|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
Thread Tools |
05-11-2007, 11:54 AM
|
#1 (permalink) |
|
Registered User
Join Date: Nov 2005
Posts: 9
OS: XP
|
Help a.bat trojan virus
I keep getting a.bat virus come up after reboot.
Here is my Hijackthis log. Logfile of HijackThis v1.99.1 Scan saved at 18:34:25, on 11/05/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\brss01a.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\torwin32.exe C:\WINDOWS\system32\svchost32.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\nvsvc32.exe C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\uTorrent\uTorrent.exe C:\Program Files\mIRC\mirc.exe C:\Program Files\Microsoft Office\Office12\WINWORD.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\XP Repair Pro 2007\XPRepairPro.exe C:\DOCUME~1\Admin\LOCALS~1\Temp\Rar$EX00.891\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.divx.com/divx/webplayerdem...ist=divxdotcom R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [torwin32] torwin32.exe O4 - HKLM\..\Run: [lsass] svchost32.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\RunServices: [torwin32] torwin32.exe O4 - HKLM\..\RunServices: [lsass] svchost32.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [XPRepairPro2007] C:\Program Files\XP Repair Pro 2007\XPRepairPro.exe /r O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll O11 - Options group: [INTERNATIONAL] International* O17 - HKLM\System\CCS\Services\Tcpip\..\{1A808A27-9101-4661-9E20-A0596C6EB217}: NameServer = 192.168.0.1,192.168.0.2 O17 - HKLM\System\CS1\Services\Tcpip\..\{1A808A27-9101-4661-9E20-A0596C6EB217}: NameServer = 192.168.0.1,192.168.0.2 O17 - HKLM\System\CS2\Services\Tcpip\..\{1A808A27-9101-4661-9E20-A0596C6EB217}: NameServer = 216.104.64.5,216.104.72.5 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing) O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe Thanks in advance  Last edited by Mazda : 05-11-2007 at 11:56 AM. |
|
     |
|
05-13-2007, 05:12 AM
|
#2 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Help a.bat trojan virus
Hi and welcome to TSF.
My name is Iain and I will be helping you clean your system. You may wish to Subscribe to this thread (Thread Tools > Subscribe to this thread) so that you are notified when you receive a reply. Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers or live internet connections when you are following the procedures below. Note that the fix may take several posts. Please continue to respond to my instructions until I confirm that your log is clean. Remember that although your symptoms may vanish, this does NOT mean that your system is clean. If there is anything you don't understand, please ask BEFORE proceeding with the fixes. Please ensure that you follow the instructions in the order I have them listed. P2P - I see you have P2P software (i.e. uTorrent) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. P2P file sharing is used as a major conduit to spread malware. Show Hidden Files Go to My Computer > Tools > Folder Options > View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System files and Folders are showing / visible. Uncheck the Hide protected operating system files option. Downloads Please download Cleanup! or use this Alternate Link if the main link does not work and install it. You will use this later. *NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW! Download AVG Anti Spyware Use the link at the bottom of the page under "AVG Anti-Spyware Free for Windows" 
When you have finished updating, EXIT AVG Anti Spyware. Please download combofix.exe to your desktop. Alternate link. IMPORTANT - You must place combofix on your desktop!! Double click combofix.exe & follow the prompts. When finished, the tool will produce a log for you at c:\combofix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window while it's running. That may cause it to stall. Disable AdWatch Please disable AdWatch, as it may hinder the removal of some entries. You can re-enable it after you're clean. To disable AdWatch:
Reboot Reboot your system in Safe Mode.
HijackThis Entries Open Hijack This and click on Scan. Check the following entries (if they still exist) (make sure you do not miss any) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O4 - HKLM\..\Run: [torwin32] torwin32.exe O4 - HKLM\..\Run: [lsass] svchost32.exe O4 - HKLM\..\RunServices: [torwin32] torwin32.exe O4 - HKLM\..\RunServices: [lsass] svchost32.exe Please remember to close all other windows, including browsers then click Fix checked. File Deletions Delete the following File indicated in RED if it still exists. C:\WINDOWS\system32\torwin32.exe Run CleanUp! *NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW! Open Cleanup! by double-clicking the icon on your desktop (or from Start > All Programs). Set the program up as follows: Click Options Move the slider button down to Custom CleanUp! Check the following:
Click OK, Press the CleanUp! button to start the program and DO NOT REBOOT when prompted. Note: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these BEFORE running CleanUp! If you have a 64 bit Operating System do NOT run Cleanup and let me know as we will use another utility. Run AVG Anti Spyware Run AVG with it's updated definitions (...it's important that all windows must be closed)
NOTE: AVG scan may require an hour. Reboot Reboot your system in Normal Mode. Online Scan Perform an online scan with Internet Explorer with Panda ActiveScan
* Turn off the real time scanner of any existing antivirus program while performing the online scan Deckard's System Scanner - Download and Run Download Deckard's System Scanner (DSS) to your Desktop . Note: You must be logged onto an account with administrator privileges.
To attach a file to a new post, simply
Logs required c:\combofix.txt AVG Log Panda Log main.txt and attach C:\Deckard\System Scanner\extra.txt Please also let me know how your system is performing now and if you have any specific problems.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums.   Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::5 Steps For Infected PCs |
|
|
|
|
05-15-2007, 01:36 PM
|
#3 (permalink) |
|
Registered User
Join Date: Nov 2005
Posts: 9
OS: XP
|
Re: Help a.bat trojan virus
Thanks for the help Iain, I finally got it all done. The only thing I could not do i s the panda scan. For some reason IE would not run it, combofix.txt "Admin" - 2007-05-15 18:20:27 Service Pack 2 ComboFix 07-05.13.V - Running from: "C:\Documents and Settings\Admin\Desktop\" ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-15 )))))))))))))))))))))))))))))))))) 2007-05-15 18:17 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-05-15 18:11 5,894 --a------ C:\a.bat 2007-05-11 23:28 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar 2007-05-11 23:28 <DIR> d-------- C:\DOCUME~1\Admin\Contacts 2007-05-11 23:27 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2007-05-11 23:27 <DIR> d-------- C:\Program Files\Windows Live Toolbar 2007-05-11 23:26 <DIR> d-------- C:\Program Files\MSN Messenger 2007-05-11 19:05 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-05-11 19:05 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-05-11 19:05 43,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-05-11 19:05 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-05-11 19:05 <DIR> d-------- C:\Program Files\Winamp 2007-05-11 19:05 <DIR> d-------- C:\DOCUME~1\Admin\APPLIC~1\MusicIP 2007-05-11 18:26 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-05-11 18:26 <DIR> d-------- C:\Program Files\XP Repair Pro 2007 2007-05-11 18:22 <DIR> d-------- C:\DOCUME~1\Admin\APPLIC~1\Lavasoft 2007-05-10 21:48 39,936 --a------ C:\EvID4226Patch.exe 2007-05-08 19:42 <DIR> d-------- C:\Program Files\Easiestutils 2007-05-08 19:41 <DIR> d-------- C:\Downloaded Videos 2007-05-08 19:40 101,888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL 2007-05-07 18:03 51,200 --------- C:\WINDOWS\system32\brinsstr.dll 2007-05-07 18:03 50 --a------ C:\WINDOWS\system32\BRIDF04A.dat 2007-05-07 18:03 147,456 --------- C:\WINDOWS\brunin03.dll 2007-05-07 18:02 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Brother 2007-05-07 18:01 57,344 --a------ C:\WINDOWS\system32\brsvc01a.exe 2007-05-07 18:01 45,056 --a------ C:\WINDOWS\system32\brss01a.exe 2007-05-07 18:01 258,048 --a------ C:\WINDOWS\system32\bsplmf01.dll 2007-05-07 18:01 131,072 --a------ C:\WINDOWS\system32\bsplmf01.exe 2007-05-07 18:01 <DIR> d-------- C:\brother 2007-05-07 16:31 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll 2007-05-07 16:29 <DIR> d-------- C:\Program Files\MSBuild 2007-05-07 16:29 <DIR> d-------- C:\Program Files\Microsoft Works 2007-05-07 16:23 <DIR> d-------- C:\WINDOWS\SHELLNEW 2007-05-07 16:23 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help 2007-05-07 16:22 <DIR> dr-h----- C:\MSOCache 2007-05-07 15:57 <DIR> d-------- C:\serials 2007-05-07 15:53 682,232 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-05-06 22:59 <DIR> d--hs---- C:\Diskeeper 2007-05-06 22:38 <DIR> d-------- C:\trayMirc 2007-05-06 22:29 262,144 --a------ C:\DOCUME~1\ALLUSE~1\ntuser.dat 2007-05-06 22:18 <DIR> d--hs---- C:\RECYCLER 2007-05-06 22:03 <DIR> d-------- C:\Utorrent_DOwnloads 2007-05-06 22:03 <DIR> d-------- C:\kkirby 2007-05-06 21:55 <DIR> d-------- C:\Program Files\uTorrent 2007-05-06 21:55 <DIR> d-------- C:\DOCUME~1\Admin\APPLIC~1\uTorrent 2007-05-06 21:54 0 --a------ C:\WINDOWS\nsreg.dat 2007-05-06 21:51 <DIR> d-------- C:\Program Files\mIRC 2007-05-06 21:45 127,208 --a------ C:\WINDOWS\system32\mucltui.dll 2007-05-06 21:44 9,216 --a------ C:\WINDOWS\system32\avgwlntf.dll 2007-05-06 21:44 110,592 --a------ C:\WINDOWS\system32\avgfwafu.dll 2007-05-06 21:42 <DIR> d-------- C:\DOCUME~1\Admin\APPLIC~1\DivX 2007-05-06 21:36 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-05-06 21:35 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll 2007-05-06 21:34 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2007-05-06 21:34 <DIR> d-------- C:\WINDOWS\Internet Logs 2007-05-06 21:33 <DIR> d-------- C:\WINDOWS\system32\drivers\umdf 2007-05-06 21:32 <DIR> d-------- C:\DOCUME~1\Admin\APPLIC~1\Ahead 2007-05-06 21:31 <DIR> d-------- C:\Program Files\Nero 2007-05-06 21:31 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero 2007-05-06 21:30 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-05-06 21:27 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2007-05-06 21:27 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2007-05-06 21:27 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage 2007-05-06 21:26 <DIR> d-------- C:\Program Files\Opera 2007-05-06 21:26 <DIR> d-------- C:\Program Files\MSXML 4.0 2007-05-06 21:25 947,472 --a------ C:\WINDOWS\system32\msjava.dll 2007-05-06 21:25 63,248 --a------ C:\WINDOWS\system32\javaprxy.dll 2007-05-06 21:25 6,550 --a------ C:\WINDOWS\jautoexp.dat 2007-05-06 21:25 49,424 --a------ C:\WINDOWS\system32\clspack.exe 2007-05-06 21:25 46,352 --a------ C:\WINDOWS\setdebug.exe 2007-05-06 21:25 404,752 --a------ C:\WINDOWS\system32\javart.dll 2007-05-06 21:25 313,856 --a------ C:\WINDOWS\system32\dx3j.dll 2007-05-06 21:25 286,992 --a------ C:\WINDOWS\system32\vmhelper.dll 2007-05-06 21:25 21,264 --a------ C:\WINDOWS\system32\msjdbc10.dll 2007-05-06 21:25 187,152 --a------ C:\WINDOWS\system32\javacypt.dll 2007-05-06 21:25 172,304 --a------ C:\WINDOWS\system32\jview.exe 2007-05-06 21:25 171,792 --a------ C:\WINDOWS\system32\wjview.exe 2007-05-06 21:25 171,280 --a------ C:\WINDOWS\system32\jit.dll 2007-05-06 21:25 154,384 --a------ C:\WINDOWS\system32\msawt.dll 2007-05-06 21:25 15,120 --a------ C:\WINDOWS\system32\jdbgmgr.exe 2007-05-06 21:25 139,536 --a------ C:\WINDOWS\system32\javaee.dll 2007-05-06 21:25 113 --a------ C:\WINDOWS\system32\zonedon.reg 2007-05-06 21:25 113 --a------ C:\WINDOWS\system32\zonedoff.reg 2007-05-06 21:25 <DIR> d-------- C:\WBLINDS 2007-05-06 21:24 5,120 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-05-06 21:24 217,088 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-05-06 21:24 1,415,680 --a------ C:\WINDOWS\system32\WMV9VCM.dll 2007-05-06 21:24 1,138,688 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-05-06 21:24 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2007-05-06 21:24 <DIR> d-------- C:\Program Files\Diskeeper Corporation 2007-05-06 21:23 <DIR> d-------- C:\Program Files\Lavasoft 2007-05-06 21:23 <DIR> d-------- C:\Program Files\Google 2007-05-06 21:22 <DIR> d-------- C:\Program Files\Real Alternative 2007-05-06 21:22 <DIR> d-------- C:\Program Files\QuickTime Alternative 2007-05-06 21:22 <DIR> d-------- C:\Program Files\Media Player Classic 2007-05-06 21:22 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real 2007-05-06 21:22 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer 2007-05-06 21:22 <DIR> d-------- C:\DOCUME~1\Admin\APPLIC~1\Real 2007-05-06 21:17 270,336 --ah----- C:\DOCUME~1\LOCALS~1\NTUSER.DAT 2007-05-06 21:17 2,359,296 --ah----- C:\DOCUME~1\Admin\NTUSER.DAT 2007-05-06 21:17 <DIR> d-------- C:\WINDOWS\Prefetch 2007-05-06 21:17 <DIR> d-------- C:\DOCUME~1\Admin\nss1004.tmp 2007-05-06 21:16 270,336 --ah----- C:\DOCUME~1\NETWOR~1\NTUSER.DAT 2007-05-06 21:14 773,120 --a------ C:\WINDOWS\system32\bubbles.scr 2007-05-06 21:14 270,336 ---h----- C:\DOCUME~1\DEFAUL~1\NTUSER.DAT 2007-05-06 21:14 117,248 --a------ C:\WINDOWS\system32\ribbons.scr 2007-05-06 21:14 117,248 --a------ C:\WINDOWS\system32\Mystify.scr 2007-05-06 21:14 1,263,616 --a------ C:\WINDOWS\system32\aurora.scr 2007-05-06 21:13 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll 2007-05-06 21:13 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-05-06 21:13 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-05-06 21:13 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2007-05-06 21:13 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2007-05-06 21:13 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-05-06 21:13 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-05-06 21:13 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-05-06 21:13 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2007-05-06 21:12 <DIR> d-------- C:\Program Files\DivX 2007-05-06 21:06 0 -rahs---- C:\MSDOS.SYS 2007-05-06 21:06 0 -rahs---- C:\IO.SYS 2007-05-06 21:06 0 --a------ C:\CONFIG.SYS 2007-05-06 21:06 0 --a------ C:\AUTOEXEC.BAT 2007-05-06 21:06 <DIR> d-------- C:\Program Files\Angry IP Scanner 2007-05-06 21:06 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\nss1004.tmp 2007-05-06 21:05 112,128 --a------ C:\WINDOWS\system32\mapi32.dll 2007-05-06 21:05 <DIR> d-------- C:\WINDOWS\system32\dllcache 2007-05-06 21:04 <DIR> dr------- C:\WINDOWS\Offline Web Pages 2007-05-06 21:04 <DIR> d--hs---- C:\DOCUME~1\ALLUSE~1\DRM 2007-05-06 21:04 <DIR> d---s---- C:\WINDOWS\Downloaded Program Files 2007-05-06 21:03 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll 2007-05-06 21:03 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll 2007-05-06 21:03 64,512 --a------ C:\WINDOWS\system32\acctres.dll 2007-05-06 21:03 465,368 --a------ C:\WINDOWS\system32\wuapi.dll 2007-05-06 21:03 41,432 --a------ C:\WINDOWS\system32\wups.dll 2007-05-06 21:03 382,464 --a------ C:\WINDOWS\system32\qmgr.dll 2007-05-06 21:03 194,520 --a------ C:\WINDOWS\system32\wuaueng1.dll 2007-05-06 21:03 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll 2007-05-06 21:03 18,392 --a------ C:\WINDOWS\system32\wuauserv.dll 2007-05-06 21:03 174,040 --a------ C:\WINDOWS\system32\wuweb.dll 2007-05-06 21:03 172,504 --a------ C:\WINDOWS\system32\wuauclt1.exe 2007-05-06 21:03 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll 2007-05-06 21:03 127,448 --a------ C:\WINDOWS\system32\wucltui.dll 2007-05-06 21:03 124,376 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-05-06 21:03 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll 2007-05-06 21:03 11,264 --a------ C:\WINDOWS\system32\atrace.dll 2007-05-06 21:03 1,353,688 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-05-06 21:03 <DIR> d--h----- C:\Program Files\WindowsUpdate 2007-05-06 21:03 <DIR> d---s---- C:\WINDOWS\Tasks 2007-05-06 21:03 <DIR> d-------- C:\WINDOWS\system32\DirectX 2007-05-06 21:03 <DIR> d-------- C:\WINDOWS\srchasst 2007-05-06 21:03 <DIR> d-------- C:\Program Files\Movie Maker 2007-05-06 21:03 <DIR> d-------- C:\Program Files\Common Files\MSSoap 2007-05-06 21:02 81,920 --a------ C:\WINDOWS\system32\isign32.dll 2007-05-06 21:02 81,920 --a------ C:\WINDOWS\system32\ils.dll 2007-05-06 21:02 73,728 --a------ C:\WINDOWS\system32\icwdial.dll 2007-05-06 21:02 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys 2007-05-06 21:02 69,632 --a------ C:\WINDOWS\system32\msconf.dll 2007-05-06 21:02 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-06 21:02 67,584 --a------ C:\WINDOWS\system32\srclient.dll 2007-05-06 21:02 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll 2007-05-06 21:02 48,128 --a------ C:\WINDOWS\system32\inetres.dll 2007-05-06 21:02 45,568 --a------ C:\WINDOWS\system32\safrslv.dll 2007-05-06 21:02 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll 2007-05-06 21:02 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll 2007-05-06 21:02 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll 2007-05-06 21:02 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe 2007-05-06 21:02 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll 2007-05-06 21:02 29,696 --a------ C:\WINDOWS\system32\safrdm.dll 2007-05-06 21:02 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll 2007-05-06 21:02 274,944 --a------ C:\WINDOWS\system32\mstask.dll 2007-05-06 21:02 274,432 --a------ C:\WINDOWS\system32\inetcfg.dll 2007-05-06 21:02 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll 2007-05-06 21:02 239,104 --a------ C:\WINDOWS\system32\srrstr.dll 2007-05-06 21:02 23,040 --a------ C:\WINDOWS\system32\fltMc.exe 2007-05-06 21:02 21,640 --a------ C:\WINDOWS\system32\emptyregdb.dat 2007-05-06 21:02 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll 2007-05-06 21:02 170,496 --a------ C:\WINDOWS\system32\srsvc.dll 2007-05-06 21:02 16,896 --a------ C:\WINDOWS\system32\fltlib.dll 2007-05-06 21:02 128,768 --a------ C:\WINDOWS\system32\drivers\fltMgr.sys 2007-05-06 21:02 12,288 --a------ C:\WINDOWS\system32\mstinit.exe 2007-05-06 21:02 105,984 --a------ C:\WINDOWS\system32\msoert2.dll 2007-05-06 21:02 <DIR> d-------- C:\WINDOWS\system32\Restore 2007-05-06 21:01 1,536 --a------ C:\WINDOWS\system32\hidec.exe 2007-05-06 21:01 <DIR> d-------- C:\WINDOWS\Registration 2007-05-06 21:01 <DIR> d-------- C:\Program Files\Online Services 2007-05-06 21:00 97,792 --a------ C:\WINDOWS\system32\comrepl.dll 2007-05-06 21:00 9,728 --a------ C:\WINDOWS\system32\reset.exe 2007-05-06 21:00 80,384 --a------ C:\WINDOWS\system32\charmap.exe 2007-05-06 21:00 73,216 --a------ C:\WINDOWS\system32\avwav.dll 2007-05-06 21:00 605,696 --a------ C:\WINDOWS\system32\getuname.dll 2007-05-06 21:00 59,392 --a------ C:\WINDOWS\system32\stclient.dll 2007-05-06 21:00 56,832 --a------ C:\WINDOWS\system32\sol.exe 2007-05-06 21:00 55,296 --a------ C:\WINDOWS\system32\freecell.exe 2007-05-06 21:00 5,632 --a------ C:\WINDOWS\system32\write.exe 2007-05-06 21:00 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe 2007-05-06 21:00 44,544 --a------ C:\WINDOWS\system32\hticons.dll 2007-05-06 21:00 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll 2007-05-06 21:00 4,096 --a------ C:\WINDOWS\system32\mtxex.dll 2007-05-06 21:00 35,328 --a------ C:\WINDOWS\system32\winchat.exe 2007-05-06 21:00 33,792 --a------ C:\WINDOWS\system32\regini.exe 2007-05-06 21:00 25,600 --a------ C:\WINDOWS\system32\comaddin.dll 2007-05-06 21:00 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll 2007-05-06 21:00 227,840 --a------ C:\WINDOWS\system32\avtapi.dll 2007-05-06 21:00 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe 2007-05-06 21:00 20,992 --a------ C:\WINDOWS\system32\msg.exe 2007-05-06 21:00 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll 2007-05-06 21:00 16,896 --a------ C:\WINDOWS\system32\tsshutdn.exe 2007-05-06 21:00 16,896 --a------ C:\WINDOWS\system32\qappsrv.exe 2007-05-06 21:00 16,384 --a------ C:\WINDOWS\system32\tskill.exe 2007-05-06 21:00 16,384 --a------ C:\WINDOWS\system32\avmeter.dll 2007-05-06 21:00 15,872 --a------ C:\WINDOWS\system32\rwinsta.exe 2007-05-06 21:00 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll 2007-05-06 21:00 15,360 --a------ C:\WINDOWS\system32\logoff.exe 2007-05-06 21:00 147,456 --a------ C:\WINDOWS\system32\comsnap.dll 2007-05-06 21:00 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe 2007-05-06 21:00 14,848 --a------ C:\WINDOWS\system32\tscon.exe 2007-05-06 21:00 14,848 --a------ C:\WINDOWS\system32\shadow.exe 2007-05-06 21:00 138,752 --a------ C:\WINDOWS\system32\sndvol32.exe 2007-05-06 21:00 126,976 --a------ C:\WINDOWS\system32\mshearts.exe 2007-05-06 21:00 119,808 --a------ C:\WINDOWS\system32\winmine.exe 2007-05-06 21:00 114,688 --a------ C:\WINDOWS\system32\calc.exe 2007-05-06 21:00 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd 2007-05-06 21:00 <DIR> d-------- C:\VAIO 2007-05-06 21:00 <DIR> d-------- C:\Program Files\Windows Sidebar 2007-05-06 21:00 <DIR> d-------- C:\Program Files\MSN Gaming Zone 2007-05-06 21:00 <DIR> d-------- C:\Program Files\Messenger 2007-05-06 20:59 956,928 --a------ C:\WINDOWS\system32\msdtctm.dll 2007-05-06 20:59 93,696 --a------ C:\WINDOWS\system32\tscfgwmi.dll 2007-05-06 20:59 91,648 --a------ C:\WINDOWS\system32\mtxoci.dll 2007-05-06 20:59 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll 2007-05-06 20:59 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll 2007-05-06 20:59 67,072 --a------ C:\WINDOWS\system32\rdshost.exe 2007-05-06 20:59 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll 2007-05-06 20:59 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe 2007-05-06 20:59 600,576 --a------ C:\WINDOWS\system32\mstsc.exe 2007-05-06 20:59 60,416 --a------ C:\WINDOWS\system32\remotepg.dll 2007-05-06 20:59 60,416 --a------ C:\WINDOWS\system32\colbact.dll 2007-05-06 20:59 6,144 --a------ C:\WINDOWS\system32\msdtc.exe 2007-05-06 20:59 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll 2007-05-06 20:59 58,880 --a------ C:\WINDOWS\system32\licwmi.dll 2007-05-06 20:59 56,320 --a------ C:\WINDOWS\system32\servdeps.dll 2007-05-06 20:59 539,648 --a------ C:\WINDOWS\system32\comuid.dll 2007-05-06 20:59 538,624 --a------ C:\WINDOWS\system32\spider.exe 2007-05-06 20:59 498,688 --a------ C:\WINDOWS\system32\clbcatq.dll 2007-05-06 20:59 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe 2007-05-06 20:59 427,520 --a------ C:\WINDOWS\system32\msdtcprx.dll 2007-05-06 20:59 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys 2007-05-06 20:59 38,912 --a------ C:\WINDOWS\system32\cfgbkend.dll 2007-05-06 20:59 347,136 --a------ C:\WINDOWS\system32\hypertrm.dll 2007-05-06 20:59 343,040 --a------ C:\WINDOWS\system32\mspaint.exe 2007-05-06 20:59 295,424 --a------ C:\WINDOWS\system32\termsrv.dll 2007-05-06 20:59 225,792 --a------ C:\WINDOWS\system32\catsrv.dll 2007-05-06 20:59 21,896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys 2007-05-06 20:59 20,480 --a------ C:\WINDOWS\system32\qprocess.exe 2007-05-06 20:59 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys 2007-05-06 20:59 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll 2007-05-06 20:59 185,344 --a------ C:\WINDOWS\system32\cmprops.dll 2007-05-06 20:59 183,808 --a------ C:\WINDOWS\system32\accwiz.exe 2007-05-06 20:59 17,408 --a------ C:\WINDOWS\system32\mmfutil.dll 2007-05-06 20:59 161,792 --a------ C:\WINDOWS\system32\msdtcuiu.dll 2007-05-06 20:59 147,968 --a------ C:\WINDOWS\system32\rdchost.dll 2007-05-06 20:59 140,800 --a------ C:\WINDOWS\system32\sessmgr.exe 2007-05-06 20:59 139,528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys 2007-05-06 20:59 131,584 --a------ C:\WINDOWS\system32\sndrec32.exe 2007-05-06 20:59 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe 2007-05-06 20:59 123,392 --a------ C:\WINDOWS\system32\mplay32.exe 2007-05-06 20:59 12,040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys 2007-05-06 20:59 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll 2007-05-06 20:59 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll 2007-05-06 20:59 11,264 --a------ C:\WINDOWS\system32\icaapi.dll 2007-05-06 20:59 102,912 --a------ C:\WINDOWS\system32\clipbrd.exe 2007-05-06 20:59 1,866,240 --a------ C:\WINDOWS\system32\mstscax.dll 2007-05-06 20:59 1,269,248 --a------ C:\WINDOWS\system32\comsvcs.dll 2007-05-06 20:59 <DIR> d-------- C:\WINDOWS\system32\MsDtc 2007-05-06 20:59 <DIR> d-------- C:\WINDOWS\system32\Com 2007-05-06 20:59 <DIR> d-------- C:\Program Files\Windows NT 2007-05-06 13:58 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys 2007-05-06 13:58 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys 2007-05-06 13:58 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys 2007-05-06 13:58 6,272 --a------ C:\WINDOWS\system32\drivers\splitter.sys 2007-05-06 13:58 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys 2007-05-06 13:58 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys 2007-05-06 13:58 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2007-05-06 13:58 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys 2007-05-06 13:58 172,416 --a------ C:\WINDOWS\system32\drivers\kmixer.sys 2007-05-06 13:58 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys 2007-05-06 13:57 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2007-05-06 13:57 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-05-06 13:57 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2007-05-06 13:57 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys 2007-05-06 13:56 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2007-05-06 13:56 303,104 --a------ C:\WINDOWS\system32\nvwrstr.dll 2007-05-06 13:56 221,184 --a------ C:\WINDOWS\system32\nvrszhc.dll 2007-05-06 13:56 167,936 --a------ C:\WINDOWS\system32\nvwrszht.dll 2007-05-06 13:56 163,840 --a------ C:\WINDOWS\system32\nvwrszhc.dll 2007-05-06 13:56 118,784 --a------ C:\WINDOWS\system32\nvrszht.dll 2007-05-06 13:55 794,624 --a------ C:\WINDOWS\system32\nvcplui.exe 2007-05-06 13:55 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys 2007-05-06 13:55 466,944 --a------ C:\WINDOWS\system32\nvshell.dll 2007-05-06 13:55 45,056 --a------ C:\WINDOWS\system32\nvmccsrs.dll 2007-05-06 13:55 442,368 --a------ C:\WINDOWS\system32\nvappbar.exe 2007-05-06 13:55 425,984 --a------ C:\WINDOWS\system32\keystone.exe 2007-05-06 13:55 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-05-06 13:55 335,872 --a------ C:\WINDOWS\system32\nvwrses.dll 2007-05-06 13:55 335,872 --a------ C:\WINDOWS\system32\nvwrsel.dll 2007-05-06 13:55 327,680 --a------ C:\WINDOWS\system32\nvwrsfr.dll 2007-05-06 13:55 327,680 --a------ C:\WINDOWS\system32\nvwrsesm.dll 2007-05-06 13:55 323,584 --a------ C:\WINDOWS\system32\nvwrspt.dll 2007-05-06 13:55 323,584 --a------ C:\WINDOWS\system32\nvwrsit.dll 2007-05-06 13:55 323,584 --a------ C:\WINDOWS\system32\nvrshe.dll 2007-05-06 13:55 323,584 --a------ C:\WINDOWS\system32\nvrsar.dll 2007-05-06 13:55 319,488 --a------ C:\WINDOWS\system32\nvwrsptb.dll 2007-05-06 13:55 319,488 --a------ C:\WINDOWS\system32\nvwrsnl.dll 2007-05-06 13:55 315,392 --a------ C:\WINDOWS\system32\nvwrsru.dll 2007-05-06 13:55 315,392 --a------ C:\WINDOWS\system32\nvwrshu.dll 2007-05-06 13:55 311,296 --a------ C:\WINDOWS\system32\nvwrsde.dll 2007-05-06 13:55 311,296 --a------ C:\WINDOWS\system32\nvexpbar.dll 2007-05-06 13:55 303,104 --a------ C:\WINDOWS\system32\nvwrssl.dll 2007-05-06 13:55 303,104 --a------ C:\WINDOWS\system32\nvwrsfi.dll 2007-05-06 13:55 299,008 --a------ C:\WINDOWS\system32\nvwrssk.dll 2007-05-06 13:55 299,008 --a------ C:\WINDOWS\system32\nvwrsno.dll 2007-05-06 13:55 294,912 --a------ C:\WINDOWS\system32\nvwrssv.dll 2007-05-06 13:55 294,912 --a------ C:\WINDOWS\system32\nvwrspl.dll 2007-05-06 13:55 294,912 --a------ C:\WINDOWS\system32\nvwrsda.dll 2007-05-06 13:55 286,720 --a------ C:\WINDOWS\system32\nvwrseng.dll 2007-05-06 13:55 286,720 --a------ C:\WINDOWS\system32\nvwrscs.dll 2007-05-06 13:55 282,624 --a------ C:\WINDOWS\system32\nvwrsar.dll 2007-05-06 13:55 278,528 --a------ C:\WINDOWS\system32\nvwrshe.dll 2007-05-06 13:55 278,528 --a------ C:\WINDOWS\system32\nvrsfr.dll 2007-05-06 13:55 274,432 --a------ C:\WINDOWS\system32\nvrsit.dll 2007-05-06 13:55 274,432 --a------ C:\WINDOWS\system32\nvrses.dll 2007-05-06 13:55 274,432 --a------ C:\WINDOWS\system32\nvrsel.dll 2007-05-06 13:55 270,336 --a------ C:\WINDOWS\system32\nvrsde.dll 2007-05-06 13:55 266,240 --a------ C:\WINDOWS\system32\nvrspt.dll 2007-05-06 13:55 266,240 --a------ C:\WINDOWS\system32\nvrsnl.dll 2007-05-06 13:55 266,240 --a------ C:\WINDOWS\system32\nvrsesm.dll 2007-05-06 13:55 262,144 --a------ C:\WINDOWS\system32\nvrsru.dll 2007-05-06 13:55 262,144 --a------ C:\WINDOWS\system32\nvrsptb.dll 2007-05-06 13:55 262,144 --a------ C:\WINDOWS\system32\nvrsja.dll 2007-05-06 13:55 258,048 --a------ C:\WINDOWS\system32\nvrsko.dll 2007-05-06 13:55 253,952 --a------ C:\WINDOWS\system32\nvrshu.dll 2007-05-06 13:55 249,856 --a------ C:\WINDOWS\system32\nvrstr.dll 2007-05-06 13:55 249,856 --a------ C:\WINDOWS\system32\nvrssl.dll 2007-05-06 13:55 249,856 --a------ C:\WINDOWS\system32\nvrssk.dll 2007-05-06 13:55 249,856 --a------ C:\WINDOWS\system32\nvrspl.dll 2007-05-06 13:55 249,856 --a------ C:\WINDOWS\system32\nvrsno.dll 2007-05-06 13:55 245,760 --a------ C:\WINDOWS\system32\nvrssv.dll 2007-05-06 13:55 245,760 --a------ C:\WINDOWS\system32\nvrsda.dll 2007-05-06 13:55 241,664 --a------ C:\WINDOWS\system32\nvrsfi.dll 2007-05-06 13:55 241,664 --a------ C:\WINDOWS\system32\nvrseng.dll 2007-05-06 13:55 241,664 --a------ C:\WINDOWS\system32\nvrscs.dll 2007-05-06 13:55 212,992 --a------ C:\WINDOWS\system32\nvwrsja.dll 2007-05-06 13:55 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe 2007-05-06 13:55 196,608 --a------ C:\WINDOWS\system32\nvwrsko.dll 2007-05-06 13:55 147,456 --a------ C:\WINDOWS\system32\nvcolor.exe 2007-05-06 13:55 146,048 --a------ C:\WINDOWS\system32\drivers\portcls.sys 2007-05-06 13:55 1,662,976 --a------ C:\WINDOWS\system32\nvwdmcpl.dll 2007-05-06 13:55 1,622,016 --a------ C:\WINDOWS\system32\nwiz.exe 2007-05-06 13:55 1,470,464 --a------ C:\WINDOWS\system32\nview.dll 2007-05-06 13:55 1,339,392 --a------ C:\WINDOWS\system32\nvdspsch.exe 2007-05-06 13:55 1,019,904 --a------ C:\WINDOWS\system32\nvwimg.dll 2007-05-06 13:55 1,011,712 --a------ C:\WINDOWS\system32\nvcpluir.dll 2007-05-06 13:55 <DIR> d-------- C:\WINDOWS\nview 2007-05-06 13:54 74,240 --a------ C:\WINDOWS\system32\usbui.dll 2007-05-06 13:51 9,936 --a------ C:\WINDOWS\system\LZEXPAND.DLL 2007-05-06 13:51 9,008 --a------ C:\WINDOWS\system\VER.DLL 2007-05-06 13:51 85,020 --a------ C:\WINDOWS\system32\dgsetup.dll 2007-05-06 13:51 82,944 --a------ C:\WINDOWS\system\OLECLI.DLL 2007-05-06 13:51 8,704 --a------ C:\WINDOWS\system32\batt.dll 2007-05-06 13:51 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll 2007-05-06 13:51 74,752 --a------ C:\WINDOWS\system32\storprop.dll 2007-05-06 13:51 7,168 -ra------ C:\WINDOWS\system32\kbdcz.dll 2007-05-06 13:51 69,584 --a------ C:\WINDOWS\system\AVICAP.DLL 2007-05-06 13:51 69,120 --a------ C:\WINDOWS\NOTEPAD.EXE 2007-05-06 13:51 68,768 --a------ C:\WINDOWS\system\MMSYSTEM.DLL 2007-05-06 13:51 6,656 -ra------ C:\WINDOWS\system32\kbdycl.dll 2007-05-06 13:51 6,656 -ra------ C:\WINDOWS\system32\kbdsl1.dll 2007-05-06 13:51 6,656 -ra------ C:\WINDOWS\system32\kbdsl.dll 2007-05-06 13:51 6,656 -ra------ C:\WINDOWS\system32\kbdpl.dll 2007-05-06 13:51 6,656 -ra------ C:\WINDOWS\system32\kbdhu.dll 2007-05-06 13:51 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll 2007-05-06 13:51 6,656 -ra------ C:\WINDOWS\system32\kbdcz2.dll 2007-05-06 13:51 6,656 -ra------ C:\WINDOWS\system32\kbdcz1.dll 2007-05-06 13:51 6,656 -ra------ C:\WINDOWS\system32\kbdcr.dll 2007-05-06 13:51 6,656 -ra------ C:\WINDOWS\system32\KBDAL.DLL 2007-05-06 13:51 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll 2007-05-06 13:51 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll 2007-05-06 13:51 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll 2007-05-06 13:51 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll 2007-05-06 13:51 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll 2007-05-06 13:51 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll 2007-05-06 13:51 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll 2007-05-06 13:51 5,632 -ra------ C:\WINDOWS\system32\kbdro.dll 2007-05-06 13:51 5,632 -ra------ C:\WINDOWS\system32\kbdpl1.dll 2007-05-06 13:51 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll 2007-05-06 13:51 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll 2007-05-06 13:51 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll 2007-05-06 13:51 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll 2007-05-06 13:51 5,632 -ra------ C:\WINDOWS\system32\kbdhu1.dll 2007-05-06 13:51 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll 2007-05-06 13:51 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll 2007-05-06 13:51 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll 2007-05-06 13:51 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll 2007-05-06 13:51 5,120 --a------ C:\WINDOWS\system\SHELL.DLL 2007-05-06 13:51 32,816 --a------ C:\WINDOWS\system\COMMDLG.DLL 2007-05-06 13:51 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll 2007-05-06 13:51 24,064 --a------ C:\WINDOWS\system\OLESVR.DLL 2007-05-06 13:51 19,200 --a------ C:\WINDOWS\system\TAPI.DLL 2007-05-06 13:51 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll 2007-05-06 13:51 15,360 --a------ C:\WINDOWS\TASKMAN.EXE 2007-05-06 13:51 13,312 --a------ C:\WINDOWS\system32\irclass.dll 2007-05-06 13:51 126,912 --a------ C:\WINDOWS\system\MSVIDEO.DLL 2007-05-06 13:51 11,264 --a------ C:\WINDOWS\system32\drivers\irenum.sys 2007-05-06 13:51 109,456 --a------ C:\WINDOWS\system\AVIFILE.DLL 2007-05-06 13:51 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll 2007-05-06 13:51 <DIR> dr------- C:\Program Files 2007-05-06 13:51 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Documents 2007-05-06 13:51 <DIR> d--hs---- C:\WINDOWS\Installer 2007-05-06 13:51 <DIR> d-------- C:\Program Files\Common Files\SpeechEngines 2007-05-06 13:51 <DIR> d-------- C:\Program Files\Common Files\ODBC 2007-05-06 13:50 <DIR> d-------- C:\WINDOWS\system32\CatRoot2 2007-05-06 13:50 <DIR> d-------- C:\WINDOWS\system32\CatRoot 2007-05-06 13:49 720,896 --a------ C:\WINDOWS\system32\a3d.dll 2007-05-06 13:49 578,368 --a------ C:\WINDOWS\system32\drivers\smwdm.sys 2007-05-06 13:49 4,816 --a------ C:\WINDOWS\system32\drivers\aeaudio.sys 2007-05-06 13:49 3,744 --a------ C:\WINDOWS\system32\drivers\smsens.sys 2007-05-06 13:48 61,440 --a------ C:\WINDOWS\system32\vuins32.dll 2007-05-06 13:48 42,496 --a------ C:\WINDOWS\system32\drivers\fetnd5bv.sys 2007-05-06 13:47 81,920 --a------ C:\WINDOWS\system32\nvwddi.dll 2007-05-06 13:47 5,644,288 --a------ C:\WINDOWS\system32\nvoglnt.dll 2007-05-06 13:47 3,994,624 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys 2007-05-06 13:47 2,973,696 --a------ C:\WINDOWS\system32\nvvitvsr.dll 2007-05-06 13:47 2,924,544 --a------ C:\WINDOWS\system32\nvvitvs.dll 2007-05-06 13:47 159,810 --a------ C:\WINDOWS\system32\nvsvc32.exe 2007-05-06 13:47 1,732,608 --a------ C:\WINDOWS\system32\nvwssr.dll 2007-05-06 13:47 1,236,992 --a------ C:\WINDOWS\system32\nvwss.dll 2007-05-06 13:46 888,832 --a------ C:\WINDOWS\system32\nvmobls.dll 2007-05-06 13:46 86,016 --a------ C:\WINDOWS\system32\nvmctray.dll 2007-05-06 13:46 7,700,480 --a------ C:\WINDOWS\system32\nvcpl.dll 2007-05-06 13:46 581,632 --a------ C:\WINDOWS\system32\nvhwvid.dll 2007-05-06 13:46 5,619,712 --a------ C:\WINDOWS\system32\nvdisps.dll 2007-05-06 13:46 5,255,168 --a------ C:\WINDOWS\system32\nvdispsr.dll 2007-05-06 13:46 458,752 --a------ C:\WINDOWS\system32\nvmccssr.dll 2007-05-06 13:46 4,527,488 --a------ C:\WINDOWS\system32\nv4_disp.dll 2007-05-06 13:46 36,864 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys 2007-05-06 13:46 35,840 --a------ C:\WINDOWS\system32\nvcodins.dll 2007-05-06 13:46 35,840 --a------ C:\WINDOWS\system32\nvcod.dll 2007-05-06 13:46 3,203,072 --a------ C:\WINDOWS\system32\nvgamesr.dll 2007-05-06 13:46 3,047,424 --a------ C:\WINDOWS\system32\nvgames.dll 2007-05-06 13:46 286,720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll 2007-05-06 13:46 27,904 --a------ C:\WINDOWS\system32\drivers\VIAAGP1.SYS 2007-05-06 13:46 229,376 --a------ C:\WINDOWS\system32\nvmccs.dll 2007-05-06 13:46 212,992 --a------ C:\WINDOWS\system32\nvapi.dll 2007-05-06 13:46 2,859,008 --a------ C:\WINDOWS\system32\nvmoblsr.dll 2007-05-06 13:46 188,416 --a------ C:\WINDOWS\system32\nvmccss.dll 2007-05-06 13:45 <DIR> d--hs---- C:\System Volume Information 2007-05-06 13:45 <DIR> d-------- C:\Documents and Settings 2007-05-06 13:38 <DIR> dr--s---- C:\WINDOWS\Fonts 2007-05-06 13:38 <DIR> dr------- C:\WINDOWS\Web 2007-05-06 13:38 <DIR> d--h----- C:\WINDOWS\inf 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\WinSxS 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\twain_32 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\wins 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\wbem 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\usmt 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\spool 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\ShellExt 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\Setup 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\ras 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\PreInstall 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\oobe 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\npp 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\mui 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\Macromed 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\inetsrv 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\IME 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\icsxml 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\ias 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\export 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\en 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\drivers\etc 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\drivers\disdn 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\drivers 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\dhcp 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\config 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\3com_dmi 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\3076 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\2052 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\1054 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\1042 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\1041 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\1037 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\1033 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\1031 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\1028 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32\1025 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system32 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\system 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\SoftwareDistribution 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\security 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\Resources 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\repair 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\Provisioning 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\PeerNet 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\pchealth 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\Network Diagnostic 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\mui 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\msapps 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\msagent 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\Media 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\ime 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\Help 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\ehome 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\Driver Cache 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\Debug 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\Cursors 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\Connection Wizard 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\Config 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\AppPatch 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS\addins 2007-05-06 13:38 <DIR> d-------- C:\WINDOWS 2007-05-02 11:04 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe 2007-05-02 11:04 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-05-02 11:04 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-05-02 11:04 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-05-02 11:02 73,728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-05-02 11:02 593,920 --a------ C:\WINDOWS\system32\dpuGUI11.dll 2007-05-02 11:02 57,344 --a------ C:\WINDOWS\system32\dpv11.dll 2007-05-02 11:02 53,248 --a------ C:\WINDOWS\system32\dpuGUI10.dll 2007-05-02 11:02 344,064 --a------ C:\WINDOWS\system32\dpus11.dll 2007-05-02 11:02 294,912 --a------ C:\WINDOWS\system32\dpu11.dll 2007-05-02 11:02 294,912 --a------ C:\WINDOWS\system32\dpu10.dll 2007-05-02 11:02 196,608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-05-02 11:01 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-05-02 11:01 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-05-02 11:01 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-05-02 11:01 740,442 --a------ C:\WINDOWS\system32\DivX.dll 2007-05-01 19:33 124,472 --a------ C:\WINDOWS\system32\DivXCodecUpdateChecker.exe 2007-05-01 19:33 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-11 04:49:02 360,576 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS 2007-03-17 13:45:03 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-08 15:48:36 578,048 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:48:36 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:48:36 282,112 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 13:49:49 1,843,968 ----a-w C:\WINDOWS\system32\win32k.sys 2007-02-05 20:17:02 185,344 ----a-w C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 17:38] {72853161-30C5-4D22-B7F9-0BBC1D38A37E}=C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL [2006-10-27 00:48] {9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 20:33] {AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar1.dll [2007-05-06 21:23] {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}=C:\Program Files\Windows Live Toolbar\msntb.dll [2006-09-27 17:45] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "DiskeeperSystray"="\"C:\\Program Files\\Diskeeper Corporation\\Diskeeper\\DkIcon.exe\"" "RegistryMechanic"="" "NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe" "torwin32"="torwin32.exe" "lsass"="svchost32.exe" "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP" "GrooveMonitor"="\"C:\\Program Files\\Microsoft Office\\Office12\\GrooveMonitor.exe\"" "WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 04:22] "nwiz"="nwiz.exe" [2006-10-22 04:22 C:\WINDOWS\system32\nwiz.exe]) "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 04:22] "DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2006-10-04 12:38] "RegistryMechanic"="" []) "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40] "torwin32"="torwin32.exe" [2006-12-27 22:48 C:\WINDOWS\system32\torwin32.exe]) "lsass"="svchost32.exe" [2006-12-27 22:48 C:\WINDOWS\system32\svchost32.exe]) "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-05-08 09:34] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-04-25 08:44] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2006-10-07 05:20] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2006-12-07 20:28] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 21:00] "XPRepairPro2007"="C:\Program Files\XP Repair Pro 2007\XPRepairPro.exe" [2007-05-11 18:28] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 12:54] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Sidebar"="C:\\Program Files\\Windows Sidebar\\sidebar.exe /autoRun" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "XPRepairPro2007"="C:\\Program Files\\XP Repair Pro 2007\\XPRepairPro.exe /r" "MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "torwin32"="torwin32.exe" "lsass"="svchost32.exe" [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "nltide_3"=hex(2):72,75,6e,64,6c,6c,33,32,20,61,64,76,70,61,63,6b,2e,64,6c,6c,\ 2c,4c,61,75,6e,63,68,49,4e,46,53,65,63,74,69,6f,6e,45,78,20,6e,4c,69,74,65,\ 2e,69,6e,66,2c,43,2c,2c,34,2c,4e,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Sidebar"="C:\\Program Files\\Windows Sidebar\\sidebar.exe /autoRun" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"=dword:00000001 "NoResolveTrack"=dword:00000001 "LinkResolveIgnoreLinkInfo"=dword:00000001 "NoResolveSearch"=dword:00000001 "NoLowDiskSpaceChecks"=dword:00000001 "ClearRecentDocsOnExit"=dword:00000001 "NoRecentDocsMenu"=dword:00000001 "NoRecentDocsHistory"=dword:00000001 "NoStartBanner"=dword:00000001 "NoSMHelp"=dword:00000001 "StartMenuLogoff"=dword:00000001 "ForceStartMenuLogoff"=dword:00000000 "NoStartMenuPinnedList"=dword:00000001 "NoSMConfigurePrograms"=dword:00000001 "NoUserNameInStartMenu"=dword:00000001 "NoSaveSettings"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"=dword:00000001 "NoResolveTrack"=dword:00000001 "LinkResolveIgnoreLinkInfo"=dword:00000001 "NoResolveSearch"=dword:00000001 "NoLowDiskSpaceChecks"=dword:00000001 "ClearRecentDocsOnExit"=dword:00000001 "NoRecentDocsMenu"=dword:00000001 "NoRecentDocsHistory"=dword:00000001 "NoStartBanner"=dword:00000001 "NoSMHelp"=dword:00000001 "StartMenuLogoff"=dword:00000001 "ForceStartMenuLogoff"=dword:00000000 "NoStartMenuPinnedList"=dword:00000001 "NoSMConfigurePrograms"=dword:00000001 "NoUserNameInStartMenu"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL" [2006-10-27 00:48] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2006-09-28 07:13] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages msv1_0\0\0 Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages scecli\0\0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter HTTPFilter\0\0 LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService DnsCache\0\0 DcomLaunch DcomLaunch\0TermService\0\0 rpcss RpcSs\0\0 imgsvc StiSvc\0\0 termsvcs TermService\0\0 WudfServiceGroup WUDFSvc\0\0 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_AVG_ANTI-SPYWARE_DRIVER *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_AVG_ANTI-SPYWARE_GUARD Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-15 18:22:00 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 2007-05-15 18:22:04 C:\ComboFix-quarantined-files.txt ... 2007-05-15 18:22 AVG Log --------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 19:58:25 15/05/2007 + Scan result: C:\EvID4226Patch.exe -> Not-A-Virus.Hacktool.EvID : No action taken. C:\a.bat -> Trojan.Zapchast : No action taken. ::Report end main.txt Deckard's System Scanner v20070426.43 Run by Admin on 2007-05-15 at 20:24:49 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 39: 2007-05-16 03:24:58 UTC - RP39 - Deckard's System Scanner Restore Point 38: 2007-05-16 03:19:39 UTC - RP38 - Installed Windows Internet Explorer 7. 37: 2007-05-16 03:18:10 UTC - RP37 - Installed Windows IDNMitigationAPIs. 36: 2007-05-16 03:17:41 UTC - RP36 - Installed Windows NLSDownlevelMapping. 35: 2007-05-16 03:17:06 UTC - RP35 - Installed Windows XP KB915865. -- First Restore Point -- 1: 2007-05-07 04:23:29 UTC - RP1 - Installed Adobe Reader 7.0.8 Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Admin.exe) ----------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 20:25:53, on 15/05/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\brss01a.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\WINDOWS\system32\nvsvc32.exe C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Documents and Settings\Admin\Desktop\dss.exe C:\DOCUME~1\Admin\Desktop\Admin.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pandasoftware.com/products/activescan.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.divx.com/divx/webplayerdem...ist=divxdotcom O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\RunOnce: [NoIE4StubProcessing] C:\WINDOWS\system32\reg.exe DELETE "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components" /v "NoIE4StubProcessing" /f O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll O11 - Options group: [INTERNATIONAL] International* O17 - HKLM\System\CCS\Services\Tcpip\..\{1A808A27-9101-4661-9E20-A0596C6EB217}: NameServer = 192.168.0.1,192.168.0.2 O17 - HKLM\System\CS1\Services\Tcpip\..\{1A808A27-9101-4661-9E20-A0596C6EB217}: NameServer = 192.168.0.1,192.168.0.2 O17 - HKLM\System\CS2\Services\Tcpip\..\{1A808A27-9101-4661-9E20-A0596C6EB217}: NameServer = 192.168.0.1,192.168.0.2 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing) O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- HijackThis Fixed Entries (C:\DOCUME~1\Admin\Desktop\backups\) --------------- backup-20070515-183006-203 O4 - HKLM\..\Run: [lsass] svchost32.exe backup-20070515-183006-394 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = backup-20070515-183006-477 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = backup-20070515-183006-642 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = backup-20070515-183006-674 O4 - HKLM\..\Run: [torwin32] torwin32.exe backup-20070515-183006-852 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = backup-20070515-183006-865 O4 - HKLM\..\RunServices: [lsass] svchost32.exe backup-20070515-183006-871 O4 - HKLM\..\RunServices: [torwin32] torwin32.exe -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- All drivers whitelisted. -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Diskeeper - "c:\program files\diskeeper corporation\diskeeper\dkservice.exe" <Not Verified; Diskeeper Corporation; Diskeeper (TM) Disk Defragmenter> S2 brmfrmps (Brother Popup Suspend service for Resource manager) - "c:\windows\system32\brmfrmps.exe" -service (file missing) S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe -- Scheduled Tasks ------------------------------------------------------------- 2007-05-15 17:57:00 254 --a------ C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job -- Files created between 2007-04-15 and 2007-05-15 ----------------------------- 2007-05-15 20:16:56 0 d-------- C:\WINDOWS\LastGood 2007-05-15 20:05:39 0 d-------- C:\Documents and Settings\Admin\Application Data\Google 2007-05-15 20:04:53 0 d-------- C:\Documents and Settings\All Users\Application Data\Google 2007-05-15 19:59:30 0 dr-h----- C:\Documents and Settings\Admin\Recent 2007-05-11 23:28:50 0 d-------- C:\Documents and Settings\Admin\Contacts 2007-05-11 23:28:30 0 d-------- C:\Program Files\Windows Live Favorites 2007-05-11 23:28:11 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar 2007-05-11 23:27:59 0 d-------- C:\Program Files\Windows Live Toolbar 2007-05-11 23:27:03 0 d------c- C:\WINDOWS\system32\DRVSTORE 2007-05-11 23:26:55 0 d-------- C:\Program Files\MSN Messenger 2007-05-11 19:05:43 0 d-------- C:\Documents and Settings\Admin\Application Data\MusicIP 2007-05-11 19:05:15 0 d-------- C:\Program Files\Winamp 2007-05-11 18:26:37 0 d-------- C:\Program Files\XP Repair Pro 2007 2007-05-11 18:26:19 0 d-------- C:\WINDOWS\Downloaded Installations 2007-05-11 18:22:29 0 d-------- C:\Documents and Settings\Admin\Application Data\Lavasoft 2007-05-10 19:36:07 0 d-------- C:\Documents and Settings\Admin\Application Data\Identities 2007-05-10 08:26:06 0 d-------- C:\Documents and Settings\Admin\Application Data\Adobe 2007-05-08 19:42:12 0 d-------- C:\Program Files\Easiestutils 2007-05-08 19:41:08 0 d-------- C:\Downloaded Videos 2007-05-08 19:40:58 101888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows> 2007-05-07 18:03:21 50 --a------ C:\WINDOWS\system32\BRIDF04A.dat 2007-05-07 18:03:07 51200 -----n--- C:\WINDOWS\system32\brinsstr.dll <Not Verified; Brother Industries,Ltd.; Brother MFL Pro> 2007-05-07 18:03:02 147456 -----n--- C:\WINDOWS\brunin03.dll <Not Verified; Brother Industries,Ltd.; Brother MFL-Pro> 2007-05-07 18:02:23 0 d-------- C:\Documents and Settings\All Users\Application Data\Brother 2007-05-07 18:01:34 0 d-------- C:\brother 2007-05-07 16:29:48 0 d-------- C:\Program Files\Microsoft Works 2007-05-07 16:29:37 0 d-------- C:\Program Files\MSBuild 2007-05-07 16:23:53 0 d-------- C:\WINDOWS\SHELLNEW 2007-05-07 16:23:17 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help 2007-05-07 16:22:56 0 dr-h----- C:\MSOCache 2007-05-07 15:57:13 0 d-------- C:\serials 2007-05-07 15:53:38 682232 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-05-07 08:29:08 0 dr-h----- C:\$VAULT$.AVG 2007-05-06 22:59:27 0 d--hs---- C:\Diskeeper 2007-05-06 22:38:03 0 d-------- C:\trayMirc 2007-05-06 22:29:29 262144 --a------ C:\Documents and Settings\All Users\ntuser.dat 2007-05-06 22:03:20 0 d-------- C:\kkirby 2007-05-06 22:03:14 0 d-------- C:\Utorrent_DOwnloads 2007-05-06 21:55:54 0 d-------- C:\Documents and Settings\Admin\Application Data\uTorrent 2007-05-06 21:55:52 0 d-------- C:\Program Files\uTorrent 2007-05-06 21:54:16 0 --a------ C:\WINDOWS\nsreg.dat 2007-05-06 21:54:11 0 d-------- C:\Documents and Settings\Admin\Application Data\Mozilla 2007-05-06 21:51:30 0 d-------- C:\Program Files\mIRC 2007-05-06 21:46:50 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2007-05-06 21:44:49 0 d-------- C:\Documents and Settings\Admin\Application Data\AVG7 2007-05-06 21:44:35 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-05-06 21:44:35 0 d-------- C:\Documents and Settings\All Users\Application Data\avg7 2007-05-06 21:42:56 0 d-------- C:\Documents and Settings\Admin\Application Data\DivX 2007-05-06 21:36:09 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-05-06 21:35:04 11264 --a------ C:\WINDOWS\system32\SpOrder.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(TM) Operating System> 2007-05-06 21:34:43 0 d-------- C:\WINDOWS\Internet Logs 2007-05-06 21:34:07 0 d-------- C:\WINDOWS\system32\LogFiles 2007-05-06 21:33:40 0 d-------- C:\WINDOWS\system32\drivers\umdf 2007-05-06 21:32:33 0 d-------- C:\Documents and Settings\Admin\Application Data\Ahead 2007-05-06 21:31:25 0 d-------- C:\Documents and Settings\All Users\Application Data\Nero 2007-05-06 21:31:24 0 d-------- C:\Program Files\Nero 2007-05-06 21:30:44 0 d-------- C:\Program Files\Common Files\Ahead 2007-05-06 21:27:15 0 d--h----- C:\WINDOWS\$hf_mig$ 2007-05-06 21:27:00 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage 2007-05-06 21:26:52 0 d-------- C:\Program Files\MSXML 4.0 2007-05-06 21:26:31 0 d-------- C:\Program Files\Opera 2007-05-06 21:25:43 0 d-------- C:\WBLINDS 2007-05-06 21:25:20 171280 --a------ C:\WINDOWS\system32\jit.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-06 21:25:20 139536 --a------ C:\WINDOWS\system32\javaee.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-06 21:25:20 46352 --a------ C:\WINDOWS\setdebug.exe <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-06 21:25:20 6550 --a------ C:\WINDOWS\jautoexp.dat 2007-05-06 21:25:19 313856 --a------ C:\WINDOWS\system32\dx3j.dll <Not Verified; Microsoft Corporation; Microsoft® DirectX for Java> 2007-05-06 21:25:14 113 --a------ C:\WINDOWS\system32\zonedon.reg 2007-05-06 21:25:14 113 --a------ C:\WINDOWS\system32\zonedoff.reg 2007-05-06 21:25:14 171792 --a------ C:\WINDOWS\system32\wjview.exe <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-06 21:25:14 286992 --a------ C:\WINDOWS\system32\vmhelper.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-06 21:25:14 21264 --a------ C:\WINDOWS\system32\msjdbc10.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-06 21:25:13 947472 --a------ C:\WINDOWS\system32\msjava.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-06 21:25:13 154384 --a------ C:\WINDOWS\system32\msawt.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-06 21:25:13 172304 --a------ C:\WINDOWS\system32\jview.exe <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-06 21:25:13 15120 --a------ C:\WINDOWS\system32\jdbgmgr.exe <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-06 21:25:12 404752 --a------ C:\WINDOWS\system32\javart.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-06 21:25:12 63248 --a------ C:\WINDOWS\system32\javaprxy.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-06 21:25:12 187152 --a------ C:\WINDOWS\system32\javacypt.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-06 21:25:11 49424 --a------ C:\WINDOWS\system32\clspack.exe <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-06 21:25:05 0 d-------- C:\Documents and Settings\Admin\Application Data\Macromedia 2007-05-06 21:24:46 1138688 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-05-06 21:24:46 1415680 --a------ C:\WINDOWS\system32\WMV9VCM.dll <Not Verified; Microsoft Corporation; Windows Media Video 9 VCM> 2007-05-06 21:24:45 217088 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-05-06 21:24:43 5120 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-05-06 21:24:41 0 d-------- C:\Program Files\K-Lite Codec Pack 2007-05-06 21:24:24 0 d-------- C:\Program Files\Diskeeper Corporation 2007-05-06 21:23:57 0 d-------- C:\Program Files\Google 2007-05-06 21:23:36 0 d-------- C:\Program Files\Common Files\Adobe 2007-05-06 21:23:35 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe 2007-05-06 21:23:06 0 d-------- C:\Program Files\Lavasoft 2007-05-06 21:22:50 0 d-------- C:\Documents and Settings\Administrator\Application Data 2007-05-06 21:22:50 0 d-------- C:\Documents and Settings\Administrator\Application Data\Microsoft 2007-05-06 21:22:43 0 d-------- C:\Program Files\Real Alternative 2007-05-06 21:22:43 0 d-------- C:\Documents and Settings\All Users\Application Data\Real 2007-05-06 21:22:43 0 d-------- C:\Documents and Settings\Admin\Application Data\Real 2007-05-06 21:22:39 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-05-06 21:22:27 0 d-------- C:\Program Files\QuickTime Alternative 2007-05-06 21:22:27 0 d-------- C:\Program Files\Media Player Classic 2007-05-06 21:17:34 0 d--h----- C:\Documents and Settings\Admin\Templates 2007-05-06 21:17:34 0 dr------- C:\Documents and Settings\Admin\Start Menu 2007-05-06 21:17:34 0 dr-h----- C:\Documents and Settings\Admin\SendTo 2007-05-06 21:17:34 0 d--h----- C:\Documents and Settings\Admin\PrintHood 2007-05-06 21:17:34 2359296 --ah----- C:\Documents and Settings\Admin\NTUSER.DAT 2007-05-06 21:17:34 0 d-------- C:\Documents and Settings\Admin\nss1004.tmp 2007-05-06 21:17:34 0 d--h----- C:\Documents and Settings\Admin\NetHood 2007-05-06 21:17:34 0 dr------- C:\Documents and Settings\Admin\My Documents 2007-05-06 21:17:34 0 d--h----- C:\Documents and Settings\Admin\Local Settings 2007-05-06 21:17:34 0 dr------- C:\Documents and Settings\Admin\Favorites 2007-05-06 21:17:34 0 d-------- C:\Documents and Settings\Admin\Desktop 2007-05-06 21:17:34 0 d---s---- C:\Documents and Settings\Admin\Cookies 2007-05-06 21:17:34 0 dr-h----- C:\Documents and Settings\Admin\Application Data 2007-05-06 21:17:04 0 d---s---- C:\WINDOWS\system32\Microsoft 2007-05-06 21:17:04 0 d-------- C:\WINDOWS\Prefetch 2007-05-06 21:17:03 270336 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT 2007-05-06 21:17:03 0 d--h----- C:\Documents and Settings\LocalService\Local Settings 2007-05-06 21:17:03 0 d---s---- C:\Documents and Settings\LocalService\Cookies 2007-05-06 21:17:03 0 d-------- C:\Documents and Settings\LocalService\Application Data 2007-05-06 21:17:03 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft 2007-05-06 21:16:55 270336 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT 2007-05-06 21:16:55 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings 2007-05-06 21:16:55 0 d---s---- C:\Documents and Settings\NetworkService\Cookies 2007-05-06 21:16:55 0 d-------- C: |
located at the bottom of the page.
then click 