninstallKB956390$
2008-11-18 13:32:07 ----D---- C:\Program Files\MSXML 4.0
2008-11-18 13:31:46 ----HDC---- C:\WINDOWS\$NtUninstallKB936782_WMP10$
2008-11-18 13:29:23 ----D---- C:\Program Files\Agilix
2008-11-18 13:20:08 ----A---- C:\WINDOWS\msoffice.ini
2008-11-18 12:12:34 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\Symantec
2008-11-18 12:04:44 ----D---- C:\WINDOWS\system32\PreInstall
2008-11-18 12:04:39 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2008-11-18 12:03:51 ----D---- C:\Program Files\Windows Sidebar
2008-11-18 12:01:01 ----D---- C:\Program Files\Norton Internet Security
2008-11-18 11:57:28 ----A---- C:\WINDOWS\system32\S32EVNT1.DLL
2008-11-18 11:57:04 ----D---- C:\Program Files\Symantec
2008-11-18 11:57:04 ----D---- C:\Documents and Settings\All Users\Application Data\Symantec
2008-11-18 11:56:09 ----D---- C:\Program Files\Common Files\Symantec Shared
2008-11-18 11:54:11 ----A---- C:\WINDOWS\system32\TwnLib4.dll
2008-11-18 11:47:58 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-11-18 11:47:58 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-18 10:42:41 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\McAfee.com Personal Firewall
2008-11-18 10:40:24 ----D---- C:\WINDOWS\Prefetch
2008-11-17 19:21:30 ----A---- C:\WINDOWS\system32\igfxres.dll
2008-11-17 19:20:56 ----ASH---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\desktop.ini
2008-11-17 19:20:55 ----SD---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\Microsoft
2008-11-17 19:20:55 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\You've Got Pictures Screensaver
2008-11-17 19:20:55 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\SampleView
2008-11-17 19:20:55 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\Intel
2008-11-17 19:20:55 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\Identities
2008-11-17 19:20:55 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\AOL
2008-11-17 19:14:02 ----SHD---- C:\RECYCLER
2008-11-17 19:09:17 ----A---- C:\WINDOWS\system32\xpsp3res.dll
2008-11-17 19:05:14 ----A---- C:\WINDOWS\system32\spmsg.dll
2008-11-17 19:05:10 ----HD---- C:\WINDOWS\$hf_mig$
2008-11-17 19:04:53 ----D---- C:\Program Files\McAfee
2008-11-17 19:04:53 ----D---- C:\Documents and Settings\All Users\Application Data\McAfee
2008-11-17 19:04:42 ----D---- C:\Documents and Settings\All Users\Application Data\McAfee.com Personal Firewall
2008-11-17 19:04:20 ----D---- C:\Documents and Settings\All Users\Application Data\McAfee.com
2008-11-17 19:03:43 ----A---- C:\WINDOWS\system32\results.txt
2008-11-17 19:03:28 ----D---- C:\Documents and Settings\All Users\Application Data\Intel
2008-11-17 19:02:59 ----A---- C:\WINDOWS\system32\W29MLRES.DLL
2008-11-17 19:02:35 ----A---- C:\WINDOWS\system32\wmpns.dll
2008-11-17 19:01:45 ----A---- C:\WINDOWS\POWERCFG.EXE
2008-11-17 19:01:33 ----D---- C:\Documents and Settings\All Users\Application Data\Agilix GoBinder
2008-11-17 19:01:28 ----RA---- C:\WINDOWS\system32\GBInf.dll
2008-11-17 19:01:16 ----D---- C:\Documents and Settings\All Users\Application Data\Agilix
2008-11-17 19:01:06 ----D---- C:\WINDOWS\Downloaded Installations
2008-11-17 19:00:58 ----A---- C:\WINDOWS\system32\OneNotemon.dll
2008-11-17 19:00:50 ----D---- C:\Program Files\Microsoft Education Pack
2008-11-17 18:59:28 ----D---- C:\Program Files\Microsoft Experience Pack
2008-11-17 18:59:02 ----D---- C:\Program Files\Microsoft Money 2005
2008-11-17 18:58:55 ----RA---- C:\WINDOWS\system32\PUBOLE32.DLL
2008-11-17 18:58:55 ----RA---- C:\WINDOWS\system32\ochlp30e.dll
2008-11-17 18:58:55 ----RA---- C:\WINDOWS\system32\msvcr70.dll
2008-11-17 18:58:55 ----RA---- C:\WINDOWS\system32\msvcp70.dll
2008-11-17 18:58:55 ----RA---- C:\WINDOWS\system32\msvci70.dll
2008-11-17 18:58:55 ----RA---- C:\WINDOWS\system32\mfcuia32.dll
2008-11-17 18:58:55 ----A---- C:\WINDOWS\system32\msxml4r.dll
2008-11-17 18:58:54 ----RA---- C:\WINDOWS\system32\mfcans32.dll
2008-11-17 18:58:54 ----RA---- C:\WINDOWS\system32\Ltwvc11n.dll
2008-11-17 18:58:54 ----RA---- C:\WINDOWS\system32\ltfil11n.DLL
2008-11-17 18:58:54 ----RA---- C:\WINDOWS\system32\Lfpng11n.dll
2008-11-17 18:58:54 ----RA---- C:\WINDOWS\system32\lfgif11n.dll
2008-11-17 18:58:54 ----RA---- C:\WINDOWS\system32\hlp95en.dll
2008-11-17 18:58:54 ----A---- C:\WINDOWS\system32\LTKRN11N.DLL
2008-11-17 18:58:54 ----A---- C:\WINDOWS\system32\LTIMG11N.DLL
2008-11-17 18:58:54 ----A---- C:\WINDOWS\system32\LTDIS11n.dll
2008-11-17 18:58:54 ----A---- C:\WINDOWS\system32\LFWMF11N.DLL
2008-11-17 18:58:54 ----A---- C:\WINDOWS\system32\LFTIF11N.DLL
2008-11-17 18:58:54 ----A---- C:\WINDOWS\system32\LFTGA11N.DLL
2008-11-17 18:58:54 ----A---- C:\WINDOWS\system32\LFPSD11N.DLL
2008-11-17 18:58:54 ----A---- C:\WINDOWS\system32\LFPCX11N.DLL
2008-11-17 18:58:54 ----A---- C:\WINDOWS\system32\LFPCD11N.DLL
2008-11-17 18:58:54 ----A---- C:\WINDOWS\system32\LFFAX11N.DLL
2008-11-17 18:58:54 ----A---- C:\WINDOWS\system32\LFEPS11N.DLL
2008-11-17 18:58:54 ----A---- C:\WINDOWS\system32\LFCMP11n.DLL
2008-11-17 18:58:54 ----A---- C:\WINDOWS\system32\LFBMP11N.DLL
2008-11-17 18:58:32 ----D---- C:\Program Files\Microsoft Works
2008-11-17 18:58:25 ----D---- C:\Program Files\MSN Encarta Plus
2008-11-17 18:58:12 ----D---- C:\WINDOWS\tiinst
2008-11-17 18:57:48 ----D---- C:\Program Files\Common Files\Nullsoft
2008-11-17 18:57:37 ----A---- C:\WINDOWS\unvise32qt.exe
2008-11-17 18:57:32 ----D---- C:\WINDOWS\system32\QuickTime
2008-11-17 18:57:32 ----D---- C:\Program Files\QuickTime
2008-11-17 18:57:32 ----D---- C:\Documents and Settings\All Users\Application Data\QuickTime
2008-11-17 18:57:28 ----D---- C:\My Music
2008-11-17 18:57:25 ----A---- C:\WINDOWS\system32\rmoc3260.dll
2008-11-17 18:57:24 ----D---- C:\Program Files\Real
2008-11-17 18:57:24 ----D---- C:\Program Files\Common Files\Real
2008-11-17 18:57:24 ----A---- C:\WINDOWS\system32\pndx5032.dll
2008-11-17 18:57:24 ----A---- C:\WINDOWS\system32\pndx5016.dll
2008-11-17 18:57:24 ----A---- C:\WINDOWS\system32\pncrt.dll
2008-11-17 18:57:10 ----A---- C:\WINDOWS\system32\SimpleRegistry.dll
2008-11-17 18:57:10 ----A---- C:\WINDOWS\system32\aamd532.dll
2008-11-17 18:57:07 ----D---- C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-11-17 18:57:06 ----D---- C:\Program Files\Viewpoint
2008-11-17 18:57:05 ----D---- C:\Documents and Settings\All Users\Application Data\Pure Networks
2008-11-17 18:57:03 ----D---- C:\Program Files\Pure Networks
2008-11-17 18:56:38 ----D---- C:\Documents and Settings\All Users\Application Data\AOL
2008-11-17 18:56:32 ----D---- C:\Program Files\Common Files\AOL
2008-11-17 18:56:24 ----D---- C:\Program Files\Common Files\Roxio Shared
2008-11-17 18:56:18 ----D---- C:\Documents and Settings\All Users\Application Data\Napster
2008-11-17 18:56:13 ----D---- C:\Program Files\Napster
2008-11-17 18:56:01 ----D---- C:\ses2_client_bin_2_8_13g
2008-11-17 18:55:23 ----D---- C:\Program Files\Microsoft Digital Image 2006
2008-11-17 18:55:18 ----RA---- C:\WINDOWS\system32\atl71.dll
2008-11-17 18:55:18 ----D---- C:\Program Files\Common Files\Adobe
2008-11-17 18:55:02 ----D---- C:\Program Files\Adobe
2008-11-17 18:55:02 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2008-11-17 18:51:24 ----D---- C:\Program Files\Intel
2008-11-17 18:50:23 ----D---- C:\Program Files\Java
2008-11-17 18:50:23 ----D---- C:\Program Files\Common Files\Java
2008-11-17 18:50:15 ----HD---- C:\Program Files\InstallShield Installation Information
2008-11-17 18:50:10 ----D---- C:\Program Files\CyberLink
2008-11-17 18:50:06 ----A---- C:\WINDOWS\wallpg.exe
2008-11-17 18:49:55 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-11-17 18:49:50 ----A---- C:\WINDOWS\system32\SynTPFcs.dll
2008-11-17 18:49:49 ----D---- C:\Program Files\Synaptics
2008-11-17 18:49:49 ----A---- C:\WINDOWS\system32\SynTPCo2.dll
2008-11-17 18:49:49 ----A---- C:\WINDOWS\system32\SynTPAPI.dll
2008-11-17 18:49:49 ----A---- C:\WINDOWS\system32\SynCtrl.dll
2008-11-17 18:49:49 ----A---- C:\WINDOWS\system32\SynCOM.dll
2008-11-17 18:49:46 ----D---- C:\Program Files\Common Files\InstallShield
2008-11-17 18:48:04 ----A---- C:\WINDOWS\ODBC.INI
2008-11-17 18:48:00 ----A---- C:\WINDOWS\system32\mdimon.dll
2008-11-17 18:47:42 ----D---- C:\Program Files\Microsoft ActiveSync
2008-11-17 18:47:40 ----D---- C:\Program Files\Common Files\DESIGNER
2008-11-17 18:47:18 ----D---- C:\Program Files\Microsoft.NET
2008-11-17 18:47:17 ----D---- C:\Program Files\Microsoft Office
2008-11-17 18:46:56 ----RHD---- C:\MSOCache
2008-11-17 18:46:53 ----D---- C:\Program Files\Google
2008-11-17 18:46:36 ----D---- C:\Program Files\BigFix
2008-11-17 18:46:36 ----A---- C:\WINDOWS\BigFixClientOverride.dll
2008-11-17 18:46:20 ----N---- C:\WINDOWS\UNNeroBurnRights.exe
2008-11-17 18:46:20 ----A---- C:\WINDOWS\system32\NeroCo.dll
2008-11-17 18:45:42 ----A---- C:\WINDOWS\system32\TwnLib20.dll
2008-11-17 18:45:40 ----A---- C:\WINDOWS\system32\ImagXRA7.dll
2008-11-17 18:45:40 ----A---- C:\WINDOWS\system32\ImagXR7.dll
2008-11-17 18:45:40 ----A---- C:\WINDOWS\system32\ImagXpr7.dll
2008-11-17 18:45:39 ----A---- C:\WINDOWS\system32\NeroCheck.exe
2008-11-17 18:45:39 ----A---- C:\WINDOWS\system32\ImagX7.dll
2008-11-17 18:45:38 ----D---- C:\Program Files\Common Files\Ahead
2008-11-17 18:45:37 ----D---- C:\Program Files\Ahead
2008-11-17 18:45:23 ----D---- C:\Program Files\Common Files\New Boundary
2008-11-17 18:45:23 ----D---- C:\Documents and Settings\All Users\Application Data\Prism Deploy
2008-11-17 18:45:23 ----A---- C:\WINDOWS\system32\Marker32.exe
2008-11-17 18:44:27 ----D---- C:\Program Files\CONEXANT
2008-11-17 18:44:26 ----A---- C:\WINDOWS\system32\ksuser.dll
2008-11-17 18:43:13 ----SHD---- C:\System Volume Information
2008-11-17 18:41:03 ----D---- C:\WINDOWS\creator
2008-11-17 18:40:00 ----A---- C:\WINDOWS\system32\taboem.dll
2008-11-17 18:40:00 ----A---- C:\WINDOWS\system32\mdmxsdk.dll
2008-11-17 18:40:00 ----A---- C:\WINDOWS\system32\hsfci014.dll
2008-11-17 18:40:00 ----A---- C:\WINDOWS\system32\FpWinTab.dll
2008-11-17 18:40:00 ----A---- C:\WINDOWS\system32\FpHidSrv.exe
2008-11-17 18:40:00 ----A---- C:\WINDOWS\system32\FpHidCal.exe
2008-11-17 18:40:00 ----A---- C:\WINDOWS\system32\FpCoIns2.dll
2008-11-17 18:40:00 ----A---- C:\WINDOWS\system32\FpCoIns1.dll
2008-11-17 18:40:00 ----A---- C:\WINDOWS\system32\CAUDINST.dll
2008-11-17 18:39:57 ----D---- C:\WINDOWS\SMINST
2008-11-17 18:39:53 ----D---- C:\WINDOWS\I386
2008-11-17 18:39:42 ----A---- C:\WINDOWS\system32\wzcsvc.dll
2008-11-17 18:39:42 ----A---- C:\WINDOWS\system32\wzcsapi.dll
2008-11-17 18:39:38 ----A---- C:\WINDOWS\system32\wowfaxui.dll
2008-11-17 18:39:34 ----A---- C:\WINDOWS\system32\wowfax.dll
2008-11-17 18:39:25 ----A---- C:\WINDOWS\system32\usrvpa.dll
2008-11-17 18:39:21 ----A---- C:\WINDOWS\system32\usrvoica.dll
2008-11-17 18:39:18 ----A---- C:\WINDOWS\system32\usrv80a.dll
2008-11-17 18:39:14 ----A---- C:\WINDOWS\system32\usrv42a.dll
2008-11-17 18:39:10 ----A---- C:\WINDOWS\system32\usrsvpia.dll
2008-11-17 18:39:06 ----A---- C:\WINDOWS\system32\usrshuta.exe
2008-11-17 18:39:03 ----A---- C:\WINDOWS\system32\usrsdpia.dll
2008-11-17 18:38:59 ----A---- C:\WINDOWS\system32\usrrtosa.dll
2008-11-17 18:38:55 ----A---- C:\WINDOWS\system32\usrprbda.exe
2008-11-17 18:38:52 ----A---- C:\WINDOWS\system32\usrmlnka.exe
2008-11-17 18:38:48 ----A---- C:\WINDOWS\system32\usrlbva.dll
2008-11-17 18:38:44 ----A---- C:\WINDOWS\system32\usrfaxa.dll
2008-11-17 18:38:41 ----A---- C:\WINDOWS\system32\usrdtea.dll
2008-11-17 18:38:37 ----A---- C:\WINDOWS\system32\usrdpa.dll
2008-11-17 18:38:33 ----A---- C:\WINDOWS\system32\usrcoina.dll
2008-11-17 18:38:30 ----A---- C:\WINDOWS\system32\usrcntra.dll
2008-11-17 18:38:29 ----A---- C:\WINDOWS\system32\usbui.dll
2008-11-17 18:38:25 ----A---- C:\WINDOWS\system32\tsbyuv.dll
2008-11-17 18:38:21 ----A---- C:\WINDOWS\system32\streamci.dll
2008-11-17 18:38:21 ----A---- C:\WINDOWS\system32\storprop.dll
2008-11-17 18:38:17 ----A---- C:\WINDOWS\system32\sprio800.dll
2008-11-17 18:38:14 ----A---- C:\WINDOWS\system32\sprio600.dll
2008-11-17 18:38:08 ----A---- C:\WINDOWS\system32\spnike.dll
2008-11-17 18:38:03 ----A---- C:\WINDOWS\system32\pjlmon.dll
2008-11-17 18:38:03 ----A---- C:\WINDOWS\system32\pid.dll
2008-11-17 18:38:00 ----A---- C:\WINDOWS\system32\paqsp.dll
2008-11-17 18:37:54 ----A---- C:\WINDOWS\system32\ntkrnlpa.exe
2008-11-17 18:37:49 ----A---- C:\WINDOWS\system32\msyuv.dll
2008-11-17 18:37:42 ----A---- C:\WINDOWS\system32\mdwmdmsp.dll
2008-11-17 18:37:40 ----A---- C:\WINDOWS\system32\iyuv_32.dll
2008-11-17 18:37:38 ----A---- C:\WINDOWS\system32\hid.dll
2008-11-17 18:37:36 ----A---- C:\WINDOWS\system32\dvdplay.exe
2008-11-17 18:36:48 ----A---- C:\WINDOWS\system32\dmutil.dll
2008-11-17 18:36:42 ----A---- C:\WINDOWS\system32\cnbjmon.dll
2008-11-17 18:25:54 ----A---- C:\WINDOWS\system32\zipfldr.dll
2008-11-17 18:25:51 ----A---- C:\WINDOWS\system32\xpsp2res.dll
2008-11-17 18:25:51 ----A---- C:\WINDOWS\system32\xpsp1res.dll
2008-11-17 18:25:51 ----A---- C:\WINDOWS\system32\xpob2res.dll
2008-11-17 18:25:50 ----A---- C:\WINDOWS\system32\xolehlp.dll
2008-11-17 18:25:50 ----A---- C:\WINDOWS\system32\xmlprovi.dll
2008-11-17 18:25:50 ----A---- C:\WINDOWS\system32\xmlprov.dll
2008-11-17 18:25:50 ----A---- C:\WINDOWS\system32\xenroll.dll
2008-11-17 18:25:50 ----A---- C:\WINDOWS\system32\xcopy.exe
2008-11-17 18:25:50 ----A---- C:\WINDOWS\system32\xactsrv.dll
2008-11-17 18:25:50 ----A---- C:\WINDOWS\system32\wzcdlg.dll
2008-11-17 18:25:50 ----A---- C:\WINDOWS\system32\wuweb.dll
2008-11-17 18:25:50 ----A---- C:\WINDOWS\system32\wups.dll
2008-11-17 18:25:50 ----A---- C:\WINDOWS\system32\wupdmgr.exe
2008-11-17 18:25:50 ----A---- C:\WINDOWS\system32\wucltui.dll
2008-11-17 18:25:49 ----A---- C:\WINDOWS\system32\wuauserv.dll
2008-11-17 18:25:49 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2008-11-17 18:25:49 ----A---- C:\WINDOWS\system32\wuaueng.dll
2008-11-17 18:25:49 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2008-11-17 18:25:49 ----A---- C:\WINDOWS\system32\wuauclt.exe
2008-11-17 18:25:49 ----A---- C:\WINDOWS\system32\wuapi.dll
2008-11-17 18:25:49 ----A---- C:\WINDOWS\system32\wtsapi32.dll
2008-11-17 18:25:49 ----A---- C:\WINDOWS\system32\wstdecod.dll
2008-11-17 18:25:49 ----A---- C:\WINDOWS\system32\wsock32.dll
2008-11-17 18:25:49 ----A---- C:\WINDOWS\system32\wsnmp32.dll
2008-11-17 18:25:49 ----A---- C:\WINDOWS\system32\wshtcpip.dll
2008-11-17 18:25:49 ----A---- C:\WINDOWS\system32\wshrm.dll
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\wshnetbs.dll
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\wshisn.dll
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\wship6.dll
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\wshext.dll
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\wshcon.dll
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\wshbth.dll
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\wshatm.dll
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\wsecedit.dll
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\wscsvc.dll
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\wscript.exe
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\wscntfy.exe
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\ws2help.dll
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\ws2_32.dll
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\write.exe
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\wpnpinst.exe
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\wpabaln.exe
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\wowexec.exe
2008-11-17 18:25:48 ----A---- C:\WINDOWS\system32\wowdeb.exe
2008-11-17 18:25:47 ----A---- C:\WINDOWS\system32\wow32.dll
2008-11-17 18:25:46 ----A---- C:\WINDOWS\system32\wmstream.dll
2008-11-17 18:25:45 ----A---- C:\WINDOWS\system32\wmsdmoe.dll
2008-11-17 18:25:40 ----A---- C:\WINDOWS\system32\wmiscmgr.dll
2008-11-17 18:25:40 ----A---- C:\WINDOWS\system32\wmiprop.dll
2008-11-17 18:25:40 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2008-11-17 18:25:39 ----A---- C:\WINDOWS\system32\wmi.dll
2008-11-17 18:25:39 ----A---- C:\WINDOWS\system32\wmerrenu.dll
2008-11-17 18:25:38 ----A---- C:\WINDOWS\system32\wlnotify.dll
2008-11-17 18:25:38 ----A---- C:\WINDOWS\system32\wldap32.dll
2008-11-17 18:25:38 ----A---- C:\WINDOWS\system32\wkssvc.dll
2008-11-17 18:25:38 ----A---- C:\WINDOWS\system32\winver.exe
2008-11-17 18:25:38 ----A---- C:\WINDOWS\system32\wintrust.dll
2008-11-17 18:25:38 ----A---- C:\WINDOWS\system32\winstrm.dll
2008-11-17 18:25:38 ----A---- C:\WINDOWS\system32\winsta.dll
2008-11-17 18:25:38 ----A---- C:\WINDOWS\system32\winsrv.dll
2008-11-17 18:25:38 ----A---- C:\WINDOWS\system32\winspool.exe
2008-11-17 18:25:38 ----A---- C:\WINDOWS\system32\winsock.dll
2008-11-17 18:25:38 ----A---- C:\WINDOWS\system32\winshfhc.dll
2008-11-17 18:25:38 ----A---- C:\WINDOWS\system32\winscard.dll
2008-11-17 18:25:38 ----A---- C:\WINDOWS\system32\winrnr.dll
2008-11-17 18:25:37 ----A---- C:\WINDOWS\system32\winntbbu.dll
2008-11-17 18:25:35 ----A---- C:\WINDOWS\system32\winnls.dll
2008-11-17 18:25:35 ----A---- C:\WINDOWS\system32\winmsd.exe
2008-11-17 18:25:35 ----A---- C:\WINDOWS\system32\winmm.dll
2008-11-17 18:25:35 ----A---- C:\WINDOWS\system32\winmine.exe
2008-11-17 18:25:35 ----A---- C:\WINDOWS\system32\winlogon.exe
2008-11-17 18:25:35 ----A---- C:\WINDOWS\system32\winipsec.dll
2008-11-17 18:25:35 ----A---- C:\WINDOWS\system32\wininet.dll
2008-11-17 18:25:34 ----A---- C:\WINDOWS\winhlp32.exe
2008-11-17 18:25:34 ----A---- C:\WINDOWS\winhelp.exe
2008-11-17 18:25:34 ----A---- C:\WINDOWS\system32\winhttp.dll
2008-11-17 18:25:34 ----A---- C:\WINDOWS\system32\winhlp32.exe
2008-11-17 18:25:34 ----A---- C:\WINDOWS\system32\winfax.dll
2008-11-17 18:25:33 ----A---- C:\WINDOWS\system32\winchat.exe
2008-11-17 18:25:33 ----A---- C:\WINDOWS\system32\winbrand.dll
2008-11-17 18:25:33 ----A---- C:\WINDOWS\system32\win87em.dll
2008-11-17 18:25:33 ----A---- C:\WINDOWS\system32\win32spl.dll
2008-11-17 18:25:32 ----A---- C:\WINDOWS\system32\win.com
2008-11-17 18:25:32 ----A---- C:\WINDOWS\system32\wifeman.dll
2008-11-17 18:25:32 ----A---- C:\WINDOWS\system32\wiavusd.dll
2008-11-17 18:25:32 ----A---- C:\WINDOWS\system32\wiavideo.dll
2008-11-17 18:25:32 ----A---- C:\WINDOWS\system32\wiashext.dll
2008-11-17 18:25:32 ----A---- C:\WINDOWS\system32\wiaservc.dll
2008-11-17 18:25:32 ----A---- C:\WINDOWS\system32\wiascr.dll
2008-11-17 18:25:32 ----A---- C:\WINDOWS\system32\wiadss.dll
2008-11-17 18:25:31 ----A---- C:\WINDOWS\system32\wiadefui.dll
2008-11-17 18:25:31 ----A---- C:\WINDOWS\system32\wiaacmgr.exe
2008-11-17 18:25:31 ----A---- C:\WINDOWS\system32\wextract.exe
2008-11-17 18:25:31 ----A---- C:\WINDOWS\system32\webvw.dll
2008-11-17 18:25:31 ----A---- C:\WINDOWS\system32\webhits.dll
2008-11-17 18:25:30 ----A---- C:\WINDOWS\system32\webclnt.dll
2008-11-17 18:25:30 ----A---- C:\WINDOWS\system32\webcheck.dll
2008-11-17 18:25:30 ----A---- C:\WINDOWS\system32\wdigest.dll
2008-11-17 18:25:27 ----A---- C:\WINDOWS\system32\wavemsp.dll
2008-11-17 18:25:26 ----A---- C:\WINDOWS\system32\w3ssl.dll
2008-11-17 18:25:26 ----A---- C:\WINDOWS\system32\w32topl.dll
2008-11-17 18:25:26 ----A---- C:\WINDOWS\system32\w32tm.exe
2008-11-17 18:25:26 ----A---- C:\WINDOWS\system32\w32time.dll
2008-11-17 18:25:26 ----A---- C:\WINDOWS\system32\vwipxspx.exe
2008-11-17 18:25:26 ----A---- C:\WINDOWS\system32\vwipxspx.dll
2008-11-17 18:25:26 ----A---- C:\WINDOWS\system32\vssvc.exe
2008-11-17 18:25:26 ----A---- C:\WINDOWS\system32\vss_ps.dll
2008-11-17 18:25:25 ----A---- C:\WINDOWS\vmmreg32.dll
2008-11-17 18:25:25 ----A---- C:\WINDOWS\system32\vssapi.dll
2008-11-17 18:25:25 ----A---- C:\WINDOWS\system32\vssadmin.exe
2008-11-17 18:25:25 ----A---- C:\WINDOWS\system32\vjoy.dll
2008-11-17 18:25:25 ----A---- C:\WINDOWS\system32\vga64k.dll
2008-11-17 18:25:24 ----A---- C:\WINDOWS\system32\vga256.dll
2008-11-17 18:25:24 ----A---- C:\WINDOWS\system32\vga.dll
2008-11-17 18:25:24 ----A---- C:\WINDOWS\system32\vfpodbc.dll
2008-11-17 18:25:24 ----A---- C:\WINDOWS\system32\version.dll
2008-11-17 18:25:24 ----A---- C:\WINDOWS\system32\verifier.exe
2008-11-17 18:25:24 ----A---- C:\WINDOWS\system32\verifier.dll
2008-11-17 18:25:24 ----A---- C:\WINDOWS\system32\ver.dll
2008-11-17 18:25:24 ----A---- C:\WINDOWS\system32\vdmredir.dll
2008-11-17 18:25:24 ----A---- C:\WINDOWS\system32\vdmdbg.dll
2008-11-17 18:25:24 ----A---- C:\WINDOWS\system32\vcdex.dll
2008-11-17 18:25:24 ----A---- C:\WINDOWS\system32\vbscript.dll
2008-11-17 18:25:24 ----A---- C:\WINDOWS\system32\vbajet32.dll
2008-11-17 18:25:24 ----A---- C:\WINDOWS\system32\uxtheme.dll
2008-11-17 18:25:23 ----A---- C:\WINDOWS\system32\utilman.exe
2008-11-17 18:25:23 ----A---- C:\WINDOWS\system32\utildll.dll
2008-11-17 18:25:23 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2008-11-17 18:25:23 ----A---- C:\WINDOWS\system32\usp10.dll
2008-11-17 18:25:23 ----A---- C:\WINDOWS\system32\userinit.exe
2008-11-17 18:25:23 ----A---- C:\WINDOWS\system32\userenv.dll
2008-11-17 18:25:22 ----A---- C:\WINDOWS\system32\user32.dll
2008-11-17 18:25:22 ----A---- C:\WINDOWS\system32\user.exe
2008-11-17 18:25:22 ----A---- C:\WINDOWS\system32\usbmon.dll
2008-11-17 18:25:22 ----A---- C:\WINDOWS\system32\urlmon.dll
2008-11-17 18:25:22 ----A---- C:\WINDOWS\system32\url.dll
2008-11-17 18:25:22 ----A---- C:\WINDOWS\system32\ureg.dll
2008-11-17 18:25:22 ----A---- C:\WINDOWS\system32\ups.exe
2008-11-17 18:25:22 ----A---- C:\WINDOWS\system32\upnpui.dll
2008-11-17 18:25:22 ----A---- C:\WINDOWS\system32\upnphost.dll
2008-11-17 18:25:22 ----A---- C:\WINDOWS\system32\upnpcont.exe
2008-11-17 18:25:22 ----A---- C:\WINDOWS\system32\upnp.dll
2008-11-17 18:25:21 ----A---- C:\WINDOWS\system32\untfs.dll
2008-11-17 18:25:20 ----A---- C:\WINDOWS\system32\unlodctr.exe
2008-11-17 18:25:20 ----A---- C:\WINDOWS\system32\uniplat.dll
2008-11-17 18:25:20 ----A---- C:\WINDOWS\system32\unimdmat.dll
2008-11-17 18:25:20 ----A---- C:\WINDOWS\system32\umpnpmgr.dll
2008-11-17 18:25:20 ----A---- C:\WINDOWS\system32\umdmxfrm.dll
2008-11-17 18:25:20 ----A---- C:\WINDOWS\system32\umandlg.dll
2008-11-17 18:25:20 ----A---- C:\WINDOWS\system32\ulib.dll
2008-11-17 18:25:20 ----A---- C:\WINDOWS\system32\ufat.dll
2008-11-17 18:25:20 ----A---- C:\WINDOWS\system32\udhisapi.dll
2008-11-17 18:25:20 ----A---- C:\WINDOWS\system32\typeperf.exe
2008-11-17 18:25:20 ----A---- C:\WINDOWS\system32\typelib.dll
2008-11-17 18:25:19 ----A---- C:\WINDOWS\twunk_32.exe
2008-11-17 18:25:19 ----A---- C:\WINDOWS\twunk_16.exe
2008-11-17 18:25:19 ----A---- C:\WINDOWS\twain_32.dll
2008-11-17 18:25:19 ----A---- C:\WINDOWS\twain.dll
2008-11-17 18:25:19 ----A---- C:\WINDOWS\system32\txflog.dll
2008-11-17 18:25:19 ----A---- C:\WINDOWS\system32\twext.dll
2008-11-17 18:25:19 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2008-11-17 18:25:19 ----A---- C:\WINDOWS\system32\tslabels.ini
2008-11-17 18:25:19 ----A---- C:\WINDOWS\system32\tskill.exe
2008-11-17 18:25:18 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2008-11-17 18:25:18 ----A---- C:\WINDOWS\system32\tsddd.dll
2008-11-17 18:25:18 ----A---- C:\WINDOWS\system32\tsd32.dll
2008-11-17 18:25:18 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2008-11-17 18:25:18 ----A---- C:\WINDOWS\system32\tscon.exe
2008-11-17 18:25:18 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2008-11-17 18:25:18 ----A---- C:\WINDOWS\system32\tsappcmp.dll
2008-11-17 18:25:18 ----A---- C:\WINDOWS\system32\trkwks.dll
2008-11-17 18:25:18 ----A---- C:\WINDOWS\system32\tree.com
2008-11-17 18:25:18 ----A---- C:\WINDOWS\system32\traffic.dll
2008-11-17 18:25:18 ----A---- C:\WINDOWS\system32\tracert6.exe
2008-11-17 18:25:18 ----A---- C:\WINDOWS\system32\tracert.exe
2008-11-17 18:25:18 ----A---- C:\WINDOWS\system32\tracerpt.exe
2008-11-17 18:25:16 ----A---- C:\WINDOWS\system32\tourstart.exe
2008-11-17 18:25:16 ----A---- C:\WINDOWS\system32\toolhelp.dll
2008-11-17 18:25:16 ----A---- C:\WINDOWS\system32\tlntsvrp.dll
2008-11-17 18:25:15 ----A---- C:\WINDOWS\system32\tlntsvr.exe
2008-11-17 18:25:15 ----A---- C:\WINDOWS\system32\tlntsess.exe
2008-11-17 18:25:15 ----A---- C:\WINDOWS\system32\tlntadmn.exe
2008-11-17 18:25:13 ----A---- C:\WINDOWS\system32\themeui.dll
2008-11-17 18:25:13 ----A---- C:\WINDOWS\system32\tftp.exe
2008-11-17 18:25:13 ----A---- C:\WINDOWS\system32\termsrv.dll
2008-11-17 18:25:13 ----A---- C:\WINDOWS\system32\termmgr.dll
2008-11-17 18:25:13 ----A---- C:\WINDOWS\system32\telnet.exe
2008-11-17 18:25:13 ----A---- C:\WINDOWS\system32\tcpsvcs.exe
2008-11-17 18:25:13 ----A---- C:\WINDOWS\system32\tcpmonui.dll
2008-11-17 18:25:13 ----A---- C:\WINDOWS\system32\tcpmon.ini
2008-11-17 18:25:13 ----A---- C:\WINDOWS\system32\tcpmon.dll
2008-11-17 18:25:13 ----A---- C:\WINDOWS\system32\tcpmib.dll
2008-11-17 18:25:12 ----A---- C:\WINDOWS\TASKMAN.EXE
2008-11-17 18:25:12 ----A---- C:\WINDOWS\system32\tcmsetup.exe
2008-11-17 18:25:12 ----A---- C:\WINDOWS\system32\taskmgr.exe
2008-11-17 18:25:12 ----A---- C:\WINDOWS\system32\taskman.exe
2008-11-17 18:25:12 ----A---- C:\WINDOWS\system32\tasklist.exe
2008-11-17 18:25:12 ----A---- C:\WINDOWS\system32\taskkill.exe
2008-11-17 18:25:12 ----A---- C:\WINDOWS\system32\tapiui.dll
2008-11-17 18:25:12 ----A---- C:\WINDOWS\system32\tapisrv.dll
2008-11-17 18:25:12 ----A---- C:\WINDOWS\system32\tapiperf.dll
2008-11-17 18:25:12 ----A---- C:\WINDOWS\system32\tapi32.dll
2008-11-17 18:25:12 ----A---- C:\WINDOWS\system32\tapi3.dll
2008-11-17 18:25:12 ----A---- C:\WINDOWS\system32\tapi.dll
2008-11-17 18:25:11 ----A---- C:\WINDOWS\system32\t2embed.dll
2008-11-17 18:25:11 ----A---- C:\WINDOWS\system32\systray.exe
2008-11-17 18:25:10 ----A---- C:\WINDOWS\system32\systeminfo.exe
2008-11-17 18:25:10 ----A---- C:\WINDOWS\system32\syssetup.dll
2008-11-17 18:25:10 ----A---- C:\WINDOWS\system32\sysocmgr.exe
2008-11-17 18:25:10 ----A---- C:\WINDOWS\system32\syskey.exe
2008-11-17 18:25:10 ----A---- C:\WINDOWS\system32\sysinv.dll
2008-11-17 18:25:10 ----A---- C:\WINDOWS\system32\sysedit.exe
2008-11-17 18:25:09 ----A---- C:\WINDOWS\system32\syncui.dll
2008-11-17 18:25:09 ----A---- C:\WINDOWS\system32\synceng.dll
2008-11-17 18:25:09 ----A---- C:\WINDOWS\system32\syncapp.exe
2008-11-17 18:25:09 ----A---- C:\WINDOWS\system32\sxs.dll
2008-11-17 18:25:09 ----A---- C:\WINDOWS\system32\swprv.dll
2008-11-17 18:25:09 ----A---- C:\WINDOWS\system32\svcpack.dll
2008-11-17 18:25:09 ----A---- C:\WINDOWS\system32\svchost.exe
2008-11-17 18:25:08 ----A---- C:\WINDOWS\system32\subst.exe
2008-11-17 18:25:08 ----A---- C:\WINDOWS\system32\strmfilt.dll
2008-11-17 18:25:08 ----A---- C:\WINDOWS\system32\strmdll.dll
2008-11-17 18:25:08 ----A---- C:\WINDOWS\system32\storage.dll
2008-11-17 18:25:08 ----A---- C:\WINDOWS\system32\stobject.dll
2008-11-17 18:25:08 ----A---- C:\WINDOWS\system32\stimon.exe
2008-11-17 18:25:08 ----A---- C:\WINDOWS\system32\sti_ci.dll
2008-11-17 18:25:08 ----A---- C:\WINDOWS\system32\sti.dll
2008-11-17 18:25:08 ----A---- C:\WINDOWS\system32\stclient.dll
2008-11-17 18:25:07 ----A---- C:\WINDOWS\system32\ssdpsrv.dll
2008-11-17 18:25:07 ----A---- C:\WINDOWS\system32\ssdpapi.dll
2008-11-17 18:25:07 ----A---- C:\WINDOWS\system32\srvsvc.dll
2008-11-17 18:25:06 ----A---- C:\WINDOWS\system32\srsvc.dll
2008-11-17 18:25:06 ----A---- C:\WINDOWS\system32\srrstr.dll
2008-11-17 18:25:06 ----A---- C:\WINDOWS\system32\srclient.dll
2008-11-17 18:25:06 ----A---- C:\WINDOWS\system32\sqlwoa.dll
2008-11-17 18:25:06 ----A---- C:\WINDOWS\system32\sqlwid.dll
2008-11-17 18:25:06 ----A---- C:\WINDOWS\system32\sqlunirl.dll
2008-11-17 18:25:06 ----A---- C:\WINDOWS\system32\sqlsrv32.dll
2008-11-17 18:25:05 ----A---- C:\WINDOWS\system32\spxcoins.dll
2008-11-17 18:25:05 ----A---- C:\WINDOWS\system32\sprestrt.exe
2008-11-17 18:25:02 ----A---- C:\WINDOWS\system32\spoolsv.exe
2008-11-17 18:25:01 ----A---- C:\WINDOWS\system32\spoolss.dll
2008-11-17 18:25:01 ----A---- C:\WINDOWS\system32\spnpinst.exe
2008-11-17 18:25:01 ----A---- C:\WINDOWS\system32\spiisupd.exe
2008-11-17 18:25:01 ----A---- C:\WINDOWS\system32\spider.exe
2008-11-17 18:24:59 ----A---- C:\WINDOWS\system32\sort.exe
2008-11-17 18:24:59 ----A---- C:\WINDOWS\system32\sol.exe
2008-11-17 18:24:59 ----A---- C:\WINDOWS\system32\softpub.dll
2008-11-17 18:24:59 ----A---- C:\WINDOWS\system32\snmpsnap.dll
2008-11-17 18:24:59 ----A---- C:\WINDOWS\system32\snmpapi.dll
2008-11-17 18:24:58 ----A---- C:\WINDOWS\system32\sndvol32.exe
2008-11-17 18:24:58 ----A---- C:\WINDOWS\system32\sndrec32.exe
2008-11-17 18:24:58 ----A---- C:\WINDOWS\system32\smss.exe
2008-11-17 18:24:58 ----A---- C:\WINDOWS\system32\smlogsvc.exe
2008-11-17 18:24:58 ----A---- C:\WINDOWS\system32\smlogcfg.dll
2008-11-17 18:24:58 ----A---- C:\WINDOWS\system32\smbinst.exe
2008-11-17 18:24:57 ----A---- C:\WINDOWS\system32\slbrccsp.dll
2008-11-17 18:24:57 ----A---- C:\WINDOWS\system32\slbiop.dll
2008-11-17 18:24:57 ----A---- C:\WINDOWS\system32\slbcsp.dll
2008-11-17 18:24:57 ----A---- C:\WINDOWS\system32\slayerxp.dll
2008-11-17 18:24:57 ----A---- C:\WINDOWS\system32\skeys.exe
2008-11-17 18:24:57 ----A---- C:\WINDOWS\system32\skdll.dll
2008-11-17 18:24:56 ----A---- C:\WINDOWS\system32\sisbkup.dll
2008-11-17 18:24:56 ----A---- C:\WINDOWS\system32\sigverif.exe
2008-11-17 18:24:56 ----A---- C:\WINDOWS\system32\sigtab.dll
2008-11-17 18:24:56 ----A---- C:\WINDOWS\system32\shutdown.exe
2008-11-17 18:24:56 ----A---- C:\WINDOWS\system32\shsvcs.dll
2008-11-17 18:24:56 ----A---- C:\WINDOWS\system32\shscrap.dll
2008-11-17 18:24:56 ----A---- C:\WINDOWS\system32\shrpubw.exe
2008-11-17 18:24:56 ----A---- C:\WINDOWS\system32\shmgrate.exe
2008-11-17 18:24:56 ----A---- C:\WINDOWS\system32\shmedia.dll
2008-11-17 18:24:55 ----A---- C:\WINDOWS\system32\shlwapi.dll
2008-11-17 18:24:55 ----A---- C:\WINDOWS\system32\shimgvw.dll
2008-11-17 18:24:55 ----A---- C:\WINDOWS\system32\shimeng.dll
2008-11-17 18:24:55 ----A---- C:\WINDOWS\system32\shgina.dll
2008-11-17 18:24:55 ----A---- C:\WINDOWS\system32\shfolder.dll
2008-11-17 18:24:54 ----A---- C:\WINDOWS\system32\shell32.dll
2008-11-17 18:24:54 ----A---- C:\WINDOWS\system32\shell.dll
2008-11-17 18:24:53 ----A---- C:\WINDOWS\system32\shdocvw.dll
2008-11-17 18:24:53 ----A---- C:\WINDOWS\system32\shdoclc.dll
2008-11-17 18:24:53 ----A---- C:\WINDOWS\system32\share.exe
2008-11-17 18:24:53 ----A---- C:\WINDOWS\system32\shadow.exe
2008-11-17 18:24:53 ----A---- C:\WINDOWS\system32\sfmapi.dll
2008-11-17 18:24:53 ----A---- C:\WINDOWS\system32\sfcfiles.dll
2008-11-17 18:24:53 ----A---- C:\WINDOWS\system32\sfc_os.dll
2008-11-17 18:24:53 ----A---- C:\WINDOWS\system32\sfc.exe
2008-11-17 18:24:53 ----A---- C:\WINDOWS\system32\sfc.dll
2008-11-17 18:24:53 ----A---- C:\WINDOWS\system32\setver.exe
2008-11-17 18:24:52 ----A---- C:\WINDOWS\system32\setupdll.dll
2008-11-17 18:24:52 ----A---- C:\WINDOWS\system32\setupapi.dll
2008-11-17 18:24:52 ----A---- C:\WINDOWS\system32\setup.exe
2008-11-17 18:24:52 ----A---- C:\WINDOWS\system32\sethc.exe
2008-11-17 18:24:52 ----A---- C:\WINDOWS\system32\sessmgr.exe
2008-11-17 18:24:52 ----A---- C:\WINDOWS\system32\serwvdrv.dll
2008-11-17 18:24:52 ----A---- C:\WINDOWS\system32\services.msc
2008-11-17 18:24:52 ----A---- C:\WINDOWS\system32\services.exe
2008-11-17 18:24:52 ----A---- C:\WINDOWS\system32\servdeps.dll
2008-11-17 18:24:52 ----A---- C:\WINDOWS\system32\serialui.dll
2008-11-17 18:24:51 ----D---- C:\Voice Recordings
2008-11-17 18:24:51 ----D---- C:\Vigyan
2008-11-17 18:24:51 ----A---- C:\WINDOWS\system32\senscfg.dll
2008-11-17 18:24:51 ----A---- C:\WINDOWS\system32\sensapi.dll
2008-11-17 18:24:51 ----A---- C:\WINDOWS\system32\sens.dll
2008-11-17 18:24:51 ----A---- C:\WINDOWS\system32\sendmail.dll
2008-11-17 18:24:51 ----A---- C:\WINDOWS\system32\sendcmsg.dll
2008-11-17 18:24:51 ----A---- C:\WINDOWS\system32\security.dll
2008-11-17 18:24:51 ----A---- C:\WINDOWS\system32\secur32.dll
2008-11-17 18:24:51 ----A---- C:\WINDOWS\system32\secpol.msc
2008-11-17 18:24:51 ----A---- C:\WINDOWS\system32\seclogon.dll
2008-11-17 18:24:51 ----A---- C:\WINDOWS\system32\secedit.exe
2008-11-17 18:24:51 ----A---- C:\WINDOWS\system32\sdpblb.dll
2008-11-17 18:24:51 ----A---- C:\WINDOWS\system32\sdhcinst.dll
2008-11-17 18:24:51 ----A---- C:\WINDOWS\system32\sdbinst.exe
2008-11-17 18:24:51 ----A---- C:\WINDOWS\system32\scrrun.dll
2008-11-17 18:24:51 ----A---- C:\WINDOWS\system32\scrobj.dll
2008-11-17 18:24:51 ----A---- C:\WINDOWS\system32\scriptpw.dll
2008-11-17 18:24:51 ----A---- C:\WINDOWS\system32\schtasks.exe
2008-11-17 18:24:50 ----D---- C:\TEAMS
2008-11-17 18:24:50 ----A---- C:\WINDOWS\system32\scredir.dll
2008-11-17 18:24:50 ----A---- C:\WINDOWS\system32\sclgntfy.dll
2008-11-17 18:24:50 ----A---- C:\WINDOWS\system32\schedsvc.dll
2008-11-17 18:24:50 ----A---- C:\WINDOWS\system32\schannel.dll
2008-11-17 18:24:50 ----A---- C:\WINDOWS\system32\scesrv.dll
2008-11-17 18:24:50 ----A---- C:\WINDOWS\system32\scecli.dll
2008-11-17 18:24:50 ----A---- C:\WINDOWS\system32\sccsccp.dll
2008-11-17 18:24:50 ----A---- C:\WINDOWS\system32\sccbase.dll
2008-11-17 18:24:50 ----A---- C:\WINDOWS\system32\scardsvr.exe
2008-11-17 18:24:50 ----A---- C:\WINDOWS\system32\scardssp.dll
2008-11-17 18:24:50 ----A---- C:\WINDOWS\system32\scarddlg.dll
2008-11-17 18:24:50 ----A---- C:\WINDOWS\system32\sc.exe
2008-11-17 18:24:50 ----A---- C:\WINDOWS\system32\sbeio.dll
2008-11-17 18:24:50 ----A---- C:\WINDOWS\system32\sbe.dll
2008-11-17 18:24:50 ----A---- C:\WINDOWS\system32\savedump.exe
2008-11-17 18:24:49 ----A---- C:\WINDOWS\system32\samsrv.dll
2008-11-17 18:24:49 ----A---- C:\WINDOWS\system32\samlib.dll
2008-11-17 18:24:48 ----A---- C:\WINDOWS\system32\safrslv.dll
2008-11-17 18:24:48 ----A---- C:\WINDOWS\system32\safrdm.dll
2008-11-17 18:24:48 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2008-11-17 18:24:48 ----A---- C:\WINDOWS\system32\rwinsta.exe
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\runonce.exe
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rundll32.exe
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\runas.exe
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rtutils.dll
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rtm.dll
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rtipxmib.dll
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rtcshare.exe
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rsvpsp.dll
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rsvpperf.dll
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rsvpmsg.dll
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rsvp.ini
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rsvp.exe
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rsopprov.exe
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rsop.msc
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rsnotify.exe
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rsmui.exe
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rsmsink.exe
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rsmps.dll
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rsm.exe
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rshx32.dll
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rsh.exe
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rsfsaps.dll
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rsaenh.dll
2008-11-17 18:24:47 ----A---- C:\WINDOWS\system32\rpcss.dll
2008-11-17 18:24:46 ----A---- C:\WINDOWS\system32\rpcrt4.dll
2008-11-17 18:24:46 ----A---- C:\WINDOWS\system32\rpcns4.dll
2008-11-17 18:24:45 ----A---- C:\WINDOWS\system32\routetab.dll
2008-11-17 18:24:45 ----A---- C:\WINDOWS\system32\routemon.exe
2008-11-17 18:24:45 ----A---- C:\WINDOWS\system32\route.exe
2008-11-17 18:24:45 ----A---- C:\WINDOWS\system32\rnr20.dll
2008-11-17 18:24:45 ----A---- C:\WINDOWS\system32\riched32.dll
2008-11-17 18:24:45 ----A---- C:\WINDOWS\system32\riched20.dll
2008-11-17 18:24:45 ----A---- C:\WINDOWS\system32\rexec.exe
2008-11-17 18:24:45 ----A---- C:\WINDOWS\system32\resutils.dll
2008-11-17 18:24:45 ----A---- C:\WINDOWS\system32\reset.exe
2008-11-17 18:24:45 ----A---- C:\WINDOWS\system32\replace.exe
2008-11-17 18:24:45 ----A---- C:\WINDOWS\system32\rend.dll
2008-11-17 18:24:45 ----A---- C:\WINDOWS\system32\remotepg.dll
2008-11-17 18:24:45 ----A---- C:\WINDOWS\system32\relog.exe
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\regwizc.dll
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\regwiz.exe
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\regsvr32.exe
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\regsvc.dll
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\regini.exe
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\regedt32.exe
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\regapi.dll
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\reg.exe
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\redir.exe
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\recover.exe
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\rdshost.exe
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\rdpdd.dll
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\rdpclip.exe
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\rdchost.dll
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\rcp.exe
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\rcimlby.exe
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\rcbdyctl.dll
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\rastls.dll
2008-11-17 18:24:44 ----A---- C:\WINDOWS\system32\rastapi.dll
2008-11-17 18:24:44 ----A---- C:\WINDOWS\regedit.exe
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\rasser.dll
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\rassapi.dll
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\rasrad.dll
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\rasppp.dll
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\rasphone.exe
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\rasmxs.dll
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\rasmontr.dll
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\rasmans.dll
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\rasman.dll
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\rasdlg.dll
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\rasdial.exe
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\rasctrs.ini
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\rasctrs.dll
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\raschap.dll
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\rasautou.exe
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\rasauto.dll
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\rasapi32.dll
log.txt continued:
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\rasadhlp.dll
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\racpldlg.dll
2008-11-17 18:24:43 ----A---- C:\WINDOWS\system32\qwinsta.exe
2008-11-17 18:24:42 ----A---- C:\WINDOWS\system32\query.dll
2008-11-17 18:24:42 ----A---- C:\WINDOWS\system32\quartz.dll
2008-11-17 18:24:42 ----A---- C:\WINDOWS\system32\qprocess.exe
2008-11-17 18:24:42 ----A---- C:\WINDOWS\system32\qosname.dll
2008-11-17 18:24:42 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2008-11-17 18:24:42 ----A---- C:\WINDOWS\system32\qmgr.dll
2008-11-17 18:24:41 ----A---- C:\WINDOWS\system32\qedwipes.dll
2008-11-17 18:24:41 ----A---- C:\WINDOWS\system32\qedit.dll
2008-11-17 18:24:40 ----A---- C:\WINDOWS\system32\qdvd.dll
2008-11-17 18:24:40 ----A---- C:\WINDOWS\system32\qdv.dll
2008-11-17 18:24:40 ----A---- C:\WINDOWS\system32\qcap.dll
2008-11-17 18:24:40 ----A---- C:\WINDOWS\system32\qappsrv.exe
2008-11-17 18:24:40 ----A---- C:\WINDOWS\system32\pubprn.vbs
2008-11-17 18:24:40 ----A---- C:\WINDOWS\system32\pstorsvc.dll
2008-11-17 18:24:40 ----A---- C:\WINDOWS\system32\pstorec.dll
2008-11-17 18:24:40 ----A---- C:\WINDOWS\system32\psnppagn.dll
2008-11-17 18:24:40 ----A---- C:\WINDOWS\system32\pschdprf.ini
2008-11-17 18:24:40 ----A---- C:\WINDOWS\system32\pschdprf.dll
2008-11-17 18:24:40 ----A---- C:\WINDOWS\system32\psbase.dll
2008-11-17 18:24:40 ----A---- C:\WINDOWS\system32\psapi.dll
2008-11-17 18:24:32 ----A---- C:\WINDOWS\system32\proxycfg.exe
2008-11-17 18:24:31 ----A---- C:\WINDOWS\system32\proquota.exe
2008-11-17 18:24:31 ----A---- C:\WINDOWS\system32\progman.exe
2008-11-17 18:24:31 ----A---- C:\WINDOWS\system32\profmap.dll
2008-11-17 18:24:31 ----A---- C:\WINDOWS\system32\prodspec.ini
2008-11-17 18:24:31 ----A---- C:\WINDOWS\system32\prnqctl.vbs
2008-11-17 18:24:31 ----A---- C:\WINDOWS\system32\prnport.vbs
2008-11-17 18:24:31 ----A---- C:\WINDOWS\system32\prnmngr.vbs
2008-11-17 18:24:31 ----A---- C:\WINDOWS\system32\prnjobs.vbs
2008-11-17 18:24:31 ----A---- C:\WINDOWS\system32\prndrvr.vbs
2008-11-17 18:24:31 ----A---- C:\WINDOWS\system32\prncnfg.vbs
2008-11-17 18:24:31 ----A---- C:\WINDOWS\system32\printui.dll
2008-11-17 18:24:31 ----A---- C:\WINDOWS\system32\print.exe
2008-11-17 18:24:31 ----A---- C:\WINDOWS\system32\prflbmsg.dll
2008-11-17 18:24:31 ----A---- C:\WINDOWS\system32\powrprof.dll
2008-11-17 18:24:31 ----A---- C:\WINDOWS\system32\powercfg.exe
2008-11-17 18:24:30 ----A---- C:\WINDOWS\system32\polstore.dll
2008-11-17 18:24:30 ----A---- C:\WINDOWS\system32\pnrpnsp.dll
2008-11-17 18:24:30 ----A---- C:\WINDOWS\system32\pngfilt.dll
2008-11-17 18:24:30 ----A---- C:\WINDOWS\system32\pmspl.dll
2008-11-17 18:24:30 ----A---- C:\WINDOWS\system32\plustab.dll
2008-11-17 18:24:30 ----A---- C:\WINDOWS\system32\ping6.exe
2008-11-17 18:24:30 ----A---- C:\WINDOWS\system32\ping.exe
2008-11-17 18:24:30 ----A---- C:\WINDOWS\system32\pifmgr.dll
2008-11-17 18:24:30 ----A---- C:\WINDOWS\system32\pidgen.dll
2008-11-17 18:24:29 ----A---- C:\WINDOWS\system32\photowiz.dll
2008-11-17 18:24:29 ----A---- C:\WINDOWS\system32\perfwci.ini
2008-11-17 18:24:29 ----A---- C:\WINDOWS\system32\perfts.dll
2008-11-17 18:24:29 ----A---- C:\WINDOWS\system32\perfproc.dll
2008-11-17 18:24:29 ----A---- C:\WINDOWS\system32\perfos.dll
2008-11-17 18:24:29 ----A---- C:\WINDOWS\system32\perfnw.dll
2008-11-17 18:24:29 ----A---- C:\WINDOWS\system32\perfnet.dll
2008-11-17 18:24:29 ----A---- C:\WINDOWS\system32\perfmon.msc
2008-11-17 18:24:29 ----A---- C:\WINDOWS\system32\perfmon.exe
2008-11-17 18:24:29 ----A---- C:\WINDOWS\system32\perffilt.ini
2008-11-17 18:24:29 ----A---- C:\WINDOWS\system32\perfdisk.dll
2008-11-17 18:24:29 ----A---- C:\WINDOWS\system32\perfctrs.dll
2008-11-17 18:24:29 ----A---- C:\WINDOWS\system32\perfci.ini
2008-11-17 18:24:28 ----A---- C:\WINDOWS\system32\pentnt.exe
2008-11-17 18:24:28 ----A---- C:\WINDOWS\system32\pdh.dll
2008-11-17 18:24:26 ----A---- C:\WINDOWS\system32\pautoenr.dll
2008-11-17 18:24:26 ----A---- C:\WINDOWS\system32\pathping.exe
2008-11-17 18:24:26 ----A---- C:\WINDOWS\system32\panmap.dll
2008-11-17 18:24:25 ----A---- C:\WINDOWS\system32\pagefileconfig.vbs
2008-11-17 18:24:25 ----A---- C:\WINDOWS\system32\packager.exe
2008-11-17 18:24:25 ----A---- C:\WINDOWS\system32\p2psvc.dll
2008-11-17 18:24:25 ----A---- C:\WINDOWS\system32\p2pnetsh.dll
2008-11-17 18:24:25 ----A---- C:\WINDOWS\system32\p2pgraph.dll
2008-11-17 18:24:25 ----A---- C:\WINDOWS\system32\p2pgasvc.dll
2008-11-17 18:24:25 ----A---- C:\WINDOWS\system32\p2p.dll
2008-11-17 18:24:25 ----A---- C:\WINDOWS\system32\osuninst.exe
2008-11-17 18:24:25 ----A---- C:\WINDOWS\system32\osuninst.dll
2008-11-17 18:24:25 ----A---- C:\WINDOWS\system32\osk.exe
2008-11-17 18:24:25 ----A---- C:\WINDOWS\system32\openfiles.exe
2008-11-17 18:24:24 ----A---- C:\WINDOWS\system32\opengl32.dll
2008-11-17 18:24:24 ----A---- C:\WINDOWS\system32\olethk32.dll
2008-11-17 18:24:24 ----A---- C:\WINDOWS\system32\olesvr32.dll
2008-11-17 18:24:24 ----A---- C:\WINDOWS\system32\olesvr.dll
2008-11-17 18:24:24 ----A---- C:\WINDOWS\system32\olepro32.dll
2008-11-17 18:24:24 ----A---- C:\WINDOWS\system32\oleprn.dll
2008-11-17 18:24:24 ----A---- C:\WINDOWS\system32\oledlg.dll
2008-11-17 18:24:24 ----A---- C:\WINDOWS\system32\olecnv32.dll
2008-11-17 18:24:24 ----A---- C:\WINDOWS\system32\olecli32.dll
2008-11-17 18:24:24 ----A---- C:\WINDOWS\system32\olecli.dll
2008-11-17 18:24:24 ----A---- C:\WINDOWS\system32\oleaut32.dll
2008-11-17 18:24:24 ----A---- C:\WINDOWS\system32\oleaccrc.dll
2008-11-17 18:24:24 ----A---- C:\WINDOWS\system32\oleacc.dll
2008-11-17 18:24:23 ----A---- C:\WINDOWS\system32\ole32.dll
2008-11-17 18:24:23 ----A---- C:\WINDOWS\system32\ole2nls.dll
2008-11-17 18:24:23 ----A---- C:\WINDOWS\system32\ole2disp.dll
2008-11-17 18:24:23 ----A---- C:\WINDOWS\system32\ole2.dll
2008-11-17 18:24:23 ----A---- C:\WINDOWS\system32\offfilt.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odtext32.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odpdx32.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odfox32.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odexl32.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\oddbse32.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odbctrac.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odbcp32r.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odbcjt32.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odbcji32.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odbcint.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odbccu32.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odbccr32.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odbccp32.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odbcconf.exe
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odbcconf.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odbcbcp.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odbcad32.exe
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odbc32gt.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odbc32.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\odbc16gt.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\ocmanage.dll
2008-11-17 18:24:15 ----A---- C:\WINDOWS\system32\occache.dll
2008-11-17 18:24:14 ----A---- C:\WINDOWS\system32\objsel.dll
2008-11-17 18:24:13 ----A---- C:\WINDOWS\system32\oakley.dll
2008-11-17 18:24:13 ----A---- C:\WINDOWS\system32\nwwks.dll
2008-11-17 18:24:13 ----A---- C:\WINDOWS\system32\nwscript.exe
2008-11-17 18:24:13 ----A---- C:\WINDOWS\system32\nwprovau.dll
2008-11-17 18:24:13 ----A---- C:\WINDOWS\system32\nwevent.dll
2008-11-17 18:24:13 ----A---- C:\WINDOWS\system32\nwcfg.dll
2008-11-17 18:24:13 ----A---- C:\WINDOWS\system32\nwapi32.dll
2008-11-17 18:24:13 ----A---- C:\WINDOWS\system32\nwapi16.dll
2008-11-17 18:24:13 ----A---- C:\WINDOWS\system32\nw16.exe
2008-11-17 18:24:12 ----A---- C:\WINDOWS\system32\ntvdmd.dll
2008-11-17 18:24:12 ----A---- C:\WINDOWS\system32\ntvdm.exe
2008-11-17 18:24:12 ----A---- C:\WINDOWS\system32\ntshrui.dll
2008-11-17 18:24:12 ----A---- C:\WINDOWS\system32\ntsdexts.dll
2008-11-17 18:24:12 ----A---- C:\WINDOWS\system32\ntsd.exe
2008-11-17 18:24:11 ----A---- C:\WINDOWS\system32\ntprint.dll
2008-11-17 18:24:10 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2008-11-17 18:24:10 ----A---- C:\WINDOWS\system32\ntmssvc.dll
2008-11-17 18:24:10 ----A---- C:\WINDOWS\system32\ntmsoprq.msc
2008-11-17 18:24:10 ----A---- C:\WINDOWS\system32\ntmsmgr.msc
2008-11-17 18:24:10 ----A---- C:\WINDOWS\system32\ntmsmgr.dll
2008-11-17 18:24:10 ----A---- C:\WINDOWS\system32\ntmsevt.dll
2008-11-17 18:24:09 ----A---- C:\WINDOWS\system32\ntmsdba.dll
2008-11-17 18:24:09 ----A---- C:\WINDOWS\system32\ntmsapi.dll
2008-11-17 18:24:09 ----A---- C:\WINDOWS\system32\ntmarta.dll
2008-11-17 18:24:09 ----A---- C:\WINDOWS\system32\ntlsapi.dll
2008-11-17 18:24:09 ----A---- C:\WINDOWS\system32\ntlanui2.dll
2008-11-17 18:24:09 ----A---- C:\WINDOWS\system32\ntlanui.dll
2008-11-17 18:24:09 ----A---- C:\WINDOWS\system32\ntlanman.dll
2008-11-17 18:24:08 ----A---- C:\WINDOWS\system32\ntdsbcli.dll
2008-11-17 18:24:08 ----A---- C:\WINDOWS\system32\ntdsapi.dll
2008-11-17 18:24:07 ----A---- C:\WINDOWS\system32\ntdll.dll
2008-11-17 18:24:07 ----A---- C:\WINDOWS\system32\ntbackup.exe
2008-11-17 18:24:05 ----A---- C:\WINDOWS\system32\nslookup.exe
2008-11-17 18:24:05 ----A---- C:\WINDOWS\system32\npptools.dll
2008-11-17 18:24:05 ----A---- C:\WINDOWS\system32\notepad.exe
2008-11-17 18:24:05 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2008-11-17 18:24:05 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2008-11-17 18:24:05 ----A---- C:\WINDOWS\notepad.exe
2008-11-17 18:24:04 ----A---- C:\WINDOWS\system32\nlsfunc.exe
2008-11-17 18:24:03 ----A---- C:\WINDOWS\system32\nlhtml.dll
2008-11-17 18:24:03 ----A---- C:\WINDOWS\system32\newdev.dll
2008-11-17 18:24:02 ----A---- C:\WINDOWS\system32\netui2.dll
2008-11-17 18:24:02 ----A---- C:\WINDOWS\system32\netui1.dll
2008-11-17 18:24:02 ----A---- C:\WINDOWS\system32\netui0.dll
2008-11-17 18:24:02 ----A---- C:\WINDOWS\system32\netstat.exe
2008-11-17 18:24:02 ----A---- C:\WINDOWS\system32\netshell.dll
2008-11-17 18:24:02 ----A---- C:\WINDOWS\system32\netsh.exe
2008-11-17 18:24:01 ----A---- C:\WINDOWS\system32\netsetup.exe
2008-11-17 18:24:01 ----A---- C:\WINDOWS\system32\netrap.dll
2008-11-17 18:24:01 ----A---- C:\WINDOWS\system32\netplwiz.dll
2008-11-17 18:24:01 ----A---- C:\WINDOWS\system32\netmsg.dll
2008-11-17 18:24:01 ----A---- C:\WINDOWS\system32\netman.dll
2008-11-17 18:24:01 ----A---- C:\WINDOWS\system32\netlogon.dll
2008-11-17 18:24:01 ----A---- C:\WINDOWS\system32\netid.dll
2008-11-17 18:24:01 ----A---- C:\WINDOWS\system32\neth.dll
2008-11-17 18:24:00 ----A---- C:\WINDOWS\system32\netevent.dll
2008-11-17 18:24:00 ----A---- C:\WINDOWS\system32\netdde.exe
2008-11-17 18:24:00 ----A---- C:\WINDOWS\system32\netcfgx.dll
2008-11-17 18:23:59 ----A---- C:\WINDOWS\system32\netapi32.dll
2008-11-17 18:23:59 ----A---- C:\WINDOWS\system32\netapi.dll
2008-11-17 18:23:59 ----A---- C:\WINDOWS\system32\net1.exe
2008-11-17 18:23:59 ----A---- C:\WINDOWS\system32\net.exe
2008-11-17 18:23:59 ----A---- C:\WINDOWS\system32\nddenb32.dll
2008-11-17 18:23:59 ----A---- C:\WINDOWS\system32\nddeapir.exe
2008-11-17 18:23:59 ----A---- C:\WINDOWS\system32\nddeapi.dll
2008-11-17 18:23:59 ----A---- C:\WINDOWS\system32\ncxpnt.dll
2008-11-17 18:23:59 ----A---- C:\WINDOWS\system32\ncobjapi.dll
2008-11-17 18:23:59 ----A---- C:\WINDOWS\system32\nbtstat.exe
2008-11-17 18:23:59 ----A---- C:\WINDOWS\system32\narrhook.dll
2008-11-17 18:23:59 ----A---- C:\WINDOWS\system32\narrator.exe
2008-11-17 18:23:59 ----A---- C:\WINDOWS\system32\mydocs.dll
2008-11-17 18:23:58 ----A---- C:\WINDOWS\system32\mycomput.dll
2008-11-17 18:23:56 ----A---- C:\WINDOWS\system32\mtxoci.dll
2008-11-17 18:23:56 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2008-11-17 18:23:56 ----A---- C:\WINDOWS\system32\mtxex.dll
2008-11-17 18:23:56 ----A---- C:\WINDOWS\system32\mtxdm.dll
2008-11-17 18:23:56 ----A---- C:\WINDOWS\system32\mtxclu.dll
2008-11-17 18:23:56 ----A---- C:\WINDOWS\system32\msxmlr.dll
2008-11-17 18:23:56 ----A---- C:\WINDOWS\system32\msxml3r.dll
2008-11-17 18:23:55 ----A---- C:\WINDOWS\system32\msxml3.dll
2008-11-17 18:23:55 ----A---- C:\WINDOWS\system32\msxml2r.dll
2008-11-17 18:23:55 ----A---- C:\WINDOWS\system32\msxml2.dll
2008-11-17 18:23:55 ----A---- C:\WINDOWS\system32\msxml.dll
2008-11-17 18:23:55 ----A---- C:\WINDOWS\system32\msxbde40.dll
2008-11-17 18:23:55 ----A---- C:\WINDOWS\system32\mswstr10.dll
2008-11-17 18:23:55 ----A---- C:\WINDOWS\system32\mswsock.dll
2008-11-17 18:23:55 ----A---- C:\WINDOWS\system32\mswebdvd.dll
2008-11-17 18:23:54 ----D---- C:\ROME
2008-11-17 18:23:54 ----D---- C:\Resume
2008-11-17 18:23:54 ----A---- C:\WINDOWS\system32\mswdat10.dll
2008-11-17 18:23:54 ----A---- C:\WINDOWS\system32\msw3prt.dll
2008-11-17 18:23:54 ----A---- C:\WINDOWS\system32\msvideo.dll
2008-11-17 18:23:54 ----A---- C:\WINDOWS\system32\msvidctl.dll
2008-11-17 18:23:54 ----A---- C:\WINDOWS\system32\msvidc32.dll
2008-11-17 18:23:54 ----A---- C:\WINDOWS\system32\msvfw32.dll
2008-11-17 18:23:54 ----A---- C:\WINDOWS\system32\msvcrt40.dll
2008-11-17 18:23:54 ----A---- C:\WINDOWS\system32\msvcrt20.dll
2008-11-17 18:23:54 ----A---- C:\WINDOWS\system32\msvcrt.dll
2008-11-17 18:23:54 ----A---- C:\WINDOWS\system32\msvcp60.dll
2008-11-17 18:23:54 ----A---- C:\WINDOWS\system32\msvcp50.dll
2008-11-17 18:23:54 ----A---- C:\WINDOWS\system32\msvcirt.dll
2008-11-17 18:23:53 ----A---- C:\WINDOWS\system32\msvbvm60.dll
2008-11-17 18:23:53 ----A---- C:\WINDOWS\system32\msvbvm50.dll
2008-11-17 18:23:53 ----A---- C:\WINDOWS\system32\msv1_0.dll
2008-11-17 18:23:53 ----A---- C:\WINDOWS\system32\msutb.dll
2008-11-17 18:23:52 ----D---- C:\PSR
2008-11-17 18:23:52 ----A---- C:\WINDOWS\system32\mstscax.dll
2008-11-17 18:23:52 ----A---- C:\WINDOWS\system32\mstsc.exe
2008-11-17 18:23:52 ----A---- C:\WINDOWS\system32\mstlsapi.dll
2008-11-17 18:23:52 ----A---- C:\WINDOWS\system32\mstinit.exe
2008-11-17 18:23:52 ----A---- C:\WINDOWS\system32\mstime.dll
2008-11-17 18:23:52 ----A---- C:\WINDOWS\system32\mstext40.dll
2008-11-17 18:23:52 ----A---- C:\WINDOWS\system32\mstask.dll
2008-11-17 18:23:52 ----A---- C:\WINDOWS\system32\msswchx.exe
2008-11-17 18:23:52 ----A---- C:\WINDOWS\system32\msswch.dll
2008-11-17 18:23:52 ----A---- C:\WINDOWS\system32\mssip32.dll
2008-11-17 18:23:52 ----A---- C:\WINDOWS\system32\mssign32.dll
2008-11-17 18:23:51 ----D---- C:\Proposals
2008-11-17 18:23:51 ----A---- C:\WINDOWS\system32\mssap.dll
2008-11-17 18:23:51 ----A---- C:\WINDOWS\system32\msrle32.dll
2008-11-17 18:23:51 ----A---- C:\WINDOWS\system32\msrepl40.dll
2008-11-17 18:23:51 ----A---- C:\WINDOWS\system32\msrecr40.dll
2008-11-17 18:23:51 ----A---- C:\WINDOWS\system32\msrd3x40.dll
2008-11-17 18:23:51 ----A---- C:\WINDOWS\system32\msrd2x40.dll
2008-11-17 18:23:51 ----A---- C:\WINDOWS\system32\msrclr40.dll
2008-11-17 18:23:51 ----A---- C:\WINDOWS\system32\msrating.dll
2008-11-17 18:23:51 ----A---- C:\WINDOWS\system32\msratelc.dll
2008-11-17 18:23:51 ----A---- C:\WINDOWS\system32\msr2cenu.dll
2008-11-17 18:23:51 ----A---- C:\WINDOWS\system32\msr2c.dll
2008-11-17 18:23:51 ----A---- C:\WINDOWS\system32\msprivs.dll
2008-11-17 18:23:51 ----A---- C:\WINDOWS\system32\msports.dll
2008-11-17 18:23:50 ----A---- C:\WINDOWS\system32\mspbde40.dll
2008-11-17 18:23:50 ----A---- C:\WINDOWS\system32\mspatcha.dll
2008-11-17 18:23:50 ----A---- C:\WINDOWS\system32\mspaint.exe
2008-11-17 18:23:50 ----A---- C:\WINDOWS\system32\msorcl32.dll
2008-11-17 18:23:50 ----A---- C:\WINDOWS\system32\msorc32r.dll
2008-11-17 18:23:50 ----A---- C:\WINDOWS\system32\msoert2.dll
2008-11-17 18:23:50 ----A---- C:\WINDOWS\system32\msoeacct.dll
2008-11-17 18:23:49 ----A---- C:\WINDOWS\system32\msobjs.dll
2008-11-17 18:23:48 ----A---- C:\WINDOWS\system32\msnsspc.dll
2008-11-17 18:23:38 ----A---- C:\WINDOWS\system32\msltus40.dll
2008-11-17 18:23:38 ----A---- C:\WINDOWS\system32\msls31.dll
2008-11-17 18:23:38 ----A---- C:\WINDOWS\system32\mslbui.dll
2008-11-17 18:23:38 ----A---- C:\WINDOWS\system32\msjtes40.dll
2008-11-17 18:23:38 ----A---- C:\WINDOWS\system32\msjter40.dll
2008-11-17 18:23:38 ----A---- C:\WINDOWS\system32\msjint40.dll
2008-11-17 18:23:38 ----A---- C:\WINDOWS\system32\msjetoledb40.dll
2008-11-17 18:23:37 ----A---- C:\WINDOWS\system32\msjet40.dll
2008-11-17 18:23:37 ----A---- C:\WINDOWS\system32\msisip.dll
2008-11-17 18:23:37 ----A---- C:\WINDOWS\system32\msimtf.dll
2008-11-17 18:23:37 ----A---- C:\WINDOWS\system32\msimsg.dll
2008-11-17 18:23:37 ----A---- C:\WINDOWS\system32\msimg32.dll
2008-11-17 18:23:37 ----A---- C:\WINDOWS\system32\msihnd.dll
2008-11-17 18:23:37 ----A---- C:\WINDOWS\system32\msiexec.exe
2008-11-17 18:23:36 ----A---- C:\WINDOWS\system32\msieftp.dll
2008-11-17 18:23:36 ----A---- C:\WINDOWS\system32\msidntld.dll
2008-11-17 18:23:36 ----A---- C:\WINDOWS\system32\msidle.dll
2008-11-17 18:23:36 ----A---- C:\WINDOWS\system32\msident.dll
2008-11-17 18:23:36 ----A---- C:\WINDOWS\system32\msi.dll
2008-11-17 18:23:36 ----A---- C:\WINDOWS\system32\mshtmler.dll
2008-11-17 18:23:36 ----A---- C:\WINDOWS\system32\mshtmled.dll
2008-11-17 18:23:35 ----A---- C:\WINDOWS\system32\mshtml.dll
2008-11-17 18:23:35 ----A---- C:\WINDOWS\system32\mshta.exe
2008-11-17 18:23:35 ----A---- C:\WINDOWS\system32\mshearts.exe
2008-11-17 18:23:35 ----A---- C:\WINDOWS\system32\msgsvc.dll
2008-11-17 18:23:34 ----A---- C:\WINDOWS\system32\msgina.dll
2008-11-17 18:23:34 ----A---- C:\WINDOWS\system32\msg.exe
2008-11-17 18:23:34 ----A---- C:\WINDOWS\system32\msftedit.dll
2008-11-17 18:23:34 ----A---- C:\WINDOWS\system32\msexcl40.dll
2008-11-17 18:23:33 ----A---- C:\WINDOWS\system32\msexch40.dll
2008-11-17 18:23:33 ----A---- C:\WINDOWS\system32\msencode.dll
2008-11-17 18:23:33 ----A---- C:\WINDOWS\system32\msdxmlc.dll
2008-11-17 18:23:33 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2008-11-17 18:23:33 ----A---- C:\WINDOWS\system32\msdtctm.dll
2008-11-17 18:23:33 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2008-11-17 18:23:33 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2008-11-17 18:23:33 ----A---- C:\WINDOWS\system32\msdtclog.dll
2008-11-17 18:23:33 ----A---- C:\WINDOWS\system32\msdtc.exe
2008-11-17 18:23:33 ----A---- C:\WINDOWS\system32\msdmo.dll
2008-11-17 18:23:33 ----A---- C:\WINDOWS\msdfmap.ini
2008-11-17 18:23:32 ----A---- C:\WINDOWS\system32\msdart.dll
2008-11-17 18:23:32 ----A---- C:\WINDOWS\system32\msdadiag.dll
2008-11-17 18:23:32 ----A---- C:\WINDOWS\system32\msctfp.dll
2008-11-17 18:23:32 ----A---- C:\WINDOWS\system32\msctf.dll
2008-11-17 18:23:32 ----A---- C:\WINDOWS\system32\mscpxl32.dll
2008-11-17 18:23:32 ----A---- C:\WINDOWS\system32\mscpx32r.dll
2008-11-17 18:23:32 ----A---- C:\WINDOWS\system32\msconf.dll
2008-11-17 18:23:32 ----A---- C:\WINDOWS\system32\mscms.dll
2008-11-17 18:23:32 ----A---- C:\WINDOWS\system32\mscdexnt.exe
2008-11-17 18:23:32 ----A---- C:\WINDOWS\system32\mscat32.dll
2008-11-17 18:23:32 ----A---- C:\WINDOWS\system32\msaudite.dll
2008-11-17 18:23:32 ----A---- C:\WINDOWS\system32\msasn1.dll
2008-11-17 18:23:32 ----A---- C:\WINDOWS\system32\msapsspc.dll
2008-11-17 18:23:32 ----A---- C:\WINDOWS\system32\msafd.dll
2008-11-17 18:23:31 ----A---- C:\WINDOWS\system32\msacm32.dll
2008-11-17 18:23:31 ----A---- C:\WINDOWS\system32\msacm.dll
2008-11-17 18:23:31 ----A---- C:\WINDOWS\system32\msaatext.dll
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mrinfo.exe
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqutil.dll
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqupgrd.dll
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqtrig.dll
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqtgsvc.exe
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqsvc.exe
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqsnap.dll
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqsec.dll
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqrtdep.dll
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqrt.dll
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqqm.dll
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqperf.ini
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqperf.dll
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqoa.dll
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqlogmgr.dll
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqise.dll
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqgentr.dll
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqdscli.dll
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqcertui.dll
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqbkup.exe
2008-11-17 18:23:29 ----A---- C:\WINDOWS\system32\mqad.dll
2008-11-17 18:23:28 ----D---- C:\Prophecy 1
2008-11-17 18:23:28 ----A---- C:\WINDOWS\system32\mprui.dll
2008-11-17 18:23:28 ----A---- C:\WINDOWS\system32\mprmsg.dll
2008-11-17 18:23:28 ----A---- C:\WINDOWS\system32\mprdim.dll
2008-11-17 18:23:28 ----A---- C:\WINDOWS\system32\mprddm.dll
2008-11-17 18:23:28 ----A---- C:\WINDOWS\system32\mprapi.dll
2008-11-17 18:23:28 ----A---- C:\WINDOWS\system32\mpr.dll
2008-11-17 18:23:28 ----A---- C:\WINDOWS\system32\mpnotify.exe
2008-11-17 18:23:28 ----A---- C:\WINDOWS\system32\mplay32.exe
2008-11-17 18:23:28 ----A---- C:\WINDOWS\system32\mpg4dmod.dll
2008-11-17 18:23:28 ----A---- C:\WINDOWS\system32\mp4sdmod.dll
2008-11-17 18:23:28 ----A---- C:\WINDOWS\system32\mp43dmod.dll
2008-11-17 18:23:26 ----A---- C:\WINDOWS\system32\mountvol.exe
2008-11-17 18:23:26 ----A---- C:\WINDOWS\system32\moricons.dll
2008-11-17 18:23:26 ----A---- C:\WINDOWS\system32\more.com
2008-11-17 18:23:26 ----A---- C:\WINDOWS\system32\modex.dll
2008-11-17 18:23:26 ----A---- C:\WINDOWS\system32\modemui.dll
2008-11-17 18:23:25 ----A---- C:\WINDOWS\system32\mode.com
2008-11-17 18:23:25 ----A---- C:\WINDOWS\system32\mobsync.exe
2008-11-17 18:23:25 ----A---- C:\WINDOWS\system32\mobsync.dll
2008-11-17 18:23:25 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2008-11-17 18:23:25 ----A---- C:\WINDOWS\system32\mnmdd.dll
2008-11-17 18:23:25 ----A---- C:\WINDOWS\system32\mmutilse.dll
2008-11-17 18:23:25 ----A---- C:\WINDOWS\system32\mmsystem.dll
2008-11-17 18:23:24 ----A---- C:\WINDOWS\system32\mmfutil.dll
2008-11-17 18:23:24 ----A---- C:\WINDOWS\system32\mmdrv.dll
2008-11-17 18:23:24 ----A---- C:\WINDOWS\system32\mmcshext.dll
2008-11-17 18:23:24 ----A---- C:\WINDOWS\system32\mmcndmgr.dll
2008-11-17 18:23:24 ----A---- C:\WINDOWS\system32\mmcbase.dll
2008-11-17 18:23:24 ----A---- C:\WINDOWS\system32\mmc.exe
2008-11-17 18:23:24 ----A---- C:\WINDOWS\system32\mll_qic.dll
2008-11-17 18:23:24 ----A---- C:\WINDOWS\system32\mll_mtf.dll
2008-11-17 18:23:24 ----A---- C:\WINDOWS\system32\mll_hp.dll
2008-11-17 18:23:24 ----A---- C:\WINDOWS\system32\mlang.dll
2008-11-17 18:23:23 ----A---- C:\WINDOWS\system32\mimefilt.dll
2008-11-17 18:23:23 ----A---- C:\WINDOWS\system32\migpwd.exe
2008-11-17 18:23:23 ----A---- C:\WINDOWS\system32\miglibnt.dll
2008-11-17 18:23:23 ----A---- C:\WINDOWS\system32\midimap.dll
2008-11-17 18:23:22 ----A---- C:\WINDOWS\system32\mgmtapi.dll
2008-11-17 18:23:22 ----A---- C:\WINDOWS\system32\mfcsubs.dll
2008-11-17 18:23:22 ----A---- C:\WINDOWS\system32\mfc42u.dll
2008-11-17 18:23:22 ----A---- C:\WINDOWS\system32\mfc42.dll
2008-11-17 18:23:22 ----A---- C:\WINDOWS\system32\mfc40u.dll
2008-11-17 18:23:21 ----A---- C:\WINDOWS\system32\mfc40.dll
2008-11-17 18:23:21 ----A---- C:\WINDOWS\system32\mf3216.dll
2008-11-17 18:23:20 ----A---- C:\WINDOWS\system32\mem.exe
2008-11-17 18:23:19 ----A---- C:\WINDOWS\system32\mdminst.dll
2008-11-17 18:23:18 ----A---- C:\WINDOWS\system32\mdhcp.dll
2008-11-17 18:23:18 ----A---- C:\WINDOWS\system32\mciwave.dll
2008-11-17 18:23:18 ----A---- C:\WINDOWS\system32\mciseq.dll
2008-11-17 18:23:18 ----A---- C:\WINDOWS\system32\mciqtz32.dll
2008-11-17 18:23:18 ----A---- C:\WINDOWS\system32\mciole32.dll
2008-11-17 18:23:18 ----A---- C:\WINDOWS\system32\mciole16.dll
2008-11-17 18:23:18 ----A---- C:\WINDOWS\system32\mcicda.dll
2008-11-17 18:23:18 ----A---- C:\WINDOWS\system32\mciavi32.dll
2008-11-17 18:23:18 ----A---- C:\WINDOWS\system32\mchgrcoi.dll
2008-11-17 18:23:18 ----A---- C:\WINDOWS\system32\mcdsrv32.dll
2008-11-17 18:23:18 ----A---- C:\WINDOWS\system32\mcd32.dll
2008-11-17 18:23:18 ----A---- C:\WINDOWS\system32\mcastmib.dll
2008-11-17 18:23:18 ----A---- C:\WINDOWS\system32\mapistub.dll
2008-11-17 18:23:18 ----A---- C:\WINDOWS\system32\makecab.exe
2008-11-17 18:23:17 ----A---- C:\WINDOWS\system32\magnify.exe
2008-11-17 18:23:17 ----A---- C:\WINDOWS\system32\mag_hook.dll
2008-11-17 18:23:17 ----A---- C:\WINDOWS\system32\lzexpand.dll
2008-11-17 18:23:17 ----A---- C:\WINDOWS\system32\lz32.dll
2008-11-17 18:23:17 ----A---- C:\WINDOWS\system32\lusrmgr.msc
2008-11-17 18:23:16 ----A---- C:\WINDOWS\system32\lsass.exe
2008-11-17 18:23:16 ----A---- C:\WINDOWS\system32\lsasrv.dll
2008-11-17 18:23:16 ----A---- C:\WINDOWS\system32\lprmonui.dll
2008-11-17 18:23:16 ----A---- C:\WINDOWS\system32\lprhelp.dll
2008-11-17 18:23:16 ----A---- C:\WINDOWS\system32\lpr.exe
2008-11-17 18:23:16 ----A---- C:\WINDOWS\system32\lpq.exe
2008-11-17 18:23:16 ----A---- C:\WINDOWS\system32\lpk.dll
2008-11-17 18:23:16 ----A---- C:\WINDOWS\system32\logonui.exe
2008-11-17 18:23:16 ----A---- C:\WINDOWS\system32\logoff.exe
2008-11-17 18:23:16 ----A---- C:\WINDOWS\system32\logman.exe
2008-11-17 18:23:16 ----A---- C:\WINDOWS\system32\login.cmd
2008-11-17 18:23:16 ----A---- C:\WINDOWS\system32\loghours.dll
2008-11-17 18:23:16 ----A---- C:\WINDOWS\system32\lodctr.exe
2008-11-17 18:23:16 ----A---- C:\WINDOWS\system32\locator.exe
2008-11-17 18:23:16 ----A---- C:\WINDOWS\system32\localui.dll
2008-11-17 18:23:16 ----A---- C:\WINDOWS\system32\localspl.dll
2008-11-17 18:23:15 ----A---- C:\WINDOWS\system32\localsec.dll
2008-11-17 18:23:15 ----A---- C:\WINDOWS\system32\loadperf.dll
2008-11-17 18:23:15 ----A---- C:\WINDOWS\system32\loadfix.com
2008-11-17 18:23:15 ----A---- C:\WINDOWS\system32\lnkstub.exe
2008-11-17 18:23:15 ----A---- C:\WINDOWS\system32\lmrt.dll
2008-11-17 18:23:15 ----A---- C:\WINDOWS\system32\lmhsvc.dll
2008-11-17 18:23:15 ----A---- C:\WINDOWS\system32\linkinfo.dll
2008-11-17 18:23:15 ----A---- C:\WINDOWS\system32\lights.exe
2008-11-17 18:23:15 ----A---- C:\WINDOWS\system32\licwmi.dll
2008-11-17 18:23:15 ----A---- C:\WINDOWS\system32\licmgr10.dll
2008-11-17 18:23:15 ----A---- C:\WINDOWS\system32\licdll.dll
2008-11-17 18:23:14 ----A---- C:\WINDOWS\system32\langwrbk.dll
2008-11-17 18:23:01 ----D---- C:\Progress Reports
2008-11-17 18:22:45 ----D---- C:\Past Performance
2008-11-17 18:22:42 ----D---- C:\NNI
2008-11-17 18:22:42 ----D---- C:\New Process Progress Reports
2008-11-17 18:22:11 ----A---- C:\WINDOWS\system32\label.exe
2008-11-17 18:22:11 ----A---- C:\WINDOWS\system32\krnl386.exe
2008-11-17 18:22:11 ----A---- C:\WINDOWS\system32\keymgr.dll
2008-11-17 18:22:11 ----A---- C:\WINDOWS\system32\kernel32.dll
2008-11-17 18:22:11 ----A---- C:\WINDOWS\system32\kerberos.dll
2008-11-17 18:22:11 ----A---- C:\WINDOWS\system32\kdcom.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kd1394.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdycl.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdycc.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbduzb.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdusx.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdusr.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdusl.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdus.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdur.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdukx.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbduk.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdtuq.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdtuf.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdtat.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdsw.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdsp.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdsmsno.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdsmsfi.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdsl1.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdsl.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdsg.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdsf.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdru1.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdru.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdro.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdpo.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdpl1.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdpl.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdno1.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdno.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdnec.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdne.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdmon.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdmlt48.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdmlt47.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdmaori.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdmac.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdlv1.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdlv.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdlt1.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdlt.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdla.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdkyr.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdkaz.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdit142.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdit.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdir.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdinmal.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdinben.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdinbe1.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdic.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdhu1.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdhu.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdhept.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdhela3.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdhela2.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdhe319.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdhe220.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdhe.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdgr1.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdgr.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdgkl.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdgae.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdfr.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdfo.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdfi1.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdfi.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdfc.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdest.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdes.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbddv.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdda.dll
2008-11-17 18:22:10 ----A---- C:\WINDOWS\system32\kbdcz2.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\kbdcz1.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\kbdcz.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\kbdcr.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\kbdcan.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\kbdca.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\kbdbu.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\kbdbr.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\kbdblr.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\kbdbene.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\kbdbe.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\kbdazel.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\kbdaze.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\KBDAL.DLL
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\kb16.com
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\jsproxy.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\jscript.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\jobexec.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\jet500.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\ixsso.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\iuengine.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\itss.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\itircl.dll
2008-11-17 18:22:09 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2008-11-17 18:22:08 ----A---- C:\WINDOWS\system32\isign32.dll
2008-11-17 18:22:08 ----A---- C:\WINDOWS\system32\irclass.dll
2008-11-17 18:22:08 ----A---- C:\WINDOWS\system32\ir50_qcx.dll
2008-11-17 18:22:08 ----A---- C:\WINDOWS\system32\ir50_qc.dll
2008-11-17 18:22:08 ----A---- C:\WINDOWS\system32\ir50_32.dll
2008-11-17 18:22:08 ----A---- C:\WINDOWS\system32\ir41_qcx.dll
2008-11-17 18:22:08 ----A---- C:\WINDOWS\system32\ir41_qc.dll
2008-11-17 18:22:08 ----A---- C:\WINDOWS\system32\ir32_32.dll
2008-11-17 18:22:08 ----A---- C:\WINDOWS\system32\ipxwan.dll
2008-11-17 18:22:08 ----A---- C:\WINDOWS\system32\ipxsap.dll
2008-11-17 18:22:08 ----A---- C:\WINDOWS\system32\ipxrtmgr.dll
2008-11-17 18:22:08 ----A---- C:\WINDOWS\system32\ipxroute.exe
2008-11-17 18:22:08 ----A---- C:\WINDOWS\system32\ipxrip.dll
2008-11-17 18:22:08 ----A---- C:\WINDOWS\system32\ipxpromn.dll
2008-11-17 18:22:08 ----A---- C:\WINDOWS\system32\ipxmontr.dll
2008-11-17 18:22:07 ----A---- C:\WINDOWS\system32\ipv6mon.dll
2008-11-17 18:22:07 ----A---- C:\WINDOWS\system32\ipv6.exe
2008-11-17 18:22:07 ----A---- C:\WINDOWS\system32\ipsmsnap.dll
2008-11-17 18:22:07 ----A---- C:\WINDOWS\system32\ipsecsvc.dll
2008-11-17 18:22:07 ----A---- C:\WINDOWS\system32\ipsecsnp.dll
2008-11-17 18:22:07 ----A---- C:\WINDOWS\system32\ipsec6.exe
2008-11-17 18:22:07 ----A---- C:\WINDOWS\system32\iprtrmgr.dll
2008-11-17 18:22:07 ----A---- C:\WINDOWS\system32\iprtprio.dll
2008-11-17 18:22:07 ----A---- C:\WINDOWS\system32\iprop.dll
2008-11-17 18:22:07 ----A---- C:\WINDOWS\system32\ippromon.dll
2008-11-17 18:22:07 ----A---- C:\WINDOWS\system32\ipnathlp.dll
2008-11-17 18:22:07 ----A---- C:\WINDOWS\system32\ipmontr.dll
2008-11-17 18:22:07 ----A---- C:\WINDOWS\system32\iphlpapi.dll
2008-11-17 18:22:07 ----A---- C:\WINDOWS\system32\ipconfig.exe
2008-11-17 18:22:07 ----A---- C:\WINDOWS\system32\iologmsg.dll
2008-11-17 18:22:06 ----A---- C:\WINDOWS\system32\inseng.dll
2008-11-17 18:22:05 ----A---- C:\WINDOWS\system32\input.dll
2008-11-17 18:22:05 ----A---- C:\WINDOWS\system32\initpki.dll
2008-11-17 18:22:05 ----A---- C:\WINDOWS\system32\infosoft.dll
2008-11-17 18:22:05 ----A---- C:\WINDOWS\system32\inetres.dll
2008-11-17 18:22:05 ----A---- C:\WINDOWS\system32\inetppui.dll
2008-11-17 18:22:05 ----A---- C:\WINDOWS\system32\inetpp.dll
2008-11-17 18:22:05 ----A---- C:\WINDOWS\system32\inetmib1.dll
2008-11-17 18:22:05 ----A---- C:\WINDOWS\system32\inetcplc.dll
2008-11-17 18:22:04 ----A---- C:\WINDOWS\system32\inetcomm.dll
2008-11-17 18:22:04 ----A---- C:\WINDOWS\system32\inetcfg.dll
2008-11-17 18:22:04 ----A---- C:\WINDOWS\system32\imm32.dll
2008-11-17 18:22:04 ----A---- C:\WINDOWS\system32\imgutil.dll
2008-11-17 18:22:04 ----A---- C:\WINDOWS\system32\imeshare.dll
2008-11-17 18:22:04 ----A---- C:\WINDOWS\system32\imapi.exe
2008-11-17 18:22:04 ----A---- C:\WINDOWS\system32\imagehlp.dll
2008-11-17 18:22:04 ----A---- C:\WINDOWS\system32\ils.dll
2008-11-17 18:22:04 ----A---- C:\WINDOWS\system32\iissuba.dll
2008-11-17 18:22:01 ----A---- C:\WINDOWS\system32\igmpagnt.dll
2008-11-17 18:22:01 ----A---- C:\WINDOWS\system32\ifsutil.dll
2008-11-17 18:22:01 ----A---- C:\WINDOWS\system32\ifmon.dll
2008-11-17 18:22:01 ----A---- C:\WINDOWS\system32\iexpress.exe
2008-11-17 18:22:01 ----A---- C:\WINDOWS\system32\iesetup.dll
2008-11-17 18:22:01 ----A---- C:\WINDOWS\system32\iernonce.dll
2008-11-17 18:22:01 ----A---- C:\WINDOWS\system32\iepeers.dll
2008-11-17 18:22:01 ----A---- C:\WINDOWS\system32\ieencode.dll
2008-11-17 18:22:01 ----A---- C:\WINDOWS\system32\iedkcs32.dll
2008-11-17 18:22:01 ----A---- C:\WINDOWS\system32\ieakui.dll
2008-11-17 18:22:01 ----A---- C:\WINDOWS\system32\ieaksie.dll
2008-11-17 18:22:01 ----A---- C:\WINDOWS\system32\ieakeng.dll
2008-11-17 18:22:01 ----A---- C:\WINDOWS\system32\ie4uinit.exe
2008-11-17 18:22:01 ----A---- C:\WINDOWS\system32\idq.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\icwphbk.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\icwdial.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\icmui.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\icmp.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\icm32.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\iccvid.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\icaapi.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\iassvcs.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\iassdo.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\iassam.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\iasrecst.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\iasrad.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\iaspolcy.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\iasnap.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\iashlpr.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\iasads.dll
2008-11-17 18:22:00 ----A---- C:\WINDOWS\system32\iasacct.dll
2008-11-17 18:21:59 ----A---- C:\WINDOWS\system32\hypertrm.dll
2008-11-17 18:21:59 ----A---- C:\WINDOWS\system32\htui.dll
2008-11-17 18:21:59 ----A---- C:\WINDOWS\system32\httpapi.dll
2008-11-17 18:21:59 ----A---- C:\WINDOWS\system32\hticons.dll
2008-11-17 18:21:57 ----A---- C:\WINDOWS\system32\hotplug.dll
2008-11-17 18:21:57 ----A---- C:\WINDOWS\system32\hostname.exe
2008-11-17 18:21:57 ----A---- C:\WINDOWS\system32\hnetwiz.dll
2008-11-17 18:21:57 ----A---- C:\WINDOWS\system32\hnetmon.dll
2008-11-17 18:21:57 ----A---- C:\WINDOWS\system32\hnetcfg.dll
2008-11-17 18:21:57 ----A---- C:\WINDOWS\system32\hlink.dll
2008-11-17 18:21:56 ----A---- C:\WINDOWS\system32\hhsetup.dll
2008-11-17 18:21:56 ----A---- C:\WINDOWS\hh.exe
2008-11-17 18:21:55 ----A---- C:\WINDOWS\system32\help.exe
2008-11-17 18:21:55 ----A---- C:\WINDOWS\system32\hccoin.dll
2008-11-17 18:21:54 ----A---- C:\WINDOWS\system32\h323msp.dll
2008-11-17 18:21:54 ----A---- C:\WINDOWS\system32\grpconv.exe
2008-11-17 18:21:54 ----A---- C:\WINDOWS\system32\graphics.com
2008-11-17 18:21:54 ----A---- C:\WINDOWS\system32\graftabl.com
2008-11-17 18:21:53 ----A---- C:\WINDOWS\system32\gpupdate.exe
2008-11-17 18:21:53 ----A---- C:\WINDOWS\system32\gptext.dll
2008-11-17 18:21:53 ----A---- C:\WINDOWS\system32\gpresult.exe
2008-11-17 18:21:53 ----A---- C:\WINDOWS\system32\gpkrsrc.dll
2008-11-17 18:21:53 ----A---- C:\WINDOWS\system32\gpkcsp.dll
2008-11-17 18:21:53 ----A---- C:\WINDOWS\system32\gpedit.msc
2008-11-17 18:21:53 ----A---- C:\WINDOWS\system32\gpedit.dll
2008-11-17 18:21:51 ----A---- C:\WINDOWS\system32\glu32.dll
2008-11-17 18:21:51 ----A---- C:\WINDOWS\system32\glmf32.dll
2008-11-17 18:21:51 ----A---- C:\WINDOWS\system32\getuname.dll
2008-11-17 18:21:51 ----A---- C:\WINDOWS\system32\getmac.exe
2008-11-17 18:21:50 ----A---- C:\WINDOWS\system32\gdi32.dll
2008-11-17 18:21:50 ----A---- C:\WINDOWS\system32\gdi.exe
2008-11-17 18:21:50 ----A---- C:\WINDOWS\system32\gcdef.dll
2008-11-17 18:21:49 ----A---- C:\WINDOWS\system32\fwcfg.dll
2008-11-17 18:21:49 ----A---- C:\WINDOWS\system32\ftsrch.dll
2008-11-17 18:21:49 ----A---- C:\WINDOWS\system32\ftp.exe
2008-11-17 18:21:49 ----A---- C:\WINDOWS\system32\fsutil.exe
2008-11-17 18:21:49 ----A---- C:\WINDOWS\system32\fsusd.dll
2008-11-17 18:21:49 ----A---- C:\WINDOWS\system32\fsquirt.exe
2008-11-17 18:21:49 ----A---- C:\WINDOWS\system32\fsmgmt.msc
2008-11-17 18:21:49 ----A---- C:\WINDOWS\system32\freecell.exe
2008-11-17 18:21:49 ----A---- C:\WINDOWS\system32\framebuf.dll
2008-11-17 18:21:47 ----A---- C:\WINDOWS\system32\format.com
2008-11-17 18:21:47 ----A---- C:\WINDOWS\system32\forcedos.exe
2008-11-17 18:21:47 ----A---- C:\WINDOWS\system32\fontview.exe
2008-11-17 18:21:47 ----A---- C:\WINDOWS\system32\fontsub.dll
2008-11-17 18:21:47 ----A---- C:\WINDOWS\system32\fontext.dll
2008-11-17 18:21:47 ----A---- C:\WINDOWS\system32\fmifs.dll
2008-11-17 18:21:47 ----A---- C:\WINDOWS\system32\fltmc.exe
2008-11-17 18:21:47 ----A---- C:\WINDOWS\system32\fltlib.dll
2008-11-17 18:21:47 ----A---- C:\WINDOWS\system32\fldrclnr.dll
2008-11-17 18:21:47 ----A---- C:\WINDOWS\system32\fixmapi.exe
2008-11-17 18:21:47 ----A---- C:\WINDOWS\system32\finger.exe
2008-11-17 18:21:47 ----A---- C:\WINDOWS\system32\findstr.exe
2008-11-17 18:21:47 ----A---- C:\WINDOWS\system32\find.exe
2008-11-17 18:21:47 ----A---- C:\WINDOWS\system32\filemgmt.dll
2008-11-17 18:21:46 ----A---- C:\WINDOWS\system32\feclient.dll
2008-11-17 18:21:46 ----A---- C:\WINDOWS\system32\fdeploy.dll
2008-11-17 18:21:46 ----A---- C:\WINDOWS\system32\fde.dll
2008-11-17 18:21:46 ----A---- C:\WINDOWS\system32\fc.exe
2008-11-17 18:21:46 ----A---- C:\WINDOWS\system32\faultrep.dll
2008-11-17 18:21:46 ----A---- C:\WINDOWS\system32\fastopen.exe
2008-11-17 18:21:46 ----A---- C:\WINDOWS\system32\exts.dll
2008-11-17 18:21:46 ----A---- C:\WINDOWS\system32\extrac32.exe
2008-11-17 18:21:46 ----A---- C:\WINDOWS\system32\extmgr.dll
2008-11-17 18:21:46 ----A---- C:\WINDOWS\system32\expsrv.dll
2008-11-17 18:21:46 ----A---- C:\WINDOWS\system32\expand.exe
2008-11-17 18:21:46 ----A---- C:\WINDOWS\explorer.exe
2008-11-17 18:21:44 ----A---- C:\WINDOWS\system32\exe2bin.exe
2008-11-17 18:21:44 ----A---- C:\WINDOWS\system32\eventvwr.msc
2008-11-17 18:21:44 ----A---- C:\WINDOWS\system32\eventvwr.exe
2008-11-17 18:21:44 ----A---- C:\WINDOWS\system32\eventtriggers.exe
2008-11-17 18:21:44 ----A---- C:\WINDOWS\system32\eventquery.vbs
2008-11-17 18:21:44 ----A---- C:\WINDOWS\system32\eventlog.dll
2008-11-17 18:21:44 ----A---- C:\WINDOWS\system32\eventcreate.exe
2008-11-17 18:21:44 ----A---- C:\WINDOWS\system32\eventcls.dll
2008-11-17 18:21:44 ----A---- C:\WINDOWS\system32\eula.txt
2008-11-17 18:21:44 ----A---- C:\WINDOWS\system32\eudcedit.exe
2008-11-17 18:21:44 ----A---- C:\WINDOWS\system32\esentutl.exe
2008-11-17 18:21:44 ----A---- C:\WINDOWS\system32\esentprf.ini
2008-11-17 18:21:44 ----A---- C:\WINDOWS\system32\esentprf.dll
2008-11-17 18:21:44 ----A---- C:\WINDOWS\system32\esent97.dll
2008-11-17 18:21:43 ----A---- C:\WINDOWS\system32\esent.dll
2008-11-17 18:21:43 ----A---- C:\WINDOWS\system32\es.dll
2008-11-17 18:21:43 ----A---- C:\WINDOWS\system32\ersvc.dll
2008-11-17 18:21:43 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2008-11-17 18:21:43 ----A---- C:\WINDOWS\system32\encdec.dll
2008-11-17 18:21:43 ----A---- C:\WINDOWS\system32\encapi.dll
2008-11-17 18:21:43 ----A---- C:\WINDOWS\system32\els.dll
2008-11-17 18:21:43 ----A---- C:\WINDOWS\system32\efsadu.dll
2008-11-17 18:21:43 ----A---- C:\WINDOWS\system32\edlin.exe
2008-11-17 18:21:43 ----A---- C:\WINDOWS\system32\edit.com
log.txt continued: (last)
2008-11-17 18:21:42 ----A---- C:\WINDOWS\system32\dxtrans.dll
2008-11-17 18:21:42 ----A---- C:\WINDOWS\system32\dxtmsft.dll
2008-11-17 18:21:42 ----A---- C:\WINDOWS\system32\dxmasf.dll
2008-11-17 18:21:41 ----A---- C:\WINDOWS\system32\dxdiagn.dll
2008-11-17 18:21:41 ----A---- C:\WINDOWS\system32\dxdiag.exe
2008-11-17 18:21:41 ----A---- C:\WINDOWS\system32\dx8vb.dll
2008-11-17 18:21:41 ----A---- C:\WINDOWS\system32\dx7vb.dll
2008-11-17 18:21:41 ----A---- C:\WINDOWS\system32\dwwin.exe
2008-11-17 18:21:41 ----A---- C:\WINDOWS\system32\dvdupgrd.exe
2008-11-17 18:21:41 ----A---- C:\WINDOWS\system32\duser.dll
2008-11-17 18:21:41 ----A---- C:\WINDOWS\system32\dumprep.exe
2008-11-17 18:21:41 ----A---- C:\WINDOWS\system32\dswave.dll
2008-11-17 18:21:41 ----A---- C:\WINDOWS\system32\dsuiext.dll
2008-11-17 18:21:40 ----A---- C:\WINDOWS\system32\dssenh.dll
2008-11-17 18:21:40 ----A---- C:\WINDOWS\system32\dssec.dll
2008-11-17 18:21:40 ----A---- C:\WINDOWS\system32\dsquery.dll
2008-11-17 18:21:40 ----A---- C:\WINDOWS\system32\dsprpres.dll
2008-11-17 18:21:40 ----A---- C:\WINDOWS\system32\dsprop.dll
2008-11-17 18:21:40 ----A---- C:\WINDOWS\system32\dsound3d.dll
2008-11-17 18:21:40 ----A---- C:\WINDOWS\system32\dsound.dll
2008-11-17 18:21:40 ----A---- C:\WINDOWS\system32\dskquoui.dll
2008-11-17 18:21:40 ----A---- C:\WINDOWS\system32\dskquota.dll
2008-11-17 18:21:40 ----A---- C:\WINDOWS\system32\dsdmoprp.dll
2008-11-17 18:21:40 ----A---- C:\WINDOWS\system32\dsdmo.dll
2008-11-17 18:21:40 ----A---- C:\WINDOWS\system32\dsauth.dll
2008-11-17 18:21:40 ----A---- C:\WINDOWS\system32\ds32gt.dll
2008-11-17 18:21:40 ----A---- C:\WINDOWS\system32\ds16gt.dLL
2008-11-17 18:21:40 ----A---- C:\WINDOWS\system32\drwtsn32.exe
2008-11-17 18:21:40 ----A---- C:\WINDOWS\system32\drwatson.exe
2008-11-17 18:21:39 ----A---- C:\WINDOWS\system32\drprov.dll
2008-11-17 18:21:39 ----A---- C:\WINDOWS\system32\driverquery.exe
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dpwsockx.dll
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dpwsock.dll
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dpvvox.dll
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dpvsetup.exe
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dpvoice.dll
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dpvacm.dll
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dpserial.dll
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dpnwsock.dll
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dpnsvr.exe
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dpnmodem.dll
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dpnlobby.dll
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dpnhupnp.dll
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dpnhpast.dll
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dpnet.dll
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dpnaddr.dll
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dpmodemx.dll
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dplayx.dll
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dplaysvr.exe
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dplay.dll
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dpcdll.dll
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\dosx.exe
2008-11-17 18:21:02 ----A---- C:\WINDOWS\system32\doskey.exe
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\docprop2.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\docprop.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dnsrslvr.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dnsapi.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dmusic.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dmsynth.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dmstyle.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dmserver.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dmscript.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dmremote.exe
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dmocx.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dmloader.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dmintf.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dmime.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dmdskres.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dmdskmgr.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dmdlgs.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dmconfig.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dmcompos.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dmband.dll
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dmadmin.exe
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dllhst3g.exe
2008-11-17 18:21:01 ----A---- C:\WINDOWS\system32\dllhost.exe
2008-11-17 18:20:59 ----A---- C:\WINDOWS\system32\dispex.dll
2008-11-17 18:20:59 ----A---- C:\WINDOWS\system32\diskperf.exe
2008-11-17 18:20:59 ----A---- C:\WINDOWS\system32\diskpart.exe
2008-11-17 18:20:59 ----A---- C:\WINDOWS\system32\diskmgmt.msc
2008-11-17 18:20:58 ----A---- C:\WINDOWS\system32\diskcopy.dll
2008-11-17 18:20:58 ----A---- C:\WINDOWS\system32\diskcopy.com
2008-11-17 18:20:58 ----A---- C:\WINDOWS\system32\diskcomp.com
2008-11-17 18:20:58 ----A---- C:\WINDOWS\system32\dinput8.dll
2008-11-17 18:20:58 ----A---- C:\WINDOWS\system32\dinput.dll
2008-11-17 18:20:58 ----A---- C:\WINDOWS\system32\dimap.dll
2008-11-17 18:20:57 ----A---- C:\WINDOWS\system32\digest.dll
2008-11-17 18:20:57 ----A---- C:\WINDOWS\system32\diantz.exe
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\diactfrm.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\dhcpsapi.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\dhcpmon.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\dhcpcsvc.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\dgsetup.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\dgnet.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\dfsshlex.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\dfrgui.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\dfrgsnap.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\dfrgres.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\dfrgntfs.exe
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\dfrgfat.exe
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\dfrg.msc
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\devmgr.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\devmgmt.msc
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\devenum.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\deskperf.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\deskmon.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\deskadp.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\defrag.exe
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\debug.exe
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\ddrawex.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\ddraw.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\ddeshare.exe
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\ddeml.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\dciman32.dll
2008-11-17 18:20:56 ----A---- C:\WINDOWS\system32\dbnmpntw.dll
2008-11-17 18:20:55 ----A---- C:\WINDOWS\system32\dbnetlib.dll
2008-11-17 18:20:55 ----A---- C:\WINDOWS\system32\dbmsrpcn.dll
2008-11-17 18:20:55 ----A---- C:\WINDOWS\system32\dbghelp.dll
2008-11-17 18:20:55 ----A---- C:\WINDOWS\system32\dbgeng.dll
2008-11-17 18:20:54 ----A---- C:\WINDOWS\system32\davclnt.dll
2008-11-17 18:20:54 ----A---- C:\WINDOWS\system32\datime.dll
2008-11-17 18:20:54 ----A---- C:\WINDOWS\system32\dataclen.dll
2008-11-17 18:20:54 ----A---- C:\WINDOWS\system32\danim.dll
2008-11-17 18:20:54 ----A---- C:\WINDOWS\system32\d3dxof.dll
2008-11-17 18:20:54 ----A---- C:\WINDOWS\system32\d3drm.dll
2008-11-17 18:20:54 ----A---- C:\WINDOWS\system32\d3dramp.dll
2008-11-17 18:20:54 ----A---- C:\WINDOWS\system32\d3dpmesh.dll
2008-11-17 18:20:54 ----A---- C:\WINDOWS\system32\d3dim700.dll
2008-11-17 18:20:54 ----A---- C:\WINDOWS\system32\d3dim.dll
2008-11-17 18:20:53 ----A---- C:\WINDOWS\system32\d3d9.dll
2008-11-17 18:20:53 ----A---- C:\WINDOWS\system32\d3d8thk.dll
2008-11-17 18:20:53 ----A---- C:\WINDOWS\system32\d3d8.dll
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\ctl3dv2.dll
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\ctl3d32.dll
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\ctfmon.exe
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\csseqchk.dll
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\csrss.exe
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\csrsrv.dll
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\cscui.dll
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\cscript.exe
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\cscdll.dll
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\cryptui.dll
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\cryptsvc.dll
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\cryptnet.dll
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\cryptext.dll
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\cryptdll.dll
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\cryptdlg.dll
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\crypt32.dll
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\crtdll.dll
2008-11-17 18:20:51 ----A---- C:\WINDOWS\system32\credui.dll
2008-11-17 18:20:49 ----A---- C:\WINDOWS\system32\corpol.dll
2008-11-17 18:20:49 ----A---- C:\WINDOWS\system32\convert.exe
2008-11-17 18:20:49 ----A---- C:\WINDOWS\system32\control.exe
2008-11-17 18:20:49 ----A---- C:\WINDOWS\system32\console.dll
2008-11-17 18:20:49 ----A---- C:\WINDOWS\system32\conime.exe
2008-11-17 18:20:49 ----A---- C:\WINDOWS\system32\confmsp.dll
2008-11-17 18:20:48 ----A---- C:\WINDOWS\system32\comuid.dll
2008-11-17 18:20:48 ----A---- C:\WINDOWS\system32\comsvcs.dll
2008-11-17 18:20:48 ----A---- C:\WINDOWS\system32\comsnap.dll
2008-11-17 18:20:48 ----A---- C:\WINDOWS\system32\comres.dll
2008-11-17 18:20:48 ----A---- C:\WINDOWS\system32\comrepl.dll
2008-11-17 18:20:48 ----A---- C:\WINDOWS\system32\compstui.dll
2008-11-17 18:20:48 ----A---- C:\WINDOWS\system32\compobj.dll
2008-11-17 18:20:48 ----A---- C:\WINDOWS\system32\compmgmt.msc
2008-11-17 18:20:44 ----A---- C:\WINDOWS\system32\compatui.dll
2008-11-17 18:20:44 ----A---- C:\WINDOWS\system32\compact.exe
2008-11-17 18:20:44 ----A---- C:\WINDOWS\system32\comp.exe
2008-11-17 18:20:44 ----A---- C:\WINDOWS\system32\commdlg.dll
2008-11-17 18:20:44 ----A---- C:\WINDOWS\system32\command.com
2008-11-17 18:20:43 ----A---- C:\WINDOWS\system32\comdlg32.dll
2008-11-17 18:20:43 ----A---- C:\WINDOWS\system32\comctl32.dll
2008-11-17 18:20:43 ----A---- C:\WINDOWS\system32\comcat.dll
2008-11-17 18:20:43 ----A---- C:\WINDOWS\system32\comaddin.dll
2008-11-17 18:20:43 ----A---- C:\WINDOWS\system32\colbact.dll
2008-11-17 18:20:43 ----A---- C:\WINDOWS\system32\cnvfat.dll
2008-11-17 18:20:43 ----A---- C:\WINDOWS\system32\cnetcfg.dll
2008-11-17 18:20:43 ----A---- C:\WINDOWS\system32\cmutil.dll
2008-11-17 18:20:43 ----A---- C:\WINDOWS\system32\cmstp.exe
2008-11-17 18:20:43 ----A---- C:\WINDOWS\system32\cmsetacl.dll
2008-11-17 18:20:43 ----A---- C:\WINDOWS\system32\cmprops.dll
2008-11-17 18:20:43 ----A---- C:\WINDOWS\system32\cmpbk32.dll
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\shellstyle.dll
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\cmmon32.exe
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\cmdl32.exe
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\cmdial32.dll
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\cmd.exe
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\cmcfg32.dll
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\clusapi.dll
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\clipsrv.exe
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\clipbrd.exe
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\cliconfg.exe
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\cliconfg.dll
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\cleanmgr.exe
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\clbcatq.dll
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\clbcatex.dll
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\clb.dll
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\ckcnv.exe
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\cisvc.exe
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\cipher.exe
2008-11-17 18:20:42 ----A---- C:\WINDOWS\system32\ciodm.dll
2008-11-17 18:20:41 ----A---- C:\WINDOWS\system32\cidaemon.exe
2008-11-17 18:20:41 ----A---- C:\WINDOWS\system32\cic.dll
2008-11-17 18:20:41 ----A---- C:\WINDOWS\system32\ciadv.msc
2008-11-17 18:20:41 ----A---- C:\WINDOWS\system32\ciadmin.dll
2008-11-17 18:20:41 ----A---- C:\WINDOWS\system32\chkntfs.exe
2008-11-17 18:20:41 ----A---- C:\WINDOWS\system32\chkdsk.exe
2008-11-17 18:20:41 ----A---- C:\WINDOWS\system32\chcp.com
2008-11-17 18:20:41 ----A---- C:\WINDOWS\system32\charmap.exe
2008-11-17 18:20:41 ----A---- C:\WINDOWS\system32\cfgmgr32.dll
2008-11-17 18:20:41 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2008-11-17 18:20:40 ----A---- C:\WINDOWS\system32\certmgr.msc
2008-11-17 18:20:40 ----A---- C:\WINDOWS\system32\certmgr.dll
2008-11-17 18:20:40 ----A---- C:\WINDOWS\system32\certcli.dll
2008-11-17 18:20:40 ----A---- C:\WINDOWS\system32\cdosys.dll
2008-11-17 18:20:40 ----A---- C:\WINDOWS\system32\cdmodem.dll
2008-11-17 18:20:40 ----A---- C:\WINDOWS\system32\cdm.dll
2008-11-17 18:20:40 ----A---- C:\WINDOWS\system32\cdfview.dll
2008-11-17 18:20:40 ----A---- C:\WINDOWS\system32\ccfgnt.dll
2008-11-17 18:20:40 ----A---- C:\WINDOWS\system32\catsrvut.dll
2008-11-17 18:20:40 ----A---- C:\WINDOWS\system32\catsrvps.dll
2008-11-17 18:20:40 ----A---- C:\WINDOWS\system32\catsrv.dll
2008-11-17 18:20:39 ----A---- C:\WINDOWS\system32\cards.dll
2008-11-17 18:20:39 ----A---- C:\WINDOWS\system32\capesnpn.dll
2008-11-17 18:20:39 ----A---- C:\WINDOWS\system32\camocx.dll
2008-11-17 18:20:39 ----A---- C:\WINDOWS\system32\calc.exe
2008-11-17 18:20:39 ----A---- C:\WINDOWS\system32\cacls.exe
2008-11-17 18:20:39 ----A---- C:\WINDOWS\system32\cabview.dll
2008-11-17 18:20:39 ----A---- C:\WINDOWS\system32\cabinet.dll
2008-11-17 18:20:39 ----A---- C:\WINDOWS\system32\btpanui.dll
2008-11-17 18:20:39 ----A---- C:\WINDOWS\system32\bthserv.dll
2008-11-17 18:20:39 ----A---- C:\WINDOWS\system32\bthci.dll
2008-11-17 18:20:39 ----A---- C:\WINDOWS\system32\browsewm.dll
2008-11-17 18:20:38 ----A---- C:\WINDOWS\system32\browseui.dll
2008-11-17 18:20:38 ----A---- C:\WINDOWS\system32\browser.dll
2008-11-17 18:20:38 ----A---- C:\WINDOWS\system32\browselc.dll
2008-11-17 18:20:37 ----A---- C:\WINDOWS\system32\bootvrfy.exe
2008-11-17 18:20:37 ----A---- C:\WINDOWS\system32\bootvid.dll
2008-11-17 18:20:37 ----A---- C:\WINDOWS\system32\bootok.exe
2008-11-17 18:20:37 ----A---- C:\WINDOWS\system32\bootcfg.exe
2008-11-17 18:20:37 ----A---- C:\WINDOWS\system32\blastcln.exe
2008-11-17 18:20:37 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2008-11-17 18:20:37 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2008-11-17 18:20:37 ----A---- C:\WINDOWS\system32\bidispl.dll
2008-11-17 18:20:36 ----A---- C:\WINDOWS\system32\batt.dll
2008-11-17 18:20:36 ----A---- C:\WINDOWS\system32\batmeter.dll
2008-11-17 18:20:36 ----A---- C:\WINDOWS\system32\basesrv.dll
2008-11-17 18:20:36 ----A---- C:\WINDOWS\system32\avwav.dll
2008-11-17 18:20:36 ----A---- C:\WINDOWS\system32\avtapi.dll
2008-11-17 18:20:36 ----A---- C:\WINDOWS\system32\avmeter.dll
2008-11-17 18:20:36 ----A---- C:\WINDOWS\system32\avifile.dll
2008-11-17 18:20:36 ----A---- C:\WINDOWS\system32\avifil32.dll
2008-11-17 18:20:36 ----A---- C:\WINDOWS\system32\avicap32.dll
2008-11-17 18:20:36 ----A---- C:\WINDOWS\system32\avicap.dll
2008-11-17 18:20:36 ----A---- C:\WINDOWS\system32\autolfn.exe
2008-11-17 18:20:35 ----A---- C:\WINDOWS\system32\autofmt.exe
2008-11-17 18:20:35 ----A---- C:\WINDOWS\system32\autodisc.dll
2008-11-17 18:20:35 ----A---- C:\WINDOWS\system32\autoconv.exe
2008-11-17 18:20:35 ----A---- C:\WINDOWS\system32\autochk.exe
2008-11-17 18:20:35 ----A---- C:\WINDOWS\system32\authz.dll
2008-11-17 18:20:35 ----A---- C:\WINDOWS\system32\auditusr.exe
2008-11-17 18:20:35 ----A---- C:\WINDOWS\system32\audiosrv.dll
2008-11-17 18:20:35 ----A---- C:\WINDOWS\system32\attrib.exe
2008-11-17 18:20:35 ----A---- C:\WINDOWS\system32\atrace.dll
2008-11-17 18:20:34 ----A---- C:\WINDOWS\system32\atmpvcno.dll
2008-11-17 18:20:34 ----A---- C:\WINDOWS\system32\atmlib.dll
2008-11-17 18:20:34 ----A---- C:\WINDOWS\system32\atmfd.dll
2008-11-17 18:20:34 ----A---- C:\WINDOWS\system32\atmadm.exe
2008-11-17 18:20:34 ----A---- C:\WINDOWS\system32\atl.dll
2008-11-17 18:20:34 ----A---- C:\WINDOWS\system32\atkctrs.dll
2008-11-17 18:20:34 ----A---- C:\WINDOWS\system32\at.exe
2008-11-17 18:20:34 ----A---- C:\WINDOWS\system32\asycfilt.dll
2008-11-17 18:20:34 ----A---- C:\WINDOWS\system32\asr_pfu.exe
2008-11-17 18:20:34 ----A---- C:\WINDOWS\system32\asr_ldm.exe
2008-11-17 18:20:34 ----A---- C:\WINDOWS\system32\asr_fmt.exe
2008-11-17 18:20:23 ----A---- C:\WINDOWS\system32\arp.exe
2008-11-17 18:20:22 ----A---- C:\WINDOWS\system32\appmgr.dll
2008-11-17 18:20:22 ----A---- C:\WINDOWS\system32\appmgmts.dll
2008-11-17 18:20:22 ----A---- C:\WINDOWS\system32\apphelp.dll
2008-11-17 18:20:22 ----A---- C:\WINDOWS\system32\append.exe
2008-11-17 18:20:22 ----A---- C:\WINDOWS\system32\apcups.dll
2008-11-17 18:20:21 ----A---- C:\WINDOWS\system32\amstream.dll
2008-11-17 18:20:21 ----A---- C:\WINDOWS\system32\alrsvc.dll
2008-11-17 18:20:21 ----A---- C:\WINDOWS\system32\alg.exe
2008-11-17 18:20:21 ----A---- C:\WINDOWS\system32\ahui.exe
2008-11-17 18:20:21 ----A---- C:\WINDOWS\system32\advpack.dll
2008-11-17 18:20:20 ----A---- C:\WINDOWS\system32\advapi32.dll
2008-11-17 18:20:20 ----A---- C:\WINDOWS\system32\adsnw.dll
2008-11-17 18:20:20 ----A---- C:\WINDOWS\system32\adsnt.dll
2008-11-17 18:20:20 ----A---- C:\WINDOWS\system32\adsnds.dll
2008-11-17 18:20:20 ----A---- C:\WINDOWS\system32\adsmsext.dll
2008-11-17 18:20:20 ----A---- C:\WINDOWS\system32\adsldpc.dll
2008-11-17 18:20:20 ----A---- C:\WINDOWS\system32\adsldp.dll
2008-11-17 18:20:20 ----A---- C:\WINDOWS\system32\adptif.dll
2008-11-17 18:20:20 ----A---- C:\WINDOWS\system32\admparse.dll
2008-11-17 18:20:20 ----A---- C:\WINDOWS\system32\actxprxy.dll
2008-11-17 18:20:20 ----A---- C:\WINDOWS\system32\actmovie.exe
2008-11-17 18:20:20 ----A---- C:\WINDOWS\system32\activeds.dll
2008-11-17 18:20:19 ----A---- C:\WINDOWS\system32\aclui.dll
2008-11-17 18:20:19 ----A---- C:\WINDOWS\system32\acledit.dll
2008-11-17 18:20:19 ----A---- C:\WINDOWS\system32\accwiz.exe
2008-11-17 18:20:19 ----A---- C:\WINDOWS\system32\acctres.dll
2008-11-17 18:20:19 ----A---- C:\WINDOWS\system32\aaaamon.dll
2008-11-17 18:20:19 ----A---- C:\WINDOWS\system32\6to4svc.dll
2008-11-17 18:11:43 ----D---- C:\McGee Lifeworks Library
2008-11-17 18:10:02 ----D---- C:\Joel's Files
2008-11-17 18:05:19 ----D---- C:\Images
2008-11-17 17:52:01 ----D---- C:\Evelyn
2008-11-17 17:50:26 ----A---- C:\WINDOWS\system32\msxml6r.dll
2008-11-17 17:50:26 ----A---- C:\WINDOWS\system32\msxml6.dll
2008-11-17 17:50:05 ----D---- C:\CCBD
2008-11-17 17:50:01 ----D---- C:\CAVS
2008-11-17 17:49:57 ----D---- C:\Aero Scholarship Proposal
2008-11-17 17:49:56 ----D---- C:\A-CITS
2008-11-17 17:49:35 ----A---- C:\WINDOWS\system32\comsdupd.exe
2008-11-17 17:49:34 ----A---- C:\WINDOWS\system32\smtpapi.dll
2008-11-17 17:49:34 ----A---- C:\WINDOWS\system32\rwnh.dll
2008-11-17 17:49:24 ----A---- C:\WINDOWS\system32\ati3d1ag.dll
2008-11-17 17:49:24 ----A---- C:\WINDOWS\system32\ati2dvag.dll
2008-11-17 17:49:24 ----A---- C:\WINDOWS\system32\ati2dvaa.dll
2008-11-17 17:49:24 ----A---- C:\WINDOWS\system32\ati2cqag.dll
2008-11-17 17:49:24 ----A---- C:\WINDOWS\system32\aaclient.dll
2008-11-17 17:49:23 ----A---- C:\WINDOWS\system32\azroles.dll
2008-11-17 17:49:23 ----A---- C:\WINDOWS\system32\ativvaxx.dll
2008-11-17 17:49:23 ----A---- C:\WINDOWS\system32\ativtmxx.dll
2008-11-17 17:49:23 ----A---- C:\WINDOWS\system32\ati3duag.dll
2008-11-17 17:49:22 ----A---- C:\WINDOWS\system32\credssp.dll
2008-11-17 17:49:22 ----A---- C:\WINDOWS\system32\bitsprx4.dll
2008-11-17 17:49:21 ----A---- C:\WINDOWS\system32\dot3msm.dll
2008-11-17 17:49:21 ----A---- C:\WINDOWS\system32\dot3gpclnt.dll
2008-11-17 17:49:21 ----A---- C:\WINDOWS\system32\dot3dlg.dll
2008-11-17 17:49:21 ----A---- C:\WINDOWS\system32\dot3cfg.dll
2008-11-17 17:49:21 ----A---- C:\WINDOWS\system32\dot3api.dll
2008-11-17 17:49:21 ----A---- C:\WINDOWS\system32\dimsroam.dll
2008-11-17 17:49:21 ----A---- C:\WINDOWS\system32\dimsntfy.dll
2008-11-17 17:49:21 ----A---- C:\WINDOWS\system32\dhcpqec.dll
2008-11-17 17:49:20 ----A---- C:\WINDOWS\system32\dot3ui.dll
2008-11-17 17:49:20 ----A---- C:\WINDOWS\system32\dot3svc.dll
2008-11-17 17:49:19 ----A---- C:\WINDOWS\system32\eappprxy.dll
2008-11-17 17:49:19 ----A---- C:\WINDOWS\system32\eapphost.dll
2008-11-17 17:49:19 ----A---- C:\WINDOWS\system32\eappgnui.dll
2008-11-17 17:49:19 ----A---- C:\WINDOWS\system32\eappcfg.dll
2008-11-17 17:49:19 ----A---- C:\WINDOWS\system32\eapp3hst.dll
2008-11-17 17:49:19 ----A---- C:\WINDOWS\system32\eapolqec.dll
2008-11-17 17:49:18 ----A---- C:\WINDOWS\system32\eapsvc.dll
2008-11-17 17:49:18 ----A---- C:\WINDOWS\system32\eapqec.dll
2008-11-17 17:49:16 ----A---- C:\WINDOWS\system32\hsfcisp2.dll
2008-11-17 17:49:14 ----A---- C:\WINDOWS\system32\l2gpstore.dll
2008-11-17 17:49:14 ----A---- C:\WINDOWS\system32\kmsvc.dll
2008-11-17 17:49:14 ----A---- C:\WINDOWS\system32\kbdpash.dll
2008-11-17 17:49:14 ----A---- C:\WINDOWS\system32\kbdnepr.dll
2008-11-17 17:49:14 ----A---- C:\WINDOWS\system32\kbdiultn.dll
2008-11-17 17:49:14 ----A---- C:\WINDOWS\system32\kbdbhc.dll
2008-11-17 17:49:13 ----A---- C:\WINDOWS\system32\microsoft.managementconsole.dll
2008-11-17 17:49:12 ----A---- C:\WINDOWS\system32\mmcperf.exe
2008-11-17 17:49:12 ----A---- C:\WINDOWS\system32\mmcfxcommon.dll
2008-11-17 17:49:12 ----A---- C:\WINDOWS\system32\mmcex.dll
2008-11-17 17:49:11 ----A---- C:\WINDOWS\system32\mssha.dll
2008-11-17 17:49:10 ----A---- C:\WINDOWS\system32\napipsec.dll
2008-11-17 17:49:10 ----A---- C:\WINDOWS\system32\mtxparhd.dll
2008-11-17 17:49:10 ----A---- C:\WINDOWS\system32\msshavmsg.dll
2008-11-17 17:49:09 ----A---- C:\WINDOWS\system32\napstat.exe
2008-11-17 17:49:09 ----A---- C:\WINDOWS\system32\napmontr.dll
2008-11-17 17:49:08 ----A---- C:\WINDOWS\system32\onex.dll
2008-11-17 17:49:08 ----A---- C:\WINDOWS\system32\nv4_disp.dll
2008-11-17 17:49:07 ----A---- C:\WINDOWS\system32\rhttpaa.dll
2008-11-17 17:49:07 ----A---- C:\WINDOWS\system32\rasqec.dll
2008-11-17 17:49:07 ----A---- C:\WINDOWS\system32\qutil.dll
2008-11-17 17:49:07 ----A---- C:\WINDOWS\system32\qcliprov.dll
2008-11-17 17:49:07 ----A---- C:\WINDOWS\system32\qagentrt.dll
2008-11-17 17:49:07 ----A---- C:\WINDOWS\system32\qagent.dll
2008-11-17 17:49:07 ----A---- C:\WINDOWS\system32\photometadatahandler.dll
2008-11-17 17:49:06 ----A---- C:\WINDOWS\system32\slgen.dll
2008-11-17 17:49:06 ----A---- C:\WINDOWS\system32\slextspk.dll
2008-11-17 17:49:06 ----A---- C:\WINDOWS\system32\slcoinst.dll
2008-11-17 17:49:06 ----A---- C:\WINDOWS\system32\setupn.exe
2008-11-17 17:49:06 ----A---- C:\WINDOWS\system32\s3gnb.dll
2008-11-17 17:49:05 ----A---- C:\WINDOWS\system32\slserv.exe
2008-11-17 17:49:05 ----A---- C:\WINDOWS\system32\slrundll.exe
2008-11-17 17:49:04 ----A---- C:\WINDOWS\system32\verclsid.exe
2008-11-17 17:49:04 ----A---- C:\WINDOWS\system32\tzchange.exe
2008-11-17 17:49:04 ----A---- C:\WINDOWS\system32\tspkg.dll
2008-11-17 17:49:04 ----A---- C:\WINDOWS\system32\tsgqec.dll
2008-11-17 17:49:03 ----A---- C:\WINDOWS\system32\windowscodecs.dll
2008-11-17 17:49:02 ----A---- C:\WINDOWS\system32\wlanapi.dll
2008-11-17 17:49:02 ----A---- C:\WINDOWS\system32\windowscodecsext.dll
2008-11-17 17:49:01 ----A---- C:\WINDOWS\system32\xmllite.dll
2008-11-17 17:49:01 ----A---- C:\WINDOWS\system32\wmphoto.dll
2008-11-17 17:48:59 ----N---- C:\WINDOWS\slrundll.exe
2008-11-17 17:48:59 ----D---- C:\WINDOWS\system32\en-us
2008-11-17 17:48:56 ----D---- C:\WINDOWS\system32\scripting
2008-11-17 17:48:55 ----D---- C:\WINDOWS\l2schemas
2008-11-17 17:48:54 ----D---- C:\WINDOWS\system32\en
2008-11-17 17:48:53 ----D---- C:\WINDOWS\system32\bits
2008-11-17 17:41:49 ----D---- C:\WINDOWS\ServicePackFiles
2008-11-17 17:39:01 ----D---- C:\WINDOWS\network diagnostic
2008-11-17 17:38:02 ----A---- C:\WINDOWS\003097_.tmp
2008-11-17 17:37:42 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2008-11-17 17:35:43 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2008-11-17 17:33:37 ----D---- C:\Backup
2008-11-17 17:30:17 ----D---- C:\Documents and Settings\Owner.YOUR-449DE6425B\Application Data\U3
2008-11-17 17:29:55 ----D---- C:\WINDOWS\system32\SoftwareDistribution
======List of files/folders modified in the last 1 months======
2008-11-27 11:16:53 ----D---- C:\WINDOWS\Temp
2008-11-27 11:15:03 ----RD---- C:\Program Files
2008-11-27 09:45:02 ----SD---- C:\WINDOWS\Tasks
2008-11-27 09:45:02 ----A---- C:\WINDOWS\setuplog.txt
2008-11-25 17:42:25 ----D---- C:\WINDOWS
2008-11-25 15:41:01 ----SHD---- C:\WINDOWS\Installer
2008-11-25 15:40:58 ----D---- C:\WINDOWS\system32
2008-11-23 16:26:50 ----D---- C:\WINDOWS\system32\CatRoot2
2008-11-22 14:39:52 ----D---- C:\WINDOWS\system32\drivers
2008-11-22 13:58:09 ----D---- C:\Program Files\Common Files
2008-11-22 13:37:37 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-11-20 16:09:41 ----D---- C:\WINDOWS\WinSxS
2008-11-20 16:08:40 ----RSD---- C:\WINDOWS\Fonts
2008-11-19 19:35:58 ----A---- C:\WINDOWS\win.ini
2008-11-19 19:35:21 ----D---- C:\Program Files\Common Files\Microsoft Shared
2008-11-19 19:34:41 ----HD---- C:\WINDOWS\ShellNew
2008-11-19 19:34:22 ----D---- C:\Program Files\Common Files\System
2008-11-19 19:31:01 ----D---- C:\WINDOWS\system
2008-11-19 19:14:34 ----D---- C:\WINDOWS\Help
2008-11-19 19:05:05 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-11-19 11:01:12 ----HD---- C:\WINDOWS\inf
2008-11-19 11:00:59 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-11-19 10:46:45 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-11-18 22:02:26 ----D---- C:\Documents and Settings
2008-11-18 19:45:34 ----D---- C:\Program Files\Internet Explorer
2008-11-18 15:14:43 ----D---- C:\WINDOWS\system32\CatRoot
2008-11-18 15:13:56 ----A---- C:\WINDOWS\imsins.BAK
2008-11-18 15:12:55 ----D---- C:\WINDOWS\system32\config
2008-11-18 15:12:39 ----D---- C:\WINDOWS\Media
2008-11-18 15:07:40 ----D---- C:\WINDOWS\Debug
2008-11-18 13:36:35 ----D---- C:\Program Files\Messenger
2008-11-18 10:41:31 ----A---- C:\WINDOWS\OEWABLog.txt
2008-11-18 10:39:52 ----D---- C:\WINDOWS\system32\Setup
2008-11-18 10:39:52 ----D---- C:\WINDOWS\ime
2008-11-18 10:39:51 ----D---- C:\WINDOWS\system32\wbem
2008-11-18 10:39:51 ----D---- C:\WINDOWS\AppPatch
2008-11-18 10:39:12 ----D---- C:\WINDOWS\security
2008-11-17 19:19:05 ----D---- C:\WINDOWS\Registration
2008-11-17 19:14:05 ----D---- C:\WINDOWS\OPTIONS
2008-11-17 19:08:47 ----A---- C:\WINDOWS\system32\emver.ini
2008-11-17 19:02:38 ----D---- C:\WINDOWS\RegisteredPackages
2008-11-17 18:43:32 ----A---- C:\WINDOWS\system.ini
2008-11-17 18:39:45 ----D---- C:\Program Files\Common Files\Services
2008-11-17 18:39:43 ----D---- C:\WINDOWS\twain_32
2008-11-17 18:38:04 ----D---- C:\WINDOWS\system32\ras
2008-11-17 18:37:39 ----D---- C:\WINDOWS\system32\icsxml
2008-11-17 18:37:39 ----D---- C:\WINDOWS\system32\ias
2008-11-17 18:36:37 ----D---- C:\WINDOWS\system32\1033
2008-11-17 18:36:28 ----RD---- C:\WINDOWS\Web
2008-11-17 18:36:03 ----D---- C:\WINDOWS\Cursors
2008-11-17 18:35:56 ----SHD---- C:\System Recovery
2008-11-17 18:35:56 ----D---- C:\Program Files\xerox
2008-11-17 18:35:55 ----D---- C:\Program Files\Online Services
2008-11-17 18:35:55 ----D---- C:\Program Files\MSN Gaming Zone
2008-11-17 18:35:55 ----D---- C:\Program Files\MSN
2008-11-17 18:35:55 ----D---- C:\Program Files\microsoft frontpage
2008-11-17 18:35:49 ----D---- C:\Program Files\Common Files\SpeechEngines
2008-11-17 18:35:49 ----D---- C:\Program Files\Common Files\ODBC
2008-11-17 18:35:49 ----D---- C:\Program Files\Common Files\MSSoap
2008-11-17 18:35:47 ----D---- C:\Drivers
2008-11-17 18:35:21 ----D---- C:\CMPNENTS
2008-11-17 18:34:53 ----D---- C:\WINDOWS\pchealth
2008-11-17 18:34:53 ----D---- C:\WINDOWS\msapps
2008-11-17 18:34:36 ----RSD---- C:\WINDOWS\assembly
2008-11-17 18:34:34 ----D---- C:\WINDOWS\Resources
2008-11-17 18:34:31 ----D---- C:\WINDOWS\Provisioning
2008-11-17 18:34:30 ----RD---- C:\WINDOWS\Offline Web Pages
2008-11-17 18:34:19 ----D---- C:\WINDOWS\Microsoft.Net
2008-11-17 18:34:18 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-11-17 18:34:18 ----D---- C:\WINDOWS\Driver Cache
2008-11-17 18:34:15 ----D---- C:\WINDOWS\system32\spool
2008-11-17 18:34:15 ----D---- C:\WINDOWS\system32\mui
2008-11-17 18:34:12 ----D---- C:\WINDOWS\system32\URTTemp
2008-11-17 18:34:11 ----SD---- C:\WINDOWS\system32\Microsoft
2008-11-17 18:34:11 ----D---- C:\WINDOWS\system32\MsDtc
2008-11-17 18:34:11 ----D---- C:\WINDOWS\system32\Macromed
2008-11-17 18:34:11 ----D---- C:\WINDOWS\system32\IME
2008-11-17 18:34:11 ----D---- C:\WINDOWS\system32\DirectX
2008-11-17 18:34:08 ----D---- C:\WINDOWS\java
2008-11-17 17:50:09 ----D---- C:\Program Files\Windows Journal
2008-11-17 17:49:32 ----D---- C:\WINDOWS\system32\inetsrv
2008-11-17 17:48:59 ----D---- C:\WINDOWS\system32\usmt
2008-11-17 17:48:53 ----D---- C:\WINDOWS\PeerNet
2008-11-17 17:48:52 ----D---- C:\Program Files\Movie Maker
2008-11-17 17:41:24 ----D---- C:\WINDOWS\system32\Restore
2008-11-17 17:41:24 ----D---- C:\WINDOWS\system32\npp
2008-11-17 17:41:24 ----D---- C:\WINDOWS\mui
2008-11-17 17:41:21 ----D---- C:\WINDOWS\msagent
2008-11-17 17:41:17 ----D---- C:\WINDOWS\srchasst
2008-11-17 17:41:14 ----D---- C:\Program Files\NetMeeting
2008-11-17 17:41:12 ----D---- C:\WINDOWS\system32\Com
2008-11-17 17:41:08 ----D---- C:\Program Files\Windows Media Player
2008-11-17 17:41:06 ----D---- C:\Program Files\Windows NT
2008-11-17 17:41:06 ----D---- C:\Program Files\Outlook Express
2008-11-17 17:40:29 ----D---- C:\WINDOWS\system32\oobe
2008-11-17 17:35:40 ----D---- C:\WINDOWS\ehome
2008-11-17 17:29:59 ----D---- C:\WINDOWS\SoftwareDistribution
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 Cdr4_xp;Cdr4_xp; C:\WINDOWS\system32\drivers\Cdr4_xp.sys [2004-11-10 44288]
R1 Cdralw2k;Cdralw2k; C:\WINDOWS\system32\drivers\Cdralw2k.sys [2004-11-10 24832]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys []
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 SRTSP;SRTSP; C:\WINDOWS\System32\Drivers\SRTSP.SYS [2007-11-30 279088]
R1 SRTSPX;SRTSPX; C:\WINDOWS\System32\Drivers\SRTSPX.SYS [2007-11-30 43696]
R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2008-06-13 184240]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.1.6.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2008-11-17 17119]
R2 CO_Mon;CO_Mon; \??\C:\WINDOWS\system32\drivers\CO_Mon.sys []
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-03-17 13059]
R2 s24trans;WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2004-10-15 11354]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2005-04-05 132352]
R3 CAMCAUD;Conexant AMC Audio; C:\WINDOWS\system32\drivers\camc6aud.sys [2005-06-17 38144]
R3 CAMCHALA;CAMCHALA; C:\WINDOWS\system32\drivers\camc6hal.sys [2005-06-17 352000]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-14 13952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 FinePnt;FinePoint Innovations HID Driver; C:\WINDOWS\system32\DRIVERS\FpHidDrv.sys [2005-07-06 17280]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2005-01-25 1038208]
R3 HSFHWICH;HSFHWICH; C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys [2005-01-25 207616]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-05-13 827196]
R3 IWCA;Intel Wireless Connection Agent Miniport for Win XP; C:\WINDOWS\system32\DRIVERS\iwca.sys [2004-08-12 234496]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 MSTabBtn;Tablet PC Buttons HID Driver; C:\WINDOWS\system32\DRIVERS\MSTabBtn.sys [2005-07-26 9600]
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081126.025\NAVENG.SYS []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081126.025\NAVEX15.SYS []
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-14 79232]
R3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2008-06-13 13616]
R3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS []
R3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2008-06-13 96432]
R3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2008-06-13 38576]
R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\ipsdefs\20081126.002\SymIDSCo.sys []
R3 SymIMMP;SymIMMP; C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-06-13 31280]
R3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2008-06-13 37424]
R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2008-06-13 22320]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2004-11-05 185824]
R3 tifm21;tifm21; C:\WINDOWS\system32\drivers\tifm21.sys [2005-04-19 159488]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 w29n51;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows XP; C:\WINDOWS\system32\DRIVERS\w29n51.sys [2004-10-29 3222784]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2005-01-25 703616]
S3 COH_Mon;COH_Mon; \??\C:\WINDOWS\system32\Drivers\COH_Mon.sys []
S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver; C:\WINDOWS\system32\DRIVERS\el575nd5.sys [2001-08-17 69692]
S3 SRTSPL;SRTSPL; C:\WINDOWS\System32\Drivers\SRTSPL.SYS [2007-11-30 317616]
S3 SymIM;Symantec Network Security Intermediate Filter Service; C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-06-13 31280]
S3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 wanatw;WAN Miniport (ATW); C:\WINDOWS\system32\DRIVERS\wanatw4.sys [2003-01-10 33588]
S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe [2007-08-31 243064]
R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-10-17 149352]
R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-10-17 149352]
R2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-10-17 149352]
R2 EvtEng;EvtEng; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2004-10-15 86016]
R2 LiveUpdate Notice;LiveUpdate Notice; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-10-17 149352]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 PrismXL;PrismXL; C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS [2008-11-17 196608]
R2 RegSrvc;RegSrvc; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2004-10-15 139264]
R2 S24EventMonitor;Spectrum24 Event Monitor; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2004-10-15 360521]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
R3 Symantec Core LC;Symantec Core LC; C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe [2008-11-18 1251720]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
S3 comHost;COM Host; C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe [2007-08-22 55640]
S3 LiveUpdate;LiveUpdate; C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE [2007-08-23 3192184]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
-----------------EOF-----------------
info.txt log
info.txt logfile of random's system information tool 1.04 2008-11-27 11:17:40
======Uninstall list======
-->"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Acrobat.com-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe -uninstall com.adobe.mauby 4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
Acrobat.com-->MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07}
Adobe AIR-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{00203668-8170-44A0-BE44-B632FA4D780F}
Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 7.0-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70000000000}
Adobe Shockwave Player 11-->C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
Agilix GoBinder Lite-->MsiExec.exe /I{5E71102C-2CEB-4C8B-99D3-D33B9741EEDA}
AppCore-->MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
Ask Toolbar-->"C:\Program Files\AskBarDis\unins000.exe"
ccCommon-->MsiExec.exe /I{B24E05CC-46FF-4787-BBB8-5CD516AFB118}
Component Framework-->MsiExec.exe /I{31478BE1-CDE5-4753-A8B2-F6D4BC1FBE09}
Conexant AC-Link Audio-->C:\Program Files\CONEXANT\CNXT_AUDIO\HXFSETUP.EXE -U -IQTA0610A.INF
Data Fax SoftModem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_8086&DEV_266D&SUBSYS_0610107B\HXFSETUP.EXE -U -Iqta0610m.inf
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
HijackThis 2.0.2-->"C:\Documents and Settings\Owner.YOUR-449DE6425B\Desktop\HijackThis.exe" /uninstall
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Ink Art-->MsiExec.exe /I{1FBEE61B-F90E-4EE3-AE94-FCB8BD6EC443}
Intel(R) Graphics Media Accelerator Driver for Mobile-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV_2792 PCI\VEN_8086&DEV_2592
Intel(R) PROSet/Wireless Software-->C:\WINDOWS\Installer\iProInst.exe
J2SE Runtime Environment 5.0 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150020}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
LiveUpdate (Symantec Corporation)-->MsiExec.exe /x {E80F62FF-5D3C-4A19-8409-9721F2928206} /l*v "C:\Documents and Settings\All Users\Application Data\LuUninstall.LiveUpdate"
LiveUpdate (Symantec Corporation)-->MsiExec.exe /X{E80F62FF-5D3C-4A19-8409-9721F2928206}
mCore-->MsiExec.exe /I{6DE14BE4-6F04-4935-8ABD-A0A19FE2E55A}
mDriver-->MsiExec.exe /I{28DA872A-0848-48CF-B749-19A198157A2A}
mDrWiFi-->MsiExec.exe /I{F6090A17-0967-4A8A-B3C3-422A1B514D49}
mHelp-->MsiExec.exe /I{8C6BB412-D3A8-4AAE-A01B-35B681789D68}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Digital Image Starter Edition 2006-->"C:\Program Files\Common Files\Microsoft Shared\Picture It!\RmvSuite.exe" ADDREMOVE=1 SKU=TRIAL VERSION=11
Microsoft Education Pack for Windows XP Tablet PC Edition-->MsiExec.exe /I{40FFC202-F842-44C7-ACBE-8B0EA690B1A3}
Microsoft Energy Blue Theme Pack-->MsiExec.exe /I{FA7314E7-9428-4866-80A8-762A538444DB}
Microsoft Experience Pack for Tablet PC-->MsiExec.exe /I{C12EB29D-9D64-4ACA-84C2-33D8729AABD3}
Microsoft Ink Crossword-->MsiExec.exe /I{1759CACC-6CF9-4C3C-92C5-39668679AB17}
Microsoft Ink Desktop-->MsiExec.exe /I{0759CACC-6CF9-4C3C-92C5-39668679AB16}
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft Media Transfer-->MsiExec.exe /X{F6C2D09F-6C82-48BB-A9D5-6A0478F52BD6}
Microsoft Money 2005-->C:\Program Files\Microsoft Money 2005\MNYCoreFiles\Setup\uninst.exe /s:120
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office OneNote 2003-->MsiExec.exe /I{91A10409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{91110409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Standard Edition 2003-->MsiExec.exe /I{91120409-6000-11D3-8CFE-0150048383C9}
Microsoft Office XP Professional with FrontPage-->MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9}
Microsoft Snipping Tool 2.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8853C080-7F5C-4020-B663-C57FE29BB858}\setup.exe" -l0x9 -removeonly
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works-->MsiExec.exe /I{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}
mIWA-->MsiExec.exe /I{3E9D596A-61D4-4239-BD19-2DB984D2A16F}
mIWCA-->MsiExec.exe /I{6FFFE74E-3FBD-4E2E-97F9-5E9A2A077626}
mLogView-->MsiExec.exe /I{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}
mMHouse-->MsiExec.exe /I{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}
mPfMgr-->MsiExec.exe /I{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}
mPfWiz-->MsiExec.exe /I{90B0D222-8C21-4B35-9262-53B042F18AF9}
mProSafe-->MsiExec.exe /I{23FB368F-1399-4EAC-817C-4B83ECBE3D83}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
mWlsSafe-->MsiExec.exe /I{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}
mXML-->MsiExec.exe /I{9CC89556-3578-48DD-8408-04E66EBEF401}
mZConfig-->MsiExec.exe /I{94658027-9F16-4509-BBD7-A59FE57C3023}
Napster Burn Engine-->MsiExec.exe /I{8DCE550C-CA43-4E82-92DF-FFC4A48F5BE1}
Napster-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BBBCAE4B-B416-4182-A6F2-438180894A81}\setup.exe" -l0x9
Nero BurnRights-->C:\WINDOWS\UNNeroBurnRights.exe /UNINSTALL
Nero OEM-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
Norton AntiVirus Help-->MsiExec.exe /I{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}
Norton AntiVirus-->MsiExec.exe /X{77FFBA7E-0973-4F39-BBDB-AC2F537578D2}
Norton Confidential Core-->MsiExec.exe /I{55A6283C-638A-4EE0-B491-51118554BDA2}
Norton Internet Security (Symantec Corporation)-->"C:\Program Files\Common Files\Symantec Shared\SymSetup\{C1C185CA-C531-49F5-A6FA-B838405A049D}_15_0_0_60\Setup.exe" /X
Norton Internet Security-->MsiExec.exe /I{C1C185CA-C531-49F5-A6FA-B838405A049D}
Norton Protection Center-->MsiExec.exe /I{62120008-8E1E-4807-860D-A8B48F8552DB}
OpenOffice.org 3.0-->MsiExec.exe /I{F44DA61E-720D-4E79-871F-F6E628B33242}
PL-2303 USB-to-Serial-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Setup.exe" -l0x9 Installed
PowerDVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
QuickTime-->C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log
RealPlayer Basic-->C:\Program Files\Common Files\Real\Update\\rnuninst.exe RealNetworks|RealPlayer|6.0
SeaMonkey (1.1.12)-->C:\WINDOWS\SeaMonkeyUninstall.exe /ua "1.1.12 (en)"
Security Update for Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
SPBBC 32bit-->MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Tablet PC Tutorials for Microsoft Windows XP SP2-->MsiExec.exe /X{0CAD092C-5D1E-48AD-A845-E1EBA9AF1AF8}
Texas Instruments PCIxx21/x515 drivers.-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{612DC38A-B36A-4699-88EB-12C7394DE2FC} /l1033
Update for Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
VanDyke Software SecureFX 2.0-->C:\PROGRA~1\SecureFX\UNINSTAL.EXE C:\PROGRA~1\SecureFX\INSTALL.LOG
Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Player 10-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
WinZip 11.2-->MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240B6}
======Hosts File======
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
======Security center information======
AV: Norton Internet Security
FW: Norton Internet Security
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\PROGRA~1\SecureFX
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 13 Stepping 8, GenuineIntel
"PROCESSOR_REVISION"=0d08
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
-----------------EOF-----------------
Step 1
Malwarebytes' Anti-Malware
Please download Malwarebytes' Anti-Malware (http://www.besttechie.net/tools/mbam-setup.exe) to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to
Update Malwarebytes' Anti-Malware
and Launch Malwarebytes' Anti-Malware
then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply
If you accidently close it, the log file is saved here and will be named like this:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
----------------------------------------------------------- -----------------------------------------------------------
Step 2
Download and Run ComboFix (by sUBs)
Please visit this webpage for instructions for downloading and running ComboFix:
Bleeping Computer ComboFix Tutorial (http://www.bleepingcomputer.com/combofix/how-to-use-combofix)
Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper
----------------------------------------------------------- -----------------------------------------------------------
Step 3
Remove Programs
Older versions of some programs have vulnerabilities that malware can use to infect your system.
Now click Start---Control Panel. Double click Add or Remove Programs (XP) / Programs and Features (Vista) . If any of the following programs are listed there,
click on the program to highlight it, and click on remove.
Adobe Reader 7.0 << See below for updating Adobe
J2SE Runtime Environment 5.0 Update 2
Now close the Control Panel.
----------------------------------------------------------- -----------------------------------------------------------
Step 4
Logs/Information to Post in Reply
Please post the following logs/Information in your reply
MalwareBytes Log
Combofix Log
How are things running now ?
----------------------------------------------------------- -----------------------------------------------------------
Additional Notes
Your Adobe Acrobat Reader is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Adobe Reader is a large program and uses unnecessary space.
If you prefer a smaller program you can get Foxit 2.0 from http://www.foxitsoftware.com/pdf/rd_intro.php << Recommended
There is a newer version of Adobe Acrobat Reader available.
Please go to this link Adobe Acrobat Reader Download Link (http://www.adobe.com/products/acrobat/readstep2.html)
Click Download
On the right Untick Adobe Phototshop Album Starter Edition if you do not wish to include this in the installation.
Click the Continue button
Click Run, and click Run again
Next click the Install Now button and follow the on screen prompts
When the installation is complete go to Add/Remove Programs and uninstall all previous versions.
Malwarebytes' Anti-Malware 1.30
Database version: 1430
Windows 5.1.2600 Service Pack 3
11/27/2008 1:13:56 PM
mbam-log-2008-11-27 (13-13-56).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 132398
Time elapsed: 33 minute(s), 49 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 13
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{b1629d92-afe4-4b23-a39d-b092f1d1bcbf} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b1629d92-afe4-4b23-a39d-b092f1d1bcbf} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b1629d92-afe4-4b23-a39d-b092f1d1bcbf} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winmqx32 (Dialer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSMGR (Trojan.Downloader) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{b1629d92-afe4-4b23-a39d-b092f1d1bcbf} (Trojan.BHO) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Documents and Settings\Owner.YOUR-449DE6425B\Local Settings\Temporary Internet Files\Content.IE5\I3K0Q82K\apstpldr.dll[1].htm (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner.YOUR-449DE6425B\Local Settings\Temporary Internet Files\Content.IE5\IW408XWQ\upd[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{736B8453-93FE-477D-9F4C-E9DBA07C5B6E}\RP18\A0005494.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{736B8453-93FE-477D-9F4C-E9DBA07C5B6E}\RP21\A0005600.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{736B8453-93FE-477D-9F4C-E9DBA07C5B6E}\RP21\A0005601.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{736B8453-93FE-477D-9F4C-E9DBA07C5B6E}\RP21\A0005602.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{736B8453-93FE-477D-9F4C-E9DBA07C5B6E}\RP21\A0005603.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{736B8453-93FE-477D-9F4C-E9DBA07C5B6E}\RP21\A0005611.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{736B8453-93FE-477D-9F4C-E9DBA07C5B6E}\RP21\A0005613.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{736B8453-93FE-477D-9F4C-E9DBA07C5B6E}\RP21\A0005616.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{736B8453-93FE-477D-9F4C-E9DBA07C5B6E}\RP21\A0005626.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{736B8453-93FE-477D-9F4C-E9DBA07C5B6E}\RP21\A0005636.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winmqx32.dll (Dialer) -> Delete on reboot
_____________________________________________________________
after ComboFix ran, I got the blue screen of death and had to unplug and cold boot.
ComboFix 08-11-27.01 - Owner 2008-11-27 13:23:37.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.74 [GMT -5:00]
Running from: c:\documents and settings\Owner.YOUR-449DE6425B\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\giOrCJjl.ini
c:\windows\Tasks\brxuabev.job
D:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-10-27 to 2008-11-27 )))))))))))))))))))))))))))))))
.
2008-11-27 12:37 . 2008-11-27 12:37 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-27 12:37 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-27 12:37 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-27 12:35 . 2008-11-27 12:35 <DIR> d-------- c:\documents and settings\Owner.YOUR-449DE6425B\Application Data\Malwarebytes
2008-11-27 12:35 . 2008-11-27 12:35 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-27 11:16 . 2008-11-27 11:17 <DIR> d-------- C:\rsit
2008-11-25 15:30 . 2008-11-25 15:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\GIRDAC
2008-11-25 15:28 . 2008-11-25 15:28 <DIR> d-------- C:\archive
2008-11-25 13:51 . 2008-11-25 13:51 <DIR> d-------- c:\program files\Trend Micro
2008-11-23 14:27 . 2008-11-23 14:27 <DIR> d-------- c:\documents and settings\Owner.YOUR-449DE6425B\Application Data\CyberLink
2008-11-23 14:26 . 2008-11-23 14:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\CyberLink
2008-11-22 14:09 . 2008-11-22 14:09 <DIR> d-------- C:\VundoFix Backups
2008-11-21 22:49 . 2008-11-21 23:11 <DIR> d-------- C:\SDFix
2008-11-20 16:11 . 2008-11-20 16:11 <DIR> d-------- c:\documents and settings\Owner.YOUR-449DE6425B\Application Data\OpenOffice.org
2008-11-20 16:08 . 2008-11-20 16:08 <DIR> d-------- c:\program files\JRE
2008-11-20 16:07 . 2008-11-20 16:08 <DIR> d-------- c:\program files\OpenOffice.org 3
2008-11-20 16:07 . 2008-06-10 02:32 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-11-20 13:42 . 2008-11-20 13:42 <DIR> d-------- c:\program files\Nsasoft
2008-11-20 13:42 . 2008-11-22 14:39 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-11-19 20:10 . 2008-11-27 13:46 <DIR> d-------- c:\program files\DNA
2008-11-19 20:10 . 2008-11-27 13:46 <DIR> d-------- c:\documents and settings\Owner.YOUR-449DE6425B\Application Data\DNA
2008-11-19 20:09 . 2008-11-20 12:56 <DIR> d-------- c:\program files\AskBarDis
2008-11-19 19:45 . 2008-11-19 19:45 48,640 --a------ c:\windows\system32\winrge32.dll
2008-11-19 17:10 . 2008-11-19 17:10 <DIR> d-------- c:\documents and settings\Owner.YOUR-449DE6425B\Application Data\VanDyke
2008-11-19 17:09 . 2008-11-19 17:09 <DIR> d-------- c:\program files\SecureFX
2008-11-19 14:35 . 2008-11-19 14:35 <DIR> d-------- c:\documents and settings\Owner.YOUR-449DE6425B\Application Data\SmartDraw
2008-11-19 14:34 . 2008-11-19 14:34 <DIR> d-------- C:\ISO9001
2008-11-19 14:33 . 2008-11-19 14:33 <DIR> d-------- C:\J. Vernon McGee
2008-11-19 13:51 . 2008-11-19 13:51 <DIR> d-------- c:\program files\SmartDraw 2008
2008-11-19 13:47 . 2008-11-19 13:47 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2008-11-19 13:41 . 2008-11-19 13:41 <DIR> d-------- c:\documents and settings\Owner.YOUR-449DE6425B\Application Data\AdobeUM
2008-11-19 13:39 . 2008-11-19 13:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\WinZip
2008-11-19 13:37 . 2008-11-19 13:37 <DIR> d-------- c:\windows\system32\Adobe
2008-11-19 13:30 . 2008-11-19 13:30 <DIR> d-------- C:\AQA
2008-11-19 10:45 . 2008-11-19 10:45 <DIR> d-------- c:\program files\Common Files\L&H
2008-11-18 23:30 . 2008-11-18 23:30 <DIR> d-------- c:\documents and settings\All Users\Symantec Temporary Files
2008-11-18 22:02 . 2008-11-18 22:02 <DIR> d-------- c:\documents and settings\OWNER.HHR
2008-11-18 18:47 . 2008-11-18 18:47 118,784 --a------ c:\windows\SeaMonkeyUninstall.exe
2008-11-18 18:47 . 2008-11-18 18:47 118,784 --a------ c:\windows\GREUninstall.exe
2008-11-18 18:47 . 2008-11-18 18:47 8,653 --a------ c:\windows\mozver.dat
2008-11-18 18:46 . 2008-11-18 18:46 <DIR> d-------- c:\program files\mozilla.org
2008-11-18 18:46 . 2008-11-25 15:30 <DIR> d-------- C:\Download
2008-11-18 15:46 . 2008-04-14 00:15 10,368 --a------ c:\windows\system32\drivers\hidusb.sys
2008-11-18 15:46 . 2008-04-14 00:15 10,368 --a--c--- c:\windows\system32\dllcache\hidusb.sys
2008-11-18 15:13 . 2008-10-03 12:41 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll
2008-11-18 15:13 . 2007-04-17 04:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat
2008-11-18 15:13 . 2007-03-08 00:10 991,232 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui
2008-11-18 15:13 . 2008-08-26 02:24 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll
2008-11-18 15:13 . 2008-08-26 02:24 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll
2008-11-18 15:13 . 2008-08-26 02:24 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll
2008-11-18 15:13 . 2008-08-26 02:24 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll
2008-11-18 15:13 . 2008-08-26 02:24 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll
2008-11-18 15:13 . 2008-08-25 03:38 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe
2008-11-18 13:32 . 2008-11-18 13:32 <DIR> d-------- c:\program files\MSXML 4.0
2008-11-18 13:29 . 2008-11-18 13:29 <DIR> d-------- c:\program files\Agilix
2008-11-18 13:20 . 2008-11-18 13:20 2 --a------ c:\windows\msoffice.ini
2008-11-18 12:14 . 2008-06-13 06:05 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys
2008-11-18 12:14 . 2008-08-14 05:04 138,496 -----c--- c:\windows\system32\dllcache\afd.sys
2008-11-18 12:13 . 2008-09-08 05:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-11-18 12:12 . 2008-11-18 12:12 <DIR> d-------- c:\documents and settings\Owner.YOUR-449DE6425B\Application Data\Symantec
2008-11-18 12:11 . 2008-08-14 05:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-11-18 12:11 . 2008-08-14 05:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-11-18 12:11 . 2008-08-14 04:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-11-18 12:11 . 2008-08-14 04:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-11-18 12:11 . 2008-09-15 07:12 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys
2008-11-18 12:09 . 2008-05-08 09:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys
2008-11-18 12:08 . 2008-04-11 14:04 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
2008-11-18 12:08 . 2008-10-24 06:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-18 12:08 . 2008-05-01 09:33 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll
2008-11-18 12:07 . 2008-10-15 11:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-11-18 12:03 . 2008-11-18 12:03 <DIR> d-------- c:\program files\Windows Sidebar
2008-11-18 12:01 . 2008-11-18 13:22 <DIR> d-------- c:\program files\Norton Internet Security
2008-11-18 12:01 . 2008-09-04 12:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-18 11:57 . 2008-11-18 23:15 <DIR> d-------- c:\program files\Symantec
2008-11-18 11:57 . 2008-11-27 13:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\Symantec
2008-11-18 11:57 . 2008-11-18 23:15 123,952 --a------ c:\windows\system32\drivers\SYMEVENT.SYS
2008-11-18 11:57 . 2008-11-18 23:15 60,800 --a------ c:\windows\system32\S32EVNT1.DLL
2008-11-18 11:57 . 2008-11-18 23:15 10,671 --a------ c:\windows\system32\drivers\SYMEVENT.CAT
2008-11-18 11:57 . 2008-11-18 23:15 805 --a------ c:\windows\system32\drivers\SYMEVENT.INF
2008-11-18 11:56 . 2008-11-27 13:27 <DIR> d-------- c:\program files\Common Files\Symantec Shared
2008-11-18 11:55 . 2005-09-01 11:03 127,488 --------- c:\windows\system32\drivers\imagesrv.sys
2008-11-18 11:55 . 2005-09-01 11:03 5,888 --------- c:\windows\system32\drivers\imagedrv.sys
2008-11-18 11:54 . 2004-07-09 08:43 364,544 --a------ c:\windows\system32\TwnLib4.dll
2008-11-18 11:47 . 2008-11-20 21:24 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-11-18 11:47 . 2008-11-18 11:48 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-18 10:42 . 2008-11-18 11:34 <DIR> d-------- c:\documents and settings\Owner.YOUR-449DE6425B\Application Data\McAfee.com Personal Firewall
2008-11-18 10:42 . 2008-11-18 10:42 <DIR> d-------- c:\documents and settings\LocalService\Application Data\McAfee.com Personal Firewall
2008-11-17 19:21 . 2005-05-13 03:30 163,840 --a------ c:\windows\system32\igfxres.dll
2008-11-17 19:20 . 2008-11-17 18:35 <DIR> d-------- c:\windows\system32\config\systemprofile\WINDOWS
2008-11-17 19:20 . 2008-11-17 18:57 <DIR> d-------- c:\windows\system32\config\systemprofile\Application Data\You've Got Pictures Screensaver
2008-11-17 19:20 . 2008-11-17 19:03 <DIR> d-------- c:\windows\system32\config\systemprofile\Application Data\SampleView
2008-11-17 19:20 . 2008-11-17 19:03 <DIR> d-------- c:\windows\system32\config\systemprofile\Application Data\Intel
2008-11-17 19:20 . 2008-11-17 19:11 <DIR> d-------- c:\windows\system32\config\systemprofile\Application Data\AOL
2008-11-17 19:20 . 2008-11-17 18:35 <DIR> d-------- c:\documents and settings\Owner.YOUR-449DE6425B\WINDOWS
2008-11-17 19:20 . 2008-11-17 18:57 <DIR> d-------- c:\documents and settings\Owner.YOUR-449DE6425B\Application Data\You've Got Pictures Screensaver
2008-11-17 19:20 . 2008-11-17 19:03 <DIR> d-------- c:\documents and settings\Owner.YOUR-449DE6425B\Application Data\SampleView
2008-11-17 19:20 . 2008-11-17 19:03 <DIR> d-------- c:\documents and settings\Owner.YOUR-449DE6425B\Application Data\Intel
2008-11-17 19:20 . 2008-11-18 13:20 <DIR> d-------- c:\documents and settings\Owner.YOUR-449DE6425B\Application Data\AOL
2008-11-17 19:20 . 2008-11-17 19:20 <DIR> d-------- c:\documents and settings\Owner.YOUR-449DE6425B
2008-11-17 19:16 . 2008-11-17 19:16 8,192 --a------ c:\windows\REGLOCS.OLD
2008-11-17 19:14 . 2008-11-18 11:41 31,648 --a------ c:\windows\system32\Status.MPF
2008-11-17 19:14 . 2008-11-17 19:14 0 --a------ c:\windows\system32\Gateway_CX2618_Rev.1_T155C31005311.MRK
2008-11-17 19:13 . 2008-11-17 19:13 333 --a------ c:\windows\system32\$ncsp$.inf
2008-11-17 19:11 . 2008-11-18 13:20 <DIR> d-------- c:\documents and settings\Administrator\Application Data\AOL
2008-11-17 19:05 . 2008-11-19 11:00 <DIR> d--h----- c:\windows\$hf_mig$
2008-11-17 19:04 . 2008-11-17 19:04 <DIR> d-------- c:\program files\McAfee
2008-11-17 19:04 . 2008-11-18 10:45 <DIR> d-------- c:\documents and settings\All Users\Application Data\McAfee.com Personal Firewall
2008-11-17 19:04 . 2008-11-17 19:04 <DIR> d-------- c:\documents and settings\All Users\Application Data\McAfee.com
2008-11-17 19:04 . 2008-11-17 19:04 <DIR> d-------- c:\documents and settings\All Users\Application Data\McAfee
2008-11-17 19:04 . 2005-01-09 23:32 181,938 --a------ c:\windows\Gateway.bmp
2008-11-17 19:03 . 2008-11-17 19:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\Intel
2008-11-17 19:03 . 2008-11-17 19:03 <DIR> d-------- c:\documents and settings\Administrator\Application Data\SampleView
2008-11-17 19:03 . 2008-11-17 19:03 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Intel
2008-11-17 19:03 . 2008-11-17 19:03 17,119 --a------ c:\windows\system32\drivers\AegisP.sys
2008-11-17 19:02 . 2004-10-15 13:20 1,654,784 --a------ c:\windows\system32\W29MLRES.DLL
2008-11-17 19:02 . 2004-08-04 07:00 221,184 --a------ c:\windows\system32\wmpns.dll
2008-11-17 19:02 . 2004-06-28 15:08 42,752 --a------ c:\windows\system32\drivers\ser2pl.sys
2008-11-17 19:01 . 2008-11-17 19:01 <DIR> d-------- c:\windows\Downloaded Installations
2008-11-17 19:01 . 2008-11-17 19:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\Agilix GoBinder
2008-11-17 19:01 . 2008-11-17 19:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\Agilix
2008-11-17 19:01 . 2005-05-19 15:36 167,936 -ra------ c:\windows\system32\GBInf.dll
2008-11-17 19:01 . 2003-03-25 08:00 67,072 --a------ c:\windows\POWERCFG.EXE
2008-11-17 19:00 . 2008-11-17 19:00 <DIR> d-------- c:\program files\Microsoft Education Pack
2008-11-17 19:00 . 2005-07-07 22:02 23,784 --a------ c:\windows\system32\OneNotemon.dll
2008-11-17 18:59 . 2008-11-17 18:59 <DIR> d-------- c:\program files\Microsoft Money 2005
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-17 23:57 8,552 ----a-w c:\windows\system32\drivers\asctrm.sys
2008-11-17 23:35 --------- d-----w c:\program files\microsoft frontpage
2008-11-17 22:50 --------- d-----w c:\program files\Windows Journal
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-09-29 17:24 325000 --a------ c:\program files\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-29 325000]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-29 325000]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-11-19 342336]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TabletWizard"="c:\windows\help\SplshWrp.exe" [2008-04-14 16384]
"TabletTip"="c:\program files\Common Files\microsoft shared\ink\tabtip.exe" [2008-04-14 271872]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-05 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-05 688218]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-05-13 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-05-13 126976]
"HostManager"="c:\program files\Common Files\AOL\1226966200\EE\AOLHostManager.exe" [2004-11-03 125528]
"Snippet"="c:\program files\Microsoft Experience Pack\Snipping Tool\SnippingTool.exe" [2005-02-25 68296]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-02-25 966656]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-15 385024]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 1121792]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2007-08-25 714608]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
c:\documents and settings\Owner.YOUR-449DE6425B\Start Menu\Programs\Startup\
Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2004-06-12 59080]
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-09-12 384000]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-10-15 14:27 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey]
2008-04-14 05:41 47104 c:\program files\Common Files\Microsoft Shared\Ink\loginkey.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL]
2002-08-29 05:41 11776 c:\windows\system32\tabbtnwl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify]
2008-04-14 05:42 32256 c:\windows\system32\tpgwlnot.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1226966200\\EE\\AOLServiceHost.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
R2 LiveUpdate Notice;LiveUpdate Notice;"c:\program files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [2007-08-25 149352]
R3 FinePnt;FinePoint Innovations HID Driver;c:\windows\system32\DRIVERS\FpHidDrv.sys [2008-11-17 17280]
R3 MSTabBtn;Tablet PC Buttons HID Driver;c:\windows\system32\DRIVERS\MSTabBtn.sys [2008-11-17 9600]
S3 COH_Mon;COH_Mon;\??\c:\windows\system32\Drivers\COH_Mon.sys [2007-05-29 23888]
S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;c:\windows\system32\DRIVERS\el575nd5.sys [2008-11-17 69692]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d1e5490e-b5ca-11dd-9cd7-0013ceb1e790}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
2008-11-18 c:\windows\Tasks\ISP signup reminder 3.job
- c:\windows\system32\OOBE\oobebaln.exe [2008-04-14 05:42]
2008-11-18 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Owner.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-08-26 21:19]
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-27 13:46:43
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1472)
c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Common Files\Microsoft Shared\Ink\keyboardsurrogate.exe
c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe
c:\windows\system32\wisptis.exe
c:\windows\system32\tabbtnu.exe
c:\progra~1\Intel\Wireless\Bin\1XConfig.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Common Files\Microsoft Shared\Ink\tcserver.exe
c:\progra~1\COMMON~1\AOL\122696~1\EE\AOLServiceHost.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
.
**************************************************************************
.
Completion time: 2008-11-27 13:50:16 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-27 18:50:05
Pre-Run: 30,767,685,632 bytes free
Post-Run: 30,771,376,128 bytes free
266 --- E O F --- 2008-11-19 16:01:13
___________________________________________________________
HijackThis log follows:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:57:48 PM, on 11/27/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\SYSTEM32\WISPTIS.EXE
C:\WINDOWS\System32\tabbtnu.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\PROGRA~1\COMMON~1\AOL\122696~1\EE\AOLHOS~1.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\PROGRA~1\COMMON~1\AOL\122696~1\EE\AOLServiceHost.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\explorer.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\mozilla.org\SeaMonkey\seamonkey.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gateway.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [TabletWizard] C:\WINDOWS\help\SplshWrp.exe
O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" /resume
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1226966200\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [Snippet] "C:\Program Files\Microsoft Experience Pack\Snipping Tool\SnippingTool.exe" /i
O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
--
End of file - 8797 bytes
Things are running OK now, but I still have the problem with shutting down. Don't know if VirtuMonde is causing this or not.
I am going to run Spybot (scan only) to see if it is still detecting VirtuMonde.
Thanks for your help!
I ran Spybot and it found nothing!!!!!
Thanks Katana for your help and quick turnaround. You're terrific!
I'm curious, how do you know how to respond to such different problems? I'm in awe!
Katana, now when I run Spybot it finds Microsoft WindowsSecurityCenter_disabled, as it has every time before except that last run. Is there a way to enable it, and is that something I should do? How?
I'm curious, how do you know how to respond to such different problems?
Lots of practice :)
Katana, now when I run Spybot it finds Microsoft WindowsSecurityCenter_disabled, as it has every time before except that last run. Is there a way to enable it, and is that something I should do? How?
Let's make sure you are completely clean before we worry about that.
Kaspersky Online Scanner .
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- This scan is best done from IE (Internet Explorer)
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html
Read the Requirements and limitations before you click Accept.
Once the database has downloaded, click My Computer in the left pane
Now go and put the kettle on !
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.
**Note**
To optimize scanning time and produce a more sensible report for review: Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.
You weren't kidding when you said put the kettle on! Scan took almost 4 hours!
Log follows:
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, November 27, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, November 27, 2008 15:19:34
Records in database: 1421479
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
Scan statistics:
Files scanned: 78497
Threat name: 3
Infected objects: 5
Suspicious objects: 0
Duration of the scan: 04:16:22
File name / Threat name / Threats count
C:\Download\keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.g 1
C:\Download\keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.a 1
C:\Download\WPPerm_v1.0.zip Infected: not-a-virus:PSWTool.Win32.RAS.g 1
C:\Download\WPPerm_v1.0.zip Infected: not-a-virus:PSWTool.Win32.RAS.a 1
D:\i386\Apps\App00577\comps\toolbar\toolbr.exe Infected: not-a-virus:AdWare.Win32.SearchIt.t 1
The selected area was scanned.
Do you know anything about this file ?
WPPerm_v1.0.zip
Please run the MGA Diagnostic Tool and post back the report it creates:
Download MGADiag (http://go.microsoft.com/fwlink/?linkid=56062) to your desktop.
Double-click on MGADiag.exe to launch the program
Click "Continue"
Ensure that the "Windows" tab is selected (it should be by default).
Click the "Copy" button to copy the MGA Diagnostic Report to the Windows clipboard.
Paste the MGA Diagnostic Report back here in your next reply.
I have no idea what that zip file is!
Diagnostic Report (1.7.0110.1):
-----------------------------------------
WGA Data-->
Validation Status: Validation Control not Installed
Validation Code: 0
Online Validation Code: N/A
Cached Validation Code: N/A
Windows Product Key: *****-*****-P7HQD-Y3QTT-DYRVJ
Windows Product Key Hash: u7RvFak8TXkguw3Y0TRHZhDCtDE=
Windows Product ID: 76487-OEM-2211906-00319
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 5.1.2600.2.00010100.3.0.tab
ID: {38C5D1AA-50F3-49C6-B69A-F80D80AD2876}(1)
Is Admin: Yes
TestCab: 0x0
WGA Version: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: N/A
Architecture: N/A
Build lab: N/A
TTS Error: N/A
Validation Diagnostic: 025D1FF3-171-1_E2AD56EA-761-d003_E2AD56EA-762-0_E2AD56EA-134-80004005
Resolution Status: N/A
WgaER Data-->
ThreatID(s): N/A
Version: N/A
WGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
WGATray.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 101 Not Activated
Microsoft Office XP Professional with FrontPage - 100 Genuine
Microsoft Office Professional Edition 2003 - 101 Not Activated
Microsoft Office Standard Edition 2003 - 104 Unknown PID
Microsoft Office OneNote 2003 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 77F760FE-153-80070002_7E90FEE8-203-80070002_025D1FF3-171-1_3E121E02-115-80004005_E2AD56EA-761-d003_E2AD56EA-762-0_E2AD56EA-134-80004005_3E121E02-115-80004005_3E121E02-424-80004005_3E121E02-315-80004005_B4D0AA8B-1065-80070057_FA827CE6-153-8007007e_FA827CE6-180-8007007e
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{38C5D1AA-50F3-49C6-B69A-F80D80AD2876}</UGUID><Version>1.7.0110.1</Version><OS>5.1.2600.2.00010100.3.0.tab</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-DYRVJ</PKey><PID>76487-OEM-2211906-00319</PID><PIDType>2</PIDType><SID>S-1-5-21-3454727132-3780038754-212182858</SID><SYSTEM><Manufacturer>Gateway </Manufacturer><Model>CX2618 </Model></SYSTEM><BIOS><Manufacturer>Gateway</Manufacturer><Version>62.04</Version><SMBIOSVersion major="2" minor="31"/><Date>20051019000000.000000+000</Date><SLPBIOS>Gateway,Gateway,Gateway,Gateway</SLPBIOS></BIOS><HWID>BCFC3B07018400E2</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>2</stat><msppid></msppid><name>Gateway</name><model>CX2618</model></SBID><OEM/><BRT/></MachineData><Software><Office><Result>101</Result><Products><Product GUID="{90280409-6000-11D3-8CFE-0050048383C9}"><LegitResult>100</LegitResult><Name>Microsoft Office XP Professional with FrontPage</Name><Ver>10</Ver><Val>5647A6CD7BF0FB2</Val><Hash>9CfrgEkPCkxDh5aX4jx4Zgh0+3E=</Hash><Pid>54185-736-0695933-17950</Pid><PidType>1</PidType></Product><Product GUID="{91110409-6000-11D3-8CFE-0150048383C9}"><LegitResult>101</LegitResult><Name>Microsoft Office Professional Edition 2003</Name><Ver>11</Ver><Val>1E4B46FCB5A4DF3</Val><Hash>EX6V1z0eVa4BTnZx0V9EJ1Ig9Cg=</Hash><Pid>70145-761-5847202-57907</Pid><PidType>1</PidType></Product><Product GUID="{91120409-6000-11D3-8CFE-0150048383C9}"><LegitResult>104</LegitResult><Name>Microsoft Office Standard Edition 2003</Name><Ver>11</Ver><PidType>0</PidType></Product><Product GUID="{91A10409-6000-11D3-8CFE-0150048383C9}"><LegitResult>100</LegitResult><Name>Microsoft Office OneNote 2003</Name><Ver>11</Ver><Val>73268F0FF3A0F24</Val><Hash>6fvVRozJcwqfjYeHziEtpTssJbw=</Hash><Pid>70172-OEM-5591431-10363</Pid><PidType>6</PidType></Product></Products><Applications><App Id="15" Version="10" Result="100"/><App Id="16" Version="10" Result="100"/><App Id="17" Version="10" Result="100"/><App Id="18" Version="10" Result="100"/><App Id="1A" Version="10" Result="100"/><App Id="1B" Version="10" Result="100"/><App Id="15" Version="11" Result="101"/><App Id="16" Version="11" Result="101"/><App Id="18" Version="11" Result="101"/><App Id="19" Version="11" Result="101"/><App Id="1A" Version="11" Result="101"/><App Id="1B" Version="11" Result="101"/><App Id="44" Version="11" Result="101"/><App Id="A1" Version="11" Result="100"/></Applications></Office></Software></GenuineResults>
Licensing Data-->
N/A
HWID Data-->
N/A
OEM Activation 1.0 Data-->
BIOS string matches: yes
Marker string from BIOS: 1E840:Gateway, Inc
Marker string from OEMBIOS.DAT: Gateway,Gateway,Gateway,Gateway
OEM Activation 2.0 Data-->
N/A
Please visit HERE (http://www.microsoft.com/genuine) and validate your copy of Windows and Office.
Once you have done so, please re-run the MGA Diagnostic Tool and post the new report.
Thank you for completing the validation process and for using genuine Microsoft software.
By using genuine Microsoft software, you can be confident that you will have access to the latest features, security, and support, which will help to improve your productivity and expand the capabilities of your computer.
You will also have access to new innovations and offerings available only to genuine Microsoft software customers
____________________________________________________________
Microsoft Office Professional Edition 2003: Product Not Activated[0x80180101]
Microsoft Office Standard Edition 2003: No Product Key Detected[0x80180104]
I had to do a system restore last week because of the spyware on my computer. Office 2003 came on my computer and I don't have the product key for it. I cannot use it because I have no key, and when I installed the Pro upgrade, it still wanted the standard key. I have installed office xp and use that.
Diagnostic Report (1.7.0110.1):
-----------------------------------------
WGA Data-->
Validation Status: Genuine
Validation Code: 0
Online Validation Code: N/A
Cached Validation Code: N/A
Windows Product Key: *****-*****-P7HQD-Y3QTT-DYRVJ
Windows Product Key Hash: u7RvFak8TXkguw3Y0TRHZhDCtDE=
Windows Product ID: 76487-OEM-2211906-00319
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 5.1.2600.2.00010100.3.0.tab
ID: {38C5D1AA-50F3-49C6-B69A-F80D80AD2876}(3)
Is Admin: Yes
TestCab: 0x0
WGA Version: Registered, 1.7.69.2
Signed By: Microsoft
Product Name: N/A
Architecture: N/A
Build lab: N/A
TTS Error: N/A
Validation Diagnostic: 025D1FF3-171-1
Resolution Status: N/A
WgaER Data-->
ThreatID(s): N/A
Version: N/A
WGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
WGATray.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 101 Not Activated
Microsoft Office XP Professional with FrontPage - 100 Genuine
Microsoft Office Professional Edition 2003 - 101 Not Activated
Microsoft Office Standard Edition 2003 - 104 Unknown PID
Microsoft Office OneNote 2003 - 100 Genuine
OGA Version: Registered, 1.6.28.0
Signed By: Microsoft
Office Diagnostics: 77F760FE-153-80070002_7E90FEE8-203-80070002_025D1FF3-171-1_3E121E02-115-80004005_3E121E02-115-80004005_3E121E02-424-80004005_3E121E02-315-80004005_B4D0AA8B-1065-80070057_FA827CE6-153-8007007e_FA827CE6-180-8007007e
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{38C5D1AA-50F3-49C6-B69A-F80D80AD2876}</UGUID><Version>1.7.0110.1</Version><OS>5.1.2600.2.00010100.3.0.tab</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-DYRVJ</PKey><PID>76487-OEM-2211906-00319</PID><PIDType>2</PIDType><SID>S-1-5-21-3454727132-3780038754-212182858</SID><SYSTEM><Manufacturer>Gateway </Manufacturer><Model>CX2618 </Model></SYSTEM><BIOS><Manufacturer>Gateway</Manufacturer><Version>62.04</Version><SMBIOSVersion major="2" minor="31"/><Date>20051019000000.000000+000</Date><SLPBIOS>Gateway,Gateway,Gateway,Gateway</SLPBIOS></BIOS><HWID>BCFC3B07018400E2</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>2</stat><msppid></msppid><name>Gateway</name><model>CX2618</model></SBID><OEM/><BRT/></MachineData><Software><Office><Result>101</Result><Products><Product GUID="{90280409-6000-11D3-8CFE-0050048383C9}"><LegitResult>100</LegitResult><Name>Microsoft Office XP Professional with FrontPage</Name><Ver>10</Ver><Val>5647A6CD7BF0FB2</Val><Hash>9CfrgEkPCkxDh5aX4jx4Zgh0+3E=</Hash><Pid>54185-736-0695933-17950</Pid><PidType>1</PidType></Product><Product GUID="{91110409-6000-11D3-8CFE-0150048383C9}"><LegitResult>101</LegitResult><Name>Microsoft Office Professional Edition 2003</Name><Ver>11</Ver><Val>1E4B46FCB5A4DF3</Val><Hash>EX6V1z0eVa4BTnZx0V9EJ1Ig9Cg=</Hash><Pid>70145-761-5847202-57907</Pid><PidType>1</PidType></Product><Product GUID="{91120409-6000-11D3-8CFE-0150048383C9}"><LegitResult>104</LegitResult><Name>Microsoft Office Standard Edition 2003</Name><Ver>11</Ver><PidType>0</PidType></Product><Product GUID="{91A10409-6000-11D3-8CFE-0150048383C9}"><LegitResult>100</LegitResult><Name>Microsoft Office OneNote 2003</Name><Ver>11</Ver><Val>73268F0FF3A0F24</Val><Hash>6fvVRozJcwqfjYeHziEtpTssJbw=</Hash><Pid>70172-OEM-5591431-10363</Pid><PidType>6</PidType></Product></Products><Applications><App Id="15" Version="10" Result="100"/><App Id="16" Version="10" Result="100"/><App Id="17" Version="10" Result="100"/><App Id="18" Version="10" Result="100"/><App Id="1A" Version="10" Result="100"/><App Id="1B" Version="10" Result="100"/><App Id="15" Version="11" Result="101"/><App Id="16" Version="11" Result="101"/><App Id="18" Version="11" Result="101"/><App Id="19" Version="11" Result="101"/><App Id="1A" Version="11" Result="101"/><App Id="1B" Version="11" Result="101"/><App Id="44" Version="11" Result="101"/><App Id="A1" Version="11" Result="100"/></Applications></Office></Software></GenuineResults>
Licensing Data-->
N/A
HWID Data-->
N/A
OEM Activation 1.0 Data-->
BIOS string matches: yes
Marker string from BIOS: 1E840:Gateway, Inc
Marker string from OEMBIOS.DAT: Gateway,Gateway,Gateway,Gateway
OEM Activation 2.0 Data-->
N/A
Katana, now when I run Spybot it finds Microsoft WindowsSecurityCenter_disabled, as it has every time before except that last run. Is there a way to enable it, and is that something I should do? How?
It is probably Norton/Symantec that is causing that, as long as you keep your AV updated there is no problem.
Congratulations your logs look clean :)
Let's see if I can help you keep it that way
First lets tidy up
This will clear your System Volume Information restore points and remove all the infected files that were quarantined
Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
http://i189.photobucket.com/albums/z176/EPL47/CF_Cleanup.png
You can also delete any logs we have produced, and empty your Recycle bin.
The following is some info to help you stay safe and clean.
You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.
( Vista users must ensure that any programs are Vista compatible BEFORE installing )
Online Scanners
I would recommend a scan at one or more of the following sites at least once a month.
http://www.pandasecurity.com/activescan
http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html
!!! Make sure that all your programs are updated !!!
Secunia Software Inspector does all the work for you, .... see HERE (http://secunia.com/software_inspector/) for details
AntiSpyware
AntiSpyware is not the same thing as Antivirus.
Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
Most of the programs in this list have a free (for Home Users ) and paid versions,
it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
Spybot - Search & Destroy (http://www.safer-networking.org/) <<< A must have program It includes host protection and registry protection A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites
MalwareBytes Anti-malware (http://www.malwarebytes.org/mbam.php) <<< A New and effective program
a-squared Free (http://www.emsisoft.com/en/software/free/) <<< A good "realtime" or "on demand" scanner
superantispyware (http://www.superantispyware.com/) <<< A good "realtime" or "on demand" scanner
Prevention
These programs don't detect malware, they help stop it getting on your machine in the first place.
Each does a different job, so you can have more than one
Winpatrol (http://www.winpatrol.com) An excellent startup manager and then some !! Notifies you if programs are added to startup Allows delayed startup A must have addition
SpywareBlaster 4.0 (http://www.javacoolsoftware.com/spywareblaster.html) SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
SpywareGuard 2.2 (http://www.javacoolsoftware.com/spywareguard.html) SpywareGuard provides real-time protection against spyware. Not required if you have other "realtime" antispyware or Winpatrol
ZonedOut (http://www.funkytoad.com/index.php?option=com_content&view=article&id=15&Itemid=33) Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
MVPS HOSTS (http://www.mvps.org/winhelp2002/hosts.zip) This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial (http://www.mvps.org/winhelp2002/hosts.htm) by WinHelp2002. Not required if you are using other host file protections
Internet Browsers
Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys.
Using a different web browser can help stop malware getting on your machine.
Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialise and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
If you are still using IE6 then either update, or get one of the following.
FireFox (http://www.mozilla.com/en-US/firefox/) With many addons available that make customization easy this is a very popular choice NoScript and AdBlockPlus addons are essential
Opera (http://www.opera.com/) Another popular alternative
Netscape (http://browser.netscape.com/addons) Another popular alternative Also has Addons available
Cleaning Temporary Internet Files and Tracking Cookies
Temporary Internet Files are mainly the files that are downloaded when you open a web page.
Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware.
It is a good idea to empty the Temporary Internet Files folder on a regular basis.
Tracking Cookies are files that websites use to monitor which sites you visit and how often.
A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted.
CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords
Both of these can be cleaned manually, but a quicker option is to use a program
ATF Cleaner (http://www.atribune.org/index.php?option=com_content&task=view&id=25&Itemid=25) Free and very simple to use
CCleaner (http://www.ccleaner.com/) Free and very flexible, you can chose which cookies to keep
Also PLEASE read this article.....So How Did I Get Infected In The First Place (http://forum.malwareremoval.com/viewtopic.php?t=4959)
The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.
If you follow this advice then (with a bit of luck) you will never have to hear from me again :D
If you could post back one more time to let me know everything is OK, then I can have this thread archived.
Happy surfing K'
Many thanks to you, Katana, for your time, patience, generosity of spirit and expertise. You are an :angel:.
I have copied your last instructions on keeping my machine clean and will follow them after I get all the necessary software. It is a lot to keep track of :whistle:. I will do my best, once again, thank you for yours. :bighug:
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.
Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.
If it has been less than five days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.