gsmer
2010-08-31, 06:32
I seem to have a problem with "Win32.Agent.deot" I used spybot to scan the problem and fix it but it just keeps coming back. I also notice a click sound in the background around 4-6 PM everyday (which is a clue that it's back).
I just don't know how to get rid of it forever. I have tried other programs but spybot search & destroy is the only one that finds it.
Win32.Agent.deot HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lac97inf is the location it shows from spybot
DDS LOG:
DDS (Ver_10-03-17.01) - NTFSx86
Run by Matt at 21:18:54.09 on Mon 08/30/2010
Internet Explorer: 8.0.6001.18943 BrowserJavaVersion: 1.6.0_21
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2047.1249 [GMT -7:00]
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Lavasoft Ad-Watch Live! *enabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\WINDOWS\RtHDVCpl.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Matt\Downloads\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=74&bd=Presario&pf=desktop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=74&bd=Presario&pf=desktop
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [Steam] "c:\program files\valve\steam\steam.exe" -silent
mRun: [OsdMaestro] "c:\program files\hewlett-packard\on-screen osd indicator\OSD.exe"
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [<NO NAME>]
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [ATICustomerCare] "c:\program files\ati\aticustomercare\ATICustomerCare.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
Notify: igfxcui - igfxdev.dll
Hosts: 127.0.0.1 www.spywareinfo.com
================= FIREFOX ===================
FF - ProfilePath - c:\users\matt\appdata\roaming\mozilla\firefox\profiles\o4812a8q.default\
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
============= SERVICES / DRIVERS ===============
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-6-21 64288]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-5-27 176128]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-6-16 1153368]
R3 amdkmdag;amdkmdag;c:\windows\system32\drivers\atikmdag.sys [2010-5-27 5586432]
R3 amdkmdap;amdkmdap;c:\windows\system32\drivers\atikmpag.sys [2010-5-27 209920]
R3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2010-6-23 21504]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2010-7-1 34896]
RUnknown lac97inf;lac97inf; [x]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-7-12 1355416]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\dragon age\bin_ship\daupdatersvc.service.exe [2009-12-15 25832]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-8-12 15008]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
=============== Created Last 30 ================
2010-08-30 03:15:34 0 d-----w- c:\program files\Valve
2010-08-26 02:57:17 0 d-----w- c:\users\matt\appdata\roaming\Screaming Bee
2010-08-26 02:56:29 0 d-----w- c:\programdata\Screaming Bee
2010-08-26 02:56:29 0 d-----w- c:\program files\Screaming Bee
2010-08-23 05:16:20 218 ----a-w- c:\users\matt\.recently-used.xbel
2010-08-21 03:31:26 0 d-----w- c:\users\matt\appdata\roaming\Armagetron
2010-08-21 03:31:22 0 d-----w- c:\programdata\Armagetron
2010-08-21 03:31:22 0 d-----w- c:\program files\Armagetron Advanced
2010-08-18 03:48:16 0 d-----w- c:\program files\ASC Games
2010-08-15 10:30:42 1908 ----a-w- c:\windows\diagwrn.xml
2010-08-15 10:30:42 1908 ----a-w- c:\windows\diagerr.xml
2010-08-15 04:38:53 0 d-----w- c:\program files\Lavalys
2010-08-14 12:01:57 52736 ----a-w- c:\windows\ipuninst.exe
2010-08-14 11:58:32 0 d-----w- c:\program files\BlackIsle
2010-08-12 07:47:04 0 d-----w- c:\users\matt\appdata\roaming\uTorrent
2010-08-10 21:33:53 3600768 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-08-10 21:33:52 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-08-10 21:33:48 1248768 ----a-w- c:\windows\system32\msxml3.dll
2010-08-10 21:33:47 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-10 21:33:46 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-08-10 21:33:43 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-08-08 01:12:04 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-08 01:12:03 0 d-----w- c:\programdata\Malwarebytes
2010-08-08 01:12:01 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-08 01:12:01 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-07 06:28:34 0 d-----w- c:\program files\VideoLAN
2010-08-07 06:09:29 0 d-----w- C:\Fraps
2010-08-07 05:25:10 26 ----a-w- c:\windows\system32\unregister.bat
2010-08-07 05:25:10 245760 ----a-w- c:\windows\system32\MADFilter.ax
2010-08-07 05:25:10 23 ----a-w- c:\windows\system32\register.bat
2010-08-06 22:28:17 0 d-----w- c:\program files\Microsoft Games for Windows - LIVE
2010-08-06 20:17:19 452440 ----a-w- c:\windows\system32\d3dx10_40.dll
2010-08-06 20:17:19 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll
2010-08-06 20:16:50 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll
2010-08-06 19:57:18 0 d-----w- c:\windows\system32\xlive
2010-08-04 19:17:17 0 d-----w- c:\program files\common files\PX Storage Engine
2010-08-04 19:12:55 0 d-----w- c:\programdata\DivX
2010-08-04 05:28:04 0 d-----w- c:\program files\Bethesda Softworks
==================== Find3M ====================
2010-08-31 01:16:53 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2010-08-29 12:47:00 51200 ----a-w- c:\windows\inf\infpub.dat
2010-08-29 12:47:00 143360 ----a-w- c:\windows\inf\infstrng.dat
2010-08-29 12:47:00 143360 ----a-w- c:\windows\inf\infstor.dat
2010-08-15 16:59:01 108144 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-07-23 05:31:09 665600 ----a-w- c:\windows\inf\drvindex.dat
2010-07-23 05:30:44 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2010-07-23 05:02:18 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2010-07-23 04:57:43 37665 ----a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont
2010-07-17 12:00:04 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-12 08:55:39 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-07-09 19:04:40 41872 ----a-w- c:\windows\system32\xfcodec.dll
2010-06-26 06:05:49 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-26 06:02:15 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-06-26 06:02:15 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-06-26 04:25:02 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-06-23 07:57:04 174 --sha-w- c:\program files\desktop.ini
2010-06-23 07:37:33 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2010-06-23 07:37:24 82432 ----a-w- c:\windows\system32\axaltocm.dll
2010-06-22 05:57:32 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-06-21 13:37:03 2037760 ----a-w- c:\windows\system32\win32k.sys
2010-06-20 10:01:42 377344 ----a-w- c:\windows\system32\winhttp.dll
2010-06-20 06:34:51 499712 ----a-w- c:\windows\system32\kerberos.dll
2010-06-18 17:31:29 36864 ----a-w- c:\windows\system32\rtutils.dll
2010-06-18 06:42:10 72704 ----a-w- c:\windows\system32\fontsub.dll
2010-06-18 06:42:10 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-06-18 04:34:46 61440 ----a-w- c:\windows\system32\winipsec.dll
2010-06-18 04:34:45 272896 ----a-w- c:\windows\system32\polstore.dll
2010-06-18 04:25:22 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2010-06-18 04:25:22 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2010-06-18 04:25:22 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2010-06-18 04:25:22 19968 ----a-w- c:\windows\system32\ARP.EXE
2010-06-18 04:25:22 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2010-06-18 04:25:22 17920 ----a-w- c:\windows\system32\netevent.dll
2010-06-18 04:25:22 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2010-06-18 04:25:22 105984 ----a-w- c:\windows\system32\netiohlp.dll
2010-06-18 04:25:22 10240 ----a-w- c:\windows\system32\finger.exe
2010-06-18 04:20:03 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2010-06-18 04:20:02 68096 ----a-w- c:\windows\system32\wlanhlp.dll
2010-06-18 04:20:02 65024 ----a-w- c:\windows\system32\wlanapi.dll
2010-06-18 04:20:02 513536 ----a-w- c:\windows\system32\wlansvc.dll
2010-06-18 04:20:02 302592 ----a-w- c:\windows\system32\wlansec.dll
2010-06-18 04:20:02 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2010-06-18 04:19:59 15181 ----a-w- c:\windows\system32\gatherWirelessInfo.vbs
2010-06-18 04:18:15 1401856 ----a-w- c:\windows\system32\msxml6.dll
2010-06-18 04:17:45 2048 ----a-w- c:\windows\system32\msxml3r.dll
2010-06-18 04:17:44 2048 ----a-w- c:\windows\system32\msxml6r.dll
2010-06-18 04:15:54 23552 ----a-w- c:\windows\system32\lpk.dll
2010-06-18 04:15:54 10240 ----a-w- c:\windows\system32\dciman32.dll
2010-06-18 04:14:15 72704 ----a-w- c:\windows\system32\secur32.dll
2010-06-18 04:14:15 218624 ----a-w- c:\windows\system32\msv1_0.dll
2010-06-18 04:14:15 175104 ----a-w- c:\windows\system32\wdigest.dll
2010-06-18 04:14:14 9728 ----a-w- c:\windows\system32\lsass.exe
2010-06-18 04:14:14 1259008 ----a-w- c:\windows\system32\lsasrv.dll
2010-06-18 04:10:47 98816 ----a-w- c:\windows\system32\mfps.dll
2010-06-18 04:10:47 53248 ----a-w- c:\windows\system32\rrinstaller.exe
2010-06-18 04:10:47 2868224 ----a-w- c:\windows\system32\mf.dll
2010-06-18 04:10:46 24576 ----a-w- c:\windows\system32\mfpmp.exe
2010-06-18 04:10:46 2048 ----a-w- c:\windows\system32\mferror.dll
2010-06-18 03:58:50 71680 ----a-w- c:\windows\system32\atl.dll
2010-06-18 03:49:38 160256 ----a-w- c:\windows\system32\wkssvc.dll
2010-06-18 03:48:02 53248 ----a-w- c:\windows\system32\tsgqec.dll
2010-06-18 03:48:02 136192 ----a-w- c:\windows\system32\aaclient.dll
2010-06-18 03:48:01 2066432 ----a-w- c:\windows\system32\mstscax.dll
2010-06-18 03:29:55 623616 ----a-w- c:\windows\system32\localspl.dll
2010-06-18 03:11:56 6656 ----a-w- c:\windows\system32\kbd106n.dll
2010-06-18 03:05:42 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-06-18 02:55:14 37888 ----a-w- c:\windows\system32\printcom.dll
2010-06-18 02:51:10 14848 ----a-w- c:\windows\system32\wshrm.dll
2010-06-18 02:49:46 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2010-06-18 02:48:15 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-06-18 02:48:15 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-06-18 02:48:15 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-06-18 02:48:15 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-06-18 02:48:15 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-06-18 02:48:14 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-06-18 02:48:14 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-06-18 02:48:14 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-06-18 02:48:14 471552 ----a-w- c:\windows\system32\secproc.dll
2010-06-18 02:01:58 84480 ----a-w- c:\windows\system32\INETRES.dll
2010-06-18 02:01:35 60928 ----a-w- c:\windows\system32\msasn1.dll
2010-06-18 02:00:54 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2010-06-18 02:00:10 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-06-18 02:00:09 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-06-18 01:57:06 243712 ----a-w- c:\windows\system32\rastls.dll
2010-06-18 01:56:44 355328 ----a-w- c:\windows\system32\WSDApi.dll
2010-06-18 01:54:59 91136 ----a-w- c:\windows\system32\avifil32.dll
2010-06-18 01:54:59 82944 ----a-w- c:\windows\system32\mciavi32.dll
2010-06-18 01:54:59 65024 ----a-w- c:\windows\system32\avicap32.dll
2010-06-18 01:54:59 31744 ----a-w- c:\windows\system32\msvidc32.dll
2010-06-18 01:54:59 13312 ----a-w- c:\windows\system32\msrle32.dll
2010-06-18 01:54:59 123904 ----a-w- c:\windows\system32\msvfw32.dll
2010-06-18 01:54:58 22528 ----a-w- c:\windows\system32\msyuv.dll
2010-06-18 01:54:58 1314816 ----a-w- c:\windows\system32\quartz.dll
2010-06-18 01:54:57 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2010-06-18 01:54:57 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2010-06-18 01:54:00 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2010-06-18 01:53:28 310784 ----a-w- c:\windows\system32\unregmp2.exe
2010-06-18 01:53:27 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2010-06-18 01:53:25 7680 ----a-w- c:\windows\system32\spwmp.dll
2007-08-11 14:07:20 8192 --sha-w- c:\windows\users\default\NTUSER.DAT
============= FINISH: 21:19:23.71 ===============
Thanks.
I just don't know how to get rid of it forever. I have tried other programs but spybot search & destroy is the only one that finds it.
Win32.Agent.deot HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lac97inf is the location it shows from spybot
DDS LOG:
DDS (Ver_10-03-17.01) - NTFSx86
Run by Matt at 21:18:54.09 on Mon 08/30/2010
Internet Explorer: 8.0.6001.18943 BrowserJavaVersion: 1.6.0_21
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2047.1249 [GMT -7:00]
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Lavasoft Ad-Watch Live! *enabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\WINDOWS\RtHDVCpl.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Matt\Downloads\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=74&bd=Presario&pf=desktop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=74&bd=Presario&pf=desktop
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [Steam] "c:\program files\valve\steam\steam.exe" -silent
mRun: [OsdMaestro] "c:\program files\hewlett-packard\on-screen osd indicator\OSD.exe"
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [<NO NAME>]
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [ATICustomerCare] "c:\program files\ati\aticustomercare\ATICustomerCare.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
Notify: igfxcui - igfxdev.dll
Hosts: 127.0.0.1 www.spywareinfo.com
================= FIREFOX ===================
FF - ProfilePath - c:\users\matt\appdata\roaming\mozilla\firefox\profiles\o4812a8q.default\
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
============= SERVICES / DRIVERS ===============
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-6-21 64288]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-5-27 176128]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-6-16 1153368]
R3 amdkmdag;amdkmdag;c:\windows\system32\drivers\atikmdag.sys [2010-5-27 5586432]
R3 amdkmdap;amdkmdap;c:\windows\system32\drivers\atikmpag.sys [2010-5-27 209920]
R3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2010-6-23 21504]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2010-7-1 34896]
RUnknown lac97inf;lac97inf; [x]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-7-12 1355416]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\dragon age\bin_ship\daupdatersvc.service.exe [2009-12-15 25832]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-8-12 15008]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
=============== Created Last 30 ================
2010-08-30 03:15:34 0 d-----w- c:\program files\Valve
2010-08-26 02:57:17 0 d-----w- c:\users\matt\appdata\roaming\Screaming Bee
2010-08-26 02:56:29 0 d-----w- c:\programdata\Screaming Bee
2010-08-26 02:56:29 0 d-----w- c:\program files\Screaming Bee
2010-08-23 05:16:20 218 ----a-w- c:\users\matt\.recently-used.xbel
2010-08-21 03:31:26 0 d-----w- c:\users\matt\appdata\roaming\Armagetron
2010-08-21 03:31:22 0 d-----w- c:\programdata\Armagetron
2010-08-21 03:31:22 0 d-----w- c:\program files\Armagetron Advanced
2010-08-18 03:48:16 0 d-----w- c:\program files\ASC Games
2010-08-15 10:30:42 1908 ----a-w- c:\windows\diagwrn.xml
2010-08-15 10:30:42 1908 ----a-w- c:\windows\diagerr.xml
2010-08-15 04:38:53 0 d-----w- c:\program files\Lavalys
2010-08-14 12:01:57 52736 ----a-w- c:\windows\ipuninst.exe
2010-08-14 11:58:32 0 d-----w- c:\program files\BlackIsle
2010-08-12 07:47:04 0 d-----w- c:\users\matt\appdata\roaming\uTorrent
2010-08-10 21:33:53 3600768 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-08-10 21:33:52 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-08-10 21:33:48 1248768 ----a-w- c:\windows\system32\msxml3.dll
2010-08-10 21:33:47 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-10 21:33:46 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-08-10 21:33:43 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-08-08 01:12:04 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-08 01:12:03 0 d-----w- c:\programdata\Malwarebytes
2010-08-08 01:12:01 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-08 01:12:01 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-07 06:28:34 0 d-----w- c:\program files\VideoLAN
2010-08-07 06:09:29 0 d-----w- C:\Fraps
2010-08-07 05:25:10 26 ----a-w- c:\windows\system32\unregister.bat
2010-08-07 05:25:10 245760 ----a-w- c:\windows\system32\MADFilter.ax
2010-08-07 05:25:10 23 ----a-w- c:\windows\system32\register.bat
2010-08-06 22:28:17 0 d-----w- c:\program files\Microsoft Games for Windows - LIVE
2010-08-06 20:17:19 452440 ----a-w- c:\windows\system32\d3dx10_40.dll
2010-08-06 20:17:19 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll
2010-08-06 20:16:50 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll
2010-08-06 19:57:18 0 d-----w- c:\windows\system32\xlive
2010-08-04 19:17:17 0 d-----w- c:\program files\common files\PX Storage Engine
2010-08-04 19:12:55 0 d-----w- c:\programdata\DivX
2010-08-04 05:28:04 0 d-----w- c:\program files\Bethesda Softworks
==================== Find3M ====================
2010-08-31 01:16:53 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2010-08-29 12:47:00 51200 ----a-w- c:\windows\inf\infpub.dat
2010-08-29 12:47:00 143360 ----a-w- c:\windows\inf\infstrng.dat
2010-08-29 12:47:00 143360 ----a-w- c:\windows\inf\infstor.dat
2010-08-15 16:59:01 108144 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-07-23 05:31:09 665600 ----a-w- c:\windows\inf\drvindex.dat
2010-07-23 05:30:44 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2010-07-23 05:02:18 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2010-07-23 04:57:43 37665 ----a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont
2010-07-17 12:00:04 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-12 08:55:39 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-07-09 19:04:40 41872 ----a-w- c:\windows\system32\xfcodec.dll
2010-06-26 06:05:49 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-26 06:02:15 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-06-26 06:02:15 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-06-26 04:25:02 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-06-23 07:57:04 174 --sha-w- c:\program files\desktop.ini
2010-06-23 07:37:33 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2010-06-23 07:37:24 82432 ----a-w- c:\windows\system32\axaltocm.dll
2010-06-22 05:57:32 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-06-21 13:37:03 2037760 ----a-w- c:\windows\system32\win32k.sys
2010-06-20 10:01:42 377344 ----a-w- c:\windows\system32\winhttp.dll
2010-06-20 06:34:51 499712 ----a-w- c:\windows\system32\kerberos.dll
2010-06-18 17:31:29 36864 ----a-w- c:\windows\system32\rtutils.dll
2010-06-18 06:42:10 72704 ----a-w- c:\windows\system32\fontsub.dll
2010-06-18 06:42:10 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-06-18 04:34:46 61440 ----a-w- c:\windows\system32\winipsec.dll
2010-06-18 04:34:45 272896 ----a-w- c:\windows\system32\polstore.dll
2010-06-18 04:25:22 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2010-06-18 04:25:22 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2010-06-18 04:25:22 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2010-06-18 04:25:22 19968 ----a-w- c:\windows\system32\ARP.EXE
2010-06-18 04:25:22 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2010-06-18 04:25:22 17920 ----a-w- c:\windows\system32\netevent.dll
2010-06-18 04:25:22 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2010-06-18 04:25:22 105984 ----a-w- c:\windows\system32\netiohlp.dll
2010-06-18 04:25:22 10240 ----a-w- c:\windows\system32\finger.exe
2010-06-18 04:20:03 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2010-06-18 04:20:02 68096 ----a-w- c:\windows\system32\wlanhlp.dll
2010-06-18 04:20:02 65024 ----a-w- c:\windows\system32\wlanapi.dll
2010-06-18 04:20:02 513536 ----a-w- c:\windows\system32\wlansvc.dll
2010-06-18 04:20:02 302592 ----a-w- c:\windows\system32\wlansec.dll
2010-06-18 04:20:02 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2010-06-18 04:19:59 15181 ----a-w- c:\windows\system32\gatherWirelessInfo.vbs
2010-06-18 04:18:15 1401856 ----a-w- c:\windows\system32\msxml6.dll
2010-06-18 04:17:45 2048 ----a-w- c:\windows\system32\msxml3r.dll
2010-06-18 04:17:44 2048 ----a-w- c:\windows\system32\msxml6r.dll
2010-06-18 04:15:54 23552 ----a-w- c:\windows\system32\lpk.dll
2010-06-18 04:15:54 10240 ----a-w- c:\windows\system32\dciman32.dll
2010-06-18 04:14:15 72704 ----a-w- c:\windows\system32\secur32.dll
2010-06-18 04:14:15 218624 ----a-w- c:\windows\system32\msv1_0.dll
2010-06-18 04:14:15 175104 ----a-w- c:\windows\system32\wdigest.dll
2010-06-18 04:14:14 9728 ----a-w- c:\windows\system32\lsass.exe
2010-06-18 04:14:14 1259008 ----a-w- c:\windows\system32\lsasrv.dll
2010-06-18 04:10:47 98816 ----a-w- c:\windows\system32\mfps.dll
2010-06-18 04:10:47 53248 ----a-w- c:\windows\system32\rrinstaller.exe
2010-06-18 04:10:47 2868224 ----a-w- c:\windows\system32\mf.dll
2010-06-18 04:10:46 24576 ----a-w- c:\windows\system32\mfpmp.exe
2010-06-18 04:10:46 2048 ----a-w- c:\windows\system32\mferror.dll
2010-06-18 03:58:50 71680 ----a-w- c:\windows\system32\atl.dll
2010-06-18 03:49:38 160256 ----a-w- c:\windows\system32\wkssvc.dll
2010-06-18 03:48:02 53248 ----a-w- c:\windows\system32\tsgqec.dll
2010-06-18 03:48:02 136192 ----a-w- c:\windows\system32\aaclient.dll
2010-06-18 03:48:01 2066432 ----a-w- c:\windows\system32\mstscax.dll
2010-06-18 03:29:55 623616 ----a-w- c:\windows\system32\localspl.dll
2010-06-18 03:11:56 6656 ----a-w- c:\windows\system32\kbd106n.dll
2010-06-18 03:05:42 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-06-18 02:55:14 37888 ----a-w- c:\windows\system32\printcom.dll
2010-06-18 02:51:10 14848 ----a-w- c:\windows\system32\wshrm.dll
2010-06-18 02:49:46 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2010-06-18 02:48:15 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-06-18 02:48:15 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-06-18 02:48:15 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-06-18 02:48:15 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-06-18 02:48:15 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-06-18 02:48:14 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-06-18 02:48:14 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-06-18 02:48:14 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-06-18 02:48:14 471552 ----a-w- c:\windows\system32\secproc.dll
2010-06-18 02:01:58 84480 ----a-w- c:\windows\system32\INETRES.dll
2010-06-18 02:01:35 60928 ----a-w- c:\windows\system32\msasn1.dll
2010-06-18 02:00:54 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2010-06-18 02:00:10 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-06-18 02:00:09 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-06-18 01:57:06 243712 ----a-w- c:\windows\system32\rastls.dll
2010-06-18 01:56:44 355328 ----a-w- c:\windows\system32\WSDApi.dll
2010-06-18 01:54:59 91136 ----a-w- c:\windows\system32\avifil32.dll
2010-06-18 01:54:59 82944 ----a-w- c:\windows\system32\mciavi32.dll
2010-06-18 01:54:59 65024 ----a-w- c:\windows\system32\avicap32.dll
2010-06-18 01:54:59 31744 ----a-w- c:\windows\system32\msvidc32.dll
2010-06-18 01:54:59 13312 ----a-w- c:\windows\system32\msrle32.dll
2010-06-18 01:54:59 123904 ----a-w- c:\windows\system32\msvfw32.dll
2010-06-18 01:54:58 22528 ----a-w- c:\windows\system32\msyuv.dll
2010-06-18 01:54:58 1314816 ----a-w- c:\windows\system32\quartz.dll
2010-06-18 01:54:57 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2010-06-18 01:54:57 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2010-06-18 01:54:00 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2010-06-18 01:53:28 310784 ----a-w- c:\windows\system32\unregmp2.exe
2010-06-18 01:53:27 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2010-06-18 01:53:25 7680 ----a-w- c:\windows\system32\spwmp.dll
2007-08-11 14:07:20 8192 --sha-w- c:\windows\users\default\NTUSER.DAT
============= FINISH: 21:19:23.71 ===============
Thanks.