Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 




Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > HijackThis Log Help
malware/spyware xadbrk_.exe,trojandownloader.xs and more malware/spyware xadbrk_.exe,trojandownloader.xs and more
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read

HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help.

Reply
Page 1 of 2 1 2 >
 
Thread Tools
Old 02-25-2008, 03:22 PM   #1 (permalink)
Registered User
 
Join Date: Feb 2008
Posts: 21
OS: xp,sp2


malware/spyware xadbrk_.exe,trojandownloader.xs and more
i get pop ups saying to me to buy SPY AWAY and PERFECT CLEANER

since i got those malwares i encountered those problems,
i use internet explorer 6, and since then i cannot open some of the webpages, i discovered this when i tryed to acces www.triburile.ro or www.tribalwars.com, www.isohunt.com
and i installed mozzila firefox, it works
more problems: task manager gets disabled after every restart, my micro torrent doesn't work whit this malware, says something that he could not be open, and then closest by itself.
there is a little triangle whit yellow color and "!" but doesn`t look like the original windows.
i get a red pop up that has the name "microsoft spyware center" or something like that, don`t remember name and comes whit a name of a spyware, and click here to scan u`re pc, just 5 mins.
my desktop background changed to a blue screen, whit some words on it
Warning: Spyware thread detected on your pc

your computer has several fatal errors due to spyware activity

click here to scan your pc for free, and redirects me to first pop up

i got error on dss, but i added the log on txt error

here is hijack log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:18:46 AM, on 2/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\mgmrwmrv.exe
C:\WINDOWS\Explorer.EXE
d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
d:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
D:\Program Files\Steam\Steam.exe
D:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\muistu.OPE\Local Settings\Application Data\cftmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Documents and Settings\muistu.OPE\Local Settings\Application Data\cftmon.exe
C:\Documents and Settings\muistu.OPE\Local Settings\Application Data\cftmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
d:\Program Files\Alwil Software\Avast4\ashSimpl.exe
D:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\muistu.OPE\Desktop\Gattahack.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\muistu.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ro/
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\mgmrwmrv.exe,
O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - (no file)
O2 - BHO: (no name) - {00000012-890e-4aac-afd9-eff6954a34dd} - (no file)
O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {06dfedaa-6196-11d5-bfc8-00508b4a487d} - (no file)
O2 - BHO: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file)
O2 - BHO: (no name) - {1adbcce8-cf84-441e-9b38-afc7a19c06a4} - (no file)
O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {944864a5-3916-46e2-96a9-a2e84f3f1208} - (no file)
O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {bb936323-19fa-4521-ba29-eca6a121bc78} - (no file)
O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
O2 - BHO: (no name) - {c5af2622-8c75-4dfb-9693-23ab7686a456} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Steam] "D:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t
O4 - HKUS\S-1-5-18\..\Run: [autoload] C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\cftmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [autoload] C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\cftmon.exe (User 'Default user')
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6271 bytes
Attached Files
File Type: txt error.txt (15.6 KB, 0 views)
File Type: txt DxDiag.txt (36.3 KB, 0 views)
muistu is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Reply With Quote
Old 02-25-2008, 09:29 PM   #2 (permalink)
Registered User
 
Join Date: Feb 2008
Posts: 21
OS: xp,sp2


Re: malware/spyware xadbrk_.exe,trojandownloader.xs and more
more info, the avast system scan said it discovered win32:small_jmk found in c
win32:ctx found on panda active scan
win32 trojano has been found on iso file
and
the red looks like
Windows Security Center system warning
Alert details C:windows/iexplorrr23.dll
thread adblaster

my internet explorer seems now to work but i doubt it will work after restart, this is due to avast scan and fix some of the errors, but i do still get pop-ups
Attached Files
File Type: txt avast.txt (3.9 KB, 1 views)
Last edited by muistu : 02-25-2008 at 09:31 PM. Reason: more info
muistu is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Reply With Quote
Old 02-26-2008, 07:21 AM   #3 (permalink)
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
 
Ried's Avatar
 
Join Date: Jan 2005
Location: Ohio
Posts: 18,173
OS: WinXP and Win98se


Re: malware/spyware xadbrk_.exe,trojandownloader.xs and more
Hello muistu,

What error did you receive with dss.exe?

Run dss.exe again and take note of the area it is scanning when the error occurs.

Then run dss.exe again, but use these instructions:

Click Start>Select 'Run' - then copy/paste the following text into the run box & click OK

"%userprofile%\desktop\dss.exe" /config

In the dialog box that appears:

View all the categories listed, and uncheck whichever one caused the problem. (Typically Temp Cleanup or Event Logs)

Click Scan!

Post the main.txt and extra.txt it produces.
__________________

Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Keep this site free for all. Please consider, donating

"It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."
Ried is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Reply With Quote
Old 02-26-2008, 08:06 AM   #4 (permalink)
Registered User
 
Join Date: Feb 2008
Posts: 21
OS: xp,sp2


Re: malware/spyware xadbrk_.exe,trojandownloader.xs and more
how do i find out what username i have/?????
i can't seem to make it work
muistu is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Reply With Quote
Old 02-26-2008, 08:14 AM   #5 (permalink)
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
 
Ried's Avatar
 
Join Date: Jan 2005
Location: Ohio
Posts: 18,173
OS: WinXP and Win98se


Re: malware/spyware xadbrk_.exe,trojandownloader.xs and more
That's the beauty of that command--you don't need to know the username.

Simply copy/paste the command exactly as shown above. Make sure you also include that first quotation mark.
__________________

Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Keep this site free for all. Please consider, donating

"It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."
Ried is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Reply With Quote
Old 02-26-2008, 08:22 AM   #6 (permalink)
Registered User
 
Join Date: Feb 2008
Posts: 21
OS: xp,sp2


Re: malware/spyware xadbrk_.exe,trojandownloader.xs and more
here is the log
Deckard's System Scanner v20071014.68
Run by muistu on 2008-02-26 18:15:51
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Backed up registry hives.

Percentage of Memory in Use: 94% (more than 75%).
System Drive C: has 0.75 GiB (less than 15%) free.


-- HijackThis (run as muistu.exe) ----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:16:17 PM, on 2/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
d:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\mgmrwmrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
D:\Program Files\Steam\Steam.exe
D:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Documents and Settings\muistu.OPE\Desktop\Gattahack.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\muistu.OPE\desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\muistu.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ro/
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\mgmrwmrv.exe,
O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - (no file)
O2 - BHO: (no name) - {00000012-890e-4aac-afd9-eff6954a34dd} - (no file)
O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {06dfedaa-6196-11d5-bfc8-00508b4a487d} - (no file)
O2 - BHO: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file)
O2 - BHO: (no name) - {1adbcce8-cf84-441e-9b38-afc7a19c06a4} - (no file)
O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {944864a5-3916-46e2-96a9-a2e84f3f1208} - (no file)
O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {bb936323-19fa-4521-ba29-eca6a121bc78} - (no file)
O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
O2 - BHO: (no name) - {c5af2622-8c75-4dfb-9693-23ab7686a456} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Steam] "D:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t
O4 - HKUS\S-1-5-18\..\Run: [autoload] C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\cftmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [autoload] C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\cftmon.exe (User 'Default user')
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6082 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R2 MDC8021X (AEGIS Protocol (IEEE 802.1x) v2.3.1.9) - c:\windows\system32\drivers\mdc8021x.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 2.3.1.9>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

All services whitelisted.


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: ACPI\AWY0001\4&EDAA9BC&0
Manufacturer:
Name:
PNP Device ID: ACPI\AWY0001\4&EDAA9BC&0
Service:


-- Files created between 2008-01-26 and 2008-02-26 -----------------------------

2008-02-26 01:05:08 0 d-------- C:\Program Files\Trend Micro
2008-02-26 00:53:36 0 d-------- C:\WINDOWS\system32\ActiveScan
2008-02-25 21:50:49 0 d-------- C:\Program Files\Accoona
2008-02-25 21:50:48 0 d-------- C:\Program Files\3721
2008-02-25 20:55:29 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-02-25 20:24:37 0 d--h----- C:\WINDOWS\system32\GroupPolicy
2008-02-25 17:59:18 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\SITEguard
2008-02-25 17:53:04 0 d-------- C:\Program Files\Common Files\iS3
2008-02-25 17:53:04 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\STOPzilla!
2008-02-25 17:42:28 30464 --a------ C:\WINDOWS\eventlowg.dll
2008-02-25 17:42:28 26880 --a------ C:\WINDOWS\daxtime.dll
2008-02-25 17:42:27 31232 --a------ C:\WINDOWS\xadbrk.dll
2008-02-25 17:42:27 12800 --a------ C:\WINDOWS\system32\msole32.exe
2008-02-25 17:42:27 11264 --a------ C:\WINDOWS\liqui-Uninstaller.exe
2008-02-25 17:42:27 15872 --a------ C:\WINDOWS\liqui.exe
2008-02-25 17:42:27 19456 --a------ C:\WINDOWS\liqui.dll
2008-02-25 17:42:27 11008 --a------ C:\WINDOWS\fhfmm-Uninstaller.exe
2008-02-25 17:42:27 28928 --a------ C:\WINDOWS\fhfmm.exe
2008-02-25 17:42:26 11008 --a------ C:\WINDOWS\xadbrk_.exe
2008-02-25 17:42:26 24320 --a------ C:\WINDOWS\xadbrk.exe
2008-02-25 17:42:26 26624 --a------ C:\WINDOWS\liqad.exe
2008-02-25 17:42:26 15104 --a------ C:\WINDOWS\liqad.dll
2008-02-25 17:42:26 20480 --a------ C:\WINDOWS\kkcomp.exe
2008-02-25 17:42:26 9472 --a------ C:\WINDOWS\kkcomp.dll
2008-02-25 17:42:26 24064 --a------ C:\WINDOWS\kkcomp$.exe
2008-02-25 17:42:25 22016 --a------ C:\WINDOWS\settn.dll
2008-02-25 17:42:25 12544 --a------ C:\WINDOWS\liqad$.exe
2008-02-25 17:42:25 18944 --a------ C:\WINDOWS\kvnab.exe
2008-02-25 17:42:25 26624 --a------ C:\WINDOWS\kvnab.dll
2008-02-25 17:42:25 24320 --a------ C:\WINDOWS\kvnab$.exe
2008-02-25 17:42:25 17152 --a------ C:\WINDOWS\hcwprn.exe
2008-02-25 17:42:25 24064 --a------ C:\WINDOWS\cbinst$.exe
2008-02-25 17:42:24 19712 --a------ C:\WINDOWS\wbeInst$.exe
2008-02-25 17:42:24 15872 --a------ C:\WINDOWS\wbeCheck.exe
2008-02-25 17:42:24 16384 --a------ C:\WINDOWS\pbsysie.dll
2008-02-25 17:42:24 28928 --a------ C:\WINDOWS\jd2002.dll
2008-02-25 17:42:24 26624 --a------ C:\WINDOWS\iexplorr23.dll
2008-02-25 17:42:24 16896 --a------ C:\WINDOWS\adbar.dll
2008-02-25 17:42:23 18944 --a------ C:\WINDOWS\system32\ESHOPEE.exe
2008-02-25 17:42:23 29184 --a------ C:\WINDOWS\spredirect.dll
2008-02-25 17:42:23 0 d-------- C:\Program Files\e-zshopper
2008-02-25 17:42:21 0 d-------- C:\Program Files\amsys
2008-02-25 17:42:20 0 d-------- C:\WINDOWS\system32\acespy
2008-02-25 17:42:20 11776 --a------ C:\WINDOWS\system32\ace16win.dll
2008-02-25 17:42:20 19456 --a------ C:\WINDOWS\ie_32.exe
2008-02-25 17:42:20 15872 --a------ C:\WINDOWS\aconti.exe
2008-02-25 17:42:19 14592 --a------ C:\WINDOWS\xxxvideo.exe
2008-02-25 17:42:19 28160 --a------ C:\WINDOWS\ngd.dll
2008-02-25 17:42:19 9216 --a------ C:\WINDOWS\hotporn.exe
2008-02-25 17:42:19 11776 --a------ C:\WINDOWS\dp0.dll
2008-02-25 17:42:19 0 d-------- C:\Program Files\p2pnetworks
2008-02-25 17:42:17 0 d-------- C:\Program Files\akl
2008-02-25 17:42:16 30464 --a------ C:\WINDOWS\wml.exe
2008-02-25 17:42:16 15360 --a------ C:\WINDOWS\vxddsk.exe
2008-02-25 17:42:16 23296 --a------ C:\WINDOWS\system32\wml.exe
2008-02-25 17:42:16 12288 --a------ C:\WINDOWS\system32\vxddsk.exe
2008-02-25 17:42:15 17920 --a------ C:\WINDOWS\pbar.dll
2008-02-25 17:42:15 9216 --a------ C:\WINDOWS\flt.dll
2008-02-25 17:42:15 11008 --a------ C:\WINDOWS\7search.dll
2008-02-25 17:42:15 16896 --a------ C:\WINDOWS\764.exe
2008-02-25 17:27:11 4 --a------ C:\WINDOWS\system32\winfrun32.bin
2008-02-25 17:27:05 89107 --a------ C:\WINDOWS\system32\mgmrwmrv.exe <Not Verified; Microsoft; runbll>
2008-02-23 23:38:09 0 d-------- C:\Documents and Settings\muistu.OPE\Application Data\BitTorrent
2008-02-23 23:38:02 0 d-------- C:\Program Files\DNA
2008-02-23 23:38:02 0 d-------- C:\Documents and Settings\muistu.OPE\Application Data\DNA
2008-02-23 23:27:43 1158 --a------ C:\WINDOWS\mozver.dat
2008-02-23 20:27:33 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-23 20:27:31 0 d-------- C:\Documents and Settings\muistu.OPE\Application Data\Mozilla
2008-02-20 11:07:21 23 --a------ C:\WINDOWS\popcinfot.dat
2008-02-14 21:05:40 0 d-------- C:\Program Files\Unity
2008-02-13 18:05:31 0 --a------ C:\WINDOWS\PowerReg.dat
2008-02-13 02:07:46 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft Help
2008-02-13 02:07:19 0 dr-h----- C:\MSOCache
2008-02-13 01:43:17 0 d-------- C:\Documents and Settings\muistu.OPE\Application Data\Sun
2008-02-12 20:10:42 0 d-------- C:\Documents and Settings\muistu.OPE\Application Data\DAEMON Tools
2008-02-12 20:08:20 716272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-12 03:01:56 0 d-------- C:\Documents and Settings\muistu.OPE\Application Data\WinRAR
2008-02-07 21:29:12 0 d---s---- C:\Documents and Settings\muistu.OPE\UserData
2008-02-07 1826 0 d-------- C:\Program Files\uTorrent
2008-02-07 1821 0 d-------- C:\Documents and Settings\muistu.OPE\Application Data\uTorrent
2008-02-07 17:37:23 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Adobe
2008-02-07 17:11:23 0 d-------- C:\Documents and Settings\muistu.OPE\Application Data\Yahoo!
2008-02-07 17:11:23 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo! Companion
2008-02-07 17:09:49 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo!
2008-02-07 06:23:37 40960 -r------- C:\WINDOWS\system32\ChCfg.exe
2008-02-07 06:21:52 487424 -r------- C:\WINDOWS\RtlExUpd.dll <Not Verified; Realtek Semiconductor Corp.; RtlExUpd Dynamic Link Library>
2008-02-07 06:16:14 5824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2008-02-07 06:07:58 15781 --a------ C:\WINDOWS\system32\drivers\mdc8021x.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 2.3.1.9>
2008-02-07 06:00:38 1626112 --a------ C:\WINDOWS\system32\nwiz.exe
2008-02-07 06:00:37 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2008-02-07 06:00:36 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2008-02-07 06:00:36 929744 --a------ C:\WINDOWS\system32\nvucode.bin
2008-02-07 06:00:36 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2008-02-07 06:00:35 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll
2008-02-07 06:00:34 1474560 --a------ C:\WINDOWS\system32\nview.dll
2008-02-07 06:00:34 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2008-02-07 06:00:29 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2008-02-07 06:00:21 425984 --a------ C:\WINDOWS\system32\keystone.exe
2008-02-07 06:00:12 0 d-------- C:\WINDOWS\system32\WinFast
2008-02-07 05:51:08 0 d-------- C:\Documents and Settings\muistu.OPE\Application Data\Identities
2008-02-07 05:50:49 0 d--h----- C:\Documents and Settings\muistu.OPE\Templates
2008-02-07 05:50:49 0 dr------- C:\Documents and Settings\muistu.OPE\Start Menu
2008-02-07 05:50:49 0 dr-h----- C:\Documents and Settings\muistu.OPE\SendTo
2008-02-07 05:50:49 0 dr-h----- C:\Documents and Settings\muistu.OPE\Recent
2008-02-07 05:50:49 0 d--h----- C:\Documents and Settings\muistu.OPE\PrintHood
2008-02-07 05:50:49 0 d--h----- C:\Documents and Settings\muistu.OPE\NetHood
2008-02-07 05:50:49 0 dr------- C:\Documents and Settings\muistu.OPE\My Documents
2008-02-07 05:50:49 0 d--h----- C:\Documents and Settings\muistu.OPE\Local Settings
2008-02-07 05:50:49 0 dr------- C:\Documents and Settings\muistu.OPE\Favorites
2008-02-07 05:50:49 0 d-------- C:\Documents and Settings\muistu.OPE\Desktop
2008-02-07 05:50:49 0 d---s---- C:\Documents and Settings\muistu.OPE\Cookies
2008-02-07 05:50:49 0 dr-h----- C:\Documents and Settings\muistu.OPE\Application Data
2008-02-07 05:50:48 2359296 --ah----- C:\Documents and Settings\muistu.OPE\NTUSER.DAT
2008-02-07 05:49:59 262144 --ah----- C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT
2008-02-07 05:49:59 0 d--h----- C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings
2008-02-07 05:49:59 0 d---s---- C:\Documents and Settings\LocalService.NT AUTHORITY\Cookies
2008-02-07 05:49:59 0 d-------- C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data
2008-02-07 05:49:59 0 d---s---- C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\Microsoft
2008-02-07 05:49:42 262144 --ah----- C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT
2008-02-07 05:49:42 0 d--h----- C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings
2008-02-07 05:49:42 0 d---s---- C:\Documents and Settings\NetworkService.NT AUTHORITY\Cookies
2008-02-07 05:49:42 0 d-------- C:\Documents and Settings\NetworkService.NT AUTHORITY\Application Data
2008-02-07 05:49:42 0 d---s---- C:\Documents and Settings\NetworkService.NT AUTHORITY\Application Data\Microsoft
2008-02-07 05:46:15 225280 ---h----- C:\Documents and Settings\Default User.WINDOWS\NTUSER.DAT
2008-02-07 05:45:03 0 d--hs---- C:\Documents and Settings\All Users.WINDOWS\DRM
2008-02-07 05:43:50 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-02-06 21:33:34 0 d--h----- C:\Documents and Settings\All Users.WINDOWS\Templates
2008-02-06 21:33:34 0 dr------- C:\Documents and Settings\All Users.WINDOWS\Start Menu
2008-02-06 21:33:34 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Favorites
2008-02-06 21:33:34 0 dr------- C:\Documents and Settings\All Users.WINDOWS\Documents
2008-02-06 21:33:34 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Desktop
2008-02-06 21:33:33 0 d--h----- C:\Documents and Settings\Default User.WINDOWS\Templates
2008-02-06 21:33:33 0 dr------- C:\Documents and Settings\Default User.WINDOWS\Start Menu
2008-02-06 21:33:33 0 dr-h----- C:\Documents and Settings\Default User.WINDOWS\SendTo
2008-02-06 21:33:33 0 d--h----- C:\Documents and Settings\Default User.WINDOWS\Recent
2008-02-06 21:33:33 0 d--h----- C:\Documents and Settings\Default User.WINDOWS\PrintHood
2008-02-06 21:33:33 0 d--h----- C:\Documents and Settings\Default User.WINDOWS\NetHood
2008-02-06 21:33:33 0 d-------- C:\Documents and Settings\Default User.WINDOWS\My Documents
2008-02-06 21:33:33 0 dr-h----- C:\Documents and Settings\Default User.WINDOWS\Local Settings
2008-02-06 21:33:33 0 d-------- C:\Documents and Settings\Default User.WINDOWS\Favorites
2008-02-06 21:33:33 0 d-------- C:\Documents and Settings\Default User.WINDOWS\Desktop
2008-02-06 21:33:33 0 d---s---- C:\Documents and Settings\Default User.WINDOWS\Cookies
2008-02-06 21:32:29 0 dr-h----- C:\Documents and Settings\Default User.WINDOWS\Application Data
2008-02-06 21:32:29 0 d---s---- C:\Documents and Settings\Default User.WINDOWS\Application Data\Microsoft
2008-02-06 21:32:28 0 dr-h----- C:\Documents and Settings\All Users.WINDOWS\Application Data
2008-02-06 21:32:28 0 d---s---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft
2008-02-06 21:13:31 0 d-------- C:\Documents and Settings\muistu.OPE\Application Data\vlc
2008-02-06 20:36:02 0 d-------- C:\Documents and Settings\muistu.OPE\Application Data\Macromedia
2008-02-06 20:36:01 0 d-------- C:\Documents and Settings\muistu.OPE\Application Data\Adobe
2008-02-06 20:27:36 0 d-------- C:\WINDOWS\system32\SoftwareDistribution
2008-02-06 19:22:08 12400 --a------ C:\WINDOWS\system32\drivers\secdrv.sys <Not Verified; Macrovision Europe Ltd; Security Windows NT>
2008-02-06 18:49:01 0 d-------- C:\WINDOWS\setup.pss
2008-02-06 17:51:25 0 d-------- C:\WINDOWS\system32\WinFox
2008-02-06 17:28:50 0 d-------- C:\WINDOWS\pss
2008-02-05 20:07:12 0 d-------- C:\Program Files\Creative
2008-02-05 19:52:29 0 d-------- C:\Program Files\SystemRequirementsLab
2008-01-27 02:05:56 0 d-------- C:\Documents and Settings\muistu\Application Data\mIRC


-- Find3M Report ---------------------------------------------------------------

2008-02-25 20:53:26 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-25 17:53:04 0 d-------- C:\Program Files\Common Files
2008-02-24 1112 0 d-------- C:\Program Files\BFG
2008-02-23 23:43:37 0 d-------- C:\Program Files\Java
2008-02-19 03:23:25 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-02-13 02:13:46 0 d-------- C:\Program Files\Microsoft Works
2008-02-07 17:09:38 0 d-------- C:\Program Files\Yahoo!
2008-02-07 05:43:18 0 d-------- C:\Program Files\Messenger
2008-02-06 21:33:33 62 --ahs---- C:\Documents and Settings\muistu.OPE\Application Data\desktop.ini
2008-02-06 20:31:40 0 d-------- C:\Program Files\ASUS
2008-02-06 17:51:21 0 d-------- C:\Program Files\Common Files\InstallShield
2008-01-23 21:38:41 0 d-------- C:\Program Files\QuickTime
2008-01-23 04:17:34 0 d-------- C:\Program Files\Google
2008-01-16 18:48:47 0 d-------- C:\Program Files\Common Files\ButterflyVista
2007-12-28 04:49:18 0 d-------- C:\Program Files\MSECache
2007-12-28 00:15:46 0 d-------- C:\Program Files\Apple Software Update
2007-12-27 06:45:54 0 d-------- C:\Program Files\Webteh
2007-12-26 02:44:27 0 d-------- C:\Program Files\AGEIA Technologies


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000000-d9e3-4bc6-a0bd-3d0ca4be5271}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000012-890e-4aac-afd9-eff6954a34dd}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06dfedaa-6196-11d5-bfc8-00508b4a487d}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1adbcce8-cf84-441e-9b38-afc7a19c06a4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{51641ef3-8a7a-4d84-8659-b0911e947cc8}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53C330D6-A4AB-419B-B45D-FD4411C1FEF4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{669695bc-a811-4a9d-8cdf-ba8c795f261e}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{944864a5-3916-46e2-96a9-a2e84f3f1208}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b8875bfe-b021-11d4-bfa8-00508b8e9bd3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bb936323-19fa-4521-ba29-eca6a121bc78}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c5af2622-8c75-4dfb-9693-23ab7686a456}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ca1d1b05-9c66-11d5-a009-000103c1e50b}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9147a0a-a866-4214-b47c-da821891240f}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [04/13/2007 09:44 AM C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [04/04/2006 11:44 AM C:\WINDOWS\RTHDCPL.exe]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 07:51 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 01:11 AM]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [04/13/2007 09:44 AM]
"avast!"="d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [12/04/2007 03:00 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="D:\Program Files\Steam\Steam.exe" [02/06/2008 08:39 PM]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [08/30/2007 05:43 PM]
"DAEMON Tools Lite"="D:\Program Files\DAEMON Tools Lite\daemon.exe" [01/17/2008 06:51 PM]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [08/04/2004 01:06 AM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/03/2004 11:56 PM]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [10/26/2006 07:48 PM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"autoload"=C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\cftmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\mgmrwmrv.exe,"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background




-- End of Deckard's System Scanner: finished at 2008-02-26 18:21:23 ------------










and the extra log
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel(R) Pentium(R) 4 CPU 3.00GHz
CPU 1: Intel(R) Pentium(R) 4 CPU 3.00GHz
Percentage of Memory in Use: 87%
Physical Memory (total/avail): 1023.11 MiB / 124.96 MiB
Pagefile Memory (total/avail): 2461.31 MiB / 1478.14 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1913.26 MiB

A: is Removable (Unformatted)
C: is Fixed (NTFS) - 9.79 GiB total, 0.75 GiB free.
D: is Fixed (NTFS) - 139.25 GiB total, 17.38 GiB free.
E: is CDROM (No Media)
F: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - WDC WD1600AAJS-08PSA0 - 149.05 GiB - 2 partitions
\PARTITION0 (bootable) - Installable File System - 9.79 GiB - C:
\PARTITION1 - Extended w/Extended Int 13 - 139.25 GiB - D:



-- Security Center -------------------------------------------------------------

AUOptions is disabled.
Windows Internal Firewall is disabled.

FirstRunDisabled is set.

AV: avast! antivirus 4.7.1098 [VPS 080226-0] v4.7.1098 (ALWIL Software)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\\STHIW\\stInstall.exe"="E:\\STHIW\\stInstall.exe:*:Enabled:SpeedTouch Home Install Wizard"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent"
"D:\\Program Files\\Steam\\steamapps\\opemuistul\\team fortress 2\\hl2.exe"="D:\\Program Files\\Steam\\steamapps\\opemuistul\\team fortress 2\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Enabled:DNA"
"d:\\Program Files\\BitTorrent\\bittorrent.exe"="d:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users.WINDOWS
APPDATA=C:\Documents and Settings\muistu.OPE\Application Data
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=OPE
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\muistu.OPE
LOGONSERVER=\\OPE
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Intel\DMIX
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 6 Stepping 5, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0605
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\muistu.OPE\LOCALS~1\Temp
TMP=C:\DOCUME~1\muistu.OPE\LOCALS~1\Temp
USERDOMAIN=OPE
USERNAME=muistu
USERPROFILE=C:\Documents and Settings\muistu.OPE
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

muistu.OPE (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> MsiExec.exe /I{403EF592-953B-4794-BCEF-ECAB835C2095}
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
µTorrent --> "C:\Program Files\uTorrent\uTorrent.exe" /UNINSTALL
Ad-Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.2 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
AsusUpdate --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{587178E7-B1DF-494E-9838-FA4DD36E873C}\setup.exe" -l0x9
avast! Antivirus --> rundll32 d:\PROGRA~1\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup
BitTorrent 6.0 --> d:\Program Files\BitTorrent\uninst.exe
DNA --> "C:\Program Files\DNA\btdna.exe" /UNINSTALL
Half-Life 2: Episode One --> "D:\Program Files\Steam\steam.exe" steam://uninstall/380
Half-Life 2: Episode Two --> "D:\Program Files\Steam\steam.exe" steam://uninstall/420
Half-Life 2: Lost Coast --> "D:\Program Files\Steam\steam.exe" steam://uninstall/340
High Definition Audio Driver Package - KB888111 --> "C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Intel(R) PRO Network Connections --> MsiExec.exe /I{E6C48B74-26ED-4EF8-A04C-42AFDE5E1CA3}
Java(TM) 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Microsoft Office Excel MUI (English) 2007 --> MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Home and Student 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007 --> MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007 --> MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007 --> MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007 --> MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007 --> MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007 --> MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (2.0.0.12) --> d:\Program Files\Mozilla Firefox\uninstall\helper.exe
mpowerplayer --> C:\WINDOWS\system32\javaws.exe -uninstall -prompt "http://content.mplayit.com/client/player.jarjnlp"
Panda ActiveScan --> C:\WINDOWS\system32\ASUninst.exe Panda ActiveScan
Realtek High Definition Audio Driver --> RtlUpd.exe -r -m
Steam --> MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Team Fortress 2 --> "D:\Program Files\Steam\steam.exe" steam://uninstall/440
The Witcher --> "C:\Program Files\InstallShield Installation Information\{F138762F-5A1F-4CF0-A5E1-1588EF6088A4}\setup.exe" -runfromtemp -l0x0009 -removeonly
Unity Web Player --> C:\Program Files\Unity\WebPlayer\Uninstall.exe
VideoLAN VLC media player 0.8.6d --> d:\Program Files\VideoLAN\VLC\uninstall.exe
Warlords IV --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7B31DF8A-8B77-497F-8180-E710A01635F1}\Setup.exe" -l0x9
WinFast(R) Display Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F69FD33C-8815-46BF-9134-A643DE68F3C0}\setup.exe" -l0x9 -removeonly
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
Yahoo! Messenger --> C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
Yahoo! Toolbar --> C:\PROGRA~1\Yahoo!\Common\unyt.exe


-- End of Deckard's System Scanner: finished at 2008-02-26 18:21:23 ------------
muistu is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Reply With Quote
Old 02-26-2008, 08:32 AM   #7 (permalink)
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
 
Ried's Avatar
 
Join Date: Jan 2005
Location: Ohio
Posts: 18,173
OS: WinXP and Win98se


Re: malware/spyware xadbrk_.exe,trojandownloader.xs and more
Download Combofix from any of the links below, and save it to your desktop. For information regarding this download, please visit this webpage: http://www.bleepingcomputer.com/comb...o-use-combofix

Link 1
Link 2
Link 3


**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

--------------------------------------------------------------------

Click the Windows 'Start' button > Select 'Run' - then copy/paste this into the run box & click OK

"%userprofile%\desktop\combofix.exe" /killall

When finished, it shall produce a log for you. Post that log in your next reply.
__________________

Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Keep this site free for all. Please consider, donating

"It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."
Ried is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Reply With Quote
Old 02-26-2008, 09:25 AM   #8 (permalink)
Registered User
 
Join Date: Feb 2008
Posts: 21
OS: xp,sp2


Re: malware/spyware xadbrk_.exe,trojandownloader.xs and more
the scan is complete and i think it worked...
there are some errors that ocurred...
after combofix did his job greatly he got restarted, and at the login of windows it got me a error.
now when it is in windows i don`t have any start bar.
was kinda hard to get programs whit task manager, a the task manager works again.

anyway here is the log

ComboFix 08-02-25.3 - muistu 2008-02-26 19:11:06.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.771 [GMT 2:00]
Running from: C:\Documents and Settings\muistu.OPE\desktop\combofix.exe
Command switches used :: /killall
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\cftmon.exe
C:\Program Files\3721
C:\Program Files\3721\assist\asbar.dll
C:\Program Files\3721\helper.dll
C:\Program Files\Accoona
C:\Program Files\Accoona\ASearchAssist.dll
C:\Program Files\akl
C:\Program Files\akl\akl.dll
C:\Program Files\akl\akl.exe
C:\Program Files\akl\curlog.htm
C:\Program Files\akl\keylog.txt
C:\Program Files\akl\readme.txt
C:\Program Files\akl\uninstall.exe
C:\Program Files\akl\unsetup.dat
C:\Program Files\akl\unsetup.exe
C:\Program Files\amsys
C:\Program Files\amsys\awmsg.dat
C:\Program Files\amsys\guid.dat
C:\Program Files\amsys\ijl15.dll
C:\Program Files\amsys\mfc42.dll
C:\Program Files\amsys\msvcrt.dll
C:\Program Files\amsys\unins000.dat
C:\Program Files\amsys\unis000.exe
C:\Program Files\amsys\winam.dat
C:\Program Files\e-zshopper
C:\Program Files\e-zshopper\BarLcher.dll
C:\Program Files\p2pnetworks
C:\Program Files\p2pnetworks\amp2pl.exe
C:\WINDOWS\764.exe
C:\WINDOWS\7search.dll
C:\WINDOWS\absolute key logger.lnk
C:\WINDOWS\aconti.exe
C:\WINDOWS\aconti.ini
C:\WINDOWS\aconti.log
C:\WINDOWS\aconti.sdb
C:\WINDOWS\acontidialer.txt
C:\WINDOWS\adbar.dll
C:\WINDOWS\cbinst$.exe
C:\WINDOWS\daxtime.dll
C:\WINDOWS\default.htm
C:\WINDOWS\dp0.dll
C:\WINDOWS\eventlowg.dll
C:\WINDOWS\fhfmm-Uninstaller.exe
C:\WINDOWS\fhfmm.exe
C:\WINDOWS\flt.dll
C:\WINDOWS\hcwprn.exe
C:\WINDOWS\hotporn.exe
C:\WINDOWS\ie_32.exe
C:\WINDOWS\iexplorr23.dll
C:\WINDOWS\jd2002.dll
C:\WINDOWS\kkcomp$.exe
C:\WINDOWS\kkcomp.dll
C:\WINDOWS\kkcomp.exe
C:\WINDOWS\kvnab$.exe
C:\WINDOWS\kvnab.dll
C:\WINDOWS\kvnab.exe
C:\WINDOWS\liqad$.exe
C:\WINDOWS\liqad.dll
C:\WINDOWS\liqad.exe
C:\WINDOWS\liqui-Uninstaller.exe
C:\WINDOWS\liqui.dll
C:\WINDOWS\liqui.exe
C:\WINDOWS\ngd.dll
C:\WINDOWS\pbar.dll
C:\WINDOWS\pbsysie.dll
C:\WINDOWS\settn.dll
C:\WINDOWS\spredirect.dll
C:\WINDOWS\system32\ace16win.dll
C:\WINDOWS\system32\acespy
C:\WINDOWS\system32\acespy\__acelog.ndx
C:\WINDOWS\system32\acespy\systune.exe
C:\WINDOWS\system32\ESHOPEE.exe
C:\WINDOWS\system32\msole32.exe
C:\WINDOWS\system32\vxddsk.exe
C:\WINDOWS\system32\wml.exe
C:\WINDOWS\system32\wsnpoem
C:\WINDOWS\vxddsk.exe
C:\WINDOWS\wbeCheck.exe
C:\WINDOWS\wbeInst$.exe
C:\WINDOWS\wml.exe
C:\WINDOWS\xadbrk.dll
C:\WINDOWS\xadbrk.exe
C:\WINDOWS\xadbrk_.exe
C:\WINDOWS\xxxvideo.exe

.
((((((((((((((((((((((((( Files Created from 2008-01-26 to 2008-02-26 )))))))))))))))))))))))))))))))
.

2008-02-26 01:05 . 2008-02-26 01:05 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-26 01:02 . 2008-02-26 01:02 <DIR> d-------- C:\Deckard
2008-02-26 00:53 . 2008-02-26 01:06 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-02-26 00:53 . 2008-02-26 00:55 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-02-26 00:53 . 2008-02-26 00:55 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-02-26 00:53 . 2008-02-26 00:55 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-02-25 20:55 . 2008-02-25 20:56 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-02-25 20:24 . 2008-02-25 20:24 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-02-25 17:59 . 2008-02-25 17:59 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\SITEguard
2008-02-25 17:53 . 2008-02-25 17:53 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-02-25 17:53 . 2008-02-25 20:54 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\STOPzilla!
2008-02-25 17:27 . 2008-02-25 17:27 89,107 --a------ C:\WINDOWS\system32\mgmrwmrv.exe
2008-02-25 17:27 . 2008-02-25 17:27 4 --a------ C:\WINDOWS\system32\winfrun32.bin
2008-02-23 23:43 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-23 23:38 . 2008-02-24 11:07 <DIR> d-------- C:\Program Files\DNA
2008-02-23 23:38 . 2008-02-24 10:49 <DIR> d-------- C:\Documents and Settings\muistu.OPE\Application Data\DNA
2008-02-23 23:38 . 2008-02-23 23:38 <DIR> d-------- C:\Documents and Settings\muistu.OPE\Application Data\BitTorrent
2008-02-23 23:27 . 2008-02-23 23:27 1,158 --a------ C:\WINDOWS\mozver.dat
2008-02-23 20:27 . 2008-02-23 20:27 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-20 11:07 . 2008-02-20 11:50 23 --a------ C:\WINDOWS\popcinfot.dat
2008-02-18 20:23 . 2008-02-18 20:23 278,984 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-02-18 20:23 . 2008-02-18 20:23 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-02-14 21:05 . 2008-02-14 21:05 <DIR> d-------- C:\Program Files\Unity
2008-02-13 18:05 . 2008-02-13 18:05 0 --a------ C:\WINDOWS\PowerReg.dat
2008-02-13 02:15 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2008-02-13 02:07 . 2008-02-13 02:07 <DIR> dr-h----- C:\MSOCache
2008-02-13 02:07 . 2008-02-25 18:05 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft Help
2008-02-12 20:10 . 2008-02-12 20:10 <DIR> d-------- C:\Documents and Settings\muistu.OPE\Application Data\DAEMON Tools
2008-02-12 20:08 . 2008-02-12 20:08 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-07 21:29 . 2008-02-07 21:29 <DIR> d---s---- C:\Documents and Settings\muistu.OPE\UserData
2008-02-07 18:06 . 2008-02-25 21:22 <DIR> d-------- C:\Program Files\uTorrent
2008-02-07 18:06 . 2008-02-26 07:45 <DIR> d-------- C:\Documents and Settings\muistu.OPE\Application Data\uTorrent
2008-02-07 17:11 . 2008-02-07 17:11 <DIR> d-------- C:\Documents and Settings\muistu.OPE\Application Data\Yahoo!
2008-02-07 17:11 . 2008-02-07 17:11 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo! Companion
2008-02-07 17:09 . 2008-02-07 17:09 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo!
2008-02-07 06:26 . 2005-09-14 11:24 179,200 -ra------ C:\WINDOWS\system32\drivers\e1e5132.sys
2008-02-07 06:26 . 2005-07-06 10:12 163,840 -ra------ C:\WINDOWS\system32\e1000msg.dll
2008-02-07 06:26 . 2005-06-15 07:27 126,976 -ra------ C:\WINDOWS\system32\Prounstl.exe
2008-02-07 06:26 . 2005-05-19 01:28 21,504 -ra------ C:\WINDOWS\system32\NicIn32.dll
2008-02-07 06:26 . 2005-06-14 16:08 20,480 -ra------ C:\WINDOWS\system32\NicCo32.dll
2008-02-07 06:26 . 2005-06-23 04:59 17,408 -ra------ C:\WINDOWS\system32\EtCo32.dll
2008-02-07 06:26 . 2005-07-13 11:06 2,790 -ra------ C:\WINDOWS\system32\e1e5132.din
2008-02-07 06:26 . 2003-11-03 11:15 1,902 --------- C:\WINDOWS\system32\SetupBD.din
2008-02-07 06:25 . 2008-02-07 06:25 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-02-07 06:25 . 2008-02-07 06:25 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-02-07 06:25 . 2004-08-04 09:15 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2008-02-07 06:25 . 2004-08-04 09:15 82,944 --a--c--- C:\WINDOWS\system32\dllcache\wdmaud.sys
2008-02-07 06:25 . 2004-08-04 09:07 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2008-02-07 06:25 . 2004-08-04 09:07 6,400 --a--c--- C:\WINDOWS\system32\dllcache\splitter.sys
2008-02-07 06:24 . 2004-08-04 09:07 171,776 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2008-02-07 06:24 . 2004-08-04 08:39 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys
2008-02-07 06:24 . 2004-08-04 09:15 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2008-02-07 06:24 . 2001-08-18 00:00 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2008-02-07 06:24 . 2004-08-04 09:07 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2008-02-07 06:24 . 2004-08-04 09:07 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2008-02-07 06:22 . 2004-11-18 20:42 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-02-07 06:21 . 2005-04-16 16:20 487,424 -r------- C:\WINDOWS\RtlExUpd.dll
2008-02-07 06:16 . 2008-02-07 06:26 17,414 --a------ C:\WINDOWS\Ascd_tmp.ini
2008-02-07 06:16 . 2004-04-27 16:26 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2008-02-07 06:16 . 2004-08-13 12:56 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys
2008-02-07 06:07 . 2008-02-07 06:07 15,781 --a------ C:\WINDOWS\system32\drivers\mdc8021x.sys
2008-02-07 06:04 . 2007-04-13 09:44 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-02-07 06:04 . 2007-04-13 09:44 115,830 --a------ C:\WINDOWS\system32\nvapps.xml
2008-02-07 06:04 . 2007-04-13 09:44 17,177 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-02-07 05:49 . 2008-02-07 05:49 8,192 --a------ C:\WINDOWS\REGLOCS.OLD
2008-02-07 05:47 . 2001-08-23 14:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-02-07 05:46 . 2004-08-03 23:56 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-02-07 05:45 . 2008-02-07 05:45 <DIR> d--hs---- C:\Documents and Settings\All Users.WINDOWS\DRM
2008-02-07 05:45 . 2008-02-07 05:45 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2008-02-07 05:45 . 2008-02-07 05:45 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb
2008-02-07 05:45 . 2008-02-07 05:45 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb
2008-02-07 05:43 . 2004-08-03 23:56 1,352,192 --a--c--- C:\WINDOWS\system32\dllcache\cimwin32.dll
2008-02-06 21:36 . 2004-08-04 00:59 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-02-06 21:36 . 2001-08-17 15:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-02-06 21:35 . 2004-08-04 10:56 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2008-02-06 21:35 . 2004-08-04 10:56 74,240 --a--c--- C:\WINDOWS\system32\dllcache\usbui.dll
2008-02-06 21:33 . 2008-02-07 05:44 <DIR> dr------- C:\Documents and Settings\All Users.WINDOWS\Documents
2008-02-06 21:32 . 2004-08-04 00:58 2,012,670 --a--c--- C:\WINDOWS\system32\dllcache\NT5.CAT
2008-02-06 21:30 . 2008-02-07 05:48 642 --a------ C:\WINDOWS\system32\$winnt$.inf
2008-02-06 21:13 . 2008-02-06 21:13 <DIR> d-------- C:\Documents and Settings\muistu.OPE\Application Data\vlc
2008-02-06 20:29 . 2005-10-28 10:11 27,648 -ra------ C:\WINDOWS\system32\drivers\iteatapi.sys
2008-02-06 20:28 . 2008-02-06 20:28 <DIR> d-------- C:\Documents and Settings\muistu~OPE\LOCALS~1
2008-02-06 19:21 . 2001-08-23 14:00 13,107,200 --a------ C:\WINDOWS\system32\oembios.bin
2008-02-06 19:20 . 2004-08-03 23:56 2,067,968 --a--c--- C:\WINDOWS\system32\dllcache\cdosys.dll
2008-02-06 17:51 . 2008-02-06 17:51 <DIR> d-------- C:\WINDOWS\system32\WinFox
2008-02-05 20:07 . 2008-02-05 20:07 <DIR> d-------- C:\Program Files\Creative
2008-02-05 19:52 . 2008-02-05 19:52 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-01-27 02:05 . 2008-01-27 02:20 <DIR> d-------- C:\Documents and Settings\muistu\Application Data\mIRC

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-25 18:53 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-24 09:06 --------- d-----w C:\Program Files\BFG
2008-02-23 21:43 --------- d-----w C:\Program Files\Java
2008-02-19 01:23 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-13 00:13 --------- d-----w C:\Program Files\Microsoft Works
2008-02-12 18:16 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2008-02-07 15:09 --------- d-----w C:\Program Files\Yahoo!
2008-02-06 18:31 --------- d-----w C:\Program Files\ASUS
2008-02-06 15:51 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-06 15:48 --------- d-----w C:\Documents and Settings\muistu\Application Data\BitTorrent
2008-01-23 19:38 --------- d-----w C:\Program Files\QuickTime
2008-01-23 02:17 --------- d-----w C:\Program Files\Google
2008-01-16 16:48 --------- d-----w C:\Program Files\Common Files\ButterflyVista
2008-01-15 16:55 --------- d-----w C:\Documents and Settings\muistu\Application Data\teamspeak2
2008-01-14 17:04 --------- d-----w C:\Documents and Settings\muistu\Application Data\Babylon
2008-01-08 04:28 --------- d-----w C:\Documents and Settings\muistu\Application Data\InstallShield Installation Information
2008-01-05 04:53 --------- d-----w C:\Documents and Settings\muistu\Application Data\CoreFTP
2007-12-29 23:08 --------- d-----w C:\Documents and Settings\muistu\Application Data\Apple Computer
2007-12-28 02:49 --------- d-----w C:\Program Files\MSECache
2007-12-27 22:15 --------- d-----w C:\Program Files\Apple Software Update
2007-12-27 14:44 --------- d-----w C:\Documents and Settings\muistu\Application Data\DivX
2007-12-27 04:45 --------- d-----w C:\Program Files\Webteh
2007-12-27 01:01 --------- d-----w C:\Documents and Settings\muistu\Application Data\WordWeb
2007-12-26 15:58 --------- d-----w C:\Documents and Settings\muistu\Application Data\InstallShield
2007-12-26 00:44 --------- d-----w C:\Program Files\AGEIA Technologies
2007-12-14 09:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr