|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
Thread Tools |
06-27-2008, 06:59 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 2
OS: Windows XP SP3
|
IExplore.exe connecting to a remote site in the background
Hi guys, I have a tricky situation here. I know that I have been infected with some type of virus. Here is some background info:
I did a fresh install of Windows XP and loaded all my drivers and windows updates. I loaded Mcafee and everything seemed to work fine so I continued to load my software. All of the sudden Mcaffee detected a virus in explorer.exe (generic loader or something, I couldn't get more details) and said it cleaned it. After my computer restarted, it acted very strangely. My theme was gone (the default blue xp theme). None of my applications could connect to the internet. If I tried to open Mcafee, it would just close itself. I opened msconfig, and when I went to uncheck startup items, it told me that I didn't have sufficent privileges. So I did a clean format and installed windows again. This time, everything seemed to fine. I installed NOD32 and did a full system scan to find nothing. I installed and updated Spybot and Adaware, and came up with nothing. But I noticed something strange. My firewall utility showed an outgoing connect to 90.210.240.183 on port 65001 under IExpore.exe. Now I don't use internet explorer so I thought this to be weird. When I end task the process, it kept coming back. I restarted and it does not seem to be showing up anymore. Please help me find the culprit! This is a work machine and I've been down now for days! I have attached my all my logs. Deckard's System Scanner v20071014.68 Run by kLAcK on 2008-06-27 17:51:23 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 22: 2008-06-28 00:51:28 UTC - RP22 - Deckard's System Scanner Restore Point 21: 2008-06-28 00:43:21 UTC - RP21 - Software Distribution Service 3.0 20: 2008-06-27 23:51:08 UTC - RP20 - Installed Ad-Aware 19: 2008-06-27 23:21:30 UTC - RP19 - ComboFix created restore point 18: 2008-06-27 22:57:13 UTC - RP18 - Installed ASUS Gamer OSD -- First Restore Point -- 1: 2008-06-27 20:33:16 UTC - RP1 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as kLAcK.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:52:16 PM, on 6/27/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe D:\MSSQL$BALLISTIC\Binn\sqlservr.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\ASUS\GamerOSD\GamerOSD.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\msiexec.exe C:\Documents and Settings\kLAcK\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\kLAcK.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [Application Layer Gateway Service] C:\WINDOWS\system32:Applic32.exe O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe -- End of file - 4516 bytes -- File Associations ----------------------------------------------------------- .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%* .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 Vax347b - c:\windows\system32\drivers\vax347b.sys R0 Vax347s - c:\windows\system32\drivers\vax347s.sys R1 asuskbnt (Enhanced Display Driver Helper Service) - c:\windows\system32\drivers\atkkbnt.sys <Not Verified; ASUSTeK COMPUTER INC.; ASUS Help driver For Keyboard Service.> R3 asusgsb (ASUS Virtual Video Capture Device Driver) - c:\windows\system32\drivers\asusgsb.sys <Not Verified; ASUSTeK Computer Inc.; ASUS Virtual Video Capture Device Driver> R3 Video3D (ASUS Video3D Service) - c:\windows\system32\drivers\video3d32.sys <Not Verified; ASUSTeK COMPUTER INC.; ASUS Video3D driver> S3 catchme - c:\combofix\catchme.sys (file missing) S3 VIAudio (VIA AC'97 Audio Controller (WDM)) - c:\windows\system32\drivers\viaudios.sys (file missing) S3 Vsp - c:\windows\system32\drivers\vsp.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 ATKKeyboardService (ATK Keyboard Service) - c:\windows\atkkbservice.exe <Not Verified; ASUSTeK COMPUTER INC.; ASUS Keyboard Service> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Microsoft® Keyboard with Fingerprint Reader Device ID: USB\VID_045E&PID_00BB&MI_02\6&16AF9BB5&0&0002 Manufacturer: Name: Microsoft® Keyboard with Fingerprint Reader PNP Device ID: USB\VID_045E&PID_00BB&MI_02\6&16AF9BB5&0&0002 Service: Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: MF5770 Device ID: USB\VID_04A9&PID_265F&MI_00\6&1CFD44C5&0&0000 Manufacturer: Name: MF5770 PNP Device ID: USB\VID_04A9&PID_265F&MI_00\6&1CFD44C5&0&0000 Service: -- Files created between 2008-05-27 and 2008-06-27 ----------------------------- 2008-06-27 17:52:09 0 d-------- C:\Program Files\Trend Micro 2008-06-27 17:47:42 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-27 17:47:11 0 d-------- C:\Program Files\SpywareBlaster 2008-06-27 17  05 0 d-------- C:\Program Files\Panda Security2008-06-27 16:51:09 0 d-------- C:\Program Files\Lavasoft 2008-06-27 16:51:08 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-27 16:47:31 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-27 16:25:50 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-27 16:21:09 68096 --a------ C:\WINDOWS\zip.exe 2008-06-27 16:21:09 49152 --a------ C:\WINDOWS\VFind.exe 2008-06-27 16:21:09 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-06-27 16:21:09 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-06-27 16:21:09 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-06-27 16:21:09 98816 --a------ C:\WINDOWS\sed.exe 2008-06-27 16:21:09 80412 --a------ C:\WINDOWS\grep.exe 2008-06-27 16:21:09 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-06-27 16:02:21 0 d-------- C:\WINDOWS\pss 2008-06-27 15:57:18 0 d-------- C:\Documents and Settings\kLAcK\Application Data\ATI 2008-06-27 15:57:18 0 d-------- C:\Documents and Settings\All Users\Application Data\ATI 2008-06-27 15:57:17 262144 --a------ C:\WINDOWS\ATKKBService.exe <Not Verified; ASUSTeK COMPUTER INC.; ASUS Keyboard Service> 2008-06-27 15:57:16 10752 --a------ C:\WINDOWS\system32\drivers\Video3D32.sys <Not Verified; ASUSTeK COMPUTER INC.; ASUS Video3D driver> 2008-06-27 15:57:16 196608 --a------ C:\WINDOWS\system32\drivers\nVivid.bin 2008-06-27 15:57:16 196608 --a------ C:\WINDOWS\system32\drivers\nStandard.bin 2008-06-27 15:57:16 196608 --a------ C:\WINDOWS\system32\drivers\nAsmedia.bin 2008-06-27 15:57:16 196608 --a------ C:\WINDOWS\system32\drivers\nAdvanced.bin 2008-06-27 15:57:16 8704 --a------ C:\WINDOWS\system32\drivers\Bravo.sys <Not Verified; ASMT; Microsoft(R) Windows NT(R) Operating System> 2008-06-27 15:57:16 196653 --a------ C:\WINDOWS\system32\drivers\aVivid.bin 2008-06-27 15:57:16 11136 --a------ C:\WINDOWS\system32\drivers\atkkbnt.sys <Not Verified; ASUSTeK COMPUTER INC.; ASUS Help driver For Keyboard Service.> 2008-06-27 15:57:16 196582 --a------ C:\WINDOWS\system32\drivers\aStandard.bin 2008-06-27 15:57:16 196582 --a------ C:\WINDOWS\system32\drivers\aAsmedia.bin 2008-06-27 15:57:16 196608 --a------ C:\WINDOWS\system32\drivers\aAdvanced.bin 2008-06-27 15:57:16 11264 --a------ C:\WINDOWS\system32\ATKOSDMini.DLL <Not Verified; ASUSTeK Computer Inc.; > 2008-06-27 15:57:16 2093056 --a------ C:\WINDOWS\system32\ATKDispCPL.dll <Not Verified; ASUSTeK COMPUTER INC.; ASUS Display Property Page> 2008-06-27 15:57:16 242816 --a------ C:\WINDOWS\system32\ATKDISP.dll <Not Verified; ASUSTeK Computer Inc.; ASUS Windows 2000/XP Display Driver> 2008-06-27 15:57:16 0 d-------- C:\Program Files\ASUS 2008-06-27 15:57:14 180224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2008-06-27 15:57:14 761856 --a------ C:\WINDOWS\system32\xvidcore.dll 2008-06-27 15:57:14 12416 --a------ C:\WINDOWS\system32\drivers\asusgsb.sys <Not Verified; ASUSTeK Computer Inc.; ASUS Virtual Video Capture Device Driver> 2008-06-27 15:57:14 77312 --a------ C:\WINDOWS\system32\devcon.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-06-27 15:57:14 5424640 --a------ C:\WINDOWS\system32\ATKOSDX32.dll <Not Verified; ASUSTeK COMPUTER INC.; ASUS On-Screen Display For 3D Game> 2008-06-27 15:57:14 36352 --a------ C:\WINDOWS\system32\ATKOGL32.dll <Not Verified; ASUSTeK COMPUTER INC.; ASUSTeK Computer Inc. AsusOGL> 2008-06-27 15:57:14 12416 --a------ C:\WINDOWS\system32\asusgsb.sys <Not Verified; ASUSTeK Computer Inc.; ASUS Virtual Video Capture Device Driver> 2008-06-27 15:57:14 46080 --a------ C:\WINDOWS\system32\asrussian.dll 2008-06-27 15:57:14 45568 --a------ C:\WINDOWS\system32\askorean.dll 2008-06-27 15:57:14 45568 --a------ C:\WINDOWS\system32\asjapan.dll 2008-06-27 15:57:14 46080 --a------ C:\WINDOWS\system32\asgerman.dll 2008-06-27 15:57:14 46592 --a------ C:\WINDOWS\system32\asfrench.dll 2008-06-27 15:57:14 46080 --a------ C:\WINDOWS\system32\aseng.dll 2008-06-27 15:57:14 45568 --a------ C:\WINDOWS\system32\ASCHT.dll 2008-06-27 15:57:14 45568 --a------ C:\WINDOWS\system32\aschs.dll 2008-06-27 15:43:26 0 d-------- C:\Program Files\Windows Media Connect 2 2008-06-27 15:42:22 0 d-------- C:\WINDOWS\system32\drivers\UMDF 2008-06-27 15:39:31 0 d-------- C:\WINDOWS\system32\URTTemp 2008-06-27 15:36:33 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage 2008-06-27 15:34:23 0 --a------ C:\WINDOWS\ativpsrm.bin 2008-06-27 15:31:37 0 d-------- C:\Program Files\ATI Technologies 2008-06-27 15:00:22 0 d-------- C:\Program Files\AMD 2008-06-27 14:55:25 0 d-------- C:\Program Files\Microsoft Works 2008-06-27 14:55:18 0 d-------- C:\Program Files\MSBuild 2008-06-27 14:52:53 49152 -ra------ C:\WINDOWS\system32\ChCfg.exe 2008-06-27 14:52:26 0 d-------- C:\Program Files\Realtek Sound Manager 2008-06-27 14:52:25 0 d-------- C:\Program Files\AvRack 2008-06-27 14:52:07 0 d-------- C:\Program Files\Realtek AC97 2008-06-27 14:52:00 0 d-------- C:\WINDOWS\SHELLNEW 2008-06-27 14:51:57 315392 -ra------ C:\WINDOWS\alcupd.exe <Not Verified; Realtek Semiconductor Corp.; Realtek AC'97 Update driver Tool> 2008-06-27 14:51:31 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-06-27 14:51:16 0 dr-h----- C:\MSOCache 2008-06-27 14:49:27 0 d-------- C:\Documents and Settings\kLAcK\Application Data\WinRAR 2008-06-27 14:48:40 192569 --a------ C:\WINDOWS\system32\msrpjt40.dll <Not Verified; Microsoft Corporation; Microsoft (R) Jet> 2008-06-27 14:48:35 36939 --a------ C:\WINDOWS\system32\insrepim.exe <Not Verified; ; Repository SDK> 2008-06-27 14:48:21 81920 --a------ C:\WINDOWS\system32\mdt2fw95.dll <Not Verified; Microsoft Corporation; Microsoft Design Tools> 2008-06-27 14:47:35 0 d-------- C:\Program Files\Microsoft SQL Server 2008-06-27 14:39:55 5248 --a------ C:\WINDOWS\system32\drivers\Vax347s.sys 2008-06-27 14:39:55 159616 --a------ C:\WINDOWS\system32\drivers\Vax347b.sys 2008-06-27 14:39:49 0 d-------- C:\Program Files\Alcohol Soft 2008-06-27 14:39:21 0 d-------- C:\WINDOWS\WinRAR 2008-06-27 14:34:59 0 d-------- C:\Program Files\VIA Technologies, Inc 2008-06-27 14:10:39 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-06-27 14:10:26 0 d------c- C:\WINDOWS\system32\DRVSTORE 2008-06-27 14:10:10 0 d-------- C:\WINDOWS\system32\ReinstallBackups 2008-06-27 14:09:26 0 d-------- C:\Program Files\VIA 2008-06-27 14:09:22 0 d-------- C:\Program Files\Common Files\InstallShield 2008-06-27 13:57:31 0 d-------- C:\Program Files\MSI 2008-06-27 13:56:46 0 d-------- C:\Program Files\Setup Files 2008-06-27 13:55:19 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller> 2008-06-27 13:53:30 0 --a------ C:\WINDOWS\nsreg.dat 2008-06-27 13:53:27 0 d-------- C:\Documents and Settings\kLAcK\Application Data\Mozilla 2008-06-27 13:45:15 0 d---s---- C:\Documents and Settings\kLAcK\UserData 2008-06-27 13:44:56 0 d-------- C:\WINDOWS\system32\PreInstall 2008-06-27 13:44:54 0 d--h----- C:\WINDOWS\$hf_mig$ 2008-06-27 13:38:31 0 d-------- C:\Documents and Settings\kLAcK\Application Data\ESET 2008-06-27 13:38:23 0 d-------- C:\WINDOWS\system32\LogFiles 2008-06-27 13:37:56 0 d-------- C:\Documents and Settings\All Users\Application Data\ESET 2008-06-27 13:33:08 0 d-------- C:\Documents and Settings\kLAcK\Application Data\Identities 2008-06-27 13:33:03 0 d--h----- C:\Documents and Settings\kLAcK\Templates 2008-06-27 13:33:03 0 dr------- C:\Documents and Settings\kLAcK\Start Menu 2008-06-27 13:33:03 0 dr-h----- C:\Documents and Settings\kLAcK\SendTo 2008-06-27 13:33:03 0 dr-h----- C:\Documents and Settings\kLAcK\Recent 2008-06-27 13:33:03 0 d--h----- C:\Documents and Settings\kLAcK\PrintHood 2008-06-27 13:33:03 1572864 --ah----- C:\Documents and Settings\kLAcK\NTUSER.DAT 2008-06-27 13:33:03 0 d--h----- C:\Documents and Settings\kLAcK\NetHood 2008-06-27 13:33:03 0 dr------- C:\Documents and Settings\kLAcK\My Documents 2008-06-27 13:33:03 0 d--h----- C:\Documents and Settings\kLAcK\Local Settings 2008-06-27 13:33:03 0 dr------- C:\Documents and Settings\kLAcK\Favorites 2008-06-27 13:33:03 0 d-------- C:\Documents and Settings\kLAcK\Desktop 2008-06-27 13:33:03 0 d---s---- C:\Documents and Settings\kLAcK\Cookies 2008-06-27 13:33:03 0 dr-h----- C:\Documents and Settings\kLAcK\Application Data 2008-06-27 13:32:58 0 d-------- C:\WINDOWS\system32\SoftwareDistribution 2008-06-27 13:31:26 0 d-------- C:\WINDOWS\SoftwareDistribution 2008-06-27 13:31:25 0 d---s---- C:\WINDOWS\system32\Microsoft 2008-06-27 13:31:25 0 d-------- C:\WINDOWS\Prefetch 2008-06-27 13:31:24 262144 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT 2008-06-27 13:31:24 0 d--h----- C:\Documents and Settings\LocalService\Local Settings 2008-06-27 13:31:24 0 d---s---- C:\Documents and Settings\LocalService\Cookies 2008-06-27 13:31:24 0 d-------- C:\Documents and Settings\LocalService\Application Data 2008-06-27 13:31:24 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft 2008-06-27 13:31:18 237568 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT 2008-06-27 13:31:18 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings 2008-06-27 13:31:18 0 d---s---- C:\Documents and Settings\NetworkService\Cookies 2008-06-27 13:31:18 0 d-------- C:\Documents and Settings\NetworkService\Application Data 2008-06-27 13:31:18 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft 2008-06-27 13:28:39 0 d-------- C:\WINDOWS\system32\xircom 2008-06-27 13:28:39 0 d-------- C:\Program Files\microsoft frontpage 2008-06-27 13:28:28 237568 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT 2008-06-27 13:28:27 0 -rahs---- C:\MSDOS.SYS 2008-06-27 13:28:27 0 -rahs---- C:\IO.SYS 2008-06-27 13:28:27 0 --a------ C:\CONFIG.SYS 2008-06-27 13:28:27 0 --a------ C:\AUTOEXEC.BAT 2008-06-27 13:27:30 0 d--hs---- C:\Documents and Settings\All Users\DRM 2008-06-27 13:27:23 0 dr------- C:\WINDOWS\Offline Web Pages 2008-06-27 13:27:23 0 d---s---- C:\WINDOWS\Downloaded Program Files 2008-06-27 13:27:16 0 d--h----- C:\Program Files\WindowsUpdate 2008-06-27 13:27:04 0 d-------- C:\WINDOWS\system32\DirectX 2008-06-27 13:26:46 0 d---s---- C:\WINDOWS\Tasks 2008-06-27 13:26:45 0 d-------- C:\Program Files\Common Files\MSSoap 2008-06-27 13:26:42 0 d-------- C:\WINDOWS\system32\Macromed 2008-06-27 13:26:42 0 d-------- C:\WINDOWS\srchasst 2008-06-27 13:26:35 0 d-------- C:\Program Files\Movie Maker 2008-06-27 13:26:16 0 d-------- C:\WINDOWS\system32\Restore 2008-06-27 13:25:48 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat 2008-06-27 13:25:46 0 d-------- C:\WINDOWS\Registration 2008-06-27 13:25:43 0 d-------- C:\Program Files\Online Services 2008-06-27 13:25:40 0 d-------- C:\Program Files\Messenger 2008-06-27 13:25:37 0 d-------- C:\Program Files\MSN Gaming Zone 2008-06-27 13:25:06 0 d-------- C:\Program Files\Windows NT 2008-06-27 13:25:03 0 d-------- C:\WINDOWS\system32\MsDtc 2008-06-27 13:25:01 0 d-------- C:\WINDOWS\system32\Com 2008-06-27 06:20:15 0 d--hs---- C:\WINDOWS\Installer 2008-06-27 06:20:15 0 d-------- C:\Program Files\Common Files\ODBC 2008-06-27 06:20:12 0 dr------- C:\Program Files 2008-06-27 06:20:12 0 d-------- C:\Program Files\Common Files 2008-06-27 06:20:12 0 d-------- C:\Program Files\Common Files\SpeechEngines 2008-06-27 06:19:54 0 d--h----- C:\Documents and Settings\Default User\Templates 2008-06-27 06:19:54 0 dr------- C:\Documents and Settings\Default User\Start Menu 2008-06-27 06:19:54 0 dr-h----- C:\Documents and Settings\Default User\SendTo 2008-06-27 06:19:54 0 d--h----- C:\Documents and Settings\Default User\Recent 2008-06-27 06:19:54 0 d--h----- C:\Documents and Settings\Default User\PrintHood 2008-06-27 06:19:54 0 d--h----- C:\Documents and Settings\Default User\NetHood 2008-06-27 06:19:54 0 d-------- C:\Documents and Settings\Default User\My Documents 2008-06-27 06:19:54 0 dr-h----- C:\Documents and Settings\Default User\Local Settings 2008-06-27 06:19:54 0 d-------- C:\Documents and Settings\Default User\Favorites 2008-06-27 06:19:54 0 d-------- C:\Documents and Settings\Default User\Desktop 2008-06-27 06:19:54 0 d---s---- C:\Documents and Settings\Default User\Cookies 2008-06-27 06:19:54 0 d--h----- C:\Documents and Settings\All Users\Templates 2008-06-27 06:19:54 0 dr------- C:\Documents and Settings\All Users\Start Menu 2008-06-27 06:19:54 0 d-------- C:\Documents and Settings\All Users\Favorites 2008-06-27 06:19:54 0 dr------- C:\Documents and Settings\All Users\Documents 2008-06-27 06:19:54 0 d-------- C:\Documents and Settings\All Users\Desktop 2008-06-27 06:19:43 0 d-------- C:\WINDOWS\system32\CatRoot2 2008-06-27 06:19:43 0 d-------- C:\WINDOWS\system32\CatRoot 2008-06-27 06:19:37 0 dr-h----- C:\Documents and Settings\Default User\Application Data 2008-06-27 06:19:37 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft 2008-06-27 06:19:37 0 dr-h----- C:\Documents and Settings\All Users\Application Data 2008-06-27 06:19:37 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft 2008-06-27 06:19:18 0 d--hs---- C:\System Volume Information 2008-06-27 06:19:18 0 d-------- C:\Documents and Settings 2008-06-27 06:14:19 0 d-------- C:\WINDOWS\OemDir 2008-06-27 06:14:18 0 d-------- C:\WINDOWS 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\WinSxS 2008-06-27 06:14:18 0 dr------- C:\WINDOWS\Web 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\twain_32 2008-06-27 06:14:18 0 d-a------ C:\WINDOWS\system32 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\wins 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\wbem 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\usmt 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\spool 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\ShellExt 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\Setup 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\scripting 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\ras 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\oobe 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\npp 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\mui 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\inetsrv 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\IME 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\icsxml 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\ias 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\export 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\en 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\drivers 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\drivers\etc 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\drivers\disdn 2008-06-27 06:14:18 0 dr-hs--c- C:\WINDOWS\system32\dllcache 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\dhcp 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\config 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\3com_dmi 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\3076 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\2052 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\1054 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\1042 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\1041 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\1037 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\1033 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\1031 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\1028 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system32\1025 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\system 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\security 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\Resources 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\repair 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\Provisioning 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\PeerNet 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\pchealth 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\Network Diagnostic 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\mui 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\msapps 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\msagent 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\Media 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\L2Schemas 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\java 2008-06-27 06:14:18 0 d--h----- C:\WINDOWS\inf 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\ime 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\Help 2008-06-27 06:14:18 0 dr--s---- C:\WINDOWS\Fonts 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\ehome 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\Driver Cache 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\Debug 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\Cursors 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\Connection Wizard 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\Config 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\AppPatch 2008-06-27 06:14:18 0 d-------- C:\WINDOWS\addins -- Find3M Report --------------------------------------------------------------- 2008-06-27 06:19:54 62 --ahs---- C:\Documents and Settings\kLAcK\Application Data\desktop.ini -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [03/13/2008 04:48 PM] "Application Layer Gateway Service"="C:\WINDOWS\system32:Applic32.exe" [] "ASUSGamerOSD"="C:\Program Files\ASUS\GamerOSD\GamerOSD.exe" [10/23/2007 05:48 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/13/2008 08:42 PM] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [01/28/2008 11:43 AM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [12/17/2002 5:23:32 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy] C:\WINDOWS\System32\dimsntfy.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs napagent hkmsvc [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B13DF0A7-2B8C-16F7-8500-FD2DA867C5A4}] C:\WINDOWS\system32:Applic32.exe -- End of Deckard's System Scanner: finished at 2008-06-27 17:54:20 ------------ |
|
     
|
|
| Thread Tools | |
|
|
