snafubaby

Ok here goes. I've had a problem with malware forever. I do a lot of video processing, converting VHS tapes to DVD, so i tend to turn off any virus scanners so that there is nothing in the way of the conversion process. The computer is at full speed, with no other programs loaded except for the files for the video conversion unit i have (ADSTech DVD XPress). That is a major problem because when i'm NOT video processing, i forget to turn the A/V guard of Antivir back on. That's something i'll have to start remembering to do.

Now for the malware. In the past two weeks, i've must have tried about 12 different Anti-virus checkers. Some online, and some installed free or trialware versions of popular titles such as MalwareBytes, Antivir, and Avast. I've also tried the brand new scanner which is gaining in popularity called Vipre. Now, I also have been using something called Multi-AV, which is run from the cmd prompt, so i guess you can call it a DOS-based scanner. It's composed of Sophos, Trend, McAfee, and Kaspersky online Anti-Virus scanners. It never used to give me major problems, until last year, when Kaspersky's would always end prematurely. I never could figure out why. It just never would scan my whole 100+ gigabyte drive anymore. Now, in the past three weeks, Sophos had ran all the way through, but the Trend and McAfee virus scanners don't scan at all. What happens is the viruses or whatever that is on my machine has deleted the component files of Multi-AV whenever i would choose either of those scanners. They just disappear! Then, i load them up from the main installation file, and try again. It deletes them again. Another virus scanner i had success with in the past but have had problems recently with is Bitdefender. I had used their online scanner, and it's taken out quite a few trojans in the past years. Now, when i try to load up the scanner, it hangs the machine up when updating the virus definitions. Then i have to close Windows. I did try a couple of other online scanners that did work, such as one at www.ca.com. When it scanned, it showed that i have the Puper NV and Puper QQ trojans. I know that one of those has an alias as trojan.fakeavalert. I've had those for a few weeks. I've ran all those virus scanners with disinfecting functions, such as the ones i've mentioned above, and not one had identified any of these Puper trojans. Ca's scanner identifies them everytime i do a scan, because i've had SOME success in disinfecting other malware using those scanners above, so i tried to see if maybe the pupers were deleted. I know there are various aliases with viruses, and when using the Multi-AV version of Sophos, it had caught some malware that it supposedly deleted. I guess it didn't delete the evil buggers known as Puper QQ and Puper NV. I've even tried manually deleting these viruses by doing what various malware websites suggest, such as stopping their processes with task manager, deleting them from the registry with regedit, and deleting the files or folders that they run from. I've never found any viruses with these methods. That is the most mysterious thing. When seeking help from malware websites, it says to make sure to use safe mode when using the virus checkers, which i've done. Also, it says to turn off system restore, and to also use CCleaner or other cleaner to delete any remnants of the viruses, which i've done. Yes, i forgot to mention that I can get into safe mode with my normal account, but cannot get into my administrator profile. The computer just hangs. I believe the virus is doing it's dirty work there, too.



I know that the viruses are there, because i cannot go to some websites with video content and watch videos. Remember, it deletes the component files of Multi-AV. One more thing to mention. I have the infamous yellow triangle with the exclamation point in the bottom left of my screen, with the words "error on page" next to it. I've tried the homemade scanners such as the combofix scanner. It never finds the puper viruses and takes them out. This is the most evil virus i've ever had on any pc! Back in the late 90's, when i first got a pc, i was infected with the NYB virus. Back then, when we all were using floppy drives to store stuff because cd burners weren't available back then, that virus would infect the boot sectors of the floppys, making them unreadable by the drives. It would also infect the boot sectors of the hard drive. Well, after getting a simple little dos-based anti virus scanner like mcafee, it would delete the virus from the boot sector, and clean the disk. That was a cake walk compared to the pupers i have.

Anyway, i will for sure follow any instructions that anyone gives me in deleting these viruses so i can have my machine back. I am patient, and will suffer greatly until someone helps me out on this one, and i am confident that someone will.

Thank you!

Here are my files that i forgot to include in my earlier post.


DDS (Ver_09-10-26.01) - NTFSx86
Run by Dude at 3:38:24.71 on Sun 11/01/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.894.215 [GMT -8:00]

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\OpenCase\OpenCASE Media Agent\MediaAgent.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\StkASv2K.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\V0230Mon.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Vista Start Menu\VistaStartMenu.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Asoftech\Asoftech Speeder\speeder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\Program Files\Youtube Downloader HD\YouTubeDownloaderHD.exe
C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe
c:\AV-CLS\Sophos\t.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
c:\program files\real\realplayer\RecordingManager.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\Archos Purse ****\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://p2penergy.ourtoolbar.com/Uninstall?toolbarid=CT1269415&version=4.5.189.21&uid=UN20081211014704906
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: H - No File
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
mURLSearchHooks: Winamp Search Class: {57bca5fa-5dbb-45a2-b558-1755c3f6253b} - c:\program files\winamp toolbar\winamptb.dll
BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - c:\program files\orbitdownloader\orbitcth.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
BHO: {0eedb912-c5fa-486f-8334-57288578c627} - Shareaza Web Download Hook
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.3.4501.1418\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn1\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
TB: Winamp Toolbar: {ebf2ba02-9094-4c5a-858b-bb198f3d8de2} - c:\program files\winamp toolbar\winamptb.dll
TB: Veoh Browser Plug-in: {d0943516-5076-4020-a3b5-aefaf26ab263} - c:\program files\veoh networks\veoh\plugins\reg\VeohToolbar.dll
TB: Grab Pro: {c55bbcd6-41ad-48ad-9953-3609c48eacc7} - c:\program files\orbitdownloader\GrabPro.dll
TB: Veoh Web Player Video Finder: {0fbb9689-d3d7-4f7a-a2e2-585b10099bfc} - c:\program files\veoh networks\veohwebplayer\VeohIEToolbar.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
TB: Searchme Toolbar: {4d02e7e6-5930-4b51-b9b0-9f21b3789400} - mscoree.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: Pictures: {8e929f51-5914-11d6-971f-0050fc3f9161} - c:\program files\diodia software\pictures toolbar\Pictures.dll
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [VistaStartMenu] "c:\program files\vista start menu\VistaStartMenu.exe"
uRun: [Search Protection] c:\program files\yahoo!\search protection\SearchProtection.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [V0230Mon.exe] c:\windows\V0230Mon.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
mRun: [UVS10 Preload] c:\program files\ulead systems\ulead videostudio se dvd\uvPL.exe
mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [YSearchProtection] "c:\program files\yahoo!\search protection\SearchProtection.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
dRunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe
mPolicies-explorer: NoSecurityTab = 1 (0x1)
mPolicies-system: SynchronousMachineGroupPolicy = 0 (0x0)
mPolicies-system: SynchronousUserGroupPolicy = 0 (0x0)
IE: &Download by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/202
IE: Download with &Shareaza - c:\program files\crux p2p\plugins\RazaWebHook.dll/3000
Trusted Zone: akamai.net\a248.e
Trusted Zone: bitdefender.com
Trusted Zone: netflame.cc\ssl-hints
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - hxxp://www.eset.eu/buxus/docs/OnlineScanner.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
DPF: {88D969C0-F192-11D4-A65F-0040963251E5} - hxxps://wimpro.cce.hp.com/ChatEntry/downloads/msxml4.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9}
DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} - hxxp://support.f-secure.com/ols/fscax.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E6BB2089-163F-466B-812A-748096614DFD} - hxxp://cainternetsecurity.net/scanner/cascanner.cab
DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - hxxp://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5780/mcfscan.cab
DPF: {FFFFFFFF-CACE-BABE-BABE-00AA0055595A} - hxxp://www.trueswitch.com/TrueInstall.exe
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath -
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R1 SBRE;SBRE;\??\c:\windows\system32\drivers\sbredrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-10-18 108289]
RUnknown aswFsBlk;aswFsBlk; [x]
RUnknown aswSP;aswSP; [x]
RUnknown sbtis;sbtis; [x]
S1 bthportt;bthportt;c:\windows\system32\drivers\bthportt.sys --> c:\windows\system32\drivers\bthportt.sys [?]
S2 DVR2EXP;ADS DVD Xpress;c:\windows\system32\drivers\dvr2exp.sys [2003-4-14 34760]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\19.tmp --> c:\windows\system32\19.tmp [?]
S3 NPF;Netgroup Packet Filter;c:\windows\system32\drivers\npf.sys [2008-5-21 42512]
S3 PAC207;SoC PC-Camer@;c:\windows\system32\drivers\PFC027.sys [2005-2-24 162176]
S3 Partizan;Partizan;c:\windows\system32\drivers\partizan.sys --> c:\windows\system32\drivers\Partizan.sys [?]
S3 RkPavproc1;RkPavproc1;\??\c:\windows\system32\drivers\rkpavproc1.sys --> c:\windows\system32\drivers\RkPavproc1.sys [?]
S3 V0230Vfx;V0230Vfx;c:\windows\system32\drivers\V0230Vfx.sys [2008-7-25 6272]
S3 V0230VID;Live! Cam Video IM Pro;c:\windows\system32\drivers\V0230VID.sys [2008-7-25 500480]

=============== Created Last 30 ================

2009-11-01 10:36:21 107 ----a-w- C:\run.bat
2009-11-01 09:11:33 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-01 04:47:49 2946 ----a-w- c:\windows\system32\tmp.reg
2009-11-01 04:43:53 0 d-----w- c:\documents and settings\dude\SmitfraudFix
2009-10-31 20:52:59 424 ----a-w- c:\windows\system32\drivers\kgpfr2.cfg
2009-10-31 20:52:37 5144 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2009-10-31 10:58:55 0 d-----w- C:\Rooter$
2009-10-31 09:27:10 0 d-----w- c:\program files\Enigma Software Group
2009-10-31 07:45:56 15 ----a-w- c:\documents and settings\dude\settings.dat
2009-10-31 06:24:03 11904 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2009-10-31 06:22:57 0 d-----w- c:\docume~1\alluse~1\applic~1\Hitman Pro
2009-10-31 06:22:55 0 d-----w- c:\program files\Hitman Pro 3.5
2009-10-31 06:08:06 0 d-----w- c:\docume~1\alluse~1\applic~1\Kaspersky Lab Setup Files
2009-10-31 03:08:28 0 d-----w- c:\docume~1\alluse~1\applic~1\SITEguard
2009-10-31 03:05:19 0 d-----w- c:\program files\common files\iS3
2009-10-31 03:05:16 0 d-----w- c:\docume~1\alluse~1\applic~1\STOPzilla!
2009-10-30 23:04:52 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-26 07:45:11 77312 ----a-w- c:\windows\MBR.exe
2009-10-26 05:42:39 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2009-10-26 05:42:39 75264 ----a-w- c:\windows\system32\unacev2.dll
2009-10-26 05:42:39 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2009-10-26 05:42:39 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2009-10-26 03:07:35 745 ----a-w- C:\20091025_200658.mov
2009-10-26 01:38:21 0 d-----w- c:\program files\a-squared Free
2009-10-25 22:32:46 0 d-----w- c:\docume~1\alluse~1\applic~1\XoftSpySE
2009-10-25 06:50:00 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-10-24 09:44:36 0 d-----w- c:\windows\McAfee.com
2009-10-23 22:28:19 67366 ----a-w- C:\SP32-20091023-152804.jpg
2009-10-22 20:31:37 0 d-----w- c:\docume~1\dude\applic~1\TrojanHunter
2009-10-22 20:28:54 0 d-----w- c:\program files\TrojanHunter 5.2
2009-10-20 11:42:52 0 d-----w- c:\docume~1\dude\applic~1\Sunbelt
2009-10-20 11:40:03 0 d-----w- c:\docume~1\alluse~1\applic~1\Sunbelt
2009-10-20 11:37:36 0 d-----w- c:\program files\Sunbelt Software
2009-10-19 06:14:21 81920 -c--a-w- c:\windows\system32\dllcache\ieencode.dll
2009-10-19 02:44:32 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-19 02:44:24 0 d-----w- c:\program files\Avira
2009-10-19 02:44:24 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira
2009-10-18 21:19:15 2180224 -c--a-w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-10-18 21:19:15 2180224 ------w- c:\windows\system32\ntoskrnl.exe
2009-10-17 23:19:01 0 d-----w- c:\docume~1\alluse~1\applic~1\CA
2009-10-17 12:09:59 98816 ----a-w- c:\windows\sed.exe
2009-10-17 12:09:59 161792 ----a-w- c:\windows\SWREG.exe
2009-10-17 06:19:08 0 d-----w- c:\program files\Western Digital
2009-10-11 11:08:35 262144 ----a-w- C:\ntuser.dat
2009-10-11 04:50:20 939368 ----a-w- c:\windows\system32\flash.ocx
2009-10-11 04:50:20 253952 ----a-w- c:\windows\system32\histogram.ocx
2009-10-11 04:23:23 49152 ----a-w- c:\windows\system32\OctaneARM.dll
2009-10-11 04:23:22 0 d-----w- c:\program files\eDATA Unerase
2009-10-11 04:15:23 0 d-----w- c:\program files\RightMark Memory Analyzer

==================== Find3M ====================

2009-10-11 15:10:09 236544 ----a-w- c:\windows\PEV.exe
2009-09-28 01:11:08 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-09-28 01:11:07 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-09-21 02:27:19 237568 ----a-w- c:\windows\system32\rmc_rtspdl.dll
2009-09-21 02:27:19 156672 ----a-w- c:\windows\system32\rmc_fixasf.exe
2009-09-21 02:26:28 323584 ----a-w- c:\windows\system32\AUDIOGENIE2.DLL
2009-09-15 14:01:36 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2009-09-15 14:01:34 0 ----a-w- c:\windows\system32\drivers\logiflt.iad
2009-09-13 07:29:51 6017618 ----a-w- c:\windows\system32\LanStick_preAlpha3.zip
2009-09-13 05:55:00 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2009-09-13 05:55:00 60273 ----a-w- c:\windows\system32\pthreadGC2.dll
2009-09-13 04:42:08 4252306 ----a-w- c:\windows\system32\ffdshow_rev3072_20090912_xxl.exe
2009-09-13 01:50:57 1638275 ----a-w- c:\windows\system32\DiskAid_3_1.exe
2009-09-12 12:29:43 29709258 ----a-w- c:\windows\system32\ipcsuite_for_iphone_full_v2_5_3_98_20090814.exe
2009-09-04 10:36:26 299008 ----a-w- c:\windows\system32\TubeFinder.exe
2009-08-28 1244 1111058 ----a-w- c:\windows\system32\x264.exe
2009-08-23 02:22:26 564140 ----a-w- c:\windows\system32\nctaudiofile2.dll.zip
2009-08-17 07:08:50 160543 ----a-w- c:\windows\Sqirlz Water Reflections Uninstaller.exe
2009-08-17 07:07:11 286720 ------w- c:\windows\Setup1.exe
2009-08-16 01:12:37 160259 ----a-w- c:\windows\Sqirlz Morph Uninstaller.exe
2009-08-07 02:23:46 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-07 02:23:46 215920 ----a-w- c:\windows\system32\muweb.dll
2006-05-03 0954 163328 --sha-r- c:\windows\system32\flvDX.dll
2007-02-21 10:47:16 31232 --sha-r- c:\windows\system32\msfDX.dll
2007-12-17 12:43:00 27648 --sha-w- c:\windows\system32\Smab0.dll

============= FINISH: 3:40:16.90 ===============

Attached Files

	attach.zip (5.5 KB, 0 views)
	ark.zip (1.1 KB, 3 views)