|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Virus/Trojan/Spyware Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
LinkBack | Thread Tools |
09-26-2009, 12:53 PM
|
#1 (permalink) |
|
Registered User
Join Date: Sep 2009
Posts: 10
OS: vista home premium
|
Trojan Error and popups
Hi,
I am having problems with my anti virus software telling me i have a trojan virus on on pc. i run f-secure thru charter internet and it tells me it has found it yet failed to do anything with it. I am also getting ads on my pc free floating on the screens at times. and lastly, i get a window that pops up and says that my computer is infected it shows files like my pc is being scanned and asked me to download a virus protection program from the interent. one more thing and i am not sure if it is related. my dvd drive will is not recognized in anything except for windows media player and windows dvd maker. any other programs do not find the drive at all.  please help. Attached are the files requested.DDS (Ver_09-09-24.01) - NTFSx86 Run by at 13:58:00.12 on Sat 09/26/2009 Internet Explorer: 8.0.6001.18813 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2942.1903 [GMT -4:00] SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k rpcss C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\rundll32.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\Windows\system32\atashost.exe C:\Program Files\Charter Security Suite\Anti-Virus\fsgk32st.exe C:\Program Files\Charter Security Suite\Common\FSMA32.EXE C:\Program Files\Charter Security Suite\Anti-Virus\FSGK32.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Charter Security Suite\Common\FSMB32.EXE C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Windows\system32\WUDFHost.exe C:\Program Files\Charter Security Suite\Common\FCH32.EXE C:\Program Files\Charter Security Suite\Anti-Virus\fssm32.exe C:\Program Files\Charter Security Suite\Common\FAMEH32.EXE C:\Program Files\Charter Security Suite\FSAUA\program\fsaua.exe C:\Program Files\Charter Security Suite\ORSP Client\fsorsp.exe C:\Program Files\Charter Security Suite\Anti-Virus\fsqh.exe C:\Program Files\Charter Security Suite\FWES\Program\fsdfwd.exe C:\Program Files\Charter Security Suite\FSPC\fspc.exe C:\Windows\system32\taskeng.exe C:\Program Files\Charter Security Suite\FSAUA\program\fsus.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Charter Security Suite\Anti-Virus\fsav32.exe C:\Program Files\Windows Defender\MSASCui.exe C:\hp\support\hpsysdrv.exe C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe C:\Windows\RtHDVCpl.exe C:\Windows\system32\schtasks.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Charter Security Suite\Common\FSM32.EXE C:\Windows\System32\rundll32.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\COMODO\COMODO Internet Security\cfp.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\Windows\Pixart\Pac7302\Monitor.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\ehome\ehmsas.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\ehome\ehsched.exe C:\Program Files\Charter Security Suite\FSGUI\fsguidll.exe C:\Windows\ehome\ehRecvr.exe c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe C:\Windows\system32\svchost.exe -k WindowsMobile C:\Windows\System32\mobsync.exe C:\hp\kbd\kbd.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\rundll32.exe C:\Users\Lyonez Pro\Desktop\dds.scr C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - Symantec Intrusion Prevention BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn3\YTSingleInstance.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe mRun: [KBD] c:\hp\kbd\KbdStub.EXE mRun: [OsdMaestro] "c:\program files\hewlett-packard\on-screen osd indicator\OSD.exe" mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [SunJavaUpdateReg] "c:\windows\system32\jureg.exe" mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [F-Secure Manager] "c:\program files\charter security suite\common\FSM32.EXE" /splash mRun: [F-Secure TNB] "c:\program files\charter security suite\fsgui\TNBUtil.exe" /CHECKALL /WAITFORSW mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe mRun: [PAC7302_Monitor] c:\windows\pixart\pac7302\Monitor.exe mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe mRunOnce: [PCDrProfiler] "c:\program files\pc-doctor for windows\RunProfiler.exe" -r mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: {200DB664-75B5-47c0-8B45-A44ACCF73C00} - {D68926FD-18FD-4B0E-A1C7-917D13FAB760} - c:\program files\charter security suite\fspc\fspcmsie.dll IE: {200DB664-75B5-47c0-8B45-A44ACCF73F01} - {D68926FD-18FD-4B0E-A1C7-917D13FAB760} - c:\program files\charter security suite\fspc\fspcmsie.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL LSP: c:\windows\system32\wpclsp.dll DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {A3256902-51FA-45A0-8A97-FC1143C169D9} - hxxp://support.microsoft.com/mats/DiagWebControl.cab DPF: {CAFECAFE-0013-0001-0022-ABCDEFABCDEF} - hxxp://www.fultoncourtrecords.com:7778/forms/jinitiator/jinit.exe DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll AppInit_DLLs: c:\windows\system32\guard32.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll ============= SERVICES / DRIVERS =============== R0 crpf;crpf;c:\windows\system32\drivers\crpf.sys [2009-7-10 37920] R0 csdf;cdsf;c:\windows\system32\drivers\csdf.sys [2009-7-10 40480] R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [2009-7-6 33920] R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2009-7-10 128888] R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2009-7-10 29520] R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\charter security suite\hips\drivers\fshs.sys [2009-7-6 67808] R1 FSES;F-Secure Email Scanning Driver;c:\windows\system32\drivers\fses.sys [2009-7-6 35552] R1 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2009-7-6 70944] R1 fsvista;F-Secure Vista Support Driver;c:\program files\charter security suite\anti-virus\minifilter\fsvista.sys [2009-7-6 12384] R2 atashost;WebEx Service Host for Support Center;c:\windows\system32\atashost.exe [2009-5-23 20376] R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-5-19 240512] R2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\common files\microsoft shared\windows live\WLIDSVC.EXE [2009-3-30 1533808] R2 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392] R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\charter security suite\anti-virus\minifilter\fsgk.sys [2009-7-6 99960] R3 FSORSPClient;F-Secure ORSP Client;c:\program files\charter security suite\orsp client\fsorsp.exe [2009-7-6 55904] R3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\system32\drivers\HCW85BDA.sys [2008-12-3 1426304] R3 PAC7302;PAC7302 VGA USB Camera;c:\windows\system32\drivers\PAC7302.SYS [2009-9-17 457856] S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2009-9-9 54632] S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864] S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2009-3-30 33176] S4 F-Secure Filter;F-Secure File System Filter;c:\program files\charter security suite\anti-virus\win2k\fsfilter.sys [2009-7-6 39776] S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\charter security suite\anti-virus\win2k\fsrec.sys [2009-7-6 25184] =============== Created Last 30 ================ 2009-09-26 13:22 <DIR> -cdsh--- C:\$RECYCLE.BIN 2009-09-26 13:10 229,888 a------- c:\windows\PEV.exe 2009-09-26 13:10 161,792 a------- c:\windows\SWREG.exe 2009-09-26 13:10 98,816 a------- c:\windows\sed.exe 2009-09-26 13:10 <DIR> -cd----- C:\ComboFix 2009-09-20 02:31 130 a------- c:\windows\cfplogvw.INI 2009-09-18 19:24 <DIR> --d----- c:\users\lyonez~1\appdata\roaming\licenses 2009-09-18 19:24 <DIR> --d----- c:\users\lyonez~1\appdata\roaming\PCMM2009 2009-09-18 19:23 <DIR> --d----- c:\program files\PC MightyMax 2009 2009-09-17 15:39 457,856 a------- c:\windows\system32\drivers\PAC7302.SYS 2009-09-17 15:39 6,656 a------- c:\windows\system32\CoInst.dll 2009-09-17 15:39 <DIR> --d----- c:\windows\Pixart 2009-09-17 15:39 129,024 a------- c:\windows\system32\SP7302.AX 2009-09-17 15:39 566 a------- c:\windows\system32\SP7302.INI 2009-09-17 15:39 <DIR> --d----- c:\program files\VGA USB Camera 2009-09-17 15:37 <DIR> --d----- c:\programdata\ArcSoft 2009-09-17 15:37 <DIR> --d----- c:\progra~2\ArcSoft 2009-09-17 15:36 18,688 a------- c:\windows\system32\drivers\afc.sys 2009-09-16 15:47 524,288 a--sh--- C:\ntuser.dat{4da9142e-a2f9-11de-a818-001e900ae83b}.TMContainer00000000000000000002.regtrans-ms 2009-09-16 15:47 524,288 a--sh--- C:\ntuser.dat{4da9142e-a2f9-11de-a818-001e900ae83b}.TMContainer00000000000000000001.regtrans-ms 2009-09-16 15:47 65,536 a--sh--- C:\ntuser.dat{4da9142e-a2f9-11de-a818-001e900ae83b}.TM.blf 2009-09-16 15:47 5,120 a---h--- C:\ntuser.dat.LOG1 2009-09-16 15:47 0 a---h--- C:\ntuser.dat.LOG2 2009-09-16 15:47 262,144 a------- C:\ntuser.dat 2009-09-12 15:46 <DIR> --d----- c:\programdata\Office Genuine Advantage 2009-09-12 15:37 28,672 a------- c:\windows\system32\Apphlpdm.dll 2009-09-12 15:37 4,240,384 a------- c:\windows\system32\GameUXLegacyGDFs.dll 2009-09-10 03:11 <DIR> --d----- c:\program files\Skyhook Wireless 2009-09-10 01:21 293,376 a------- c:\windows\system32\wlanmsm.dll 2009-09-10 01:21 127,488 a------- c:\windows\system32\L2SecHC.dll 2009-09-10 01:21 302,592 a------- c:\windows\system32\wlansec.dll 2009-09-10 01:21 2,501,921 a------- c:\windows\system32\wlan.tmf 2009-09-10 01:21 65,024 a------- c:\windows\system32\wlanapi.dll 2009-09-10 01:21 513,536 a------- c:\windows\system32\wlansvc.dll 2009-09-10 01:20 2,868,224 a------- c:\windows\system32\mf.dll 2009-09-10 01:17 904,776 a------- c:\windows\system32\drivers\tcpip.sys 2009-09-10 01:17 105,984 a------- c:\windows\system32\netiohlp.dll 2009-09-10 01:17 27,136 a------- c:\windows\system32\NETSTAT.EXE 2009-09-10 01:17 19,968 a------- c:\windows\system32\ARP.EXE 2009-09-10 01:17 9,728 a------- c:\windows\system32\TCPSVCS.EXE 2009-09-10 01:17 10,240 a------- c:\windows\system32\finger.exe 2009-09-10 01:17 11,264 a------- c:\windows\system32\MRINFO.EXE 2009-09-10 01:17 8,704 a------- c:\windows\system32\HOSTNAME.EXE 2009-09-10 01:17 30,720 a------- c:\windows\system32\drivers\tcpipreg.sys 2009-09-10 01:17 17,920 a------- c:\windows\system32\ROUTE.EXE 2009-09-10 01:17 17,920 a------- c:\windows\system32\netevent.dll 2009-09-09 20:55 <DIR> --d----- c:\users\lyonez~1\appdata\roaming\Blackberry Desktop 2009-09-09 20:49 <DIR> --d----- c:\program files\Research In Motion 2009-09-09 19:24 <DIR> --d----- c:\users\lyonez~1\appdata\roaming\Research In Motion 2009-09-09 17:24 54,632 a------- c:\windows\system32\drivers\fssfltr.sys 2009-09-09 17:23 <DIR> --d----- c:\program files\Microsoft SQL Server Compact Edition 2009-09-09 15:25 <DIR> --d----- c:\program files\Windows Installer Clean Up 2009-09-09 15:24 <DIR> --d----- c:\program files\MSECACHE 2009-09-09 14:31 196,608 a------- c:\windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.perf 2009-09-09 14:31 65,536 a------- c:\windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.dpx 2009-09-09 14:31 2,424,832 a------- c:\windows\ocsetup_install_MicrosoftWindowsPowerShell.etl 2009-09-09 14:31 <DIR> --d----- c:\program files\Microsoft ATS 2009-09-09 13:43 4,984 a------- c:\windows\system32\drivers\nvphy.bin 2009-09-06 13:36 411,368 a------- c:\windows\system32\deploytk.dll 2009-09-02 18:49 <DIR> -cd----- C:\My Music 2009-08-30 00:10 45,164 -------- c:\windows\system32\plugincpl13122.cpl 2009-08-30 00:10 36,962 -------- c:\windows\system32\ActPanel.dll 2009-08-30 00:10 <DIR> --d----- c:\program files\Oracle 2009-08-27 19:37 0 a------- c:\users\lyonez~1\appdata\roaming\wklnhst.dat ==================== Find3M ==================== 2009-09-26 13:02 1,474,832 a------- c:\windows\system32\drivers\sfi.dat 2009-09-17 15:39 143,360 a------- c:\windows\inf\infstrng.dat 2009-09-17 15:39 143,360 a------- c:\windows\inf\infstor.dat 2009-09-17 15:39 51,200 a------- c:\windows\inf\infpub.dat 2009-09-17 15:28 179,792 a------- c:\windows\system32\guard32.dll 2009-09-17 15:28 29,520 a------- c:\windows\system32\drivers\cmdhlp.sys 2009-09-17 15:28 128,888 a------- c:\windows\system32\drivers\cmdguard.sys 2009-09-10 14:54 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-10 14:53 19,160 a------- c:\windows\system32\drivers\mbam.sys 2009-08-28 22:30 173,056 a------- c:\windows\apppatch\AcXtrnal.dll 2009-08-28 22:30 458,752 a------- c:\windows\apppatch\AcSpecfc.dll 2009-08-28 22:30 2,159,616 a------- c:\windows\apppatch\AcGenral.dll 2009-08-28 22:30 542,720 a------- c:\windows\apppatch\AcLayers.dll 2009-08-04 09:48 2,744,800 a------- c:\windows\system32\drivers\RTKVHDA.sys 2009-08-04 09:17 1,265,696 a------- c:\windows\system32\RtkPgExt.dll 2009-08-04 09:17 52,256 a------- c:\windows\system32\RtkCoInst.dll 2009-08-04 09:17 2,898,464 a------- c:\windows\system32\RtkAPO.dll 2009-08-04 09:17 326,176 a------- c:\windows\system32\RtkApoApi.dll 2009-08-03 15:07 403,816 a------- c:\windows\system32\OGACheckControl.dll 2009-08-03 15:07 322,928 a------- c:\windows\system32\OGAAddin.dll 2009-08-03 15:07 230,768 a------- c:\windows\system32\OGAEXEC.exe 2009-07-26 16:44 48,448 a------- c:\windows\system32\sirenacm.dll 2009-07-25 23:07 665,600 a------- c:\windows\inf\drvindex.dat 2009-07-21 17:52 915,456 a------- c:\windows\system32\wininet.dll 2009-07-21 17:47 109,056 a------- c:\windows\system32\iesysprep.dll 2009-07-21 17:47 71,680 a------- c:\windows\system32\iesetup.dll 2009-07-21 16:13 133,632 a------- c:\windows\system32\ieUnatt.exe 2009-07-21 14:01 266,240 a------- c:\windows\system32\FMAPO.dll 2009-07-17 09:54 71,680 a------- c:\windows\system32\atl.dll 2009-07-15 08:40 8,147,456 a------- c:\windows\system32\wmploc.DLL 2009-07-15 08:39 313,344 a------- c:\windows\system32\wmpdxm.dll 2009-07-15 08:39 4,096 a------- c:\windows\system32\dxmasf.dll 2009-07-15 08:39 7,680 a------- c:\windows\system32\spwmp.dll 2009-07-07 13:42 319,456 a------- c:\windows\DIFxAPI.dll 2008-06-29 04:09 174 a--sh--- c:\program files\desktop.ini 2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat ============= FINISH: 13:58:21.19 =============== |
|
     
|
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
10-04-2009, 11:16 AM
|
#3 (permalink) |
|
Visiting Teacher/Analyst, Security Team
Join Date: Jun 2008
Location: Finland
Posts: 755
OS: Win XP, Vista 32-bit, Win7 64-bit
|
Re: Trojan Error and popups
Hi,
It seems you've run ComboFix there too (should be done under supervision of trained helper only). Kindly post back contents of its report.
__________________
 Microsoft MVP Consumer Security 2008 2009 ASAP & UNITE member since 2006 |
|
|
|
|
10-04-2009, 05:56 PM
|
#4 (permalink) |
|
Registered User
Join Date: Sep 2009
Posts: 10
OS: vista home premium
|
Re: Trojan Error and popups
here is the combo fix log.
ComboFix 09-09-25.01 - LP 09/26/2009 13:11.1.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2942.1627 [GMT -4:00] Running from: c:\users\LP\Desktop\ComboFix.exe SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-1857883511-523636785-2748142994-500 c:\$recycle.bin\S-1-5-21-1857883511-523636785-2748142994-501 c:\$recycle.bin\S-1-5-21-192345369-2729201545-2745846667-1000 c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500 c:\$recycle.bin\S-1-5-21-4263315954-3256946145-2243115215-500 c:\windows\system32\gxvxccount . ((((((((((((((((((((((((( Files Created from 2009-08-26 to 2009-09-26 ))))))))))))))))))))))))))))))) . 2009-09-18 23:24 . 2009-09-18 23:24 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\licenses 2009-09-18 23:24 . 2009-09-18 23:25 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\PCMM2009 2009-09-18 23:23 . 2009-09-18 23:27 -------- d-----w- c:\program files\PC MightyMax 2009 2009-09-17 19:44 . 2009-09-17 19:44 -------- d-----w- c:\users\Lyonez Pro\AppData\Local\ArcSoft 2009-09-17 19:39 . 2009-09-17 19:47 -------- d-----w- c:\windows\Pixart 2009-09-17 19:39 . 2007-06-14 19:29 457856 ----a-w- c:\windows\system32\drivers\PAC7302.SYS 2009-09-17 19:39 . 2006-11-20 13:04 6656 ----a-w- c:\windows\system32\CoInst.dll 2009-09-17 19:39 . 2009-09-17 19:39 -------- d-----w- c:\program files\VGA USB Camera 2009-09-17 19:37 . 2009-09-17 19:49 -------- d-----w- c:\documents and settings\All Users\Application Data\ArcSoft 2009-09-17 19:36 . 2006-11-10 19:05 18688 ----a-w- c:\windows\system32\drivers\afc.sys 2009-09-17 19:33 . 2009-09-17 19:35 -------- d-----w- c:\program files\Common Files\ArcSoft 2009-09-17 19:33 . 2009-09-17 19:33 -------- d-----w- c:\program files\ArcSoft 2009-09-17 19:32 . 2009-09-21 23:45 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\ArcSoft 2009-09-16 19:48 . 2009-09-16 19:48 -------- d-s---w- c:\windows\system32\config\systemprofile\AppData\Roaming\yahoo! 2009-09-16 19:47 . 2009-09-16 19:47 262144 ----a-w- C:\ntuser.dat 2009-09-12 19:46 . 2009-09-12 19:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage 2009-09-12 19:37 . 2009-08-29 00:14 28672 ----a-w- c:\windows\system32\Apphlpdm.dll 2009-09-12 19:37 . 2009-08-29 00:27 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2009-09-10 07:11 . 2009-09-18 23:27 -------- d-----w- c:\program files\Skyhook Wireless 2009-09-10 05:21 . 2009-07-11 19:01 293376 ----a-w- c:\windows\system32\wlanmsm.dll 2009-09-10 05:21 . 2009-07-11 17:03 127488 ----a-w- c:\windows\system32\L2SecHC.dll 2009-09-10 05:21 . 2009-07-11 19:01 302592 ----a-w- c:\windows\system32\wlansec.dll 2009-09-10 05:21 . 2009-07-11 19:01 65024 ----a-w- c:\windows\system32\wlanapi.dll 2009-09-10 05:21 . 2009-07-11 19:01 513536 ----a-w- c:\windows\system32\wlansvc.dll 2009-09-10 05:20 . 2009-06-10 11:41 2868224 ----a-w- c:\windows\system32\mf.dll 2009-09-10 05:17 . 2009-08-14 16:27 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys 2009-09-10 05:17 . 2009-08-14 13:48 105984 ----a-w- c:\windows\system32\netiohlp.dll 2009-09-10 05:17 . 2009-08-14 13:49 27136 ----a-w- c:\windows\system32\NETSTAT.EXE 2009-09-10 05:17 . 2009-08-14 13:49 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE 2009-09-10 05:17 . 2009-08-14 13:49 19968 ----a-w- c:\windows\system32\ARP.EXE 2009-09-10 05:17 . 2009-08-14 13:49 10240 ----a-w- c:\windows\system32\finger.exe 2009-09-10 05:17 . 2009-08-14 13:49 11264 ----a-w- c:\windows\system32\MRINFO.EXE 2009-09-10 05:17 . 2009-08-14 13:49 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE 2009-09-10 05:17 . 2009-08-14 13:48 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys 2009-09-10 05:17 . 2009-08-14 13:49 17920 ----a-w- c:\windows\system32\ROUTE.EXE 2009-09-10 05:17 . 2009-08-14 15:53 17920 ----a-w- c:\windows\system32\netevent.dll 2009-09-10 00:55 . 2009-09-10 00:55 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Blackberry Desktop 2009-09-10 00:49 . 2009-09-10 00:51 -------- d-----w- c:\program files\Research In Motion 2009-09-10 00:22 . 2009-09-10 00:23 -------- d-----w- c:\program files\QuickTime 2009-09-10 00:20 . 2009-09-10 00:20 -------- d-----w- c:\program files\Common Files\Apple 2009-09-10 00:20 . 2009-09-10 00:20 -------- d-----w- c:\program files\Apple Software Update 2009-09-09 23:24 . 2009-09-09 23:24 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Research In Motion 2009-09-09 21:24 . 2009-08-06 02:48 54632 ----a-w- c:\windows\system32\drivers\fssfltr.sys 2009-09-09 21:24 . 2009-09-09 21:24 -------- d-----w- c:\program files\Microsoft Sync Framework 2009-09-09 21:23 . 2009-09-09 21:23 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition 2009-09-09 19:25 . 2009-09-09 19:25 -------- d-----w- c:\program files\Windows Installer Clean Up 2009-09-09 19:24 . 2009-09-09 19:24 -------- d-----w- c:\program files\MSECACHE 2009-09-09 18:44 . 2009-09-09 20:29 -------- d-----w- c:\users\Lyonez Pro\AppData\Local\ElevatedDiagnostics 2009-09-09 18:31 . 2009-09-09 18:31 -------- d-----w- c:\program files\Microsoft ATS 2009-09-09 17:43 . 2008-07-08 12:45 4984 ----a-w- c:\windows\system32\drivers\nvphy.bin 2009-09-06 17:36 . 2009-09-06 17:35 411368 ----a-w- c:\windows\system32\deploytk.dll 2009-09-02 22:49 . 2009-09-02 22:49 -------- dc----w- C:\My Music 2009-08-30 04:10 . 2005-04-05 08:38 36962 ------w- c:\windows\system32\ActPanel.dll 2009-08-30 04:10 . 2009-08-30 04:10 -------- d-----w- c:\program files\Oracle 2009-08-27 23:37 . 2009-08-27 23:37 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Template . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-09-26 17:02 . 2009-07-10 07:43 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat 2009-09-26 16:34 . 2009-06-07 05:34 -------- d-----w- c:\program files\Charter Security Suite 2009-09-24 23:40 . 2009-06-15 21:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-09-21 02:36 . 2008-03-01 02:23 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\uTorrent 2009-09-20 05:22 . 2008-10-11 02:19 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Move Networks 2009-09-18 18:36 . 2008-05-09 06:01 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Canon 2009-09-18 11:44 . 2009-04-03 01:19 108248 ----a-w- c:\users\Kids\AppData\Local\GDIPFONTCACHEV1.DAT 2009-09-17 19:48 . 2007-11-10 05:37 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-09-17 19:28 . 2009-07-10 05:37 74328 ----a-w- c:\windows\system32\drivers\inspect.sys 2009-09-17 19:28 . 2009-07-10 05:37 179792 ----a-w- c:\windows\system32\guard32.dll 2009-09-17 19:28 . 2009-07-10 05:37 29520 ----a-w- c:\windows\system32\drivers\cmdhlp.sys 2009-09-17 19:28 . 2009-07-10 05:37 128888 ----a-w- c:\windows\system32\drivers\cmdguard.sys 2009-09-17 00:11 . 2008-02-28 21:53 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Yahoo! 2009-09-16 19:46 . 2008-02-28 21:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion 2009-09-12 19:43 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2009-09-12 19:42 . 2008-02-24 06:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-09-10 18:54 . 2009-07-23 01:59 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-10 18:53 . 2009-07-23 01:59 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-09-10 00:50 . 2008-09-15 04:34 -------- d-----w- c:\program files\Common Files\Research In Motion 2009-09-10 00:22 . 2008-09-18 00:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer 2009-09-09 21:36 . 2008-02-29 00:25 -------- d-----w- c:\program files\Windows Live 2009-09-09 21:24 . 2009-03-31 19:42 -------- d-----w- c:\program files\Microsoft Office Outlook Connector 2009-09-09 21:16 . 2008-03-01 02:41 -------- d-----w- c:\program files\DivX 2009-09-09 20:15 . 2008-02-23 05:36 108248 ----a-w- c:\users\Lyonez Pro\AppData\Local\GDIPFONTCACHEV1.DAT 2009-09-09 20:05 . 2009-04-28 21:31 -------- d-----w- c:\program files\Common Files\AVSMedia 2009-09-09 20:05 . 2009-04-28 21:31 -------- d-----w- c:\program files\AVS4YOU 2009-09-09 19:41 . 2008-08-06 07:23 -------- d-----w- c:\program files\Microsoft Silverlight 2009-09-09 17:55 . 2007-11-10 05:39 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA 2009-09-06 17:35 . 2007-11-10 05:47 -------- d-----w- c:\program files\Java 2009-08-30 04:10 . 2007-11-10 05:37 -------- d-----w- c:\program files\Common Files\InstallShield 2009-08-27 23:37 . 2009-08-27 23:37 0 ----a-w- c:\users\Lyonez Pro\AppData\Roaming\wklnhst.dat 2009-08-15 04:17 . 2008-02-23 14:50 680 ----a-w- c:\users\Lyonez Pro\AppData\Local\d3d9caps.dat 2009-08-07 14:14 . 2007-11-10 05:45 -------- d---a-w- c:\program files\Common Files\LightScribe 2009-08-04 13:48 . 2009-08-04 13:48 2744800 ----a-w- c:\windows\system32\drivers\RTKVHDA.sys 2009-08-04 13:17 . 2009-08-04 13:17 1265696 ----a-w- c:\windows\system32\RtkPgExt.dll 2009-08-04 13:17 . 2008-04-03 03:13 52256 ----a-w- c:\windows\system32\RtkCoInst.dll 2009-08-04 13:17 . 2009-08-04 13:17 326176 ----a-w- c:\windows\system32\RtkApoApi.dll 2009-08-04 13:17 . 2008-04-03 03:13 2898464 ----a-w- c:\windows\system32\RtkAPO.dll 2009-08-03 19:07 . 2009-08-03 19:07 403816 ----a-w- c:\windows\system32\OGACheckControl.dll 2009-08-03 19:07 . 2009-08-03 19:07 322928 ----a-w- c:\windows\system32\OGAAddin.dll 2009-08-03 19:07 . 2009-08-03 19:07 230768 ----a-w- c:\windows\system32\OGAEXEC.exe 2009-07-26 20:44 . 2009-07-26 20:44 48448 ----a-w- c:\windows\system32\sirenacm.dll 2009-07-21 21:52 . 2009-07-28 23:53 915456 ----a-w- c:\windows\system32\wininet.dll 2009-07-21 21:47 . 2009-07-28 23:53 109056 ----a-w- c:\windows\system32\iesysprep.dll 2009-07-21 21:47 . 2009-07-28 23:53 71680 ----a-w- c:\windows\system32\iesetup.dll 2009-07-21 20:13 . 2009-07-28 23:53 133632 ----a-w- c:\windows\system32\ieUnatt.exe 2009-07-21 18:01 . 2009-07-21 18:01 266240 ----a-w- c:\windows\system32\FMAPO.dll 2009-07-17 13:54 . 2009-08-13 21:42 71680 ----a-w- c:\windows\system32\atl.dll 2009-07-15 12:40 . 2009-08-13 21:35 8147456 ----a-w- c:\windows\system32\wmploc.DLL 2009-07-15 12:39 . 2009-08-13 21:36 313344 ----a-w- c:\windows\system32\wmpdxm.dll 2009-07-15 12:39 . 2009-08-13 21:36 4096 ----a-w- c:\windows\system32\dxmasf.dll 2009-07-15 12:39 . 2009-08-13 21:35 7680 ----a-w- c:\windows\system32\spwmp.dll 2009-07-10 01:36 . 2009-07-07 02:15 33920 ----a-w- c:\windows\system32\drivers\fsbts.sys 2009-07-07 17:42 . 2007-11-10 05:37 319456 ----a-w- c:\windows\DIFxAPI.dll 2007-11-10 05:06 . 2007-11-10 05:01 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184] "hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536] "KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536] "OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784] "SunJavaUpdateReg"="c:\windows\system32\jureg.exe" [2007-04-07 54936] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-07 198160] "F-Secure Manager"="c:\program files\Charter Security Suite\Common\FSM32.EXE" [2009-02-19 182936] "F-Secure TNB"="c:\program files\Charter Security Suite\FSGUI\TNBUtil.exe" [2009-02-19 957024] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-23 13539872] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-23 92704] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-06 149280] "COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-09-17 1799952] "ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-07-10 195072] "PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-01-15 4874240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Launcher"="c:\windows\SMINST\launcher.exe" [2007-10-09 44168] "PCDrProfiler"="c:\program files\PC-Doctor for Windows\RunProfiler.exe" [2008-09-10 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\System32\guard32.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "VistaSp2"=hex(b):70,d3,e7,ac,9f,0d,ca,01 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{46CDC510-BBF9-45B8-A4E3-749D3D0BD37E}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{198093D5-5017-4AC7-8A1B-3F6D78423B0B}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{53EE0812-56F1-484B-9D99-82DB516C0CF0}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{6F9B64DB-D3A5-4358-A8C8-F0DEE0A4D92D}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{A8B3DDF2-8C4B-4F7A-AD4D-BD76871A99A5}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{1F772AE8-B359-4949-94C3-F694C5A4B998}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{4F6BE64A-84A1-45A6-8976-A051A549E9E0}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{61B9E342-8318-4BDE-AAD0-06E918AE4AA5}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{37282ADB-A5D3-4AEF-B4D8-9B412271550E}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{7DD48E46-1C05-4DD4-B539-5800AEEC32BE}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{0008103B-DCF6-4748-A95D-8AB52B257265}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{4AF93C4C-A63A-4945-A084-61432897DCDD}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{72F018B9-277A-496D-94B4-29DDF6408E91}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{D27D44B8-FE22-47CA-9948-C0977A9935BC}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "{764E0FD4-CA6C-4703-8609-D6FD19471DD1}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "{FE5C39D5-CA72-437A-BED5-CF4E8F55F603}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent "{D09572A3-21C4-43BF-AB95-0159193F4F15}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent "TCP Query User{3869B2BB-07B6-4317-A089-5AB1E8AD4D02}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent "UDP Query User{D5E5D7ED-7094-4D5C-AE16-0766C630D4FC}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent "{E85C6038-0300-438E-B414-966DF34F89F3}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{02356B2F-B7BE-4183-9DEE-7F43F1CA90B9}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "{7F0F0F5F-E7C7-42C5-8EC3-E272E5D9983D}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{2D8A7795-37E2-42CD-A34A-26273DAE8710}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{1BB1A0A4-A66B-4C9C-AACF-A8353A2A6FB5}"= TCP:67:DHCP Discovery Service "{B438DA73-548F-4741-99E1-8A5450D34D92}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync "{9C3564C5-D6A1-4321-BF66-817A321F6F0A}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector "{006B12F6-B54A-4C51-8585-2BF0DBFCCE21}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{4438146C-EA54-4CF7-9D30-83FD58E009E9}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{333250CD-2E34-4282-A748-EA60C5F1A4CB}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{86693735-1338-4308-A8AA-A17347123848}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{6F24C0D5-E042-4BD1-8F8A-4D5BCA453DA6}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{C65C8A33-556F-4B99-94AC-A496BBED6D28}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink R0 crpf;crpf;c:\windows\System32\drivers\crpf.sys [7/10/2009 1:28 AM 37920] R0 csdf;cdsf;c:\windows\System32\drivers\csdf.sys [7/10/2009 1:28 AM 40480] R0 fsbts;fsbts;c:\windows\System32\drivers\fsbts.sys [7/6/2009 10:15 PM 33920] R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\System32\drivers\cmdguard.sys [7/10/2009 1:37 AM 128888] R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\System32\drivers\cmdhlp.sys [7/10/2009 1:37 AM 29520] R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\Charter Security Suite\HIPS\drivers\fshs.sys [7/6/2009 10:15 PM 67808] R1 FSES;F-Secure Email Scanning Driver;c:\windows\System32\drivers\fses.sys [7/6/2009 10:15 PM 35552] R1 FSFW;F-Secure Firewall Driver;c:\windows\System32\drivers\fsdfw.sys [7/6/2009 10:15 PM 70944] R1 fsvista;F-Secure Vista Support Driver;c:\program files\Charter Security Suite\Anti-Virus\minifilter\fsvista.sys [7/6/2009 10:14 PM 12384] R2 atashost;WebEx Service Host for Support Center;c:\windows\System32\atashost.exe [5/23/2009 6:10 PM 20376] R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\Charter Security Suite\Anti-Virus\minifilter\fsgk.sys [7/6/2009 10:14 PM 99960] R3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\System32\drivers\HCW85BDA.sys [12/3/2008 10:20 PM 1426304] R3 PAC7302;PAC7302 VGA USB Camera;c:\windows\System32\drivers\PAC7302.SYS [9/17/2009 3:39 PM 457856] S2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE [3/30/2009 4:28 PM 1533808] S3 FSORSPClient;F-Secure ORSP Client;c:\program files\Charter Security Suite\ORSP Client\fsorsp.exe [7/6/2009 10:15 PM 55904] S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [9/9/2009 5:24 PM 54632] S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [8/5/2009 10:48 PM 704864] S4 F-Secure Filter;F-Secure File System Filter;c:\program files\Charter Security Suite\Anti-Virus\win2k\fsfilter.sys [7/6/2009 10:14 PM 39776] S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\Charter Security Suite\Anti-Virus\win2k\fsrec.sys [7/6/2009 10:14 PM 25184] --- Other Services/Drivers In Memory --- *NewlyCreated* - FSBL *NewlyCreated* - PCD5SRVC{7DB2D2E3-4FE4EEA9-05040000} *Deregistered* - fsbl *Deregistered* - PCD5SRVC{7DB2D2E3-4FE4EEA9-05040000} [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}] c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,LaunchINFSectionEx c:\program files\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12 . Contents of the 'Scheduled Tasks' folder 2009-09-25 c:\windows\Tasks\COMODO Registry Cleaner task.job - c:\program files\COMODO\System Cleaner\CRC.exe [2009-07-10 19:18] 2009-09-26 c:\windows\Tasks\Scheduled scanning task.job - c:\progra~1\CHARTE~1\ANTI-V~1\fsav.exe [2009-07-07 11:44] 2009-09-26 c:\windows\Tasks\User_Feed_Synchronization-{FB4B4EFB-6359-4332-921B-6923D8E1B847}.job - c:\windows\system32\msfeedssync.exe [2009-07-28 20:13] . . ------- Supplementary Scan ------- . mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 LSP: c:\windows\system32\wpclsp.dll DPF: {CAFECAFE-0013-0001-0022-ABCDEFABCDEF} - hxxp://www.fultoncourtrecords.com:7778/forms/jinitiator/jinit.exe . - - - - ORPHANS REMOVED - - - - HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-09-26 13:20 Windows 6.0.6002 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(828) c:\windows\system32\guard32.dll - - - - - - - > 'lsass.exe'(748) c:\windows\system32\guard32.dll . Completion time: 2009-09-26 13:22 ComboFix-quarantined-files.txt 2009-09-26 17:22 Pre-Run: 123,634,114,560 bytes free Post-Run: 123,617,439,744 bytes free 301 --- E O F --- 2009-09-24 14:28 |
|
|
|
|
10-05-2009, 07:27 AM
|
#5 (permalink) |
|
Visiting Teacher/Analyst, Security Team
Join Date: Jun 2008
Location: Finland
Posts: 755
OS: Win XP, Vista 32-bit, Win7 64-bit
|
Re: Trojan Error and popups
Hi,
There're some remnants of Symantec protection software there. Download a removal tool here and run it. Do you have both antivirus and firewall component installed and running of Comodo Internet Security? How about Charter Security Suite? There should be only one antivirus and firewall running in same system. There're some signs of uTorrent P2P file sharing program. It's recommended to uninstall it (if still present). P2P downloads is one of the biggest sources of infections nowadays. Open notepad and copy/paste the text in the quotebox below into it: Code:
DDS::
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000000
[-HKLM\SYSTEM\ControlSet001\Services\gxvxcserv.sys]
Save this as CFScript A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.  Have all your protection software disabled, close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe (let ComboFix update itself) Then post the resultant log. ___________________ Check here to see if your Flash is up-to-date (do it separately with each of your browsers). If not, uninstall vulnerable versions by following instructions here. Fresh version can be obtained here. Uninstall these outdated Javas: J2SE Runtime Environment 5.0 Update 3 Java(TM) SE Runtime Environment 6 Update 1 Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop. Double-click ATF Cleaner.exe to open it Under Main choose: Windows Temp Current User Temp All Users Temp Cookies Temporary Internet Files Prefetch Java Cache *The other boxes are optional* Then click the Empty Selected button. If you use Firefox: Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. If you use Opera: Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. Click Exit on the Main menu to close the program. Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here. Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log. Since there appears to be Malwarebytes' Anti-Malware installed, update its definitions and run a quick scan with it. Post back its report.
__________________
Microsoft MVP Consumer Security 2008 2009 ASAP & UNITE member since 2006 |
|
|
|
|
10-05-2009, 02:12 PM
|
#6 (permalink) |
|
Registered User
Join Date: Sep 2009
Posts: 10
OS: vista home premium
|
Re: Trojan Error and popups
ComboFix 09-10-04.01 - Lyonez Pro 10/05/2009 15:26.2.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2942.1703 [GMT -4:00] Running from: c:\users\Lyonez Pro\Desktop\ComboFix.exe Command switches used :: c:\users\Lyonez Pro\Desktop\CFScript.txt SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . ((((((((((((((((((((((((( Files Created from 2009-09-05 to 2009-10-05 ))))))))))))))))))))))))))))))) . 2009-10-05 19:36 . 2009-10-05 19:37 -------- d-----w- c:\users\Lyonez Pro\AppData\Local\temp 2009-10-05 19:36 . 2009-10-05 19:36 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp 2009-10-05 19:36 . 2009-10-05 19:36 -------- d-----w- c:\users\Public\AppData\Local\temp 2009-10-05 19:36 . 2009-10-05 19:36 -------- d-----w- c:\users\Kids\AppData\Local\temp 2009-10-05 19:36 . 2009-10-05 19:36 -------- d-----w- c:\users\Default\AppData\Local\temp 2009-10-03 01:16 . 2009-10-03 01:16 -------- d-----w- c:\windows\Sun 2009-10-02 12:05 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll 2009-10-02 12:05 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe 2009-10-02 12:05 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll 2009-10-02 12:05 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll 2009-10-02 12:04 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll 2009-10-02 12:04 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll 2009-10-02 12:04 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll 2009-10-02 12:02 . 2009-08-06 23:23 171608 ----a-w- c:\windows\system32\wuwebv.dll 2009-10-02 12:02 . 2009-08-06 22:44 33792 ----a-w- c:\windows\system32\wuapp.exe 2009-09-18 23:24 . 2009-09-18 23:24 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\licenses 2009-09-18 23:24 . 2009-09-18 23:25 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\PCMM2009 2009-09-18 23:23 . 2009-09-18 23:27 -------- d-----w- c:\program files\PC MightyMax 2009 2009-09-17 19:44 . 2009-09-17 19:44 -------- d-----w- c:\users\Lyonez Pro\AppData\Local\ArcSoft 2009-09-17 19:39 . 2009-09-17 19:47 -------- d-----w- c:\windows\Pixart 2009-09-17 19:39 . 2007-06-14 19:29 457856 ----a-w- c:\windows\system32\drivers\PAC7302.SYS 2009-09-17 19:39 . 2006-11-20 13:04 6656 ----a-w- c:\windows\system32\CoInst.dll 2009-09-17 19:39 . 2009-09-17 19:39 -------- d-----w- c:\program files\VGA USB Camera 2009-09-17 19:37 . 2009-09-17 19:49 -------- d-----w- c:\documents and settings\All Users\Application Data\ArcSoft 2009-09-17 19:36 . 2006-11-10 19:05 18688 ----a-w- c:\windows\system32\drivers\afc.sys 2009-09-17 19:33 . 2009-09-17 19:35 -------- d-----w- c:\program files\Common Files\ArcSoft 2009-09-17 19:33 . 2009-09-17 19:33 -------- d-----w- c:\program files\ArcSoft 2009-09-17 19:32 . 2009-09-21 23:45 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\ArcSoft 2009-09-16 19:48 . 2009-09-16 19:48 -------- d-s---w- c:\windows\system32\config\systemprofile\AppData\Roaming\yahoo! 2009-09-16 19:47 . 2009-09-16 19:47 262144 ----a-w- C:\ntuser.dat 2009-09-12 19:46 . 2009-09-12 19:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage 2009-09-12 19:37 . 2009-08-29 00:14 28672 ----a-w- c:\windows\system32\Apphlpdm.dll 2009-09-12 19:37 . 2009-08-29 00:27 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2009-09-10 07:11 . 2009-09-18 23:27 -------- d-----w- c:\program files\Skyhook Wireless 2009-09-10 05:21 . 2009-07-11 19:01 293376 ----a-w- c:\windows\system32\wlanmsm.dll 2009-09-10 05:21 . 2009-07-11 17:03 127488 ----a-w- c:\windows\system32\L2SecHC.dll 2009-09-10 05:21 . 2009-07-11 19:01 302592 ----a-w- c:\windows\system32\wlansec.dll 2009-09-10 05:21 . 2009-07-11 19:01 65024 ----a-w- c:\windows\system32\wlanapi.dll 2009-09-10 05:21 . 2009-07-11 19:01 513536 ----a-w- c:\windows\system32\wlansvc.dll 2009-09-10 05:20 . 2009-06-10 11:41 2868224 ----a-w- c:\windows\system32\mf.dll 2009-09-10 05:17 . 2009-08-14 16:27 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys 2009-09-10 05:17 . 2009-08-14 13:48 105984 ----a-w- c:\windows\system32\netiohlp.dll 2009-09-10 05:17 . 2009-08-14 13:49 27136 ----a-w- c:\windows\system32\NETSTAT.EXE 2009-09-10 05:17 . 2009-08-14 13:49 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE 2009-09-10 05:17 . 2009-08-14 13:49 19968 ----a-w- c:\windows\system32\ARP.EXE 2009-09-10 05:17 . 2009-08-14 13:49 10240 ----a-w- c:\windows\system32\finger.exe 2009-09-10 05:17 . 2009-08-14 13:49 11264 ----a-w- c:\windows\system32\MRINFO.EXE 2009-09-10 05:17 . 2009-08-14 13:49 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE 2009-09-10 05:17 . 2009-08-14 13:48 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys 2009-09-10 05:17 . 2009-08-14 13:49 17920 ----a-w- c:\windows\system32\ROUTE.EXE 2009-09-10 05:17 . 2009-08-14 15:53 17920 ----a-w- c:\windows\system32\netevent.dll 2009-09-10 00:55 . 2009-09-10 00:55 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Blackberry Desktop 2009-09-10 00:49 . 2009-09-10 00:51 -------- d-----w- c:\program files\Research In Motion 2009-09-10 00:22 . 2009-09-10 00:23 -------- d-----w- c:\program files\QuickTime 2009-09-10 00:20 . 2009-09-10 00:20 -------- d-----w- c:\program files\Common Files\Apple 2009-09-10 00:20 . 2009-09-10 00:20 -------- d-----w- c:\program files\Apple Software Update 2009-09-09 23:24 . 2009-09-09 23:24 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Research In Motion 2009-09-09 21:24 . 2009-08-06 02:48 54632 ----a-w- c:\windows\system32\drivers\fssfltr.sys 2009-09-09 21:24 . 2009-09-09 21:24 -------- d-----w- c:\program files\Microsoft Sync Framework 2009-09-09 21:23 . 2009-09-09 21:23 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition 2009-09-09 19:25 . 2009-09-09 19:25 -------- d-----w- c:\program files\Windows Installer Clean Up 2009-09-09 19:24 . 2009-09-09 19:24 -------- d-----w- c:\program files\MSECACHE 2009-09-09 18:44 . 2009-09-09 20:29 -------- d-----w- c:\users\Lyonez Pro\AppData\Local\ElevatedDiagnostics 2009-09-09 18:31 . 2009-09-09 18:31 -------- d-----w- c:\program files\Microsoft ATS 2009-09-09 17:43 . 2008-07-08 12:45 4984 ----a-w- c:\windows\system32\drivers\nvphy.bin 2009-09-06 17:36 . 2009-09-06 17:35 411368 ----a-w- c:\windows\system32\deploytk.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-10-05 19:22 . 2009-03-30 19:25 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS 2009-10-05 18:36 . 2009-07-10 07:43 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat 2009-10-05 16:08 . 2009-06-07 05:34 -------- d-----w- c:\program files\Charter Security Suite 2009-09-24 23:40 . 2009-06-15 21:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-09-20 05:22 . 2008-10-11 02:19 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Move Networks 2009-09-18 18:36 . 2008-05-09 06:01 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Canon 2009-09-18 11:44 . 2009-04-03 01:19 108248 ----a-w- c:\users\Kids\AppData\Local\GDIPFONTCACHEV1.DAT 2009-09-17 19:48 . 2007-11-10 05:37 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-09-17 19:28 . 2009-07-10 05:37 74328 ----a-w- c:\windows\system32\drivers\inspect.sys 2009-09-17 19:28 . 2009-07-10 05:37 179792 ----a-w- c:\windows\system32\guard32.dll 2009-09-17 19:28 . 2009-07-10 05:37 29520 ----a-w- c:\windows\system32\drivers\cmdhlp.sys 2009-09-17 19:28 . 2009-07-10 05:37 128888 ----a-w- c:\windows\system32\drivers\cmdguard.sys 2009-09-17 00:11 . 2008-02-28 21:53 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Yahoo! 2009-09-16 19:46 . 2008-02-28 21:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion 2009-09-12 19:43 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2009-09-12 19:42 . 2008-02-24 06:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-09-10 18:54 . 2009-07-23 01:59 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-10 18:53 . 2009-07-23 01:59 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-09-10 00:50 . 2008-09-15 04:34 -------- d-----w- c:\program files\Common Files\Research In Motion 2009-09-10 00:22 . 2008-09-18 00:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer 2009-09-09 21:36 . 2008-02-29 00:25 -------- d-----w- c:\program files\Windows Live 2009-09-09 21:24 . 2009-03-31 19:42 -------- d-----w- c:\program files\Microsoft Office Outlook Connector 2009-09-09 21:16 . 2008-03-01 02:41 -------- d-----w- c:\program files\DivX 2009-09-09 20:15 . 2008-02-23 05:36 108248 ----a-w- c:\users\Lyonez Pro\AppData\Local\GDIPFONTCACHEV1.DAT 2009-09-09 20:05 . 2009-04-28 21:31 -------- d-----w- c:\program files\Common Files\AVSMedia 2009-09-09 20:05 . 2009-04-28 21:31 -------- d-----w- c:\program files\AVS4YOU 2009-09-09 19:41 . 2008-08-06 07:23 -------- d-----w- c:\program files\Microsoft Silverlight 2009-09-09 17:55 . 2007-11-10 05:39 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA 2009-09-06 17:35 . 2007-11-10 05:47 -------- d-----w- c:\program files\Java 2009-08-30 04:10 . 2009-08-30 04:10 -------- d-----w- c:\program files\Oracle 2009-08-30 04:10 . 2007-11-10 05:37 -------- d-----w- c:\program files\Common Files\InstallShield 2009-08-27 23:37 . 2009-08-27 23:37 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Template 2009-08-27 23:37 . 2009-08-27 23:37 0 ----a-w- c:\users\Lyonez Pro\AppData\Roaming\wklnhst.dat 2009-08-15 04:17 . 2008-02-23 14:50 680 ----a-w- c:\users\Lyonez Pro\AppData\Local\d3d9caps.dat 2009-08-07 14:14 . 2007-11-10 05:45 -------- d---a-w- c:\program files\Common Files\LightScribe 2009-08-04 13:48 . 2009-08-04 13:48 2744800 ----a-w- c:\windows\system32\drivers\RTKVHDA.sys 2009-08-04 13:17 . 2009-08-04 13:17 1265696 ----a-w- c:\windows\system32\RtkPgExt.dll 2009-08-04 13:17 . 2008-04-03 03:13 52256 ----a-w- c:\windows\system32\RtkCoInst.dll 2009-08-04 13:17 . 2009-08-04 13:17 326176 ----a-w- c:\windows\system32\RtkApoApi.dll 2009-08-04 13:17 . 2008-04-03 03:13 2898464 ----a-w- c:\windows\system32\RtkAPO.dll 2009-08-03 19:07 . 2009-08-03 19:07 403816 ----a-w- c:\windows\system32\OGACheckControl.dll 2009-08-03 19:07 . 2009-08-03 19:07 322928 ----a-w- c:\windows\system32\OGAAddin.dll 2009-08-03 19:07 . 2009-08-03 19:07 230768 ----a-w- c:\windows\system32\OGAEXEC.exe 2009-07-26 20:44 . 2009-07-26 20:44 48448 ----a-w- c:\windows\system32\sirenacm.dll 2009-07-21 21:52 . 2009-07-28 23:53 915456 ----a-w- c:\windows\system32\wininet.dll 2009-07-21 21:47 . 2009-07-28 23:53 109056 ----a-w- c:\windows\system32\iesysprep.dll 2009-07-21 21:47 . 2009-07-28 23:53 71680 ----a-w- c:\windows\system32\iesetup.dll 2009-07-21 20:13 . 2009-07-28 23:53 133632 ----a-w- c:\windows\system32\ieUnatt.exe 2009-07-21 18:01 . 2009-07-21 18:01 266240 ----a-w- c:\windows\system32\FMAPO.dll 2009-07-17 13:54 . 2009-08-13 21:42 71680 ----a-w- c:\windows\system32\atl.dll 2009-07-15 12:40 . 2009-08-13 21:35 8147456 ----a-w- c:\windows\system32\wmploc.DLL 2009-07-15 12:39 . 2009-08-13 21:36 313344 ----a-w- c:\windows\system32\wmpdxm.dll 2009-07-15 12:39 . 2009-08-13 21:36 4096 ----a-w- c:\windows\system32\dxmasf.dll 2009-07-15 12:39 . 2009-08-13 21:35 7680 ----a-w- c:\windows\system32\spwmp.dll 2009-07-10 01:36 . 2009-07-07 02:15 33920 ----a-w- c:\windows\system32\drivers\fsbts.sys 2007-11-10 05:06 . 2007-11-10 05:01 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT . ((((((((((((((((((((((((((((( SnapShot@2009-09-26_17.20.31 ))))))))))))))))))))))))))))))))))))))))) . + 2009-10-02 12:05 . 2009-08-07 02:24 44768 c:\windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.4.7600.226_none_e979223d5b9c821b\wups2.dll + 2009-10-02 12:05 . 2009-08-07 02:24 53472 c:\windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.4.7600.226_none_e979223d5b9c821b\wuauclt.exe + 2009-10-02 12:02 . 2009-08-06 22:44 33792 c:\windows\winsxs\x86_microsoft-windows-w..pdateclient-activex_31bf3856ad364e35_7.4.7600.226_none_79951cca15140d1a\wuapp.exe + 2009-10-02 12:04 . 2009-08-07 02:24 35552 c:\windows\winsxs\x86_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_7.4.7600.226_none_cf8a5c896f5cdb1e\wups.dll + 2009-10-02 12:04 . 2009-08-07 01:44 87552 c:\windows\winsxs\x86_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_7.4.7600.226_none_cf8a5c896f5cdb1e\wudriver.dll + 2007-11-10 05:28 . 2009-10-05 18:51 71450 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2006-11-02 13:05 . 2009-10-05 18:51 91786 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2008-02-23 05:23 . 2009-10-05 18:51 18940 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1857883511-523636785-2748142994-1000_UserData.bin - 2008-12-04 21:49 . 2009-08-07 14:21 88589 c:\windows\System32\Macromed\Flash\uninstall_activeX.exe + 2009-10-05 19:06 . 2009-10-05 19:06 88589 c:\windows\System32\Macromed\Flash\uninstall_activeX.exe - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 32768 c:\windows\System32\config\systemprofile\Application Data\Microsoft\Windows\Cookies\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 32768 c:\windows\System32\config\systemprofile\Application Data\Microsoft\Windows\Cookies\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-09-26 17:08 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2009-08-06 23:23 . 2009-08-06 23:23 73288 c:\windows\SoftwareDistribution\SelfUpdate\Handler\WuSetupV.exe - 2009-02-01 04:58 . 2009-09-17 00:18 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-02-01 04:58 . 2009-10-05 17:07 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-02-01 04:58 . 2009-10-05 17:07 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-02-01 04:58 . 2009-09-17 00:09 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-02-01 04:58 . 2009-10-05 17:07 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-02-01 04:58 . 2009-09-17 00:18 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-10-02 12:02 . 2009-08-06 23:23 171608 c:\windows\winsxs\x86_microsoft-windows-w..pdateclient-activex_31bf3856ad364e35_7.4.7600.226_none_79951cca15140d1a\wuwebv.dll + 2009-10-02 12:04 . 2009-08-07 02:23 575704 c:\windows\winsxs\x86_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_7.4.7600.226_none_cf8a5c896f5cdb1e\wuapi.dll + 2008-08-06 13:31 . 2009-10-05 15:06 437806 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin - 2006-11-02 10:33 . 2009-09-25 15:21 605478 c:\windows\System32\perfh009.dat + 2006-11-02 10:33 . 2009-10-03 18:17 605478 c:\windows\System32\perfh009.dat + 2006-11-02 10:33 . 2009-10-03 18:17 105232 c:\windows\System32\perfc009.dat - 2006-11-02 10:33 . 2009-09-25 15:21 105232 c:\windows\System32\perfc009.dat + 2009-09-06 17:36 . 2007-04-07 09:16 139264 c:\windows\System32\javaws.exe + 2009-09-06 17:36 . 2007-04-07 08:15 135168 c:\windows\System32\javaw.exe + 2009-09-06 17:36 . 2007-04-07 08:15 135168 c:\windows\System32\java.exe + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\Local Settings\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\Local Settings\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2008-02-24 06:57 . 2009-10-05 19:09 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat - 2008-02-24 06:57 . 2008-02-28 07:13 262144 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\usrclass.dat + 2009-10-02 12:05 . 2009-08-07 01:45 2421760 c:\windows\winsxs\x86_microsoft-windows-windowsupdateclient-ui_31bf3856ad364e35_7.4.7600.226_none_672645e7fba0c4cc\wucltux.dll + 2009-10-02 12:05 . 2009-08-07 02:23 1929952 c:\windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.4.7600.226_none_e979223d5b9c821b\wuaueng.dll - 2006-11-02 10:22 . 2009-09-12 22:49 6553600 c:\windows\System32\SMI\Store\Machine\schema.dat + 2006-11-02 10:22 . 2009-10-05 18:47 6553600 c:\windows\System32\SMI\Store\Machine\schema.dat + 2009-06-04 11:35 . 2009-10-02 12:06 193222822 c:\windows\winsxs\ManifestCache\6.0.6002.18005_001c11ba_blobs.bin . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184] "hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536] "KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536] "OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784] "SunJavaUpdateReg"="c:\windows\system32\jureg.exe" [2007-04-07 54936] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-07 198160] "F-Secure Manager"="c:\program files\Charter Security Suite\Common\FSM32.EXE" [2009-02-19 182936] "F-Secure TNB"="c:\program files\Charter Security Suite\FSGUI\TNBUtil.exe" [2009-02-19 957024] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-23 13539872] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-23 92704] "COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-09-17 1799952] "ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-07-10 195072] "PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_01\bin\jusched.exe" [2007-04-07 132760] "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-01-15 4874240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Launcher"="c:\windows\SMINST\launcher.exe" [2007-10-09 44168] "PCDrProfiler"="c:\program files\PC-Doctor for Windows\RunProfiler.exe" [2008-09-10 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\System32\guard32.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "VistaSp2"=hex(b):70,d3,e7,ac,9f,0d,ca,01 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{46CDC510-BBF9-45B8-A4E3-749D3D0BD37E}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{198093D5-5017-4AC7-8A1B-3F6D78423B0B}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{53EE0812-56F1-484B-9D99-82DB516C0CF0}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{6F9B64DB-D3A5-4358-A8C8-F0DEE0A4D92D}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{A8B3DDF2-8C4B-4F7A-AD4D-BD76871A99A5}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{1F772AE8-B359-4949-94C3-F694C5A4B998}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{4F6BE64A-84A1-45A6-8976-A051A549E9E0}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{61B9E342-8318-4BDE-AAD0-06E918AE4AA5}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{37282ADB-A5D3-4AEF-B4D8-9B412271550E}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{7DD48E46-1C05-4DD4-B539-5800AEEC32BE}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{0008103B-DCF6-4748-A95D-8AB52B257265}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{4AF93C4C-A63A-4945-A084-61432897DCDD}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{72F018B9-277A-496D-94B4-29DDF6408E91}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{D27D44B8-FE22-47CA-9948-C0977A9935BC}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "{764E0FD4-CA6C-4703-8609-D6FD19471DD1}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "{FE5C39D5-CA72-437A-BED5-CF4E8F55F603}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent "{D09572A3-21C4-43BF-AB95-0159193F4F15}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent "TCP Query User{3869B2BB-07B6-4317-A089-5AB1E8AD4D02}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent "UDP Query User{D5E5D7ED-7094-4D5C-AE16-0766C630D4FC}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent "{7F0F0F5F-E7C7-42C5-8EC3-E272E5D9983D}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{2D8A7795-37E2-42CD-A34A-26273DAE8710}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{1BB1A0A4-A66B-4C9C-AACF-A8353A2A6FB5}"= TCP:67:DHCP Discovery Service "{B438DA73-548F-4741-99E1-8A5450D34D92}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync "{9C3564C5-D6A1-4321-BF66-817A321F6F0A}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector "{006B12F6-B54A-4C51-8585-2BF0DBFCCE21}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{4438146C-EA54-4CF7-9D30-83FD58E009E9}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{333250CD-2E34-4282-A748-EA60C5F1A4CB}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{86693735-1338-4308-A8AA-A17347123848}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{6F24C0D5-E042-4BD1-8F8A-4D5BCA453DA6}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{C65C8A33-556F-4B99-94AC-A496BBED6D28}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "{EEB6C2EA-D226-4C5C-8587-4C9419D42268}"= UDP:c:\users\Lyonez Pro\AppData\Local\temp\7zSBEE5.tmp\SymNRT.exe:Norton Removal Tool "{C94BE236-9AC5-437C-B8ED-4DD57C35A334}"= TCP:c:\users\Lyonez Pro\AppData\Local\temp\7zSBEE5.tmp\SymNRT.exe:Norton Removal Tool [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink R0 crpf;crpf;c:\windows\System32\drivers\crpf.sys [7/10/2009 1:28 AM 37920] R0 csdf;cdsf;c:\windows\System32\drivers\csdf.sys [7/10/2009 1:28 AM 40480] R0 fsbts;fsbts;c:\windows\System32\drivers\fsbts.sys [7/6/2009 10:15 PM 33920] R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\System32\drivers\cmdguard.sys [7/10/2009 1:37 AM 128888] R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\System32\drivers\cmdhlp.sys [7/10/2009 1:37 AM 29520] R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\Charter Security Suite\HIPS\drivers\fshs.sys [7/6/2009 10:15 PM 67808] R1 FSES;F-Secure Email Scanning Driver;c:\windows\System32\drivers\fses.sys [7/6/2009 10:15 PM 35552] R1 FSFW;F-Secure Firewall Driver;c:\windows\System32\drivers\fsdfw.sys [7/6/2009 10:15 PM 70944] R1 fsvista;F-Secure Vista Support Driver;c:\program files\Charter Security Suite\Anti-Virus\minifilter\fsvista.sys [7/6/2009 10:14 PM 12384] R2 atashost;WebEx Service Host for Support Center;c:\windows\System32\atashost.exe [5/23/2009 6:10 PM 20376] R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\Charter Security Suite\Anti-Virus\minifilter\fsgk.sys [7/6/2009 10:14 PM 99960] R3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\System32\drivers\HCW85BDA.sys [12/3/2008 10:20 PM 1426304] R3 PAC7302;PAC7302 VGA USB Camera;c:\windows\System32\drivers\PAC7302.SYS [9/17/2009 3:39 PM 457856] S2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE [3/30/2009 4:28 PM 1533808] S3 FSORSPClient;F-Secure ORSP Client;c:\program files\Charter Security Suite\ORSP Client\fsorsp.exe [7/6/2009 10:15 PM 55904] S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [9/9/2009 5:24 PM 54632] S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [8/5/2009 10:48 PM 704864] S3 getPlusHelper;getPlus(R) Helper;c:\windows\System32\svchost.exe -k getPlusHelper [6/28/2008 11:43 AM 21504] S4 F-Secure Filter;F-Secure File System Filter;c:\program files\Charter Security Suite\Anti-Virus\win2k\fsfilter.sys [7/6/2009 10:14 PM 39776] S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\Charter Security Suite\Anti-Virus\win2k\fsrec.sys [7/6/2009 10:14 PM 25184] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr getPlusHelper REG_MULTI_SZ getPlusHelper [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}] c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,LaunchINFSectionEx c:\program files\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12 . Contents of the 'Scheduled Tasks' folder 2009-09-25 c:\windows\Tasks\COMODO Registry Cleaner task.job - c:\program files\COMODO\System Cleaner\CRC.exe [2009-07-10 19:18] 2009-10-05 c:\windows\Tasks\Scheduled scanning task.job - c:\progra~1\CHARTE~1\ANTI-V~1\fsav.exe [2009-07-07 11:44] 2009-10-05 c:\windows\Tasks\User_Feed_Synchronization-{FB4B4EFB-6359-4332-921B-6923D8E1B847}.job - c:\windows\system32\msfeedssync.exe [2009-07-28 20:13] . . ------- Supplementary Scan ------- . mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 LSP: c:\windows\system32\wpclsp.dll DPF: {CAFECAFE-0013-0001-0022-ABCDEFABCDEF} - hxxp://www.fultoncourtrecords.com:7778/forms/jinitiator/jinit.exe . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-05 15:37 Windows 6.0.6002 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'Explorer.exe'(2844) c:\program files\Hewlett-Packard\HP Advisor\Pillars\Market\MLDeskBand.dll . Completion time: 2009-10-05 15:40 ComboFix-quarantined-files.txt 2009-10-05 19:40 ComboFix2.txt 2009-09-26 17:22 Pre-Run: 123,773,812,736 bytes free Post-Run: 123,776,339,968 bytes free 544 --- E O F --- 2009-10-03 06:47 |
|
|
|
|
10-05-2009, 05:48 PM
|
#7 (permalink) |
|
Registered User
Join Date: Sep 2009
Posts: 10
OS: vista home premium
|
Re: Trojan Error and popups
here are the reports for the dds and also the attach.zip files ... i run both comodo and charter suite. charter is the firewall and comodo does the rest i will attach the malware report in a few moments. also included is the kaspersky report....
-------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0: scan report Monday, October 5, 2009 Operating system: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 2 (build 6002) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Monday, October 05, 2009 21:18:58 Records in database: 2918039 -------------------------------------------------------------------------------- Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\ Scan statistics: Objects scanned: 202918 Threats found: 1 Infected objects found: 1 Suspicious objects found: 0 Scan duration: 02:33:10 File name / Threat / Threats count C:\Windows\System32\drivers\gxvxciwvonkegqfcppxrtbvmbveqhbdmiyquc.0ys Infected: Rootkit.Win32.Agent.llg 1 Selected area has been scanned. |
|
|
|
|
10-05-2009, 06:00 PM
|
#8 (permalink) |
|
Registered User
Join Date: Sep 2009
Posts: 10
OS: vista home premium
|
Re: Trojan Error and popups
Here are the results for the malware bytes scan. Also, when attempting to remove the old java programs as requested it did not allow me to do so. it told me to browse where it is located for the update and for the version 5 3.0 , it told me that it was already installed .. i did allow me to remove version/update 6 rel 15. afterwards i did install 6 rel 16... it does not find the program, however it does still show in the add/remove programs portion of the system.
Malwarebytes' Anti-Malware 1.41 Database version: 2911 Windows 6.0.6002 Service Pack 2 10/5/2009 7:54:37 PM mbam-log-2009-10-05 (19-54-37).txt Scan type: Quick Scan Objects scanned: 97554 Time elapsed: 4 minute(s), 3 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 1 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Program Files\PC MightyMax 2009 (Rogue.PcMightyMax) -> Quarantined and deleted successfully. Files Infected: C:\Program Files\PC MightyMax 2009\pcmm2009.error.log (Rogue.PcMightyMax) -> Quarantined and deleted successfully. |
|
|
|
|
10-06-2009, 07:44 AM
|
#9 (permalink) |
|
Visiting Teacher/Analyst, Security Team
Join Date: Jun 2008
Location: Finland
Posts: 755
OS: Win XP, Vista 32-bit, Win7 64-bit
|
Re: Trojan Error and popups
Hi again,
See if you're able to uninstall these with Windows Installer Cleanup Utility that seems to be installed there: J2SE Runtime Environment 5.0 Update 3 Java(TM) SE Runtime Environment 6 Update 1 Open notepad and copy/paste the text in the quotebox below into it: Code:
File:: C:\Windows\System32\drivers\gxvxciwvonkegqfcppxrtbvmbveqhbdmiyquc.0ys Folder:: c:\users\lyonez~1\appdata\roaming\PCMM2009 c:\program files\PC MightyMax 2009 DirLook:: c:\users\lyonez~1\appdata\roaming\licenses Registry:: [-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] [-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] Save this as CFScript A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use. Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe Then post the resultant log. Let me know about remaining symptoms (if any).
__________________
Microsoft MVP Consumer Security 2008 2009 ASAP & UNITE member since 2006 Last edited by Blade81; 10-06-2009 at 07:47 AM. |
|
|
|
|
10-06-2009, 10:30 AM
|
#10 (permalink) |
|
Registered User
Join Date: Sep 2009
Posts: 10
OS: vista home premium
|
Re: Trojan Error and popups
blade81,
here are the results from the combofix below .. i am still unable to remove a particular file c:\windows\System32\drivers\gxvxciwvonkegqfcppxrtbvmbveqhbdmiyquc.0ys ... what is this file for and why is it not removing. i still see the Java programs in add remove programs that were requested to be reomved as well Java SE Runtime Environment 6Update 1 and J2SE Java Runtime Environment 5.0 update 3.  ComboFix 09-10-05.01 - Lyonez Pro 10/06/2009 11:37.3.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2942.1573 [GMT -4:00] Running from: c:\users\Lyonez Pro\Desktop\ComboFix.exe Command switches used :: c:\users\Lyonez Pro\Desktop\CFScript.txt SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} * Resident AV is active FILE :: "c:\windows\System32\drivers\gxvxciwvonkegqfcppxrtbvmbveqhbdmiyquc.0ys" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\users\lyonez~1\appdata\roaming\PCMM2009 c:\users\lyonez~1\appdata\roaming\PCMM2009\diagnostic\last-scan c:\users\lyonez~1\appdata\roaming\PCMM2009\pcmm2009-configuration c:\windows\System32\drivers\gxvxciwvonkegqfcppxrtbvmbveqhbdmiyquc.0ys . ((((((((((((((((((((((((( Files Created from 2009-09-06 to 2009-10-06 ))))))))))))))))))))))))))))))) . 2009-10-06 15:11 . 2009-10-06 15:11 -------- d-----w- c:\users\Guest\AppData\Local\ArcSoft 2009-10-06 15:11 . 2009-10-06 15:11 -------- d-----w- c:\users\Guest\AppData\Roaming\Malwarebytes 2009-10-06 15:10 . 2009-10-06 15:11 -------- d-----w- c:\users\Guest\AppData\Roaming\ArcSoft 2009-10-06 15:10 . 2009-10-06 15:10 108248 ----a-w- c:\users\Guest\AppData\Local\GDIPFONTCACHEV1.DAT 2009-10-05 20:03 . 2009-10-01 14:29 195440 ------w- c:\windows\system32\MpSigStub.exe 2009-10-05 19:40 . 2009-10-06 16:12 -------- d-----w- c:\users\Lyonez Pro\AppData\Local\temp 2009-10-03 01:16 . 2009-10-03 01:16 -------- d-----w- c:\windows\Sun 2009-10-02 12:05 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll 2009-10-02 12:05 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe 2009-10-02 12:05 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll 2009-10-02 12:05 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll 2009-10-02 12:04 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll 2009-10-02 12:04 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll 2009-10-02 12:04 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll 2009-10-02 12:02 . 2009-08-06 23:23 171608 ----a-w- c:\windows\system32\wuwebv.dll 2009-10-02 12:02 . 2009-08-06 22:44 33792 ----a-w- c:\windows\system32\wuapp.exe 2009-09-18 23:24 . 2009-09-18 23:24 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\licenses 2009-09-17 19:44 . 2009-09-17 19:44 -------- d-----w- c:\users\Lyonez Pro\AppData\Local\ArcSoft 2009-09-17 19:39 . 2009-09-17 19:47 -------- d-----w- c:\windows\Pixart 2009-09-17 19:39 . 2007-06-14 19:29 457856 ----a-w- c:\windows\system32\drivers\PAC7302.SYS 2009-09-17 19:39 . 2006-11-20 13:04 6656 ----a-w- c:\windows\system32\CoInst.dll 2009-09-17 19:39 . 2009-09-17 19:39 -------- d-----w- c:\program files\VGA USB Camera 2009-09-17 19:37 . 2009-09-17 19:49 -------- d-----w- c:\documents and settings\All Users\Application Data\ArcSoft 2009-09-17 19:36 . 2006-11-10 19:05 18688 ----a-w- c:\windows\system32\drivers\afc.sys 2009-09-17 19:33 . 2009-09-17 19:35 -------- d-----w- c:\program files\Common Files\ArcSoft 2009-09-17 19:33 . 2009-09-17 19:33 -------- d-----w- c:\program files\ArcSoft 2009-09-17 19:32 . 2009-09-21 23:45 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\ArcSoft 2009-09-16 19:48 . 2009-09-16 19:48 -------- d-s---w- c:\windows\system32\config\systemprofile\AppData\Roaming\yahoo! 2009-09-16 19:47 . 2009-09-16 19:47 262144 ----a-w- C:\ntuser.dat 2009-09-12 19:46 . 2009-09-12 19:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage 2009-09-12 19:37 . 2009-08-29 00:14 28672 ----a-w- c:\windows\system32\Apphlpdm.dll 2009-09-12 19:37 . 2009-08-29 00:27 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2009-09-10 07:11 . 2009-09-18 23:27 -------- d-----w- c:\program files\Skyhook Wireless 2009-09-10 05:21 . 2009-07-11 19:01 293376 ----a-w- c:\windows\system32\wlanmsm.dll 2009-09-10 05:21 . 2009-07-11 17:03 127488 ----a-w- c:\windows\system32\L2SecHC.dll 2009-09-10 05:21 . 2009-07-11 19:01 302592 ----a-w- c:\windows\system32\wlansec.dll 2009-09-10 05:21 . 2009-07-11 19:01 65024 ----a-w- c:\windows\system32\wlanapi.dll 2009-09-10 05:21 . 2009-07-11 19:01 513536 ----a-w- c:\windows\system32\wlansvc.dll 2009-09-10 05:20 . 2009-06-10 11:41 2868224 ----a-w- c:\windows\system32\mf.dll 2009-09-10 05:17 . 2009-08-14 16:27 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys 2009-09-10 05:17 . 2009-08-14 13:48 105984 ----a-w- c:\windows\system32\netiohlp.dll 2009-09-10 05:17 . 2009-08-14 13:49 27136 ----a-w- c:\windows\system32\NETSTAT.EXE 2009-09-10 05:17 . 2009-08-14 13:49 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE 2009-09-10 05:17 . 2009-08-14 13:49 19968 ----a-w- c:\windows\system32\ARP.EXE 2009-09-10 05:17 . 2009-08-14 13:49 10240 ----a-w- c:\windows\system32\finger.exe 2009-09-10 05:17 . 2009-08-14 13:49 11264 ----a-w- c:\windows\system32\MRINFO.EXE 2009-09-10 05:17 . 2009-08-14 13:49 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE 2009-09-10 05:17 . 2009-08-14 13:48 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys 2009-09-10 05:17 . 2009-08-14 13:49 17920 ----a-w- c:\windows\system32\ROUTE.EXE 2009-09-10 05:17 . 2009-08-14 15:53 17920 ----a-w- c:\windows\system32\netevent.dll 2009-09-10 00:55 . 2009-09-10 00:55 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Blackberry Desktop 2009-09-10 00:49 . 2009-09-10 00:51 -------- d-----w- c:\program files\Research In Motion 2009-09-10 00:22 . 2009-09-10 00:23 -------- d-----w- c:\program files\QuickTime 2009-09-10 00:20 . 2009-09-10 00:20 -------- d-----w- c:\program files\Common Files\Apple 2009-09-10 00:20 . 2009-09-10 00:20 -------- d-----w- c:\program files\Apple Software Update 2009-09-09 23:24 . 2009-09-09 23:24 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Research In Motion 2009-09-09 21:24 . 2009-08-06 02:48 54632 ----a-w- c:\windows\system32\drivers\fssfltr.sys 2009-09-09 21:24 . 2009-09-09 21:24 -------- d-----w- c:\program files\Microsoft Sync Framework 2009-09-09 21:23 . 2009-09-09 21:23 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition 2009-09-09 19:25 . 2009-09-09 19:25 -------- d-----w- c:\program files\Windows Installer Clean Up 2009-09-09 19:24 . 2009-09-09 19:24 -------- d-----w- c:\program files\MSECACHE 2009-09-09 18:44 . 2009-09-09 20:29 -------- d-----w- c:\users\Lyonez Pro\AppData\Local\ElevatedDiagnostics 2009-09-09 18:31 . 2009-09-09 18:31 -------- d-----w- c:\program files\Microsoft ATS 2009-09-09 17:43 . 2008-07-08 12:45 4984 ----a-w- c:\windows\system32\drivers\nvphy.bin 2009-09-06 17:36 . 2009-10-05 20:01 411368 ----a-w- c:\windows\system32\deploytk.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-10-06 14:35 . 2009-06-07 05:34 -------- d-----w- c:\program files\Charter Security Suite 2009-10-05 19:22 . 2009-03-30 19:25 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS 2009-10-05 18:36 . 2009-07-10 07:43 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat 2009-09-24 23:40 . 2009-06-15 21:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-09-20 05:22 . 2008-10-11 02:19 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Move Networks 2009-09-18 18:36 . 2008-05-09 06:01 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Canon 2009-09-18 11:44 . 2009-04-03 01:19 108248 ----a-w- c:\users\Kids\AppData\Local\GDIPFONTCACHEV1.DAT 2009-09-17 19:48 . 2007-11-10 05:37 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-09-17 19:28 . 2009-07-10 05:37 74328 ----a-w- c:\windows\system32\drivers\inspect.sys 2009-09-17 19:28 . 2009-07-10 05:37 179792 ----a-w- c:\windows\system32\guard32.dll 2009-09-17 19:28 . 2009-07-10 05:37 29520 ----a-w- c:\windows\system32\drivers\cmdhlp.sys 2009-09-17 19:28 . 2009-07-10 05:37 128888 ----a-w- c:\windows\system32\drivers\cmdguard.sys 2009-09-17 00:11 . 2008-02-28 21:53 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Yahoo! 2009-09-16 19:46 . 2008-02-28 21:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion 2009-09-12 19:43 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2009-09-12 19:42 . 2008-02-24 06:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-09-10 18:54 . 2009-07-23 01:59 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-10 18:53 . 2009-07-23 01:59 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-09-10 00:50 . 2008-09-15 04:34 -------- d-----w- c:\program files\Common Files\Research In Motion 2009-09-10 00:22 . 2008-09-18 00:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer 2009-09-09 21:36 . 2008-02-29 00:25 -------- d-----w- c:\program files\Windows Live 2009-09-09 21:24 . 2009-03-31 19:42 -------- d-----w- c:\program files\Microsoft Office Outlook Connector 2009-09-09 21:16 . 2008-03-01 02:41 -------- d-----w- c:\program files\DivX 2009-09-09 20:15 . 2008-02-23 05:36 108248 ----a-w- c:\users\Lyonez Pro\AppData\Local\GDIPFONTCACHEV1.DAT 2009-09-09 20:05 . 2009-04-28 21:31 -------- d-----w- c:\program files\Common Files\AVSMedia 2009-09-09 20:05 . 2009-04-28 21:31 -------- d-----w- c:\program files\AVS4YOU 2009-09-09 19:41 . 2008-08-06 07:23 -------- d-----w- c:\program files\Microsoft Silverlight 2009-09-09 17:55 . 2007-11-10 05:39 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA 2009-09-06 17:35 . 2007-11-10 05:47 -------- d-----w- c:\program files\Java 2009-08-30 04:10 . 2009-08-30 04:10 -------- d-----w- c:\program files\Oracle 2009-08-30 04:10 . 2007-11-10 05:37 -------- d-----w- c:\program files\Common Files\InstallShield 2009-08-27 23:37 . 2009-08-27 23:37 -------- d-----w- c:\users\Lyonez Pro\AppData\Roaming\Template 2009-08-27 23:37 . 2009-08-27 23:37 0 ----a-w- c:\users\Lyonez Pro\AppData\Roaming\wklnhst.dat 2009-08-15 04:17 . 2008-02-23 14:50 680 ----a-w- c:\users\Lyonez Pro\AppData\Local\d3d9caps.dat 2009-08-04 13:48 . 2009-08-04 13:48 2744800 ----a-w- c:\windows\system32\drivers\RTKVHDA.sys 2009-08-04 13:17 . 2009-08-04 13:17 1265696 ----a-w- c:\windows\system32\RtkPgExt.dll 2009-08-04 13:17 . 2008-04-03 03:13 52256 ----a-w- c:\windows\system32\RtkCoInst.dll 2009-08-04 13:17 . 2009-08-04 13:17 326176 ----a-w- c:\windows\system32\RtkApoApi.dll 2009-08-04 13:17 . 2008-04-03 03:13 2898464 ----a-w- c:\windows\system32\RtkAPO.dll 2009-08-03 19:07 . 2009-08-03 19:07 403816 ----a-w- c:\windows\system32\OGACheckControl.dll 2009-08-03 19:07 . 2009-08-03 19:07 322928 ----a-w- c:\windows\system32\OGAAddin.dll 2009-08-03 19:07 . 2009-08-03 19:07 230768 ----a-w- c:\windows\system32\OGAEXEC.exe 2009-07-26 20:44 . 2009-07-26 20:44 48448 ----a-w- c:\windows\system32\sirenacm.dll 2009-07-21 21:52 . 2009-07-28 23:53 915456 ----a-w- c:\windows\system32\wininet.dll 2009-07-21 21:47 . 2009-07-28 23:53 109056 ----a-w- c:\windows\system32\iesysprep.dll 2009-07-21 21:47 . 2009-07-28 23:53 71680 ----a-w- c:\windows\system32\iesetup.dll 2009-07-21 20:13 . 2009-07-28 23:53 133632 ----a-w- c:\windows\system32\ieUnatt.exe 2009-07-21 18:01 . 2009-07-21 18:01 266240 ----a-w- c:\windows\system32\FMAPO.dll 2009-07-17 13:54 . 2009-08-13 21:42 71680 ----a-w- c:\windows\system32\atl.dll 2009-07-15 12:40 . 2009-08-13 21:35 8147456 ----a-w- c:\windows\system32\wmploc.DLL 2009-07-15 12:39 . 2009-08-13 21:36 313344 ----a-w- c:\windows\system32\wmpdxm.dll 2009-07-15 12:39 . 2009-08-13 21:36 4096 ----a-w- c:\windows\system32\dxmasf.dll 2009-07-15 12:39 . 2009-08-13 21:35 7680 ----a-w- c:\windows\system32\spwmp.dll 2009-07-10 01:36 . 2009-07-07 02:15 33920 ----a-w- c:\windows\system32\drivers\fsbts.sys 2007-11-10 05:06 . 2007-11-10 05:01 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of c:\users\lyonez~1\appdata\roaming\licenses ---- 2009-09-18 23:24 . 2009-09-18 23:24 632 ----a-w- c:\users\lyonez~1\appdata\roaming\licenses\PCMightyMax167e88a6-e53f-4bd1-b79b-6e4ecaf520d1 ((((((((((((((((((((((((((((( SnapShot_2009-10-05_19.37.16 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-10 05:28 . 2009-10-06 14:34 71506 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2006-11-02 13:05 . 2009-10-06 14:34 91882 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2008-02-23 05:23 . 2009-10-06 00:06 19274 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1857883511-523636785-2748142994-1000_UserData.bin + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 32768 c:\windows\System32\config\systemprofile\Application Data\Microsoft\Windows\Cookies\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 32768 c:\windows\System32\config\systemprofile\Application Data\Microsoft\Windows\Cookies\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-10-05 20:07 . 2009-10-05 20:07 20480 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\6baea4fe-5a90a774-n\jogl_awt.dll + 2009-10-05 20:07 . 2009-10-05 20:07 20480 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\4f710eed-3e40cd4c-n\gluegen-rt.dll + 2009-10-05 20:07 . 2009-10-05 20:07 61440 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\14e5d595-6c9338b2-n\decora-sse.dll + 2009-10-05 20:07 . 2009-10-05 20:07 12800 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\14e5d595-6c9338b2-n\decora-d3d.dll + 2009-10-05 20:07 . 2009-10-05 20:07 61440 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\58fb3e0f-5b24cda7-n\decora-sse.dll + 2009-10-05 20:07 . 2009-10-05 20:07 12800 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\58fb3e0f-5b24cda7-n\decora-d3d.dll + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 81920 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-02-23 05:31 . 2009-10-05 19:04 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat + 2008-02-23 05:31 . 2009-10-06 15:28 16384 c:\windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat - 2008-08-06 13:31 . 2009-10-05 15:06 437806 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2008-08-06 13:31 . 2009-10-06 14:31 437806 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2009-10-05 20:01 . 2009-10-05 20:01 149280 c:\windows\System32\javaws.exe + 2009-10-05 20:01 . 2009-10-05 20:01 145184 c:\windows\System32\javaw.exe + 2009-10-05 20:01 . 2009-10-05 20:01 145184 c:\windows\System32\java.exe + 2009-10-05 20:07 . 2009-10-05 20:07 114688 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\6baea4fe-5a90a774-n\jogl_cg.dll + 2009-10-05 20:07 . 2009-10-05 20:07 315392 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\6baea4fe-5a90a774-n\jogl.dll + 2009-10-05 20:07 . 2009-10-05 20:07 348160 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\14e5d595-6c9338b2-n\msvcr71.dll + 2009-10-05 20:07 . 2009-10-05 20:07 503808 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\14e5d595-6c9338b2-n\msvcp71.dll + 2009-10-05 20:07 . 2009-10-05 20:07 499712 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\14e5d595-6c9338b2-n\jmc.dll + 2009-10-05 20:07 . 2009-10-05 20:07 348160 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\58fb3e0f-5b24cda7-n\msvcr71.dll + 2009-10-05 20:07 . 2009-10-05 20:07 503808 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\58fb3e0f-5b24cda7-n\msvcp71.dll + 2009-10-05 20:07 . 2009-10-05 20:07 499712 c:\windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\58fb3e0f-5b24cda7-n\jmc.dll + 2009-10-05 20:01 . 2009-10-05 20:01 537600 c:\windows\Installer\ca0e9.msi + 2008-02-23 05:58 . 2009-10-06 16:09 3872984 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat - 2008-02-23 05:58 . 2009-09-20 07:56 3872984 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184] "hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536] "KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536] "OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784] "SunJavaUpdateReg"="c:\windows\system32\jureg.exe" [2007-04-07 54936] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-07 198160] "F-Secure Manager"="c:\program files\Charter Security Suite\Common\FSM32.EXE" [2009-02-19 182936] "F-Secure TNB"="c:\program files\Charter Security Suite\FSGUI\TNBUtil.exe" [2009-02-19 957024] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-23 13539872] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-23 92704] "COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-09-17 1799952] "ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-07-10 195072] "PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-05 149280] "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-01-15 4874240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Launcher"="c:\windows\SMINST\launcher.exe" [2007-10-09 44168] "PCDrProfiler"="c:\program files\PC-Doctor for Windows\RunProfiler.exe" [2008-09-10 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\System32\guard32.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "VistaSp2"=hex(b):70,d3,e7,ac,9f,0d,ca,01 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{46CDC510-BBF9-45B8-A4E3-749D3D0BD37E}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{198093D5-5017-4AC7-8A1B-3F6D78423B0B}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{53EE0812-56F1-484B-9D99-82DB516C0CF0}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{6F9B64DB-D3A5-4358-A8C8-F0DEE0A4D92D}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{A8B3DDF2-8C4B-4F7A-AD4D-BD76871A99A5}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{1F772AE8-B359-4949-94C3-F694C5A4B998}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{4F6BE64A-84A1-45A6-8976-A051A549E9E0}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{61B9E342-8318-4BDE-AAD0-06E918AE4AA5}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{37282ADB-A5D3-4AEF-B4D8-9B412271550E}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{7DD48E46-1C05-4DD4-B539-5800AEEC32BE}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{0008103B-DCF6-4748-A95D-8AB52B257265}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{4AF93C4C-A63A-4945-A084-61432897DCDD}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{72F018B9-277A-496D-94B4-29DDF6408E91}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{D27D44B8-FE22-47CA-9948-C0977A9935BC}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "{764E0FD4-CA6C-4703-8609-D6FD19471DD1}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "{FE5C39D5-CA72-437A-BED5-CF4E8F55F603}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent "{D09572A3-21C4-43BF-AB95-0159193F4F15}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent "TCP Query User{3869B2BB-07B6-4317-A089-5AB1E8AD4D02}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent "UDP Query User{D5E5D7ED-7094-4D5C-AE16-0766C630D4FC}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent "{7F0F0F5F-E7C7-42C5-8EC3-E272E5D9983D}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{2D8A7795-37E2-42CD-A34A-26273DAE8710}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{1BB1A0A4-A66B-4C9C-AACF-A8353A2A6FB5}"= TCP:67:DHCP Discovery Service "{B438DA73-548F-4741-99E1-8A5450D34D92}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync "{9C3564C5-D6A1-4321-BF66-817A321F6F0A}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector "{006B12F6-B54A-4C51-8585-2BF0DBFCCE21}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{4438146C-EA54-4CF7-9D30-83FD58E009E9}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{333250CD-2E34-4282-A748-EA60C5F1A4CB}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{86693735-1338-4308-A8AA-A17347123848}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{6F24C0D5-E042-4BD1-8F8A-4D5BCA453DA6}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{C65C8A33-556F-4B99-94AC-A496BBED6D28}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "{EEB6C2EA-D226-4C5C-8587-4C9419D42268}"= UDP:c:\users\Lyonez Pro\AppData\Local\temp\7zSBEE5.tmp\SymNRT.exe:Norton Removal Tool "{C94BE236-9AC5-437C-B8ED-4DD57C35A334}"= TCP:c:\users\Lyonez Pro\AppData\Local\temp\7zSBEE5.tmp\SymNRT.exe:Norton Removal Tool [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink R0 crpf;crpf;c:\windows\System32\drivers\crpf.sys [7/10/2009 1:28 AM 37920] R0 csdf;cdsf;c:\windows\System32\drivers\csdf.sys [7/10/2009 1:28 AM 40480] R0 fsbts;fsbts;c:\windows\System32\drivers\fsbts.sys [7/6/2009 10:15 PM 33920] R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\System32\drivers\cmdguard.sys [7/10/2009 1:37 AM 128888] R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\System32\drivers\cmdhlp.sys [7/10/2009 1:37 AM 29520] R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\Charter Security Suite\HIPS\drivers\fshs.sys [7/6/2009 10:15 PM 67808] R1 FSES;F-Secure Email Scanning Driver;c:\windows\System32\drivers\fses.sys [7/6/2009 10:15 PM 35552] R1 FSFW;F-Secure Firewall Driver;c:\windows\System32\drivers\fsdfw.sys [7/6/2009 10:15 PM 70944] R1 fsvista;F-Secure Vista Support Driver;c:\program files\Charter Security Suite\Anti-Virus\minifilter\fsvista.sys [7/6/2009 10:14 PM 12384] R2 atashost;WebEx Service Host for Support Center;c:\windows\System32\atashost.exe [5/23/2009 6:10 PM 20376] R2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE [3/30/2009 4:28 PM 1533808] R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\Charter Security Suite\Anti-Virus\minifilter\fsgk.sys [7/6/2009 10:14 PM 100984] R3 FSORSPClient;F-Secure ORSP Client;c:\program files\Charter Security Suite\ORSP Client\fsorsp.exe [7/6/2009 10:15 PM 55904] R3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\System32\drivers\HCW85BDA.sys [12/3/2008 10:20 PM 1426304] R3 PAC7302;PAC7302 VGA USB Camera;c:\windows\System32\drivers\PAC7302.SYS [9/17/2009 3:39 PM 457856] S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [9/9/2009 5:24 PM 54632] S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [8/5/2009 10:48 PM 704864] S3 getPlusHelper;getPlus(R) Helper;c:\windows\System32\svchost.exe -k getPlusHelper [6/28/2008 11:43 AM 21504] S4 F-Secure Filter;F-Secure File System Filter;c:\program files\Charter Security Suite\Anti-Virus\win2k\fsfilter.sys [7/6/2009 10:14 PM 39776] S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\Charter Security Suite\Anti-Virus\win2k\fsrec.sys [7/6/2009 10:14 PM 25184] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr getPlusHelper REG_MULTI_SZ getPlusHelper [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}] c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,LaunchINFSectionEx c:\program files\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12 . Contents of the 'Scheduled Tasks' folder 2009-09-25 c:\windows\Tasks\COMODO Registry Cleaner task.job - c:\program files\COMODO\System Cleaner\CRC.exe [2009-07-10 19:18] 2009-10-06 c:\windows\Tasks\Scheduled scanning task.job - c:\progra~1\CHARTE~1\ANTI-V~1\fsav.exe [2009-07-07 11:44] 2009-10-06 c:\windows\Tasks\User_Feed_Synchronization-{FB4B4EFB-6359-4332-921B-6923D8E1B847}.job - c:\windows\system32\msfeedssync.exe [2009-07-28 20:13] . . ------- Supplementary Scan ------- . mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 LSP: c:\windows\system32\wpclsp.dll DPF: {CAFECAFE-0013-0001-0022-ABCDEFABCDEF} - hxxp://www.fultoncourtrecords.com:7778/forms/jinitiator/jinit.exe . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-06 12:12 Windows 6.0.6002 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'Explorer.exe'(884) c:\program files\Hewlett-Packard\HP Advisor\Pillars\Market\MLDeskBand.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\System32\nvvsvc.exe c:\program files\COMODO\COMODO Internet Security\cmdagent.exe c:\windows\System32\audiodg.exe c:\windows\System32\rundll32.exe c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe c:\program files\Charter Security Suite\Anti-Virus\fsgk32st.exe c:\program files\Charter Security Suite\Common\FSMA32.EXE c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\Charter Security Suite\Common\FSMB32.EXE c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\windows\System32\drivers\XAudio.exe c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\program files\Charter Security Suite\Common\FCH32.EXE c:\program files\Charter Security Suite\Common\FAMEH32.EXE c:\program files\Charter Security Suite\Anti-Virus\fsqh.exe c:\program files\Charter Security Suite\FSAUA\program\fsaua.exe c:\program files\Charter Security Suite\FSPC\fspc.exe c:\program files\Charter Security Suite\FWES\program\fsdfwd.exe c:\program files\Charter Security Suite\FSAUA\program\fsus.exe c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE c:\program files\Charter Security Suite\Anti-Virus\fsav32.exe c:\program files\Charter Security Suite\Anti-Virus\fsgk32.exe c:\program files\Charter Security Suite\Anti-Virus\fssm32.exe c:\windows\ehome\ehsched.exe c:\program files\Hewlett-Packard\HP Health Check\HPHC_Service.exe c:\windows\ehome\ehrecvr.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\windows\servicing\TrustedInstaller.exe c:\windows\System32\wbem\unsecapp.exe . ************************************************************************** . Completion time: 2009-10-06 12:18 - machine was rebooted ComboFix-quarantined-files.txt 2009-10-06 16:18 ComboFix2.txt 2009-10-05 19:40 ComboFix3.txt 2009-09-26 17:22 Pre-Run: 121,027,067,904 bytes free Post-Run: 120,916,742,144 bytes free 534 --- E O F --- 2009-10-05 20:03 |
|
|
|
|
10-07-2009, 02:11 AM
|
#11 (permalink) | ||
|
Visiting Teacher/Analyst, Security Team
Join Date: Jun 2008
Location: Finland
Posts: 755
OS: Win XP, Vista 32-bit, Win7 64-bit
|
Re: Trojan Error and popups
Quote:
Quote:
__________________
Microsoft MVP Consumer Security 2008 2009 ASAP & UNITE member since 2006 |
||
|
|
|
|
10-07-2009, 11:24 PM
|
#13 (permalink) |
|
Visiting Teacher/Analyst, Security Team
Join Date: Jun 2008
Location: Finland
Posts: 755
OS: Win XP, Vista 32-bit, Win7 64-bit
|
Re: Trojan Error and popups
Hi,
There are some final steps I want you to follow :) THESE STEPS ARE VERY IMPORTANT Let's reset system restore Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points. A To disable the System Restore feature: 1. Click on the Start button. 2. Hover over the Computer option, right click on it and then click Properties. 3. On the left hand side, click Advanced Settings. 4. If asked to permit the action, click on Allow. 5. Click on the System Protection tab. 6. Uncheck any checkboxes listed for your hard drives. 7. Press OK. B. Reboot. C Turn ON System Restore. Follow the steps like you did when disabling system restore but on step 6. check any checkboxes listed for your hard drives. Now lets uninstall ComboFix:
Please download OTC and save it to desktop.
Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so. UPDATING WINDOWS AND INTERNET EXPLORER IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates. If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update. Make your Internet Explorer more secure This can be done by following these simple instructions: From within Internet Explorer click on the Tools menu and then click on Options. Click once on the Security tab Click once on the Internet icon so it becomes highlighted. Click once on the Custom Level button. Change the Download signed ActiveX controls to Prompt Change the Download unsigned ActiveX controls to Disable Change the Initialize and script ActiveX controls not marked as safe to Disable Change the Installation of desktop items to Prompt Change the Launching programs and files in an IFRAME to Prompt Change the Navigate sub-frames across different domains to Prompt When all these settings have been made, click on the OK button. If it prompts you as to whether or not you want to save the settings, press the Yes button. Next press the Apply button and then the OK to exit the Internet Properties page. The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.
Just a final reminder for you. I am trying to stress these two points. UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks. Make sure all of your security programs are up to date. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates. Once again, please post and tell me how things are going with your system... problems etc. Have a great day, Blade 
__________________
Microsoft MVP Consumer Security 2008 2009 ASAP & UNITE member since 2006 |
|
|
|
|
10-09-2009, 12:01 AM
|
#14 (permalink) |
|
Registered User
Join Date: Sep 2009
Posts: 10
OS: vista home premium
|
Re: Trojan Error and popups
blade
Thanks I have everything removed. But the 2 problems that I was trying to resolve here are my Media Center will not play movies that I have on file and the cd/dvd drive is not being read in some software programs like Divx and also PowerDirerctor to burn a dvd. I thought it was associated to the problems I had going on with the virus popup... it may be topic for a different board. can u give any insight to what is causing problems or at least how to fix those problem? |
|
|
|
|
10-09-2009, 08:36 AM
|
#15 (permalink) |
|
Visiting Teacher/Analyst, Security Team
Join Date: Jun 2008
Location: Finland
Posts: 755
OS: Win XP, Vista 32-bit, Win7 64-bit
|
Re: Trojan Error and popups
Hi,
I believe it's better that you start a new topic for that issue on other area of Tech Support Forum so that people with more knowledge can assist you :)
__________________
Microsoft MVP Consumer Security 2008 2009 ASAP & UNITE member since 2006 |
|
|
|
|
| Thread Tools | |
|
|
!
