Page 2 of 2 FirstFirst 12
Results 11 to 16 of 16

Thread: Spyware Guard 2008 HELP!

  1. 2009-01-19, 19:50 #11
    clsaar
    clsaar is offline
    Member clsaar's Avatar
    Join Date
    May 2008
    Posts
    43

    Default Cf #5

    + 2008-04-14 00:12:08 102,400 ------w c:\windows\ServicePackFiles\i386\win32spl.dll
    + 2008-04-13 16:48:53 1,647,616 ------w c:\windows\ServicePackFiles\i386\winbrand.dll
    + 2008-04-14 00:12:39 283,648 ------w c:\windows\ServicePackFiles\i386\winhlp32.exe
    + 2008-04-14 00:12:08 354,304 ------w c:\windows\ServicePackFiles\i386\winhttp.dll
    + 2008-04-14 00:12:08 666,112 ------w c:\windows\ServicePackFiles\i386\wininet.dll
    + 2008-04-14 00:12:09 32,256 ------w c:\windows\ServicePackFiles\i386\winipsec.dll
    + 2008-04-14 00:12:39 507,904 ------w c:\windows\ServicePackFiles\i386\winlogon.exe
    + 2008-04-14 00:12:09 176,128 ------w c:\windows\ServicePackFiles\i386\winmm.dll
    + 2004-08-04 11:00:00 5,120 ------w c:\windows\ServicePackFiles\i386\winnls.dll
    + 2008-04-14 00:11:11 756,224 ------w c:\windows\ServicePackFiles\i386\winntbbu.dll
    + 2008-04-14 00:12:09 16,896 ------w c:\windows\ServicePackFiles\i386\winrnr.dll
    + 2008-04-14 00:12:09 99,328 ------w c:\windows\ServicePackFiles\i386\winscard.dll
    + 2008-04-14 00:12:09 17,408 ------w c:\windows\ServicePackFiles\i386\winshfhc.dll
    + 2008-04-14 00:12:45 146,432 ------w c:\windows\ServicePackFiles\i386\winspool.drv
    + 2008-04-14 00:12:09 293,376 ------w c:\windows\ServicePackFiles\i386\winsrv.dll
    + 2008-04-14 00:12:09 53,760 ------w c:\windows\ServicePackFiles\i386\winsta.dll
    + 2008-04-14 00:12:09 176,640 ------w c:\windows\ServicePackFiles\i386\wintrust.dll
    + 2008-04-14 00:12:40 5,632 ------w c:\windows\ServicePackFiles\i386\winver.exe
    + 2008-04-14 00:12:09 132,096 ------w c:\windows\ServicePackFiles\i386\wkssvc.dll
    + 2008-04-14 00:12:09 69,120 ------w c:\windows\ServicePackFiles\i386\wlanapi.dll
    + 2008-04-14 00:12:09 172,032 ------w c:\windows\ServicePackFiles\i386\wldap32.dll
    + 2004-08-04 03:31:28 154,624 ------w c:\windows\ServicePackFiles\i386\wlluc48.sys
    + 2008-04-14 00:12:09 92,672 ------w c:\windows\ServicePackFiles\i386\wlnotify.dll
    + 2008-04-14 00:11:15 5,632 ------w c:\windows\ServicePackFiles\i386\wmi.dll
    + 2008-04-13 18:36:38 8,832 ------w c:\windows\ServicePackFiles\i386\wmiacpi.sys
    + 2008-04-14 00:12:40 196,608 ------w c:\windows\ServicePackFiles\i386\wmiadap.exe
    + 2008-04-13 17:10:20 6,656 ------w c:\windows\ServicePackFiles\i386\wmiapres.dll
    + 2008-04-14 00:12:09 88,576 ------w c:\windows\ServicePackFiles\i386\wmiaprpl.dll
    + 2008-04-14 00:12:40 126,464 ------w c:\windows\ServicePackFiles\i386\wmiapsrv.exe
    + 2008-04-14 00:12:40 358,912 ------w c:\windows\ServicePackFiles\i386\wmic.exe
    + 2008-04-14 00:12:09 60,928 ------w c:\windows\ServicePackFiles\i386\wmicookr.dll
    + 2008-04-14 00:12:09 140,800 ------w c:\windows\ServicePackFiles\i386\wmidcprv.dll
    + 2008-04-14 00:12:09 156,672 ------w c:\windows\ServicePackFiles\i386\wmipcima.dll
    + 2008-04-14 00:12:09 132,096 ------w c:\windows\ServicePackFiles\i386\wmipdskq.dll
    + 2008-04-14 00:12:09 61,952 ------w c:\windows\ServicePackFiles\i386\wmipiprt.dll
    + 2008-04-14 00:12:09 62,464 ------w c:\windows\ServicePackFiles\i386\wmipjobj.dll
    + 2008-04-14 00:12:09 144,896 ------w c:\windows\ServicePackFiles\i386\wmiprov.dll
    + 2008-04-14 00:12:09 437,248 ------w c:\windows\ServicePackFiles\i386\wmiprvsd.dll
    + 2008-04-14 00:12:40 218,112 ------w c:\windows\ServicePackFiles\i386\wmiprvse.exe
    + 2008-04-14 00:12:09 41,472 ------w c:\windows\ServicePackFiles\i386\wmipsess.dll
    + 2008-04-14 00:12:09 144,896 ------w c:\windows\ServicePackFiles\i386\wmisvc.dll
    + 2008-04-14 00:12:09 95,232 ------w c:\windows\ServicePackFiles\i386\wmiutils.dll
    + 2008-04-14 00:12:09 167,936 ------w c:\windows\ServicePackFiles\i386\wmm2ae.dll
    + 2008-04-14 00:12:09 4,096 ------w c:\windows\ServicePackFiles\i386\wmm2eres.dll
    + 2008-04-14 00:12:09 7,680 ------w c:\windows\ServicePackFiles\i386\wmm2ext.dll
    + 2008-04-14 00:12:09 402,432 ------w c:\windows\ServicePackFiles\i386\wmm2filt.dll
    + 2008-04-14 00:12:09 502,272 ------w c:\windows\ServicePackFiles\i386\wmm2fxa.dll
    + 2008-04-14 00:12:09 325,632 ------w c:\windows\ServicePackFiles\i386\wmm2fxb.dll
    + 2008-04-14 00:12:09 4,256,768 ------w c:\windows\ServicePackFiles\i386\wmm2res.dll
    + 2008-04-14 00:12:09 5,632 ------w c:\windows\ServicePackFiles\i386\wmm2res2.dll
    + 2008-04-14 00:12:09 276,992 ------w c:\windows\ServicePackFiles\i386\wmphoto.dll
    + 2008-04-14 00:12:40 214,528 ------w c:\windows\ServicePackFiles\i386\wordpad.exe
    + 2008-04-14 00:12:10 264,192 ------w c:\windows\ServicePackFiles\i386\wow32.dll
    + 2008-04-14 00:12:40 32,256 ------w c:\windows\ServicePackFiles\i386\wpabaln.exe
    + 2008-04-14 00:12:41 11,264 ------w c:\windows\ServicePackFiles\i386\wpnpinst.exe
    + 2008-04-14 00:12:10 82,432 ------w c:\windows\ServicePackFiles\i386\ws2_32.dll
    + 2008-04-14 00:12:10 19,968 ------w c:\windows\ServicePackFiles\i386\ws2help.dll
    + 2008-04-14 00:12:41 13,824 ------w c:\windows\ServicePackFiles\i386\wscntfy.exe
    + 2008-04-14 00:12:41 155,648 ------w c:\windows\ServicePackFiles\i386\wscript.exe
    + 2008-04-14 00:12:10 80,896 ------w c:\windows\ServicePackFiles\i386\wscsvc.dll
    + 2008-04-14 00:12:10 604,160 ------w c:\windows\ServicePackFiles\i386\wsecedit.dll
    + 2008-04-14 00:12:10 108,032 ------w c:\windows\ServicePackFiles\i386\wshbth.dll
    + 2008-04-14 00:12:10 36,864 ------w c:\windows\ServicePackFiles\i386\wshcon.dll
    + 2008-04-14 00:12:10 90,112 ------w c:\windows\ServicePackFiles\i386\wshext.dll
    + 2008-04-14 00:12:10 14,336 ------w c:\windows\ServicePackFiles\i386\wship6.dll
    + 2008-04-14 00:12:10 8,192 ------w c:\windows\ServicePackFiles\i386\wshirda.dll
    + 2008-04-14 00:12:10 11,264 ------w c:\windows\ServicePackFiles\i386\wshrm.dll
    + 2008-04-14 00:12:10 19,456 ------w c:\windows\ServicePackFiles\i386\wshtcpip.dll
    + 2004-08-04 03:29:48 12,063 ------w c:\windows\ServicePackFiles\i386\wsiintxx.sys
    + 2008-04-14 00:12:10 41,984 ------w c:\windows\ServicePackFiles\i386\wsnmp32.dll
    + 2008-04-14 00:12:10 22,528 ------w c:\windows\ServicePackFiles\i386\wsock32.dll
    + 2008-04-13 18:46:24 19,200 ------w c:\windows\ServicePackFiles\i386\wstcodec.sys
    + 2008-04-14 00:12:10 50,688 ------w c:\windows\ServicePackFiles\i386\wstdecod.dll
    + 2008-04-14 00:12:10 18,432 ------w c:\windows\ServicePackFiles\i386\wtsapi32.dll
    + 2008-04-14 00:12:10 430,592 ------w c:\windows\ServicePackFiles\i386\wuapi.dll
    + 2008-04-14 00:12:41 111,104 ------w c:\windows\ServicePackFiles\i386\wuauclt.exe
    + 2008-04-14 00:12:41 165,888 ------w c:\windows\ServicePackFiles\i386\wuauclt1.exe
    + 2008-04-14 00:12:11 1,135,616 ------w c:\windows\ServicePackFiles\i386\wuaueng.dll
    + 2008-04-14 00:12:11 183,296 ------w c:\windows\ServicePackFiles\i386\wuaueng1.dll
    + 2008-04-14 00:12:11 6,656 ------w c:\windows\ServicePackFiles\i386\wuauserv.dll
    + 2008-04-14 00:12:11 112,640 ------w c:\windows\ServicePackFiles\i386\wucltui.dll
    + 2008-04-14 00:12:11 32,256 ------w c:\windows\ServicePackFiles\i386\wups.dll
    + 2008-04-14 00:12:11 120,320 ------w c:\windows\ServicePackFiles\i386\wuweb.dll
    + 2004-08-04 03:29:50 19,455 ------w c:\windows\ServicePackFiles\i386\wvchntxx.sys
    + 2008-04-14 00:12:11 383,488 ------w c:\windows\ServicePackFiles\i386\wzcdlg.dll
    + 2008-04-14 00:12:11 52,736 ------w c:\windows\ServicePackFiles\i386\wzcsapi.dll
    + 2008-04-14 00:12:11 483,840 ------w c:\windows\ServicePackFiles\i386\wzcsvc.dll
    + 2008-04-14 00:12:11 91,648 ------w c:\windows\ServicePackFiles\i386\xactsrv.dll
    + 2008-04-14 00:12:41 30,720 ------w c:\windows\ServicePackFiles\i386\xcopy.exe
    + 2004-08-04 11:00:00 174,200 ------w c:\windows\ServicePackFiles\i386\xenroll.dll
    + 2008-04-14 00:12:11 121,856 ------w c:\windows\ServicePackFiles\i386\xmllite.dll
    + 2008-04-14 00:12:11 129,024 ------w c:\windows\ServicePackFiles\i386\xmlprov.dll
    + 2008-04-14 00:12:11 50,176 ------w c:\windows\ServicePackFiles\i386\xmlprovi.dll
    + 2008-04-14 00:12:11 11,776 ------w c:\windows\ServicePackFiles\i386\xolehlp.dll
    + 2008-04-13 18:53:32 558,080 ------w c:\windows\ServicePackFiles\i386\xpnetdg.exe
    + 2008-04-13 17:39:29 438,784 ------w c:\windows\ServicePackFiles\i386\xpob2res.dll
    + 2008-04-13 17:39:22 187,392 ------w c:\windows\ServicePackFiles\i386\xpsp1res.dll
    + 2008-04-13 17:39:24 2,897,920 ------w c:\windows\ServicePackFiles\i386\xpsp2res.dll
    + 2008-04-13 17:39:26 689,152 ------w c:\windows\ServicePackFiles\i386\xpsp3res.dll
    + 2008-04-14 00:12:11 18,944 ------w c:\windows\ServicePackFiles\i386\xrxscnui.dll
    + 2008-04-14 00:12:11 116,224 ------w c:\windows\ServicePackFiles\i386\xrxwiadr.dll
    + 2008-04-14 00:12:11 338,432 ------w c:\windows\ServicePackFiles\i386\zipfldr.dll
    + 2008-04-14 00:11:51 33,792 ------w c:\windows\ServicePackFiles\ServicePackCache\i386\custsat.dll
    + 2008-04-14 00:11:59 82,944 ------w c:\windows\ServicePackFiles\ServicePackCache\i386\msgsc.dll
    + 2008-04-13 17:30:28 180,224 ------w c:\windows\ServicePackFiles\ServicePackCache\i386\msgslang.dll
    + 2008-04-14 00:12:28 1,695,232 ------w c:\windows\ServicePackFiles\ServicePackCache\i386\msmsgs.exe
    + 2008-04-14 00:12:35 32,866 ------w c:\windows\slrundll.exe
    - 2004-08-04 11:00:00 3,166,208 ----a-w c:\windows\srchasst\msgr3en.dll
    + 2008-04-14 00:11:59 3,166,208 ----a-w c:\windows\srchasst\msgr3en.dll
    - 2004-08-04 11:00:00 58,434 ----a-w c:\windows\srchasst\srchctls.dll
    + 2008-04-14 00:12:06 58,434 ----a-w c:\windows\srchasst\srchctls.dll
    - 2004-08-04 11:00:00 725,566 ----a-w c:\windows\srchasst\srchui.dll
    + 2008-04-14 00:12:07 726,078 ----a-w c:\windows\srchasst\srchui.dll
    - 2004-08-04 11:00:00 146,432 ----a-w c:\windows\system\WINSPOOL.DRV
    + 2008-04-14 00:12:45 146,432 ----a-w c:\windows\system\winspool.drv
    - 2006-08-16 11:58:05 100,352 ----a-w c:\windows\system32\6to4svc.dll
    + 2008-04-14 00:11:48 100,352 ----a-w c:\windows\system32\6to4svc.dll
    + 2008-04-14 00:11:48 136,192 ------w c:\windows\system32\aaclient.dll
    - 2004-08-04 11:00:00 183,808 ----a-w c:\windows\system32\accwiz.exe
    + 2008-04-14 00:12:11 184,320 ----a-w c:\windows\system32\accwiz.exe
    - 2004-08-04 11:00:00 114,688 ----a-w c:\windows\system32\aclui.dll
    + 2008-04-14 00:11:48 115,712 ----a-w c:\windows\system32\aclui.dll
    - 2004-08-04 11:00:00 194,048 ----a-w c:\windows\system32\activeds.dll
    + 2008-04-14 00:11:48 193,536 ----a-w c:\windows\system32\activeds.dll
    - 2004-08-04 11:00:00 4,096 ----a-w c:\windows\system32\actmovie.exe
    + 2008-04-14 00:12:12 4,096 ----a-w c:\windows\system32\actmovie.exe
    - 2004-08-04 11:00:00 101,888 ----a-w c:\windows\system32\actxprxy.dll
    + 2008-04-14 00:11:48 98,304 ----a-w c:\windows\system32\actxprxy.dll
    - 2004-08-04 11:00:00 61,440 ----a-w c:\windows\system32\admparse.dll
    + 2008-04-14 00:11:48 61,440 ----a-w c:\windows\system32\admparse.dll
    - 2004-08-04 11:00:00 175,616 ----a-w c:\windows\system32\adsldp.dll
    + 2008-04-14 00:11:48 175,616 ----a-w c:\windows\system32\adsldp.dll
    - 2004-08-04 11:00:00 143,360 ----a-w c:\windows\system32\adsldpc.dll
    + 2008-04-14 00:11:48 143,360 ----a-w c:\windows\system32\adsldpc.dll
    - 2004-08-04 11:00:00 68,096 ----a-w c:\windows\system32\adsmsext.dll
    + 2008-04-14 00:11:48 68,096 ----a-w c:\windows\system32\adsmsext.dll
    - 2004-08-04 11:00:00 263,680 ----a-w c:\windows\system32\adsnt.dll
    + 2008-04-14 00:11:48 263,680 ----a-w c:\windows\system32\adsnt.dll
    - 2004-08-04 11:00:00 109,568 ----a-w c:\windows\system32\adsnw.dll
    + 2008-04-14 00:11:48 123,392 ----a-w c:\windows\system32\adsnw.dll
    - 2004-08-04 11:00:00 616,960 ----a-w c:\windows\system32\advapi32.dll
    + 2008-04-14 00:11:48 617,472 ----a-w c:\windows\system32\advapi32.dll
    - 2004-08-04 11:00:00 99,840 ----a-w c:\windows\system32\advpack.dll
    + 2008-04-14 00:11:48 99,840 ----a-w c:\windows\system32\advpack.dll
    - 2004-08-04 11:00:00 98,304 ----a-w c:\windows\system32\ahui.exe
    + 2008-04-14 00:12:12 98,304 ----a-w c:\windows\system32\ahui.exe
    - 2004-08-04 11:00:00 44,544 ----a-w c:\windows\system32\alg.exe
    + 2008-04-14 00:12:12 44,544 ----a-w c:\windows\system32\alg.exe
    - 2004-08-04 11:00:00 17,408 ----a-w c:\windows\system32\alrsvc.dll
    + 2008-04-14 00:11:49 17,408 ----a-w c:\windows\system32\alrsvc.dll
    - 2004-08-04 11:00:00 70,656 ----a-w c:\windows\system32\amstream.dll
    + 2008-04-14 00:11:49 70,656 ----a-w c:\windows\system32\amstream.dll
    - 2004-08-04 11:00:00 126,976 ----a-w c:\windows\system32\apphelp.dll
    + 2008-04-14 00:11:49 125,952 ----a-w c:\windows\system32\apphelp.dll
    - 2004-08-04 11:00:00 167,936 ----a-w c:\windows\system32\appmgmts.dll
    + 2008-04-14 00:11:49 167,936 ----a-w c:\windows\system32\appmgmts.dll
    - 2004-08-04 11:00:00 295,936 ----a-w c:\windows\system32\appmgr.dll
    + 2008-04-14 00:11:49 295,936 ----a-w c:\windows\system32\appmgr.dll
    - 2004-08-04 11:00:00 8,192 ----a-w c:\windows\system32\asferror.dll
    + 2008-04-13 17:23:38 8,192 ----a-w c:\windows\system32\asferror.dll
    - 2004-08-04 11:00:00 30,208 ----a-w c:\windows\system32\asr_fmt.exe
    + 2008-04-14 00:12:12 30,208 ----a-w c:\windows\system32\asr_fmt.exe
    - 2004-08-04 11:00:00 32,768 ----a-w c:\windows\system32\asr_pfu.exe
    + 2008-04-14 00:12:12 32,768 ----a-w c:\windows\system32\asr_pfu.exe
    - 2004-08-04 11:00:00 65,024 ----a-w c:\windows\system32\asycfilt.dll
    + 2008-04-14 00:11:49 65,024 ----a-w c:\windows\system32\asycfilt.dll
    - 2004-08-04 11:00:00 25,088 ----a-w c:\windows\system32\at.exe
    + 2008-04-14 00:12:12 25,088 ----a-w c:\windows\system32\at.exe
    + 2008-04-14 00:11:49 229,376 ------w c:\windows\system32\ati2cqag.dll
    + 2008-04-14 00:11:49 377,984 ------w c:\windows\system32\ati2dvaa.dll
    + 2008-04-14 00:11:49 201,728 ------w c:\windows\system32\ati2dvag.dll
    + 2008-04-14 00:11:49 870,784 ------w c:\windows\system32\ati3d1ag.dll
    + 2008-04-14 00:11:50 1,888,992 ------w c:\windows\system32\ati3duag.dll
    + 2008-04-14 00:11:50 32,768 ------w c:\windows\system32\ativtmxx.dll
    + 2008-04-14 00:11:50 516,768 ------w c:\windows\system32\ativvaxx.dll
    - 2004-08-04 11:00:00 58,880 ----a-w c:\windows\system32\atl.dll
    + 2008-04-14 00:11:50 58,880 ----a-w c:\windows\system32\atl.dll
    - 2004-08-04 11:00:00 11,264 ----a-w c:\windows\system32\atmadm.exe
    + 2008-04-14 00:12:12 11,264 ----a-w c:\windows\system32\atmadm.exe
    - 2004-08-04 11:00:00 285,696 ----a-w c:\windows\system32\atmfd.dll
    + 2008-04-14 00:09:01 285,696 ----a-w c:\windows\system32\atmfd.dll
    - 2004-08-04 11:00:00 30,208 ----a-w c:\windows\system32\atmlib.dll
    + 2008-04-14 00:11:50 30,208 ----a-w c:\windows\system32\atmlib.dll
    - 2004-08-04 11:00:00 11,264 ----a-w c:\windows\system32\attrib.exe
    + 2008-04-14 00:12:12 12,288 ----a-w c:\windows\system32\attrib.exe
    - 2004-08-04 11:00:00 42,496 ----a-w c:\windows\system32\audiosrv.dll
    + 2008-04-14 00:11:50 42,496 ----a-w c:\windows\system32\audiosrv.dll
    - 2004-08-04 11:00:00 14,336 ----a-w c:\windows\system32\auditusr.exe
    + 2008-04-14 00:12:12 14,336 ----a-w c:\windows\system32\auditusr.exe
    - 2005-03-02 18:09:29 56,832 ----a-w c:\windows\system32\authz.dll
    + 2008-04-14 00:11:50 62,464 ----a-w c:\windows\system32\authz.dll
    - 2004-08-04 11:00:00 588,800 ----a-w c:\windows\system32\autochk.exe
    + 2008-04-14 00:12:12 588,800 ----a-w c:\windows\system32\autochk.exe
    - 2004-08-04 11:00:00 602,624 ----a-w c:\windows\system32\autoconv.exe
    + 2008-04-14 00:12:12 602,624 ----a-w c:\windows\system32\autoconv.exe
    - 2004-08-04 11:00:00 580,608 ----a-w c:\windows\system32\autofmt.exe
    + 2008-04-14 00:12:13 580,608 ----a-w c:\windows\system32\autofmt.exe
    - 2004-08-04 11:00:00 11,264 ----a-w c:\windows\system32\autolfn.exe
    + 2008-04-14 00:12:13 11,264 ----a-w c:\windows\system32\autolfn.exe
    - 2004-08-04 11:00:00 84,992 ----a-w c:\windows\system32\avifil32.dll
    + 2008-04-14 00:11:50 84,992 ----a-w c:\windows\system32\avifil32.dll
    + 2008-04-14 00:11:50 233,472 ------w c:\windows\system32\azroles.dll
    - 2004-08-04 11:00:00 52,736 ----a-w c:\windows\system32\basesrv.dll
    + 2008-04-14 00:11:50 52,736 ----a-w c:\windows\system32\basesrv.dll
    - 2004-08-04 11:00:00 28,672 ----a-w c:\windows\system32\batmeter.dll
    + 2008-04-14 00:11:50 29,184 ----a-w c:\windows\system32\batmeter.dll
    - 2004-08-04 11:00:00 8,704 ----a-w c:\windows\system32\batt.dll
    + 2008-04-14 00:11:50 8,704 ----a-w c:\windows\system32\batt.dll
    - 2004-08-04 11:00:00 17,408 ----a-w c:\windows\system32\bidispl.dll
    + 2008-04-14 00:11:50 17,408 ----a-w c:\windows\system32\bidispl.dll
    + 2008-04-14 00:12:03 409,088 ------w c:\windows\system32\bits\qmgr.dll
    - 2004-08-04 11:00:00 8,192 ----a-w c:\windows\system32\bitsprx2.dll
    + 2008-04-14 00:11:50 8,192 ----a-w c:\windows\system32\bitsprx2.dll
    - 2004-08-04 11:00:00 7,168 ----a-w c:\windows\system32\bitsprx3.dll
    + 2008-04-14 00:11:50 7,168 ----a-w c:\windows\system32\bitsprx3.dll
    + 2008-04-14 00:11:50 7,168 ------w c:\windows\system32\bitsprx4.dll
    - 2004-08-04 11:00:00 286,208 ----a-w c:\windows\system32\blackbox.dll
    + 2008-04-14 00:11:50 286,720 ----a-w c:\windows\system32\blackbox.dll
    - 2004-08-04 11:00:00 71,680 ----a-w c:\windows\system32\blastcln.exe
    + 2008-04-14 00:12:13 71,680 ----a-w c:\windows\system32\blastcln.exe
    - 2004-08-04 11:00:00 136,704 ----a-w c:\windows\system32\bootcfg.exe
    + 2008-04-14 00:12:13 142,848 ----a-w c:\windows\system32\bootcfg.exe
    - 2004-08-04 11:00:00 63,488 ----a-w c:\windows\system32\browselc.dll
    + 2008-04-13 17:03:24 63,488 ----a-w c:\windows\system32\browselc.dll
    - 2004-08-04 11:00:00 77,312 ----a-w c:\windows\system32\browser.dll
    + 2008-04-14 00:11:50 77,824 ----a-w c:\windows\system32\browser.dll
    - 2008-10-16 10:37:04 1,023,488 ----a-w c:\windows\system32\browseui.dll
    + 2008-04-14 00:11:50 1,025,024 ----a-w c:\windows\system32\browseui.dll
    - 2004-08-04 11:00:00 78,336 ----a-w c:\windows\system32\browsewm.dll
    + 2008-04-14 00:11:50 78,336 ----a-w c:\windows\system32\browsewm.dll
    - 2004-08-04 11:00:00 20,992 ----a-w c:\windows\system32\bthci.dll
    + 2008-04-14 00:11:50 20,992 ----a-w c:\windows\system32\bthci.dll
    - 2004-08-04 11:00:00 30,208 ----a-w c:\windows\system32\bthserv.dll
    + 2008-04-14 00:11:50 30,208 ----a-w c:\windows\system32\bthserv.dll
    - 2004-08-04 11:00:00 50,688 ----a-w c:\windows\system32\btpanui.dll
    + 2008-04-14 00:11:50 50,688 ----a-w c:\windows\system32\btpanui.dll
    - 2004-08-04 11:00:00 59,904 ----a-w c:\windows\system32\cabinet.dll
    + 2008-04-14 00:11:50 60,416 ----a-w c:\windows\system32\cabinet.dll
    - 2004-08-04 11:00:00 84,480 ----a-w c:\windows\system32\cabview.dll
    + 2008-04-14 00:11:50 84,480 ----a-w c:\windows\system32\cabview.dll
    - 2004-08-04 11:00:00 18,432 ----a-w c:\windows\system32\cacls.exe
    + 2008-04-14 00:12:13 19,968 ----a-w c:\windows\system32\cacls.exe
    - 2004-08-04 11:00:00 50,688 ----a-w c:\windows\system32\camocx.dll
    + 2008-04-14 00:11:50 50,688 ----a-w c:\windows\system32\camocx.dll
    - 2004-08-04 11:00:00 142,848 ----a-w c:\windows\system32\capesnpn.dll
    + 2008-04-14 00:11:50 150,016 ----a-w c:\windows\system32\capesnpn.dll
    - 2005-07-26 04:39:42 225,792 ----a-w c:\windows\system32\catsrv.dll
    + 2008-04-14 00:11:50 226,304 ----a-w c:\windows\system32\catsrv.dll
    - 2004-08-04 11:00:00 85,504 ----a-w c:\windows\system32\catsrvps.dll
    + 2008-04-14 00:11:50 85,504 ----a-w c:\windows\system32\catsrvps.dll
    - 2005-07-26 04:39:43 625,152 ----a-w c:\windows\system32\catsrvut.dll
    + 2008-04-14 00:11:50 625,664 ----a-w c:\windows\system32\catsrvut.dll
    - 2008-10-16 10:37:02 151,040 ----a-w c:\windows\system32\cdfview.dll
    + 2008-04-14 00:11:50 151,040 ----a-w c:\windows\system32\cdfview.dll
    - 2005-09-10 01:53:41 2,067,968 ----a-w c:\windows\system32\cdosys.dll
    + 2008-04-14 00:11:50 2,091,520 ----a-w c:\windows\system32\cdosys.dll
    - 2004-08-04 11:00:00 194,560 ----a-w c:\windows\system32\certcli.dll
    + 2008-04-14 00:11:50 194,560 ----a-w c:\windows\system32\certcli.dll
    - 2004-08-04 11:00:00 457,728 ----a-w c:\windows\system32\certmgr.dll
    + 2008-04-14 00:11:50 457,728 ----a-w c:\windows\system32\certmgr.dll
    - 2004-08-04 11:00:00 159,232 ----a-w c:\windows\system32\cewmdm.dll
    + 2008-04-14 00:11:50 159,232 ----a-w c:\windows\system32\cewmdm.dll
    - 2004-08-04 11:00:00 38,912 ----a-w c:\windows\system32\cfgbkend.dll
    + 2008-04-14 00:11:50 38,912 ----a-w c:\windows\system32\cfgbkend.dll
    - 2004-08-04 11:00:00 16,896 ----a-w c:\windows\system32\cfgmgr32.dll
    + 2008-04-14 00:09:05 16,896 ----a-w c:\windows\system32\cfgmgr32.dll
    - 2004-08-04 11:00:00 109,568 ----a-w c:\windows\system32\cic.dll
    + 2008-04-14 00:11:50 148,480 ----a-w c:\windows\system32\cic.dll
    - 2006-06-22 05:06:29 69,120 ----a-w c:\windows\system32\ciodm.dll
    + 2008-04-14 00:11:50 69,120 ----a-w c:\windows\system32\ciodm.dll
    - 2004-08-04 11:00:00 56,320 ----a-w c:\windows\system32\cipher.exe
    + 2008-04-14 00:12:14 56,832 ----a-w c:\windows\system32\cipher.exe
    - 2004-08-04 11:00:00 5,632 ----a-w c:\windows\system32\cisvc.exe
    + 2008-04-14 00:12:14 5,632 ----a-w c:\windows\system32\cisvc.exe
    - 2005-07-26 04:39:43 110,080 ----a-w c:\windows\system32\clbcatex.dll
    + 2008-04-14 00:11:50 110,592 ----a-w c:\windows\system32\clbcatex.dll
    - 2005-07-26 04:39:43 498,688 ----a-w c:\windows\system32\clbcatq.dll
    + 2008-04-14 00:11:50 498,688 ----a-w c:\windows\system32\clbcatq.dll
    - 2004-08-04 11:00:00 64,000 ----a-w c:\windows\system32\cleanmgr.exe
    + 2008-04-14 00:12:14 64,000 ----a-w c:\windows\system32\cleanmgr.exe
    - 2004-08-04 11:00:00 77,824 ----a-w c:\windows\system32\cliconfg.dll
    + 2008-04-14 00:11:50 77,824 ----a-w c:\windows\system32\cliconfg.dll
    - 2004-08-04 11:00:00 20,480 ----a-w c:\windows\system32\cliconfg.exe
    + 2008-04-14 00:12:14 20,480 ----a-w c:\windows\system32\cliconfg.exe
    - 2004-08-04 11:00:00 102,912 ----a-w c:\windows\system32\clipbrd.exe
    + 2008-04-14 00:12:14 102,912 ----a-w c:\windows\system32\clipbrd.exe
    - 2004-08-04 11:00:00 33,280 ----a-w c:\windows\system32\clipsrv.exe
    + 2008-04-14 00:12:14 33,280 ----a-w c:\windows\system32\clipsrv.exe
    - 2004-08-04 11:00:00 57,856 ----a-w c:\windows\system32\clusapi.dll
    + 2008-04-14 00:11:50 58,368 ----a-w c:\windows\system32\clusapi.dll
    - 2004-08-04 11:00:00 15,872 ----a-w c:\windows\system32\cmcfg32.dll
    + 2008-04-14 00:11:50 15,872 ----a-w c:\windows\system32\cmcfg32.dll
    - 2004-08-04 11:00:00 388,608 ----a-w c:\windows\system32\cmd.exe
    + 2008-04-14 00:12:14 389,120 ----a-w c:\windows\system32\cmd.exe
    - 2004-08-04 11:00:00 343,040 ----a-w c:\windows\system32\cmdial32.dll
    + 2008-04-14 00:11:50 344,064 ----a-w c:\windows\system32\cmdial32.dll
    - 2004-08-04 11:00:00 47,104 ----a-w c:\windows\system32\cmdl32.exe
    + 2008-04-14 00:12:14 25,600 ----a-w c:\windows\system32\cmdl32.exe
    - 2004-08-04 11:00:00 39,936 ----a-w c:\windows\system32\cmmon32.exe
    + 2008-04-14 00:12:15 39,936 ----a-w c:\windows\system32\cmmon32.exe
    - 2004-08-04 11:00:00 185,344 ----a-w c:\windows\system32\cmprops.dll
    + 2008-04-14 00:11:50 185,344 ----a-w c:\windows\system32\cmprops.dll
    - 2004-08-04 11:00:00 13,824 ----a-w c:\windows\system32\cmsetACL.dll
    + 2008-04-14 00:11:50 13,312 ----a-w c:\windows\system32\cmsetacl.dll
    - 2004-08-04 11:00:00 63,488 ----a-w c:\windows\system32\cmstp.exe
    + 2008-04-14 00:12:15 63,488 ----a-w c:\windows\system32\cmstp.exe
    - 2004-08-04 11:00:00 39,936 ----a-w c:\windows\system32\cmutil.dll
    + 2008-04-14 00:11:50 39,424 ----a-w c:\windows\system32\cmutil.dll
    - 2004-08-04 11:00:00 47,104 ----a-w c:\windows\system32\cnbjmon.dll
    + 2008-04-14 00:11:50 47,104 ----a-w c:\windows\system32\cnbjmon.dll
    - 2005-07-26 04:39:43 60,416 ----a-w c:\windows\system32\colbact.dll
    + 2008-04-14 00:11:51 60,416 ----a-w c:\windows\system32\colbact.dll
    - 2005-07-26 04:39:44 195,072 ----a-w c:\windows\system32\Com\comadmin.dll
    + 2008-04-14 00:11:51 195,072 ----a-w c:\windows\system32\Com\comadmin.dll
    - 2004-08-04 11:00:00 9,728 ----a-w c:\windows\system32\Com\comrepl.exe
    + 2008-04-14 00:12:15 9,728 ----a-w c:\windows\system32\Com\comrepl.exe
    - 2004-08-04 11:00:00 5,120 ----a-w c:\windows\system32\Com\comrereg.exe
    + 2008-04-14 00:12:15 6,144 ----a-w c:\windows\system32\Com\comrereg.exe
    - 2004-08-04 11:00:00 25,600 ----a-w c:\windows\system32\comaddin.dll
    + 2008-04-14 00:11:51 28,160 ----a-w c:\windows\system32\comaddin.dll
    - 2006-08-25 15:45:58 617,472 ----a-w c:\windows\system32\comctl32.dll
    + 2008-04-14 00:11:51 617,472 ----a-w c:\windows\system32\comctl32.dll
    - 2004-08-04 11:00:00 276,992 ----a-w c:\windows\system32\comdlg32.dll
    + 2008-04-14 00:11:51 276,992 ----a-w c:\windows\system32\comdlg32.dll
    - 2004-08-04 11:00:00 252,928 ----a-w c:\windows\system32\compatUI.dll
    + 2008-04-14 00:11:51 252,928 ----a-w c:\windows\system32\compatui.dll
    - 2004-08-04 11:00:00 229,376 ----a-w c:\windows\system32\compstui.dll
    + 2008-04-14 00:11:51 229,376 ----a-w c:\windows\system32\compstui.dll
    - 2005-07-26 04:39:44 97,792 ----a-w c:\windows\system32\comrepl.dll
    + 2008-04-14 00:11:51 97,792 ----a-w c:\windows\system32\comrepl.dll
    - 2004-08-04 11:00:00 792,064 ----a-w c:\windows\system32\comres.dll
    + 2008-04-14 00:11:51 792,064 ----a-w c:\windows\system32\comres.dll
    + 2008-04-13 18:43:32 9,728 ------w c:\windows\system32\comsdupd.exe
    - 2004-08-04 11:00:00 147,456 ----a-w c:\windows\system32\comsnap.dll
    + 2008-04-14 00:11:51 167,424 ----a-w c:\windows\system32\comsnap.dll
    - 2005-07-26 04:39:44 1,267,200 ----a-w c:\windows\system32\comsvcs.dll
    + 2008-04-14 00:11:51 1,267,200 ----a-w c:\windows\system32\comsvcs.dll
    - 2005-07-26 04:39:45 540,160 ----a-w c:\windows\system32\comuid.dll
    + 2008-04-14 00:11:51 539,648 ----a-w c:\windows\system32\comuid.dll
    - 2009-01-19 13:24:26 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
    + 2009-01-19 16:49:40 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
    - 2009-01-19 13:24:26 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2009-01-19 16:49:40 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2009-01-19 16:49:37 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009011920090120\index.dat
    - 2009-01-19 13:24:26 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    + 2009-01-19 16:49:40 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet
  2. 2009-01-19, 19:51 #12
    peku006
    peku006 is offline
    Emeritus- Security Expert peku006's Avatar
    Join Date
    Feb 2007
    Location
    Norway
    Posts
    3,103

    Default

    Hi clsaar

    1 - Download anf Run OTMoveIt3

    Download OTMoveIt3 by Old Timer and save it to your Desktop.
    • Double-click OTMoveIt3.exe.
    • Copy the lines in the codebox below.

    Code:
    :files
c:\windows\oldvmreg.dll
c:\windows\system32\viyivifa.exe
c:\windows\system32\wiftgqma.exe
c:\windows\VPC32.INI
c:\windows\system32\nowepeto.exe
c:\windows\system32\fihikulo.dll
    • Return to OTMoveIt3, right click in the Paste Instructions for Items to be Moved window (under the yellow bar) and choose Paste.
    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar), and paste it in your next reply.
    • Close OTMoveIt3


    2 - Update Java

    Please download JavaRa and unzip it to your desktop.

    • Double-click on JavaRa.exe to start the program.
    • Click on Remove Older Versions to remove the older versions of Java installed on your computer.
    • Click Yes when prompted. When JavaRa is done, a notice will appear that a log file has been produced. Click OK.
    • A log file will pop up. Please save it to a convenient location.


    Download the latest version of Java Runtime Environment (JRE) 6 Update 11.

    • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
    • Click the "Download" button to the right.
    • Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
    • Click on Continue.
    • Click on the link to download Windows Offline Installation and save it to your desktop. Do NOT use the Sun Download Manager..
    • Close any programs you may have running - especially your web browser.
    • Then from your desktop double-click on the download to install the newest version.


    3 - Clean temp files

    • Download and Run ATF Cleaner
      Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.Double-click ATF Cleaner.exe to open it.

      Under Main choose:
      • Windows Temp
        Current User Temp
        All Users Temp
        Temporary Internet Files
        Prefetch
        Java Cache
        *The other boxes are optional*
        Then click the Empty Selected button.

      if you use Firefox:
      • Click Firefox at the top and choose: Select All
        Click the Empty Selected button.
        NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

      if you use Opera:
      • Click Opera at the top and choose: Select All
        Click the Empty Selected button.
        NOTE: If you would like to keep your saved passwords, please click NO at the prompt.


      Click Exit on the Main menu to close the program


    4 - Kaspersky Online Scan

    Please go to Kaspersky website and perform an online antivirus scan.

    1. Read through the requirements and privacy statement and click on Accept button.
    2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    3. When the downloads have finished, click on Settings.
    4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      • Spyware, Adware, Dialers, and other potentially dangerous programs
        Archives
        Mail databases
    5. Click on My Computer under Scan.
    6. Once the scan is complete, it will display the results. Click on View Scan Report.
    7. You will see a list of infected items there. Click on Save Report As....
    8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
    9. Please post this log in your next reply.


    5 - Run Hijackthis
    Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad

    6 - Status Check
    Please reply with

    1. the OTMoveIt3. log
    2. the Kaspersky online scanner report
    3. a fresh HijackThis log
    How's the computer running now? Any problems?

    Thanks peku006
    I don't help with logs thru PM. If you have problems create a thread in the forum, please.
  3. 2009-01-19, 22:33 #13
    clsaar
    clsaar is offline
    Member clsaar's Avatar
    Join Date
    May 2008
    Posts
    43

    Default Updated Logs

    ========== FILES ==========
    LoadLibrary failed for c:\windows\oldvmreg.dll
    c:\windows\oldvmreg.dll NOT unregistered.
    c:\windows\oldvmreg.dll moved successfully.
    c:\windows\system32\viyivifa.exe moved successfully.
    c:\windows\system32\wiftgqma.exe moved successfully.
    c:\windows\VPC32.INI moved successfully.
    c:\windows\system32\nowepeto.exe moved successfully.
    DllUnregisterServer procedure not found in c:\windows\system32\fihikulo.dll
    c:\windows\system32\fihikulo.dll NOT unregistered.
    c:\windows\system32\fihikulo.dll moved successfully.

    OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01192009_130510


    --------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER 7 REPORT
    Monday, January 19, 2009
    Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Monday, January 19, 2009 17:10:23
    Records in database: 1648886
    --------------------------------------------------------------------------------

    Scan settings:
    Scan using the following database: extended
    Scan archives: yes
    Scan mail databases: yes

    Scan area - My Computer:
    C:\
    D:\
    J:\
    P:\
    Q:\
    R:\
    U:\
    V:\

    Scan statistics:
    Files scanned: 50091
    Threat name: 3
    Infected objects: 6
    Suspicious objects: 0
    Duration of the scan: 00:50:32


    File name / Threat name / Threats count
    C:\Qoobox\Quarantine\C\WINDOWS\system32\abgiwext.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.gbs 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\bdbxkxph.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.gbc 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\cjmgae.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.gbs 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\cojelqqk.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.gbs 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\zfkzdx.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.gbc 1
    C:\_OTMoveIt\MovedFiles\01192009_130510\windows\system32\fihikulo.dll Infected: Trojan.Win32.Monder.amxk 1

    The selected area was scanned.


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 3:29:54 PM, on 1/19/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\WINDOWS\System32\WLTRYSVC.EXE
    C:\WINDOWS\System32\bcmwltry.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
    C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    C:\Program Files\Symantec AntiVirus\SavRoam.exe
    C:\WINDOWS\system32\StacSV.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\WINDOWS\stsystra.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=1080403
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.vzam.net/download/downloa...ctid=479&upd=t
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
    O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
    O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Vertical.local
    O17 - HKLM\Software\..\Telephony: DomainName = Vertical.local
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Vertical.local
    O20 - Winlogon Notify: ddcCUnkj - C:\WINDOWS\
    O20 - Winlogon Notify: gemsafe - C:\Program Files\Gemplus\GemSafe Libraries\BIN\WLEventNotify.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: SecureStorageService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: NTRU TSS v1.2.1.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe
    O23 - Service: TdmService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
    O23 - Service: WaveEnrollmentService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Authentication Manager\WaveEnrollmentService.exe
    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

    --
    End of file - 8843 bytes


    Computer seems to be running normally. I don't suppose I can use this exact procedure on another computer withSpyware Guard 2008? I know, I have already posted a new thread. Let me know if all is good!
  4. 2009-01-19, 22:51 #14
    peku006
    peku006 is offline
    Emeritus- Security Expert peku006's Avatar
    Join Date
    Feb 2007
    Location
    Norway
    Posts
    3,103

    Default

    Hi clsaar

    Congratulations, your log looks clean!

    Next we remove all used tools.

    uninstall ComboFix:

    • Click START then RUN
    • Now type Combofix /u in the runbox and click OK


    • Double-click OTMoveIt3.exe.
    • Click the CleanUp! button.
    • Select Yes when the "Begin cleanup Process?" prompt appears.
    • If you are prompted to Reboot during the cleanup, select Yes.
    • The tool will delete itself once it finishes, if not delete it by yourself.


    Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

    Here are some free programs I recommend that could help you improve your computer's security.

    Spybot Search and Destroy 1.6
    Download it from here. Just choose a mirror and off you go.
    Find here the tutorial on how to use Spybot properly here

    Install SpyWare Blaster 4.0
    Download it from here
    Find here the tutorial on how to use Spyware Blaster here

    Install WinPatrol
    Download it from here
    Here you can find information about how WinPatrol works here

    Install FireTrust SiteHound
    You can find information and download it from here

    Install MVPS Hosts File from here
    The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
    Find Tutorial here : http://www.mvps.org/winhelp2002/hosts.htm

    Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
    You can use one of these sites to check if any updates are needed for your pc.
    Secunia Software Inspector
    F-secure Health Check

    Visit Microsoft often to get the latest updates for your computer.
    http://www.update.microsoft.com

    Please check out Tony Klein's article "How did I get infected in the first place?"

    Read some information here how to prevent Malware.


    Happy safe surfing!
    I don't help with logs thru PM. If you have problems create a thread in the forum, please.
  5. 2009-01-20, 14:43 #15
    clsaar
    clsaar is offline
    Member clsaar's Avatar
    Join Date
    May 2008
    Posts
    43

    Default Thank You!

    Thank you soo much for your help. I have followed the last of your instructions for tool removal and have added more protection to this machine! You guys to a great job, thank you so much!
  6. 2009-01-20, 18:12 #16
    peku006
    peku006 is offline
    Emeritus- Security Expert peku006's Avatar
    Join Date
    Feb 2007
    Location
    Norway
    Posts
    3,103

    Default

    Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.
    I don't help with logs thru PM. If you have problems create a thread in the forum, please.
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules