I'm having this process called avguard.exe which makes my firefox unable to launch. I have tried a lot to remove it but it keeps coming back. Both the process and the file comes back seconds after removal.
I have been told it is a worm.netsky.g causing this but the guides on how to remove it doesn't fit in this case... I can't find the registry values that netsky.g creates.
Logfile of random's system information tool 1.04 (written by random/random)
Run by Mattias at 2008-11-06 19:52:02
Microsoft Windows XP Professional Service Pack 2
System drive C: has 62 GB (81%) free of 76 GB
Total RAM: 511 MB (46% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:52:14, on 2008-11-06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\World of Warcraft\WoW-2.4.2-enGB-downloader.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\avguard.exe
C:\Documents and Settings\Mattias\Desktop\RSIT.exe
C:\Program Files\trend micro\Mattias.exe
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - Startup: lsass.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) -
http://cdn.scan.onecare.live.com/res...scbase6662.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
--
End of file - 2298 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-08-01 61440]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"=C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-08-08 490952]
C:\Documents and Settings\Mattias\Start Menu\Programs\Startup
lsass.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-08-21 143360]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\World of Warcraft\WoW-2.4.2-enGB-downloader.exe"="C:\Program Files\World of Warcraft\WoW-2.4.2-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b4fd7948-abec-11dd-aced-806d6172696f}]
shell\AutoRun\command - F:\Installer.exe
======List of files/folders created in the last 1 months======
2008-11-06 19:52:05 ----D---- C:\Program Files\trend micro
2008-11-06 19:52:02 ----D---- C:\rsit
2008-11-06 19:30:48 ----A---- C:\WINDOWS\gmer.ini
2008-11-06 19:30:45 ----A---- C:\WINDOWS\gmer_uninstall.cmd
2008-11-06 19:30:44 ----A---- C:\WINDOWS\gmer.exe
2008-11-06 19:30:44 ----A---- C:\WINDOWS\gmer.dll
2008-11-06 19:30:35 ----D---- C:\Documents and Settings\Mattias\Application Data\WinRAR
2008-11-06 19:10:18 ----A---- C:\SDFix.exe
2008-11-06 18:56:47 ----SHD---- C:\RECYCLER
2008-11-06 18:26:07 ----D---- C:\WINDOWS\system32\CatRoot_bak
2008-11-06 18:15:23 ----D---- C:\WINDOWS\system32\PreInstall
2008-11-06 18:15:21 ----N---- C:\WINDOWS\system32\spmsg.dll
2008-11-06 18:15:20 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2008-11-06 18:15:18 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2008-11-06 18:15:18 ----HD---- C:\WINDOWS\$hf_mig$
2008-11-06 18:09:07 ----D---- C:\Program Files\Windows Live Safety Center
2008-11-06 17:38:24 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2008-11-06 17:37:26 ----D---- C:\WINDOWS\system32\appmgmt
2008-11-06 17:36:50 ----D---- C:\WINDOWS\LastGood
2008-11-06 17:27:32 ----A---- C:\WINDOWS\avguard.exe
2008-11-06 17:27:24 ----A---- C:\WINDOWS\system32\wowformf436_130.dll
2008-11-06 14
24 ----D---- C:\WINDOWS\Eurobattle.net Installer
2008-11-06 14
00 ----A---- C:\WINDOWS\Eurobattle.net Installer Setup Log.txt
2008-11-06 13:45:34 ----D---- C:\Documents and Settings\Mattias\Application Data\Ventrilo
2008-11-06 13:44:48 ----D---- C:\Program Files\VentriloMIX
2008-11-06 13:43:39 ----A---- C:\WINDOWS\War3Unin.exe
2008-11-06 13:41:01 ----D---- C:\Program Files\Warcraft III
2008-11-06 13:36:42 ----D---- C:\Program Files\DAEMON Tools Lite
2008-11-06 12:35:23 ----D---- C:\Documents and Settings\Mattias\Application Data\DAEMON Tools
2008-11-06 12:30:35 ----D---- C:\Documents and Settings\All Users\Application Data\Blizzard
2008-11-06 11:55:58 ----A---- C:\WINDOWS\system32\h323log.txt
2008-11-06 11:55:05 ----D---- C:\Program Files\World of Warcraft
2008-11-06 11:55:05 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2008-11-06 11:54:21 ----A---- C:\WINDOWS\system32\ativvaxx.dll
2008-11-06 11:54:21 ----A---- C:\WINDOWS\system32\ati3duag.dll
2008-11-06 11:54:21 ----A---- C:\WINDOWS\system32\ati3d1ag.dll
2008-11-06 11:54:20 ----A---- C:\WINDOWS\system32\ati2dvag.dll
2008-11-06 11:54:20 ----A---- C:\WINDOWS\system32\ati2cqag.dll
2008-11-06 11:54:01 ----A---- C:\WINDOWS\system32\usbui.dll
2008-11-06 11:53:53 ----A---- C:\WINDOWS\system32\HSFCISP2.dll
2008-11-06 11:53:52 ----A---- C:\WINDOWS\system32\mdmxsdk.dll
2008-11-06 11:53:34 ----D---- C:\Documents and Settings\Mattias\Application Data\ATI
2008-11-06 11:53:34 ----D---- C:\Documents and Settings\All Users\Application Data\ATI
2008-11-06 11:52:45 ----A---- C:\WINDOWS\imsins.BAK
2008-11-06 11:52:42 ----SHD---- C:\WINDOWS\Installer
2008-11-06 11:52:42 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-11-06 11:52:41 ----A---- C:\WINDOWS\ODBCINST.INI
2008-11-06 11:52:38 ----RD---- C:\Program Files
2008-11-06 11:52:38 ----D---- C:\Program Files\Common Files\SpeechEngines
2008-11-06 11:52:38 ----D---- C:\Program Files\Common Files\Microsoft Shared
2008-11-06 11:52:38 ----D---- C:\Program Files\Common Files
2008-11-06 11:52:35 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2008-11-06 11:52:35 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2008-11-06 11:52:35 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2008-11-06 11:52:33 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2008-11-06 11:52:33 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2008-11-06 11:52:33 ----RA---- C:\WINDOWS\system32\kbdur.dll
2008-11-06 11:52:33 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2008-11-06 11:52:33 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2008-11-06 11:52:33 ----RA---- C:\WINDOWS\system32\kbdru.dll
2008-11-06 11:52:33 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2008-11-06 11:52:33 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2008-11-06 11:52:33 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2008-11-06 11:52:33 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2008-11-06 11:52:33 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2008-11-06 11:52:33 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2008-11-06 11:52:31 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2008-11-06 11:52:31 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2008-11-06 11:52:31 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2008-11-06 11:52:31 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2008-11-06 11:52:31 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2008-11-06 11:52:31 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2008-11-06 11:52:31 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2008-11-06 11:52:29 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2008-11-06 11:52:29 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2008-11-06 11:52:29 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2008-11-06 11:52:29 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2008-11-06 11:52:29 ----RA---- C:\WINDOWS\system32\kbdest.dll
2008-11-06 11:52:27 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2008-11-06 11:52:27 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2008-11-06 11:52:27 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2008-11-06 11:52:27 ----RA---- C:\WINDOWS\system32\kbdro.dll
2008-11-06 11:52:27 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2008-11-06 11:52:27 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2008-11-06 11:52:27 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2008-11-06 11:52:27 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2008-11-06 11:52:27 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2008-11-06 11:52:27 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2008-11-06 11:52:27 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2008-11-06 11:52:27 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2008-11-06 11:52:27 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2008-11-06 11:52:24 ----A---- C:\WINDOWS\system32\spxcoins.dll
2008-11-06 11:52:24 ----A---- C:\WINDOWS\system32\irclass.dll
2008-11-06 11:52:24 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2008-11-06 11:52:24 ----A---- C:\WINDOWS\system32\dgsetup.dll
2008-11-06 11:52:24 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2008-11-06 11:52:22 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2008-11-06 11:52:22 ----A---- C:\WINDOWS\TASKMAN.EXE
2008-11-06 11:52:21 ----A---- C:\WINDOWS\system32\batt.dll
2008-11-06 11:52:21 ----A---- C:\WINDOWS\NOTEPAD.EXE
2008-11-06 11:52:20 ----A---- C:\WINDOWS\system32\storprop.dll
2008-11-06 11:52:12 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2008-11-06 11:52:08 ----RA---- C:\WINDOWS\SET8.tmp
2008-11-06 11:52:05 ----RA---- C:\WINDOWS\SET4.tmp
2008-11-06 11:52:04 ----RA---- C:\WINDOWS\SET3.tmp
2008-11-06 11:51:58 ----D---- C:\WINDOWS\system32\CatRoot2
2008-11-06 11:51:58 ----D---- C:\WINDOWS\system32\CatRoot
2008-11-06 11:51:53 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-11-06 11:51:49 ----N---- C:\WINDOWS\{00000000-00000000-0000000B-00001102-00000004-00541102}.BAK
2008-11-06 11:51:40 ----A---- C:\WINDOWS\setuplog.txt
2008-11-06 11:51:36 ----SHD---- C:\System Volume Information
2008-11-06 11:51:36 ----D---- C:\Documents and Settings
2008-11-06 11:50:42 ----SH---- C:\boot.ini
2008-11-06 11:44:40 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-11-06 11:44:40 ----RSD---- C:\WINDOWS\Fonts
2008-11-06 11:44:40 ----RD---- C:\WINDOWS\Web
2008-11-06 11:44:40 ----HD---- C:\WINDOWS\inf
2008-11-06 11:44:40 ----D---- C:\WINDOWS\WinSxS
2008-11-06 11:44:40 ----D---- C:\WINDOWS\twain_32
2008-11-06 11:44:40 ----D---- C:\WINDOWS\Temp
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\wins
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\wbem
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\usmt
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\spool
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\ShellExt
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\Setup
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\ras
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\oobe
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\npp
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\mui
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\inetsrv
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\IME
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\icsxml
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\ias
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\export
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\drivers
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\dhcp
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\config
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\3com_dmi
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\3076
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\2052
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\1054
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\1042
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\1041
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\1037
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\1033
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\1031
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\1028
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32\1025
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system32
2008-11-06 11:44:40 ----D---- C:\WINDOWS\system
2008-11-06 11:44:40 ----D---- C:\WINDOWS\security
2008-11-06 11:44:40 ----D---- C:\WINDOWS\Resources
2008-11-06 11:44:40 ----D---- C:\WINDOWS\repair
2008-11-06 11:44:40 ----D---- C:\WINDOWS\Provisioning
2008-11-06 11:44:40 ----D---- C:\WINDOWS\PeerNet
2008-11-06 11:44:40 ----D---- C:\WINDOWS\pchealth
2008-11-06 11:44:40 ----D---- C:\WINDOWS\mui
2008-11-06 11:44:40 ----D---- C:\WINDOWS\msapps
2008-11-06 11:44:40 ----D---- C:\WINDOWS\msagent
2008-11-06 11:44:40 ----D---- C:\WINDOWS\Media
2008-11-06 11:44:40 ----D---- C:\WINDOWS\java
2008-11-06 11:44:40 ----D---- C:\WINDOWS\ime
2008-11-06 11:44:40 ----D---- C:\WINDOWS\Help
2008-11-06 11:44:40 ----D---- C:\WINDOWS\ehome
2008-11-06 11:44:40 ----D---- C:\WINDOWS\Driver Cache
2008-11-06 11:44:40 ----D---- C:\WINDOWS\Debug
2008-11-06 11:44:40 ----D---- C:\WINDOWS\Cursors
2008-11-06 11:44:40 ----D---- C:\WINDOWS\Connection Wizard
2008-11-06 11:44:40 ----D---- C:\WINDOWS\Config
2008-11-06 11:44:40 ----D---- C:\WINDOWS\AppPatch
2008-11-06 11:44:40 ----D---- C:\WINDOWS\addins
2008-11-06 11:44:40 ----D---- C:\WINDOWS
2008-11-06 11:36:24 ----D---- C:\Documents and Settings\Mattias\Application Data\Macromedia
2008-11-06 11:36:23 ----D---- C:\Documents and Settings\Mattias\Application Data\Adobe
2008-11-06 11:25:57 ----D---- C:\WINDOWS\system32\Defaults
2008-11-06 11:25:46 ----D---- C:\Program Files\ESET
2008-11-06 11:25:46 ----D---- C:\Documents and Settings\All Users\Application Data\ESET
2008-11-06 11:23:35 ----D---- C:\Program Files\Creative
2008-11-06 11:21:40 ----A---- C:\WINDOWS\system32\wrap_oal.dll
2008-11-06 11:21:40 ----A---- C:\WINDOWS\system32\OpenAL32.dll
2008-11-06 11:21:39 ----D---- C:\Documents and Settings\Mattias\Application Data\Creative
2008-11-06 11:19:24 ----A---- C:\WINDOWS\system32\ksuser.dll
2008-11-06 11:17:03 ----RSD---- C:\WINDOWS\assembly
2008-11-06 11:15:14 ----D---- C:\WINDOWS\Microsoft.NET
2008-11-06 11:14:39 ----N---- C:\WINDOWS\system32\ati2sgag.exe
2008-11-06 11:14:15 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-11-06 11:13:42 ----D---- C:\WINDOWS\system32\Data
2008-11-06 11:13:34 ----D---- C:\Program Files\ATI Technologies
2008-11-06 11:13:27 ----HD---- C:\Program Files\InstallShield Installation Information
2008-11-06 11:11:54 ----DC---- C:\WINDOWS\system32\DRVSTORE
2008-11-06 11:11:54 ----D---- C:\Program Files\Common Files\InstallShield
2008-11-06 11:11:38 ----D---- C:\ATI
2008-11-06 11:11:04 ----D---- C:\Program Files\MSN Messenger
2008-11-06 11:10:35 ----D---- C:\Documents and Settings\Mattias\Application Data\Mozilla
2008-11-06 11:10:27 ----D---- C:\Program Files\Mozilla Firefox
2008-11-06 11:09:56 ----D---- C:\Program Files\uTorrent
2008-11-06 11:09:55 ----D---- C:\Documents and Settings\Mattias\Application Data\uTorrent
2008-11-06 11:09:48 ----D---- C:\Program Files\WinRAR
2008-11-06 11:09:17 ----D---- C:\Documents and Settings\Mattias\Application Data\Identities
2008-11-06 11:09:08 ----ASH---- C:\Documents and Settings\Mattias\Application Data\desktop.ini
2008-11-06 11:09:07 ----SD---- C:\Documents and Settings\Mattias\Application Data\Microsoft
2008-11-06 11:08:23 ----D---- C:\WINDOWS\SoftwareDistribution
2008-11-06 11:08:13 ----D---- C:\WINDOWS\Prefetch
2008-11-06 11:08:12 ----SD---- C:\WINDOWS\system32\Microsoft
2008-11-06 11:08:12 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-11-06 11:04:17 ----D---- C:\WINDOWS\system32\xircom
2008-11-06 11:04:17 ----D---- C:\Program Files\xerox
2008-11-06 11:04:17 ----D---- C:\Program Files\microsoft frontpage
2008-11-06 11:04:00 ----A---- C:\WINDOWS\control.ini
2008-11-06 11:04:00 ----A---- C:\AUTOEXEC.BAT
2008-11-06 11:03:43 ----A---- C:\WINDOWS\OEWABLog.txt
2008-11-06 11:03:40 ----A---- C:\WINDOWS\system32\mapi32.dll
2008-11-06 11:02:27 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-11-06 11:02:27 ----RD---- C:\WINDOWS\Offline Web Pages
2008-11-06 11:02:27 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2008-11-06 11:02:19 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2008-11-06 11:01:46 ----D---- C:\WINDOWS\system32\DirectX
2008-11-06 11:01:08 ----A---- C:\WINDOWS\system32\atrace.dll
2008-11-06 11:01:05 ----A---- C:\WINDOWS\system32\desktop.ini
2008-11-06 11:01:05 ----A---- C:\WINDOWS\desktop.ini
2008-11-06 11:00:52 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2008-11-06 11:00:50 ----A---- C:\WINDOWS\system32\acctres.dll
2008-11-06 11:00:49 ----D---- C:\Program Files\Common Files\Services
2008-11-06 11:00:44 ----SD---- C:\WINDOWS\Tasks
2008-11-06 11:00:44 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2008-11-06 11:00:42 ----D---- C:\Program Files\Common Files\MSSoap
2008-11-06 11:00:32 ----D---- C:\WINDOWS\srchasst
2008-11-06 11:00:30 ----D---- C:\WINDOWS\system32\Macromed
2008-11-06 11:00:24 ----A---- C:\WINDOWS\system32\wuweb.dll
2008-11-06 11:00:23 ----A---- C:\WINDOWS\system32\wucltui.dll
2008-11-06 11:00:23 ----A---- C:\WINDOWS\system32\wuauserv.dll
2008-11-06 11:00:23 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2008-11-06 11:00:22 ----A---- C:\WINDOWS\system32\wups.dll
2008-11-06 11:00:22 ----A---- C:\WINDOWS\system32\wuaueng.dll.wusetup.2593375.bak
2008-11-06 11:00:22 ----A---- C:\WINDOWS\system32\wuaueng.dll
2008-11-06 11:00:22 ----A---- C:\WINDOWS\system32\wuaucpl.cpl.wusetup.2592703.bak
2008-11-06 11:00:21 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2008-11-06 11:00:21 ----A---- C:\WINDOWS\system32\wuauclt.exe.wusetup.2592468.bak
2008-11-06 11:00:21 ----A---- C:\WINDOWS\system32\wuauclt.exe
2008-11-06 11:00:21 ----A---- C:\WINDOWS\system32\wuapi.dll.wusetup.2592171.bak
2008-11-06 11:00:21 ----A---- C:\WINDOWS\system32\wuapi.dll
2008-11-06 11:00:20 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2008-11-06 11:00:20 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2008-11-06 11:00:19 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2008-11-06 11:00:19 ----A---- C:\WINDOWS\system32\qmgr.dll
2008-11-06 11:00:09 ----D---- C:\Program Files\Movie Maker
2008-11-06 11:00:02 ----A---- C:\WINDOWS\system32\safrslv.dll
2008-11-06 11:00:02 ----A---- C:\WINDOWS\system32\safrdm.dll
2008-11-06 11:00:02 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2008-11-06 11:00:02 ----A---- C:\WINDOWS\system32\racpldlg.dll
2008-11-06 10:59:51 ----A---- C:\WINDOWS\system32\fltMc.exe
2008-11-06 10:59:51 ----A---- C:\WINDOWS\system32\fltlib.dll
2008-11-06 10:59:50 ----D---- C:\WINDOWS\system32\Restore
2008-11-06 10:59:50 ----A---- C:\WINDOWS\system32\srsvc.dll
2008-11-06 10:59:50 ----A---- C:\WINDOWS\system32\srrstr.dll
2008-11-06 10:59:49 ----A---- C:\WINDOWS\system32\srclient.dll
2008-11-06 10:59:48 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2008-11-06 10:59:48 ----A---- C:\WINDOWS\system32\ils.dll
2008-11-06 10:59:47 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2008-11-06 10:59:47 ----A---- C:\WINDOWS\system32\msconf.dll
2008-11-06 10:59:47 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2008-11-06 10:59:47 ----A---- C:\WINDOWS\system32\mnmdd.dll
2008-11-06 10:59:43 ----D---- C:\Program Files\NetMeeting
2008-11-06 10:59:43 ----A---- C:\WINDOWS\system32\msoert2.dll
2008-11-06 10:59:43 ----A---- C:\WINDOWS\system32\msoeacct.dll
2008-11-06 10:59:42 ----A---- C:\WINDOWS\system32\inetres.dll
2008-11-06 10:59:41 ----A---- C:\WINDOWS\system32\inetcomm.dll
2008-11-06 10:59:37 ----D---- C:\Program Files\Outlook Express
2008-11-06 10:59:37 ----A---- C:\WINDOWS\system32\schedsvc.dll
2008-11-06 10:59:37 ----A---- C:\WINDOWS\system32\mstinit.exe
2008-11-06 10:59:37 ----A---- C:\WINDOWS\system32\mstask.dll
2008-11-06 10:59:36 ----A---- C:\WINDOWS\system32\icwphbk.dll
2008-11-06 10:59:36 ----A---- C:\WINDOWS\system32\icwdial.dll
2008-11-06 10:59:35 ----A---- C:\WINDOWS\system32\isign32.dll
2008-11-06 10:59:35 ----A---- C:\WINDOWS\system32\inetcfg.dll
2008-11-06 10:59:23 ----D---- C:\Program Files\Common Files\System
2008-11-06 10:59:21 ----D---- C:\Program Files\Internet Explorer
2008-11-06 10:58:45 ----A---- C:\WINDOWS\vbaddin.ini
2008-11-06 10:58:45 ----A---- C:\WINDOWS\vb.ini
2008-11-06 10:58:41 ----D---- C:\WINDOWS\Registration
2008-11-06 10:58:35 ----D---- C:\Program Files\Online Services
2008-11-06 10:58:34 ----D---- C:\Program Files\Windows Media Player
2008-11-06 10:58:28 ----D---- C:\Program Files\Messenger
2008-11-06 10:58:17 ----D---- C:\Program Files\MSN Gaming Zone
2008-11-06 10:58:17 ----A---- C:\WINDOWS\system32\write.exe
2008-11-06 10:58:08 ----A---- C:\WINDOWS\system32\sndvol32.exe
2008-11-06 10:58:08 ----A---- C:\WINDOWS\system32\hticons.dll
2008-11-06 10:58:08 ----A---- C:\WINDOWS\system32\avwav.dll
2008-11-06 10:58:08 ----A---- C:\WINDOWS\system32\avtapi.dll
2008-11-06 10:58:08 ----A---- C:\WINDOWS\system32\avmeter.dll
2008-11-06 10:58:07 ----A---- C:\WINDOWS\system32\winchat.exe
2008-11-06 10:58:00 ----A---- C:\WINDOWS\system32\getuname.dll
2008-11-06 10:58:00 ----A---- C:\WINDOWS\system32\charmap.exe
2008-11-06 10:58:00 ----A---- C:\WINDOWS\system32\calc.exe
2008-11-06 10:57:59 ----A---- C:\WINDOWS\system32\winmine.exe
2008-11-06 10:57:59 ----A---- C:\WINDOWS\system32\sol.exe
2008-11-06 10:57:59 ----A---- C:\WINDOWS\system32\reset.exe
2008-11-06 10:57:59 ----A---- C:\WINDOWS\system32\mshearts.exe
2008-11-06 10:57:59 ----A---- C:\WINDOWS\system32\freecell.exe
2008-11-06 10:57:58 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2008-11-06 10:57:58 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2008-11-06 10:57:58 ----A---- C:\WINDOWS\system32\tslabels.ini
2008-11-06 10:57:58 ----A---- C:\WINDOWS\system32\tskill.exe
2008-11-06 10:57:58 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2008-11-06 10:57:58 ----A---- C:\WINDOWS\system32\tscon.exe
2008-11-06 10:57:58 ----A---- C:\WINDOWS\system32\shadow.exe
2008-11-06 10:57:58 ----A---- C:\WINDOWS\system32\rwinsta.exe
2008-11-06 10:57:58 ----A---- C:\WINDOWS\system32\regini.exe
2008-11-06 10:57:58 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2008-11-06 10:57:58 ----A---- C:\WINDOWS\system32\qwinsta.exe
2008-11-06 10:57:58 ----A---- C:\WINDOWS\system32\qappsrv.exe
2008-11-06 10:57:57 ----A---- C:\WINDOWS\system32\msg.exe
2008-11-06 10:57:57 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2008-11-06 10:57:57 ----A---- C:\WINDOWS\system32\logoff.exe
2008-11-06 10:57:57 ----A---- C:\WINDOWS\system32\cdmodem.dll
2008-11-06 10:57:56 ----A---- C:\WINDOWS\system32\stclient.dll
2008-11-06 10:57:56 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2008-11-06 10:57:56 ----A---- C:\WINDOWS\system32\mtxex.dll
2008-11-06 10:57:56 ----A---- C:\WINDOWS\system32\mtxdm.dll
2008-11-06 10:57:56 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2008-11-06 10:57:56 ----A---- C:\WINDOWS\system32\comsnap.dll
2008-11-06 10:57:56 ----A---- C:\WINDOWS\system32\comrepl.dll
2008-11-06 10:57:56 ----A---- C:\WINDOWS\system32\comaddin.dll
2008-11-06 10:57:51 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2008-11-06 10:57:42 ----D---- C:\Program Files\MSN
2008-11-06 10:57:41 ----A---- C:\WINDOWS\system32\accwiz.exe
2008-11-06 10:57:40 ----D---- C:\Program Files\Windows NT
2008-11-06 10:57:40 ----A---- C:\WINDOWS\system32\sndrec32.exe
2008-11-06 10:57:40 ----A---- C:\WINDOWS\system32\mspaint.exe
2008-11-06 10:57:40 ----A---- C:\WINDOWS\system32\mplay32.exe
2008-11-06 10:57:40 ----A---- C:\WINDOWS\system32\hypertrm.dll
2008-11-06 10:57:39 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2008-11-06 10:57:39 ----A---- C:\WINDOWS\system32\spider.exe
2008-11-06 10:57:39 ----A---- C:\WINDOWS\system32\clipbrd.exe
2008-11-06 10:57:38 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2008-11-06 10:57:38 ----A---- C:\WINDOWS\system32\sessmgr.exe
2008-11-06 10:57:38 ----A---- C:\WINDOWS\system32\remotepg.dll
2008-11-06 10:57:38 ----A---- C:\WINDOWS\system32\rdshost.exe
2008-11-06 10:57:38 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2008-11-06 10:57:38 ----A---- C:\WINDOWS\system32\rdchost.dll
2008-11-06 10:57:38 ----A---- C:\WINDOWS\system32\mstscax.dll
2008-11-06 10:57:38 ----A---- C:\WINDOWS\system32\mstsc.exe
2008-11-06 10:57:37 ----D---- C:\WINDOWS\system32\MsDtc
2008-11-06 10:57:37 ----A---- C:\WINDOWS\system32\termsrv.dll
2008-11-06 10:57:37 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2008-11-06 10:57:37 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2008-11-06 10:57:37 ----A---- C:\WINDOWS\system32\rdpclip.exe
2008-11-06 10:57:37 ----A---- C:\WINDOWS\system32\qprocess.exe
2008-11-06 10:57:37 ----A---- C:\WINDOWS\system32\mtxoci.dll
2008-11-06 10:57:37 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2008-11-06 10:57:37 ----A---- C:\WINDOWS\system32\icaapi.dll
2008-11-06 10:57:37 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2008-11-06 10:57:36 ----A---- C:\WINDOWS\system32\xolehlp.dll
2008-11-06 10:57:36 ----A---- C:\WINDOWS\system32\msdtctm.dll
2008-11-06 10:57:36 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2008-11-06 10:57:36 ----A---- C:\WINDOWS\system32\msdtclog.dll
2008-11-06 10:57:36 ----A---- C:\WINDOWS\system32\msdtc.exe
2008-11-06 10:57:35 ----D---- C:\WINDOWS\system32\Com
2008-11-06 10:57:35 ----A---- C:\WINDOWS\system32\colbact.dll
2008-11-06 10:57:35 ----A---- C:\WINDOWS\system32\clbcatex.dll
2008-11-06 10:57:35 ----A---- C:\WINDOWS\system32\catsrvut.dll
2008-11-06 10:57:35 ----A---- C:\WINDOWS\system32\catsrvps.dll
2008-11-06 10:57:35 ----A---- C:\WINDOWS\system32\catsrv.dll
2008-11-06 10:57:34 ----A---- C:\WINDOWS\system32\comuid.dll
2008-11-06 10:57:34 ----A---- C:\WINDOWS\system32\comsvcs.dll
2008-11-06 10:57:34 ----A---- C:\WINDOWS\system32\clbcatq.dll
2008-11-06 10:57:28 ----A---- C:\WINDOWS\system32\servdeps.dll
2008-11-06 10:57:28 ----A---- C:\WINDOWS\system32\mmfutil.dll
2008-11-06 10:57:28 ----A---- C:\WINDOWS\system32\licwmi.dll
2008-11-06 10:57:28 ----A---- C:\WINDOWS\system32\cmprops.dll
======List of files/folders modified in the last 1 months======
2008-11-06 11:52:37 ----A---- C:\WINDOWS\system.ini
2008-11-06 11:04:00 ----A---- C:\WINDOWS\win.ini
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 36096]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-08-03 11868]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-08-21 3299840]
R3 COMMONFX.SYS;COMMONFX.SYS; C:\WINDOWS\System32\drivers\COMMONFX.SYS [2008-06-27 99352]
R3 ctac32k;Creative AC3 Software Decoder; C:\WINDOWS\system32\drivers\ctac32k.sys [2008-07-07 511000]
R3 ctaud2k;Creative Audio Driver (WDM); C:\WINDOWS\system32\drivers\ctaud2k.sys [2008-07-07 532376]
R3 CTAUDFX.SYS;CTAUDFX.SYS; C:\WINDOWS\System32\drivers\CTAUDFX.SYS [2008-06-27 555032]
R3 ctprxy2k;Creative Proxy Driver; C:\WINDOWS\system32\drivers\ctprxy2k.sys [2008-07-07 14360]
R3 CTSBLFX.SYS;CTSBLFX.SYS; C:\WINDOWS\System32\drivers\CTSBLFX.SYS [2008-06-27 566296]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\drivers\ctsfm2k.sys [2008-07-07 157208]
R3 emupia;E-mu Plug-in Architecture Driver; C:\WINDOWS\system32\drivers\emupia2k.sys [2008-07-07 92696]
R3 ha10kx2k;Creative Hardware Abstract Layer Driver; C:\WINDOWS\system32\drivers\ha10kx2k.sys [2008-07-07 797720]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2004-08-04 9600]
R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSFDPSP2.sys [2004-08-03 1041536]
R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\system32\DRIVERS\HSFBS2S2.sys [2004-08-03 220032]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12160]
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\drivers\ctoss2k.sys [2008-07-07 127512]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSFCXTS2.sys [2004-08-03 685056]
R4 eamon;EAMON; C:\WINDOWS\system32\DRIVERS\eamon.sys []
R4 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys []
S3 aih99loe;aih99loe; C:\WINDOWS\system32\drivers\aih99loe.sys []
S3 COMMONFX;COMMONFX; C:\WINDOWS\system32\drivers\COMMONFX.SYS [2008-06-27 99352]
S3 CTAUDFX;CTAUDFX; C:\WINDOWS\system32\drivers\CTAUDFX.SYS [2008-06-27 555032]
S3 ctdvda2k;Creative DVD-Audio Device Driver; C:\WINDOWS\system32\drivers\ctdvda2k.sys [2008-07-07 347080]
S3 CTERFXFX.SYS;CTERFXFX.SYS; C:\WINDOWS\System32\drivers\CTERFXFX.SYS [2008-06-27 100888]
S3 CTERFXFX;CTERFXFX; C:\WINDOWS\system32\drivers\CTERFXFX.SYS [2008-06-27 100888]
S3 CTSBLFX;CTSBLFX; C:\WINDOWS\system32\drivers\CTSBLFX.SYS [2008-06-27 566296]
S3 gmer;gmer; C:\WINDOWS\System32\DRIVERS\gmer.sys [2008-11-06 85969]
S3 hap16v2k;Creative P16V HAL Driver; C:\WINDOWS\system32\drivers\hap16v2k.sys [2008-07-07 162840]
S3 hap17v2k;Creative P17V HAL Driver; C:\WINDOWS\system32\drivers\hap17v2k.sys [2008-07-07 189464]
S3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-08-21 573440]
R2 wowsystemcode;Remote TCP/IP; C:\WINDOWS\System32\svchost.exe [2004-08-04 14336]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2008-08-20 593920]
S2 RPCHE;Remote Procedure Call (RPCE); C:\Program Files\NetMeeting\Winlog.exe [2008-11-06 456192]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
-----------------EOF-----------------