Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 




Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > HijackThis Log Help
rundll32 / umonitor problem rundll32 / umonitor problem
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read

HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help.

Reply
 
Thread Tools
Old 01-11-2005, 09:45 AM   #1 (permalink)
Registered User
 
laredo47's Avatar
 
Join Date: Jan 2005
Posts: 3
OS: Windows XP


rundll32 / umonitor problem
When I boot my machine I get an exception error which reads something like
C:\WINDOW\upsystem32\xxxxxxx.dll",UMonitor". The "xxxxxx.dll" varies with each startup. The manifest symptoms on my machine are regular re-directs in the IE 6.0 browser. For example, I will type in "symantec" on the Yahoo search page and a new window will immediately open advertising spyware cleaning software

I've run the latest Spybot, Spy Sweeper, Norton AV, and Ad-Aware (with all of the add-ins). All now run clean except the Ad-Aware which continues to find VX2 instances. Ad-Aware will clean all of the instances EXCEPT for one apparently random .dll file which it cannot delete, saying it is use by another program.

From reading some of the posts it seems others are experiencing the same issue. Please advise. I appreciate your help.
laredo47 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Reply With Quote
Old 01-11-2005, 05:39 PM   #2 (permalink)
Knower of all that is MS
 
CTSNKY's Avatar
 
Join Date: Aug 2004
Posts: 10,755
OS: (multiple machines) 95, 98, 2K & XP Home & Pro


Please download HijackThis - this program will help us determine if there are any spyware/malware on your computer. Create a folder at C:\HJT and move HijackThis.exe there. Double click on the program to run it.

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Get HijackThis Analyzer and save it to the same folder as the hijackthis.log file. Run HijackThis Analyzer and type in y if you agree. The result.txt file will open up in Notepad. Copy the whole result.txt log and post it in the forum. We do not need the original hijackthis.log (unless we ask for it). Do not fix anything in HijackThis since they may be harmless.
__________________


GO BIG BLUE!!
CTSNKY is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Reply With Quote
Old 01-15-2005, 09:37 AM   #3 (permalink)
Registered User
 
laredo47's Avatar
 
Join Date: Jan 2005
Posts: 3
OS: Windows XP


1.15.05 Hijackthis log for laredo47
Sorry I was not able to reply sooner with this log. Work, travel, and children keep me hopping!!

Below is the log from the HJT analyzer. Many thanks for your help in this matter.

Log was analyzed using KRC HijackThis Analyzer - Updated on 1/12/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Webroot\PopUpWasher\PopUpWasher.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.0
Scan saved at 12:31:48 PM, on 1/15/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Popup Killer - {4A3A071E-F913-4eee-AE15-AEFFA16FB6BC} - C:\WINNT\PopUpWasher21.dll
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll (file missing)
O16 - DPF: WebWorks Help 3.0 - http://www.netgear.com/docs/fvs318/wwhelp3.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {814EA0DA-E0D9-4AA4-833C-A1A6D38E79E9} (DASWebDownload Class) - http://das.microsoft.com/activate/ca...ail/DASAct.cab
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O23 - Service: IMAPI CD-Burning COM Service - Roxio Inc. - C:\WINNT\System32\ImapiRox.exe
O23 - Service: IomegaAccess - Iomega Corporation - C:\WINNT\System32\IomegaAccess.exe
O23 - Service: PictureTaker - Unknown - c:\fixit\pt\PCTKRNT.SYS (file missing)
O23 - Service: Super Ad Blocker Service - Unknown - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE (file missing)


End of KRC HijackThis Analyzer Log.
laredo47 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Reply With Quote
Old 01-15-2005, 09:45 AM   #4 (permalink)
Analyst, Security Team
 
greyknight17's Avatar
 
Join Date: Jul 2004
Location: New York
Posts: 14,327
OS: Windows 98 & Windows XP Home/Pro

My System

Nothing much to fix. Check and fix these in HijackThis:

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll (file missing)
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB

Restart and run new HijackThis scan. If there were some entries that didn't show up in Safe Mode, you may check and fix those that appear now in normal mode (if you do that, make sure to run a new scan again). Save the log file and run KRC HijackThis Analyzer in the same folder to get the result.txt log. Just post the contents of the result.txt file in the forum.

Download: StartDreck (http://www.greyknight17.com/spy/StartDreck.zip).

Unzip to its own folder and start the program:
Press 'Config'
Press 'mark all'

Uncheck the following boxes only:
System/Drivers -> NT Services
System/Drivers -> NT Kernel- and FS-drivers
Press 'OK'

Press 'Save' and select the location to save the log file (default is the same folder as the application)

Post the log in this thread.
__________________
Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it.
greyknight17 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Reply With Quote
Old 01-15-2005, 10:40 AM   #5 (permalink)
Registered User
 
laredo47's Avatar
 
Join Date: Jan 2005
Posts: 3
OS: Windows XP


Below please find the Hijackthis analyzer and Start Dreck files. I've been running HJT in the "Normal" mode and from your previous message am unsure if I need to run it in "Safe" mode to give you for analysis. Please clarify and many thanks for your help.

HJT Analyzer

Log was analyzed using KRC HijackThis Analyzer - Updated on 1/12/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.0
Scan saved at 1:14:27 PM, on 1/15/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.gateway.net
O2 - BHO: Popup Killer - {4A3A071E-F913-4eee-AE15-AEFFA16FB6BC} - C:\WINNT\PopUpWasher21.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll (file missing)
O16 - DPF: WebWorks Help 3.0 - http://www.netgear.com/docs/fvs318/wwhelp3.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {814EA0DA-E0D9-4AA4-833C-A1A6D38E79E9} (DASWebDownload Class) - http://das.microsoft.com/activate/ca...ail/DASAct.cab
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O23 - Service: IMAPI CD-Burning COM Service - Roxio Inc. - C:\WINNT\System32\ImapiRox.exe
O23 - Service: IomegaAccess - Iomega Corporation - C:\WINNT\System32\IomegaAccess.exe
O23 - Service: PictureTaker - Unknown - c:\fixit\pt\PCTKRNT.SYS (file missing)
O23 - Service: Super Ad Blocker Service - Unknown - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE (file missing)

End of KRC HijackThis Analyzer Log.

Start Dreck File

StartDreck (build 2.1.7 public stable) - 2005-01-15 @ 13:32:48 (GMT -05:00)
Platform: Windows XP (Win NT 5.1.2600 Service Pack 2)
Internet Explorer: 6.0.2900.2180
Logged in as Laredo at LAREDO47

»Registry
»Run Keys
»Current User
»Run
*ctfmon.exe=C:\WINNT\system32\ctfmon.exe
*Microsoft Works Update Detection=C:\Program Files\Microsoft Works\WkDetect.exe
*PopUpWasher=C:\Program Files\Webroot\PopUpWasher\PopUpWasher.exe
*SpySweeper="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
»RunOnce
»Default User
»Run
*Symantec Network Driver Update Warning=C:\PROGRA~1\Symantec\LIVEUP~1\SNDWarn.EXE
»RunOnce
*SRUUninstall=
»Local Machine
»Run
*NvCplDaemon=RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
*nwiz=nwiz.exe /install
*IntelliPoint="C:\Program Files\Microsoft IntelliPoint\point32.exe"
*ccApp="C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
*Symantec NetDriver Monitor=C:\PROGRA~1\SYMNET~1\SNDMon.exe
*QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
+OptionalComponents
+MSFS
*Installed=1
+MAPI
*Installed=1
*NoChange=1
+MAPI
*Installed=1
*NoChange=1
»RunOnce
»RunServices
»RunServicesOnce
»RunOnceEx
»RunServicesOnceEx
»File Associations (CR)
+.bat
*batfile="%1" %*
+.com
*comfile="%1" %*
+.disabled
*SpybotSD.DisabledFile="C:\Program Files\Spybot - Search & Destroy\blindman.exe" "%1"
+.exe
*exefile="%1" %*
+.hta
*htafile=C:\WINNT\System32\mshta.exe "%1" %*
+.htm
*htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" -nohome
+.html
*htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" -nohome
+.js
*JSFile=%SystemRoot%\System32\WScript.exe "%1" %*
+.jse
*JSEFile=%SystemRoot%\System32\WScript.exe "%1" %*
+.pif
*piffile="%1" %*
+.reg
*regfile=regedit.exe "%1"
+.scr
*scrfile="%1" /S
+.txt
*txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
+.vbs
*VBSFile=%SystemRoot%\System32\WScript.exe "%1" %*
+.vbe
*VBEFile=%SystemRoot%\System32\WScript.exe "%1" %*
+.wsh
*WSHFile=%SystemRoot%\System32\WScript.exe "%1" %*
+.wsf
*WSFFile=%SystemRoot%\System32\WScript.exe "%1" %*
+.lnk
`lnkfile= [key or value does not exist]
»Active Setup (LM)
+Internet Explorer/>{26923b43-4d38-484f-9b9e-de460746276c}
*StubPath=%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
+Browser Customizations/>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS
*StubPath=RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
+Outlook Express/>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
*StubPath=%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
+Themes Setup/{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
*StubPath=%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
+Microsoft Outlook Express 6/{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
*StubPath="%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
+NetMeeting 3.01/{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
*StubPath=rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
+Internet Explorer/{4b218e3e-bc98-4770-93d3-2731b9329278}
*StubPath=%SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf
+Windows Messenger 4.7/{5945c046-1e7d-11d1-bc44-00c04fd912be}
*StubPath=rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msmsgs.inf,BLC.QuietInstall.PerUser
+Microsoft Windows Media Player/{6BF52A52-394A-11d3-B153-00C04F79FAA6}
*StubPath=rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\wmp10.inf,PerUserStub
+Address Book 6/{7790769C-0471-11d2-AF11-00C04FA35D02}
*StubPath="%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
+Windows Desktop Update/{89820200-ECBD-11cf-8B85-00AA005B4340}
*StubPath=regsvr32.exe /s /n /i:U shell32.dll
+Internet Explorer 6/{89820200-ECBD-11cf-8B85-00AA005B4383}
*StubPath=%SystemRoot%\system32\ie4uinit.exe
+Fax/{8b15971b-5355-4c82-8c07-7e181ea07608}
*StubPath=rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\fxsocm.inf,Fax.Install.PerUser
»Browser Helper Objects (LM)
*Popup Killer/{4A3A071E-F913-4eee-AE15-AEFFA16FB6BC}
`InprocServer32=C:\WINNT\PopUpWasher21.dll
*{53707962-6F74-2D53-2644-206D7942484F}
`InprocServer32=C:\PROGRA~1\SPYBOT~1\SDHelper.dll
»Internet Explorer
»Current User
*Local Page=c:\winnt\system32\blank.htm
*Search Bar=http://ie.search.msn.com/{sub_rfc1766}/srchasst/srchasst.htm
*Search Page=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
*Start Page=http://www.yahoo.com/
*CustomizeSearch=http://ie.search.msn.com/{sub_rfc1766}/srchasst/srchcust.htm
*SearchAssistant=http://ie.search.msn.com/{sub_rfc1766}/srchasst/srchasst.htm
+SearchUrl
*provider=
*=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
»Default User
»Local Machine
*Default_Page_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
*Default_Search_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
*Local Page=c:\winnt\system32\blank.htm
*Search Bar=http://ie.search.msn.com/{sub_rfc1766}/srchasst/srchasst.htm
*Search Page=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
*Start Page=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
*CustomizeSearch=http://ie.search.msn.com/{sub_rfc1766}/srchasst/srchcust.htm
*SearchAssistant=http://ie.search.msn.com/{sub_rfc1766}/srchasst/srchasst.htm
»ShellServiceObjectDelayLoad (LM)
*PostBootReminder={7849596a-48ea-486e-8937-a2a3009f31a9}
`InprocServer32=%SystemRoot%\system32\SHELL32.dll
*CDBurn={fbeb8a05-beee-4442-804e-409d6c4515e9}
`InprocServer32=%SystemRoot%\system32\SHELL32.dll
*WebCheck={E6FB5E20-DE35-11CF-9C87-00AA005127ED}
`InprocServer32=%SystemRoot%\System32\webcheck.dll
*SysTray={35CEC8A3-2BE6-11D2-8773-92E220524153}
`InprocServer32=C:\WINNT\System32\stobject.dll
»Special NT Values
»Current User
*Load=
*Run=
*Programs=com exe bat pif cmd
*SHELL=
»Default User
*Load=
*Run=
*Programs=com exe bat pif cmd
*SHELL=
»Local Machine
*AppInit_DLLs=
*SHELL=Explorer.exe
*Userinit=C:\WINNT\system32\userinit.exe,
»Files
»Autostart Folders
»Current User
*C:\Documents and Settings\Laredo\Start Menu\Programs\Startup\desktop.ini
»Default User
*C:\WINNT\system32\config\systemprofile\Start Menu\Programs\Startup\desktop.ini
»Local Machine
*C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
*C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
»INI-Files
»WIN.INI\[windows]
*LOAD=
*RUN=
»SYSTEM.INI\[boot]
*SHELL=Explorer.exe
»Text Files
*C:\boot.ini
`[boot loader]
`timeout=30
`default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
`[operating systems]
`multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
*C:\msdos.sys
*C:\WINNT\system32\config.nt
`dos=high, umb
`device=%SystemRoot%\system32\himem.sys
`files=40
*C:\autoexec.bat
*C:\WINNT\system32\autoexec.nt
`@echo off
`lh %SystemRoot%\system32\mscdexnt.exe
`lh %SystemRoot%\system32\redir
`lh %SystemRoot%\system32\dosx
`SET BLASTER=A220 I5 D1 P330 T3
*C:\WINNT\system32\drivers\etc\hosts
`127.0.0.1 www.igetnet.com
`127.0.0.1 code.ignphrases.com
`127.0.0.1 clear-search.com
`127.0.0.1 r1.clrsch.com
`127.0.0.1 sds.clrsch.com
`127.0.0.1 status.clrsch.com
`127.0.0.1 www.clrsch.com
`127.0.0.1 clr-sch.com
`127.0.0.1 sds-qckads.com
`127.0.0.1 status.qckads.com
`127.0.0.1 localhost
`127.0.0.1 www.doubleclick.net
`127.0.0.1 ad.preferances.com
`127.0.0.1 ad.doubleclick.com
`127.0.0.1 ads.web.aol.com
`127.0.0.1 ad.doubleclick.net
`127.0.0.1 ad.preferences.com
`127.0.0.1 ad.washingtonpost.com
`127.0.0.1 adpick.switchboard.com
`127.0.0.1 ads.doubleclick.com
`127.0.0.1 ads.infospace.com
`127.0.0.1 ads.msn.com
`127.0.0.1 ads.switchboard.com
`127.0.0.1 ads.enliven.com
`127.0.0.1 oz.valueclick.com
`127.0.0.1 doubleclick.net
`127.0.0.1 ads.doubleclick.net
`127.0.0.1 ad2.doubleclick.net
`127.0.0.1 ad3.doubleclick.net
`127.0.0.1 ad4.doubleclick.net
`127.0.0.1 ad5.doubleclick.net
`127.0.0.1 ad6.doubleclick.net
`127.0.0.1 ad7.doubleclick.net
`127.0.0.1 ad8.doubleclick.net
`127.0.0.1 ad9.doubleclick.net
`127.0.0.1 ad10.doubleclick.net
`127.0.0.1 ad11.doubleclick.net
`127.0.0.1 ad12.doubleclick.net
`127.0.0.1 ad13.doubleclick.net
`127.0.0.1 ad14.doubleclick.net
`127.0.0.1 ad15.doubleclick.net
`127.0.0.1 ad16.doubleclick.net
`127.0.0.1 ad17.doubleclick.net
`127.0.0.1 ad18.doubleclick.net
`127.0.0.1 ad19.doubleclick.net
`127.0.0.1 ad20.doubleclick.net
`127.0.0.1 ad.ch.doubleclick.net
`127.0.0.1 ad.linkexchange.com
`127.0.0.1 banner.linkexchange.com
`127.0.0.1 ads*.focalink.com
`127.0.0.1 ads.imdb.com
`127.0.0.1 commonwealth.riddler.com
`127.0.0.1 globaltrak.net
`127.0.0.1 nrsite.com
`127.0.0.1 www.nrsite.com
`127.0.0.1 ad-up.com
`127.0.0.1 ad.adsmart.net
`127.0.0.1 ad.atlas.cz
`127.0.0.1 ad.blm.net
`127.0.0.1 ad.dogpile.com
`127.0.0.1 ad.infoseek.com
`127.0.0.1 ad.net-service.de
`127.0.0.1 ad.preferences.com
`127.0.0.1 ad.vol.at
`127.0.0.1 adbot.com
`127.0.0.1 adbureau.net
`127.0.0.1 adcount.hollywood.com
`127.0.0.1 add.yaho.com
`127.0.0.1 adex3.flycast.com
`127.0.0.1 adforce.adtech.de
`127.0.0.1 adforce.imgis.com
`127.0.0.1 adimage.blm.net
`127.0.0.1 adlink.deh.de
`127.0.0.1 ads.criticalmass.com
`127.0.0.1 ads.csi.emcweb.com
`127.0.0.1 ads.filez.com
`127.0.0.1 ads.imagine-inc.com
`127.0.0.1 ads.imdb.com
`127.0.0.1 ads.infospace.com
`127.0.0.1 ads.jwtt3.com
`127.0.0.1 ads.mirrormedia.co.uk
`127.0.0.1 ads.msn.com
`127.0.0.1 ads.narrowline.com
`127.0.0.1 ads.newcitynet.com
`127.0.0.1 ads.realcities.com
`127.0.0.1 ads.realmedia.com
`127.0.0.1 ads.switchboard.com
`127.0.0.1 ads.tripod.com
`127.0.0.1 ads.usatoday.com
`127.0.0.1 ads.washingtonpost.com
`127.0.0.1 ads.web.de
`127.0.0.1 ads.web21.com
`127.0.0.1 adserv.newcentury.net
`127.0.0.1 adservant.guj.de
`127.0.0.1 adservant.mediapoint.de
`127.0.0.1 adserver-espnet.sportszone.com
`127.0.0.1 advert.heise.de
`127.0.0.1 banners.internetextra.com
`127.0.0.1 bannerswap.com
`127.0.0.1 dino.mainz.ibm.de
`127.0.0.1 ganges.imagine-inc.com
`127.0.0.1 globaltrack.com
`127.0.0.1 207-87-18-203.wsmg.digex.net
`127.0.0.1 garden.ngadcenter.net
`127.0.0.1 ogilvy.ngadcenter.net
`127.0.0.1 responsemedia-ad.flycast.com
`127.0.0.1 suissa-ad.flycast.com
`127.0.0.1 ugo.eu-adcenter.net
`127.0.0.1 vnu.eu-adcenter.net
`127.0.0.1 ad-adex3.flycast.com
`127.0.0.1 ad.adsmart.net
`127.0.0.1 ad.ca.doubleclick.net
`127.0.0.1 ad.de.doubleclick.net
`127.0.0.1 ad.fr.doubleclick.net
`127.0.0.1 ad.jp.doubleclick.net
`127.0.0.1 ad.linkexchange.com
`127.0.0.1 ad.linksynergy.com
`127.0.0.1 ad.nl.doubleclick.net
`127.0.0.1 ad.no.doubleclick.net
`127.0.0.1 ad.sma.punto.net
`127.0.0.1 ad.uk.doubleclick.net
`127.0.0.1 ad.webprovider.com
`127.0.0.1 ad08.focalink.com
`127.0.0.1 adcontroller.unicast.com
`127.0.0.1 adcreatives.imaginemedia.com
`127.0.0.1 adforce.ads.imgis.com
`127.0.0.1 adforce.imgis.com
`127.0.0.1 adfu.blockstackers.com
`127.0.0.1 adimages.earthweb.com
`127.0.0.1 adimg.egroups.com
`127.0.0.1 admedia.xoom.com
`127.0.0.1 adremote.pathfinder.com
`127.0.0.1 ads.admaximize.com
`127.0.0.1 ads.bfast.com
`127.0.0.1 ads.clickhouse.com
`127.0.0.1 ads.fairfax.com.au
`127.0.0.1 ads.fool.com
`127.0.0.1 ads.freshmeat.net
`127.0.0.1 ads.hollywood.com
`127.0.0.1 ads.i33.com
`127.0.0.1 ads.infi.net
`127.0.0.1 ads.link4ads.com
`127.0.0.1 ads.lycos.com
`127.0.0.1 ads.madison.com
`127.0.0.1 ads.mediaodyssey.com
`127.0.0.1 ads.msn.com
`127.0.0.1 ads.ninemsn.com.au
`127.0.0.1 ads.seattletimes.com
`127.0.0.1 ads.smartclicks.com
`127.0.0.1 ads.smartclicks.net
`127.0.0.1 ads.sptimes.com
`127.0.0.1 ads.web.aol.com
`127.0.0.1 ads.x10.com
`127.0.0.1 ads.xtra.co.nz
`127.0.0.1 ads.zdnet.com
`127.0.0.1 ads01.focalink.com
`127.0.0.1 ads02.focalink.com
`127.0.0.1 ads03.focalink.com
`127.0.0.1 ads04.focalink.com
`127.0.0.1 ads05.focalink.com
`127.0.0.1 ads06.focalink.com
`127.0.0.1 ads08.focalink.com
`127.0.0.1 ads09.focalink.com
`127.0.0.1 ads1.activeagent.at
`127.0.0.1 ads10.focalink.com
`127.0.0.1 ads11.focalink.com
`127.0.0.1 ads12.focalink.com
`127.0.0.1 ads14.focalink.com
`127.0.0.1 ads16.focalink.com
`127.0.0.1 ads17.focalink.com
`127.0.0.1 ads18.focalink.com
`127.0.0.1 ads19.focalink.com
`127.0.0.1 ads2.zdnet.com
`127.0.0.1 ads20.focalink.com
`127.0.0.1 ads21.focalink.com
`127.0.0.1 ads22.focalink.com
`127.0.0.1 ads23.focalink.com
`127.0.0.1 ads24.focalink.com
`127.0.0.1 ads25.focalink.com
`127.0.0.1 ads3.zdnet.com
`127.0.0.1 ads5.gamecity.net
`127.0.0.1 adserv.iafrica.com
`127.0.0.1 adserv.quality-channel.de
`127.0.0.1 adserver.dbusiness.com
`127.0.0.1 adserver.garden.com
`127.0.0.1 adserver.janes.com
`127.0.0.1 adserver.merc.com
`127.0.0.1 adserver.monster.com
`127.0.0.1 adserver.track-star.com
`127.0.0.1 adserver1.ogilvy-interactive.de
`127.0.0.1 adtegrity.spinbox.net
`127.0.0.1 antfarm-ad.flycast.com
`127.0.0.1 au.ads.link4ads.com
`127.0.0.1 banner.media-system.de
`127.0.0.1 banner.orb.net
`127.0.0.1 banner.relcom.ru
`127.0.0.1 banners.easydns.com
`127.0.0.1 banners.looksmart.com
`127.0.0.1 banners.wunderground.com
`127.0.0.1 barnesandnoble.bfast.com
`127.0.0.1 beseenad.looksmart.com
`127.0.0.1 bizad.nikkeibp.co.jp
`127.0.0.1 bn.bfast.com
`127.0.0.1 c3.xxxcounter.com
`127.0.0.1 califia.imaginemedia.com
`127.0.0.1 cds.mediaplex.com
`127.0.0.1 click.avenuea.com
`127.0.0.1 click.go2net.com
`127.0.0.1 click.linksynergy.com
`127.0.0.1 cookies.cmpnet.com
`127.0.0.1 cornflakes.pathfinder.com
`127.0.0.1 counter.hitbox.com
`127.0.0.1 crux.songline.com
`127.0.0.1 erie.smartage.com
`127.0.0.1 etad.telegraph.co.uk
`127.0.0.1 fp.valueclick.com
`127.0.0.1 gadgeteer.pdamart.com
`127.0.0.1 gm.preferences.com
`127.0.0.1 gp.dejanews.com
`127.0.0.1 hg1.hitbox.com
`127.0.0.1 image.click2net.com
`127.0.0.1 image.eimg.com
`127.0.0.1 images2.nytimes.com
`127.0.0.1 jobkeys.ngadcenter.net
`127.0.0.1 kansas.valueclick.com
`127.0.0.1 leader.linkexchange.com
`127.0.0.1 liquidad.narrowcastmedia.com
`127.0.0.1 ln.doubleclick.net
`127.0.0.1 m.doubleclick.net
`127.0.0.1 macaddictads.snv.futurenet.com
`127.0.0.1 maximumpcads.imaginemedia.com
`127.0.0.1 media.preferences.com
`127.0.0.1 mercury.rmuk.co.uk
`127.0.0.1 mojofarm.sjc.mediaplex.com
`127.0.0.1 nbc.adbureau.net
`127.0.0.1 newads.cmpnet.com
`127.0.0.1 ng3.ads.warnerbros.com
`127.0.0.1 ngads.smartage.com
`127.0.0.1 nsads.hotwired.com
`127.0.0.1 ntbanner.digitalriver.com
`127.0.0.1 ph-ad05.focalink.com
`127.0.0.1 ph-ad07.focalink.com
`127.0.0.1 ph-ad16.focalink.com
`127.0.0.1 ph-ad17.focalink.com
`127.0.0.1 ph-ad18.focalink.com
`127.0.0.1 realads.realmedia.com
`127.0.0.1 redherring.ngadcenter.net
`127.0.0.1 redirect.click2net.com
`127.0.0.1 retaildirect.realmedia.com
`127.0.0.1 s2.focalink.com
`127.0.0.1 sh4sure-images.adbureau.net
`127.0.0.1 spin.spinbox.net
`127.0.0.1 static.admaximize.com
`127.0.0.1 stats.superstats.com
`127.0.0.1 sview.avenuea.com
`127.0.0.1 thinknyc.eu-adcenter.net
`127.0.0.1 tracker.clicktrade.com
`127.0.0.1 tsms-ad.tsms.com
`127.0.0.1 v0.extreme-dm.com
`127.0.0.1 v1.extreme-dm.com
`127.0.0.1 van.ads.link4ads.com
`127.0.0.1 view.accendo.com
`127.0.0.1 view.avenuea.com
`127.0.0.1 w113.hitbox.com
`127.0.0.1 w25.hitbox.com
`127.0.0.1 web2.deja.com
`127.0.0.1 webads.bizservers.com
`127.0.0.1 www.postmasterbannernet.com
`127.0.0.1 www.ad-up.com
`127.0.0.1 www.admex.com
`127.0.0.1 www.alladvantage.com
`127.0.0.1 www.burstnet.com
`127.0.0.1 www.commission-junction.com
`127.0.0.1 www.eads.com
`127.0.0.1 www.freestats.com
`127.0.0.1 www.imaginemedia.com
`127.0.0.1 www.netdirect.nl
`127.0.0.1 www.oneandonlynetwork.com
`127.0.0.1 www.targetshop.com
`127.0.0.1 www.teknosurf2.com
`127.0.0.1 www.teknosurf3.com
`127.0.0.1 www.valueclick.com
`127.0.0.1 www.websitefinancing.com
`127.0.0.1 www2.burstnet.com
`127.0.0.1 www4.trix.net
`127.0.0.1 www80.valueclick.com
`127.0.0.1 z.extreme-dm.com
`127.0.0.1 z0.extreme-dm.com
`127.0.0.1 z1.extreme-dm.com
`127.0.0.1 ads.forbes.net
`127.0.0.1 ads.newcity.com
`127.0.0.1 ads.ign.com
`127.0.0.1 adserver.ign.com
`127.0.0.1 ads.scifi.com
`127.0.0.1 adengine.theglobe.com
`127.0.0.1 ads.tucows.com
`127.0.0.1 adcontent.gamespy.com
`127.0.0.1 ads4.advance.net
`127.0.0.1 ads1.advance.net
`127.0.0.1 eur.yimg.com
`127.0.0.1 us.a1.yimg.com
`127.0.0.1 ad.harmony-central.com
`127.0.0.1 sg.yimg.com
`127.0.0.1 adverity.adverity.com
`127.0.0.1 ads.bloomberg.com
`127.0.0.1 mojofarm.mediaplex.com
`127.0.0.1 ads.mysimon.com
`127.0.0.1 ad.img.yahoo.co.kr
`127.0.0.1 adimages.go.com
`127.0.0.1 kr-adimage.lycos.co.kr
`127.0.0.1 ad.kimo.com.tw
`127.0.0.1 ads.paxnet.co.kr
`127.0.0.1 ads.paxnet.com
`127.0.0.1 ads.eu.msn.com
`127.0.0.1 ads.admonitor.net
`127.0.0.1 wwa.hitbox.com
`127.0.0.1 ads.nytimes.com
`127.0.0.1 ads.erotism.com
`127.0.0.1 banner.rootsweb.com
`127.0.0.1 ads.ole.com
`127.0.0.1 adimg1.chosun.com
`127.0.0.1 ss.mtree.com
`127.0.0.1 adpulse.ads.targetnet.com
`127.0.0.1 adserver.ugo.com
`127.0.0.1 ad.sales.olympics.com
`127.0.0.1 m2.doubleclick.net
`127.0.0.1 ph-ad21.focalink.com
`127.0.0.1 focusin.ads.targetnet.com
`127.0.0.1 www.datais.com
`127.0.0.1 oas.mmd.ch
`127.0.0.1 pub-g.ifrance.com
`127.0.0.1 ads.bianca.com
`127.0.0.1 wap.adlink.de
`127.0.0.1 click.adlink.de
`127.0.0.1 banner.adlink.de
`127.0.0.1 hurricane.adlink.de
`127.0.0.1 west.adlink.de
`127.0.0.1 scand.adlink.de
`127.0.0.1 regio.adlink.de
`127.0.0.1 direct.adlink.de
`127.0.0.1 classic.adlink.de
`127.0.0.1 adlui001.adlink.de
`127.0.0.1 banner1.adlink.de
`127.0.0.1 click.mp3.com
`127.0.0.1 adcodes.bla-bla.com
`127.0.0.1 icover.realmedia.com
`127.0.0.1 ca.fp.sandpiper.net
`127.0.0.1 adfarm.mediaplex.com
`127.0.0.1 ads.tmcs.net
`127.0.0.1 amedia.techies.com
`127.0.0.1 www.exchange-it.com
`127.0.0.1 www.ad.tomshardware.com
`127.0.0.1 ad.tomshardware.com
`127.0.0.1 ads.currantbun.com
`127.0.0.1 phoenix-adrunner.mycomputer.com
`127.0.0.1 ads15.focalink.com
`127.0.0.1 ads13.focalink.com
`127.0.0.1 adserver.colleges.com
`127.0.0.1 ads.nwsource.com
`127.0.0.1 ads.guardianunlimited.co.uk
`127.0.0.1 ads.newsint.co.uk
`127.0.0.1 ads.starnews.com
`127.0.0.1 www.linksynergy.com
`127.0.0.1 ieee-images.adbureau.net
`127.0.0.1 connect.247media.ads.link4ads.com
`127.0.0.1 ads.newsdigital.net
`127.0.0.1 arc5.msn.com
`127.0.0.1 arc4.msn.com
`127.0.0.1 arc3.msn.com
`127.0.0.1 arc2.msn.com
`127.0.0.1 arc1.msn.com
`127.0.0.1 ads.discovery.com
`127.0.0.1 im.800.com
`127.0.0.1 img.cmpnet.com
`127.0.0.1 ad7.internetadserver.com
`127.0.0.1 ads.dai.net
`127.0.0.1 ads.cbc.ca
`127.0.0.1 www75.valueclick.com
`127.0.0.1 ads.clearbluemedia.com
`127.0.0.1 ti.click2net.com
`127.0.0.1 www.onresponse.com
`127.0.0.1 ads.list-universe.com
`127.0.0.1 advert.bayarea.com
`127.0.0.1 www3.pagecount.com
`127.0.0.1 www.netsponsors.com
`127.0.0.1 adthru.com
`127.0.0.1 ads.newtimes.com
`127.0.0.1 ads.ugo.com
`127.0.0.1 ads.belointeractive.com
`127.0.0.1 wwb.hitbox.com
`127.0.0.1 comtrack.comclick.com
`127.0.0.1 www.24pm-affiliation.com
`127.0.0.1 www.click-fr.com
`127.0.0.1 www.cibleclick.com
`127.0.0.1 reply.mediatris.net
`127.0.0.1 cgi.declicnet.com
`127.0.0.1 pubs.mgn.net
`127.0.0.1 ads.mcafee.com
`127.0.0.1 ads1.ad-flow.com
`127.0.0.1 ad.be.doubleclick.net
`127.0.0.1 ad.adtraq.com
`127.0.0.1 ad.sg.doubleclick.net
`127.0.0.1 adpop.theglobe.com
`127.0.0.1 ads-03.tor.focusin.ads.targetnet.com
`127.0.0.1 ads.adflight.com
`127.0.0.1 ads.detelefoongids.nl
`127.0.0.1 ads.ecircles.com
`127.0.0.1 ads.god.co.uk
`127.0.0.1 ads.hyperbanner.net
`127.0.0.1 ads.jpost.com
`127.0.0.1 ads.netmechanic.com
`127.0.0.1 ads.webcash.nl
`127.0.0.1 adserver.netcast.nl
`127.0.0.1 adserver.webads.com
`127.0.0.1 adserver.webads.nl
`127.0.0.1 adserver1.realtracker.com
`127.0.0.1 adserver2.realtracker.com
`127.0.0.1 adserver3.realtracker.com
`127.0.0.1 delivery1.ads.telegraaf.nl
`127.0.0.1 holland.hyperbanner.net
`127.0.0.1 images.webads.nl
`127.0.0.1 sc.clicksupply.com
`127.0.0.1 service.bfast.com
`127.0.0.1 www.ad4ex.com
`127.0.0.1 www.bannercampaign.com
`127.0.0.1 www.cyberbounty.com
`127.0.0.1 www.netvertising.be
`127.0.0.1 www.speedyclick.com
`127.0.0.1 www.webads.nl
`127.0.0.1 ads.snowball.com
`127.0.0.1 ads.amazingmedia.com
`127.0.0.1 www10.valueclick.com
`127.0.0.1 js1.hitbox.com
`127.0.0.1 rd1.hitbox.com
`127.0.0.1 mt37.mtree.com
`127.0.0.1 ads.gameanswers.com
`127.0.0.1 ads7.udc.advance.net
`127.0.0.1 www23.valueclick.com
`127.0.0.1 ads.fortunecity.com
`127.0.0.1 banners.nextcard.com
`127.0.0.1 ads.iwon.com
`127.0.0.1 www.qksrv.net
`127.0.0.1 clickserve.cc-dt.com
`127.0.0.1 ads-b.focalink.com
`127.0.0.1 ad2.peel.com
`127.0.0.1 ads.floridatoday.com
`127.0.0.1 stats.adultrevenueservice.com
`127.0.0.1 ads18.bpath.com
`127.0.0.1 ph-ad06.focalink.com
`127.0.0.1 global.msads.net
`127.0.0.1 pluto1.iserver.net
`127.0.0.1 ads1.intelliads.com
`127.0.0.1 primetime.ad.asap-asp.net
`127.0.0.1 ads.stileproject.com
`127.0.0.1 di.image.eshop.msn.com
`127.0.0.1 www.blissnet.net
`127.0.0.1 www.consumerinfo.com
`127.0.0.1 ads.rottentomatoes.com
`127.0.0.1 k5ads.osdn.com
`127.0.0.1 actionsplash.com
`127.0.0.1 campaigns.f2.com.au
`127.0.0.1 adserver.news.com.au
`127.0.0.1 servedby.advertising.com
`127.0.0.1 java.yahoo.com
`127.0.0.1 ad.howstuffworks.com
`127.0.0.1 ads.1for1.com
`127.0.0.1 images.ads.fairfax.com.au
`127.0.0.1 ads.devx.com
`127.0.0.1 utils.mediageneral.com
`127.0.0.1 banners.friendfinder.com
`127.0.0.1 adserver.matchcraft.com
`127.0.0.1 www.dnps.com
`127.0.0.1 creative.whi.co.nz
`127.0.0.1 rmedia.boston.com
`127.0.0.1 webaffiliate.covad.com
`127.0.0.1 ad.iwin.com
`127.0.0.1 www.nailitonline2.com
`127.0.0.1 mds.centrport.net
`127.0.0.1 oas.dispatch.com
`127.0.0.1 adserver.ads360.com
`127.0.0.1 banners.adultfriendfinder.com
`127.0.0.1 ads.as4x.tmcs.net
`127.0.0.1 ads.clickagents.com
`127.0.0.1 banners.chek.com
`127.0.0.1 zi.r.tv.com
`127.0.0.1 ph-ad19.focalink.com
`127.0.0.1 ads.greensboro.com
`127.0.0.1 ad2.adcept.net
`127.0.0.1 ads.colo.kiva.net
`127.0.0.1 adsrv.iol.co.za
`127.0.0.1 mjxads.internet.com
`127.0.0.1 adimage.asiaone.com.sg
`127.0.0.1 ads.vnuemedia.com
`127.0.0.1 affiliate.doteasy.com
`127.0.0.1 m.tribalfusion.com
`127.0.0.1 oas.lee.net
`127.0.0.1 www.banneroverdrive.com
`127.0.0.1 ad3.peel.com
`127.0.0.1 ad1.peel.comwww.xbn.ru
`127.0.0.1 adserver.snowball.com
`127.0.0.1 media15.fastclick.net
`127.0.0.1 ads5.advance.net
`127.0.0.1 ads3.advance.net
`127.0.0.1 ads2.advance.net
`127.0.0.1 ads.advance.net
`127.0.0.1 usbytecom.orbitcycle.com
`127.0.0.1 adbanner.sweepsclub.com
`127.0.0.1 oas.villagevoice.com
`127.0.0.1 www.ad-flow.com
`127.0.0.1 ads.guardian.co.uk
`127.0.0.1 ads.hitcents.com
`127.0.0.1 media19.fastclick.net
`127.0.0.1 a.tribalfusion.com
`127.0.0.1 ads.nypost.com
`127.0.0.1 ads.premiumnetwork.com
`127.0.0.1 ads.ad-flow.com
`127.0.0.1 adserver.hispavista.com
`127.0.0.1 ads.musiccity.com
`127.0.0.1 banners.revenuelink.com
`127.0.0.1 ads1.sptimes.com
`127.0.0.1 adserver.bizland-inc.net
`127.0.0.1 ads.adtegrity.net
`127.0.0.1 media13.fastclick.net
`127.0.0.1 adserver.ukplus.co.uk
`127.0.0.1 ads.live365.com
`127.0.0.1 ads.fredericksburg.com
`127.0.0.1 banners.affiliatefuel.com
`127.0.0.1 ar.atwola.com
`127.0.0.1 ads.bigcitytools.com
`127.0.0.1 netshelter.adtrix.com
`127.0.0.1 y.ibsys.com
`127.0.0.1 adserver.nydailynews.com
`127.0.0.1 s0b.bluestreak.com
`127.0.0.1 images.scripps.com
`127.0.0.1 images.cybereps.com
`127.0.0.1 altfarm.mediaplex.com
`127.0.0.1 krd.realcities.com
`127.0.0.1 www3.bannerspace.com
`127.0.0.1 view.atdmt.com
`127.0.0.1 ads7.advance.net
`127.0.0.1 ad.abcnews.com
`127.0.0.1 ads.newsquest.co.uk
`127.0.0.1 secure.webconnect.net
`127.0.0.1 ads.nandomedia.com
`127.0.0.1 banners.babylon-x.com
`127.0.0.1 media17.fastclick.net
`127.0.0.1 techreview-images.adbureau.net
`127.0.0.1 ads.exhedra.com
`127.0.0.1 ad.trafficmp.com
`127.0.0.1 realmedia-a800.d4p.net
`127.0.0.1 banner.northsky.com
`127.0.0.1 ftp.nacorp.com
`127.0.0.1 www.digitalbettingcasinos.com
`127.0.0.1 c1.zedo.com
`127.0.0.1 ads4.condenet.com
`127.0.0.1 www.brilliantdigital.com
`127.0.0.1 desktop.kazaa.com
`127.0.0.1 shop.kazaa.com
`127.0.0.1 www.bonzi.com
`127.0.0.1 www.b3d.com
`127.0.0.1 neighborhood.standard.net
`127.0.0.1 ads.telegraph.co.uk
`127.0.0.1 spinbox.techtracker.com
`127.0.0.1 toads.osdn.com
`127.0.0.1 ads.themes.org
`127.0.0.1 adserver.trb.com
`127.0.0.1 media.fastclick.net
`127.0.0.1 banner.easyspace.com
`127.0.0.1 www.banner2u.com
`127.0.0.1 ads.thestar.com
`127.0.0.1 ads.digitalmedianet.com
`127.0.0.1 www.fineclicks.com
`127.0.0.1 ads.mdchoice.com
`127.0.0.1 ad.horvitznewspapers.net
`127.0.0.1 adtegrity.thruport.com
`127.0.0.1 a.mktw.net
`127.0.0.1 ads.pennyweb.com
`127.0.0.1 www3.ad.tomshardware.com
`127.0.0.1 www4.ad.tomshardware.com
`127.0.0.1 www6.ad.tomshardware.com
`127.0.0.1 www8.ad.tomshardware.com
`127.0.0.1 www15.ad.tomshardware.com
`127.0.0.1 ads.forbes.com
`127.0.0.1 ads.desmoinesregister.com
`127.0.0.1 adserver.tribuneinteractive.com
`127.0.0.1 bannerads.anytimenews.com
`127.0.0.1 ads1.condenet.com
`127.0.0.1 adserver.anm.co.uk
`127.0.0.1 zrap.zdnet.com.com
`127.0.0.1 bidclix.net
`127.0.0.1 media.popuptraffic.com
`127.0.0.1 coreg.flashtrack.net
`127.0.0.1 rmads.msn.com
`127.0.0.1 ads.icq.com
`127.0.0.1 cb.icq.com
`127.0.0.1 cf.icq.com
`127.0.0.1 www2.newtopsites.com
`127.0.0.1 adserv.internetfuel.com
`127.0.0.1 images.fastclick.net
`127.0.0.1 adserver.securityfocus.com
`127.0.0.1 www.avsads.com
`127.0.0.1 banners.moviegoods.com
`127.0.0.1 ads.bitsonthewire.com
`127.0.0.1 ads.iambic.com
`127.0.0.1 sfads.osdn.com
`127.0.0.1 fl01.ct2.comclick.com
`127.0.0.1 adserver.phillyburbs.com
`127.0.0.1 marketing.nyi.net
`127.0.0.1 www.netflip.com
`127.0.0.1 image.imgfarm.com
`127.0.0.1 ads.viaarena.com
`127.0.0.1 phpads2.cnpapers.com
`127.0.0.1 ads.astalavista.us
`127.0.0.1 banner.coza.com
`127.0.0.1 adcreative.tribuneinteractive.com
`127.0.0.1 ads.democratandchronicle.com
`127.0.0.1 adlog.com.com
`127.0.0.1 adimg.com.com
`127.0.0.1 adimage.bankrate.com
`127.0.0.1 ads.mediadevil.com
`127.0.0.1 imageserv.adtech.de
`127.0.0.1 ad.se.doubleclick.net
`127.0.0.1 ads.cashsurfers.com
`127.0.0.1 ads.specificpop.com
`127.0.0.1 z1.adserver.com
`127.0.0.1 images.bizrate.com
`127.0.0.1 q.pni.com
`127.0.0.1 ad01.mediacorpsingapore.com
`127.0.0.1 adimage.asia1.com.sg
`127.0.0.1 images.newsx.cc
`127.0.0.1 www.adireland.com
`127.0.0.1 ads.iafrica.com
`127.0.0.1 ads.nyi.net
`127.0.0.1 geoads.osdn.com
`127.0.0.1 www.crisscross.com
`127.0.0.1 netcomm.spinbox.net
`127.0.0.1 ads.videoaxs.com
`127.0.0.1 mediamgr.ugo.com
`127.0.0.1 adserver.pollstar.com
`127.0.0.1 information.gopher.com
`127.0.0.1 ads.adviva.net
`127.0.0.1 adsrv.bankrate.com
`127.0.0.1 a207.p.f.qz3.net
`127.0.0.1 ehg-bestbuy.hitbox.com
`127.0.0.1 ehg-intel.hitbox.com
`127.0.0.1 ehg-espn.hitbox.com
`127.0.0.1 ehg-macromedia.hitbox.com
`127.0.0.1 ehg-dig.hitbox.com
`127.0.0.1 speed.pointroll.com
`127.0.0.1 amch.questionmarket.com
`127.0.0.1 ads.gamespy.com
`127.0.0.1 spd.atdmt.com
`127.0.0.1 ads.columbian.com
`127.0.0.1 clickit.go2net.com
`127.0.0.1 vpdc.ru4.com
`127.0.0.1 ads.developershed.com
`127.0.0.1 ads.globeandmail.com
`127.0.0.1 ads.nerve.com
`127.0.0.1 iv.doubleclick.net
`127.0.0.1 ads2.condenet.com
`127.0.0.1 www.burstnet.com
`127.0.0.1 ads5.canoe.ca
`127.0.0.1 askmen.thruport.com
`127.0.0.1 adsrv2.gainesvillesun.com
`127.0.0.1 ads.theolympian.com
`127.0.0.1 ads.courierpostonline.com
`127.0.0.1 i.timeinc.net
`127.0.0.1 oasads.whitepages.com
`127.0.0.1 rad.msn.com
`127.0.0.1 serve.thisbanner.com
`127.0.0.1 images.trafficmp.com
`127.0.0.1 www.kaplanindex.com
`127.0.0.1 kaplanindex.com
`127.0.0.1 1.httpdads.com
`127.0.0.1 spinbox.maccentral.com
`127.0.0.1 akaads-abc.starwave.com
`127.0.0.1 webad.ajeeb.com
`127.0.0.1 ads.granadamedia.com
`127.0.0.1 oas.uniontrib.com
`127.0.0.1 ads.wnd.com
`127.0.0.1 a3.suntimes.com
`127.0.0.1 tmsads.tribune.com
`127.0.0.1 ads.peel.com
`127.0.0.1 ads.mh5.com
`127.0.0.1 ad.usatoday.com
`127.0.0.1 adserver.digitalpartners.com
`127.0.0.1 ads.mediaturf.net
`127.0.0.1 ads4.clearchannel.com
`127.0.0.1 ads.clearchannel.com
`127.0.0.1 ads2.clearchannel.com
`127.0.0.1 ads.jacksonsun.com
`127.0.0.1 servads.aip.org
`127.0.0.1 ad.au.doubleclick.net
`127.0.0.1 adng.ascii24.com
`127.0.0.1 engage.speedera.net
`127.0.0.1 ads.msn-ppe.com
`127.0.0.1 ad.openfind.com.tw
`127.0.0.1 adi.mainichi.co.jp
`127.0.0.1 ads.northjersey.com
`127.0.0.1 ad.moscowtimes.ru
`127.0.0.1 banners.valuead.com
`127.0.0.1 ad1.aaddzz.com
`127.0.0.1 ds.eyeblaster.com
`127.0.0.1 adserver.digitalpartners.com
`127.0.0.1 oas.uniontrib.com
`127.0.0.1 ads.statesmanjournal.com
`127.0.0.1 ads.centralohio.com
»Program Files
*C:\ntldr
*C:\ntdetect.com
*C:\io.sys
*C:\WINNT\system32\win.com
*C:\WINNT\explorer.exe
»%PATH% Companion Files
+C:\WINNT\system32\notepad.exe
*C:\WINNT\notepad.exe
+C:\WINNT\system32\slrundll.exe
*C:\WINNT\slrundll.exe
+C:\WINNT\system32\taskman.exe
*C:\WINNT\TASKMAN.EXE
+C:\WINNT\system32\winhlp32.exe
*C:\WINNT\winhlp32.exe
»System/Drivers
»Running Processes
+0=<idle>
+4=<system>
+364=\SystemRoot\System32\smss.exe
*C:\WINNT\system32\ntdll.dll
+412=<unkown>
+436=\??\C:\WINNT\system32\winlogon.exe
*C:\WINNT\system32\ntdll.dll
*C:\WINNT\system32\kernel32.dll
*C:\WINNT\system32\ADVAPI32.dll
*C:\WINNT\system32\RPCRT4.dll
*C:\WINNT\system32\AUTHZ.dll
*C:\WINNT\system32\msvcrt.dll
*C:\WINNT\system32\CRYPT32.dll
*C:\WINNT\system32\USER32.dll
*C:\WINNT\system32\GDI32.dll
*C:\WINNT\system32\MSASN1.dll
*C:\WINNT\system32\NDdeApi.dll
*C:\WINNT\system32\PROFMAP.dll
*C:\WINNT\system32\NETAPI32.dll
*C:\WINNT\system32\USERENV.dll
*C:\WINNT\system32\PSAPI.DLL
*C:\WINNT\system32\REGAPI.dll
*C:\WINNT\system32\Secur32.dll
*C:\WINNT\system32\SETUPAPI.dll
*C:\WINNT\system32\VERSION.dll
*C:\WINNT\system32\WINSTA.dll
*C:\WINNT\system32\WINTRUST.dll
*C:\WINNT\system32\IMAGEHLP.dll
*C:\WINNT\system32\WS2_32.dll
*C:\WINNT\system32\WS2HELP.dll
*C:\WINNT\system32\MSGINA.dll
*C:\WINNT\system32\SHELL32.dll
*C:\WINNT\system32\SHLWAPI.dll
*C:\WINNT\system32\COMCTL32.dll
*C:\WINNT\system32\ODBC32.dll
*C:\WINNT\system32\comdlg32.dll
*C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
*C:\WINNT\system32\odbcint.dll
*C:\WINNT\system32\SHSVCS.dll
*C:\WINNT\system32\sfc.dll
*C:\WINNT\system32\sfc_os.dll
*C:\WINNT\system32\ole32.dll
*C:\WINNT\system32\Apphelp.dll
*C:\WINNT\system32\WINSCARD.DLL
*C:\WINNT\system32\WTSAPI32.dll
*C:\WINNT\system32\sxs.dll
*C:\WINNT\system32\uxtheme.dll
*C:\WINNT\system32\WINMM.dll
*C:\WINNT\system32\cscdll.dll
*C:\WINNT\system32\WlNotify.dll
*C:\WINNT\system32\WINSPOOL.DRV
*C:\WINNT\system32\MPR.dll
*C:\WINNT\system32\rsaenh.dll
*C:\WINNT\system32\SAMLIB.dll
*C:\WINNT\system32\hrp8057ue.dll
*C:\WINNT\system32\OLEAUT32.dll
*C:\WINNT\system32\oledlg.dll
*C:\WINNT\system32\urlmon.dll
*C:\WINNT\system32\WININET.dll
*C:\WINNT\system32\RASAPI32.DLL
*C:\WINNT\system32\rasman.dll
*C:\WINNT\system32\TAPI32.dll
*C:\WINNT\system32\rtutils.dll
*C:\WINNT\system32\msv1_0.dll
*C:\WINNT\system32\iphlpapi.dll
*C:\WINNT\system32\mswsock.dll
*C:\WINNT\system32\hnetcfg.dll
*C:\WINNT\System32\wshtcpip.dll
*C:\WINNT\system32\DNSAPI.dll
*C:\WINNT\System32\winrnr.dll
*C:\WINNT\system32\WLDAP32.dll
*C:\WINNT\system32\rasadhlp.dll
*C:\WINNT\system32\cscui.dll
*C:\WINNT\system32\xpsp2res.dll
*C:\WINNT\system32\NTMARTA.DLL
*C:\WINNT\system32\wdmaud.drv
*C:\WINNT\system32\msacm32.drv
*C:\WINNT\system32\MSACM32.dll
*C:\WINNT\system32\midimap.dll
*C:\WINNT\system32\COMRes.dll
*C:\WINNT\system32\CLBCATQ.DLL
+480=C:\WINNT\system32\services.exe
*C:\WINNT\system32\ntdll.dll
*C:\WINNT\system32\kernel32.dll
*C:\WINNT\system32\msvcrt.dll
*C:\WINNT\system32\ADVAPI32.dll
*C:\WINNT\system32\RPCRT4.dll
*C:\WINNT\system32\USER32.dll
*C:\WINNT\system32\GDI32.dll
*C:\WINNT\system32\USERENV.dll
*C:\WINNT\system32\SCESRV.dll
*C:\WINNT\system32\AUTHZ.dll
*C:\WINNT\system32\umpnpmgr.dll
*C:\WINNT\system32\WINSTA.dll
*C:\WINNT\system32\NETAPI32.dll
*C:\WINNT\system32\NCObjAPI.DLL
*C:\WINNT\system32\MSVCP60.dll
*C:\WINNT\system32\ShimEng.dll
*C:\WINNT\AppPatch\AcGenral.DLL
*C:\WINNT\system32\WINMM.dll
*C:\WINNT\system32\ole32.dll
*C:\WINNT\system32\OLEAUT32.dll
*C:\WINNT\system32\MSACM32.dll
*C:\WINNT\system32\VERSION.dll
*C:\WINNT\system32\SHELL32.dll
*C:\WINNT\system32\SHLWAPI.dll
*C:\WINNT\system32\UxTheme.dll
*C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
*C:\WINNT\system32\comctl32.dll
*C:\WINNT\system32\secur32.dll
*C:\WINNT\system32\Apphelp.dll
*C:\WINNT\system32\eventlog.dll
*C:\WINNT\system32\WS2_32.dll
*C:\WINNT\system32\WS2HELP.dll
*C:\WINNT\system32\PSAPI.DLL
*C:\WINNT\system32\wtsapi32.dll
+492=C:\WINNT\system32\lsass.exe
*C:\WINNT\system32\ntdll.dll
*C:\WINNT\system32\kernel32.dll
*C:\WINNT\system32\ADVAPI32.dll
*C:\WINNT\system32\RPCRT4.dll
*C:\WINNT\system32\LSASRV.dll
*C:\WINNT\system32\MPR.dll
*C:\WINNT\system32\USER32.dll
*C:\WINNT\system32\GDI32.dll
*C:\WINNT\system32\MSASN1.dll
*C:\WINNT\system32\msvcrt.dll
*C:\WINNT\system32\NETAPI32.dll
*C:\WINNT\system32\NTDSAPI.dll
*C:\WINNT\system32\DNSAPI.dll
*C:\WINNT\system32\WS2_32.dll
*C:\WINNT\system32\WS2HELP.dll
*C:\WINNT\system32\WLDAP32.dll
*C:\WINNT\system32\Secur32.dll
*C:\WINNT\system32\SAMLIB.dll
*C:\WINNT\system32\SAMSRV.dll
*C:\WINNT\system32\cryptdll.dll
*C:\WINNT\system32\ShimEng.dll
*C:\WINNT\AppPatch\AcGenral.DLL
*C:\WINNT\system32\WINMM.dll
*C:\WINNT\system32\ole32.dll
*C:\WINNT\system32\OLEAUT32.dll
*C:\WINNT\system32\MSACM32.dll
*C:\WINNT\system32\VERSION.dll
*C:\WINNT\system32\SHELL32.dll
*C:\WINNT\system32\SHLWAPI.dll
*C:\WINNT\system32\USERENV.dll
*C:\WINNT\system32\UxTheme.dll
*C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
*C:\WINNT\system32\comctl32.dll
*C:\WINNT\system32\msprivs.dll
*C:\WINNT\system32\kerberos.dll
*C:\WINNT\system32\msv1_0.dll
*C:\WINNT\system32\iphlpapi.dll
*C:\WINNT\system32\netlogon.dll
*C:\WINNT\system32\w32time.dll
*C:\WINNT\system32\MSVCP60.dll
*C:\WINNT\system32\schannel.dll
*C:\WINNT\system32\CRYPT32.dll
*C:\WINNT\system32\wdigest.dll
*C:\WINNT\system32\rsaenh.dll
*C:\WINNT\system32\scecli.dll
*C:\WINNT\system32\SETUPAPI.dll
*C:\WINNT\system32\ipsecsvc.dll
*C:\WINNT\system32\AUTHZ.dll
*C:\WINNT\system32\oakley.DLL
*C:\WINNT\system32\WINIPSEC.DLL
*C:\WINNT\system32\mswsock.dll
*C:\WINNT\system32\hnetcfg.dll
*C:\WINNT\System32\wshtcpip.dll
*C:\WINNT\system32\dssenh.dll
*C:\WINNT\system32\pstorsvc.dll
*C:\WINNT\system32\psbase.dll
+636=C:\WINNT\system32\svchost.exe
*C:\WINNT\system32\ntdll.dll
*C:\WINNT\system32\kernel32.dll
*C:\WINNT\system32\ADVAPI32.dll
*C:\WINNT\system32\RPCRT4.dll
*C:\WINNT\system32\ShimEng.dll
*C:\WINNT\AppPatch\AcGenral.DLL
*C:\WINNT\system32\USER32.dll
*C:\WINNT\system32\GDI32.dll
*C:\WINNT\system32\WINMM.dll
*C:\WINNT\system32\ole32.dll
*C:\WINNT\system32\msvcrt.dll
*C:\WINNT\system32\OLEAUT32.dll
*C:\WINNT\system32\MSACM32.dll
*C:\WINNT\system32\VERSION.dll
*C:\WINNT\system32\SHELL32.dll
*C:\WINNT\system32\SHLWAPI.dll
*C:\WINNT\system32\USERENV.dll
*C:\WINNT\system32\UxTheme.dll
*C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
*C:\WINNT\system32\comctl32.dll
*C:\WINNT\system32\NTMARTA.DLL
*C:\WINNT\system32\WLDAP32.dll
*C:\WINNT\system32\SAMLIB.dll
*c:\winnt\system32\rpcss.dll
*c:\winnt\system32\WS2_32.dll
*c:\winnt\system32\WS2HELP.dll
*c:\winnt\system32\Secur32.dll
*C:\WINNT\system32\xpsp2res.dll
*C:\WINNT\system32\CLBCATQ.DLL
*C:\WINNT\system32\COMRes.dll
*c:\winnt\system32\termsrv.dll
*c:\winnt\system32\ICAAPI.dll
*c:\winnt\system32\SETUPAPI.dll
*C:\WINNT\system32\WINTRUST.dll
*C:\WINNT\system32\CRYPT32.dll
*C:\WINNT\system32\MSASN1.dll
*C:\WINNT\system32\IMAGEHLP.dll
*c:\winnt\system32\AUTHZ.dll
*c:\winnt\system32\mstlsapi.dll
*c:\winnt\system32\ACTIVEDS.dll
*c:\winnt\system32\adsldpc.dll
*C:\WINNT\system32\NETAPI32.dll
*c:\winnt\system32\ATL.DLL
*C:\WINNT\system32\REGAPI.dll
*C:\WINNT\system32\rsaenh.dll
*C:\WINNT\system32\msi.dll
*C:\WINNT\system32\Apphelp.dll
+692=<unkown>
+732=C:\WINNT\System32\svchost.exe
*C:\WINNT\system32\ntdll.dll
*C:\WINNT\system32\kernel32.dll
*C:\WINNT\system32\ADVAPI32.dll
*C:\WINNT\system32\RPCRT4.dll
*C:\WINNT\System32\ShimEng.dll
*C:\WINNT\AppPatch\AcGenral.DLL
*C:\WINNT\system32\USER32.dll
*C:\WINNT\system32\GDI32.dll
*C:\WINNT\System32\WINMM.dll
*C:\WINNT\system32\ole32.dll
*C:\WINNT\system32\msvcrt.dll
*C:\WINNT\system32\OLEAUT32.dll
*C:\WINNT\System32\MSACM32.dll
*C:\WINNT\system32\VERSION.dll
*C:\WINNT\system32\SHELL32.dll
*C:\WINNT\system32\SHLWAPI.dll
*C:\WINNT\system32\USERENV.dll
*C:\WINNT\System32\UxTheme.dll
*C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
*C:\WINNT\system32\comctl32.dll
*C:\WINNT\System32\NTMARTA.DLL
*C:\WINNT\system32\WLDAP32.dll
*C:\WINNT\System32\SAMLIB.dll
*C:\WINNT\System32\xpsp2res.dll
*c:\winnt\system32\shsvcs.dll
*C:\WINNT\System32\WINSTA.dll
*C:\WINNT\system32\NETAPI32.dll
*c:\winnt\system32\dhcpcsvc.dll
*c:\winnt\system32\DNSAPI.dll
*c:\winnt\system32\WS2_32.dll
*c:\winnt\system32\WS2HELP.dll
*c:\winnt\system32\iphlpapi.dll
*c:\winnt\system32\Secur32.dll
*C:\WINNT\System32\rsaenh.dll
*C:\WINNT\system32\mswsock.dll
*C:\WINNT\System32\hnetcfg.dll
*C:\WINNT\System32\wshtcpip.dll
*c:\winnt\system32\wzcsvc.dll
*c:\winnt\system32\rtutils.dll
*c:\winnt\system32\WMI.dll
*C:\WINNT\system32\CRYPT32.dll
*C:\WINNT\system32\MSASN1.dll
*c:\winnt\system32\WTSAPI32.dll
*c:\winnt\system32\ESENT.dll
*c:\winnt\system32\ATL.DLL
*C:\WINNT\System32\rastls.dll
*C:\WINNT\system32\CRYPTUI.dll
*C:\WINNT\system32\WINTRUST.dll
*C:\WINNT\system32\IMAGEHLP.dll
*C:\WINNT\system32\WININET.dll
*C:\WINNT\System32\MPRAPI.dll
*C:\WINNT\System32\ACTIVEDS.dll
*C:\WINNT\System32\adsldpc.dll
*C:\WINNT\System32\SETUPAPI.dll
*C:\WINNT\System32\RASAPI32.dll
*C:\WINNT\System32\rasman.dll
*C:\WINNT\System32\TAPI32.dll
*C:\WINNT\System32\SCHANNEL.dll
*C:\WINNT\System32\WinSCard.dll
*C:\WINNT\System32\raschap.dll
*C:\WINNT\system32\msv1_0.dll
*C:\WINNT\System32\CLBCATQ.DLL
*C:\WINNT\System32\COMRes.dll
*c:\winnt\system32\schedsvc.dll
*c:\winnt\system32\NTDSAPI.dll
*C:\WINNT\System32\MSIDLE.DLL
*c:\winnt\system32\audiosrv.dll
*c:\winnt\system32\wkssvc.dll
*c:\winnt\system32\cryptsvc.dll
*c:\winnt\system32\certcli.dll
*c:\winnt\system32\ersvc.dll
*c:\winnt\system32\es.dll
*c:\winnt\pchealth\helpctr\binaries\pchsvc.dll
*c:\winnt\system32\srvsvc.dll
*C:\WINNT\System32\winspool.drv
*c:\winnt\system32\netman.dll
*c:\winnt\system32\netshell.dll
*c:\winnt\system32\credui.dll
*c:\winnt\system32\WZCSAPI.DLL
*c:\winnt\system32\seclogon.dll
*c:\winnt\system32\sens.dll
*c:\winnt\system32\srsvc.dll
*c:\winnt\system32\POWRPROF.dll
*C:\WINNT\System32\SXS.DLL
*c:\winnt\system32\tapisrv.dll
*c:\winnt\system32\PSAPI.DLL
*c:\winnt\system32\trkwks.dll
*c:\winnt\system32\w32time.dll
*c:\winnt\system32\MSVCP60.dll
*c:\winnt\system32\wbem\wmisvc.dll
*C:\WINNT\system32\VSSAPI.DLL
*c:\winnt\system32\wuauserv.dll
*C:\WINNT\system32\wuaueng.dll
*C:\WINNT\System32\ADVPACK.dll
*C:\WINNT\System32\SHFOLDER.dll
*C:\WINNT\System32\WINHTTP.dll
*C:\WINNT\System32\Cabinet.dll
*C:\WINNT\System32\mspatcha.dll
*C:\WINNT\System32\sfc.dll
*C:\WINNT\System32\sfc_os.dll
*c:\winnt\system32\browser.dll
*C:\WINNT\System32\MSXML3.DLL
*C:\WINNT\system32\comsvcs.dll
*C:\WINNT\system32\MTXCLU.DLL
*C:\WINNT\system32\WSOCK32.dll
*C:\WINNT\system32\colbact.DLL
*C:\WINNT\System32\CLUSAPI.DLL
*C:\WINNT\System32\RESUTILS.DLL
*c:\winnt\system32\ipnathlp.dll
*c:\winnt\system32\AUTHZ.dll
*c:\winnt\system32\wscsvc.dll
*c:\winnt\system32\msi.dll
*C:\WINNT\System32\wbem\wbemcomn.dll
*C:\WINNT\System32\Wbem\wbemcore.dll
*C:\WINNT\System32\Wbem\esscli.dll
*C:\WINNT\System32\Wbem\FastProx.dll
*C:\WINNT\System32\wbem\wbemsvc.dll
*C:\WINNT\System32\wbem\wmiutils.dll
*C:\WINNT\System32\wbem\repdrvfs.dll
*C:\WINNT\System32\wbem\wmiprvsd.dll
*C:\WINNT\system32\NCObjAPI.DLL
*C:\WINNT\System32\wbem\wbemess.dll
*C:\WINNT\System32\wbem\ncprov.dll
*c:\winnt\system32\rasmans.dll
*c:\winnt\system32\WINIPSEC.DLL
*c:\winnt\system32\netcfgx.dll
*C:\WINNT\System32\rasadhlp.dll
*C:\WINNT\System32\rastapi.dll
*C:\WINNT\System32\unimdm.tsp
*C:\WINNT\System32\uniplat.dll
*C:\WINNT\System32\upnp.dll
*C:\WINNT\System32\SSDPAPI.dll
*C:\WINNT\System32\kmddsp.tsp
*C:\WINNT\System32\ndptsp.tsp
*C:\WINNT\System32\ipconf.tsp
*C:\WINNT\System32\h323.tsp
*C:\WINNT\System32\hidphone.tsp
*C:\WINNT\System32\HID.DLL
*C:\WINNT\System32\rasppp.dll
*C:\WINNT\System32\ntlsapi.dll
*C:\WINNT\system32\kerberos.dll
*C:\WINNT\System32\cryptdll.dll
*C:\WINNT\System32\RASDLG.dll
*C:\WINNT\System32\wups.dll
*C:\WINNT\System32\winrnr.dll
*C:\WINNT\System32\dssenh.dll
*C:\WINNT\System32\cryptnet.dll
*C:\WINNT\System32\SensApi.dll
+788=<unkown>
+868=<unkown>
+1024=C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
*C:\WINNT\system32\ntdll.dll
*C:\WINNT\system32\kernel32.dll
*C:\WINNT\system32\WS2_32.dll
*C:\WINNT\system32\msvcrt.dll
*C:\WINNT\system32\WS2HELP.dll
*C:\WINNT\system32\ADVAPI32.dll
*C:\WINNT\system32\RPCRT4.dll
*C:\WINNT\system32\SYMREDIR.dll
*C:\WINNT\system32\USER32.dll
*C:\WINNT\system32\GDI32.dll
*C:\WINNT\system32\ole32.dll
*C:\WINNT\system32\SHLWAPI.dll
*C:\WINNT\system32\SymNeti.DLL
*C:\WINNT\system32\SHELL32.dll
*C:\WINNT\system32\OLEAUT32.dll
*C:\WINNT\system32\MSVCP60.dll
*C:\WINNT\system32\MSVCP71.dll
*C:\WINNT\system32\MSVCR71.dll
*C:\Program Files\Common Files\Symantec Shared\ccL30.dll
*C:\WINNT\system32\VERSION.dll
*C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
*C:\WINNT\system32\comctl32.dll
*C:\WINNT\system32\DBGHELP.DLL
*C:\WINNT\system32\IMM32.DLL
*C:\WINNT\system32\Secur32.dll
*C:\WINNT\system32\mswsock.dll
*C:\WINNT\system32\hnetcfg.dll
*C:\WINNT\System32\wshtcpip.dll
*C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll
*C:\WINNT\system32\SETUPAPI.dll
*C:\WINNT\system32\WSOCK32.dll
*C:\WINNT\system32\Crypt32.dll
*C:\WINNT\system32\MSASN1.dll
*C:\WINNT\system32\WinTrust.dll
*C:\WINNT\system32\IMAGEHLP.dll
*C:\WINNT\system32\rsaenh.dll
*C:\WINNT\system32\xpsp2res.dll
*C:\WINNT\system32\userenv.dll
*C:\WINNT\system32\netapi32.dll
*C:\Program Files\Common Files\Symantec Shared\ccSet.dll
*C:\WINNT\system32\CLBCATQ.DLL
*C:\WINNT\system32\COMRes.dll
*C:\WINNT\system32\msi.dll
*C:\WINNT\system32\SXS.DLL
*C:\Program Files\Common Files\Symantec Shared\DPHTML.dll
*C:\Program Files\Common Files\Symantec Shared\DPJS.dll
*C:\Program Files\Common Files\Symantec Shared\DPVBS.dll
*C:\Program Files\Common Files\Symantec Shared\PFPriv.dll
*C:\Program Files\Common Files\Symantec Shared\PFRes.dll
*C:\Program Files\Norton Internet Security\SYMURL.DLL
*C:\Program Files\Norton Internet Security\NISRES.DLL
*C:\Program Files\Common Files\Symantec Shared\ccProSub.dll
*C:\Program Files\Common Files\Symantec Shared\PFSec.dll
*C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll
*C:\Program Files\Common Files\Symantec Shared\PFAdBlk.dll
*C:\Program Files\Common Files\Symantec Shared\PFMisc.dll
*C:\Program Files\Common Files\Symantec Shared\PxyHTTP.dll
*C:\Program Files\Common Files\Symantec Shared\DPHTTP.dll
*C:\Program Files\Common Files\Symantec Shared\PxyIM.dll
*C:\Program Files\Common Files\Symantec Shared\PxyNNTP.dll
*C:\Program Files\Common Files\Symantec Shared\ccPxyEvt.dll
*C:\Program Files\Common Files\Symantec Shared\ccLogin.dll
*C:\Program Files\Common Files\Symantec Shared\ccCharCv.dll
+1036=C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
*C:\WINNT\system32\ntdll.dll
*C:\WINNT\system32\kernel32.dll
*C:\WINNT\system32\USER32.dll
*C:\WINNT\system32\GDI32.dll
*C:\WINNT\system32\ADVAPI32.dll
*C:\WINNT\system32\RPCRT4.dll
*C:\WINNT\system32\ole32.dll
*C:\WINNT\system32\msvcrt.dll
*C:\WINNT\system32\OLEAUT32.dll
*C:\WINNT\system32\SHLWAPI.dll
*C:\WINNT\system32\MSVCP71.dll
*C:\WINNT\system32\MSVCR71.dll
*C:\Program Files\Common Files\Symantec Shared\ccL30.dll
*C:\WINNT\system32\SHELL32.dll
*C:\WINNT\system32\WS2_32.dll
*C:\WINNT\system32\WS2HELP.dll
*C:\WINNT\system32\VERSION.dll
*C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
*C:\WINNT\system32\comctl32.dll
*C:\WINNT\system32\DBGHELP.DLL
*C:\WINNT\system32\IMM32.DLL
*C:\WINNT\system32\Secur32.dll
*C:\WINNT\system32\WTSAPI32.DLL
*C:\WINNT\system32\WINSTA.dll
*C:\WINNT\system32\NETAPI32.dll
*C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll
*C:\WINNT\system32\SETUPAPI.dll
*C:\WINNT\system32\WSOCK32.dll
*C:\WINNT\system32\Crypt32.dll
*C:\WINNT\system32\MSASN1.dll
*C:\WINNT\system32\WinTrust.dll
*C:\WINNT\system32\IMAGEHLP.dll
*C:\WINNT\system32\xpsp2res.dll
*C:\WINNT\system32\CLBCATQ.DLL
*C:\WINNT\system32\COMRes.dll
*C:\WINNT\system32\msi.dll
*C:\WINNT\system32\USERENV.dll
*C:\WINNT\system32\SXS.DLL
*C:\WINNT\system32\rsaenh.dll
*C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll
+1048=C:\Program Files\Norton Internet Security\ISSVC.exe
*C:\WINNT\system32\ntdll.dll
*C:\WINNT\system32\kernel32.dll
*C:\WINNT\system32\SymNeti.DLL
*C:\WINNT\system32\USER32.dll
*C:\WINNT\system32\GDI32.dll
*C:\WINNT\system32\ADVAPI32.dll
*C:\WINNT\system32\RPCRT4.dll
*C:\WINNT\system32\SHELL32.dll
*C:\WINNT\system32\msvcrt.dll
*C:\WINNT\system32\SHLWAPI.dll
*C:\WINNT\system32\ole32.dll
*C:\WINNT\system32\OLEAUT32.dll
*C:\WINNT\system32\MSVCP60.dll
*C:\Program Files\Norton Internet Security\NISRES.DLL
*C:\WINNT\system32\msi.dll
*C:\WINNT\system32\USERENV.dll
*C:\WINNT\system32\MSVCP71.dll
*C:\WINNT\system32\MSVCR71.dll
*C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
*C:\WINNT\system32\comctl32.dll
*C:\Program Files\Common Files\Symantec Shared\ccL30.dll
*C:\WINNT\system32\WS2_32.dll
*C:\WINNT\system32\WS2HELP.dll
*C:\WINNT\system32\VERSION.dll
*C:\WINNT\system32\DBGHELP.DLL
*C:\WINNT\system32\IMM32.DLL
*C:\WINNT\system32\Secur32.dll
*C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll
*C:\WINNT\system32\SETUPAPI.dll
*C:\WINNT\system32\WSOCK32.dll
*C:\WINNT\system32\Crypt32.dll
*C:\WINNT\system32\MSASN1.dll
*C:\WINNT\system32\WinTrust.dll
*C:\WINNT\system32\IMAGEHLP.dll
*C:\WINNT\system32\rsaenh.dll
*C:\WINNT\system32\xpsp2res.dll
*C:\WINNT\system32\netapi32.dll
*C:\Program Files\Norton Internet Security\ObrkData.dll
*C:\WINNT\system32\WININET.dll
*C:\Program Files\Common Files\Symantec Shared\ccSet.dll
*C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll
*C:\Program Files\Common Files\Symantec Shared\ccProSub.dll
*C:\WINNT\system32\CLBCATQ.DLL
*C:\WINNT\system32\COMRes.dll
*C:\WINNT\system32\SXS.DLL
*C:\WINNT\system32\urlmon.dll
*C:\WINNT\System32\wbem\wbemprox.dll
*C:\WINNT\System32\wbem\wbemcomn.dll
*C:\WINNT\System32\wbem\wbemsvc.dll
*C:\WINNT\System32\wbem\fastprox.dll
*C:\WINNT\system32\NTDSAPI.dll
*C:\WINNT\system32\DNSAPI.dll
*C:\WINNT\system32\WLDAP32.dll
*C:\WINNT\system32\RASAPI32.DLL
*C:\WINNT\system32\rasman.dll
*C:\WINNT\system32\TAPI32.dll
*C:\WINNT\system32\rtutils.dll
*C:\WINNT\system32\WINMM.dll
*C:\WINNT\system32\msv1_0.dll
*C:\WINNT\system32\iphlpapi.dll
*C:\WINNT\system32\sensapi.dll
*C:\WINNT\System32\mswsock.dll
*C:\WINNT\System32\winrnr.dll
*C:\WINNT\system32\rasadhlp.dll
*C:\WINNT\system32\hnetcfg.dll
*C:\WINNT\System32\wshtcpip.dll
+1064=C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
*C:\WINNT\system32\ntdll.dll
*C:\WINNT\system32\kernel32.dll
*C:\WINNT\system32\USER32.dll
*C:\WINNT\system32\GDI32.dll
*C:\WINNT\system32\ADVAPI32.dll
*C:\WINNT\system32\RPCRT4.dll
*C:\WINNT\system32\ole32.dll
*C:\WINNT\system32\msvcrt.dll
*C:\WINNT\system32\OLEAUT32.dll
*C:\WINNT\system32\SymNeti.DLL
*C:\WINNT\system32\SHELL32.dll
*C:\WINNT\system32\SHLWAPI.dll
*C:\WINNT\system32\MSVCP60.dll
*C:\WINNT\system32\WS2_32.dll
*C:\WINNT\system32\WS2HELP.dll
*C:\WINNT\system32\iphlpapi.dll
*C:\WINNT\system32\VERSION.dll
*C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
*C:\WINNT\system32\comctl32.dll
*C:\WINNT\system32\RASAPI32.DLL
*C:\WINNT\system32\rasman.dll
*C:\WINNT\system32\NETAPI32.dll
*C:\WINNT\system32\TAPI32.dll
*C:\WINNT\system32\rtutils.dll
*C:\WINNT\system32\WINMM.dll
*C:\WINNT\system32\Secur32.dll
*C:\WINNT\system32\rsaenh.dll
*C:\WINNT\system32\xpsp2res.dll
*C:\WINNT\system32\userenv.dll
*C:\WINNT\system32\CLBCATQ.DLL
*C:\WINNT\system32\COMRes.dll
*C:\WINNT\system32\MPRAPI.dll
*C:\WINNT\system32\ACTIVEDS.dll
*C:\WINNT\system32\adsldpc.dll
*C:\WINNT\system32\WLDAP32.dll
*C:\WINNT\system32\ATL.DLL
*C:\WINNT\system32\SAMLIB.dll
*C:\WINNT\system32\SETUPAPI.dll
*C:\WINNT\system32\msi.dll
*C:\WINNT\system32\SXS.DLL
+1132=C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
*C:\WINNT\system32\ntdll.dll
*C:\WINNT\system32\kernel32.dll
*C:\WINNT\system32\USER32.dll
*C:\WINNT\system32\GDI32.dll
*C:\WINNT\system32\ole32.dll
*C:\WINNT\system32\msvcrt.dll
*C:\WINNT\system32\ADVAPI32.dll
*C:\WINNT\system32\RPCRT4.dll
*C:\WINNT\system32\OLEAUT32.dll
*C:\WINNT\system32\SHLWAPI.dll
*C:\WINNT\system32\MSVCP71.dll
*C:\WINNT\system32\MSVCR71.dll
*C:\Program Files\Common Files\Symantec Shared\ccL30.dll
*C:\WINNT\system32\SHELL32.dll
*C:\WINNT\system32\WS2_32.dll
*C:\WINNT\system32\WS2HELP.dll
*C:\WINNT\system32\VERSION.dll
*C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
*C:\WINNT\system32\comctl32.dll
*C:\WINNT\system32\DBGHELP.DLL
*C:\WINNT\system32\IMM32.DLL
*C:\WINNT\system32\Secur32.dll
*C:\WINNT\system32\xpsp2res.dll
*C:\WINNT\system32\Crypt32.dll
*C:\WINNT\system32\MSASN1.dll
*C:\WINNT\system32\WinTrust.dll
*C:\WINNT\system32\IMAGEHLP.dll
*C:\WINNT\system32\rsaenh.dll
*C:\WINNT\system32\userenv.dll
*C:\WINNT\system32\netapi32.dll
*C:\WINNT\system32\CLBCATQ.DLL
*C:\WINNT\system32\COMRes.dll
*C:\WINNT\system32\msi.dll
*C:\WINNT\system32\SXS.DLL
*C:\WINNT\system32\WTSAPI32.DLL
*C:\WINNT\system32\WINSTA.dll
*C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll
*C:\WINNT\system32\SETUPAPI.dll
*C:\WINNT\system32\WSOCK32.dll
*C:\PROGRA~1\COMMON~1\SYMANT~1\ANTISPAM\ASSPMEVT.DLL
*C:\PROGRA~1\COMMON~1\SYMANT~1\SPBBC\SPBBCEVT.DLL
*C:\PROGRA~1\COMMON~1\SYMANT~1\CCLOGIN.DLL
*C:\Program Files\Common Files\Symantec Shared\ccSet.dll
*C:\PROGRA~1\COMMON~1\SYMANT~1\CCPXYEVT.DLL
*C:\PROGRA~1\COMMON~1\SYMANT~1\CCSETEVT.DLL
*C:\PROGRA~1\NORTON~2\NORTON~1\NAVEVENT.DLL
*C:\WINNT\SYSTEM32\SYMNETI.DLL
*C:\WINNT\SYSTEM32\MSVCP60.dll
+1308=C:\WINNT\Explorer.EXE
*C:\WINNT\system32\ntdll.dll
*C:\WINNT\system32\kernel32.dll
*C:\WINNT\system32\msvcrt.dll
*C:\WINNT\system32\ADVAPI32.dll
*C:\WINNT\system32\RPCRT4.dll
*C:\WINNT\system32\GDI32.dll
*C:\WINNT\system32\USER32.dll
*C:\WINNT\system32\SHLWAPI.dll
*C:\WINNT\system32\SHELL32.dll
*C:\WINNT\system32\ole32.dll
*C:\WINNT\system32\OLEAUT32.dll
*C:\WINNT\system32\BROWSEUI.dll
*C:\WINNT\system32\SHDOCVW.dll
*C:\WINNT\system32\CRYPT32.dll
*C:\WINNT\system32\MSASN1.dll
*C:\WINNT\system32\CRYPTUI.dll
*C:\WINNT\system32\WINTRUST.dll
*C:\WINNT\system32\IMAGEHLP.dll
*C:\WINNT\system32\NETAPI32.dll
*C:\WINNT\system32\WININET.dll
*C:\WINNT\system32\WLDAP32.dll
*C:\WINNT\system32\VERSION.dll
*C:\WINNT\system32\UxTheme.dll
*C:\WINNT\system32\ShimEng.dll
*C:\WINNT\AppPatch\AcGenral.DLL
*C:\WINNT\system32\WINMM.dll
*C:\WINNT\system32\MSACM32.dll
*C:\WINNT\system32\USERENV.dl