|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
08-09-2008, 06:46 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 23
OS: XP
|
Hijack This Log
Here we go, I am having a problem with a rundll32.exe error, I am unable to open the clock on the computer, also the add/remove programs, and the cmd box, I get the same type of error with each one. For example when I go to start > Run> cmd I get an error that says at the top---cmd.exe - Application Error
The application failed to initialize properly (0xc0000005). A couple of weeks ago, running the virus scans I noticed a virus popping up called Trojan.Vundo, I think I have that under control, but the main problem is what is listed above. I have followed every step throughout the 5 steps before posting a log, and need to let you know that I cannot access step one, to remove the malicious programs through add/remove programs, as it wont load either. The only other problem I am having which I am not sure if you can help me with is when I go into IE and try to get to hotmail.com it says to make the computer accept cookies, but when I go in to do it, they are already accepted. If you could help with this I would appreciate it as well, if not no problem. Deckard's System Scanner v20071014.68 Run by Josh and Angie on 2008-08-09 20:30:00 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 35: 2008-08-10 00:30:16 UTC - RP35 - Deckard's System Scanner Restore Point 34: 2008-08-09 22:27:33 UTC - RP34 - Removed EasyCleaner 33: 2008-08-09 18:26:17 UTC - RP33 - Installed RegSweep 32: 2008-08-09 05:13:11 UTC - RP32 - System Checkpoint 31: 2008-08-08 00:55:53 UTC - RP31 - System Checkpoint -- First Restore Point -- 1: 2008-07-19 16:11:22 UTC - RP1 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 254 MiB (512 MiB recommended). -- HijackThis (run as Josh and Angie.exe) -------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:33:11 PM, on 8/9/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\Program Files\twc\medicsp2\bin\sprtsvc.exe C:\WINDOWS\explorer.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\RegSweep\RegSweep.exe C:\Documents and Settings\Josh and Angie\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Josh and Angie.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.onlineregister.com/bvg/?B...49&TMRT=LD0044 O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {16EC00C6-90B4-4956-BE82-96A007727458} - (no file) O2 - BHO: (no name) - {4BEE6973-0E81-4A95-9EA9-C84766231D14} - (no file) O2 - BHO: (no name) - {513247F0-FB97-455D-A4C2-5F8B1725345C} - (no file) O2 - BHO: (no name) - {54C855A2-C964-EFC8-4DB0-E3BC6F7DB0CD} - (no file) O2 - BHO: (no name) - {54C855A7-C963-E3B1-4DC5-96BC1F7AB0C6} - (no file) O2 - BHO: (no name) - {54C855D7-C962-EBBB-4DC4-94BC6E79B0C8} - (no file) O2 - BHO: (no name) - {55C855A5-C961-EBB9-4DC4-92BC697FB0CF} - (no file) O2 - BHO: (no name) - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - (no file) O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: (no name) - {6BC9B5C0-5E90-433C-AD71-49128D0A9D20} - (no file) O2 - BHO: (no name) - {6E63A308-8ADE-4AA0-A253-035A0DDAFABB} - (no file) O2 - BHO: (no name) - {7502B650-F67C-4FCD-BC29-65E95B3623E4} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7A2FAC49-3EEE-485E-9376-B0DEDA6ABF79} - (no file) O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file) O2 - BHO: (no name) - {A2405E88-1B24-4569-866C-2492FD40AA57} - (no file) O2 - BHO: (no name) - {B282E1E3-AECA-44E2-9DA8-22F347D37114} - (no file) O2 - BHO: {21f33f4a-3530-de49-9544-859d91f53a3c} - {c3a35f19-d958-4459-94ed-0353a4f33f12} - C:\WINDOWS\system32\qynvnc.dll O2 - BHO: (no name) - {C5E84927-CFF0-4CA3-A068-02E7C01C1E7C} - (no file) O2 - BHO: (no name) - {D58FA9CB-84C7-4774-AB6A-815A9A3839ED} - (no file) O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file) O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKLM\..\Run: [BMc3c7117e] Rundll32.exe "C:\WINDOWS\system32\jkblowmo.dll",s O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [RegSweep] C:\Program Files\RegSweep\RegSweep.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BySoft FreeRAM] C:\Program Files\BySoft FreeRAM\FreeRAM.exe O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user') O4 - Global Startup: Digital Line Detect.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/tech...bs/tgctlsr.cab O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file) O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file) O20 - AppInit_DLLs: qynvnc.dll O20 - Winlogon Notify: fccCTklJ - fccCTklJ.dll (file missing) O20 - Winlogon Notify: ssqPiFvs - ssqPiFvs.dll (file missing) O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe O23 - Service: SupportSoft Sprocket Service (medicsp2) (sprtsvc_medicsp2) - SupportSoft, Inc. - C:\Program Files\twc\medicsp2\bin\sprtsvc.exe -- End of file - 7480 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R2 MDC8021X (AEGIS Protocol (IEEE 802.1x) v2.3.1.9) - c:\windows\system32\drivers\mdc8021x.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 2.3.1.9> S3 DSproct - c:\program files\dellsupport\gtaction\triggers\dsproct.sys <Not Verified; Gteko Ltd.; processt> S3 SymIM (Symantec Network Security Intermediate Filter Service) - c:\windows\system32\drivers\symim.sys (file missing) S3 SymIMMP - c:\windows\system32\drivers\symim.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 sprtsvc_dellsupportcenter (SupportSoft Sprocket Service (dellsupportcenter)) - c:\program files\dell support center\bin\sprtsvc.exe /service /p dellsupportcenter -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-08-09 18:30:00 366 --a------ C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (JTSPC-Josh Thompson).job 2008-08-09 14:26:36 404 --a------ C:\WINDOWS\Tasks\RegSweep Scheduled Scan.job 2005-04-10 16:49:26 258 --a------ C:\WINDOWS\Tasks\ISP signup reminder 1.job -- Files created between 2008-07-09 and 2008-08-09 ----------------------------- 2008-08-09 20:32:45 0 d-------- C:\Program Files\Trend Micro 2008-08-09 20:20:27 0 d------c- C:\ie-spyad_zo 2008-08-09 20:13:04 0 d-------- C:\Program Files\SpywareBlaster 2008-08-09 18:43:36 0 d-------- C:\Program Files\Panda Security 2008-08-09 14:32:37 0 d-------- C:\Program Files\Eusing Free Registry Cleaner 2008-08-09 14:26:31 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\RegSweep 2008-08-09 14:26:18 0 d-------- C:\Program Files\RegSweep 2008-08-09 14:19:00 0 d-------- C:\WINDOWS\LastGood 2008-08-05 16:11:45 0 d-------- C:\Program Files\Lavasoft 2008-08-05 16:11:34 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-08-05 16:08:18 0 dr-h----- C:\Documents and Settings\Josh and Angie\Recent 2008-08-05 16:05:58 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-08-04 18:53:46 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg8 2008-08-04 17:46:56 0 d-------- C:\Program Files\BySoft FreeRAM 2008-08-02 11:45:06 110080 --a------ C:\WINDOWS\system32\fvjkdk.dll 2008-08-02 11:44:57 110080 --a------ C:\WINDOWS\system32\jsxspfpl.dll 2008-08-02 11:40:20 93184 --a------ C:\WINDOWS\system32\jkblowmo.dll 2008-08-02 11:28:40 110080 --a------ C:\WINDOWS\system32\ztzhzr.dll 2008-08-02 11:28:31 110080 --a------ C:\WINDOWS\system32\hyrgqojk.dll 2008-08-02 11:25:32 93184 --a------ C:\WINDOWS\system32\rljmthxc.dll 2008-08-01 11:36:40 0 d-------- C:\Documents and Settings\Josh and Angie\.housecall6.6 2008-08-01 11:25:56 83456 --a------ C:\WINDOWS\system32\rrtgvdys.dll 2008-08-01 11:24:51 110080 --a------ C:\WINDOWS\system32\qynvnc.dll 2008-08-01 11:24:13 110080 --a------ C:\WINDOWS\system32\gyljlrtg.dll 2008-08-01 11:23:49 93184 --a------ C:\WINDOWS\system32\wxjwwpsy.dll 2008-08-01 11:22:53 870617 --ahs---- C:\WINDOWS\system32\KQYIOqru.ini2 2008-07-29 13:59:22 93696 --a------ C:\WINDOWS\system32\otkkqcmx.dll 2008-07-29 13:57:58 876321 --ahs---- C:\WINDOWS\system32\AHiSvyay.ini2 2008-07-28 19:18:59 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\Mozilla 2008-07-28 16:59:18 0 d-------- C:\Program Files\Abexo 2008-07-28 15:53:11 895124 --ahs---- C:\WINDOWS\system32\UxHOYcfe.ini2 2008-07-27 13:43:15 867379 --ahs---- C:\WINDOWS\system32\GQrBKRqr.ini2 2008-07-26 20:08:07 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\CyberLink 2008-07-26 18:05:06 0 d-------- C:\WINDOWS\Logs 2008-07-26 17:59:12 0 d-------- C:\Program Files\Conduit 2008-07-26 16:33:01 0 --a------ C:\Documents and Settings\Josh and Angie\jagex_runescape_preferences.dat 2008-07-26 16:32:42 0 d-------- C:\WINDOWS\.jagex_cache_32 2008-07-26 16:23:52 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\DMCache 2008-07-26 15:46:10 93184 --a------ C:\WINDOWS\system32\ityfpfno.dll 2008-07-26 15:45:12 345 --ahs---- C:\WINDOWS\system32\iOpYacdd.ini2 2008-07-26 15:39:50 0 d-------- C:\WINDOWS\system32\kBin02 2008-07-26 15:39:19 77 --a------ C:\Documents and Settings\Josh and Angie\6752.bat 2008-07-26 15:39:17 36352 --a------ C:\Documents and Settings\Josh and Angie\services.exe 2008-07-26 15:24:46 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\LimeWire 2008-07-19 22:53:25 0 d-------- C:\Program Files\AVG 2008-07-19 19:33:02 0 d-------- C:\VundoFix Backups 2008-07-19 18:10:22 868765 --ahs---- C:\WINDOWS\system32\dMlUuBeg.ini2 2008-07-19 16:36:29 0 d-------- C:\Temp 2008-07-19 13:09:10 0 d-------- C:\Program Files\Advanced Spyware Remover 2008-07-19 12:28:47 0 d-------- C:\Documents and Settings\LocalService\Application Data\Mozilla 2008-07-18 21:17:49 1977 --ahs---- C:\WINDOWS\system32\cfMpYcfe.ini2 2008-07-17 09:37:06 0 dr------- C:\Documents and Settings\Administrator\Favorites 2008-07-17 09:37:06 0 d-------- C:\Documents and Settings\Administrator\Desktop 2008-07-17 09:37:06 0 d---s---- C:\Documents and Settings\Administrator\Cookies 2008-07-17 09:37:06 0 dr-h----- C:\Documents and Settings\Administrator\Application Data 2008-07-17 09:37:06 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun 2008-07-17 09:37:06 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sonic 2008-07-17 09:37:06 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft 2008-07-17 09:37:06 0 d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc 2008-07-17 09:37:06 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities 2008-07-17 09:37:05 0 d--h----- C:\Documents and Settings\Administrator\Templates 2008-07-17 09:37:05 0 dr------- C:\Documents and Settings\Administrator\Start Menu 2008-07-17 09:37:05 0 dr-h----- C:\Documents and Settings\Administrator\SendTo 2008-07-17 09:37:05 0 dr-h----- C:\Documents and Settings\Administrator\Recent 2008-07-17 09:37:05 0 d--h----- C:\Documents and Settings\Administrator\PrintHood 2008-07-17 09:37:05 598016 --a------ C:\Documents and Settings\Administrator\NTUSER.DAT 2008-07-17 09:37:05 0 d--h----- C:\Documents and Settings\Administrator\NetHood 2008-07-17 09:37:05 0 dr------- C:\Documents and Settings\Administrator\My Documents 2008-07-17 09:37:05 0 d--h----- C:\Documents and Settings\Administrator\Local Settings 2008-07-17 09:08:10 60582204 --a----c- C:\SYM_REGISTRY_BACKUP.reg 2008-07-17 08:51:31 851490 --ahs---- C:\WINDOWS\system32\AacKmnmp.ini2 2008-07-16 08:27:06 726589 --ahs---- C:\WINDOWS\system32\CbJmWvut.ini2 2008-07-11 18:24:52 0 d-------- C:\Program Files\twc 2008-07-11 18:23:00 0 d-------- C:\Program Files\HERACTSTG 2008-07-10 18:40:59 0 d--hs---- C:\found.001 -- Find3M Report --------------------------------------------------------------- 2008-08-05 16:05:58 0 d-------- C:\Program Files\Common Files 2008-08-05 15:38:21 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-08-04 18:00:29 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\FrostWire 2008-07-26 18:21:54 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\Real 2008-07-19 22:18:15 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-07-11 18:24:18 0 d-------- C:\Program Files\Common Files\supportsoft 2008-07-07 15:34:55 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\Macromedia 2008-07-07 15:34:55 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\Adobe 2008-07-07 15:34:29 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\Move Networks 2008-07-05 12:32:01 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\WeatherBug 2008-07-04 16:52:19 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\Symantec 2008-06-29 22:13:51 0 d-------- C:\Program Files\MSXML 4.0 2008-06-26 21:22:09 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\Ludia 2008-06-26 11:19:27 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\PlayFirst 2008-06-25 18:48:40 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\WinRAR 2008-06-23 10:51:57 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\ViquaSoft 2008-06-22 18:49:08 4096 --a------ C:\WINDOWS\d3dx.dat 2008-06-21 14:50:36 147456 --a------ C:\WINDOWS\system32\vbzip10.dll <Not Verified; Info-ZIP; Info-ZIP's WiZ> 2008-06-20 20:55:17 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\funkitron 2008-06-15 18:13:57 0 d-------- C:\Program Files\Communities.com 2008-06-12 09:29:18 0 d-------- C:\Documents and Settings\Josh and Angie\Application Data\Sonic -- Registry Dump --------------------------------------------------------------- -- End of Deckard's System Scanner: finished at 2008-08-09 20:34:05 ------------ Thanks for your help Josh |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
08-12-2008, 09:14 PM
|
#3 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,798
OS: WinXP and Vista
|
Re: Hijack This Log
Hello jt9435,
This will require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once installed, you should see a blue screen prompt that says: The Recovery Console was successfully installed. Please continue as follows:
Please include the following reports for further review, and so we may continue cleansing the system: C:\ComboFix.txt New HijackThis log. |
|
|
|
|
08-13-2008, 12:35 PM
|
#4 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 23
OS: XP
|
Re: Hijack This Log
Ok Ried here are the reports that you asked for.
Combo Fix: ComboFix 08-08-12.01 - Josh and Angie 2008-08-13 14:11:55.1 - NTFSx86 Running from: C:\Documents and Settings\Josh and Angie\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Josh and Angie\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Guest\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML C:\Documents and Settings\Josh and Angie\Application Data\macromedia\Flash Player\#SharedObjects\RP2W6VQN\interclick.com C:\Documents and Settings\Josh and Angie\Application Data\macromedia\Flash Player\#SharedObjects\RP2W6VQN\interclick.com\ud.sol C:\Documents and Settings\Josh and Angie\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com C:\Documents and Settings\Josh and Angie\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol C:\Documents and Settings\Josh and Angie\services.exe C:\WINDOWS\BMc3c7117e.txt C:\WINDOWS\BMc3c7117e.xml C:\WINDOWS\cookies.ini C:\WINDOWS\Fonts\a.zip C:\WINDOWS\Fonts\acrsecB.fon C:\WINDOWS\Fonts\acrsecI.fon C:\WINDOWS\pskt.ini C:\WINDOWS\smdat32a.sys C:\WINDOWS\smdat32m.sys C:\WINDOWS\system32\AacKmnmp.ini C:\WINDOWS\SYSTEM32\AacKmnmp.ini2 C:\WINDOWS\SYSTEM32\AHiSvyay.ini C:\WINDOWS\SYSTEM32\AHiSvyay.ini2 C:\WINDOWS\SYSTEM32\brvacekd.ini C:\WINDOWS\SYSTEM32\CbJmWvut.ini C:\WINDOWS\SYSTEM32\CbJmWvut.ini2 C:\WINDOWS\SYSTEM32\cfMpYcfe.ini C:\WINDOWS\SYSTEM32\cfMpYcfe.ini2 C:\WINDOWS\system32\cohdbytf.ini C:\WINDOWS\SYSTEM32\dMlUuBeg.ini C:\WINDOWS\SYSTEM32\dMlUuBeg.ini2 C:\WINDOWS\SYSTEM32\eawrnasd.ini C:\WINDOWS\system32\fgqlnseq.ini C:\WINDOWS\system32\fqskvxar.ini C:\WINDOWS\system32\fvjkdk.dll C:\WINDOWS\system32\gdeanxhl.ini C:\WINDOWS\SYSTEM32\GQrBKRqr.ini C:\WINDOWS\SYSTEM32\GQrBKRqr.ini2 C:\WINDOWS\system32\gyljlrtg.dll C:\WINDOWS\system32\hyrgqojk.dll C:\WINDOWS\SYSTEM32\iOpYacdd.ini C:\WINDOWS\SYSTEM32\iOpYacdd.ini2 C:\WINDOWS\system32\ityfpfno.dll C:\WINDOWS\system32\jkblowmo.dll C:\WINDOWS\system32\jsxspfpl.dll C:\WINDOWS\SYSTEM32\knmtkiiy.ini C:\WINDOWS\system32\KQYIOqru.ini C:\WINDOWS\SYSTEM32\KQYIOqru.ini2 C:\WINDOWS\system32\MSINET.oca C:\WINDOWS\system32\ntqjsgpg.ini C:\WINDOWS\system32\otkkqcmx.dll C:\WINDOWS\system32\pac.txt C:\WINDOWS\SYSTEM32\pnfqeluv.ini C:\WINDOWS\system32\psflumxe.ini C:\WINDOWS\system32\qfvcfxdb.ini C:\WINDOWS\system32\qihgbqii.ini C:\WINDOWS\system32\qkmqdcvx.ini C:\WINDOWS\system32\qwnrhbnn.ini C:\WINDOWS\system32\qxxximlr.ini C:\WINDOWS\system32\qynvnc.dll C:\WINDOWS\system32\rljmthxc.dll C:\WINDOWS\system32\rrtgvdys.dll C:\WINDOWS\SYSTEM32\sgmbuwcp.ini C:\WINDOWS\system32\skuyiedc.ini C:\WINDOWS\SYSTEM32\sydvgtrr.ini C:\WINDOWS\system32\tdhxdkgv.ini C:\WINDOWS\system32\tfrpqmud.ini C:\WINDOWS\system32\tguirfbb.ini C:\WINDOWS\system32\uaxmkbla.ini C:\WINDOWS\system32\ubluxxgi.ini C:\WINDOWS\system32\uigadyir.ini C:\WINDOWS\SYSTEM32\ujoaqiif.ini C:\WINDOWS\SYSTEM32\UxHOYcfe.ini C:\WINDOWS\SYSTEM32\UxHOYcfe.ini2 C:\WINDOWS\system32\vhysrrid.ini C:\WINDOWS\system32\wkxuayee.ini C:\WINDOWS\system32\wxjwwpsy.dll C:\WINDOWS\system32\xbmrnukc.ini C:\WINDOWS\system32\xrkwetmm.ini C:\WINDOWS\system32\xtwusyct.ini C:\WINDOWS\system32\xxgxcuua.ini C:\WINDOWS\system32\ycadjcwi.ini C:\WINDOWS\system32\yomnpkbw.ini C:\WINDOWS\system32\ztzhzr.dll . ((((((((((((((((((((((((( Files Created from 2008-07-13 to 2008-08-13 ))))))))))))))))))))))))))))))) . 2008-08-11 21:02 . 2008-08-12 19:53 <DIR> d----c--- C:\BSTONE 2008-08-09 20:32 . 2008-08-09 20:32 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-09 20:29 . 2008-08-09 20:29 <DIR> d----c--- C:\Deckard 2008-08-09 20:20 . 2008-08-09 20:20 <DIR> d----c--- C:\ie-spyad_zo 2008-08-09 20:13 . 2008-08-09 20:15 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-08-09 18:43 . 2008-08-09 18:43 <DIR> d-------- C:\Program Files\Panda Security 2008-08-09 14:32 . 2008-08-09 18:25 <DIR> d-------- C:\Program Files\Eusing Free Registry Cleaner 2008-08-09 14:26 . 2008-08-09 14:26 <DIR> d-------- C:\Program Files\RegSweep 2008-08-09 14:26 . 2008-08-09 14:27 <DIR> d-------- C:\Documents and Settings\Josh and Angie\Application Data\RegSweep 2008-08-09 14:24 . 2008-04-23 00:16 6,066,176 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll 2008-08-09 14:24 . 2007-04-17 05:32 2,455,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dat 2008-08-09 14:24 . 2007-03-08 01:10 991,232 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll.mui 2008-08-09 14:24 . 2008-04-23 00:16 459,264 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll 2008-08-09 14:24 . 2008-04-23 00:16 383,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll 2008-08-09 14:24 . 2008-04-23 00:16 267,776 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll 2008-08-09 14:24 . 2008-04-23 00:16 63,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll 2008-08-09 14:24 . 2008-04-23 00:16 52,224 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll 2008-08-09 14:24 . 2008-04-22 03:39 13,824 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe 2008-08-05 16:11 . 2008-08-05 16:11 <DIR> d-------- C:\Program Files\Lavasoft 2008-08-05 16:11 . 2008-08-05 16:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-08-05 16:05 . 2008-08-05 16:05 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-08-04 18:53 . 2008-08-04 18:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8 2008-08-04 17:46 . 2008-08-04 17:49 <DIR> d-------- C:\Program Files\BySoft FreeRAM 2008-08-01 11:38 . 2008-08-01 11:37 102,664 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\tmcomm.sys 2008-08-01 11:36 . 2008-08-01 11:40 <DIR> d-------- C:\Documents and Settings\Josh and Angie\.housecall6.6 2008-07-29 15:07 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\pavboot.sys 2008-07-28 16:59 . 2008-07-28 16:59 <DIR> d-------- C:\Program Files\Abexo 2008-07-26 20:08 . 2008-07-26 20:08 <DIR> d-------- C:\Documents and Settings\Josh and Angie\Application Data\CyberLink 2008-07-26 18:06 . 2008-05-30 14:11 3,850,760 --a------ C:\WINDOWS\SYSTEM32\D3DX9_38.dll 2008-07-26 18:06 . 2008-05-30 14:11 1,491,992 --a------ C:\WINDOWS\SYSTEM32\D3DCompiler_38.dll 2008-07-26 18:06 . 2008-05-30 14:19 507,400 --a------ C:\WINDOWS\SYSTEM32\XAudio2_1.dll 2008-07-26 18:06 . 2008-05-30 14:11 467,984 --a------ C:\WINDOWS\SYSTEM32\d3dx10_38.dll 2008-07-26 18:06 . 2008-05-30 14:18 238,088 --a------ C:\WINDOWS\SYSTEM32\xactengine3_1.dll 2008-07-26 18:06 . 2008-05-30 14:17 65,032 --a------ C:\WINDOWS\SYSTEM32\XAPOFX1_0.dll 2008-07-26 18:06 . 2008-05-30 14:17 25,608 --a------ C:\WINDOWS\SYSTEM32\X3DAudio1_4.dll 2008-07-26 18:05 . 2008-07-26 18:05 <DIR> d-------- C:\WINDOWS\Logs 2008-07-26 17:59 . 2008-07-27 13:37 <DIR> d-------- C:\Program Files\Conduit 2008-07-26 16:33 . 2008-08-12 22:28 24 --a------ C:\Documents and Settings\Josh and Angie\jagex_runescape_preferences.dat 2008-07-26 16:32 . 2008-08-08 21:22 <DIR> d-------- C:\WINDOWS\.jagex_cache_32 2008-07-26 16:23 . 2008-07-27 13:20 <DIR> d-------- C:\Documents and Settings\Josh and Angie\Application Data\DMCache 2008-07-26 15:39 . 2008-07-26 15:39 <DIR> d-------- C:\WINDOWS\SYSTEM32\kBin02 2008-07-26 15:39 . 2008-07-26 15:39 77 --a------ C:\Documents and Settings\Josh and Angie\6752.bat 2008-07-26 15:24 . 2008-08-04 18:00 <DIR> d-------- C:\Documents and Settings\Josh and Angie\Application Data\LimeWire 2008-07-26 15:18 . 2008-07-26 15:18 108,336 --ahs---- C:\WINDOWS\SYSTEM32\MSWINSCK.OCX 2008-07-19 22:53 . 2008-07-19 22:53 <DIR> d-------- C:\Program Files\AVG 2008-07-19 19:33 . 2008-08-04 16:41 <DIR> d-------- C:\VundoFix Backups 2008-07-19 16:36 . 2008-07-19 16:42 <DIR> d-------- C:\Temp\ListDLLs 2008-07-19 16:36 . 2008-07-27 13:28 <DIR> d-------- C:\Temp 2008-07-19 13:09 . 2008-07-29 15:06 <DIR> d-------- C:\Program Files\Advanced Spyware Remover 2008-07-18 13:40 . 2008-07-18 13:40 7,499,056 --a--c--- C:\Firefox Setup 3.0.1.exe 2008-07-17 09:37 . 2005-04-02 11:40 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Sonic 2008-07-17 09:37 . 2005-04-02 11:25 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc 2008-07-17 09:37 . 2008-08-04 18:53 <DIR> d-------- C:\Documents and Settings\Administrator 2008-07-17 09:08 . 2008-07-17 09:08 60,582,204 --a--c--- C:\SYM_REGISTRY_BACKUP.reg . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-05 19:38 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-04 22:00 --------- d-----w C:\Documents and Settings\Josh and Angie\Application Data\FrostWire 2008-07-27 01:00 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-07-20 02:18 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-07-20 02:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-07-11 23:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\SupportSoft 2008-07-11 23:01 --------- d-----w C:\Program Files\twc 2008-07-11 22:24 --------- d-----w C:\Program Files\Common Files\supportsoft 2008-07-11 22:23 --------- d-----w C:\Program Files\HERACTSTG 2008-07-10 22:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\GoBit Games 2008-07-09 19:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Dell 2008-07-08 01:15 1,788,250 --sha-w C:\WINDOWS\SYSTEM32\lhsbtcot.tmp 2008-07-07 19:34 --------- d-----w C:\Documents and Settings\Josh and Angie\Application Data\Move Networks 2008-07-05 16:32 --------- d-----w C:\Documents and Settings\Josh and Angie\Application Data\WeatherBug 2008-07-04 21:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee.com 2008-07-04 20:52 --------- d-----w C:\Documents and Settings\Josh and Angie\Application Data\Symantec 2008-06-30 02:13 --------- d-----w C:\Program Files\MSXML 4.0 2008-06-27 01:22 --------- d-----w C:\Documents and Settings\Josh and Angie\Application Data\Ludia 2008-06-26 15:19 --------- d-----w C:\Documents and Settings\Josh and Angie\Application Data\PlayFirst 2008-06-26 15:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst 2008-06-23 14:51 --------- d-----w C:\Documents and Settings\Josh and Angie\Application Data\ViquaSoft 2008-06-23 14:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\BigFishGamesCache 2008-06-21 18:50 147,456 ----a-w C:\WINDOWS\SYSTEM32\vbzip10.dll 2008-06-21 00:55 --------- d-----w C:\Documents and Settings\Josh and Angie\Application Data\funkitron 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\SYSTEM32\mswsock.dll 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mswsock.dll 2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dnsapi.dll 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 10:44 138,368 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip6.sys 2008-06-20 01:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ludia 2008-06-15 22:13 --------- d-----w C:\Program Files\Communities.com 2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-13 13:10 272,128 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\bthport.sys 2008-05-16 15:58 12,632 ----a-w C:\WINDOWS\SYSTEM32\lsdelete.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360] "BySoft FreeRAM"="C:\Program Files\BySoft FreeRAM\FreeRAM.exe" [2007-09-28 08:32 318976] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 17:42 1404928] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 03:05 127035] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 10:35 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 10:32 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 10:36 114688] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 09:23 202544] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-04-02 11:32 98304] "RegSweep"="C:\Program Files\RegSweep\RegSweep.exe" [2008-08-08 14:07 6751480] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2004-08-04 07:00 53760 C:\WINDOWS\SYSTEM32\NARRATOR.EXE] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-04-02 11:18:45 24576] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=qynvnc.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport] --a------ 2007-03-15 11:09 460784 C:\Program Files\DellSupport\DSAgnt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter] --a------ 2007-11-15 09:23 202544 C:\Program Files\Dell Support Center\bin\sprtcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher] --a------ 2005-01-27 03:02 86016 C:\Program Files\Dell\Media Experience\DMXLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate] --a------ 2007-11-15 09:24 16384 C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] --------- 2004-10-12 18:54 57344 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\medicsp2] --a------ 2007-03-07 11:53 198184 C:\Program Files\twc\medicsp2\bin\sprtcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2005-04-02 11:32 98304 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-02-22 04:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2005-11-29 14:51 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24] R2 sprtsvc_medicsp2;SupportSoft Sprocket Service (medicsp2);C:\Program Files\twc\medicsp2\bin\sprtsvc.exe [2007-03-07 11:54] . Contents of the 'Scheduled Tasks' folder 2005-04-10 C:\WINDOWS\Tasks\ISP signup reminder 1.job - C:\WINDOWS\system32\OOBE\OOBEBALN.EXE [2004-08-04 07:00] 2008-08-12 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (JTSPC-Josh Thompson).job - c:\program files\mcafee.com\vso\mcmnhdlr.exe [] 2008-08-13 C:\WINDOWS\Tasks\RegSweep Scheduled Scan.job - C:\Program Files\RegSweep\RegSweep.exe [2008-08-08 14:07] 2008-08-13 C:\WINDOWS\Tasks\RegSweep Scheduled Scan.job - C:\Program Files\RegSweep [2008-08-09 14:26] . - - - - ORPHANS REMOVED - - - - HKLM-Run-BMc3c7117e - C:\WINDOWS\system32\jkblowmo.dll Notify-fccCTklJ - fccCTklJ.dll Notify-ssqPiFvs - ssqPiFvs.dll Notify-WgaLogon - (no file) . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Josh and Angie\Application Data\Mozilla\Firefox\Profiles\hx2mhba8.default\ FF -: plugin - C:\Program Files\Adobe\Acrobat 6.0\Reader\browser\nppdf32.dll FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-13 14:20:20 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\DOCUME~1\JOSHAN~1\LOCALS~1\Temp\tzk7.tmp scan completed successfully hidden files: 1 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\SYSTEM32\wdfmgr.exe C:\WINDOWS\SYSTEM32\FXSSVC.EXE C:\WINDOWS\SYSTEM32\RUNDLL32.EXE . ************************************************************************** . Completion time: 2008-08-13 14:30:11 - machine was rebooted [Josh and Angie] ComboFix-quarantined-files.txt 2008-08-13 18:30:05 Pre-Run: 24,229,486,592 bytes free Post-Run: 24,312,807,424 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect 303 --- E O F --- 2008-08-10 07:02:23 And the Hijack This Log too: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:35:33 PM, on 8/13/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\Program Files\twc\medicsp2\bin\sprtsvc.exe C:\WINDOWS\system32\fxssvc.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\Program Files\RegSweep\RegSweep.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Digital Line Detect\DLG.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.onlineregister.com/bvg/?B...49&TMRT=LD0044 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [RegSweep] C:\Program Files\RegSweep\RegSweep.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BySoft FreeRAM] C:\Program Files\BySoft FreeRAM\FreeRAM.exe O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user') O4 - Global Startup: Digital Line Detect.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/tech...bs/tgctlsr.cab O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file) O20 - AppInit_DLLs: qynvnc.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe O23 - Service: SupportSoft Sprocket Service (medicsp2) (sprtsvc_medicsp2) - SupportSoft, Inc. - C:\Program Files\twc\medicsp2\bin\sprtsvc.exe -- End of file - 5588 bytes Thanks Again |
|
|
|
|
08-13-2008, 06:24 PM
|
#5 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,798
OS: WinXP and Vista
|
Re: Hijack This Log
You're welcome, jt9435. : )
Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. It's IMPORTANT to carry out the instructions in the sequence listed below. *************************************************** Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. --------------------------------------------------------------------- Open notepad and copy/paste the text in the code box below into it: Code:
File:: C:\Documents and Settings\Josh and Angie\6752.bat Folder:: C:\WINDOWS\SYSTEM32\kBin02 Registry:: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=- in the same location as ComboFix.exe  Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt -------------------------------------------------------------------- Please try once again to perform an online scan with Panda ActiveScan
* Turn off the real time scanner of any existing antivirus program while performing the online scan ----------------------------------------------------- Please include the following in your next reply: C:\Combofix.txt Panda results - (attach the report please so it does not distort the thread Update on system behavior |
|
|
|
|
08-14-2008, 04:49 PM
|
#6 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 23
OS: XP
|
Re: Hijack This Log
ok here is the combofix log:
ComboFix 08-08-12.01 - Josh and Angie 2008-08-14 13:47:13.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.103 [GMT -4:00] Running from: C:\Documents and Settings\Josh and Angie\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Josh and Angie\Desktop\CFScript.txt * Created a new restore point FILE :: C:\Documents and Settings\Josh and Angie\6752.bat . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Josh and Angie\6752.bat C:\WINDOWS\SYSTEM32\kBin02 . ((((((((((((((((((((((((( Files Created from 2008-07-14 to 2008-08-14 ))))))))))))))))))))))))))))))) . 2008-08-14 12:55 . 2005-07-19 18:05 135,168 --a------ C:\WINDOWS\SYSTEM32\igfxres.dll 2008-08-13 21:54 . 2008-08-13 21:54 <DIR> d-------- C:\Program Files\XPC Tools 2008-08-13 21:04 . 2008-07-31 10:40 509,448 --a------ C:\WINDOWS\SYSTEM32\XAudio2_2.dll 2008-08-13 21:04 . 2008-07-31 10:41 68,616 --a------ C:\WINDOWS\SYSTEM32\XAPOFX1_1.dll 2008-08-13 21:03 . 2008-07-12 08:18 3,851,784 --a------ C:\WINDOWS\SYSTEM32\D3DX9_39.dll 2008-08-13 21:03 . 2008-07-12 08:18 1,493,528 --a------ C:\WINDOWS\SYSTEM32\D3DCompiler_39.dll 2008-08-13 21:03 . 2008-07-12 08:18 467,984 --a------ C:\WINDOWS\SYSTEM32\d3dx10_39.dll 2008-08-13 21:03 . 2008-07-31 10:41 238,088 --a------ C:\WINDOWS\SYSTEM32\xactengine3_2.dll 2008-08-13 20:52 . 2005-07-19 18:26 61,440 --a------ C:\WINDOWS\SYSTEM32\iAlmCoIn_v4363.dll 2008-08-13 20:34 . 2008-08-13 20:36 <DIR> d-------- C:\Program Files\Nancy Drew 2008-08-13 18:52 . 2008-08-14 13:19 664 --a------ C:\WINDOWS\SYSTEM32\d3d9caps.dat 2008-08-11 21:02 . 2008-08-12 19:53 <DIR> d----c--- C:\BSTONE 2008-08-09 20:32 . 2008-08-09 20:32 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-09 20:29 . 2008-08-09 20:29 <DIR> d----c--- C:\Deckard 2008-08-09 20:20 . 2008-08-09 20:20 <DIR> d----c--- C:\ie-spyad_zo 2008-08-09 20:13 . 2008-08-09 20:15 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-08-09 18:43 . 2008-08-09 18:43 <DIR> d-------- C:\Program Files\Panda Security 2008-08-09 14:32 . 2008-08-09 18:25 <DIR> d-------- C:\Program Files\Eusing Free Registry Cleaner 2008-08-09 14:26 . 2008-08-09 14:27 <DIR> d-------- C:\Documents and Settings\Josh and Angie\Application Data\RegSweep 2008-08-09 14:24 . 2008-06-23 12:57 6,066,176 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll 2008-08-09 14:24 . 2007-04-17 05:32 2,455,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dat 2008-08-09 14:24 . 2007-03-08 01:10 991,232 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll.mui 2008-08-09 14:24 . 2008-06-23 12:57 459,264 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll 2008-08-09 14:24 . 2008-06-23 12:57 383,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll 2008-08-09 14:24 . 2008-06-23 12:57 267,776 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll 2008-08-09 14:24 . 2008-06-23 12:57 63,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll 2008-08-09 14:24 . 2008-06-23 12:57 52,224 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll 2008-08-09 14:24 . 2008-06-23 05:20 13,824 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe 2008-08-05 16:11 . 2008-08-05 16:11 <DIR> d-------- C:\Program Files\Lavasoft 2008-08-05 16:11 . 2008-08-05 16:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-08-05 16:05 . 2008-08-05 16:05 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-08-04 18:53 . 2008-08-04 18:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8 2008-08-04 17:46 . 2008-08-04 17:49 <DIR> d-------- C:\Program Files\BySoft FreeRAM 2008-08-01 11:38 . 2008-08-01 11:37 102,664 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\tmcomm.sys 2008-08-01 11:36 . 2008-08-01 11:40 <DIR> d-------- C:\Documents and Settings\Josh and Angie\.housecall6.6 2008-07-29 15:07 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\pavboot.sys 2008-07-28 16:59 . 2008-07-28 16:59 <DIR> d-------- C:\Program Files\Abexo 2008-07-26 20:08 . 2008-07-26 20:08 <DIR> d-------- C:\Documents and Settings\Josh and Angie\Application Data\CyberLink 2008-07-26 18:06 . 2008-05-30 14:11 3,850,760 --a------ C:\WINDOWS\SYSTEM32\D3DX9_38.dll 2008-07-26 18:06 . 2008-05-30 14:11 1,491,992 --a------ C:\WINDOWS\SYSTEM32\D3DCompiler_38.dll 2008-07-26 18:06 . 2008-05-30 14:19 507,400 --a------ C:\WINDOWS\SYSTEM32\XAudio2_1.dll 2008-07-26 18:06 . 2008-05-30 14:11 467,984 --a------ C:\WINDOWS\SYSTEM32\d3dx10_38.dll 2008-07-26 18:06 . 2008-05-30 14:18 238,088 --a------ C:\WINDOWS\SYSTEM32\xactengine3_1.dll 2008-07-26 18:06 . 2008-05-30 14:17 65,032 --a------ C:\WINDOWS\SYSTEM32\XAPOFX1_0.dll 2008-07-26 18:06 . 2008-05-30 14:17 25,608 --a------ C:\WINDOWS\SYSTEM32\X3DAudio1_4.dll 2008-07-26 18:05 . 2008-07-26 18:05 <DIR> d-------- C:\WINDOWS\Logs 2008-07-26 17:59 . 2008-07-27 13:37 <DIR> d-------- C:\Program Files\Conduit 2008-07-26 16:33 . 2008-08-13 21:52 24 --a------ C:\Documents and Settings\Josh and Angie\jagex_runescape_preferences.dat 2008-07-26 16:32 . 2008-08-08 21:22 <DIR> d-------- C:\WINDOWS\.jagex_cache_32 2008-07-26 16:23 . 2008-07-27 13:20 <DIR> d-------- C:\Documents and Settings\Josh and Angie\Application Data\DMCache 2008-07-26 15:24 . 2008-08-04 18:00 <DIR> d-------- C:\Documents and Settings\Josh and Angie\Application Data\LimeWire 2008-07-26 15:18 . 2008-07-26 15:18 108,336 --ahs---- C:\WINDOWS\SYSTEM32\MSWINSCK.OCX 2008-07-19 22:53 . 2008-07-19 22:53 <DIR> d-------- C:\Program Files\AVG 2008-07-19 19:33 . 2008-08-04 16:41 <DIR> d-------- C:\VundoFix Backups 2008-07-19 16:36 . 2008-07-19 16:42 <DIR> d-------- C:\Temp\ListDLLs 2008-07-19 16:36 . 2008-07-27 13:28 <DIR> d-------- C:\Temp 2008-07-19 13:09 . 2008-07-29 15:06 <DIR> d-------- C:\Program Files\Advanced Spyware Remover 2008-07-18 13:40 . 2008-07-18 13:40 7,499,056 --a--c--- C:\Firefox Setup 3.0.1.exe 2008-07-17 09:37 . 2005-04-02 11:40 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Sonic 2008-07-17 09:37 . 2005-04-02 11:25 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc 2008-07-17 09:37 . 2008-08-04 18:53 <DIR> d-------- C:\Documents and Settings\Administrator 2008-07-17 09:08 . 2008-07-17 09:08 60,582,204 --a--c--- C:\SYM_REGISTRY_BACKUP.reg . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-13 22:41 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-04 22:00 --------- d-----w C:\Documents and Settings\Josh and Angie\Application Data\FrostWire 2008-07-27 01:00 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-07-20 02:18 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-07-20 02:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-07-11 23:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\SupportSoft 2008-07-11 23:01 --------- d-----w C:\Program Files\twc 2008-07-11 22:24 --------- d-----w C:\Program Files\Common Files\supportsoft 2008-07-11 22:23 --------- d-----w C:\Program Files\HERACTSTG 2008-07-10 22:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\GoBit Games 2008-07-09 19:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Dell 2008-07-08 01:15 1,788,250 --sha-w C:\WINDOWS\SYSTEM32\lhsbtcot.tmp 2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\SYSTEM32\es.dll 2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\es.dll 2008-07-07 19:34 --------- d-----w C:\Documents and Settings\Josh and Angie\Application Data\Move Networks 2008-07-05 16:32 --------- d-----w C:\Documents and Settings\Josh and Angie\Application Data\WeatherBug 2008-07-04 21:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee.com 2008-07-04 20:52 --------- d-----w C:\Documents and Settings\Josh and Angie\Application Data\Symantec 2008-06-30 02:13 --------- d-----w C:\Program Files\MSXML 4.0 2008-06-27 01:22 --------- d-----w C:\Documents and Settings\Josh and Angie\Application Data\Ludia 2008-06-26 15:19 --------- d-----w C:\Documents and Settings\Josh and Angie\Application Data\PlayFirst 2008-06-26 15:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\SYSTEM32\mscms.dll 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mscms.dll 2008-06-24 14:57 3,592,192 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll 2008-06-23 14:51 --------- d-----w C:\Documents and Settings\Josh and Angie\Application Data\ViquaSoft 2008-06-23 14:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\BigFishGamesCache 2008-06-23 09:20 70,656 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe 2008-06-23 09:20 625,664 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe 2008-06-21 18:50 147,456 ----a-w C:\WINDOWS\SYSTEM32\vbzip10.dll 2008-06-21 05:23 161,792 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll 2008-06-21 00:55 --------- d-----w C:\Documents and Settings\Josh and Angie\Application Data\funkitron 2008-06-20 17:36 245,248 ----a-w C:\WINDOWS\SYSTEM32\mswsock.dll 2008-06-20 17:36 245,248 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mswsock.dll 2008-06-20 17:36 147,968 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dnsapi.dll 2008-06-20 10:44 360,960 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 360,960 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\afd.sys 2008-06-20 09:32 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-20 09:32 225,920 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip6.sys 2008-06-20 01:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ludia 2008-06-15 22:13 --------- d-----w C:\Program Files\Communities.com 2008-06-13 13:10 272,128 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\bthport.sys 2008-05-16 15:58 12,632 ----a-w C:\WINDOWS\SYSTEM32\lsdelete.exe . ((((((((((((((((((((((((((((( snapshot@2008-08-13_14.29.36.70 ))))))))))))))))))))))))))))))))))))))))) . + 2008-07-07 20  43 253,952 ----a-w C:\WINDOWS\$hf_mig$\KB950974\SP2QFE\es.dll+ 2008-07-07 20:26:58 253,952 ----a-w C:\WINDOWS\$hf_mig$\KB950974\SP3GDR\es.dll + 2008-07-07 20:23:18 253,952 ----a-w C:\WINDOWS\$hf_mig$\KB950974\SP3QFE\es.dll + 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB950974\spmsg.dll + 2007-11-30 12:39:22 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB950974\spuninst.exe + 2007-11-30 12:39:22 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB950974\update\spcustom.dll + 2007-11-30 12:39:18 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB950974\update\update.exe + 2007-11-30 12:39:19 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB950974\update\updspapi.dll + 2008-07-14 11:03:00 62,976 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\SP2QFE\tzchange.exe + 2008-07-11 12:42:28 62,976 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\SP3GDR\tzchange.exe + 2008-07-11 12:51:51 62,976 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\SP3QFE\tzchange.exe + 2007-11-30 11:18:51 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\spmsg.dll + 2007-11-30 11:18:51 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\spuninst.exe + 2007-11-30 11:18:51 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\update\spcustom.dll + 2007-11-30 12:39:22 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\update\update.exe + 2007-11-30 12:39:22 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\update\updspapi.dll + 2008-06-24 16:28:00 74,240 ----a-w C:\WINDOWS\$hf_mig$\KB952954\SP2QFE\mscms.dll + 2008-06-24 16:43:16 74,240 ----a-w C:\WINDOWS\$hf_mig$\KB952954\SP3GDR\mscms.dll + 2008-06-24 16:53:10 74,240 ----a-w C:\WINDOWS\$hf_mig$\KB952954\SP3QFE\mscms.dll + 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB952954\spmsg.dll + 2007-11-30 12:39:22 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB952954\spuninst.exe + 2007-11-30 12:39:22 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB952954\update\spcustom.dll + 2007-11-30 12:39:22 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB952954\update\update.exe + 2007-11-30 12:39:22 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB952954\update\updspapi.dll - 2004-08-04 11:00:00 138,496 -c----w C:\WINDOWS\$NtUninstallKB951748$\afd.sys - 2008-02-20 05:32:43 148,992 -c----w C:\WINDOWS\$NtUninstallKB951748$\dnsapi.dll - 2004-08-04 11:00:00 245,248 -c----w C:\WINDOWS\$NtUninstallKB951748$\mswsock.dll - 2007-10-30 17:20:55 360,064 -c----w C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys - 2006-08-16 09:37:30 225,664 -c----w C:\WINDOWS\$NtUninstallKB951748$\tcpip6.sys + 2008-08-13 22:49:52 68,608 ----a-w C:\WINDOWS\ASSEMBLY\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll + 2008-08-13 22:50:07 72,192 ----a-w C:\WINDOWS\ASSEMBLY\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll + 2008-08-13 22:50:08 4,308,992 ----a-w C:\WINDOWS\ASSEMBLY\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll + 2008-08-13 22:50:10 482,304 ----a-w C:\WINDOWS\ASSEMBLY\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll + 2008-08-13 22:50:02 2,878,976 ----a-w C:\WINDOWS\ASSEMBLY\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll + 2008-08-13 22:49:43 258,048 ----a-w C:\WINDOWS\ASSEMBLY\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll + 2008-08-13 22:49:44 114,176 ----a-w C:\WINDOWS\ASSEMBLY\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll + 2008-08-13 22:50:30 260,096 ----a-w C:\WINDOWS\ASSEMBLY\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll + 2008-08-13 22:49:57 5,025,792 ----a-w C:\WINDOWS\ASSEMBLY\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll + 2008-08-13 22:49:50 10,752 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll + 2008-08-13 22:49:43 503,808 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll + 2008-08-13 22:49:45 13,312 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll + 2008-08-13 22:50:05 8,192 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll + 2008-08-13 22:50:05 36,864 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll + 2008-08-13 22:50:06 5,632 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll + 2008-08-13 22:49:47 413,696 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll + 2008-08-13 22:49:47 36,864 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll + 2008-08-13 22:49:48 647,168 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll + 2008-08-13 22:49:49 73,728 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll + 2008-08-13 22:49:46 745,472 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll + 2008-08-13 22:50:33 110,592 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll + 2008-08-13 22:50:32 372,736 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll + 2008-08-13 22:49:32 28,672 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll + 2008-08-13 22:50:32 667,648 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll + 2008-08-13 22:50:33 5,632 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll + 2008-08-13 22:49:42 12,800 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll + 2008-08-13 22:49:41 32,768 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll + 2008-08-13 22:49:41 7,168 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll + 2008-08-13 22:50:21 110,592 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll + 2008-08-13 22:49:53 81,920 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll + 2008-08-13 22:50:22 389,120 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll + 2008-08-13 22:50:12 716,800 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll + 2008-08-13 22:49:45 884,736 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll + 2008-08-13 22:50:04 5,050,368 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll + 2008-08-13 22:49:54 188,416 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll + 2008-08-13 22:49:53 397,312 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll + 2008-08-13 22:49:54 81,920 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll + 2008-08-13 22:50:28 700,416 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll + 2008-08-13 22:50:15 368,640 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll + 2008-08-13 22:50:29 258,048 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll + 2008-08-13 22:50:17 299,008 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll + 2008-08-13 22:50:19 131,072 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll + 2008-08-13 22:49:51 258,048 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll + 2008-08-13 22:49:55 114,688 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll + 2008-08-13 22:50:31 835,584 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll + 2008-08-13 22:49:58 86,016 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll + 2008-08-13 22:49:59 823,296 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll + 2008-08-13 22:50:00 5,316,608 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll + 2008-08-13 22:50:01 2,035,712 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll + 2008-08-13 22:50:26 3,018,752 ----a-w C:\WINDOWS\ASSEMBLY\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll + 2008-08-13 23:02:18 26,624 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\Accessibility\fe41d43cac7ae0408f47db0abd2e79af\Accessibility.ni.dll + 2008-08-13 23:02:23 860,160 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\AspNetMMCExt\a0a1775ea5d20143bffef28a3f39ac00\AspNetMMCExt.ni.dll + 2008-08-13 23:02:24 237,568 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\CustomMarshalers\cf6de470f6d26242b3dba243a4686937\CustomMarshalers.ni.dll + 2008-08-13 23:02:23 15,360 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\dfsvc\0b355a6244c7374889bf29ae3e85f758\dfsvc.ni.exe + 2008-08-13 23:02:27 880,640 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\0338f18c24c65d49a1687b2ffaeb7582\Microsoft.Build.Engine.ni.dll + 2008-08-13 23:02:27 81,920 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\3dd805872e059c4782c7993d8a16e44e\Microsoft.Build.Framework.ni.dll + 2008-08-13 23:02:33 1,691,648 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\bf0d69c571d69b4caf2de66dcd4306c0\Microsoft.Build.Tasks.ni.dll + 2008-08-13 23:02:34 163,840 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\4d30e31ef8fc07419c9be2292976aa0d\Microsoft.Build.Utilities.ni.dll + 2008-08-13 23:02:39 1,724,416 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\959bca5e191f554ea33d8f09b7b03158\Microsoft.VisualBasic.ni.dll + 2008-08-13 22:51:32 11,411,456 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\mscorlib\42172038433f7246b9a970723456db95\mscorlib.ni.dll + 2008-08-13 23:02:41 962,560 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.Configuration\963b8279788614448d591d892b176a50\System.Configuration.ni.dll + 2008-08-13 22:53:41 6,688,768 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.Data\ef25662b29d8964ca10359bd9b64766a\System.Data.ni.dll + 2008-08-13 23:02:44 1,712,128 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.Deployment\f6ef0847a0f0274db1c0c842440672ac\System.Deployment.ni.dll + 2008-08-13 22:54:38 10,723,328 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.Design\74080e46c7424246aba3b959566842e3\System.Design.ni.dll + 2008-08-13 23:02:47 1,220,608 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.DirectorySer#\7aa99806021d414591a9295b2182eacb\System.DirectoryServices.ni.dll + 2008-08-13 23:02:48 512,000 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.DirectorySer#\a9975daddc9c774e83349aba02de2797\System.DirectoryServices.Protocols.ni.dll + 2008-08-13 22:52:26 229,376 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.Drawing.Desi#\79622265ab4ecd4d84b9fb5253469e14\System.Drawing.Design.ni.dll + 2008-08-13 22:52:31 1,626,112 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.Drawing\8007772c5c82cf41b52f6c0b8bb685ee\System.Drawing.ni.dll + 2008-08-13 23:02:50 659,456 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.EnterpriseSe#\b7135112e64fd04ebf0efe176787f17e\System.EnterpriseServices.ni.dll + 2008-08-13 23:02:50 294,912 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.EnterpriseSe#\b7135112e64fd04ebf0efe176787f17e\System.EnterpriseServices.Wrapper.dll + 2008-08-13 23:02:52 729,088 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.Security\af25f96f58c77f419985d5f7f28c4f64\System.Security.ni.dll + 2008-08-13 23:02:54 684,032 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.Transactions\f0b9743642894041a114a5407fbd74db\System.Transactions.ni.dll + 2008-08-13 23:03:31 2,310,144 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.Web.Mobile\1ecfaf857a81be43b1a145f39358573d\System.Web.Mobile.ni.dll + 2008-08-13 23:03:32 237,568 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.Web.RegularE#\8417dbb74eb3dc47bfc58e7ab8e3950e\System.Web.RegularExpressions.ni.dll + 2008-08-13 23:03:36 1,945,600 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.Web.Services\94707798b9767c48bbb8ef4eec06908e\System.Web.Services.ni.dll + 2008-08-13 23:03:23 11,808,768 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.Web\f4681f1074e0ad43af4126cb2b395e6c\System.Web.ni.dll + 2008-08-13 22:52:59 13,107,200 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.Windows.Forms\5dc5b11a23bea04eb77c7db76b3d8455\System.Windows.Forms.ni.dll + 2008-08-13 22:53:15 5,640,192 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System.Xml\5ee29d2ebee8c94082439ef8eb518eb0\System.Xml.ni.dll + 2008-08-13 22:52:23 8,093,696 ----a-w C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\System\2b7ea7d8cfb53e4399650cd43cba85b3\System.ni.dll + 2008-04-23 04:16:28 124,928 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\advpack.dll + 2008-04-23 04:16:28 347,136 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\dxtmsft.dll + 2008-04-23 04:16:28 214,528 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\dxtrans.dll + 2008-04-23 04:16:28 133,120 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\extmgr.dll + 2008-04-23 04:16:28 63,488 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\icardie.dll + 2008-04-22 07:39:58 70,656 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ie4uinit.exe + 2008-04-23 04:16:28 153,088 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieakeng.dll + 2008-04-23 04:16:28 230,400 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieaksie.dll + 2008-04-20 05:07:51 161,792 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieakui.dll + 2008-04-23 04:16:28 383,488 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieapfltr.dll + 2008-04-23 04:16:28 384,512 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\iedkcs32.dll + 2008-04-23 04:16:28 6,066,176 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieframe.dll + 2008-04-23 04:16:28 44,544 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\iernonce.dll + 2008-04-23 04:16:28 267,776 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\iertutil.dll + 2008-04-22 07:39:58 13,824 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieudinit.exe + 2008-04-22 07:40:18 625,664 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\iexplore.exe + 2008-04-23 04:16:28 27,648 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\jsproxy.dll + 2008-04-23 04:16:28 459,264 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\msfeeds.dll + 2008-04-23 04:16:28 52,224 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\msfeedsbs.dll + 2008-04-24 02:16:30 3,591,680 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\mshtml.dll + 2008-04-23 04:16:28 478,208 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\mshtmled.dll + 2008-04-23 04:16:28 193,024 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\msrating.dll + 2008-04-23 04:16:28 671,232 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\mstime.dll + 2008-04-23 04:16:28 102,912 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\occache.dll + 2008-04-23 04:16:28 44,544 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\pngfilt.dll + 2007-03-06 01:22:39 213,216 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe + 2007-03-06 01:23:51 371,424 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\updspapi.dll + 2008-04-23 04:16:28 105,984 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\url.dll + 2008-04-23 04:16:29 1,159,680 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\urlmon.dll + 2008-04-23 04:16:29 233,472 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\webcheck.dll + 2008-04-23 04:16:29 826,368 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\wininet.dll - 2003-02-21 01:09:46 57,344 -c--a-w C:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe + 2005-09-23 11:28:52 72,704 ----a-w C:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe - 2003-02-21 01:09:32 5,120 -c--a-w C:\WINDOWS\Microsoft.NET\Framework\SBSCMP10.DLL + 2005-09-23 11:28:52 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp10.dll + 2005-09-23 11:28:56 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp20_mscorwks.dll + 2005-09-23 11:28:58 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp20_perfcounter.dll + 2005-09-23 11:28:56 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\SharedReg12.dll - 2003-02-21 00:43:50 131,072 -c--a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\MSCORMMC.DLL + 2005-09-23 11:28:52 86,528 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll + 2005-09-23 11:28:36 18,944 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll + 2005-09-23 11:28:42 136,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll + 2005-09-23 11:28:44 4,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll + 2005-09-23 11:29:04 183,808 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll + 2005-09-23 11:28:28 208,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll + 2005-09-23 11:28:56 10,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll + 2005-09-23 11:28:58 138,240 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll + 2005-09-23 11:28:36 87,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\alink.dll + 2005-09-23 11:28:58 55,488 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe + 2005-09-23 11:28:32 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe + 2005-09-23 11:28:32 10,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll + 2005-09-23 11:28:32 8,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll + 2005-09-23 11:28:32 23,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll + 2005-09-23 11:28:32 70,656 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll + 2005-09-23 11:28:32 13,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe + 2005-09-23 11:28:32 26,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe + 2005-09-23 11:28:32 106,496 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe + 2005-09-23 11:28:32 29,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe + 2005-09-23 11:28:32 29,888 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe + 2005-09-23 11:28:32 503,808 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll + 2005-09-23 11:28:56 106,496 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CasPol.exe + 2005-09-23 11:28:56 88,576 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll + 2005-09-23 11:28:42 76,984 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe + 2005-09-23 11:28:42 1,144,832 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscomp.dll + 2005-09-23 11:28:42 13,312 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll + 2005-09-23 11:28:58 17,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll + 2005-09-23 11:28:56 68,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll + 2005-09-23 11:28:44 31,936 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cvtres.exe + 2005-09-23 11:28:38 52,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfdll.dll + 2005-09-23 11:28:38 4,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe + 2005-09-23 11:29:12 547,840 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll + 2005-09-23 11:28:56 788,992 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll + 2005-09-23 11:28:50 9,216 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fusion.dll + 2005-09-23 11:28:56 9,728 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe + 2005-09-23 11:28:56 8,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll + 2005-09-23 11:28:56 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEHost.dll + 2005-09-23 11:28:56 5,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll + 2005-09-23 11:28:56 224,952 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe + 2005-09-23 11:28:56 28,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe + 2005-09-23 11:28:56 55,296 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll + 2005-09-23 11:28:56 72,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll + 2005-09-23 11:28:48 40,960 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe + 2005-09-23 11:01:16 609,472 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe + 2005-09-23 10:29:48 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1025.dll + 2005-09-23 10:32:24 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1028.dll + 2005-09-23 10:34:10 82,944 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1029.dll + 2005-09-23 10:34:12 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1030.dll + 2005-09-23 10:34:44 85,504 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1031.dll + 2005-09-23 10:36:24 87,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1032.dll + 2005-09-23 07:46:14 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1033.dll + 2005-09-23 10:38:26 81,408 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1035.dll + 2005-09-23 10:38:52 86,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1036.dll + 2005-09-23 10:40:30 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1037.dll + 2005-09-23 10:40:32 83,968 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1038.dll + 2005-09-23 10:40:56 84,480 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1040.dll + 2005-09-23 10:42:58 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1041.dll + 2005-09-23 10:44:58 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1042.dll + 2005-09-23 10:46:38 83,456 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1043.dll + 2005-09-23 10:46:38 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1044.dll + 2005-09-23 10:46:40 83,456 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1045.dll + 2005-09-23 10:47:04 82,432 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1046.dll + 2005-09-23 10:47:30 82,432 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1049.dll + 2005-09-23 10:47:32 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1053.dll + 2005-09-23 10:47:32 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1055.dll + 2005-09-23 10:30:18 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.2052.dll + 2005-09-23 10:47:06 84,480 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.2070.dll + 2005-09-23 10:29:50 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.3076.dll + 2005-09-23 10:36:48 85,504 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.3082.dll + 2005-09-23 11:57:06 245,408 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\unicows.dll + 2005-09-23 11:28:48 413,696 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll + 2005-09-23 11:28:48 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll + 2005-09-23 11:28:48 647,168 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll + 2005-09-23 11:28:48 73,728 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll + 2005-09-23 11:28:48 745,472 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll + 2005-09-23 11:29:10 110,592 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll + 2005-09-23 11:29:10 372,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll + 2005-09-23 11:29:08 667,648 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll + 2005-09-23 11:28:30 28,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll + 2005-09-23 11:29:10 5,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll + 2005-09-23 11:28:30 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll + 2005-09-23 11:28:30 12,800 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll + 2005-09-23 11:28:30 7,168 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll + 2005-09-23 11:28:32 87,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll + 2005-09-23 11:28:48 69,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe + 2005-09-23 11:28:56 800,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll + 2005-09-23 11:28:56 73,216 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll + 2005-09-23 11:28:56 288,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll + 2005-09-23 11:28:56 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll + 2005-09-23 11:28:56 326,144 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll + 2005-09-23 11:28:56 81,408 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorld.dll + 2005-09-23 11:28:56 4,308,992 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll + 2005-09-23 11:28:56 102,400 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll + 2005-09-23 11:29:00 330,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll + 2005-09-23 11:28:56 67,072 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll + 2005-09-23 11:28:50 9,216 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll + 2005-09-23 11:28:56 226,816 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll + 2005-09-23 11:28:56 66,240 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe + 2005-09-23 11:28:56 10,240 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscortim.dll + 2005-09-23 11:28:50 5,615,616 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll + 2005-09-23 11:29:00 22,528 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MUI\0409\mscorsecr.dll + 2005-09-23 11:28:56 96,440 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe + 2005-09-23 11:28:56 14,848 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normalization.dll + 2005-09-23 11:28:56 78,336 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll + 2005-09-23 11:28:50 136,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\peverify.dll + 2005-09-23 11:28:56 53,248 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe + 2005-09-23 11:28:56 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe + 2005-09-23 11:29:02 59,072 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe + 2005-09-23 11:28:58 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll + 2005-09-23 11:28:56 107,520 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\shfusion.dll + 2005-09-23 11:29:00 85,504 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll + 2005-09-23 11:28:56 377,344 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\SOS.dll + 2005-09-23 11:28:56 110,592 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll + 2005-09-23 11:28:58 389,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll + 2005-09-23 11:28:56 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll + 2005-09-23 11:28:56 2,878,976 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.dll + 2005-09-23 11:28:56 482,304 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll + 2005-09-23 11:28:56 716,800 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll + 2005-09-23 11:28:38 884,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll + 2005-09-23 11:28:56 5,050,368 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Design.dll + 2005-09-23 11:28:56 397,312 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll + 2005-09-23 11:28:56 188,416 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll + 2005-09-23 11:28:56 3,018,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.dll + 2005-09-23 11:28:56 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll + 2005-09-23 11:28:56 700,416 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll + 2005-09-23 11:28:56 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll + 2005-09-23 11:28:56 47,616 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll + 2005-09-23 11:28:56 114,176 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll + 2005-09-23 11:28:56 368,640 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Management.dll + 2005-09-23 11:28:56 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll + 2005-09-23 11:28:56 299,008 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll + 2005-09-23 11:28:56 131,072 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll + 2005-09-23 11:28:56 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Security.dll + 2005-09-23 11:28:56 114,688 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll + 2005-09-23 11:28:56 260,096 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll + 2005-09-23 11:28:56 5,025,792 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.dll + 2005-09-23 11:28:56 835,584 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll + 2005-09-23 11:28:56 86,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll + 2005-09-23 11:28:56 823,296 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll + 2005-09-23 11:28:56 5,316,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll + 2005-09-23 11:28:56 2,035,712 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.XML.dll + 2005-09-23 11:28:56 71,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL + 2005-09-23 11:29:06 1,140,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe + 2005-09-23 11:28:30 1,306,624 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll + 2005-09-23 11:28:32 298,496 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\webengine.dll + 2005-09-23 11:28:56 28,160 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll - 2006-08-16 11:58:05 100,352 -c--a-w C:\WINDOWS\SYSTEM32\6to4svc.dll + 2006-08-16 12:08:32 100,352 ----a-w C:\WINDOWS\SYSTEM32\6to4svc.dll - 2008-04-23 04:16:28 124,928 ----a-w C:\WINDOWS\SYSTEM32\advpack.dll + 2008-06-23 16:57:27 124,928 ----a-w C:\WINDOWS\SYSTEM32\advpack.dll + 2005-09-23 11:28:38 83,456 ----a-w C:\WINDOWS\SYSTEM32\dfshim.dll - 2006-08-16 11:58:05 100,352 -c--a-w C:\WINDOWS\SYSTEM32\DLLCACHE\6to4svc.dll + 2006-08-16 12:08:32 100,352 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\6to4svc.dll - 2008-04-23 04:16:28 124,928 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\advpack.dll + 2008-06-23 16:57:27 124,928 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\advpack.dll - 2008-04-23 04:16:28 347,136 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll + 2008-06-23 16:57:27 347,136 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll - 2008-04-23 04:16:28 214,528 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll + 2008-06-23 16:57:27 214,528 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll - 2008-04-23 04:16:28 133,120 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll + 2008-06-23 16:57:27 133,120 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll - 2008-04-23 04:16:28 153,088 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakeng.dll + 2008-06-23 16:57:29 153,088 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakeng.dll - 2008-04-23 04:16:28 230,400 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\ieaksie.dll + 2008-06-23 16:57:29 230,400 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\ieaksie.dll - 2008-04-23 04:16:28 384,512 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iedkcs32.dll + 2008-06-23 16:57:29 384,512 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iedkcs32.dll - 2008-04-23 04:16:28 44,544 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iernonce.dll + 2008-06-23 16:57:33 44,544 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iernonce.dll - 2007-08-21 06:15:44 683,520 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\inetcomm.dll + 2008-04-11 18:50:43 683,520 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\inetcomm.dll - 2008-04-23 04:16:28 27,648 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll + 2008-06-23 16:57:35 27,648 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll - 2004-08-04 11:00:00 331,776 -c--a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msadce.dll + 2008-05-01 14:30:33 331,776 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msadce.dll - 2008-04-23 04:16:28 478,208 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll + 2008-06-23 16:57:39 477,696 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll - 2008-04-23 04:16:28 193,024 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll + 2008-06-23 16:57:39 193,024 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll - 2008-04-23 04:16:28 671,232 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll + 2008-06-23 16:57:40 671,232 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll - 2008-04-23 04:16:28 102,912 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\occache.dll + 2008-06-23 16:57:40 102,912 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\occache.dll - 2008-04-23 04:16:28 44,544 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll + 2008-06-23 16:57:40 44,544 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll - 2008-04-23 04:16:28 105,984 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\url.dll + 2008-06-23 16:57:40 105,984 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\url.dll - 2008-04-23 04:16:29 1,159,680 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll + 2008-06-23 16:57:40 1,159,680 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll - 2008-04-23 04:16:29 233,472 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\webcheck.dll + 2008-06-23 16:57:41 233,472 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\webcheck.dll - 2008-04-23 04:16:29 826,368 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll + 2008-06-23 16:57:41 826,368 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll - 2008-06-20 17:41:10 148,992 ----a-w C:\WINDOWS\SYSTEM32\dnsapi.dll + 2008-06-20 17:36:11 147,968 ----a-w C:\WINDOWS\SYSTEM32\dnsapi.dll - 2005-09-20 15:00:54 1,302,332 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\ialmnt5.sys + 2005-07-19 22:34:22 1,049,180 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\ialmnt5.sys - 2008-04-23 04:16:28 347,136 ----a-w C:\WINDOWS\SYSTEM32\dxtmsft.dll + 2008-06-23 16:57:27 347,136 ----a-w C:\WINDOWS\SYSTEM32\dxtmsft.dll - 2008-04-23 04:16:28 214,528 ----a-w C:\WINDOWS\SYSTEM32\dxtrans.dll + 2008-06-23 16:57:27 214,528 ----a-w C:\WINDOWS\SYSTEM32\dxtrans.dll - 2008-04-23 04:16:28 133,120 ----a-w C:\WINDOWS\SYSTEM32\extmgr.dll + 2008-06-23 16:57:27 133,120 ----a-w C:\WINDOWS\SYSTEM32\extmgr.dll - 2005-09-20 14:31:12 73,728 ----a-w C:\WINDOWS\SYSTEM32\hccutils.dll + 2005-07-19 22:05:00 73,728 ----a-w C:\WINDOWS\SYSTEM32\hccutils.dll - 2005-09-20 14:32:24 77,824 ----a-w C:\WINDOWS\SYSTEM32\hkcmd.exe + 2005-07-19 22 12 77,824 ----a-w C:\WINDOWS\SYSTEM32\hkcmd.exe- 2005-09-20 14:59:56 900,218 ----a-w C:\WINDOWS\SYSTEM32\ialmdd5.dll + 2005-07-19 22:33:36 899,706 ----a-w C:\WINDOWS\SYSTEM32\ialmdd5.dll - 2005-09-20 14:52:22 213,274 ----a-w C:\WINDOWS\SYSTEM32\ialmdev5.dll + 2005-07-19 22:26:06 212,090 ----a-w C:\WINDOWS\SYSTEM32\ialmdev5.dll - 2005-09-20 14:52:32 118,395 ----a-w C:\WINDOWS\SYSTEM32\ialmdnt5.dll + 2005-07-19 22:26:18 116,859 ----a-w C:\WINDOWS\SYSTEM32\ialmdnt5.dll - 2005-09-20 14:52:36 49,152 -c--a-w C:\WINDOWS\SYSTEM32\ialmrem.dll + 2005-07-19 22:26:20 49,152 ----a-w C:\WINDOWS\SYSTEM32\ialmrem.dll - 2005-09-20 14:52:38 36,990 ----a-w C:\WINDOWS\SYSTEM32\ialmrnt5.dll + 2005-07-19 22:26:24 38,014 ----a-w C:\WINDOWS\SYSTEM32\ialmrnt5.dll - 2005-09-20 14:37:00 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuARA.dll + 2005-07-19 22:10:50 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuARA.dll - 2005-09-20 14:37:02 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuARB.dll + 2005-07-19 22:10:50 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuARB.dll - 2005-09-20 14:37:02 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuCHS.dll + 2005-07-19 22:10:50 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuCHS.dll - 2005-09-20 14:37:02 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuCHT.dll + 2005-07-19 22:10:50 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuCHT.dll - 2005-09-20 14:37:06 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuCSY.dll + 2005-07-19 22:10:56 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuCSY.dll - 2005-09-20 14:37:02 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuDAN.dll + 2005-07-19 22:10:50 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuDAN.dll - 2005-09-20 14:37:02 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuDEU.dll + 2005-07-19 22:10:50 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuDEU.dll - 2005-09-20 14:37:00 114,688 -c--a-w C:\WINDOWS\SYSTEM32\ialmudlg.exe + 2005-07-19 22:10:50 114,688 ----a-w C:\WINDOWS\SYSTEM32\ialmudlg.exe - 2005-09-20 14:37:06 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuELL.dll + 2005-07-19 22:10:56 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuELL.dll - 2005-09-20 14:37:02 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuENG.dll + 2005-07-19 22:10:52 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuENG.dll - 2005-09-20 14:37:02 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuESP.dll + 2005-07-19 22:10:52 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuESP.dll - 2005-09-20 14:37:02 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuFIN.dll + 2005-07-19 22:10:52 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuFIN.dll - 2005-09-20 14:37:04 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuFRA.dll + 2005-07-19 22:10:52 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuFRA.dll - 2005-09-20 14:37:04 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuFRC.dll + 2005-07-19 22:10:52 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuFRC.dll - 2005-09-20 14:37:04 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuHEB.dll + 2005-07-19 22:10:52 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuHEB.dll - 2005-09-20 14:37:06 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuHUN.dll + 2005-07-19 22:10:56 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuHUN.dll - 2005-09-20 14:37:04 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuITA.dll + 2005-07-19 22:10:52 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuITA.dll - 2005-09-20 14:37:04 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuJPN.dll + 2005-07-19 22:10:54 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuJPN.dll - 2005-09-20 14:37:04 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuKOR.dll + 2005-07-19 22:10:54 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuKOR.dll - 2005-09-20 14:37:04 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuNLD.dll + 2005-07-19 22:10:54 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuNLD.dll - 2005-09-20 14:37:04 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuNOR.dll + 2005-07-19 22:10:54 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuNOR.dll - 2005-09-20 14:37:04 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuPLK.dll + 2005-07-19 22:10:54 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuPLK.dll - 2005-09-20 14:37:06 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuPTB.dll + 2005-07-19 22:10:54 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuPTB.dll - 2005-09-20 14:37:06 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuPTG.dll + 2005-07-19 22:10:54 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuPTG.dll - 2005-09-20 14:37:06 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuRUS.dll + 2005-07-19 22:10:54 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuRUS.dll - 2005-09-20 14:37:06 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuSVE.dll + 2005-07-19 22:10:56 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuSVE.dll - 2005-09-20 14:37:06 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuTHA.dll + 2005-07-19 22:10:56 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuTHA.dll - 2005-09-20 14:37:06 40,960 -c--a-w C:\WINDOWS\SYSTEM32\ialmuTRK.dll + 2005-07-19 22:10:56 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuTRK.dll - 2008-04-23 04:16:28 63,488 ----a-w C:\WINDOWS\SYSTEM32\icardie.dll + 2008-06-23 16:57:28 63,488 ----a-w C:\WINDOWS\SYSTEM32\icardie.dll - 2008-04-22 07:39:58 70,656 ----a-w C:\WINDOWS\SYSTEM32\ie4uinit.exe + 2008-06-23 09:20:25 70,656 ----a-w C:\WINDOWS\SYSTEM32\ie4uinit.exe - 2008-04-23 04:16:28 153,088 ----a-w C:\WINDOWS\SYSTEM32\ieakeng.dll + 2008-06-23 16:57:29 153,088 ----a-w C:\WINDOWS\SYSTEM32\ieakeng.dll - 2008-04-23 04:16:28 230,400 ----a-w C:\WINDOWS\SYSTEM32\ieaksie.dll + 2008-06-23 16:57:29 230,400 ----a-w C:\WINDOWS\SYSTEM32\ieaksie.dll - 2008-04-20 05:07:51 161,792 ----a-w C:\WINDOWS\SYSTEM32\ieakui.dll + 2008-06-21 05:23:54 161,792 ----a-w C:\WINDOWS\SYSTEM32\ieakui.dll - 2008-04-23 04:16:28 383,488 ----a-w C:\WINDOWS\SYSTEM32\ieapfltr.dll + 2008-06-23 16:57:29 383,488 ----a-w C:\WINDOWS\SYSTEM32\ieapfltr.dll - 2008-04-23 04:16:28 384,512 ----a-w C:\WINDOWS\SYSTEM32\iedkcs32.dll + 2008-06-23 16:57:29 384,512 ----a-w C:\WINDOWS\SYSTEM32\iedkcs32.dll - 2008-04-23 04:16:28 6,066,176 ----a-w C:\WINDOWS\SYSTEM32\ieframe.dll + 2008-06-23 16:57:33 6,066,176 ----a-w C:\WINDOWS\SYSTEM32\ieframe.dll - 2008-04-23 04:16:28 44,544 ----a-w C:\WINDOWS\SYSTEM32\iernonce.dll + 2008-06-23 16:57:33 44,544 ----a-w C:\WINDOWS\SYSTEM32\iernonce.dll - 2008-04-23 04:16:28 267,776 ----a-w C:\WINDOWS\SYSTEM32\iertutil.dll + 2008-06-23 16:57:34 267,776 ----a-w C:\WINDOWS\SYSTEM32\iertutil.dll - 2008-04-22 07:39:58 13,824 ----a-w C:\WINDOWS\SYSTEM32\ieudinit.exe + 2008-06-23 09:20:26 13,824 ----a-w C:\WINDOWS\SYSTEM32\ieudinit.exe - 2005-09-20 14:35:02 446,464 -c--a-w C:\WINDOWS\SYSTEM32\igfxcfg.exe + 2005-07-19 22:08:48 438,272 ----a-w C:\WINDOWS\SYSTEM32\igfxcfg.exe - 2005-09-20 14:31:28 135,168 ----a-w C:\WINDOWS\SYSTEM32\igfxdev.dll + 2005-07-19 22:05:16 135,168 ----a-w C:\WINDOWS\SYSTEM32\igfxdev.dll - 2005-09-20 14:32:30 86,016 -c--a-w C:\WINDOWS\SYSTEM32\igfxdo.dll + 2005-07-19 22 18 86,016 ----a-w C:\WINDOWS\SYSTEM32\igfxdo.dll- 2005-09-20 14:36:14 40,960 -c--a-w C:\WINDOWS\SYSTEM32\igfxexps.dll + 2005-07-19 22:10:00 36,864 ----a-w C:\WINDOWS\SYSTEM32\igfxexps.dll - 2005-09-20 14:36:14 94,208 -c--a-w C:\WINDOWS\SYSTEM32\igfxext.exe + 2005-07-19 22:09:58 98,304 ----a-w C:\WINDOWS\SYSTEM32\igfxext.exe - 2005-09-20 14:36:20 114,688 ----a-w C:\WINDOWS\SYSTEM32\igfxpers.exe + 2005-07-19 22:10:06 114,688 ----a-w C:\WINDOWS\SYSTEM32\igfxpers.exe - 2005-09-20 14:35:24 147,456 ----a-w C:\WINDOWS\SYSTEM32\igfxpph.dll + 2005-07-19 22:09:10 147,456 ----a-w C:\WINDOWS\SYSTEM32\igfxpph.dll - 2005-09-20 14:35:28 1,503,232 ----a-w C:\WINDOWS\SYSTEM32\igfxress.dll + 2005-07-19 22:09:14 1,503,232 ----a-w C:\WINDOWS\SYSTEM32\igfxress.dll - 2005-09-20 14:32:16 57,344 ----a-w C:\WINDOWS\SYSTEM32\igfxsrvc.dll + 2005-07-19 22 04 57,344 ----a-w C:\WINDOWS\SYSTEM32\igfxsrvc.dll- 2005-09-20 14:32:16 159,744 ----a-w C:\WINDOWS\SYSTEM32\igfxsrvc.exe + 2005-07-19 22 04 159,744 ----a-w C:\WINDOWS\SYSTEM32\igfxsrvc.exe- 2005-09-20 14:35:40 94,208 ----a-w C:\WINDOWS\SYSTEM32\igfxtray.exe + 2005-07-19 22:09:26 94,208 ----a-w C:\WINDOWS\SYSTEM32\igfxtray.exe - 2005-09-20 14:36:08 114,688 -c--a-w C:\WINDOWS\SYSTEM32\igfxzoom.exe + 2005-07-19 22:09:54 114,688 ----a-w C:\WINDOWS\SYSTEM32\igfxzoom.exe - 2005-09-20 14:44:50 524,288 -c--a-w C:\WINDOWS\SYSTEM32\igldev32.dll + 2005-07-19 22:18:38 524,288 ----a-w C:\WINDOWS\SYSTEM32\igldev32.dll - 2005-09-20 14:43:00 2,310,144 -c--a-w C:\WINDOWS\SYSTEM32\iglicd32.dll + 2005-07-19 22:16:46 2,310,144 ----a-w C:\WINDOWS\SYSTEM32\iglicd32.dll - 2007-08-21 06:15:44 683,520 ----a-w C:\WINDOWS\SYSTEM32\inetcomm.dll + 2008-04-11 18:50:43 683,520 ----a-w C:\WINDOWS\SYSTEM32\inetcomm.dll - 2008-04-23 04:16:28 27,648 ----a-w C:\WINDOWS\SYSTEM32\jsproxy.dll + 2008-06-23 16:57:35 27,648 ----a-w C:\WINDOWS\SYSTEM32\jsproxy.dll - 2008-06-25 16:15:46 17,972,344 -c--a-w C:\WINDOWS\SYSTEM32\MRT.exe + 2008-08-05 18:11:01 15,888,504 -c--a-w C:\WINDOWS\SYSTEM32\MRT.exe - 2004-07-15 05:34:06 16,896 -c--a-w C:\WINDOWS\SYSTEM32\MSCORIER.DLL + 2005-09-23 11:28:52 150,016 ----a-w C:\WINDOWS\SYSTEM32\mscorier.dll - 2003-02-21 01:09:14 106,496 -c--a-w C:\WINDOWS\SYSTEM32\MSCORIES.DLL + 2005-09-23 11:28:52 74,240 ----a-w C:\WINDOWS\SYSTEM32\mscories.dll - 2008-04-23 04:16:28 459,264 ----a-w C:\WINDOWS\SYSTEM32\msfeeds.dll + 2008-06-23 16:57:36 459,264 ----a-w C:\WINDOWS\SYSTEM32\msfeeds.dll - 2008-04-23 04:16:28 52,224 ----a-w C:\WINDOWS\SYSTEM32\msfeedsbs.dll + 2008-06-23 16:57:36 52,224 ----a-w C:\WINDOWS\SYSTEM32\msfeedsbs.dll - 2008-04-24 02:16:30 3,591,680 ----a-w C:\WINDOWS\SYSTEM32\mshtml.dll + 2008-06-24 14:57:40 3,592,192 ----a-w C:\WINDOWS\SYSTEM32\mshtml.dll - 2008-04-23 04:16:28 478,208 ----a-w C:\WINDOWS\SYSTEM32\mshtmled.dll + 2008-06-23 16:57:39 477,696 ----a-w C:\WINDOWS\SYSTEM32\mshtmled.dll - 2008-04-23 04:16:28 193,024 ----a-w C:\WINDOWS\SYSTEM32\msrating.dll + 2008-06-23 16:57:39 193,024 ----a-w C:\WINDOWS\SYSTEM32\msrating.dll - 2008-04-23 04:16:28 671,232 ----a-w C:\WINDOWS\SYSTEM32\mstime.dll + 2008-06-23 16:57:40 671,232 ----a-w C:\WINDOWS\SYSTEM32\mstime.dll - 2008-04-23 04:16:28 102,912 ----a-w C:\WINDOWS\SYSTEM32\occache.dll + 2008-06-23 16:57:40 102,912 ----a-w C:\WINDOWS\SYSTEM32\occache.dll - 2008-07-19 16:21:52 54,396 ----a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT + 2008-08-13 22:54:55 63,976 ----a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT - 2008-07-19 16:21:52 384,904 ----a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT + 2008-08-13 22:54:55 405,618 ----a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT - 2008-04-23 04:16:28 44,544 ----a-w C:\WINDOWS\SYSTEM32\pngfilt.dll + 2008-06-23 16:57:40 44,544 ----a-w C:\WINDOWS\SYSTEM32\pngfilt.dll + 2005-09-20 14:31:12 73,728 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\hccutils.dll + 2005-09-20 14:32:24 77,824 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\hkcmd.exe + 2005-09-20 14:52:34 61,440 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\iAlmCoIn.dll + 2005-09-20 14:59:56 900,218 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmdd5.dll + 2005-09-20 14:52:22 213,274 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmdev5.dll + 2005-09-20 14:52:32 118,395 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmdnt5.dll + 2005-09-20 15:00:54 1,302,332 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmnt5.sys + 2005-09-20 14:52:36 49,152 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmrem.dll + 2005-09-20 14:52:38 36,990 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmrnt5.dll + 2005-09-20 14:37:00 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuARA.dll + 2005-09-20 14:37:02 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuARB.dll + 2005-09-20 14:37:02 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuCHS.dll + 2005-09-20 14:37:02 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuCHT.dll + 2005-09-20 14:37:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuCSY.dll + 2005-09-20 14:37:02 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuDAN.dll + 2005-09-20 14:37:02 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuDEU.dll + 2005-09-20 14:37:00 114,688 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmudlg.exe + 2005-09-20 14:37:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuELL.dll + 2005-09-20 14:37:02 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuENG.dll + 2005-09-20 14:37:02 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuESP.dll + 2005-09-20 14:37:02 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuFIN.dll + 2005-09-20 14:37:04 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuFRA.dll + 2005-09-20 14:37:04 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuFRC.dll + 2005-09-20 14:37:04 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuHEB.dll + 2005-09-20 14:37:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuHUN.dll + 2005-09-20 14:37:04 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuITA.dll + 2005-09-20 14:37:04 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuJPN.dll + 2005-09-20 14:37:04 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuKOR.dll + 2005-09-20 14:37:04 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuNLD.dll + 2005-09-20 14:37:04 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuNOR.dll + 2005-09-20 14:37:04 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuPLK.dll + 2005-09-20 14:37:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuPTB.dll + 2005-09-20 14:37:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuPTG.dll + 2005-09-20 14:37:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuRUS.dll + 2005-09-20 14:37:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuSVE.dll + 2005-09-20 14:37:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuTHA.dll + 2005-09-20 14:37:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\ialmuTRK.dll + 2005-09-20 14:35:02 446,464 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\igfxcfg.exe + 2005-09-20 14:31:28 135,168 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\igfxdev.dll + 2005-09-20 14:32:30 86,016 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\igfxdo.dll + 2005-09-20 14:36:14 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\igfxexps.dll + 2005-09-20 14:36:14 94,208 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\igfxext.exe + 2005-09-20 14:36:20 114,688 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\igfxpers.exe + 2005-09-20 14:35:24 147,456 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\igfxpph.dll + 2005-09-20 14:35:28 1,503,232 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\igfxress.dll + 2005-09-20 14:32:16 57,344 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\igfxsrvc.dll + 2005-09-20 14:32:16 159,744 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\igfxsrvc.exe + 2005-09-20 14:35:40 94,208 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\igfxtray.exe + 2005-09-20 14:36:08 114,688 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\igfxzoom.exe + 2005-09-20 14:44:50 524,288 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\igldev32.dll + 2005-09-20 14:43:00 2,310,144 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\iglicd32.dll - 2007-11-13 11:31:11 60,416 ----a-w C:\WINDOWS\SYSTEM32\tzchange.exe + 2008-07-14 11:09:18 62,976 ----a-w C:\WINDOWS\SYSTEM32\tzchange.exe - 2008-04-23 04:16:28 105,984 ----a-w C:\WINDOWS\SYSTEM32\url.dll + 2008-06-23 16:57:40 105,984 ----a-w C:\WINDOWS\SYSTEM32\url.dll - 2008-04-23 04:16:29 1,159,680 ----a-w C:\WINDOWS\SYSTEM32\urlmon.dll + 2008-06-23 16:57:40 1,159,680 ----a-w C:\WINDOWS\SYSTEM32\urlmon.dll - 2008-04-23 04:16:29 233,472 ----a-w C:\WINDOWS\SYSTEM32\webcheck.dll + 2008-06-23 16:57:41 233,472 ----a-w C:\WINDOWS\SYSTEM32\webcheck.dll - 2008-04-23 04:16:29 826,368 ----a-w C:\WINDOWS\SYSTEM32\wininet.dll + 2008-06-23 16:57:41 826,368 ----a-w C:\WINDOWS\SYSTEM32\wininet.dll + 2005-09-23 11:29:16 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll + 2005-09-23 11:29:16 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll + 2005-09-23 11:29:16 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll + 2008-08-13 22:49:43 258,048 ----a-w C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll + 2008-08-13 22:49:44 114,176 ----a-w C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360] "BySoft FreeRAM"="C:\Program Files\BySoft FreeRAM\FreeRAM.exe" [2007-09-28 08:32 318976] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 17:42 1404928] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 03:05 127035] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 09:23 202544] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-04-02 11:32 98304] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-07-19 18:09 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-07-19 18:06 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-07-19 18:10 114688] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2004-08-04 07:00 53760 C:\WINDOWS\SYSTEM32\NARRATOR.EXE] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-04-02 11:18:45 24576] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport] --a------ 2007-03-15 11:09 460784 C:\Program Files\DellSupport\DSAgnt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter] --a------ 2007-11-15 09:23 202544 C:\Program Files\Dell Support Center\bin\sprtcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher] --a------ 2005-01-27 03:02 86016 C:\Program Files\Dell\Media Experience\DMXLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate] --a------ 2007-11-15 09:24 16384 C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] --------- 2004-10-12 18:54 57344 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\medicsp2] --a------ 2007-03-07 11:53 198184 C:\Program Files\twc\medicsp2\bin\sprtcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2005-04-02 11:32 98304 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-02-22 04:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2005-11-29 14:51 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24] *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder 2005-04-10 C:\WINDOWS\Tasks\ISP signup reminder 1.job - C:\WINDOWS\system32\OOBE\OOBEBALN.EXE [2004-08-04 07:00] 2008-08-13 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (JTSPC-Josh Thompson).job - c:\program files\mcafee.com\vso\mcmnhdlr.exe [] 2008-08-13 C:\WINDOWS\Tasks\RegSweep Scheduled Scan.job - C:\Program Files\RegSweep\RegSweep.exe [] 2008-08-13 C:\WINDOWS\Tasks\RegSweep Scheduled Scan.job - C:\Program Files\RegSweep [] . - - - - ORPHANS REMOVED - - - - HKCU-Run-DriverUpdaterPro - C:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-14 13:51:19 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-14 13:55:29 ComboFix-quarantined-files.txt 2008-08-14 17:54:53 ComboFix2.txt 2008-08-13 18:30:13 Pre-Run: 22,643,613,696 bytes free Post-Run: 22,690,525,184 bytes free 784 --- E O F --- 2008-08-14 07:04:41 The browser seems to be working fine. I can get into everything that I was not able to get into the other day and PDF files are loading just fine now. I tried to do the Panda Activescan 3 times and each time I do it, it will scan all the way through and then stops at this file and will not budge, instead it freezes. The file name its stuck on is: C:\WINDOWS\VFind.exe |
|
|
|
|
08-14-2008, 07:29 PM
|
#7 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,798
OS: WinXP and Vista
|
Re: Hijack This Log
See if this scanner will complete for you:
Using Internet Explorer, visit http://www.kaspersky.com/kos/eng/par...avwebscan.html Click Accept, when prompted to download and install the program files and database of malware definitions.
**Note** To optimize scanning time and produce a more sensible report for review:
|
|
|
|
|
08-15-2008, 08:03 PM
|
#9 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,798
OS: WinXP and Vista
|
Re: Hijack This Log
Hi Josh,
Panda is only reporting backups created during the course of this fix. We'll take care of that now. Your logs are clean. If there aren't any more problems, please continue with these final instructions and helpful links: The following procedure will clear out the backups and quarantines created by the fix. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point. Click Start > Run and copy/paste, or type the following bolded text into the Run box and click OK: ComboFix /u -------------------------------------------------------------------- To help protect your computer in the future I recommend that you get the following free programs if you do not already have them: McAfee Site Advisor--free version. The folks there check out websites and based on their findings, rate it as Safe, Unknown, Caution, or Bad. SpywareBlaster 4.0 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items.
IESpyAD Zoned Out to block access to malicious websites so you cannot be redirected to them from an infected site or email. This severely impairs attempts to infect your system as it basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. Update, and scan with your onboard Anti Malware and Anti Virus programs regularly. Without regular updates you will not be protected when new malicious programs are released. In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles: PC Safety and Security--What Do I Need? Think Prevention **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. ----------------------------------------------------- Follow the list above and the potential for infection will reduce dramatically. **Kindly respond one more time and let me know if we may consider this thread resolved. |
|
|
|
| Thread Tools | |
|
|
