Infection with PreciseAd Malware

[infectedone]

Hello!

I believe I am infected with precisead malware. I have backup of system registry and HJT log (attached).

Thanks in advance for your help!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:59:06 AM, on 6/14/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Vongo\VongoService.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-1219393502-2404566984-3178860527-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Sarah')
O4 - HKUS\S-1-5-21-1219393502-2404566984-3178860527-1006\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Sarah')
O4 - HKUS\S-1-5-21-1219393502-2404566984-3178860527-1006\..\Run: [ares ultra] "C:\Program Files\Ares Ultra\Ares Ultra.exe" -h (User 'Sarah')
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Vongo Service - Starz Entertainment Group LLC - C:\Program Files\Vongo\VongoService.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 10661 bytes

[Shaba]

Hi infectedone

Which program finds that infection?

[infectedone]

I'm getting constant pop-up ads with Internet Explorer. Several programs with "precisead" show up in Add/Remove Programs. If I try to uninstall them, it pops up with a warning about losing rights to some identified source and asks for me to enter a validation code as displayed on the screen. I have not proceeded with the uninstall and have disconnected that computer fromt he internet.

Thanks!

[infectedone]

I was reviewing the first post and realize that there is a problem with the HJT log. It does not match the one that I attached. (I'm guessing that since I did not post it correctly, another one was mistakenly copied in when it was corrected.) I am re-posting the original log here...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:01:26 PM, on 6/14/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Windows\SysWOW64\regsvr32.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\...\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~2\mcafee\msk\mskapbho.dll
O2 - BHO: precisead - {49eb5486-beb0-a3f7-761d-0472422e0547} - C:\Windows\SysWow64\nshC382.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: precisead search enhancer - {B29A5D2B-CD02-969A-9953-FC78079A089B} - C:\Windows\SysWow64\idvquufhaccg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files (x86)\Dell\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: precisead browser enhancer - {EAADC6F6-97D9-45C0-1F9B-A62CF7A8A292} - C:\Windows\SysWow64\yfwjpqkzcym.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~2\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [ycwfhfjxalkkcgjnv] C:\Windows\System32\regsvr32.exe /s "C:\Windows\system32\yfwjpqkzcym.dll"
O4 - HKCU\..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.3.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Unknown owner - C:\Windows\system32\AERTSr64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBackMonitor - McAfee - C:\Program Files (x86)\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~2\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~2\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files (x86)\McAfee\MSK\MskSrver.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 13565 bytes

Thanks again and sorry for the confusion.

[Shaba]

I see.

Please save any items you were working on... close any open programs. You may be asked to reboot your machine.
Please download Malwarebytes Anti-Malware (http://www.besttechie.net/tools/mbam-setup.exe) and save it to your desktop. If needed...Tutorial w/screenshots (http://thespykiller.co.uk/index.php/topic,5946.0.html)
Alternate download site available here (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html).
Make sure you are connected to the Internet.
Double-click on Download_mbam-setup.exe to install the application.
When the installation begins, follow the prompts and do not make any changes to default settings.
When installation has finished, make sure you leave both of these checked:
Update Malwarebytes' Anti-Malware
Launch Malwarebytes' Anti-Malware
Then click Finish.MBAM will automatically start and you will be asked to update the program before performing a scan.
If an update is found, the program will automatically update itself.
Press the OK button to close that box and continue.
Problems downloading the updates? Manually download them from here (http://malwarebytes.gt500.org/mbam-rules.exe) and double-click on "mbam-rules.exe" to install.
On the Scanner tab:
Make sure the "Perform Quick Scan" option is selected.
Then click on the Scan button.
If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:
Click on the Show Results button to see a list of any malware that was found.
Check all items except items in the C:\System Volume Information folder... then click on Remove Selected.
We will take care of the System Volume Information items later.
When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Please download RSIT (http://images.malwareremoval.com/random/RSIT.exe) by random/random... save it to your desktop.

Right click on RSIT.exe and select "Run As Administrator" to run it. If Windows UAC prompts you, please allow it.
Please read the disclaimer... click on Continue.
RSIT will start running. When done... 2 logs files...will be produced.
The first one, "log.txt", will be maximized
The second one, "info.txt", will be minimized.
Please post both... "log.txt" and "info.txt", file contents in your next reply.
(These logs can be lengthy, so post 1 log per reply please.)

Post:

- mbam log
- rsit logs (taken after mbam run)

[infectedone]

MBAM Log follows:

Malwarebytes' Anti-Malware 1.37
Database version: 2277
Windows 6.0.6002 Service Pack 2

6/14/2009 3:46:14 PM
mbam-log-2009-06-14 (15-46-14).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 353337
Time elapsed: 1 hour(s), 11 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{23e99604-9fe9-71dc-3123-b49e1bc4057f} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{49eb5486-beb0-a3f7-761d-0472422e0547} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{49eb5486-beb0-a3f7-761d-0472422e0547} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b29a5d2b-cd02-969a-9953-fc78079a089b} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b29a5d2b-cd02-969a-9953-fc78079a089b} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{eaadc6f6-97d9-45c0-1f9b-a62cf7a8a292} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{eaadc6f6-97d9-45c0-1f9b-a62cf7a8a292} (Adware.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ycwfhfjxalkkcgjnv (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\System32\yfwjpqkzcym.dll (Trojan.Agent) -> Delete on reboot.
c:\Windows\System32\efcryp32.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
c:\Windows\System32\idvquufhaccg.dll-uninst.exe (Adware.AdRotator) -> Quarantined and deleted successfully.
C:\Windows\SysWOW64\nshC382.dll (Adware.BHO) -> Delete on reboot.
C:\Windows\SysWOW64\idvquufhaccg.dll (Adware.AdRotator) -> Delete on reboot.
C:\Windows\SysWOW64\yfwjpqkzcym.dll (Adware.BHO) -> Delete on reboot.

[infectedone]

RSIT Log.txt follows (Part 1 - Part 2 in next reply):

Logfile of random's system information tool 1.06 (written by random/random)
Run by Gwen E. Murray at 2009-06-15 09:43:01
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 858 GB (91%) free of 938 GB
Total RAM: 8190 MB (78% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:43:17 AM, on 6/15/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Users\Gwen E. Murray\Desktop\RSIT.exe
c:\PROGRA~2\mcafee\mpf\mc\mpfalert.exe
C:\Program Files (x86)\trend micro\Gwen E. Murray.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~2\mcafee\msk\mskapbho.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files (x86)\Dell\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~2\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.3.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Unknown owner - C:\Windows\system32\AERTSr64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBackMonitor - McAfee - C:\Program Files (x86)\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~2\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~2\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files (x86)\McAfee\MSK\MskSrver.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 13256 bytes

======Scheduled tasks folder======

C:\Windows\tasks\McDefragTask.job
C:\Windows\tasks\McQcTask.job
C:\Windows\tasks\RtlNICDiagVistaStart.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll [2008-07-28 882416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27B4851A-3207-45A2-B947-BE8AFE6163AB}]
McAfee Phishing Filter - c:\PROGRA~2\mcafee\msk\mskapbho.dll [2009-01-09 246800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - C:\Program Files (x86)\McAfee\VirusScan\scriptsn.dll [2009-03-25 62784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll [2009-06-14 259696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-02-27 349576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-04-20 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll [2009-02-13 150032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll [2009-04-27 470512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
CBrowserHelperObject Object - C:\Program Files (x86)\Dell\BAE\BAE.dll [2006-11-09 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
SmartSelect Class - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-02-27 349576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
SingleInstance Class - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll [2008-07-28 160496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-02-27 349576]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll [2008-07-28 882416]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll [2009-06-14 259696]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]
"mcagent_exe"=C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe [2009-03-25 645328]
"PDVDDXSrv"=C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [2008-05-23 128296]
"McENUI"=C:\PROGRA~2\McAfee\MHN\McENUI.exe [2009-01-09 1176808]
"RoxWatchTray"=C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe [2007-08-16 236016]
"Adobe Acrobat Speed Launcher"=C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [2009-02-27 38768]
""= []
"Acrobat Assistant 8.0"=C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [2009-02-27 640376]
"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2009-01-05 413696]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"SunJavaUpdateSched"=C:\Program Files (x86)\Java\jre6\bin\jusched.exe [2009-03-09 148888]
"iTunesHelper"=C:\Program Files (x86)\iTunes\iTunesHelper.exe [2009-04-02 342312]
"hpqSRMon"=C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [2008-06-02 80896]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"=C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-10-21 68856]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Gamma Loader.exe.lnk - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Adobe Gamma Loader.lnk - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
HP Digital Imaging Monitor.lnk - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
QuickBooks Update Agent.lnk - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MpfService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=
"ForceActiveDesktopOn"=
"BindDirectlyToPropertySetStorage"=
"NoActiveDesktopChanges"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
shell\AutoRun\command - J:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a8b013aa-a2c4-11dd-bc12-00217044cc10}]
shell\AutoRun\command - J:\LaunchU3.exe


======File associations======

.js - edit - C:\Windows\SysWOW64\Notepad.exe %1
.js - open - C:\Windows\SysWOW64\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2009-06-15 09:43:01 ----D---- C:\rsit
2009-06-15 09:43:01 ----D---- C:\Program Files (x86)\trend micro
2009-06-14 14:31:49 ----D---- C:\Users\Gwen E. Murray\AppData\Roaming\Malwarebytes
2009-06-14 14:31:44 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2009-06-14 11:57:37 ----D---- C:\Program Files (x86)\ERUNT
2009-06-14 11:21:55 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy
2009-06-13 21:30:25 ----D---- C:\Program Files (x86)\Misc. Support Library (Spybot - Search & Destroy)
2009-06-13 21:30:25 ----D---- C:\Program Files (x86)\File Scanner Library (Spybot - Search & Destroy)
2009-06-13 21:22:58 ----D---- C:\Users\Gwen E. Murray\AppData\Roaming\PeerNetworking
2009-06-13 21:03:37 ----A---- C:\Windows\system32\b53645c8-33e7-312c-a874-ad7fde53373c.exe
2009-06-13 21:03:24 ----A---- C:\Windows\system32\ypkvbbfoombcatdic.exe
2009-06-09 18:58:23 ----A---- C:\Windows\system32\mshtml.dll
2009-06-09 18:58:22 ----A---- C:\Windows\system32\ieframe.dll
2009-06-09 18:58:21 ----A---- C:\Windows\system32\iertutil.dll
2009-06-09 18:58:20 ----A---- C:\Windows\system32\wininet.dll
2009-06-09 18:58:20 ----A---- C:\Windows\system32\urlmon.dll
2009-06-09 18:58:20 ----A---- C:\Windows\system32\ieui.dll
2009-06-09 18:58:20 ----A---- C:\Windows\system32\iedkcs32.dll
2009-06-09 18:58:19 ----A---- C:\Windows\system32\jsproxy.dll
2009-06-09 18:58:19 ----A---- C:\Windows\system32\iesetup.dll
2009-06-09 18:58:19 ----A---- C:\Windows\system32\iernonce.dll
2009-06-09 18:58:19 ----A---- C:\Windows\system32\ie4uinit.exe
2009-06-09 18:58:00 ----A---- C:\Windows\system32\rpcrt4.dll
2009-06-09 18:57:54 ----A---- C:\Windows\system32\localspl.dll
2009-05-30 09:29:58 ----D---- C:\Windows\system32\vi-VN
2009-05-30 09:29:58 ----D---- C:\Windows\system32\eu-ES
2009-05-30 09:29:58 ----D---- C:\Windows\system32\ca-ES
2009-05-30 09:15:33 ----A---- C:\Windows\system32\NlsLexicons0007.dll
2009-05-30 09:15:28 ----A---- C:\Windows\system32\FunctionDiscoveryFolder.dll
2009-05-30 09:15:26 ----A---- C:\Windows\system32\NlsLexicons0009.dll
2009-05-30 09:15:24 ----A---- C:\Windows\system32\SLCExt.dll
2009-05-30 09:15:21 ----A---- C:\Windows\system32\mssrch.dll
2009-05-30 09:15:18 ----A---- C:\Windows\system32\WscEapPr.dll
2009-05-30 09:15:18 ----A---- C:\Windows\system32\wcnwiz2.dll
2009-05-30 09:15:16 ----A---- C:\Windows\system32\tquery.dll
2009-05-30 09:15:14 ----A---- C:\Windows\system32\PresentationNative_v0300.dll
2009-05-30 09:15:13 ----A---- C:\Windows\system32\RMActivate_isv.exe
2009-05-30 09:15:13 ----A---- C:\Windows\system32\RMActivate.exe
2009-05-30 09:15:12 ----A---- C:\Windows\system32\msi.dll
2009-05-30 09:15:11 ----A---- C:\Windows\system32\secproc_isv.dll
2009-05-30 09:15:11 ----A---- C:\Windows\system32\imapi2fs.dll
2009-05-30 09:15:10 ----A---- C:\Windows\system32\mf.dll
2009-05-30 09:15:10 ----A---- C:\Windows\system32\icardagt.exe
2009-05-30 09:15:08 ----A---- C:\Windows\system32\spwizui.dll
2009-05-30 09:15:08 ----A---- C:\Windows\system32\AuxiliaryDisplayCpl.dll
2009-05-30 09:15:06 ----A---- C:\Windows\system32\spreview.exe
2009-05-30 09:15:06 ----A---- C:\Windows\system32\spinstall.exe
2009-05-30 09:15:05 ----A---- C:\Windows\system32\drmv2clt.dll
2009-05-30 09:15:04 ----A---- C:\Windows\system32\shell32.dll
2009-05-30 09:15:04 ----A---- C:\Windows\system32\secproc.dll
2009-05-30 09:15:04 ----A---- C:\Windows\system32\SearchIndexer.exe
2009-05-30 09:15:04 ----A---- C:\Windows\system32\p2psvc.dll
2009-05-30 09:15:04 ----A---- C:\Windows\system32\EhStorPwdMgr.dll
2009-05-30 09:15:04 ----A---- C:\Windows\system32\EhStorAuthn.dll
2009-05-30 09:15:03 ----A---- C:\Windows\system32\mssvp.dll
2009-05-30 09:15:02 ----A---- C:\Windows\system32\ntdll.dll
2009-05-30 09:15:02 ----A---- C:\Windows\system32\mssphtb.dll
2009-05-30 09:15:02 ----A---- C:\Windows\system32\mssph.dll
2009-05-30 09:15:02 ----A---- C:\Windows\system32\MSMPEG2VDEC.DLL
2009-05-30 09:15:02 ----A---- C:\Windows\system32\mscoree.dll
2009-05-30 09:15:02 ----A---- C:\Windows\system32\kernel32.dll
2009-05-30 09:15:02 ----A---- C:\Windows\system32\imapi2.dll
2009-05-30 09:15:01 ----A---- C:\Windows\system32\sdohlp.dll
2009-05-30 09:15:01 ----A---- C:\Windows\system32\IMJP10K.DLL
2009-05-30 09:15:01 ----A---- C:\Windows\system32\esent.dll
2009-05-30 09:15:01 ----A---- C:\Windows\system32\DevicePairing.dll
2009-05-30 09:15:00 ----A---- C:\Windows\system32\sperror.dll
2009-05-30 09:15:00 ----A---- C:\Windows\system32\SLC.dll
2009-05-30 09:15:00 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2009-05-30 09:15:00 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2009-05-30 09:15:00 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2009-05-30 09:15:00 ----A---- C:\Windows\system32\korwbrkr.dll
2009-05-30 09:14:59 ----A---- C:\Windows\system32\WMVCORE.DLL
2009-05-30 09:14:59 ----A---- C:\Windows\system32\wmp.dll
2009-05-30 09:14:59 ----A---- C:\Windows\system32\msshsq.dll
2009-05-30 09:14:59 ----A---- C:\Windows\system32\msjet40.dll
2009-05-30 09:14:59 ----A---- C:\Windows\system32\EhStorAPI.dll
2009-05-30 09:14:58 ----A---- C:\Windows\system32\msxml6.dll
2009-05-30 09:14:57 ----A---- C:\Windows\system32\user32.dll
2009-05-30 09:14:57 ----A---- C:\Windows\system32\Query.dll
2009-05-30 09:14:57 ----A---- C:\Windows\system32\msexch40.dll
2009-05-30 09:14:57 ----A---- C:\Windows\system32\EhStorShell.dll
2009-05-30 09:14:56 ----A---- C:\Windows\system32\srchadmin.dll
2009-05-30 09:14:56 ----A---- C:\Windows\system32\P2PGraph.dll
2009-05-30 09:14:56 ----A---- C:\Windows\system32\ole32.dll
2009-05-30 09:14:56 ----A---- C:\Windows\system32\msxml3.dll
2009-05-30 09:14:56 ----A---- C:\Windows\system32\IasMigReader.exe
2009-05-30 09:14:56 ----A---- C:\Windows\explorer.exe
2009-05-30 09:14:55 ----A---- C:\Windows\system32\mmc.exe
2009-05-30 09:14:55 ----A---- C:\Windows\system32\gdi32.dll
2009-05-30 09:14:55 ----A---- C:\Windows\system32\EncDec.dll
2009-05-30 09:14:55 ----A---- C:\Windows\system32\DevicePairingWizard.exe
2009-05-30 09:14:54 ----A---- C:\Windows\system32\riched20.dll
2009-05-30 09:14:54 ----A---- C:\Windows\system32\RacEngn.dll
2009-05-30 09:14:54 ----A---- C:\Windows\system32\Magnify.exe
2009-05-30 09:14:54 ----A---- C:\Windows\system32\IasMigPlugin.dll
2009-05-30 09:14:54 ----A---- C:\Windows\system32\fdBth.dll
2009-05-30 09:14:53 ----A---- C:\Windows\system32\spoolss.dll
2009-05-30 09:14:53 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2009-05-30 09:14:53 ----A---- C:\Windows\system32\SearchFilterHost.exe
2009-05-30 09:14:53 ----A---- C:\Windows\system32\NaturalLanguage6.dll
2009-05-30 09:14:53 ----A---- C:\Windows\system32\milcore.dll
2009-05-30 09:14:53 ----A---- C:\Windows\system32\CertEnroll.dll
2009-05-30 09:14:53 ----A---- C:\Windows\system32\bcrypt.dll
2009-05-30 09:14:52 ----A---- C:\Windows\system32\Storprop.dll
2009-05-30 09:14:52 ----A---- C:\Windows\system32\msvcp60.dll
2009-05-30 09:14:52 ----A---- C:\Windows\system32\msjtes40.dll
2009-05-30 09:14:52 ----A---- C:\Windows\system32\infocardapi.dll
2009-05-30 09:14:52 ----A---- C:\Windows\system32\gpedit.dll
2009-05-30 09:14:51 ----A---- C:\Windows\system32\mstext40.dll
2009-05-30 09:14:51 ----A---- C:\Windows\system32\es.dll
2009-05-30 09:14:51 ----A---- C:\Windows\system32\advapi32.dll
2009-05-30 09:14:50 ----A---- C:\Windows\system32\WMPhoto.dll
2009-05-30 09:14:50 ----A---- C:\Windows\system32\WebClnt.dll
2009-05-30 09:14:50 ----A---- C:\Windows\system32\slwmi.dll
2009-05-30 09:14:50 ----A---- C:\Windows\system32\msxbde40.dll
2009-05-30 09:14:50 ----A---- C:\Windows\system32\msexcl40.dll
2009-05-30 09:14:50 ----A---- C:\Windows\system32\comsvcs.dll
2009-05-30 09:14:48 ----A---- C:\Windows\system32\vssapi.dll
2009-05-30 09:14:48 ----A---- C:\Windows\system32\DevicePairingProxy.dll
2009-05-30 09:14:48 ----A---- C:\Windows\system32\authui.dll
2009-05-30 09:14:47 ----A---- C:\Windows\system32\PresentationHost.exe
2009-05-30 09:14:47 ----A---- C:\Windows\system32\mstscax.dll
2009-05-30 09:14:47 ----A---- C:\Windows\system32\msrepl40.dll
2009-05-30 09:14:46 ----A---- C:\Windows\system32\propsys.dll
2009-05-30 09:14:46 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-05-30 09:14:46 ----A---- C:\Windows\system32\newdev.dll
2009-05-30 09:14:46 ----A---- C:\Windows\system32\iasrecst.dll
2009-05-30 09:14:46 ----A---- C:\Windows\system32\explorer.exe
2009-05-30 09:14:46 ----A---- C:\Windows\system32\eudcedit.exe
2009-05-30 09:14:46 ----A---- C:\Windows\system32\crypt32.dll
2009-05-30 09:14:45 ----A---- C:\Windows\system32\setupapi.dll
2009-05-30 09:14:45 ----A---- C:\Windows\system32\mspbde40.dll
2009-05-30 09:14:45 ----A---- C:\Windows\system32\d3d9.dll
2009-05-30 09:14:44 ----A---- C:\Windows\system32\shlwapi.dll
2009-05-30 09:14:44 ----A---- C:\Windows\system32\msltus40.dll
2009-05-30 09:14:44 ----A---- C:\Windows\system32\mfc42.dll
2009-05-30 09:14:44 ----A---- C:\Windows\system32\davclnt.dll
2009-05-30 09:14:43 ----A---- C:\Windows\system32\wevtapi.dll
2009-05-30 09:14:43 ----A---- C:\Windows\system32\photowiz.dll
2009-05-30 09:14:43 ----A---- C:\Windows\system32\nlhtml.dll
2009-05-30 09:14:43 ----A---- C:\Windows\system32\msrd3x40.dll
2009-05-30 09:14:43 ----A---- C:\Windows\system32\browseui.dll
2009-05-30 09:14:42 ----A---- C:\Windows\system32\quartz.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\xmlfilter.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\winhttp.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\win32spl.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\WcnNetsh.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\SLCommDlg.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\oleaut32.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\netshell.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\mswstr10.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\msv1_0.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\msctf.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\kerberos.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\apds.dll
2009-05-30 09:14:40 ----A---- C:\Windows\system32\msvcrt.dll
2009-05-30 09:14:40 ----A---- C:\Windows\system32\mfc42u.dll
2009-05-30 09:14:40 ----A---- C:\Windows\system32\eapphost.dll
2009-05-30 09:14:39 ----A---- C:\Windows\system32\sqlsrv32.dll
2009-05-30 09:14:39 ----A---- C:\Windows\system32\secur32.dll
2009-05-30 09:14:39 ----A---- C:\Windows\system32\propdefs.dll
2009-05-30 09:14:39 ----A---- C:\Windows\system32\odbc32.dll
2009-05-30 09:14:39 ----A---- C:\Windows\system32\msrd2x40.dll
2009-05-30 09:14:38 ----A---- C:\Windows\system32\shdocvw.dll
2009-05-30 09:14:38 ----A---- C:\Windows\system32\dbgeng.dll
2009-05-30 09:14:37 ----A---- C:\Windows\system32\WsmSvc.dll
2009-05-30 09:14:37 ----A---- C:\Windows\system32\wevtutil.exe
2009-05-30 09:14:37 ----A---- C:\Windows\system32\usp10.dll
2009-05-30 09:14:37 ----A---- C:\Windows\system32\mssitlb.dll
2009-05-30 09:14:37 ----A---- C:\Windows\system32\mmcndmgr.dll
2009-05-30 09:14:36 ----A---- C:\Windows\system32\schannel.dll
2009-05-30 09:14:36 ----A---- C:\Windows\system32\netlogon.dll
2009-05-30 09:14:36 ----A---- C:\Windows\system32\msscb.dll
2009-05-30 09:14:36 ----A---- C:\Windows\system32\msctfp.dll
2009-05-30 09:14:36 ----A---- C:\Windows\system32\fdBthProxy.dll
2009-05-30 09:14:36 ----A---- C:\Windows\system32\drvinst.exe
2009-05-30 09:14:36 ----A---- C:\Windows\system32\devmgr.dll
2009-05-30 09:14:36 ----A---- C:\Windows\system32\adsldpc.dll
2009-05-30 09:14:35 ----A---- C:\Windows\system32\WSDApi.dll
2009-05-30 09:14:35 ----A---- C:\Windows\system32\WMVSDECD.DLL
2009-05-30 09:14:35 ----A---- C:\Windows\system32\Wldap32.dll
2009-05-30 09:14:35 ----A---- C:\Windows\system32\WindowsCodecs.dll
2009-05-30 09:14:35 ----A---- C:\Windows\system32\wcnwiz.dll
2009-05-30 09:14:35 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2009-05-30 09:14:35 ----A---- C:\Windows\system32\evr.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\wcncsvc.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\taskeng.exe
2009-05-30 09:14:34 ----A---- C:\Windows\system32\services.exe
2009-05-30 09:14:34 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\mswdat10.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\msjter40.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\msdtcprx.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\msdrm.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\mimefilt.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\ipsmsnap.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\comdlg32.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\certcli.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\adtschema.dll
2009-05-30 09:14:33 ----A---- C:\Windows\system32\WMNetMgr.dll
2009-05-30 09:14:33 ----A---- C:\Windows\system32\rtffilt.dll
2009-05-30 09:14:33 ----A---- C:\Windows\system32\rsaenh.dll
2009-05-30 09:14:33 ----A---- C:\Windows\system32\reg.exe
2009-05-30 09:14:33 ----A---- C:\Windows\system32\msshooks.dll
2009-05-30 09:14:33 ----A---- C:\Windows\system32\msscntrs.dll
2009-05-30 09:14:33 ----A---- C:\Windows\system32\msihnd.dll
2009-05-30 09:14:33 ----A---- C:\Windows\system32\dnsapi.dll
2009-05-30 09:14:33 ----A---- C:\Windows\system32\certutil.exe
2009-05-30 09:14:32 ----A---- C:\Windows\system32\TsWpfWrp.exe
2009-05-30 09:14:32 ----A---- C:\Windows\system32\netapi32.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\mtxclu.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\msstrc.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\mscories.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\MMDevAPI.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\inetcomm.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\hidserv.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\fundisc.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\dhcpcsvc6.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\dfshim.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\cryptsvc.dll
2009-05-30 09:14:31 ----A---- C:\Windows\system32\shsvcs.dll
2009-05-30 09:14:31 ----A---- C:\Windows\system32\msiexec.exe
2009-05-30 09:14:31 ----A---- C:\Windows\system32\imapi.dll
2009-05-30 09:14:31 ----A---- C:\Windows\system32\gameux.dll
2009-05-30 09:14:30 ----A---- C:\Windows\system32\wdc.dll
2009-05-30 09:14:30 ----A---- C:\Windows\system32\imm32.dll
2009-05-30 09:14:30 ----A---- C:\Windows\system32\iassdo.dll
2009-05-30 09:14:30 ----A---- C:\Windows\system32\chsbrkr.dll
2009-05-30 09:14:29 ----A---- C:\Windows\system32\spcmsg.dll
2009-05-30 09:14:29 ----A---- C:\Windows\system32\scrrun.dll
2009-05-30 09:14:29 ----A---- C:\Windows\system32\pnidui.dll
2009-05-30 09:14:29 ----A---- C:\Windows\system32\autofmt.exe
2009-05-30 09:14:28 ----A---- C:\Windows\system32\slmgr.vbs
2009-05-30 09:14:28 ----A---- C:\Windows\system32\pidgenx.dll
2009-05-30 09:14:28 ----A---- C:\Windows\system32\pdh.dll
2009-05-30 09:14:28 ----A---- C:\Windows\system32\dhcpcsvc.dll
2009-05-30 09:14:28 ----A---- C:\Windows\system32\CertEnrollUI.dll
2009-05-30 09:14:28 ----A---- C:\Windows\system32\azroles.dll
2009-05-30 09:14:27 ----A---- C:\Windows\system32\wmpmde.dll
2009-05-30 09:14:27 ----A---- C:\Windows\system32\winlogon.exe
2009-05-30 09:14:27 ----A---- C:\Windows\system32\SyncCenter.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\untfs.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\spp.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\sethc.exe
2009-05-30 09:14:26 ----A---- C:\Windows\system32\scrobj.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\rtutils.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\ncrypt.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\msjetoledb40.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\iassam.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\comuid.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\certmgr.dll
2009-05-30 09:14:25 ----A---- C:\Windows\system32\taskcomp.dll
2009-05-30 09:14:25 ----A---- C:\Windows\system32\autochk.exe
2009-05-30 09:14:24 ----A---- C:\Windows\system32\WMVDECOD.DLL
2009-05-30 09:14:24 ----A---- C:\Windows\system32\userenv.dll
2009-05-30 09:14:24 ----A---- C:\Windows\system32\printui.dll
2009-05-30 09:14:24 ----A---- C:\Windows\system32\onex.dll
2009-05-30 09:14:24 ----A---- C:\Windows\system32\iasnap.dll
2009-05-30 09:14:24 ----A---- C:\Windows\system32\cscript.exe
2009-05-30 09:14:24 ----A---- C:\Windows\system32\basecsp.dll
2009-05-30 09:14:24 ----A---- C:\Windows\system32\autoconv.exe
2009-05-30 09:14:24 ----A---- C:\Windows\system32\audiodg.exe
2009-05-30 09:14:23 ----A---- C:\Windows\system32\RelMon.dll
2009-05-30 09:14:23 ----A---- C:\Windows\system32\osk.exe
2009-05-30 09:14:23 ----A---- C:\Windows\system32\mswsock.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\WinSCard.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\winmm.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\WerFaultSecure.exe
2009-05-30 09:14:22 ----A---- C:\Windows\system32\WerFault.exe
2009-05-30 09:14:22 ----A---- C:\Windows\system32\Utilman.exe
2009-05-30 09:14:22 ----A---- C:\Windows\system32\stobject.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\SndVol.exe
2009-05-30 09:14:22 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\secproc_ssp.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\rdpencom.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\offfilt.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\msftedit.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\mscms.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\mfplat.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\diskraid.exe
2009-05-30 09:14:22 ----A---- C:\Windows\system32\apphelp.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\wscript.exe
2009-05-30 09:14:21 ----A---- C:\Windows\system32\wscntfy.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\ulib.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\rastapi.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\prnntfy.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\pnpsetup.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\odbccp32.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\msnetobj.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\IPHLPAPI.DLL
2009-05-30 09:14:21 ----A---- C:\Windows\system32\iasdatastore.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\fdProxy.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\dsound.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\cryptui.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\AudioEng.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\adsmsext.dll
2009-05-30 09:14:20 ----A---- C:\Windows\system32\wlangpui.dll
2009-05-30 09:14:20 ----A---- C:\Windows\system32\vdsdyn.dll
2009-05-30 09:14:20 ----A---- C:\Windows\system32\rastls.dll
2009-05-30 09:14:20 ----A---- C:\Windows\system32\ipsecsnp.dll
2009-05-30 09:14:20 ----A---- C:\Windows\system32\iashlpr.dll
2009-05-30 09:14:20 ----A---- C:\Windows\system32\gpapi.dll
2009-05-30 09:14:20 ----A---- C:\Windows\system32\diskpart.exe
2009-05-30 09:14:19 ----A---- C:\Windows\system32\wusa.exe
2009-05-30 09:14:19 ----A---- C:\Windows\system32\WMVENCOD.DLL
2009-05-30 09:14:19 ----A---- C:\Windows\system32\rasapi32.dll
2009-05-30 09:14:19 ----A---- C:\Windows\system32\ntprint.dll
2009-05-30 09:14:19 ----A---- C:\Windows\system32\netiohlp.dll
2009-05-30 09:14:19 ----A---- C:\Windows\system32\mscorier.dll
2009-05-30 09:14:19 ----A---- C:\Windows\system32\logman.exe
2009-05-30 09:14:19 ----A---- C:\Windows\system32\iasrad.dll
2009-05-30 09:14:18 ----A---- C:\Windows\system32\zipfldr.dll
2009-05-30 09:14:18 ----A---- C:\Windows\system32\wshext.dll
2009-05-30 09:14:18 ----A---- C:\Windows\system32\wer.dll
2009-05-30 09:14:18 ----A---- C:\Windows\system32\rasdlg.dll
2009-05-30 09:14:18 ----A---- C:\Windows\system32\netcenter.dll
2009-05-30 09:14:18 ----A---- C:\Windows\system32\iassvcs.dll
2009-05-30 09:14:18 ----A---- C:\Windows\system32\findstr.exe
2009-05-30 09:14:17 ----A---- C:\Windows\system32\wsnmp32.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\tsbyuv.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\themecpl.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\slcc.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\scansetting.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\ntmarta.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\msutb.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\mstlsapi.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\mssprxy.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\iasads.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\wlanhlp.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\powrprof.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\powercpl.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\PerfCenterCPL.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\newdev.exe
2009-05-30 09:14:16 ----A---- C:\Windows\system32\networkmap.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\mstsc.exe
2009-05-30 09:14:16 ----A---- C:\Windows\system32\lpk.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\icardres.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\iasacct.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\authz.dll
2009-05-30 09:14:13 ----A---- C:\Windows\system32\systemcpl.dll
2009-05-30 09:14:13 ----A---- C:\Windows\system32\sud.dll
2009-05-30 09:14:13 ----A---- C:\Windows\system32\pcaui.dll
2009-05-30 09:14:13 ----A---- C:\Windows\system32\connect.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\wpcao.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\wlanpref.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\vdsutil.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\usercpl.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\themeui.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\samlib.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\rpchttp.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\regapi.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\qdvd.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\msinfo32.exe
2009-05-30 09:14:12 ----A---- C:\Windows\system32\mmci.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\autoplay.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\accessibilitycpl.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\WMPEncEn.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\tapisrv.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\scksp.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\scesrv.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\psisdecd.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\oleprn.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\mpr.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\feclient.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\AudioSes.dll
2009-05-30 09:14:10 ----A---- C:\Windows\system32\wscisvif.dll
2009-05-30 09:14:10 ----A---- C:\Windows\system32\rekeywiz.exe
2009-05-30 09:14:10 ----A---- C:\Windows\system32\qedit.dll
2009-05-30 09:14:10 ----A---- C:\Windows\system32\perfdisk.dll
2009-05-30 09:14:10 ----A---- C:\Windows\system32\ncryptui.dll
2009-05-30 09:14:10 ----A---- C:\Windows\system32\iaspolcy.dll
2009-05-30 09:14:10 ----A---- C:\Windows\system32\hdwwiz.exe
2009-05-30 09:14:10 ----A---- C:\Windows\system32\Faultrep.dll
2009-05-30 09:14:10 ----A---- C:\Windows\system32\dpapimig.exe
2009-05-30 09:14:10 ----A---- C:\Windows\system32\dot3msm.dll
2009-05-30 09:14:10 ----A---- C:\Windows\system32\certreq.exe
2009-05-30 09:14:09 ----A---- C:\Windows\system32\whealogr.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\TSTheme.exe
2009-05-30 09:14:09 ----A---- C:\Windows\system32\tcpmon.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\tcpipcfg.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\spwinsat.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\SmartcardCredentialProvider.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\scecli.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\rasplap.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\rasgcw.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\FWPUCLNT.DLL
2009-05-30 09:14:09 ----A---- C:\Windows\system32\fdWSD.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\cmmon32.exe
2009-05-30 09:14:08 ----A---- C:\Windows\system32\wiaaut.dll
2009-05-30 09:14:08 ----A---- C:\Windows\system32\SCardSvr.dll
2009-05-30 09:14:08 ----A---- C:\Windows\system32\raschap.dll
2009-05-30 09:14:08 ----A---- C:\Windows\system32\MSVidCtl.dll
2009-05-30 09:14:08 ----A---- C:\Windows\system32\fontext.dll
2009-05-30 09:14:08 ----A---- C:\Windows\system32\conime.exe
2009-05-30 09:14:08 ----A---- C:\Windows\system32\cmdial32.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\WMVXENCD.DLL
2009-05-30 09:14:07 ----A---- C:\Windows\system32\wlanui.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\wlanmsm.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\shwebsvc.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\shsetup.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\rasppp.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\rasmontr.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\oobefldr.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\mscandui.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\modemui.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\dsprop.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\dimsroam.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\WSDMon.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\wmpeffects.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\wmdrmsdk.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\wlgpclnt.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\netplwiz.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\dataclen.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\credui.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\chtbrkr.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\blackbox.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\AUDIOKSE.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\wscapi.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\wpdwcn.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\wpcsvc.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\thawbrkr.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\sendmail.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\networkexplorer.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\msscp.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\msimtf.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\logagent.exe
2009-05-30 09:14:05 ----A---- C:\Windows\system32\InkEd.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\ifmon.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\gpresult.exe
2009-05-30 09:14:05 ----A---- C:\Windows\system32\cipher.exe
2009-05-30 09:14:04 ----A---- C:\Windows\system32\softkbd.dll
2009-05-30 09:14:04 ----A---- C:\Windows\system32\puiapi.dll
2009-05-30 09:14:04 ----A---- C:\Windows\system32\olepro32.dll
2009-05-30 09:14:04 ----A---- C:\Windows\system32\msctfui.dll
2009-05-30 09:14:04 ----A---- C:\Windows\system32\MediaMetadataHandler.dll
2009-05-30 09:14:04 ----A---- C:\Windows\system32\drmmgrtn.dll
2009-05-30 09:14:04 ----A---- C:\Windows\system32\dmsynth.dll
2009-05-30 09:14:04 ----A---- C:\Windows\system32\Apphlpdm.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\wshbth.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\wmdrmdev.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\WMADMOD.DLL
2009-05-30 09:14:03 ----A---- C:\Windows\system32\version.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\msisip.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\mprapi.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\input.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\fdSSDP.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\fc.exe
2009-05-30 09:14:03 ----A---- C:\Windows\system32\ExplorerFrame.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\dmusic.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\wsdchngr.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\wmdrmnet.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\SMBHelperClass.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\rrinstaller.exe
2009-05-30 09:14:02 ----A---- C:\Windows\system32\rasdial.exe
2009-05-30 09:14:02 ----A---- C:\Windows\system32\rasdiag.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\PortableDeviceTypes.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\msjint40.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\MsCtfMonitor.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\l2nacp.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\ftp.exe
2009-05-30 09:14:02 ----A---- C:\Windows\system32\eapp3hst.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\cscdll.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\cscapi.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\tscupgrd.exe
2009-05-30 09:14:01 ----A---- C:\Windows\system32\slcinst.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\ocsetup.exe
2009-05-30 09:14:01 ----A---- C:\Windows\system32\nslookup.exe
2009-05-30 09:14:01 ----A---- C:\Windows\system32\networkitemfactory.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\MSMPEG2ENC.DLL
2009-05-30 09:14:01 ----A---- C:\Windows\system32\MSAC3ENC.DLL
2009-05-30 09:14:01 ----A---- C:\Windows\system32\mmcico.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\mfps.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\ipconfig.exe
2009-05-30 09:14:01 ----A---- C:\Windows\system32\hbaapi.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\FwRemoteSvr.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\fdWCN.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\fdeploy.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\eappgnui.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\eappcfg.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\dot3cfg.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\CHxReadingStringIME.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\bthudtask.exe
2009-05-30 09:14:01 ----A---- C:\Windows\system32\aaclient.dll
2009-05-30 09:14:00 ----A---- C:\Windows\system32\tsgqec.dll
2009-05-30 09:14:00 ----A---- C:\Windows\system32\mfpmp.exe
2009-05-30 09:14:00 ----A---- C:\Windows\system32\gpupdate.exe
2009-05-30 09:14:00 ----A---- C:\Windows\system32\atmlib.dll
2009-05-30 09:13:59 ----A---- C:\Windows\system32\wmpps.dll
2009-05-30 09:13:59 ----A---- C:\Windows\system32\winrnr.dll
2009-05-30 09:13:59 ----A---- C:\Windows\system32\vdmdbg.dll
2009-05-30 09:13:59 ----A---- C:\Windows\system32\slwga.dll
2009-05-30 09:13:59 ----A---- C:\Windows\system32\odbcconf.dll
2009-05-30 09:13:59 ----A---- C:\Windows\system32\NcdProp.dll
2009-05-30 09:13:58 ----A---- C:\Windows\system32\midimap.dll
2009-05-30 09:13:58 ----A---- C:\Windows\system32\atmfd.dll
2009-05-30 09:13:57 ----A---- C:\Windows\system32\spwmp.dll
2009-05-30 09:13:57 ----A---- C:\Windows\system32\dxmasf.dll
2009-05-30 09:13:56 ----A---- C:\Windows\system32\wmploc.DLL
2009-05-30 09:13:56 ----A---- C:\Windows\system32\msimsg.dll
2009-05-30 09:13:56 ----A---- C:\Windows\system32\mferror.dll
2009-05-30 09:13:56 ----A---- C:\Windows\system32\f3ahvoas.dll
2009-05-30 09:13:44 ----A---- C:\Windows\system32\wdscore.dll
2009-05-30 09:13:40 ----A---- C:\Windows\system32\drvstore.dll
2009-05-24 12:04:01 ----D---- C:\Users\Gwen E. Murray\AppData\Roaming\HP
2009-05-24 11:59:58 ----D---- C:\Windows\system32\spool
2009-05-24 11:59:29 ----D---- C:\Program Files (x86)\Common Files\HP
2009-05-24 11:59:26 ----D---- C:\Program Files (x86)\Common Files\Hewlett-Packard
2009-05-24 11:59:24 ----D---- C:\Program Files (x86)\Hewlett-Packard
2009-05-24 11:49:57 ----A---- C:\hpzids40.dll
2009-05-24 11:49:56 ----A---- C:\Windows\system32\hpzc35jy.dll
2009-05-24 11:49:56 ----A---- C:\Windows\system32\hpcdmc32.dll
2009-05-24 11:49:29 ----RA---- C:\Windows\hpzshl40.exe
2009-05-24 11:49:29 ----RA---- C:\Windows\hpzmsi01.exe
2009-05-24 11:49:28 ----D---- C:\Windows\braveheart
2009-05-24 11:49:15 ----D---- C:\Program Files (x86)\HP
2009-05-24 11:49:13 ----HD---- C:\Config.Msi

======List of files/folders modified in the last 1 months======

2009-06-15 09:43:17 ----D---- C:\Windows\Prefetch
2009-06-15 09:43:16 ----D---- C:\Windows\Temp
2009-06-15 09:43:05 ----D---- C:\Windows\System32
2009-06-15 09:43:04 ----D---- C:\Windows\inf
2009-06-15 09:43:01 ----RD---- C:\Program Files (x86)
2009-06-15 08:05:04 ----D---- C:\Windows
2009-06-14 15:47:54 ----D---- C:\Windows\SysWOW64
2009-06-14 14:31:45 ----D---- C:\Windows\system32\drivers
2009-06-14 14:31:44 ----HD---- C:\ProgramData
2009-06-14 13:26:26 ----SHD---- C:\Windows\Installer
2009-06-14 10:23:52 ----SHD---- C:\System Volume Information
2009-06-14 07:41:31 ----SD---- C:\Users\Gwen E. Murray\AppData\Roaming\Microsoft
2009-06-13 21:21:59 ----D---- C:\Users\Gwen E. Murray\AppData\Roaming\LimeWire
2009-06-09 19:19:04 ----D---- C:\Windows\Microsoft.NET
2009-06-09 19:11:37 ----D---- C:\Windows\system32\migration
2009-06-09 19:11:37 ----D---- C:\Program Files (x86)\Internet Explorer
2009-06-09 19:11:33 ----D---- C:\Windows\ehome
2009-06-09 19:07:58 ----D---- C:\Windows\winsxs
2009-06-09 19:07:28 ----D---- C:\Program Files (x86)\Microsoft Works
2009-05-30 10:15:39 ----RSD---- C:\Windows\assembly
2009-05-30 09:51:46 ----D---- C:\Windows\rescache
2009-05-30 09:39:38 ----SHD---- C:\Boot
2009-05-30 09:39:05 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-05-30 09:31:43 ----D---- C:\Program Files (x86)\Windows Sidebar
2009-05-30 09:31:43 ----D---- C:\Program Files (x86)\Windows Photo Gallery
2009-05-30 09:31:43 ----D---- C:\Program Files (x86)\Windows Media Player
2009-05-30 09:31:43 ----D---- C:\Program Files (x86)\Windows Mail
2009-05-30 09:31:43 ----D---- C:\Program Files (x86)\Windows Calendar
2009-05-30 09:31:43 ----D---- C:\Program Files (x86)\Common Files\System
2009-05-30 09:31:42 ----D---- C:\Windows\servicing
2009-05-30 09:31:28 ----D---- C:\Windows\system32\XPSViewer
2009-05-30 09:31:28 ----D---- C:\Windows\system32\sk-SK
2009-05-30 09:31:28 ----D---- C:\Windows\system32\lv-LV
2009-05-30 09:31:28 ----D---- C:\Windows\system32\ko-KR
2009-05-30 09:31:28 ----D---- C:\Windows\system32\hr-HR
2009-05-30 09:31:28 ----D---- C:\Windows\system32\et-EE
2009-05-30 09:31:28 ----D---- C:\Windows\system32\da-DK
2009-05-30 09:31:25 ----D---- C:\Windows\system32\en-US
2009-05-30 09:31:22 ----D---- C:\Windows\system32\oobe
2009-05-30 09:31:22 ----D---- C:\Windows\system32\it-IT
2009-05-30 09:31:22 ----D---- C:\Windows\system32\el-GR
2009-05-30 09:31:22 ----D---- C:\Windows\system32\de-DE
2009-05-30 09:31:19 ----D---- C:\Windows\system32\zh-CN
2009-05-30 09:31:19 ----D---- C:\Windows\system32\sv-SE
2009-05-30 09:31:19 ----D---- C:\Windows\system32\sr-Latn-CS
2009-05-30 09:31:19 ----D---- C:\Windows\system32\SLUI
2009-05-30 09:31:19 ----D---- C:\Windows\system32\setup
2009-05-30 09:31:19 ----D---- C:\Windows\system32\ru-RU
2009-05-30 09:31:19 ----D---- C:\Windows\system32\pt-PT
2009-05-30 09:31:19 ----D---- C:\Windows\system32\hu-HU
2009-05-30 09:31:19 ----D---- C:\Windows\system32\he-IL
2009-05-30 09:31:19 ----D---- C:\Windows\system32\fr-FR
2009-05-30 09:31:19 ----D---- C:\Windows\system32\fi-FI
2009-05-30 09:31:19 ----D---- C:\Windows\system32\en
2009-05-30 09:31:19 ----D---- C:\Windows\system32\cs-CZ
2009-05-30 09:31:19 ----D---- C:\Windows\system32\AdvancedInstallers
2009-05-30 09:31:18 ----D---- C:\Windows\system32\zh-TW
2009-05-30 09:31:18 ----D---- C:\Windows\system32\uk-UA
2009-05-30 09:31:18 ----D---- C:\Windows\system32\tr-TR
2009-05-30 09:31:18 ----D---- C:\Windows\system32\th-TH
2009-05-30 09:31:18 ----D---- C:\Windows\system32\sl-SI
2009-05-30 09:31:18 ----D---- C:\Windows\system32\ro-RO
2009-05-30 09:31:18 ----D---- C:\Windows\system32\pl-PL
2009-05-30 09:31:18 ----D---- C:\Windows\system32\manifeststore
2009-05-30 09:31:18 ----D---- C:\Windows\system32\ja-JP
2009-05-30 09:31:18 ----D---- C:\Windows\system32\es-ES
2009-05-30 09:31:18 ----D---- C:\Windows\system32\bg-BG
2009-05-30 09:31:17 ----D---- C:\Windows\system32\wbem
2009-05-30 09:31:17 ----D---- C:\Windows\system32\nl-NL
2009-05-30 09:31:17 ----D---- C:\Windows\system32\nb-NO
2009-05-30 09:31:16 ----D---- C:\Windows\system32\pt-BR
2009-05-30 09:31:16 ----D---- C:\Windows\system32\migwiz
2009-05-30 09:31:16 ----D---- C:\Windows\system32\lt-LT
2009-05-30 09:31:16 ----D---- C:\Windows\system32\ar-SA
2009-05-30 09:30:52 ----D---- C:\Windows\IME
2009-05-30 09:30:08 ----RSD---- C:\Windows\Fonts
2009-05-30 09:30:06 ----D---- C:\Windows\AppPatch
2009-05-30 09:28:22 ----D---- C:\Windows\system32\RTCOM
2009-05-24 12:46:24 ----D---- C:\Windows\system32\Macromed
2009-05-24 12:44:19 ----SD---- C:\Windows\Downloaded Program Files
2009-05-24 12:03:57 ----A---- C:\Windows\win.ini
2009-05-24 11:59:31 ----D---- C:\Windows\twain_32
2009-05-24 11:59:29 ----D---- C:\Program Files (x86)\Common Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 mfehidk;McAfee Inc. mfehidk; C:\Windows\system32\drivers\mfehidk.sys []
R1 MPFP;MPFP; C:\Windows\System32\Drivers\Mpfp.sys []
R2 RtNdPt60;Realtek NDIS Protocol Driver; C:\Windows\system32\DRIVERS\RtNdPt60.sys []
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys []
R3 BCM43XX;Dell Wireless WLAN Card Driver; C:\Windows\system32\DRIVERS\bcmwl664.sys []
R3 dc3d;USBCCGP filter driver (dc3d); C:\Windows\system32\DRIVERS\dc3d.sys []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys []
R3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys []
R3 HidBatt;HID UPS Battery Driver; C:\Windows\system32\DRIVERS\HidBatt.sys []
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys []
R3 ksthunk;Kernel Streaming Thunks; C:\Windows\system32\drivers\ksthunk.sys []
R3 mfeavfk;McAfee Inc. mfeavfk; C:\Windows\system32\drivers\mfeavfk.sys []
R3 mfesmfk;McAfee Inc. mfesmfk; C:\Windows\system32\drivers\mfesmfk.sys []
R3 NuidFltr;NUID filter driver; C:\Windows\system32\DRIVERS\NuidFltr.sys []
R3 RimVSerPort;RIM Virtual Serial Port v2; C:\Windows\system32\DRIVERS\RimSerial_AMD64.sys []
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\Windows\System32\Drivers\RootMdm.sys []
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh64.sys []
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys []
S3 dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys []
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys []
S3 Dot4Scan;Scan Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Scan.sys []
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys []
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys []
S3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\Windows\system32\DRIVERS\e1e6032e.sys []
S3 mferkdk;McAfee Inc. mferkdk; C:\Windows\system32\drivers\mferkdk.sys []
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys []
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys []
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys []
S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys []
S3 RimUsb;BlackBerry Smartphone; C:\Windows\System32\Drivers\RimUsb_AMD64.sys []
S3 StillCam;Still Serial Digital Camera Driver; C:\Windows\system32\DRIVERS\serscan.sys []
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys []
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys []
S4 iaStor;Intel AHCI Controller; C:\Windows\system32\drivers\iastor.sys []
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys []
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys []

[infectedone]

RSIT Log.txt (Part 2)


======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AERTFilters;Andrea RT Filters Service; C:\Windows\system32\AERTSr64.exe []
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-06 132424]
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe []
R2 Bonjour Service;Bonjour Service; C:\Program Files (x86)\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 DockLoginService;Dock Login Service; C:\Program Files\Dell\DellDock\DockLogin.exe [2008-08-22 214016]
R2 hpqddsvc;HP CUE DeviceDiscovery Service; C:\Windows\system32\svchost.exe [2008-01-20 21504]
R2 HPSLPSVC;HP Network Devices Support; C:\Windows\system32\svchost.exe [2008-01-20 21504]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [2009-02-11 210216]
R2 mcmscsvc;McAfee Services; C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe [2009-03-25 797864]
R2 McNASvc;McAfee Network Agent; c:\PROGRA~2\COMMON~1\mcafee\mna\mcnasvc.exe [2009-01-09 2482848]
R2 McProxy;McAfee Proxy Service; c:\PROGRA~2\COMMON~1\mcafee\mcproxy\mcproxy.exe [2009-01-09 359952]
R2 McShield;McAfee Real-time Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [2009-03-25 153920]
R2 MpfService;McAfee Personal Firewall Service; C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe [2009-03-19 884360]
R2 MSK80Service;McAfee Anti-Spam Service; C:\Program Files (x86)\McAfee\MSK\MskSrver.exe [2009-01-09 26640]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-20 21504]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-20 21504]
R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\Windows\System32\WLTRYSVC.EXE C:\Windows\System32\bcmwltry.exe []
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-20 21504]
R3 iPod Service;iPod Service; C:\Program Files (x86)\iPod\bin\iPodService.exe [2009-04-02 656168]
R3 McSysmon;McAfee SystemGuards; C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe [2009-03-24 606736]
S2 Roxio Upnp Server 9;Roxio Upnp Server 9; C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exe [2007-07-24 358896]
S2 RoxLiveShare9;LiveShare P2P Server 9; C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe [2007-08-16 309744]
S2 RoxWatch9;Roxio Hard Drive Watcher 9; C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe [2007-08-16 166384]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-10-23 69632]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe []
S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-03-30 89920]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-11-09 651720]
S3 gusvc;Google Software Updater; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-27 182768]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 MBackMonitor;MBackMonitor; C:\Program Files (x86)\McAfee\MBK\MBackMonitor.exe [2009-01-09 68112]
S3 McODS;McAfee Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [2009-04-01 696848]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PerfHost;@%systemroot%\sysWow64\perfhost.exe,-2; C:\Windows\SysWow64\perfhost.exe [2008-01-20 19968]
S3 QBFCService;Intuit QuickBooks FCS; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [2006-11-09 65536]
S3 Roxio UPnP Renderer 9;Roxio UPnP Renderer 9; C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe [2007-07-24 88560]
S3 RoxMediaDB9;RoxMediaDB9; C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2007-08-16 1092080]
S3 stllssvr;stllssvr; C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe [2008-03-24 74384]
S4 QBCFMonitorService;QBCFMonitorService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [2008-03-18 20480]

-----------------EOF-----------------

[infectedone]

RSIT Info.txt follows:

info.txt logfile of random's system information tool 1.06 2009-06-15 09:43:19

======Uninstall list======

-->C:\PROGRA~2\Yahoo!\Common\UNYT_W~1.EXE
-->MsiExec.exe /I{2BE0C605-9BEC-434D-9FAE-931194E72414}
-->MsiExec.exe /I{48A669A9-76FA-4CA8-BFD5-00C125AC4166}
-->MsiExec.exe /I{71EEA108-09C9-4D81-8FA2-D48C70681242}
-->MsiExec.exe /I{726A362E-EBFD-4C3F-8664-6593C2B08386}
-->MsiExec.exe /I{943CB81D-11B9-401E-8305-752528D00AA1}
-->MsiExec.exe /I{E75F019D-98A0-4B39-B1A8-3A01400D2A18}
-->MsiExec.exe /X{F664EDB9-59DF-452A-A3D7-085ED1B8D374}
Acrobat.com-->C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe -uninstall com.adobe.mauby 4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
Acrobat.com-->MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07}
Adobe Acrobat 9 Standard - English, Français, Deutsch-->msiexec /I {AC76BA86-1033-F400-BA7E-000000000004}
Adobe Acrobat 9 Standard - English, Français, Deutsch-->msiexec /I {AC76BA86-1033-F400-BA7E-000000000004}
Adobe AIR-->C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{00203668-8170-44A0-BE44-B632FA4D780F}
Adobe Flash Player 10 ActiveX-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe
Adobe GoLive CS (ENG)-->"C:\Program Files (x86)\InstallShield Installation Information\{D3E4251D-8364-4698-B0E0-A7C799384403}\setup.exe"
Adobe Photoshop 6.0-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files (x86)\Adobe\Photoshop 6.0\Uninst.isu" -c"C:\Program Files (x86)\Adobe\Photoshop 6.0\Uninst.dll"
Adobe Reader 9.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A91000000001}
Adobe SVG Viewer-->C:\Windows\IsUninst.exe -f"C:\Windows\System32\Adobe\SVG Viewer\Uninst.isu"
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x9
Banctec Service Agreement-->MsiExec.exe /I{42D68A86-DB1C-4256-B8C9-5D0D92919AF5}
Berlitz Before You Know It Flash Cards-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{CDAE8C87-E61A-43FB-A59A-0AAF6077D0DD}\setup.exe" -l0x9
Berlitz Learning System - Spanish-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{16AA1AC2-07FA-46CF-8D3C-441D9E17EB33}\setup.exe" -l0x9
BlackBerry Desktop Software 4.3-->MsiExec.exe /I{D793A12F-E362-48BB-B332-1DA5E936B52D}
BlackBerry Desktop Software 4.3-->MsiExec.exe /i{D793A12F-E362-48BB-B332-1DA5E936B52D}
Browser Address Error Redirector-->MsiExec.exe /I{62230596-37E5-4618-A329-0D21F529A86F}
Browser Address Error Redirector-->regsvr32 /u /s "C:\Program Files (x86)\Dell\BAE\BAE.dll"
Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
Contextual Tool Precisead-->C:\Windows\system32\b53645c8-33e7-312c-a874-ad7fde53373c.exe
Dell Best of Web-->MsiExec.exe /I{C39A4E1F-9AF1-4FE1-A80E-A5B867FABB42}
Dell Getting Started Guide-->MsiExec.exe /I{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}
Dell Video Chat (remove only)-->C:\Program Files (x86)\Dell Video Chat\uninst.exe
Dell-eBay-->MsiExec.exe /I{B935C985-A17F-484B-8470-09E4FC27DC26}
EDocs-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}\setup.exe"
ERUNT 1.1j-->"C:\Program Files (x86)\ERUNT\unins000.exe"
Google Toolbar for Internet Explorer-->"C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_9DE96A29E721D90A.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
HijackThis 2.0.2-->"C:\Program Files (x86)\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->c:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->c:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {08155812-0202-4D5F-A7FF-12A2782DC548} /qb+ REBOOTPROMPT=""
HP Update-->MsiExec.exe /X{FE57DE70-95DE-4B64-9266-84DA811053DB}
Infragisticsv62Install-->MsiExec.exe /X{14D6D5E1-5425-4BD1-BAFB-C26C053DC0AF}
Infragisticsv62Install-->MsiExec.exe /X{5C01E990-F14D-4E3C-A009-29F3640F034B}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Lernout & Hauspie TruVoice American English TTS Engine-->RunDll32 advpack.dll,LaunchINFSection C:\Windows\INF\tv_enua.inf, Uninstall
Malwarebytes' Anti-Malware-->"C:\Program Files (x86)\Malwarebytes' Anti-Malware\unins000.exe"
McAfee SecurityCenter-->C:\Program Files (x86)\McAfee\MSC\mcuninst.exe
Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-002A-0000-1000-0000000FF1CE} /uninstall {E64BA721-2310-4B55-BE5A-2925F9706192}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-002A-0409-1000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0116-0409-1000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint Viewer 2007 (English)-->MsiExec.exe /X{95120000-00AF-0409-0000-0000000FF1CE}
Microsoft Office Professional 2007-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROR /dll OSETUP.DLL
Microsoft Office Professional 2007-->MsiExec.exe /X{91120000-0014-0000-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Works-->MsiExec.exe /I{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
PowerDVD-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -l0x9 -cluninstall
QuickBooks Pro 2007-->msiexec.exe /I {71EEA108-09C9-4D81-8FA2-D48C70681242} UNIQUE_NAME="pro" QBFULLNAME="QuickBooks Pro 2007" ADDREMOVE=1
QuickBooks Product Listing Service-->MsiExec.exe /I{55584E16-4D70-44EE-93DD-F144E8B7D4B7}
Quicken 2007-->MsiExec.exe /X{0D2E80C8-0875-43EB-9623-47118E2DFBCA}
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
Realtek Ethernet Network Card Diagnostic tool for Windows Vista-->C:\Program Files (x86)\InstallShield Installation Information\{1FECF5F8-8E75-432C-9FF7-1C04F1956B54}\setup.exe -runfromtemp -l0x0009 -removeonly
Realtek High Definition Audio Driver-->RtlUpd64.exe -r -m -nrg2709
RON Too1 Precisead-->C:\Windows\system32\ypkvbbfoombcatdic.exe
Roxio Creator Audio-->MsiExec.exe /I{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}
Roxio Creator Copy-->MsiExec.exe /I{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}
Roxio Creator Data-->MsiExec.exe /I{08E81ABD-79F7-49C2-881F-FD6CB0975693}
Roxio Creator DE-->C:\ProgramData\Uninstall\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}\setup.exe /x {09760D42-E223-42AD-8C3E-55B47D0DDAC3}
Roxio Creator DE-->MsiExec.exe /I{ED439A64-F018-4DD4-8BA5-328D85AB09AB}
Roxio Creator Tools-->MsiExec.exe /I{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}
Roxio Express Labeler 3-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Roxio Media Manager-->MsiExec.exe /X{303379C9-8610-4CCF-AF37-C4BF8998C591}
Roxio Update Manager-->MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB969679)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {C66E4A6C-6E07-4C63-8CCD-2493B5087C73}
Security Update for Microsoft Office Excel 2007 (KB969682)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {C03803BD-745A-46F8-8557-817DED578780}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
Spybot - Search & Destroy-->"C:\Program Files (x86)\Spybot - Search & Destroy\unins000.exe"
SupportSoft Assisted Service-->MsiExec.exe /I{5A3F6A80-7913-475E-8B96-477A952CFA43}
UltraTax 2000-->C:\WinCSI\UT00\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax 2001-->C:\WinCSI\UT01\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax 2002-->C:\WinCSI\UT02\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax 2003-->C:\WinCSI\UT03\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax 2004-->C:\WinCSI\UT04\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax CS 2005-->C:\WinCSI\UT05\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax CS 2006-->C:\WinCSI\UT06\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax CS 2007-->C:\WinCSI\UT07\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax CS 2008-->C:\WinCSI\UT08\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax Font Installer-->MsiExec.exe /I{7699AA03-8A8C-489E-AF9D-A76A5E97E879}
UltraTax Planner-->C:\WinCSI\UTP\PLUNINST.EXE -OUTP -PC:\WinCSI
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft Office 2007 Help for Common Features (KB963673)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42}
Update for Microsoft Office Access 2007 Help (KB963663)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {6B76A18A-AA1E-42AB-A7AD-6C84BBB43987}
Update for Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9}
Update for Microsoft Office Outlook 2007 (KB969907)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {74F98B24-AFBD-4800-9BD6-87D349B5C462}
Update for Microsoft Office Outlook 2007 Help (KB963677)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {0451F231-E3E3-4943-AB9F-58EB96171784}
Update for Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876}
Update for Microsoft Office Publisher 2007 Help (KB963667)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2E40DE55-B289-4C8B-8901-5D369B16814F}
Update for Microsoft Office Script Editor Help (KB963671)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
Update for Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726}
Update for Outlook 2007 Junk Email Filter (kb970012)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {DC4A962B-9EC2-469C-BC9C-87312ADAEE81}
Yahoo! Toolbar-->C:\PROGRA~2\Yahoo!\Common\UNYT_W~1.EXE

======Security center information======

AS: Windows Defender

======System event log======

Computer Name: Office-PC
Event Code: 4374
Message: Windows Servicing identified that package KB958644(Security Update) is not applicable for this system
Record Number: 8240
Source Name: Microsoft-Windows-Servicing
Time Written: 20081023221558.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: Office-PC
Event Code: 4374
Message: Windows Servicing identified that package KB958644(Security Update) is not applicable for this system
Record Number: 8239
Source Name: Microsoft-Windows-Servicing
Time Written: 20081023221557.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: Office-PC
Event Code: 4374
Message: Windows Servicing identified that package KB958644(Security Update) is not applicable for this system
Record Number: 8233
Source Name: Microsoft-Windows-Servicing
Time Written: 20081023221557.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: Office-PC
Event Code: 15016
Message: Unable to initialize the security package Kerberos for server side authentication. The data field contains the error number.
Record Number: 8133
Source Name: Microsoft-Windows-HttpEvent
Time Written: 20081023221112.918360-000
Event Type: Error
User:

Computer Name: Office-PC
Event Code: 4001
Message: WLAN AutoConfig service has successfully stopped.

Record Number: 8119
Source Name: Microsoft-Windows-WLAN-AutoConfig
Time Written: 20081023014326.328800-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

=====Application event log=====

Computer Name: Office-PC
Event Code: 10
Message: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Record Number: 554
Source Name: Microsoft-Windows-WMI
Time Written: 20081023225017.000000-000
Event Type: Error
User:

Computer Name: Office-PC
Event Code: 4621
Message: The COM+ Event System could not remove the EventSystem.EventSubscription object {AA44355E-6911-4447-BA5D-6720480579AF}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. The HRESULT was 80070005.
Record Number: 534
Source Name: Microsoft-Windows-EventSystem
Time Written: 20081023224713.000000-000
Event Type: Error
User:

Computer Name: Office-PC
Event Code: 10
Message: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Record Number: 522
Source Name: Microsoft-Windows-WMI
Time Written: 20081023221245.000000-000
Event Type: Error
User:

Computer Name: Office-PC
Event Code: 1530
Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-3087769141-909178524-1917751892-1000:
Process 588 (\Device\HarddiskVolume3\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-3087769141-909178524-1917751892-1000

Record Number: 503
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20081023014324.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: Office-PC
Event Code: 3013
Message: The entry <C:\USERS\GWEN E. MURRAY\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\ACCESSORIES\SYSTEM TOOLS\DESKTOP.INI> in the hash map cannot be updated.

Context: Windows Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

Record Number: 491
Source Name: Microsoft-Windows-Search
Time Written: 20081023011101.000000-000
Event Type: Error
User:

=====Security event log=====

Computer Name: Office-PC
Event Code: 4624
Message: An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: DHWKLLH1$
Account Domain: WORKGROUP
Logon ID: 0x3e7

Logon Type: 5

New Logon:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x26c
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name:
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 438
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20081023012213.022800-000
Event Type: Audit Success
User:

Computer Name: Office-PC
Event Code: 4648
Message: A logon was attempted using explicit credentials.

Subject:
Security ID: S-1-5-18
Account Name: DHWKLLH1$
Account Domain: WORKGROUP
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon GUID: {00000000-0000-0000-0000-000000000000}

Target Server:
Target Server Name: localhost
Additional Information: localhost

Process Information:
Process ID: 0x26c
Process Name: C:\Windows\System32\services.exe

Network Information:
Network Address: -
Port: -

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Record Number: 437
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20081023012213.022800-000
Event Type: Audit Success
User:

Computer Name: Office-PC
Event Code: 4616
Message: The system time was changed.

Subject:
Security ID: S-1-5-19
Account Name: LOCAL SERVICE
Account Domain: NT AUTHORITY
Logon ID: 0x3e5

Process Information:
Process ID: 0x424
Name: C:\Windows\System32\svchost.exe

Previous Time: 9:21:58 PM 10/22/2008
New Time: 9:22:03 PM 10/22/2008

This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
Record Number: 436
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20081023012203.061756-000
Event Type: Audit Success
User:

Computer Name: Office-PC
Event Code: 4616
Message: The system time was changed.

Subject:
Security ID: S-1-5-19
Account Name: LOCAL SERVICE
Account Domain: NT AUTHORITY
Logon ID: 0x3e5

Process Information:
Process ID: 0x424
Name: C:\Windows\System32\svchost.exe

Previous Time: 9:22:03 PM 10/22/2008
New Time: 9:22:03 PM 10/22/2008

This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
Record Number: 435
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20081023012203.061000-000
Event Type: Audit Success
User:

Computer Name: Office-PC
Event Code: 1102
Message: The audit log was cleared.
Subject:
Security ID: S-1-5-21-3087769141-909178524-1917751892-1000
Account Name: Gwen E. Murray
Domain Name: Office-PC
Logon ID: 0xd4f16
Record Number: 434
Source Name: Microsoft-Windows-Eventlog
Time Written: 20081023010859.874858-000
Event Type: Audit Success
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files (x86)\Common Files\Roxio Shared\DLLShared\;C:\Program Files (x86)\Common Files\Roxio Shared\10.0\DLLShared\;C:\Program Files (x86)\Common Files\Roxio Shared\9.0\DLLShared\;C:\Program Files (x86)\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=AMD64
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=Intel64 Family 6 Model 23 Stepping 7, GenuineIntel
"PROCESSOR_REVISION"=1707
"NUMBER_OF_PROCESSORS"=4
"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\34FB5F65-FFEB-4B61-BF0E-A6A76C450FAA\TraceFormat
"DFSTRACINGON"=FALSE
"RoxioCentral"=C:\Program Files (x86)\Common Files\Roxio Shared\9.0\Roxio Central33\
"CLASSPATH"=.;C:\Program Files (x86)\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files (x86)\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------

[Shaba]

Download OTMoveIt (http://oldtimer.geekstogo.com/OTM.exe) by Old Timer and save it to your Desktop.
Double-click OTM.exe. (Vista users, please right click on OTM.exe and select "Run as an Administrator")
Copy the lines in the codebox below.


:files
C:\Windows\system32\b53645c8-33e7-312c-a874-ad7fde53373c.exe
C:\Windows\system32\ypkvbbfoombcatdic.exe
C:\Users\Gwen E. Murray\AppData\Roaming\LimeWire

Return to OTMoveIt, right click in the Paste Instructions for Items to be Moved window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar), and paste it in your next reply.
Close OTMoveIt
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

[infectedone]

Completed without re-booting.

========== FILES ==========
C:\Windows\system32\b53645c8-33e7-312c-a874-ad7fde53373c.exe moved successfully.
C:\Windows\system32\ypkvbbfoombcatdic.exe moved successfully.
C:\Users\Gwen E. Murray\AppData\Roaming\LimeWire\themes\windows_theme moved successfully.
C:\Users\Gwen E. Murray\AppData\Roaming\LimeWire\themes moved successfully.
C:\Users\Gwen E. Murray\AppData\Roaming\LimeWire\promotion moved successfully.
C:\Users\Gwen E. Murray\AppData\Roaming\LimeWire\certificate moved successfully.
C:\Users\Gwen E. Murray\AppData\Roaming\LimeWire\.AppSpecialShare moved successfully.
C:\Users\Gwen E. Murray\AppData\Roaming\LimeWire moved successfully.

OTM by OldTimer - Version 2.1.0.1 log created on 06152009_131739

[Shaba]

Please go to Kaspersky website (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html) and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.

[infectedone]

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Monday, June 15, 2009
Operating System: Microsoft Windows Vista Home Premium Edition, 64-bit Service Pack 2 (build 6002)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Monday, June 15, 2009 12:27:39
Records in database: 2345167
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan statistics:
Files scanned: 246325
Threat name: 6
Infected objects: 10
Suspicious objects: 0
Duration of the scan: 02:39:27


File name / Threat name / Threats count
C:\Users\Gwen E. Murray\Documents\Downloads\DELL drivers\UBCD4WinV310.exe Infected: not-a-virus:NetTool.Win32.Portscan.c 1
C:\Users\Gwen E. Murray\Documents\Downloads\DELL drivers\UBCD4WinV310.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 2
C:\Users\Gwen E. Murray\Documents\Downloads\DELL drivers\UBCD4WinV310.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 1
C:\Users\Gwen E. Murray\Documents\Downloads\DELL drivers\UBCD4WinV310.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 4
C:\Users\Gwen E. Murray\Documents\Downloads\DELL drivers\UBCD4WinV310.exe Infected: not-a-virus:PSWTool.Win32.RAS.g 1
C:\Users\Gwen E. Murray\Documents\Downloads\DELL drivers\UBCD4WinV310.exe Infected: not-a-virus:PSWTool.Win32.RAS.a 1

The selected area was scanned.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:02:22 PM, on 6/15/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\PROGRA~2\Java\jre6\bin\jp2launcher.exe
C:\Program Files (x86)\Java\jre6\bin\java.exe
C:\Users\Gwen E. Murray\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~2\mcafee\msk\mskapbho.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files (x86)\Dell\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~2\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.3.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Unknown owner - C:\Windows\system32\AERTSr64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBackMonitor - McAfee - C:\Program Files (x86)\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~2\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~2\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files (x86)\McAfee\MSK\MskSrver.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12968 bytes

[Shaba]

That is fine :)

Still problems?

[infectedone]

Does that mean that we reasonably believe the "infection" is gone?

Also, there are three items still appearing in the Add/Remove Programs List - Contextual Tool PreciseAd, Ron Too1 Precisead, and Support Soft Assisted Service. I know the first two are related to the malware, not sure of the third.

Prior to the removal techniques, when I tried to use Add/Remove it would pop-up with a warning about losing some rights and then ask for a verification code as displayed on the screen to be entered.

How can I remove these items?

Thanks!!!!!!!

[Shaba]

They are likely just names on the list.

To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.

You will now be presented with a screen similar to the one below:

http://img.bleepingcomputer.com/tutorials/hijackthis/uninstall-man.jpg

5. Choose those entries and click Delete this entry.

[infectedone]

That did not work - items still appear in program list. Any other thoughts?

Thanks!

[Shaba]

Well they should not if files are not there.

Are these files still there?

C:\Windows\system32\b53645c8-33e7-312c-a874-ad7fde53373c.exe
C:\Windows\system32\ypkvbbfoombcatdic.exe

[infectedone]

The files are not there. However, there are still 4 entries in my Registry with "precisead" and there are 2 new files in Windows\systems32 --

File Name: 7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

File Name: 7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

Thanks!

[Shaba]

Are those executable files?

[infectedone]

I cannot tell. The file types are as follows:

C7483456-A289-439D-8115-601632D005A0 File

They are 4 Kb in size.

[Shaba]

Those are file names. Which is file extension?

[infectedone]

That is the file type as listed in Windows Explorer. There is visisble extension. Properties shows that it opens with Windows Shell Common Dll.

[Shaba]

Thanks for update.

Please post next which registry entries are still there.

[infectedone]

HKEY_USERS\S-1-5-21-3087769141-909178524-1917751892-1000\Software\AppDataLow\Software\{532789D3-ED32-017F-64FE-966E94FCFE09}

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\b53645c8-33e7-312c-a874-ad7fde53373c

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ypkvbbfoombcatdic

HKEY_CURRENT_USER\Software\AppDataLow\Software\{532789D3-ED32-017F-64FE-966E94FCFE09}

[Shaba]

Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):



:reg
[-HKEY_USERS\S-1-5-21-3087769141-909178524-1917751892-1000\Software\AppDataLow\Software\{532789D3-ED32-017F-64FE-966E94FCFE09}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\b53645c8-33e7-312c-a874-ad7fde53373c]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ypkvbbfoombcatdic]

[-HKEY_CURRENT_USER\Software\AppDataLow\Software\{532789D3-ED32-017F-64FE-966E94FCFE09}]

:commands
[EmptyTemp]
[reboot]


Return to OTMoveIt3, right click in the "Paste List of Files/Folders to Move" window (under the yellow bar) and choose Paste.

Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

[infectedone]

========== REGISTRY ==========
Registry key HKEY_USERS\S-1-5-21-3087769141-909178524-1917751892-1000\Software\AppDataLow\Software\{532789D3-ED32-017F-64FE-966E94FCFE09}\\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\b53645c8-33e7-312c-a874-ad7fde53373c\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ypkvbbfoombcatdic\\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\AppDataLow\Software\{532789D3-ED32-017F-64FE-966E94FCFE09}\\ not found.
========== COMMANDS ==========
File delete failed. C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF2864.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF286F.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF28C5.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF28CB.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF28FC.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF290B.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Windows\temp\mcmsc_hBypwQAL2F7FEcE scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\mcmsc_MX8l0O4XbN7s7Q5 scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\mcmsc_uvv4mExtJwRRNps scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\sqlite_azr8BvevEE8W37q scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\sqlite_c5OCAJZZVESWaeF scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\sqlite_Kx7QmNpXUXkoLKL scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\sqlite_qWKJqifSj6sc5Vm scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\sqlite_Sg9KnNCjbxv9Uhi scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\sqlite_SOpbdIrKX4ctvSK scheduled to be deleted on reboot.
Windows Temp folder emptied.
Temp folders emptied.

OTM by OldTimer - Version 2.1.0.1 log created on 06192009_183136

[infectedone]

This is the log file after re-booting (I posted the first one in case there was a problem on re-booting):

========== REGISTRY ==========
Registry key HKEY_USERS\S-1-5-21-3087769141-909178524-1917751892-1000\Software\AppDataLow\Software\{532789D3-ED32-017F-64FE-966E94FCFE09}\\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\b53645c8-33e7-312c-a874-ad7fde53373c\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ypkvbbfoombcatdic\\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\AppDataLow\Software\{532789D3-ED32-017F-64FE-966E94FCFE09}\\ not found.
========== COMMANDS ==========
File delete failed. C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF2864.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF286F.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF28C5.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF28CB.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF28FC.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF290B.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Windows\temp\mcmsc_hBypwQAL2F7FEcE scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\mcmsc_MX8l0O4XbN7s7Q5 scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\mcmsc_uvv4mExtJwRRNps scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\sqlite_azr8BvevEE8W37q scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\sqlite_c5OCAJZZVESWaeF scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\sqlite_Kx7QmNpXUXkoLKL scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\sqlite_qWKJqifSj6sc5Vm scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\sqlite_Sg9KnNCjbxv9Uhi scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\sqlite_SOpbdIrKX4ctvSK scheduled to be deleted on reboot.
Windows Temp folder emptied.
Temp folders emptied.

OTM by OldTimer - Version 2.1.0.1 log created on 06192009_183136

Files moved on Reboot...
File C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF2864.tmp not found!
File C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF286F.tmp not found!
File C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF28C5.tmp not found!
File C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF28CB.tmp not found!
File C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF28FC.tmp not found!
File C:\Users\GWENE~1.MUR\AppData\Local\Temp\~DF290B.tmp not found!
File C:\Windows\temp\mcmsc_hBypwQAL2F7FEcE not found!
File C:\Windows\temp\mcmsc_MX8l0O4XbN7s7Q5 not found!
File C:\Windows\temp\mcmsc_uvv4mExtJwRRNps not found!
C:\Windows\temp\sqlite_azr8BvevEE8W37q moved successfully.
File C:\Windows\temp\sqlite_c5OCAJZZVESWaeF not found!
File C:\Windows\temp\sqlite_Kx7QmNpXUXkoLKL not found!
C:\Windows\temp\sqlite_qWKJqifSj6sc5Vm moved successfully.
File C:\Windows\temp\sqlite_Sg9KnNCjbxv9Uhi not found!
File C:\Windows\temp\sqlite_SOpbdIrKX4ctvSK not found!

Registry entries deleted on Reboot...

[Shaba]

That looks good.

Are those registry entries still there?

[infectedone]

Registry entries are gone. Programs are also gone from Add/Remove Programs list. I re-scanned with Malwarebytes and the scan came back clean.

[Shaba]

Good :)

Still some issues left?

[infectedone]

It seems to be working fine now. Thank you for all of your help!!!!

[Shaba]

Great :)

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Next we remove all used tools.

Please download OTCleanIt (http://oldtimer.geekstogo.com/OTC.exe) and save it to desktop.

Double-click OTC.exe.
Click the CleanUp! button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.


Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.

Disable and Enable System Restore. - If you are using Windows Vista then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and re-enable system restore here:

Windows Vista System Restore Guide (http://www.bleepingcomputer.com/tutorials/tutorial143.html)

Re-enable system restore with instructions from tutorial above

Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt

Change the Download unsigned ActiveX controls to Disable

Change the Initialize and script ActiveX controls not marked as safe to Disable

Change the Installation of desktop items to Prompt

Change the Launching programs and files in an IFRAME to Prompt

Change the Navigate sub-frames across different domains to Prompt

When all these settings have been made, click on the OK button.

If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

Update your AntiVirus Software and keep your other programs up-to-date
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector (http://secunia.com/software_inspector/)
F-secure Health Check (http://www.f-secure.com/weblog/archives/00001356.html)

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com (http://www.windowsupdate.com) regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Install Malwarebytes' Anti-Malware - Malwarebytes''Anti-Malware is a new and powerful anti-malware tool. It is
totally free but for real-time protection you will have to pay a small one-time fee. Tutorial on installing & using this product can be found below:

Malwarebytes' Anti-Malware Setup Guide (http://www.lognrock.com/forum/index.php?showtopic=6926)

Malwarebytes' Anti-Malware Scanning Guide (http://www.lognrock.com/forum/index.php?showtopic=6913)

Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware (http://www.bleepingcomputer.com/tutorials/tutorial49.html)


Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety

MVPS Hosts file (http://mvps.org/winhelp2002/hosts.htm) <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Winpatrol (http://www.winpatrol.com/) <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software (http://www.winpatrol.com/features.html)

Stand Up and Be Counted ---> Malware Complaints (http://www.malwarecomplaints.info/index.php) <--- where you can make difference!

The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

Happy surfing and stay clean! :bigthumb:

[Shaba]

Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.

Note: If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than four days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.