Please help with http://www.updatesystempage.com/

chomedeylaval · 01-07-2006, 08:07 PM

I have downloaded ewido , adaware, ieprosetup, but nothing seems to work.]

Here is a hicjackthis scan. Any help would be appreciated

Thanx,Nick

Logfile of HijackThis v1.99.1
Scan saved at 11:02:57 PM, on 07/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvctrl.exe
C:\WINDOWS\system32\mssearchnet.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Common Files\soft602\pdfSaver.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\dcfssvc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ZipCentral\ZCentral.exe
C:\DOCUME~1\Nick\LOCALS~1\Temp\_ZCTmp.Dir\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = \SOFTWARE\Microsoft\Internet Explorer\Search
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {27150f81-0877-42e9-af13-55e5a3439a26} - C:\WINDOWS\system32\hp7DAB.tmp
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [602PC SUITE PDF Saver] "C:\Program Files\Common Files\soft602\pdfSaver.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh309190.dll/201
O14 - IERESET.INF: START_PAGE_URL=http://www.futureshop.ca
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/CA/install.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe
O16 - DPF: {525A15D0-4938-11D4-94C7-0050DA20189B} - http://www.easports.com/downloads/ga...y/iesnoopy.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v6.cab
O16 - DPF: {E62A47D8-74B1-4A93-963A-E5E43B7CC5C2} - http://www.zuvio.com/opnste/UCSearch.CAB
O18 - Protocol: start - (no CLSID) - (no file)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

sUBs · 01-08-2006, 01:26 AM

Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted.

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

* * * * * * ADDITIONAL DOWNLOADS * * * * * * * * * * * * * *

Download & install - CleanUp.exe (not recommended for WinXP64)

Download & extract it to it's own folder - smitRem.exe

You will need to update Ewido to the latest definition files.
Launch Ewido & click Update from the left pane
Then click on Start Update.
If you are having problems with the updater, you can use this link to manually update Ewido
When you have finished updating, EXIT Ewido.

If you have not already installed Ad-Aware SE 1.06, download and update aawsepersonal.exe

'UNPLUG'/DISCONNECT your computer from the Internet when you have finished downlaoding.
It is IMPORTANT that you don't miss a step & perform everything in the correct order.

Before proceeding, please disable EwidoGuard as it may hinder the removal of some entries. Keep it disabled till I tell you it's clean. To disable Ewido's real-time scanner:

Double click on the Ewido icon in system try
Click on the status button
Select Remove Guard

* * * * * * FIXING ENTRIES WITH HIJACKTHIS * * * * * * * * * *

HijackThis is able to create backups whenever if fixes any entry. These are stored in a subfolder called backups. As such, we advise against placing the program in any temporary folders. Please create a new directory, C:\Program Files\HijackThis\, and re-locate the program & it's associate files there.

Do a HijackThis scan & place a check next to these items and select "Fix checked":

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = \SOFTWARE\Microsoft\Internet Explorer\Search
O2 - BHO: (no name) - {27150f81-0877-42e9-af13-55e5a3439a26} - C:\WINDOWS\system32\hp7DAB.tmp
O16 - DPF: {E62A47D8-74B1-4A93-963A-E5E43B7CC5C2} - http://www.zuvio.com/opnste/UCSearch.CAB
O18 - Protocol: start - (no CLSID) - (no file)

* * * * * * RESTART WINDOWS IN SAFE MODE * * * * * * * * * *

1. Restart your computer
2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3. Instead of Windows loading as normal, a menu should appear
4. Select the option to run Windows in Safe Mode.

* * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * *

Run Cleanup! using the following configuration:

1. Click Options...
2. Set the slider initially to Standard CleanUp!
3. Uncheck the following:

Delete Newsgroup cache
Delete Newsgroup Subscriptions
Scan local drives for temporary files

4. Click OK
5. Press the CleanUp! button to start the program.
6. Do NOT reboot/logoff if prompted.

* CleanUp! will not create any backups!!

* * * * * * RUNNING ADDITIONAL SCANNERS * * * * * * * * * * *

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

* * * *

Next go to Control Panel click Display>Desktop>Customize Desktop>Website
Under the 'Web pages' box, Uncheck everything present.

* * * *

Open Ad-aware and close ALL other windows.

1. Click on the ‘Gear’ icon (second from the left at the top of the window) to access the preferences/settings window:

In the General window make sure the following are selected in green:
- Automatically save log-file
- Automatically quarantine objects prior to removal
- Safe Mode (always request confirmation)
- Prompt to update outdated definitions - set the number of days = 7
Click on the Scanning button on the left and select in green:
- Scan Within Archives
- Under Select drives & folders to scan:
  - choose all hard drives
- Scan Active Processes
- Scan Registry
- Deep Scan Registry
- Scan my IE favorites for banned URL’s
- Scan my Hosts file
Click on the Advanced button on the left and select in green:
- Move deleted files to recycle bin
- include addtional object information
- DeSelect - include negligible objects information
- Don't log streams smaller than 0 bytes
- Don't log ADS with the following names: CA_INOCULATEIT
Click the Tweak button:
1. Under Scanning Engine:
  - Unload recognized processes during scanning
  - Ignore spanned files when scanning cab archives
  - Scan registry for all users instead of current user only
2. Under Cleaning Engine:
  - Let Windows remove files in use at next reboot
3. Under Log Files:
  - Include basic Ad-aware SE settings in logfile
  - Include additional Ad-aware SE settings in logfile
  - Include computer & username in logfile
  - Please DeSelect: Include Module list in logfile

2. Click on Proceed to save the settings.
3. Click Start
4. Choose - Perform Full System Scan
5. DeSelect "Search for negligible risk entries", as negligible risk entries (MRU's) are not considered to be a threat.
6. Click Next and Ad-Aware SE will scan your hard drive(s) with the options you have selected and clean automatically.
7. If Ad-Aware SE finds bad entries, you will receive a list of what it found in the window
8. Right-click on the list and choose Select All
9. Click Next to finish removing the items that were found

* * * * *

Run Ewido with it's updated definitions:(...it's important that all windows must be closed)

Click Scanner
Click Complete System Scan to begin scanning.
Click OK when prompted to clean files

With the first file it prompts to clean, select the option:

"Perform action on all infections"
.Choose clean and click OK.

Once finished, click the Save report button & save the report to your desktop

** Ewido scan would require at least an hour. I suggest that you go grab a cup of coffee & do something else while you wait for it to complete.

* * * * * * REBOOT TO NORMAL MODE * * * * * * * * * * * * * *

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

* * * * * * CHECK LIST * * * * * * * * * * * * * * * * * * * * *

In your next post, please include fresh copies of:

HiJackThis log

Online scan

Smitfiles.txt

Ewido's log

Let us know if any problems persist.

chomedeylaval · 01-08-2006, 12:07 PM

Hi,

First of all I would like to thank you for the time you took to help me out.
It is highly appreciated. God bless you.

Here is the hijackthis file.

Logfile of HijackThis v1.99.1
Scan saved at 2:54:29 PM, on 08/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\dcfssvc.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\soft602\pdfSaver.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ZipCentral\ZCentral.exe
C:\DOCUME~1\Nick\LOCALS~1\Temp\_ZCTmp.Dir\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [602PC SUITE PDF Saver] "C:\Program Files\Common Files\soft602\pdfSaver.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE"
O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh309190.dll/201
O14 - IERESET.INF: START_PAGE_URL=http://www.futureshop.ca
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/CA/install.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe
O16 - DPF: {525A15D0-4938-11D4-94C7-0050DA20189B} - http://www.easports.com/downloads/ga...y/iesnoopy.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v6.cab
O18 - Protocol: start - (no CLSID) - (no file)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

Here is the Online Scan

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Sunday, January 08, 2006 14:51:29
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 8/01/2006
Kaspersky Anti-Virus database records: 169924
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 50028
Number of viruses found: 1
Number of infected objects: 2
Number of suspicious objects: 0
Duration of the scan process: 2292 sec

Infected Object Name - Virus Name
C:\WINDOWS\system32\InstaFinder_inst245.exe/stream Infected: not-a-virus:AdWare.Win32.InstaFinder.a
C:\WINDOWS\system32\InstaFinder_inst245.exe Infected: not-a-virus:AdWare.Win32.InstaFinder.a

Scan process completed.

chomedeylaval · 01-08-2006, 12:09 PM

The smitfiles text
Volume in drive C is NMC
Volume Serial Number is 3226-0BEE

Directory of C:\WINDOWS\system32

08/01/2006 12:01 AM 5,124 ncompat.tlb
07/01/2006 11:39 PM 5,632 msvol.tlb
07/01/2006 11:39 PM 10,034 __delete_on_reboot__hp7752.tmp
07/01/2006 10:55 PM 1,158 wpa.dbl
07/01/2006 09:49 PM 0 asfiles.txt
07/01/2006 09:47 PM 1,406 Help.ico
07/01/2006 09:47 PM 2,550 Uninstall.ico
06/01/2006 10:35 PM 311,912 perfh009.dat
06/01/2006 10:35 PM 40,108 perfc009.dat
06/01/2006 10:35 PM 355,944 PerfStringBackup.INI
06/01/2006 10:27 PM 90 spupdwxp.log
06/01/2006 10:26 PM 134,072 FNTCACHE.DAT
06/01/2006 09:08 AM 15,756 nvctrl.exe
28/12/2005 09:54 PM 280,064 gdi32.dll
25/12/2005 04:04 PM 40,514 InstaFinder_inst245.exe
07/12/2005 01:38 PM 2,714,976 MRT.exe
30/11/2005 10:59 PM 1,492,480 shdocvw.dll
23/11/2005 08:06 PM 3,015,680 mshtml.dll
23/11/2005 08:06 PM 1,022,464 browseui.dll
10/11/2005 02:34 PM 1,570,489 sisgl.dll
10/11/2005 02:28 PM 28,672 SiSPInst.dll
10/11/2005 01:54 PM 1,771,008 sisgrv.dll
10/11/2005 03:31 AM 49,152 sis650.bin
10/11/2005 03:31 AM 49,152 sis740.bin
04/11/2005 10:16 PM 609,280 urlmon.dll
04/11/2005 10:16 PM 1,054,208 danim.dll
04/11/2005 04:27 PM 534,280 LegitCheckControl.DLL
20/10/2005 10:39 PM 39,424 pngfilt.dll
20/10/2005 10:39 PM 448,512 mshtmled.dll
20/10/2005 10:39 PM 530,944 mstime.dll
20/10/2005 10:39 PM 658,432 wininet.dll
20/10/2005 10:39 PM 146,432 msrating.dll
20/10/2005 10:39 PM 473,600 shlwapi.dll
20/10/2005 10:39 PM 205,312 dxtrans.dll
20/10/2005 10:39 PM 55,808 extmgr.dll
20/10/2005 10:39 PM 96,256 inseng.dll
20/10/2005 10:39 PM 251,392 iepeers.dll
20/10/2005 10:39 PM 151,040 cdfview.dll
20/10/2005 05:20 PM 1,082,368 esent.dll
16/10/2005 09:21 AM 6 config.txt
12/10/2005 06:12 PM 14,048 spmsg.dll
05/10/2005 07:06 PM 1,839,488 win32k.sys
03/10/2005 07:01 AM 0 ok.txt
22/09/2005 10:05 PM 8,450,560 shell32.dll
14/09/2005 02:17 PM 462,848 px.dll
14/09/2005 02:17 PM 143,360 pxmas.dll
14/09/2005 02:17 PM 319,488 pxdrv.dll
14/09/2005 02:17 PM 28,672 vxblock.dll
14/09/2005 02:17 PM 53,248 pxhpinst.exe
14/09/2005 02:17 PM 286,720 pxwave.dll
09/09/2005 08:53 PM 2,067,968 cdosys.dll
31/08/2005 08:41 PM 291,840 winsrv.dll
31/08/2005 08:41 PM 19,968 linkinfo.dll
29/08/2005 10:54 PM 1,287,168 quartz.dll
22/08/2005 10:35 PM 123,392 umpnpmgr.dll
22/08/2005 01:29 PM 197,632 netman.dll
09/08/2005 06:13 PM 831,488 libeay32.dll
09/08/2005 06:13 PM 159,744 ssleay32.dll
09/08/2005 06:12 PM 3,596,288 qt-dx331.dll
29/07/2005 08:07 PM 73,728 asuninst.exe
25/07/2005 11:39 PM 11,776 xolehlp.dll
25/07/2005 11:39 PM 37,888 olecnv32.dll
25/07/2005 11:39 PM 397,824 rpcss.dll
25/07/2005 11:39 PM 101,376 txflog.dll
25/07/2005 11:39 PM 161,280 msdtcuiu.dll
25/07/2005 11:39 PM 945,152 msdtctm.dll
25/07/2005 11:39 PM 1,285,120 ole32.dll
25/07/2005 11:39 PM 91,136 mtxoci.dll
25/07/2005 11:39 PM 66,560 mtxclu.dll
25/07/2005 11:39 PM 74,752 olecli32.dll
25/07/2005 11:39 PM 243,200 es.dll
25/07/2005 11:39 PM 425,472 msdtcprx.dll
25/07/2005 11:39 PM 540,160 comuid.dll
25/07/2005 11:39 PM 498,688 clbcatq.dll
25/07/2005 11:39 PM 60,416 colbact.dll
25/07/2005 11:39 PM 1,267,200 comsvcs.dll
25/07/2005 11:39 PM 97,792 comrepl.dll
25/07/2005 11:39 PM 110,080 clbcatex.dll
25/07/2005 11:39 PM 625,152 catsrvut.dll
25/07/2005 11:39 PM 225,792 catsrv.dll
12/07/2005 06:04 PM 23,304 GWFSPidGen.dll
08/07/2005 11:27 AM 249,344 tapisrv.dll
08/07/2005 11:27 AM 76,800 remotesp.tsp
28/06/2005 08:46 PM 74,240 mscms.dll
28/06/2005 08:46 PM 254,976 icm32.dll
20/06/2005 09:57 AM 110,592 uci32100.dll
16/06/2005 08:59 AM 23,392 nscompat.tlb
16/06/2005 08:59 AM 16,832 amcompat.tlb
15/06/2005 12:49 PM 295,936 kerberos.dll
10/06/2005 06:53 PM 57,856 spoolsv.exe
26/05/2005 10:04 PM 155,136 itircl.dll
26/05/2005 10:04 PM 137,216 itss.dll
26/05/2005 10:04 PM 41,472 hhsetup.dll
26/05/2005 10:04 PM 546,304 hhctrl.ocx
26/05/2005 11:01 AM 49,152 SiSPower.dll
26/05/2005 11:00 AM 258,048 SiSParse.dll
26/05/2005 11:00 AM 184,320 SiSInst.dll
26/05/2005 10:54 AM 49,152 SiSBase.dll
26/05/2005 04:19 AM 173,536 wuweb.dll
26/05/2005 04:19 AM 178,408 muweb.dll
26/05/2005 04:16 AM 127,256 wucltui.dll
26/05/2005 04:16 AM 194,328 wuaueng1.dll
26/05/2005 04:16 AM 1,343,768 wuaueng.dll
26/05/2005 04:16 AM 174,360 wuaucpl.cpl
26/05/2005 04:16 AM 172,312 wuauclt1.exe
26/05/2005 04:16 AM 18,200 wups2.dll
26/05/2005 04:16 AM 465,176 wuapi.dll
26/05/2005 04:16 AM 124,184 wuauclt.exe
26/05/2005 04:16 AM 41,240 wups.dll
26/05/2005 04:16 AM 198,424 iuengine.dll
26/05/2005 04:16 AM 75,544 cdm.dll
26/05/2005 04:16 AM 127,208 mucltui.dll
16/05/2005 08:26 PM 17,920 xpsp3res.dll
10/05/2005 07:45 PM 75,776 telnet.exe
05/05/2005 04:23 PM 679,424 inetcomm.dll
04/05/2005 02:45 PM 2,890,240 msi.dll
09/04/2005 06:51 PM 2,930 jupdate-1.5.0_02-b09.log
08/04/2005 08:33 PM 2,826 jupdate-1.5.0_01-b08.log
21/03/2005 03:00 PM 78,848 msiexec.exe
21/03/2005 03:00 PM 884,736 msimsg.dll
21/03/2005 03:00 PM 271,360 msihnd.dll
21/03/2005 03:00 PM 15,360 msisip.dll
11/03/2005 11:22 AM 90,112 DXFLib.dll
10/03/2005 10:48 AM 269,312 devil.dll
04/03/2005 03:36 AM 127,078 javaws.exe
04/03/2005 03:36 AM 49,265 jpicpl32.cpl
04/03/2005 02:07 AM 49,250 javaw.exe
04/03/2005 02:06 AM 49,248 java.exe
02/03/2005 02:09 PM 56,832 authz.dll
02/03/2005 02:09 PM 577,024 user32.dll
01/03/2005 08:59 PM 2,179,328 ntoskrnl.exe
01/03/2005 08:34 PM 2,056,832 ntkrnlpa.exe
24/02/2005 01:21 PM 22,752 spupdsvc.exe
15/02/2005 09:37 PM 8,415,188 PAV.SIG
28/01/2005 01:44 PM 484,352 Audiodev.dll
28/01/2005 01:44 PM 25,088 MsPMSNSv.dll
28/01/2005 01:44 PM 1,512,448 WMVADVE.DLL
28/01/2005 01:44 PM 135,168 wmpasf.dll
28/01/2005 01:44 PM 221,184 qasf.dll
28/01/2005 01:44 PM 173,568 MsPMSP.dll
28/01/2005 01:44 PM 20,480 wmpui.dll
28/01/2005 01:44 PM 1,218,808 wmvadvd.dll
28/01/2005 01:44 PM 38,912 wdfmgr.exe
28/01/2005 01:44 PM 28,160 WMDMLOG.dll
28/01/2005 01:44 PM 1,027,072 wmnetmgr.dll
28/01/2005 01:44 PM 5,525,504 wmp.dll
28/01/2005 01:44 PM 20,480 wmpcd.dll
28/01/2005 01:44 PM 895,736 wmvdmod.dll
28/01/2005 01:44 PM 315,904 MSWMDM.dll
28/01/2005 01:44 PM 1,119,744 wmsdmoe2.dll
28/01/2005 01:44 PM 335,872 WMDRMdev.dll
28/01/2005 01:44 PM 38,912 wpd_ci.dll
28/01/2005 01:44 PM 360,448 l3codecp.acm
28/01/2005 01:44 PM 413,944 wmspdmod.dll
28/01/2005 01:44 PM 175,104 wmpsrcwp.dll
28/01/2005 01:44 PM 774,904 wmsdmod.dll
28/01/2005 01:44 PM 396,528 wmadmod.dll
28/01/2005 01:44 PM 150,016 wmidx.dll
28/01/2005 01:44 PM 61,952 wpdconns.dll
28/01/2005 01:44 PM 940,544 wmspdmoe.dll
28/01/2005 01:44 PM 294,912 blackbox.dll
28/01/2005 01:44 PM 15,872 wdfapi.dll
28/01/2005 01:44 PM 1,003,008 wmvdmoe2.dll
28/01/2005 01:44 PM 86,016 wmpshell.dll
28/01/2005 01:44 PM 20,480 wmpcore.dll
28/01/2005 01:44 PM 502,272 drmv2clt.dll
28/01/2005 01:44 PM 1,594,880 wmpencen.dll
28/01/2005 01:44 PM 282,624 wmpdxm.dll
28/01/2005 01:44 PM 3,371,008 wmploc.dll
28/01/2005 01:44 PM 96,768 drmstor.dll
28/01/2005 01:44 PM 2,370,296 wmvcore.dll
28/01/2005 01:44 PM 6,656 laprxy.dll
28/01/2005 01:44 PM 290,816 WMDRMNet.dll
28/01/2005 01:44 PM 20,480 wmp.ocx
28/01/2005 01:44 PM 114,176 wpdmtp.dll
28/01/2005 01:44 PM 8,192 asferror.dll
28/01/2005 01:44 PM 258,296 drmclien.dll
28/01/2005 01:44 PM 716,288 wmadmoe.dll
28/01/2005 01:44 PM 164,864 cewmdm.dll
28/01/2005 01:44 PM 47,104 uwdf.exe
28/01/2005 01:44 PM 189,440 wmerror.dll
28/01/2005 01:44 PM 33,792 WMDMPS.dll
28/01/2005 01:44 PM 142,336 msnetobj.dll
28/01/2005 01:44 PM 10,752 wpdtrace.dll
28/01/2005 01:44 PM 331,776 wpdmtpdr.dll
28/01/2005 01:44 PM 66,560 wpdmtpus.dll
28/01/2005 01:44 PM 96,768 logagent.exe
28/01/2005 01:44 PM 364,784 msscp.dll
28/01/2005 01:44 PM 224,768 wmasf.dll
28/01/2005 01:44 PM 331,264 wpdsp.dll
07/12/2004 02:32 PM 96,768 srvsvc.dll
17/11/2004 12:41 PM 347,136 hypertrm.dll
16/11/2004 04:17 PM 68,096 hlink.dll
12/11/2004 11:46 AM 7,168 instFunc.dll
27/10/2004 08:21 PM 721,920 lsasrv.dll
26/10/2004 06:38 PM 94,208 divxdec_0411.dll
26/10/2004 06:38 PM 94,208 divxdec_040c.dll
26/10/2004 06:38 PM 94,208 divxdec_0407.dll
04/08/2004 03:34 PM 39,018 hsfci011.dll
04/08/2004 03:07 AM 1,788 Dcache.bin
04/08/2004 03:02 AM 329,728 netsetup.exe
04/08/2004 03:01 AM 92,168 rdpdd.dll
04/08/2004 03:01 AM 12,168 tsddd.dll
04/08/2004 03:01 AM 87,176 rdpwsx.dll
04/08/2004 02:56 AM 32,256 wpabaln.exe
04/08/2004 02:56 AM 146,432 winspool.drv
04/08/2004 02:56 AM 43,008 ksxbar.ax
04/08/2004 02:56 AM 433,664 wiaacmgr.exe
04/08/2004 02:56 AM 65,536 wextract.exe
04/08/2004 02:56 AM 221,184 msadds32.ax
04/08/2004 02:56 AM 69,632 msscds32.ax
04/08/2004 02:56 AM 130,048 ksproxy.ax
04/08/2004 02:56 AM 33,280 kmddsp.tsp
04/08/2004 02:56 AM 220,672 logon.scr
04/08/2004 02:56 AM 135,680 taskmgr.exe
04/08/2004 02:56 AM 105,984 sysocmgr.exe
04/08/2004 02:56 AM 704,512 ss3dfo.scr
04/08/2004 02:56 AM 393,216 ssflwbox.scr
04/08/2004 02:56 AM 47,104 ssmypics.scr
04/08/2004 02:56 AM 18,944 ssmyst.scr
04/08/2004 02:56 AM 610,304 sspipes.scr
04/08/2004 02:56 AM 14,336 ssstars.scr
04/08/2004 02:56 AM 20,992 ssmarque.scr
04/08/2004 02:56 AM 114,688 wscript.exe
04/08/2004 02:56 AM 16,896 upnpcont.exe
04/08/2004 02:56 AM 90,624 kswdmcap.ax
04/08/2004 02:56 AM 30,720 vbisurf.ax
04/08/2004 02:56 AM 18,432 bdaplgin.ax
04/08/2004 02:56 AM 278,559 wmv8ds32.ax
04/08/2004 02:56 AM 9,216 scrnsave.scr
04/08/2004 02:56 AM 29,696 hidphone.tsp
04/08/2004 02:56 AM 30,720 xcopy.exe
04/08/2004 02:56 AM 110,592 bthprops.cpl
04/08/2004 02:56 AM 23,040 ativmvxx.ax
04/08/2004 02:56 AM 188,416 msh261.drv
04/08/2004 02:56 AM 347,136 tourstart.exe
04/08/2004 02:56 AM 56,832 msdvbnp.ax
04/08/2004 02:56 AM 358,400 inetcpl.cpl
04/08/2004 02:56 AM 80,384 firewall.cpl
04/08/2004 02:56 AM 68,608 access.cpl
04/08/2004 02:56 AM 129,536 intl.cpl
04/08/2004 02:56 AM 199,680 iac25_32.ax
04/08/2004 02:56 AM 154,624 ivfsrc.ax
04/08/2004 02:56 AM 68,608 joy.cpl
04/08/2004 02:56 AM 848,384 ir41_32.ax
04/08/2004 02:56 AM 32,256 wpnpinst.exe
04/08/2004 02:56 AM 549,888 appwiz.cpl
04/08/2004 02:56 AM 258,048 wmvds32.ax
04/08/2004 02:56 AM 94,208 timedate.cpl
04/08/2004 02:56 AM 17,408 ipconf.tsp
04/08/2004 02:56 AM 262,144 mpg4ds32.ax
04/08/2004 02:56 AM 155,136 hdwwiz.cpl
04/08/2004 02:56 AM 5,632 winver.exe
04/08/2004 02:56 AM 9,728 ativdaxx.ax
04/08/2004 02:56 AM 502,272 winlogon.exe
04/08/2004 02:56 AM 25,600 netsetup.cpl
04/08/2004 02:56 AM 380,416 irprops.cpl
04/08/2004 02:56 AM 148,992 mpg2splt.ax
04/08/2004 02:56 AM 294,912 msh263.drv
04/08/2004 02:56 AM 23,552 wdmaud.drv
04/08/2004 02:56 AM 33,280 psisrndr.ax
04/08/2004 02:56 AM 289,792 vssvc.exe
04/08/2004 02:56 AM 618,496 mmsys.cpl
04/08/2004 02:56 AM 265,728 h323.tsp
04/08/2004 02:56 AM 50,176 utilman.exe
04/08/2004 02:56 AM 21,504 spupdwxp.exe
04/08/2004 02:56 AM 28,672 vidcap.ax
04/08/2004 02:56 AM 18,432 ups.exe
04/08/2004 02:56 AM 13,824 wscntfy.exe
04/08/2004 02:56 AM 206,848 unimdm.tsp
04/08/2004 02:56 AM 135,168 desk.cpl
04/08/2004 02:56 AM 148,480 wscui.cpl
04/08/2004 02:56 AM 12,288 tracert.exe
04/08/2004 02:56 AM 118,272 mpeg2data.ax
04/08/2004 02:56 AM 56,832 ndptsp.tsp
04/08/2004 02:56 AM 298,496 sysdm.cpl
04/08/2004 02:56 AM 24,576 userinit.exe
04/08/2004 02:56 AM 61,952 kstvtune.ax
04/08/2004 02:56 AM 14,336 svchost.exe
04/08/2004 02:56 AM 14,848 stimon.exe
04/08/2004 02:56 AM 679,936 sstext3d.scr
04/08/2004 02:56 AM 19,968 ssbezier.scr
04/08/2004 02:56 AM 16,384 ipsink.ax
04/08/2004 02:56 AM 538,624 spider.exe
04/08/2004 02:56 AM 114,688 powercfg.cpl
04/08/2004 02:56 AM 32,768 odbccp32.cpl
04/08/2004 02:56 AM 257,024 nusrmgr.cpl
04/08/2004 02:56 AM 49,152 powercfg.exe
04/08/2004 02:56 AM 131,584 sndrec32.exe
04/08/2004 02:56 AM 50,688 smss.exe
04/08/2004 02:56 AM 19,456 shutdown.exe
04/08/2004 02:56 AM 70,144 sigverif.exe
04/08/2004 02:56 AM 33,280 rundll32.exe
04/08/2004 02:56 AM 26,112 skeys.exe
04/08/2004 02:56 AM 8,192 spdwnwxp.exe
04/08/2004 02:56 AM 62,464 rdpclip.exe
04/08/2004 02:56 AM 20,480 qprocess.exe
04/08/2004 02:56 AM 23,040 setup.exe
04/08/2004 02:56 AM 13,824 rdsaddin.exe
04/08/2004 02:56 AM 58,368 packager.exe
04/08/2004 02:56 AM 89,600 smlogsvc.exe
04/08/2004 02:56 AM 67,072 rdshost.exe
04/08/2004 02:56 AM 215,552 osk.exe
04/08/2004 02:56 AM 13,824 rexec.exe
04/08/2004 02:56 AM 21,504 rcp.exe
04/08/2004 02:56 AM 77,312 sdbinst.exe
04/08/2004 02:56 AM 140,800 sessmgr.exe
04/08/2004 02:56 AM 77,824 shrpubw.exe
04/08/2004 02:56 AM 15,872 perfmon.exe
04/08/2004 02:56 AM 42,496 shmgrate.exe
04/08/2004 02:56 AM 50,176 reg.exe
04/08/2004 02:56 AM 9,216 proxycfg.exe
04/08/2004 02:56 AM 13,312 savedump.exe
04/08/2004 02:56 AM 77,312 rtcshare.exe
04/08/2004 02:56 AM 109,568 progman.exe
04/08/2004 02:56 AM 56,832 rasphone.exe
04/08/2004 02:56 AM 108,032 services.exe
04/08/2004 02:56 AM 14,336 runonce.exe
04/08/2004 02:56 AM 14,848 rsh.exe
04/08/2004 02:56 AM 50,176 proquota.exe
04/08/2004 02:56 AM 35,840 rcimlby.exe
04/08/2004 02:56 AM 11,776 regsvr32.exe
04/08/2004 02:56 AM 32,866 slrundll.exe
04/08/2004 02:56 AM 73,796 slserv.exe
04/08/2004 02:56 AM 95,744 scardsvr.exe
04/08/2004 02:56 AM 8,192 smbinst.exe
04/08/2004 02:56 AM 17,920 ping.exe
04/08/2004 02:56 AM 31,232 sethc.exe
04/08/2004 02:56 AM 53,760 narrator.exe
04/08/2004 02:56 AM 42,496 net.exe
04/08/2004 02:56 AM 6,144 msdtc.exe
04/08/2004 02:56 AM 12,288 mstinit.exe
04/08/2004 02:56 AM 124,928 net1.exe
04/08/2004 02:56 AM 32,768 odbcad32.exe
04/08/2004 02:56 AM 111,104 netdde.exe
04/08/2004 02:56 AM 86,016 netsh.exe
04/08/2004 02:56 AM 343,040 mspaint.exe
04/08/2004 02:56 AM 36,864 netstat.exe
04/08/2004 02:56 AM 69,632 odbcconf.exe
04/08/2004 02:56 AM 419,840 ntvdm.exe
04/08/2004 02:56 AM 69,120 notepad.exe
04/08/2004 02:56 AM 4,096 nddeapir.exe
04/08/2004 02:56 AM 29,184 mshta.exe
04/08/2004 02:56 AM 76,800 nslookup.exe
04/08/2004 02:56 AM 123,392 mplay32.exe
04/08/2004 02:56 AM 32,768 mnmsrvc.exe
04/08/2004 02:56 AM 143,360 mobsync.exe
04/08/2004 02:56 AM 815,104 mmc.exe
04/08/2004 02:56 AM 59,392 logman.exe
04/08/2004 02:56 AM 193,024 eudcedit.exe
04/08/2004 02:56 AM 13,312 lsass.exe
04/08/2004 02:56 AM 53,248 ipv6.exe
04/08/2004 02:56 AM 150,016 imapi.exe
04/08/2004 02:56 AM 55,808 ipconfig.exe
04/08/2004 02:56 AM 45,568 extrac32.exe
04/08/2004 02:56 AM 193,024 fsquirt.exe
04/08/2004 02:56 AM 34,304 ie4uinit.exe
04/08/2004 02:56 AM 27,136 findstr.exe
04/08/2004 02:56 AM 20,992 fontview.exe
04/08/2004 02:56 AM 72,704 magnify.exe
04/08/2004 02:56 AM 42,496 ftp.exe
04/08/2004 02:56 AM 114,688 iexpress.exe
04/08/2004 02:56 AM 85,504 makecab.exe
04/08/2004 02:56 AM 22,528 fltmc.exe
04/08/2004 02:56 AM 75,264 locator.exe
04/08/2004 02:56 AM 23,552 ipxroute.exe
04/08/2004 02:56 AM 39,424 grpconv.exe
04/08/2004 02:56 AM 20,992 faxpatch.exe
04/08/2004 02:56 AM 514,560 logonui.exe
04/08/2004 02:56 AM 47,104 cmdl32.exe
04/08/2004 02:56 AM 11,264 autolfn.exe
04/08/2004 02:56 AM 1,298,432 dxdiag.exe
04/08/2004 02:56 AM 33,280 clipsrv.exe
04/08/2004 02:56 AM 17,920 dvdupgrd.exe
04/08/2004 02:56 AM 39,936 cmmon32.exe
04/08/2004 02:56 AM 5,120 dllhost.exe
04/08/2004 02:56 AM 30,208 dplaysvr.exe
04/08/2004 02:56 AM 25,088 defrag.exe
04/08/2004 02:56 AM 14,336 auditusr.exe
04/08/2004 02:56 AM 163,840 diskpart.exe
04/08/2004 02:56 AM 82,432 dfrgfat.exe
04/08/2004 02:56 AM 63,488 cmstp.exe
04/08/2004 02:56 AM 602,624 autoconv.exe
04/08/2004 02:56 AM 183,808 accwiz.exe
04/08/2004 02:56 AM 388,608 cmd.exe
04/08/2004 02:56 AM 44,544 alg.exe
04/08/2004 02:56 AM 15,872 dmremote.exe
04/08/2004 02:56 AM 98,304 ahui.exe
04/08/2004 02:56 AM 580,608 autofmt.exe
04/08/2004 02:56 AM 102,912 clipbrd.exe
04/08/2004 02:56 AM 104,960 dfrgntfs.exe
04/08/2004 02:56 AM 64,000 cleanmgr.exe
04/08/2004 02:56 AM 10,752 dumprep.exe
04/08/2004 02:56 AM 180,224 dwwin.exe
04/08/2004 02:56 AM 11,264 atmadm.exe
04/08/2004 02:56 AM 85,504 diantz.exe
04/08/2004 02:56 AM 83,456 dpvsetup.exe
04/08/2004 02:56 AM 5,632 cisvc.exe
04/08/2004 02:56 AM 588,800 autochk.exe
04/08/2004 02:56 AM 20,480 cliconfg.exe
04/08/2004 02:56 AM 98,304 cscript.exe
04/08/2004 02:56 AM 224,768 dmadmin.exe
04/08/2004 02:56 AM 6,144 csrss.exe
04/08/2004 02:56 AM 30,208 ddeshare.exe
04/08/2004 02:56 AM 18,432 dpnsvr.exe
04/08/2004 02:56 AM 15,360 ctfmon.exe
04/08/2004 02:56 AM 71,680 blastcln.exe
04/08/2004 02:56 AM 27,648 conime.exe
04/08/2004 02:56 AM 4,096 actmovie.exe
04/08/2004 02:56 AM 25,088 at.exe
04/08/2004 02:56 AM 406,528 usp10.dll
04/08/2004 02:56 AM 723,456 userenv.dll
04/08/2004 02:56 AM 25,088 slayerxp.dll
04/08/2004 02:56 AM 430,592 vssapi.dll
04/08/2004 02:56 AM 134,656 shsvcs.dll
04/08/2004 02:56 AM 18,944 snmpapi.dll
04/08/2004 02:56 AM 132,608 upnp.dll
04/08/2004 02:56 AM 129,536 xmlprov.dll
04/08/2004 02:56 AM 6,656 wuauserv.dll
04/08/2004 02:56 AM 108,032 wshbth.dll
04/08/2004 02:56 AM 295,424 termsrv.dll
04/08/2004 02:56 AM 185,344 upnphost.dll
04/08/2004 02:56 AM 26,112 vdmdbg.dll
04/08/2004 02:56 AM 135,680 webvw.dll
04/08/2004 02:56 AM 35,840 umandlg.dll
04/08/2004 02:56 AM 463,360 wiadefui.dll
04/08/2004 02:56 AM 81,408 wscsvc.dll
04/08/2004 02:56 AM 275,456 ulib.dll
04/08/2004 02:56 AM 74,240 unimdmat.dll
04/08/2004 02:56 AM 25,600 udhisapi.dll
04/08/2004 02:56 AM 15,872 w3ssl.dll
04/08/2004 02:56 AM 17,408 winshfhc.dll
04/08/2004 02:56 AM 124,416 wiadss.dll
04/08/2004 02:56 AM 351,232 winhttp.dll
04/08/2004 02:56 AM 13,824 uniplat.dll
04/08/2004 02:56 AM 115,200 wmsdmoe.dll
04/08/2004 02:56 AM 303,616 wmstream.dll
04/08/2004 02:56 AM 19,968 wshtcpip.dll
04/08/2004 02:56 AM 37,888 url.dll
04/08/2004 02:56 AM 333,312 wiaservc.dll
04/08/2004 02:56 AM 18,432 wtsapi32.dll
04/08/2004 02:56 AM 74,240 usbui.dll
04/08/2004 02:56 AM 378,368 wzcdlg.dll
04/08/2004 02:56 AM 589,312 wiashext.dll
04/08/2004 02:56 AM 191,488 syncui.dll
04/08/2004 02:56 AM 44,032 twext.dll
04/08/2004 02:56 AM 358,400 termmgr.dll
04/08/2004 02:56 AM 75,776 strmfilt.dll
04/08/2004 02:56 AM 176,128 winmm.dll
04/08/2004 02:56 AM 264,192 wow32.dll
04/08/2004 02:56 AM 19,968 ws2help.dll
04/08/2004 02:56 AM 14,848 tcpmib.dll
04/08/2004 02:56 AM 28,672 wshcon.dll
04/08/2004 02:56 AM 218,624 uxtheme.dll
04/08/2004 02:56 AM 74,752 storprop.dll
04/08/2004 02:56 AM 132,096 wkssvc.dll
04/08/2004 02:56 AM 14,336 wship6.dll
04/08/2004 02:56 AM 11,776 WshRm.dll
04/08/2004 02:56 AM 91,648 xactsrv.dll
04/08/2004 02:56 AM 67,584 sti.dll
04/08/2004 02:56 AM 385,536 themeui.dll
04/08/2004 02:56 AM 188,508 slgen.dll
04/08/2004 02:56 AM 136,704 sti_ci.dll
04/08/2004 02:56 AM 181,760 tapi32.dll
04/08/2004 02:56 AM 121,856 stobject.dll
04/08/2004 02:56 AM 858,624 tapi3.dll
04/08/2004 02:56 AM 1,580,544 sfcfiles.dll
04/08/2004 02:56 AM 71,680 ssdpsrv.dll
04/08/2004 02:56 AM 713,216 sxs.dll
04/08/2004 02:56 AM 286,792 slextspk.dll
04/08/2004 02:56 AM 51,712 vdmredir.dll
04/08/2004 02:56 AM 417,792 vbscript.dll
04/08/2004 02:56 AM 337,920 zipfldr.dll
04/08/2004 02:56 AM 359,936 wzcsvc.dll
04/08/2004 02:56 AM 180,800 sqlunirl.dll
04/08/2004 02:56 AM 51,712 wzcsapi.dll
04/08/2004 02:56 AM 50,688 wstdecod.dll
04/08/2004 02:56 AM 57,856 synceng.dll
04/08/2004 02:56 AM 22,528 wsock32.dll
04/08/2004 02:56 AM 18,944 version.dll
04/08/2004 02:56 AM 42,496 wsnmp32.dll
04/08/2004 02:56 AM 67,584 srclient.dll
04/08/2004 02:56 AM 246,302 strmdll.dll
04/08/2004 02:56 AM 170,496 srsvc.dll
04/08/2004 02:56 AM 363,008 smlogcfg.dll
04/08/2004 02:56 AM 98,304 slbiop.dll
04/08/2004 02:56 AM 174,592 w32time.dll
04/08/2004 02:56 AM 67,584 webclnt.dll
04/08/2004 02:56 AM 82,944 ws2_32.dll
04/08/2004 02:56 AM 73,832 slcoinst.dll
04/08/2004 02:56 AM 151,552 shmedia.dll
04/08/2004 02:56 AM 25,088 shfolder.dll
04/08/2004 02:56 AM 45,568 tcpmonui.dll
04/08/2004 02:56 AM 68,096 shgina.dll
04/08/2004 02:56 AM 438,272 shimgvw.dll
04/08/2004 02:56 AM 176,640 wintrust.dll
04/08/2004 02:56 AM 16,896 usbmon.dll
04/08/2004 02:56 AM 221,184 wmpns.dll
04/08/2004 02:56 AM 93,696 tscfgwmi.dll
04/08/2004 02:56 AM 34,816 ssdpapi.dll
04/08/2004 02:56 AM 101,888 win32spl.dll
04/08/2004 02:56 AM 49,152 wdigest.dll
04/08/2004 02:56 AM 13,312 sigtab.dll
04/08/2004 02:56 AM 50,176 xmlprovi.dll
04/08/2004 02:56 AM 984,576 syssetup.dll
04/08/2004 02:56 AM 27,648 shscrap.dll
04/08/2004 02:56 AM 90,624 trkwks.dll
04/08/2004 02:56 AM 239,104 srrstr.dll
04/08/2004 02:56 AM 276,480 webcheck.dll
04/08/2004 02:56 AM 75,776 wiascr.dll
04/08/2004 02:56 AM 111,104 wiavideo.dll
04/08/2004 02:56 AM 182,272 snmpsnap.dll
04/08/2004 02:56 AM 65,536 shimeng.dll
04/08/2004 02:56 AM 210,432 t2embed.dll
04/08/2004 02:56 AM 92,672 wlnotify.dll
04/08/2004 02:56 AM 172,032 wldap32.dll
04/08/2004 02:56 AM 30,749 vbajet32.dll
04/08/2004 02:56 AM 53,760 winsta.dll
04/08/2004 02:56 AM 316,416 untfs.dll
04/08/2004 02:56 AM 442,368 sqlsrv32.dll
04/08/2004 02:56 AM 45,568 tcpmon.dll
04/08/2004 02:56 AM 32,768 winipsec.dll
04/08/2004 02:56 AM 65,536 wshext.dll
04/08/2004 02:56 AM 99,328 winscard.dll
04/08/2004 02:56 AM 16,896 winrnr.dll
04/08/2004 02:56 AM 74,752 spoolss.dll
04/08/2004 02:56 AM 239,616 upnpui.dll
04/08/2004 02:56 AM 195,072 msutb.dll
04/08/2004 02:56 AM 343,040 msvcrt.dll
04/08/2004 02:56 AM 526,848 p2psvc.dll
04/08/2004 02:56 AM 18,944 qmgrprxy.dll
04/08/2004 02:56 AM 1,428,480 msvidctl.dll
04/08/2004 02:56 AM 245,248 mswsock.dll
04/08/2004 02:56 AM 36,352 ncobjapi.dll
04/08/2004 02:56 AM 86,016 p2pgasvc.dll
04/08/2004 02:56 AM 116,224 p2p.dll
04/08/2004 02:56 AM 18,944 nddenb32.dll
04/08/2004 02:56 AM 332,288 netapi32.dll
04/08/2004 02:56 AM 88,064 p2pnetsh.dll
04/08/2004 02:56 AM 139,264 netid.dll
04/08/2004 02:56 AM 382,464 qmgr.dll
04/08/2004 02:56 AM 407,040 netlogon.dll
04/08/2004 02:56 AM 875,008 netplwiz.dll
04/08/2004 02:56 AM 657,920 rasdlg.dll
04/08/2004 02:56 AM 560,640 printui.dll
04/08/2004 02:56 AM 17,920 nddeapi.dll
04/08/2004 02:56 AM 15,360 pjlmon.dll
04/08/2004 02:56 AM 14,336 msdmo.dll
04/08/2004 02:56 AM 274,944 mstask.dll
04/08/2004 02:56 AM 80,896 netui0.dll
04/08/2004 02:56 AM 1,708,032 netshell.dll
04/08/2004 02:56 AM 245,760 netui1.dll
04/08/2004 02:56 AM 33,792 msgsvc.dll
04/08/2004 02:56 AM 1,236,480 msxml3.dll
04/08/2004 02:56 AM 39,936 rshx32.dll
04/08/2004 02:56 AM 120,832 msvfw32.dll
04/08/2004 02:56 AM 54,784 npptools.dll
04/08/2004 02:56 AM 363,520 psisdecd.dll
04/08/2004 02:56 AM 39,936 perfctrs.dll
04/08/2004 02:56 AM 67,072 ntdsapi.dll
04/08/2004 02:56 AM 30,208 mspatcha.dll
04/08/2004 02:56 AM 129,536 msv1_0.dll
04/08/2004 02:56 AM 1,737,856 mtxparhd.dll
04/08/2004 02:56 AM 134,656 mssap.dll
04/08/2004 02:56 AM 6,656 sensapi.dll
04/08/2004 02:56 AM 43,520 ntlanman.dll
04/08/2004 02:56 AM 435,200 ntmssvc.dll
04/08/2004 02:56 AM 151,583 msjint40.dll
04/08/2004 02:56 AM 701,440 msxml2.dll
04/08/2004 02:56 AM 96,256 occache.dll
04/08/2004 02:56 AM 144,384 nwprovau.dll
04/08/2004 02:56 AM 143,360 msorcl32.dll
04/08/2004 02:56 AM 249,856 odbc32.dll
04/08/2004 02:56 AM 16,384 odbc32gt.dll
04/08/2004 02:56 AM 140,288 sfc_os.dll
04/08/2004 02:56 AM 385,024 qdvd.dll
04/08/2004 02:56 AM 179,712 ntmsdba.dll
04/08/2004 02:56 AM 24,576 odbcbcp.dll
04/08/2004 02:56 AM 159,232 msimtf.dll
04/08/2004 02:56 AM 512,029 msexch40.dll
04/08/2004 02:56 AM 115,712 mstlsapi.dll
04/08/2004 02:56 AM 135,168 odbcconf.dll
04/08/2004 02:56 AM 143,872 ntshrui.dll
04/08/2004 02:56 AM 266,752 oakley.dll
04/08/2004 02:56 AM 285,696 objsel.dll
04/08/2004 02:56 AM 397,824 regwizc.dll
04/08/2004 02:56 AM 106,496 odbccp32.dll
04/08/2004 02:56 AM 20,510 odpdx32.dll
04/08/2004 02:56 AM 20,510 odfox32.dll
04/08/2004 02:56 AM 20,510 odexl32.dll
04/08/2004 02:56 AM 20,511 oddbse32.dll
04/08/2004 02:56 AM 159,232 sbeio.dll
04/08/2004 02:56 AM 19,968 rdpsnd.dll
04/08/2004 02:56 AM 147,456 odbctrac.dll
04/08/2004 02:56 AM 96,768 psbase.dll
04/08/2004 02:56 AM 59,904 regsvc.dll
04/08/2004 02:56 AM 147,968 rdchost.dll
04/08/2004 02:56 AM 65,536 odbccr32.dll
04/08/2004 02:56 AM 58,880 msdtclog.dll
04/08/2004 02:56 AM 107,008 oleprn.dll
04/08/2004 02:56 AM 28,672 nmmkcert.dll
04/08/2004 02:56 AM 65,536 odbccu32.dll
04/08/2004 02:56 AM 60,416 remotepg.dll
04/08/2004 02:56 AM 44,032 rtutils.dll
04/08/2004 02:56 AM 278,559 odbcjt32.dll
04/08/2004 02:56 AM 120,832 offfilt.dll
04/08/2004 02:56 AM 553,472 oleaut32.dll
04/08/2004 02:56 AM 348,189 msxbde40.dll
04/08/2004 02:56 AM 283,648 pdh.dll
04/08/2004 02:56 AM 190,976 schedsvc.dll
04/08/2004 02:56 AM 204,288 mswebdvd.dll
04/08/2004 02:56 AM 23,040 psapi.dll
04/08/2004 02:56 AM 26,624 perfdisk.dll
04/08/2004 02:56 AM 29,184 sdhcinst.dll
04/08/2004 02:56 AM 43,520 pstorec.dll
04/08/2004 02:56 AM 43,520 racpldlg.dll
04/08/2004 02:56 AM 25,088 perfos.dll
04/08/2004 02:56 AM 397,056 s3gnb.dll
04/08/2004 02:56 AM 8,192 rasadhlp.dll
04/08/2004 02:56 AM 12,288 netrap.dll
04/08/2004 02:56 AM 34,816 perfproc.dll
04/08/2004 02:56 AM 69,632 raschap.dll
04/08/2004 02:56 AM 16,896 rassapi.dll
04/08/2004 02:56 AM 713,728 opengl32.dll
04/08/2004 02:56 AM 431,616 riched20.dll
04/08/2004 02:56 AM 279,040 qdv.dll
04/08/2004 02:56 AM 105,472 polstore.dll
04/08/2004 02:56 AM 151,552 msdart.dll
04/08/2004 02:56 AM 1,507,356 msjet40.dll
04/08/2004 02:56 AM 34,304 pstorsvc.dll
04/08/2004 02:56 AM 27,648 profmap.dll
04/08/2004 02:56 AM 25,088 mslbui.dll
04/08/2004 02:56 AM 213,023 msltus40.dll
04/08/2004 02:56 AM 552,989 msrepl40.dll
04/08/2004 02:56 AM 103,936 nlhtml.dll
04/08/2004 02:56 AM 994,304 msgina.dll
04/08/2004 02:56 AM 537,088 msftedit.dll
04/08/2004 02:56 AM 11,264 msrle32.dll
04/08/2004 02:56 AM 581,120 rpcrt4.dll
04/08/2004 02:56 AM 831,519 mswdat10.dll
04/08/2004 02:56 AM 506,368 msxml.dll
04/08/2004 02:56 AM 31,744 rtipxmib.dll
04/08/2004 02:56 AM 236,544 rasapi32.dll
04/08/2004 02:56 AM 248,832 newdev.dll
04/08/2004 02:56 AM 171,008 sccsccp.dll
04/08/2004 02:56 AM 180,224 scecli.dll
04/08/2004 02:56 AM 118,784 ntmarta.dll
04/08/2004 02:56 AM 40,960 ntmsapi.dll
04/08/2004 02:56 AM 488,448 ntmsmgr.dll
04/08/2004 02:56 AM 8,192 ntlsapi.dll
04/08/2004 02:56 AM 174,080 rasmans.dll
04/08/2004 02:56 AM 313,856 scesrv.dll
04/08/2004 02:56 AM 4,274,816 nv4_disp.dll
04/08/2004 02:56 AM 112,128 rastls.dll
04/08/2004 02:56 AM 622,080 netcfgx.dll
04/08/2004 02:56 AM 20,511 odtext32.dll
04/08/2004 02:56 AM 83,456 olepro32.dll
04/08/2004 02:56 AM 67,584 osuninst.dll
04/08/2004 02:56 AM 18,944 seclogon.dll
04/08/2004 02:56 AM 62,976 pautoenr.dll
04/08/2004 02:56 AM 55,296 sendmail.dll
04/08/2004 02:56 AM 58,880 resutils.dll
04/08/2004 02:56 AM 290,816 msnsspc.dll
04/08/2004 02:56 AM 176,128 photowiz.dll
04/08/2004 02:56 AM 35,328 pid.dll
04/08/2004 02:56 AM 38,912 sens.dll
04/08/2004 02:56 AM 91,136 ntprint.dll
04/08/2004 02:56 AM 562,176 qedit.dll
04/08/2004 02:56 AM 89,088 rasauto.dll
04/08/2004 02:56 AM 17,408 powrprof.dll
04/08/2004 02:56 AM 1,435,648 query.dll
04/08/2004 02:56 AM 206,336 rasppp.dll
04/08/2004 02:56 AM 72,704 msw3prt.dll
04/08/2004 02:56 AM 614,429 mswstr10.dll
04/08/2004 02:56 AM 421,919 msrd2x40.dll
04/08/2004 02:56 AM 315,423 msrd3x40.dll
04/08/2004 02:56 AM 61,440 rasman.dll
04/08/2004 02:56 AM 90,624 mydocs.dll
04/08/2004 02:56 AM 53,279 msjter40.dll
04/08/2004 02:56 AM 102,400 rcbdyctl.dll
04/08/2004 02:56 AM 43,520 safrcdlg.dll
04/08/2004 02:56 AM 58,880 rastapi.dll
04/08/2004 02:56 AM 241,693 msjtes40.dll
04/08/2004 02:56 AM 29,696 safrdm.dll
04/08/2004 02:56 AM 45,568 safrslv.dll
04/08/2004 02:56 AM 5,120 sfc.dll
04/08/2004 02:56 AM 18,944 rsmps.dll
04/08/2004 02:56 AM 415,744 samsrv.dll
04/08/2004 02:56 AM 270,848 sbe.dll
04/08/2004 02:56 AM 413,696 msvcp60.dll
04/08/2004 02:56 AM 159,744 scrobj.dll
04/08/2004 02:56 AM 69,632 scarddlg.dll
04/08/2004 02:56 AM 55,808 secur32.dll
04/08/2004 02:56 AM 5,632 security.dll
04/08/2004 02:56 AM 29,184 sendcmsg.dll
04/08/2004 02:56 AM 49,664 regapi.dll
04/08/2004 02:56 AM 20,992 sclgntfy.dll
04/08/2004 02:56 AM 151,552 scrrun.dll
04/08/2004 02:56 AM 252,928 msoeacct.dll
04/08/2004 02:56 AM 56,320 servdeps.dll
04/08/2004 02:56 AM 319,517 msexcl40.dll
04/08/2004 02:56 AM 144,896 schannel.dll
04/08/2004 02:56 AM 312,320 p2pGraph.dll
04/08/2004 02:56 AM 48,640 pnrpNsp.dll
04/08/2004 02:56 AM 51,712 msident.dll
04/08/2004 02:56 AM 17,408 msyuv.dll
04/08/2004 02:56 AM 248,832 msieftp.dll
04/08/2004 02:56 AM 192,512 qcap.dll
04/08/2004 02:56 AM 54,784 msvcirt.dll
04/08/2004 02:56 AM 258,077 mstext40.dll
04/08/2004 02:56 AM 6,656 msidle.dll
04/08/2004 02:56 AM 64,000 samlib.dll
04/08/2004 02:56 AM 348,189 mspbde40.dll
04/08/2004 02:56 AM 105,984 msoert2.dll
04/08/2004 02:56 AM 4,608 msimg32.dll
04/08/2004 02:56 AM 16,384 ds32gt.dll
04/08/2004 02:56 AM 42,496 audiosrv.dll
04/08/2004 02:56 AM 30,208 atmlib.dll
04/08/2004 02:56 AM 23,040 ersvc.dll
04/08/2004 02:56 AM 84,992 avifil32.dll
04/08/2004 02:56 AM 70,656 amstream.dll
04/08/2004 02:56 AM 24,576 davclnt.dll
04/08/2004 02:56 AM 52,736 basesrv.dll
04/08/2004 02:56 AM 983,552 kernel32.dll
04/08/2004 02:56 AM 263,680 adsnt.dll
04/08/2004 02:56 AM 183,296 els.dll
04/08/2004 02:56 AM 825,344 d3dim700.dll
04/08/2004 02:56 AM 8,704 dciman32.dll
04/08/2004 02:56 AM 357,888 dxtmsft.dll
04/08/2004 02:56 AM 498,205 dxmasf.dll
04/08/2004 02:56 AM 450,560 jscript.dll
04/08/2004 02:56 AM 51,200 dssec.dll
04/08/2004 02:56 AM 17,408 bidispl.dll
04/08/2004 02:56 AM 92,672 dskquota.dll
04/08/2004 02:56 AM 77,312 browser.dll
04/08/2004 02:56 AM 175,616 adsldp.dll
04/08/2004 02:56 AM 78,336 browsewm.dll
04/08/2004 02:56 AM 114,688 aclui.dll
04/08/2004 02:56 AM 50,688 camocx.dll
04/08/2004 02:56 AM 181,760 dsdmo.dll
04/08/2004 02:56 AM 85,504 catsrvps.dll
04/08/2004 02:56 AM 38,912 cfgbkend.dll
04/08/2004 02:56 AM 59,904 ipv6mon.dll
04/08/2004 02:56 AM 110,592 DBnetlib.dll
04/08/2004 02:56 AM 57,344 dpwsockx.dll
04/08/2004 02:56 AM 71,680 dsdmoprp.dll
04/08/2004 02:56 AM 330,752 ippromon.dll
04/08/2004 02:56 AM 97,280 loadperf.dll
04/08/2004 02:56 AM 36,864 mscpxl32.dLL
04/08/2004 02:56 AM 375,296 dpnet.dll
04/08/2004 02:56 AM 22,016 lpk.dll
04/08/2004 02:56 AM 148,480 dnsapi.dll
04/08/2004 02:56 AM 20,992 hid.dll
04/08/2004 02:56 AM 75,264 inetpp.dll
04/08/2004 02:56 AM 119,808 iasrad.dll
04/08/2004 02:56 AM 55,808 eventlog.dll
04/08/2004 02:56 AM 2,113,536 dxdiagn.dll
04/08/2004 02:56 AM 135,680 ifmon.dll
04/08/2004 02:56 AM 82,432 dmscript.dll
04/08/2004 02:56 AM 294,400 msctf.dll
04/08/2004 02:56 AM 32,768 isrdbg32.dll
04/08/2004 02:56 AM 384,512 mp4sdmod.dll
04/08/2004 02:56 AM 118,784 msdadiag.dll
04/08/2004 02:56 AM 11,264 icaapi.dll
04/08/2004 02:56 AM 60,416 fwcfg.dll
04/08/2004 02:56 AM 323,584 iedkcs32.dll
04/08/2004 02:56 AM 69,120 msctfp.dll
04/08/2004 02:56 AM 123,392 input.dll
04/08/2004 02:56 AM 81,920 isign32.dll
04/08/2004 02:56 AM 14,848 mcastmib.dll
04/08/2004 02:56 AM 30,208 bthserv.dll
04/08/2004 02:56 AM 36,921 imeshare.dll
04/08/2004 02:56 AM 34,560 mnmdd.dll
04/08/2004 02:56 AM 14,848 mgmtapi.dll
04/08/2004 02:56 AM 35,328 mciqtz32.dll
04/08/2004 02:56 AM 341,504 localspl.dll
04/08/2004 02:56 AM 73,728 icwdial.dll
04/08/2004 02:56 AM 101,888 cscdll.dll
04/08/2004 02:56 AM 23,040 mciseq.dll
04/08/2004 02:56 AM 20,992 bthci.dll
04/08/2004 02:56 AM 41,984 htui.dll
04/08/2004 02:56 AM 58,880 atl.dll
04/08/2004 02:56 AM 28,672 batmeter.dll
04/08/2004 02:56 AM 50,688 btpanui.dll
04/08/2004 02:56 AM 110,080 imm32.dll
04/08/2004 02:56 AM 186,368 encdec.dll
04/08/2004 02:56 AM 80,384 iccvid.dll
04/08/2004 02:56 AM 33,280 cryptdll.dll
04/08/2004 02:56 AM 35,840 imgutil.dll
04/08/2004 02:56 AM 39,936 mf3216.dll
04/08/2004 02:56 AM 1,028,096 mfc42.dll
04/08/2004 02:56 AM 18,944 midimap.dll
04/08/2004 02:56 AM 13,824 cmsetacl.dll
04/08/2004 02:56 AM 52,224 dmutil.dll
04/08/2004 02:56 AM 200,704 dmdskmgr.dll
04/08/2004 02:56 AM 15,872 inetppui.dll
04/08/2004 02:56 AM 8,192 igmpagnt.dll
04/08/2004 02:56 AM 111,104 dgnet.dll
04/08/2004 02:56 AM 16,896 fltlib.dll
04/08/2004 02:56 AM 586,240 mlang.dll
04/08/2004 02:56 AM 1,192,960 mmcndmgr.dll
04/08/2004 02:56 AM 144,896 hotplug.dll
04/08/2004 02:56 AM 69,632 msconf.dll
04/08/2004 02:56 AM 57,344 msasn1.dll
04/08/2004 02:56 AM 266,240 ddraw.dll
04/08/2004 02:56 AM 17,408 mmfutil.dll
04/08/2004 02:56 AM 240,640 mpg4dmod.dll
04/08/2004 02:56 AM 310,272 mp43dmod.dll
04/08/2004 02:56 AM 153,600 modemui.dll
04/08/2004 02:56 AM 70,656 mmcbase.dll
04/08/2004 02:56 AM 221,696 localsec.dll
04/08/2004 02:56 AM 330,752 hnetwiz.dll
04/08/2004 02:56 AM 28,672 dbnmpntw.dll
04/08/2004 02:56 AM 7,168 hccoin.dll
04/08/2004 02:56 AM 57,856 clusapi.dll
04/08/2004 02:56 AM 344,064 hnetcfg.dll
04/08/2004 02:56 AM 77,824 cliconfg.dll
04/08/2004 02:56 AM 15,872 jsproxy.dll
04/08/2004 02:56 AM 47,616 iyuv_32.dll
04/08/2004 02:56 AM 7,168 bitsprx3.dll
04/08/2004 02:56 AM 48,128 docprop2.dll
04/08/2004 02:56 AM 101,888 actxprxy.dll
04/08/2004 02:56 AM 331,264 ipnathlp.dll
04/08/2004 02:56 AM 118,272 mdminst.dll
04/08/2004 02:56 AM 147,456 initpki.dll
04/08/2004 02:56 AM 614,912 h323msp.dll
04/08/2004 02:56 AM 94,720 iphlpapi.dll
04/08/2004 02:56 AM 81,920 ils.dll
04/08/2004 02:56 AM 48,640 iernonce.dll
04/08/2004 02:56 AM 139,264 ieakeng.dll
04/08/2004 02:56 AM 194,048 activeds.dll
04/08/2004 02:56 AM 65,536 icwphbk.dll
04/08/2004 02:56 AM 54,272 dataclen.dll
04/08/2004 02:56 AM 1,227,264 dx8vb.dll
04/08/2004 02:56 AM 111,104 dhcpcsvc.dll
04/08/2004 02:56 AM 81,920 ieencode.dll
04/08/2004 02:56 AM 382,976 fontext.dll
04/08/2004 02:56 AM 33,280 inetmib1.dll
04/08/2004 02:56 AM 207,360 mobsync.dll
04/08/2004 02:56 AM 326,656 cscui.dll
04/08/2004 02:56 AM 86,016 msapsspc.dll
04/08/2004 02:56 AM 84,480 mciavi32.dll
04/08/2004 02:56 AM 122,880 glu32.dll
04/08/2004 02:56 AM 183,808 ir50_qcx.dll
04/08/2004 02:56 AM 71,680 msacm32.dll
04/08/2004 02:56 AM 349,696 ipsecsnp.dll
04/08/2004 02:56 AM 181,760 dinput8.dll
04/08/2004 02:56 AM 17,408 alrsvc.dll
04/08/2004 02:56 AM 150,528 keymgr.dll
04/08/2004 02:56 AM 19,456 dswave.dll
04/08/2004 02:56 AM 142,336 dsprop.dll
04/08/2004 02:56 AM 22,016 licmgr10.dll
04/08/2004 02:56 AM 1,689,088 d3d9.dll
04/08/2004 02:56 AM 1,294,336 dsound3d.dll
04/08/2004 02:56 AM 14,336 drprov.dll
04/08/2004 02:56 AM 457,728 certmgr.dll
04/08/2004 02:56 AM 212,480 dpvoice.dll
04/08/2004 02:56 AM 60,928 dpnhupnp.dll
04/08/2004 02:56 AM 21,504 dpvacm.dll
04/08/2004 02:56 AM 35,328 dpnhpast.dll
04/08/2004 02:56 AM 54,272 ixsso.dll
04/08/2004 02:56 AM 58,880 licwmi.dll
04/08/2004 02:56 AM 45,568 dnsrslvr.dll
04/08/2004 02:56 AM 512,512 cryptui.dll
04/08/2004 02:56 AM 105,984 dmstyle.dll
04/08/2004 02:56 AM 113,152 dsuiext.dll
04/08/2004 02:56 AM 23,552 dmserver.dll
04/08/2004 02:56 AM 181,248 dmime.dll
04/08/2004 02:56 AM 103,424 dmsynth.dll
04/08/2004 02:56 AM 337,920 filemgmt.dll
04/08/2004 02:56 AM 120,320 ir41_qc.dll
04/08/2004 02:56 AM 100,352 6to4svc.dll
04/08/2004 02:56 AM 87,040 mprapi.dll
04/08/2004 02:56 AM 10,240 lprhelp.dll
04/08/2004 02:56 AM 28,672 dmband.dll
04/08/2004 02:56 AM 159,232 dinput.dll
04/08/2004 02:56 AM 68,608 digest.dll
04/08/2004 02:56 AM 59,904 mpr.dll
04/08/2004 02:56 AM 28,672 dfsshlex.dll
04/08/2004 02:56 AM 38,912 dfrgsnap.dll
04/08/2004 02:56 AM 8,192 bitsprx2.dll
04/08/2004 02:56 AM 123,904 dfrgui.dll
04/08/2004 02:56 AM 59,904 devenum.dll
04/08/2004 02:56 AM 60,416 cryptsvc.dll
04/08/2004 02:56 AM 24,576 dbmsrpcn.dll
04/08/2004 02:56 AM 63,488 cryptnet.dll
04/08/2004 02:56 AM 640,000 dbghelp.dll
04/08/2004 02:56 AM 597,504 crypt32.dll
04/08/2004 02:56 AM 252,928 compatUI.dll
04/08/2004 02:56 AM 343,040 cmdial32.dll
04/08/2004 02:56 AM 15,872 cmcfg32.dll
04/08/2004 02:56 AM 367,616 dsound.dll
04/08/2004 02:56 AM 65,024 asycfilt.dll
04/08/2004 02:56 AM 74,752 cryptdlg.dll
04/08/2004 02:56 AM 87,552 fldrclnr.dll
04/08/2004 02:56 AM 68,096 adsmsext.dll
04/08/2004 02:56 AM 143,360 adsldpc.dll
04/08/2004 02:56 AM 61,440 admparse.dll
04/08/2004 02:56 AM 616,960 advapi32.dll
04/08/2004 02:56 AM 104,448 dmusic.dll
04/08/2004 02:56 AM 338,432 ir41_qcx.dll
04/08/2004 02:56 AM 611,328 comctl32.dll
04/08/2004 02:56 AM 516,768 ativvaxx.dll
04/08/2004 02:56 AM 163,840 credui.dll
04/08/2004 02:56 AM 755,200 ir50_32.dll
04/08/2004 02:56 AM 200,192 ir50_qc.dll
04/08/2004 02:56 AM 23,552 mciwave.dll
04/08/2004 02:56 AM 619,008 dx7vb.dll
04/08/2004 02:56 AM 21,504 feclient.dll
04/08/2004 02:56 AM 229,376 ati2cqag.dll
04/08/2004 02:56 AM 377,984 ati2dvaa.dll
04/08/2004 02:56 AM 126,976 apphelp.dll
04/08/2004 02:56 AM 80,384 faultrep.dll
04/08/2004 02:56 AM 144,384 imagehlp.dll
04/08/2004 02:56 AM 201,728 ati2dvag.dll
04/08/2004 02:56 AM 870,784 ati3d1ag.dll
04/08/2004 02:56 AM 50,688 mmcshext.dll
04/08/2004 02:56 AM 276,992 comdlg32.dll
04/08/2004 02:56 AM 1,888,992 ati3duag.dll
04/08/2004 02:56 AM 13,824 lmhsvc.dll
04/08/2004 02:56 AM 1,024,000 mfc42u.dll
04/08/2004 02:56 AM 35,328 corpol.dll
04/08/2004 02:56 AM 229,888 dplayx.dll
04/08/2004 02:56 AM 380,957 expsrv.dll
04/08/2004 02:56 AM 8,704 batt.dll
04/08/2004 02:56 AM 99,840 advpack.dll
04/08/2004 02:56 AM 792,064 comres.dll
04/08/2004 02:56 AM 182,784 ipsecsvc.dll
04/08/2004 02:56 AM 8,192 d3d8thk.dll
04/08/2004 02:56 AM 11,776 localui.dll
04/08/2004 02:56 AM 61,440 dmcompos.dll
04/08/2004 02:56 AM 274,432 inetcfg.dll
04/08/2004 02:56 AM 282,624 devmgr.dll
04/08/2004 02:56 AM 185,344 cmprops.dll
04/08/2004 02:56 AM 27,136 ddrawex.dll
04/08/2004 02:56 AM 384,000 ipsmsnap.dll
04/08/2004 02:56 AM 229,376 compstui.dll
04/08/2004 02:56 AM 116,736 dpvvox.dll
04/08/2004 02:56 AM 20,480 encapi.dll
04/08/2004 02:56 AM 399,872 lmrt.dll
04/08/2004 02:56 AM 35,840 dmloader.dll
04/08/2004 02:56 AM 22,528 mfcsubs.dll
04/08/2004 02:56 AM 53,760 cryptext.dll
04/08/2004 02:56 AM 59,904 cabinet.dll
04/08/2004 02:56 AM 4,096 ksuser.dll
04/08/2004 02:56 AM 32,768 ativtmxx.dll
04/08/2004 02:56 AM 60,928 miglibnt.dll
04/08/2004 02:56 AM 32,768 csrsrv.dll
04/08/2004 02:56 AM 84,480 cabview.dll
04/08/2004 02:56 AM 120,832 idq.dll
04/08/2004 02:56 AM 194,560 certcli.dll
04/08/2004 02:56 AM 69,120 ciodm.dll
04/08/2004 02:56 AM 23,552 dpmodemx.dll
04/08/2004 02:56 AM 62,976 iesetup.dll
04/08/2004 02:56 AM 216,576 ieaksie.dll
04/08/2004 02:56 AM 1,179,648 d3d8.dll
04/08/2004 02:56 AM 304,128 duser.dll
04/08/2004 02:56 AM 47,104 cnbjmon.dll
04/08/2004 02:56 AM 24,576 httpapi.dll
04/08/2004 02:56 AM 32,285 hsfcisp2.dll
04/08/2004 02:56 AM 239,104 dsquery.dll
04/08/2004 02:56 AM 39,936 cmutil.dll
04/08/2004 02:56 AM 187,392 xpsp1res.dll
04/08/2004 02:56 AM 5,632 wmi.dll
04/08/2004 02:56 AM 438,784 xpob2res.dll
04/08/2004 02:56 AM 2,897,920 xpsp2res.dll
04/08/2004 02:56 AM 708,096 ntdll.dll
04/08/2004 02:56 AM 937,984 winbrand.dll
04/08/2004 02:56 AM 764,928 winntbbu.dll
04/08/2004 02:56 AM 86,016 sl_anet.acm
04/08/2004 02:56 AM 549,376 shdoclc.dll
04/08/2004 02:56 AM 733,696 qedwipes.dll
04/08/2004 02:56 AM 53,279 odbcji32.dll
04/08/2004 02:56 AM 12,288 odbcp32r.dll
04/08/2004 02:56 AM 94,208 odbcint.dll
04/08/2004 02:56 AM 20,480 msorc32r.dll
04/08/2004 02:56 AM 48,128 msprivs.dll
04/08/2004 02:56 AM 177,152 msctfime.ime
04/08/2004 02:56 AM 4,126 msdxmlc.dll
04/08/2004 02:56 AM 56,832 mshtmler.dll
04/08/2004 02:56 AM 294,912 msaud32.acm
04/08/2004 02:56 AM 216,064 moricons.dll
04/08/2004 02:56 AM 12,288 mscpx32r.dLL
04/08/2004 02:56 AM 3,584 msafd.dll
04/08/2004 02:56 AM 14,848 msadp32.acm
04/08/2004 02:56 AM 7,168 kbdfi1.dll
04/08/2004 02:56 AM 7,168 kbdukx.dll
04/08/2004 02:56 AM 290,816 l3codeca.acm
04/08/2004 02:56 AM 6,144 kbdinbe1.dll
04/08/2004 02:56 AM 7,680 kbdsmsfi.dll
04/08/2004 02:56 AM 7,680 kbdsmsno.dll
04/08/2004 02:56 AM 7,168 kbdno1.dll
04/08/2004 02:56 AM 6,144 kbdmlt48.dll
04/08/2004 02:56 AM 6,144 kbdmlt47.dll
04/08/2004 02:56 AM 5,632 kbdmaori.dll
04/08/2004 02:56 AM 6,656 kbdinmal.dll
04/08/2004 02:56 AM 6,656 kbdinben.dll
04/08/2004 02:56 AM 16,384 imaadp32.acm
04/08/2004 02:56 AM 9,728 gpkrsrc.dll
04/08/2004 02:56 AM 48,128 inetres.dll
04/08/2004 02:56 AM 3,584 icmp.dll
04/08/2004 02:56 AM 9,344 framebuf.dll
04/08/2004 02:56 AM 3,584 dpnlobby.dll
04/08/2004 02:56 AM 3,584 dpnaddr.dll
04/08/2004 02:56 AM 4,096 dsprpres.dll
04/08/2004 02:56 AM 63,488 browselc.dll
04/08/2004 02:56 AM 285,696 atmfd.dll
04/08/2004 02:56 AM 16,896 cfgmgr32.dll
04/08/2004 01:13 AM 97,280 dpcdll.dll
04/08/2004 01:07 AM 17,664 watchdog.sys
04/08/2004 01:04 AM 24,064 pidgen.dll
04/08/2004 01:01 AM 114,688 asctrls.ocx
04/08/2004 01:01 AM 98,304 wshom.ocx
04/08/2004 01:01 AM 102,400 msscript.ocx
04/08/2004 01:01 AM 153,088 daxctle.ocx
04/08/2004 01:00 AM 81,920 proctexe.ocx
04/08/2004 01:00 AM 218,624 sysmon.ocx
04/08/2004 12:59 AM 423,936 html.iec
04/08/2004 12:59 AM 655,360 mstscax.dll
04/08/2004 12:59 AM 407,552 mstsc.exe
04/08/2004 12:59 AM 61,440 tdc.ocx
04/08/2004 12:59 AM 44,544 tscupgrd.exe
04/08/2004 12:59 AM 7,424 kd1394.dll
04/08/2004 12:59 AM 131,968 HAL.DLL
04/08/2004 12:58 AM 61,440 msvcrt40.dll
04/08/2004 12:56 AM 11,776 spnpinst.exe
04/08/2004 12:56 AM 983,552 setupapi.dll
04/08/2004 12:56 AM 423,936 licdll.dll
04/08/2004 12:51 AM 53,840 dosx.exe
04/08/2004 12:51 AM 68,768 mmsystem.dll
04/08/2004 12:51 AM 844,314 msdxm.ocx
04/08/2004 12:49 AM 92,224 krnl386.exe
04/08/2004 12:48 AM 3,338 redir.exe
04/08/2004 12:31 AM 306,176 slbcsp.dll
04/08/2004 12:31 AM 152,576 rsaenh.dll
04/08/2004 12:31 AM 137,216 dssenh.dll
04/08/2004 12:22 AM 23,024 ieuinit.inf
04/08/2004 12:22 AM 929 Homepage.inf
04/08/2004 12:21 AM 24,576 cliconfg.rll
04/08/2004 12:21 AM 90,112 sqlsrv32.rll
04/08/2004 12:21 AM 4,310 odbcconf.rsp
04/08/2004 12:20 AM 16,384 simpdata.tlb
04/08/2004 12:20 AM 12,288 msdatsrc.tlb
04/08/2004 12:19 AM 1,351,168 mshtml.tlb
02/08/2004 02:20 PM 7,208 secupd.sig
02/08/2004 02:20 PM 4,569 secupd.dat
17/07/2004 01:48 PM 22,040 sorttbls.nls
17/07/2004 01:48 PM 249,270 locale.nls
17/07/2004 01:46 PM 53,478 tcpmon.ini
17/07/2004 01:39 PM 174,200 xenroll.dll
17/07/2004 01:38 PM 956,990 instcat.sql
17/07/2004 01:35 PM 1,326,080 webfldrs.msi
17/06/2004 12:58 PM 13,312 ntvdmd.dll
14/06/2004 03:04 PM 874,248 SmartUI2.ocx
14/06/2004 02:56 PM 427,864 XceedZip.dll
17/05/2004 05:43 PM 35,424 ntio412.sys
17/05/2004 05:43 PM 34,560 ntio404.sys
17/05/2004 05:43 PM 34,560 ntio804.sys
17/05/2004 05:43 PM 35,648 ntio411.sys
17/05/2004 05:43 PM 33,840 ntio.sys
12/05/2004 10:48 PM 1,409 tmp59CD2.FOT
12/05/2004 10:48 PM 1,409 tmp5BCD2.FOT
10/05/2004 10:42 PM 1,409 tmpE680B.FOT
10/05/2004 10:42 PM 1,409 tmpF480B.FOT
07/05/2004 07:28 PM 1,409 tmpC7122.FOT
07/05/2004 07:28 PM 1,409 tmpD5122.FOT
04/05/2004 11:51 PM 1,409 tmpEB05B.FOT
04/05/2004 11:51 PM 1,409 tmpF905B.FOT
01/05/2004 07:49 PM 1,409 tmpBFB05.FOT
01/05/2004 07:49 PM 1,409 tmpBDB05.FOT

chomedeylaval · 01-08-2006, 12:13 PM

26/04/2004 05:58 PM 1,409 tmp4A1C5.FOT
26/04/2004 05:58 PM 1,409 tmp481C5.FOT
25/04/2004 07:42 PM 1,409 tmpE1C03.FOT
25/04/2004 07:42 PM 1,409 tmpD3C03.FOT
24/04/2004 07:08 PM 1,409 tmpC309B.FOT
24/04/2004 07:08 PM 1,409 tmpC109B.FOT
23/04/2004 06:23 PM 1,409 tmpE0D23.FOT
23/04/2004 06:23 PM 1,409 tmpFEC23.FOT
23/04/2004 03:02 PM 233,472 cmirmdrv.exe
21/04/2004 09:41 PM 1,409 tmp2B7A0.FOT
21/04/2004 09:41 PM 1,409 tmp2C7A0.FOT
10/04/2004 12:24 PM 26,112 xpsp1hfm.exe
07/04/2004 04:49 PM 811,008 FeedingFrenzy.scr
17/03/2004 11:00 AM 86,016 mdmxsdk.dll
09/03/2004 12:00 AM 212,240 richtx32.ocx
09/03/2004 12:00 AM 132,880 msinet.ocx
09/03/2004 12:00 AM 1,081,616 mscomctl.ocx
01/03/2004 02:52 PM 358,976 msjetoledb40.dll
23/02/2004 08:42 PM 1,386,496 msvbvm60.dll
19/11/2003 02:59 PM 512,688 XceedCry.dll
18/10/2003 07:10 AM 2,974 jupdate-1.4.2_01-b06.log
11/10/2003 12:22 AM 2,577 CONFIG.NT
26/07/2003 11:20 PM 1,409 tmp2076C.FOT
24/07/2003 01:00 AM 98,304 SiSApCom.dll
05/06/2003 09:13 PM 53,248 Process.exe
23/05/2003 12:28 PM 348,160 msvcr71.dll
23/05/2003 12:28 PM 499,712 msvcp71.dll
23/05/2003 12:28 PM 1,060,864 mfc71.dll
06/05/2003 09:43 AM 1,044,480 Roboex32.dll
06/05/2003 09:43 AM 49,152 inetwh32.dll
25/03/2003 08:12 AM 1,409 tmp093E7.FOT
25/03/2003 08:12 AM 1,409 tmp253E7.FOT
25/03/2003 08:12 AM 1,409 tmpFC3E7.FOT
22/03/2003 02:23 PM 1,409 tmp85DDF.FOT
22/03/2003 02:23 PM 1,409 tmp69DDF.FOT
22/03/2003 02:23 PM 1,409 tmp92DDF.FOT
19/03/2003 09:34 PM 1,409 tmp5F38E.FOT
19/03/2003 09:34 PM 1,409 tmp7B38E.FOT
19/03/2003 09:34 PM 1,409 tmp8838E.FOT
28/02/2003 06:26 PM 171,792 wjview.exe
28/02/2003 06:26 PM 172,304 jview.exe
28/02/2003 06:26 PM 15,120 jdbgmgr.exe
28/02/2003 06:26 PM 21,264 msjdbc10.dll
28/02/2003 06:26 PM 286,992 vmhelper.dll
28/02/2003 06:26 PM 947,472 msjava.dll
28/02/2003 06:26 PM 49,424 clspack.exe
28/02/2003 06:26 PM 171,280 jit.dll
28/02/2003 06:26 PM 154,384 msawt.dll
28/02/2003 06:26 PM 63,248 javaprxy.dll
28/02/2003 06:26 PM 139,536 javaee.dll
28/02/2003 06:26 PM 404,752 javart.dll
28/02/2003 06:26 PM 187,152 javacypt.dll
28/02/2003 04:54 PM 7,315 javasup.vxd
28/02/2003 04:38 PM 113 zonedon.reg
28/02/2003 04:38 PM 113 zonedoff.reg
28/02/2003 04:34 PM 313,856 dx3j.dll
20/02/2003 07:09 PM 106,496 mscories.dll
18/02/2003 06:26 PM 28,672 cmirmdrv.dll
08/02/2003 05:24 PM 483,328 URLMON(3).DLL
10/01/2003 06:36 PM 128 asinst.cfg
10/01/2003 05:52 PM 388 QuickTime.qtp
07/01/2003 04:37 PM 1,338,880 SHDOCVW(2).DLL
27/12/2002 12:34 PM 5,248 giveio.sys
26/12/2002 12:18 PM 25,065 wmpscheme.xml
26/12/2002 12:17 PM 1,511 $winnt$.inf
12/12/2002 12:14 AM 12,288 ksolay.ax
12/12/2002 12:14 AM 46,592 dxdllreg.exe
12/12/2002 12:14 AM 83,456 l3codecx.ax
10/12/2002 12:00 AM 32,768 HLINKPRX.DLL
10/12/2002 12:00 AM 36,864 DOCOBJ.DLL
02/12/2002 10:06 AM 2,783,232 MSHTML(2).DLL
25/11/2002 03:39 PM 333 $ncsp$.inf
08/11/2002 10:13 AM 4,528 SETBROWS.EXE
08/11/2002 10:13 AM 9,136 INETWH16.DLL
06/11/2002 09:28 AM 49,152 MultiSZ.dll
06/11/2002 09:28 AM 155,648 NeroCheck.exe
06/11/2002 09:28 AM 106,496 TwnLib20.dll
06/11/2002 09:28 AM 275,312 ImagXpr5.dll
06/11/2002 09:28 AM 532,480 imagx5.dll
06/11/2002 09:28 AM 35,328 picn20.dll
06/11/2002 09:28 AM 507,904 imagr5.dll
05/11/2002 07:41 PM 488 logonui.exe.manifest
05/11/2002 07:41 PM 488 WindowsLogon.manifest
05/11/2002 07:40 PM 749 cdplayer.exe.manifest
05/11/2002 07:40 PM 749 sapi.cpl.manifest
05/11/2002 07:40 PM 749 nwc.cpl.manifest
05/11/2002 07:40 PM 749 ncpa.cpl.manifest
05/11/2002 07:40 PM 749 wuaucpl.cpl.manifest
05/11/2002 07:39 PM 21,640 emptyregdb.dat
05/11/2002 07:35 PM 0 h323log.txt
16/10/2002 10:18 AM 1,375,744 ALSNDMGR.CPL
11/09/2002 07:16 AM 1,626 oeminfo.ini
11/09/2002 04:57 AM 8,192 Thumbs.db
29/08/2002 05:00 AM 13,312 verifier.dll
29/08/2002 05:00 AM 5,632 tapiperf.dll
29/08/2002 05:00 AM 19,200 tapi.dll
29/08/2002 05:00 AM 3,072 systray.exe
29/08/2002 05:00 AM 3,360 system.drv
29/08/2002 05:00 AM 3,577 sysprtj.sep
29/08/2002 05:00 AM 3,214 sysprint.sep
29/08/2002 05:00 AM 9,216 wifeman.dll
29/08/2002 05:00 AM 25,088 lnkstub.exe
29/08/2002 05:00 AM 36,864 syskey.exe
29/08/2002 05:00 AM 15,872 sysinv.dll
29/08/2002 05:00 AM 66,082 c_1251.nls
29/08/2002 05:00 AM 18,896 sysedit.exe
29/08/2002 05:00 AM 51,200 syncapp.exe
29/08/2002 05:00 AM 138,752 swprv.dll
29/08/2002 05:00 AM 6,144 svcpack.dll
29/08/2002 05:00 AM 9,216 subst.exe
29/08/2002 05:00 AM 8,192 streamci.dll
29/08/2002 05:00 AM 4,208 storage.dll
29/08/2002 05:00 AM 7,168 stdole32.tlb
29/08/2002 05:00 AM 49,179 sqlwoa.dll
29/08/2002 05:00 AM 24,603 sqlwid.dll
29/08/2002 05:00 AM 66,082 c_1250.nls
29/08/2002 05:00 AM 46,133 sqlsodbc.chm
29/08/2002 05:00 AM 66,082 c_1026.nls
29/08/2002 05:00 AM 66,082 c_10079.nls
29/08/2002 05:00 AM 72,192 sprio800.dll
29/08/2002 05:00 AM 66,082 c_10000.nls
29/08/2002 05:00 AM 70,656 sprio600.dll
29/08/2002 05:00 AM 9,728 sprestrt.exe
29/08/2002 05:00 AM 69,632 spnike.dll
29/08/2002 05:00 AM 1,744 sound.drv
29/08/2002 05:00 AM 5,632 softpub.dll
29/08/2002 05:00 AM 14,848 slbrccsp.dll
29/08/2002 05:00 AM 98,304 verifier.exe
29/08/2002 05:00 AM 5,632 skdll.dll
29/08/2002 05:00 AM 13,824 sisbkup.dll
29/08/2002 05:00 AM 5,120 shell.dll
29/08/2002 05:00 AM 20,535 vfpodbc.dll
29/08/2002 05:00 AM 2,176 vga.drv
29/08/2002 05:00 AM 882 share.exe
29/08/2002 05:00 AM 23,552 sfmapi.dll
29/08/2002 05:00 AM 9,728 sfc.exe
29/08/2002 05:00 AM 145,408 wiavusd.dll
29/08/2002 05:00 AM 5,120 bootvrfy.exe
29/08/2002 05:00 AM 4,608 bootok.exe
29/08/2002 05:00 AM 8,191 bios4.rom
29/08/2002 05:00 AM 89,600 wmidx.ocx
29/08/2002 05:00 AM 28,420 bios1.rom
29/08/2002 05:00 AM 11,753 setver.exe
29/08/2002 05:00 AM 77,824 wmpstub.exe
29/08/2002 05:00 AM 109,456 avifile.dll
29/08/2002 05:00 AM 64,000 avicap32.dll
29/08/2002 05:00 AM 102,457 usrv42a.dll
29/08/2002 05:00 AM 414,208 setupdll.dll
29/08/2002 05:00 AM 240,120 setup.bmp
29/08/2002 05:00 AM 311,327 wmv8dmod.dll
29/08/2002 05:00 AM 1,677,312 wmvcore2.dll
29/08/2002 05:00 AM 14,848 serwvdrv.dll
29/08/2002 05:00 AM 446,464 wmvdmoe.dll
29/08/2002 05:00 AM 33,464 services.msc
29/08/2002 05:00 AM 14,336 serialui.dll
29/08/2002 05:00 AM 13,824 senscfg.dll
29/08/2002 05:00 AM 130,048 sdpblb.dll
29/08/2002 05:00 AM 57,856 scripto.dll
29/08/2002 05:00 AM 26,624 scredir.dll
29/08/2002 05:00 AM 118,784 scardssp.dll
29/08/2002 05:00 AM 69,632 msr2c.dll
29/08/2002 05:00 AM 31,232 sc.exe
29/08/2002 05:00 AM 16,384 runas.exe
29/08/2002 05:00 AM 98,304 rtm.dll
29/08/2002 05:00 AM 49,209 usrv80a.dll
29/08/2002 05:00 AM 51,200 wmerrenu.dll
29/08/2002 05:00 AM 90,112 rsvpsp.dll
29/08/2002 05:00 AM 24,576 dbmsvinn.dLL
29/08/2002 05:00 AM 9,728 rsvpperf.dll
29/08/2002 05:00 AM 23,552 rsvpmsg.dll
29/08/2002 05:00 AM 3,178 rsvpcnts.h
29/08/2002 05:00 AM 12,082 rsvp.ini
29/08/2002 05:00 AM 132,608 rsvp.exe
29/08/2002 05:00 AM 49,152 rsmui.exe
29/08/2002 05:00 AM 24,576 rsmsink.exe
29/08/2002 05:00 AM 49,152 rsm.exe
29/08/2002 05:00 AM 4,608 vjoy.dll
29/08/2002 05:00 AM 69,584 avicap.dll
29/08/2002 05:00 AM 3,167 rsaci.rat
29/08/2002 05:00 AM 22,016 rpcns4.dll
29/08/2002 05:00 AM 6,656 routetab.dll
29/08/2002 05:00 AM 66,082 c_037.nls
29/08/2002 05:00 AM 25,600 routemon.exe
29/08/2002 05:00 AM 78,848 tapiui.dll
29/08/2002 05:00 AM 19,968 route.exe
29/08/2002 05:00 AM 8,192 tsbyuv.dll
29/08/2002 05:00 AM 75 View Channels.scf
29/08/2002 05:00 AM 435,712 shellstyle.dll
29/08/2002 05:00 AM 3,072 rnr20.dll
29/08/2002 05:00 AM 3,584 riched32.dll
29/08/2002 05:00 AM 80,384 autodisc.dll
29/08/2002 05:00 AM 12,800 replace.exe
29/08/2002 05:00 AM 11,264 attrib.exe
29/08/2002 05:00 AM 34,816 atmpvcno.dll
29/08/2002 05:00 AM 73,802 msrclr40.dll
29/08/2002 05:00 AM 107,520 rend.dll
29/08/2002 05:00 AM 4,608 regwiz.exe
29/08/2002 05:00 AM 3,584 regedt32.exe
29/08/2002 05:00 AM 7,168 recover.exe
29/08/2002 05:00 AM 12,800 rasser.dll
29/08/2002 05:00 AM 23,552 rasrad.dll
29/08/2002 05:00 AM 66,082 c_28598.nls
29/08/2002 05:00 AM 22,528 rasmxs.dll
29/08/2002 05:00 AM 143,360 rasmontr.dll
29/08/2002 05:00 AM 2,577 CONFIG.TMP
29/08/2002 05:00 AM 103,424 EqnClass.Dll
29/08/2002 05:00 AM 11,264 rasdial.exe
29/08/2002 05:00 AM 24,661 spxcoins.dll
29/08/2002 05:00 AM 3,458 rasctrs.ini
29/08/2002 05:00 AM 85,020 dgsetup.dll
29/08/2002 05:00 AM 11,776 rasctrs.dll
29/08/2002 05:00 AM 176,157 dgrpsetu.dll
29/08/2002 05:00 AM 1,818 rasctrnm.h
29/08/2002 05:00 AM 13,312 irclass.dll
29/08/2002 05:00 AM 11,776 rasautou.exe
29/08/2002 05:00 AM 66,082 c_20127.nls
29/08/2002 05:00 AM 8,192 qosname.dll
29/08/2002 05:00 AM 66,594 c_852.nls
29/08/2002 05:00 AM 66,082 c_10010.nls
29/08/2002 05:00 AM 3,708 pubprn.vbs
29/08/2002 05:00 AM 66,082 c_10029.nls
29/08/2002 05:00 AM 33,792 vssadmin.exe
29/08/2002 05:00 AM 66,082 c_10082.nls
29/08/2002 05:00 AM 8,192 psnppagn.dll
29/08/2002 05:00 AM 6,656 kbdycl.dll
29/08/2002 05:00 AM 51 pscript.sep
29/08/2002 05:00 AM 6,656 KBDAL.DLL
29/08/2002 05:00 AM 6,877 pschdprf.ini
29/08/2002 05:00 AM 6,656 kbdcr.dll
29/08/2002 05:00 AM 28,746 msrecr40.dll
29/08/2002 05:00 AM 7,168 kbdcz.dll
29/08/2002 05:00 AM 13,312 atkctrs.dll
29/08/2002 05:00 AM 6,656 kbdcz1.dll
29/08/2002 05:00 AM 7,168 msr2cenu.dll
29/08/2002 05:00 AM 6,656 kbdcz2.dll
29/08/2002 05:00 AM 19,456 arp.exe
29/08/2002 05:00 AM 6,656 kbdhu.dll
29/08/2002 05:00 AM 12,498 append.exe
29/08/2002 05:00 AM 5,632 kbdhu1.dll
29/08/2002 05:00 AM 102,912 apcups.dll
29/08/2002 05:00 AM 5,632 kbdpl1.dll
29/08/2002 05:00 AM 9,029 ansi.sys
29/08/2002 05:00 AM 6,656 kbdpl.dll
29/08/2002 05:00 AM 10,752 pschdprf.dll
29/08/2002 05:00 AM 5,632 kbdro.dll
29/08/2002 05:00 AM 4,048 timer.drv
29/08/2002 05:00 AM 6,656 kbdsl.dll
29/08/2002 05:00 AM 40,448 wiasf.ax
29/08/2002 05:00 AM 6,656 kbdsl1.dll
29/08/2002 05:00 AM 31,232 traffic.dll
29/08/2002 05:00 AM 66,594 c_855.nls
29/08/2002 05:00 AM 3,010 pschdcnt.h
29/08/2002 05:00 AM 66,594 c_866.nls
29/08/2002 05:00 AM 18,432 win.com
29/08/2002 05:00 AM 66,082 C_28594.NLS
29/08/2002 05:00 AM 343 prodspec.ini
29/08/2002 05:00 AM 6,144 kbdest.dll
29/08/2002 05:00 AM 9,216 print.exe
29/08/2002 05:00 AM 6,144 kbdlv.dll
29/08/2002 05:00 AM 26,112 adptif.dll
29/08/2002 05:00 AM 6,144 kbdlv1.dll
29/08/2002 05:00 AM 16,384 prflbmsg.dll
29/08/2002 05:00 AM 5,632 kbdlt.dll
29/08/2002 05:00 AM 15,360 tsd32.dll
29/08/2002 05:00 AM 5,632 kbdlt1.dll
29/08/2002 05:00 AM 46,592 pmspl.dll
29/08/2002 05:00 AM 66,594 c_737.nls
29/08/2002 05:00 AM 30,720 plustab.dll
29/08/2002 05:00 AM 66,594 c_869.nls
29/08/2002 05:00 AM 68,608 plugin.ocx
29/08/2002 05:00 AM 66,082 c_875.nls
29/08/2002 05:00 AM 16,896 vss_ps.dll
29/08/2002 05:00 AM 66,082 c_10006.nls
29/08/2002 05:00 AM 33,280 ping6.exe
29/08/2002 05:00 AM 66,082 C_28597.NLS
29/08/2002 05:00 AM 35,328 pifmgr.dll
29/08/2002 05:00 AM 5,632 kbdhe.dll
29/08/2002 05:00 AM 6,144 kbdgkl.dll
29/08/2002 05:00 AM 111,104 activeds.tlb
29/08/2002 05:00 AM 5,632 kbdhe220.dll
29/08/2002 05:00 AM 129,536 acledit.dll
29/08/2002 05:00 AM 5,632 kbdhe319.dll
29/08/2002 05:00 AM 2,732 perfwci.ini
29/08/2002 05:00 AM 6,144 kbdhela2.dll
29/08/2002 05:00 AM 61,952 acelpdec.ax
29/08/2002 05:00 AM 6,656 kbdhela3.dll
29/08/2002 05:00 AM 162,850 c_932.nls
29/08/2002 05:00 AM 8,192 kbdhept.dll
29/08/2002 05:00 AM 253,952 msvcrt20.dll
29/08/2002 05:00 AM 66,082 c_10007.nls
29/08/2002 05:00 AM 435 perfwci.h
29/08/2002 05:00 AM 66,082 c_10017.nls
29/08/2002 05:00 AM 25,600 aaaamon.dll
29/08/2002 05:00 AM 66,082 C_28595.NLS
29/08/2002 05:00 AM 5,632 kbdblr.dll
29/08/2002 05:00 AM 66,082 c_1255.nls
29/08/2002 05:00 AM 5,632 kbdbu.dll
29/08/2002 05:00 AM 12,288 perfts.dll
29/08/2002 05:00 AM 5,632 kbdru.dll
29/08/2002 05:00 AM 16,896 perfnet.dll
29/08/2002 05:00 AM 15,360 taskman.exe
29/08/2002 05:00 AM 2,233 12520850.cpx
29/08/2002 05:00 AM 5,632 kbdycc.dll
29/08/2002 05:00 AM 5,632 kbdur.dll
29/08/2002 05:00 AM 2,151 12520437.cpx
29/08/2002 05:00 AM 5,632 kbdkaz.dll
29/08/2002 05:00 AM 58,273 perfmon.msc
29/08/2002 05:00 AM 5,632 kbduzb.dll
29/08/2002 05:00 AM 272,128 perfi009.dat
29/08/2002 05:00 AM 5,632 kbdaze.dll
29/08/2002 05:00 AM 1,152 perffilt.ini
29/08/2002 05:00 AM 5,632 kbdtat.dll
29/08/2002 05:00 AM 196,642 c_936.nls
29/08/2002 05:00 AM 5,632 kbdmon.dll
29/08/2002 05:00 AM 196,642 c_949.nls
29/08/2002 05:00 AM 5,632 kbdkyr.dll
29/08/2002 05:00 AM 45,116 usrvoica.dll
29/08/2002 05:00 AM 66,082 c_10081.nls
29/08/2002 05:00 AM 49,211 usrvpa.dll
29/08/2002 05:00 AM 66,594 c_857.nls
29/08/2002 05:00 AM 66,082 c_1253.nls
29/08/2002 05:00 AM 66,082 c_28599.nls
29/08/2002 05:00 AM 140 perffilt.h
29/08/2002 05:00 AM 6,144 kbdtuf.dll
29/08/2002 05:00 AM 196,642 c_950.nls
29/08/2002 05:00 AM 19,456 tcpsvcs.exe
29/08/2002 05:00 AM 11,264 tree.com
29/08/2002 05:00 AM 5,632 kbdazel.dll
29/08/2002 05:00 AM 2,891 perfci.ini
29/08/2002 05:00 AM 66,082 c_28603.nls
29/08/2002 05:00 AM 427 perfci.h
29/08/2002 05:00 AM 15,872 more.com
29/08/2002 05:00 AM 49,664 w32tm.exe
29/08/2002 05:00 AM 66,082 c_1256.nls
29/08/2002 05:00 AM 22,016 w32topl.dll
29/08/2002 05:00 AM 66,560 console.dll
29/08/2002 05:00 AM 114 pcl.sep
29/08/2002 05:00 AM 8,192 tssoft32.acm
29/08/2002 05:00 AM 12,288 tcmsetup.exe
29/08/2002 05:00 AM 66,082 c_28593.nls
29/08/2002 05:00 AM 21,504 pathping.exe
29/08/2002 05:00 AM 66,082 c_1257.nls
29/08/2002 05:00 AM 112,128 Mapi32bak.dll
29/08/2002 05:00 AM 23,552 sort.exe
29/08/2002 05:00 AM 10,240 panmap.dll
29/08/2002 05:00 AM 40,448 osuninst.exe
29/08/2002 05:00 AM 24,064 olesvr.dll
29/08/2002 05:00 AM 51,456 vga256.dll
29/08/2002 05:00 AM 117,760 oledlg.dll
29/08/2002 05:00 AM 102,446 net.hlp
29/08/2002 05:00 AM 18,176 vga64k.dll
29/08/2002 05:00 AM 163,328 ciadmin.dll
29/08/2002 05:00 AM 112,128 mapi32.dll
29/08/2002 05:00 AM 16,896 oleaccrc.dll
29/08/2002 05:00 AM 163,328 oleacc.dll
29/08/2002 05:00 AM 153,008 ole2nls.dll
29/08/2002 05:00 AM 169,520 ole2disp.dll
29/08/2002 05:00 AM 39,744 ole2.dll
29/08/2002 05:00 AM 15,360 pentnt.exe
29/08/2002 05:00 AM 61,500 usrcntra.dll
29/08/2002 05:00 AM 69,699 usrcoina.dll
29/08/2002 05:00 AM 22,016 olesvr32.dll
29/08/2002 05:00 AM 2,560 lz32.dll
29/08/2002 05:00 AM 208,896 wavemsp.dll
29/08/2002 05:00 AM 9,216 winfax.dll
29/08/2002 05:00 AM 11,264 chkntfs.exe
29/08/2002 05:00 AM 26,224 odbc16gt.dll
29/08/2002 05:00 AM 60,928 ocmanage.dll
29/08/2002 05:00 AM 32,674 winhelp.hlp
29/08/2002 05:00 AM 36,864 ntsdexts.dll
29/08/2002 05:00 AM 31,744 ntsd.exe
29/08/2002 05:00 AM 77,890 usrdpa.dll
29/08/2002 05:00 AM 32,968 ntmsoprq.msc
29/08/2002 05:00 AM 26,209 ntmsmgr.msc
29/08/2002 05:00 AM 66,082 c_1258.nls
29/08/2002 05:00 AM 36,864 ntmsevt.dll
29/08/2002 05:00 AM 177,856 typelib.dll
29/08/2002 05:00 AM 11,776 chkdsk.exe
29/08/2002 05:00 AM 14,336 ntlanui2.dll
29/08/2002 05:00 AM 8,192 winhlp32.exe
29/08/2002 05:00 AM 57,856 ntlanui.dll
29/08/2002 05:00 AM 66,082 c_28605.nls
29/08/2002 05:00 AM 11,776 winmsd.exe
29/08/2002 05:00 AM 5,120 winnls.dll
29/08/2002 05:00 AM 51,200 dfrgres.dll
29/08/2002 05:00 AM 2,080 winoldap.mod
29/08/2002 05:00 AM 48,794 ntimage.gif
29/08/2002 05:00 AM 29,146 ntdos804.sys
29/08/2002 05:00 AM 65,489 wbcache.deu
29/08/2002 05:00 AM 29,274 ntdos412.sys
29/08/2002 05:00 AM 29,370 ntdos411.sys
29/08/2002 05:00 AM 63,488 wmimgmt.msc
29/08/2002 05:00 AM 27,866 ntdos.sys
29/08/2002 05:00 AM 2,864 winsock.dll
29/08/2002 05:00 AM 147,456 comsnap.dll
29/08/2002 05:00 AM 82,432 ufat.dll
29/08/2002 05:00 AM 13,730 noise.sve
29/08/2002 05:00 AM 308,224 netui2.dll
29/08/2002 05:00 AM 51,712 migpwd.exe
29/08/2002 05:00 AM 13,256 noise.nld
29/08/2002 05:00 AM 19,618 noise.ita
29/08/2002 05:00 AM 47,104 mprui.dll
29/08/2002 05:00 AM 54,272 stclient.dll
29/08/2002 05:00 AM 13,312 umdmxfrm.dll
29/08/2002 05:00 AM 49,196 noise.fra
29/08/2002 05:00 AM 25,600 comaddin.dll
29/08/2002 05:00 AM 19,684 noise.esn
29/08/2002 05:00 AM 323,641 usrdtea.dll
29/08/2002 05:00 AM 751 noise.enu
29/08/2002 05:00 AM 20,480 mtxdm.dll
29/08/2002 05:00 AM 751 noise.eng
29/08/2002 05:00 AM 4,096 mtxex.dll
29/08/2002 05:00 AM 149,848 noise.deu
29/08/2002 05:00 AM 25,088 mtxlegih.dll
29/08/2002 05:00 AM 741 noise.dat
29/08/2002 05:00 AM 5,120 dcomcnfg.exe
29/08/2002 05:00 AM 7,052 nlsfunc.exe
29/08/2002 05:00 AM 253,952 neth.dll
29/08/2002 05:00 AM 108,464 netapi.dll
29/08/2002 05:00 AM 35,840 ncpa.cpl
29/08/2002 05:00 AM 768 msdtcprf.h
29/08/2002 05:00 AM 7,680 ncxpnt.dll
29/08/2002 05:00 AM 1,931 msdtcprf.ini
29/08/2002 05:00 AM 20,480 nbtstat.exe
29/08/2002 05:00 AM 35,840 narrhook.dll
29/08/2002 05:00 AM 66,082 c_500.nls
29/08/2002 05:00 AM 90,112 mycomput.dll
29/08/2002 05:00 AM 86,073 usrfaxa.dll
29/08/2002 05:00 AM 7,046 l_intl.nls
29/08/2002 05:00 AM 44,032 msxml3r.dll
29/08/2002 05:00 AM 37,916 msxml2r.dll
29/08/2002 05:00 AM 15,872 cdmodem.dll
29/08/2002 05:00 AM 66,594 c_437.nls
29/08/2002 05:00 AM 15,360 logoff.exe
29/08/2002 05:00 AM 126,912 msvideo.dll
29/08/2002 05:00 AM 20,992 msg.exe
29/08/2002 05:00 AM 25,600 msvidc32.dll
29/08/2002 05:00 AM 16,896 qappsrv.exe
29/08/2002 05:00 AM 565,760 msvcp50.dll
29/08/2002 05:00 AM 65,489 wbcache.enu
29/08/2002 05:00 AM 1,355,776 msvbvm50.dll
29/08/2002 05:00 AM 22,016 qwinsta.exe
29/08/2002 05:00 AM 6,656 msswchx.exe
29/08/2002 05:00 AM 4,096 rdpcfgex.dll
29/08/2002 05:00 AM 33,792 regini.exe
29/08/2002 05:00 AM 13,312 msswch.dll
29/08/2002 05:00 AM 15,872 rwinsta.exe
29/08/2002 05:00 AM 4,608 mssip32.dll
29/08/2002 05:00 AM 14,848 shadow.exe
29/08/2002 05:00 AM 14,848 tscon.exe
29/08/2002 05:00 AM 53,305 usrlbva.dll
29/08/2002 05:00 AM 14,848 tsdiscon.exe
29/08/2002 05:00 AM 3,286 tslabels.h
29/08/2002 05:00 AM 14,848 msidntld.dll
29/08/2002 05:00 AM 13,223 tslabels.ini
29/08/2002 05:00 AM 35,840 mssign32.dll
29/08/2002 05:00 AM 16,896 tsshutdn.exe
29/08/2002 05:00 AM 4,096 unlodctr.exe
29/08/2002 05:00 AM 16,384 tskill.exe
29/08/2002 05:00 AM 65,489 wbcache.esn
29/08/2002 05:00 AM 1,161 usrlogon.cmd
29/08/2002 05:00 AM 60,416 msratelc.dll
29/08/2002 05:00 AM 41,984 msports.dll
29/08/2002 05:00 AM 9,728 reset.exe
29/08/2002 05:00 AM 65,489 wbcache.fra
29/08/2002 05:00 AM 55,296 freecell.exe
29/08/2002 05:00 AM 33,280 msobjs.dll
29/08/2002 05:00 AM 126,976 mshearts.exe
29/08/2002 05:00 AM 146,432 msls31.dll
29/08/2002 05:00 AM 119,808 winmine.exe
29/08/2002 05:00 AM 7,680 ckcnv.exe
29/08/2002 05:00 AM 56,832 sol.exe
29/08/2002 05:00 AM 80,384 charmap.exe
29/08/2002 05:00 AM 22,984 bopomofo.uce
29/08/2002 05:00 AM 19,968 msgsm32.acm
29/08/2002 05:00 AM 24,006 gb2312.uce
29/08/2002 05:00 AM 9,216 msg711.acm
29/08/2002 05:00 AM 605,696 getuname.dll
29/08/2002 05:00 AM 94,282 msencode.dll
29/08/2002 05:00 AM 60,458 ideograf.uce
29/08/2002 05:00 AM 817 mscdexnt.exe
29/08/2002 05:00 AM 6,948 kanji_1.uce
29/08/2002 05:00 AM 7,168 mscat32.dll
29/08/2002 05:00 AM 8,484 kanji_2.uce
29/08/2002 05:00 AM 65,024 msaudite.dll
29/08/2002 05:00 AM 12,876 korean.uce
29/08/2002 05:00 AM 16,740 shiftjis.uce
29/08/2002 05:00 AM 93,702 subrange.uce
29/08/2002 05:00 AM 35,328 winchat.exe
29/08/2002 05:00 AM 2,112 winspool.exe
29/08/2002 05:00 AM 227,840 avtapi.dll
29/08/2002 05:00 AM 114,688 calc.exe
29/08/2002 05:00 AM 16,384 avmeter.dll
29/08/2002 05:00 AM 73,216 avwav.dll
29/08/2002 05:00 AM 7,680 chcp.com
29/08/2002 05:00 AM 44,544 hticons.dll
29/08/2002 05:00 AM 149,019 crtdll.dll
29/08/2002 05:00 AM 61,168 msacm.dll
29/08/2002 05:00 AM 102,912 msaatext.dll
29/08/2002 05:00 AM 77,891 usrmlnka.exe
29/08/2002 05:00 AM 138,752 sndvol32.exe
29/08/2002 05:00 AM 12,800 mrinfo.exe
29/08/2002 05:00 AM 99,840 mprmsg.dll
29/08/2002 05:00 AM 5,632 write.exe
29/08/2002 05:00 AM 49,152 mprdim.dll
29/08/2002 05:00 AM 69,120 mprddm.dll
29/08/2002 05:00 AM 26,624 msxmlr.dll
29/08/2002 05:00 AM 22,016 mpnotify.exe
29/08/2002 05:00 AM 2,032 mouse.drv
29/08/2002 05:00 AM 8,192 mountvol.exe
29/08/2002 05:00 AM 10,752 clb.dll
29/08/2002 05:00 AM 17,920 ureg.dll
29/08/2002 05:00 AM 5,632 kbdru1.dll
29/08/2002 05:00 AM 10,112 modex.dll
29/08/2002 05:00 AM 19,456 mode.com
29/08/2002 05:00 AM 119,808 mmutilse.dll
29/08/2002 05:00 AM 1,152 mmtask.tsk
29/08/2002 05:00 AM 53,248 CRYPTSVC(3).DLL
29/08/2002 05:00 AM 7,680 vcdex.dll
29/08/2002 05:00 AM 139,810 c_20261.nls
29/08/2002 05:00 AM 12,288 mmdrv.dll
29/08/2002 05:00 AM 1,490 mmdriver.inf
29/08/2002 05:00 AM 5,632 mll_qic.dll
29/08/2002 05:00 AM 7,680 mll_mtf.dll
29/08/2002 05:00 AM 3,584 mll_hp.dll
29/08/2002 05:00 AM 18,944 winstrm.dll
29/08/2002 05:00 AM 673,088 mlang.dat
29/08/2002 05:00 AM 18,944 mimefilt.dll
29/08/2002 05:00 AM 46,258 mib.bin
29/08/2002 05:00 AM 924,432 mfc40u.dll
29/08/2002 05:00 AM 66,594 c_874.nls
29/08/2002 05:00 AM 17,920 stdole2.tlb
29/08/2002 05:00 AM 169,984 sccbase.dll
29/08/2002 05:00 AM 924,432 mfc40.dll
29/08/2002 05:00 AM 16,384 icfgnt5.dll
29/08/2002 05:00 AM 66,082 c_1252.nls
29/08/2002 05:00 AM 39,274 mem.exe
29/08/2002 05:00 AM 147,968 mdwmdmsp.dll
29/08/2002 05:00 AM 50,176 mdhcp.dll
29/08/2002 05:00 AM 65,489 wbcache.ita
29/08/2002 05:00 AM 66,082 c_20866.nls
29/08/2002 05:00 AM 28,160 mciwave.drv
29/08/2002 05:00 AM 25,264 mciseq.drv
29/08/2002 05:00 AM 66,082 c_1254.nls
29/08/2002 05:00 AM 64,512 acctres.dll
29/08/2002 05:00 AM 47,872 user.exe
29/08/2002 05:00 AM 118,784 msg723.acm
29/08/2002 05:00 AM 7,680 mciole32.dll
29/08/2002 05:00 AM 8,192 mciole16.dll
29/08/2002 05:00 AM 17,408 mcicda.dll
29/08/2002 05:00 AM 12,288 nmevtmsg.dll
29/08/2002 05:00 AM 73,376 mciavi.drv
29/08/2002 05:00 AM 4,608 mchgrcoi.dll
29/08/2002 05:00 AM 10,496 mcdsrv32.dll
29/08/2002 05:00 AM 2 desktop.ini
29/08/2002 05:00 AM 61,508 usrprbda.exe
29/08/2002 05:00 AM 11,264 atrace.dll
29/08/2002 05:00 AM 10,240 mcd32.dll
29/08/2002 05:00 AM 112,128 mapistub.dll
29/08/2002 05:00 AM 187,904 main.cpl
29/08/2002 05:00 AM 8,192 mag_hook.dll
29/08/2002 05:00 AM 9,936 lzexpand.dll
29/08/2002 05:00 AM 42,166 lusrmgr.msc
29/08/2002 05:00 AM 71,859 cliconf.chm
29/08/2002 05:00 AM 42,537 keyboard.sys
29/08/2002 05:00 AM 28,160 telephon.cpl
29/08/2002 05:00 AM 8,192 cidaemon.exe
29/08/2002 05:00 AM 13,888 toolhelp.dll
29/08/2002 05:00 AM 16,896 tftp.exe
29/08/2002 05:00 AM 6,144 kbdtuq.dll
29/08/2002 05:00 AM 31,744 tracert6.exe
29/08/2002 05:00 AM 9,216 lprmonui.dll
29/08/2002 05:00 AM 8,192 lpr.exe
29/08/2002 05:00 AM 6,144 lpq.exe
29/08/2002 05:00 AM 25,600 utildll.dll
29/08/2002 05:00 AM 65,489 wbcache.nld
29/08/2002 05:00 AM 28,626 perfd009.dat
29/08/2002 05:00 AM 52,224 tsappcmp.dll
29/08/2002 05:00 AM 50,176 loghours.dll
29/08/2002 05:00 AM 157,696 paqsp.dll
29/08/2002 05:00 AM 109,568 cic.dll
29/08/2002 05:00 AM 127,213 ega.cpi
29/08/2002 05:00 AM 5,120 lodctr.exe
29/08/2002 05:00 AM 66,082 c_20905.nls
29/08/2002 05:00 AM 1,131 loadfix.com
29/08/2002 05:00 AM 41,762 ciadv.msc
29/08/2002 05:00 AM 18,944 wmiprop.dll
29/08/2002 05:00 AM 171,008 netmsg.dll
29/08/2002 05:00 AM 65,489 wbcache.sve
29/08/2002 05:00 AM 29,696 lights.exe
29/08/2002 05:00 AM 221,600 lanman.drv
29/08/2002 05:00 AM 89,600 langwrbk.dll
29/08/2002 05:00 AM 9,728 label.exe
29/08/2002 05:00 AM 168 l_except.nls
29/08/2002 05:00 AM 2,000 keyboard.drv
29/08/2002 05:00 AM 42,809 key01.sys
29/08/2002 05:00 AM 6,144 kbdusx.dll
29/08/2002 05:00 AM 1,309,184 wbdbase.deu
29/08/2002 05:00 AM 66,082 c_21866.nls
29/08/2002 05:00 AM 6,144 kbdusr.dll
29/08/2002 05:00 AM 20,480 msacm32.drv
29/08/2002 05:00 AM 6,144 kbdusl.dll
29/08/2002 05:00 AM 5,632 kbduk.dll
29/08/2002 05:00 AM 2,736 wowdeb.exe
29/08/2002 05:00 AM 10,368 wowexec.exe
29/08/2002 05:00 AM 6,144 kbdsw.dll
29/08/2002 05:00 AM 6,144 kbdsp.dll
29/08/2002 05:00 AM 6,656 kbdsg.dll
29/08/2002 05:00 AM 13,600 wfwnet.drv
29/08/2002 05:00 AM 6,144 kbdsf.dll
29/08/2002 05:00 AM 6,144 kbdpo.dll
29/08/2002 05:00 AM 3,200 wowfax.dll
29/08/2002 05:00 AM 66,594 c_775.nls
29/08/2002 05:00 AM 41,019 usrsvpia.dll
29/08/2002 05:00 AM 66,594 c_850.nls
29/08/2002 05:00 AM 13,824 wowfaxui.dll
29/08/2002 05:00 AM 9,216 wshatm.dll
29/08/2002 05:00 AM 11,776 wshisn.dll
29/08/2002 05:00 AM 7,168 wshnetbs.dll
29/08/2002 05:00 AM 18,832 v7vga.rom
29/08/2002 05:00 AM 957,440 wbdbase.enu
29/08/2002 05:00 AM 13,312 win87em.dll
29/08/2002 05:00 AM 89,588 unicode.nls
29/08/2002 05:00 AM 6,144 kbdno.dll
29/08/2002 05:00 AM 32,256 wupdmgr.exe
29/08/2002 05:00 AM 7,168 kbdnec.dll
29/08/2002 05:00 AM 697 noise.tha
29/08/2002 05:00 AM 6,144 kbdne.dll
29/08/2002 05:00 AM 6,144 kbdmac.dll
29/08/2002 05:00 AM 6,656 kbdla.dll
29/08/2002 05:00 AM 5,632 kbdit142.dll
29/08/2002 05:00 AM 5,632 kbdit.dll
29/08/2002 05:00 AM 5,632 kbdir.dll
29/08/2002 05:00 AM 6,144 kbdic.dll
29/08/2002 05:00 AM 69,886 edit.com
29/08/2002 05:00 AM 10,790 edit.hlp
29/08/2002 05:00 AM 66,594 c_860.nls
29/08/2002 05:00 AM 6,144 kbdgr1.dll
29/08/2002 05:00 AM 66,594 c_861.nls
29/08/2002 05:00 AM 6,144 kbdgr.dll
29/08/2002 05:00 AM 5,632 kbdgae.dll
29/08/2002 05:00 AM 6,144 kbdfr.dll
29/08/2002 05:00 AM 6,144 kbdfo.dll
29/08/2002 05:00 AM 6,144 kbdfi.dll
29/08/2002 05:00 AM 6,144 kbdfc.dll
29/08/2002 05:00 AM 6,144 kbdes.dll
29/08/2002 05:00 AM 5,120 kbddv.dll
29/08/2002 05:00 AM 6,144 kbdda.dll
29/08/2002 05:00 AM 214,016 netevent.dll
29/08/2002 05:00 AM 9,008 ver.dll
29/08/2002 05:00 AM 7,680 kbdcan.dll
29/08/2002 05:00 AM 6,144 kbdca.dll
29/08/2002 05:00 AM 6,144 kbdbr.dll
29/08/2002 05:00 AM 6,144 kbdbene.dll
29/08/2002 05:00 AM 6,144 kbdbe.dll
29/08/2002 05:00 AM 14,710 kb16.com
29/08/2002 05:00 AM 47,952 jobexec.dll
29/08/2002 05:00 AM 65,536 jgsh400.dll
29/08/2002 05:00 AM 77,883 usrrtosa.dll
29/08/2002 05:00 AM 45,568 jgsd400.dll
29/08/2002 05:00 AM 42,496 jgpl400.dll
29/08/2002 05:00 AM 35,840 jgmd400.dll
29/08/2002 05:00 AM 144,896 jgdw400.dll
29/08/2002 05:00 AM 44,544 jgaw400.dll
29/08/2002 05:00 AM 362,496 jet500.dll
29/08/2002 05:00 AM 199,168 ir32_32.dll
29/08/2002 05:00 AM 20,992 ipxwan.dll
29/08/2002 05:00 AM 66,560 ipxsap.dll
29/08/2002 05:00 AM 39,936 ipxrtmgr.dll
29/08/2002 05:00 AM 21,504 ipxrip.dll
29/08/2002 05:00 AM 69,120 ipxpromn.dll
29/08/2002 05:00 AM 83,968 ipxmontr.dll
29/08/2002 05:00 AM 44,032 ipsec6.exe
29/08/2002 05:00 AM 66,594 c_863.nls
29/08/2002 05:00 AM 169,984 iprtrmgr.dll
29/08/2002 05:00 AM 4,096 iprtprio.dll
29/08/2002 05:00 AM 66,082 c_28591.nls
29/08/2002 05:00 AM 750,080 wbdbase.esn
29/08/2002 05:00 AM 786,944 wbdbase.fra
29/08/2002 05:00 AM 3,584 iprop.dll
29/08/2002 05:00 AM 154,112 ipmontr.dll
29/08/2002 05:00 AM 61,172 cmmgr32.hlp
29/08/2002 05:00 AM 867,840 wbdbase.ita
29/08/2002 05:00 AM 1,095,680 wbdbase.nld
29/08/2002 05:00 AM 30,720 iologmsg.dll
29/08/2002 05:00 AM 937,984 wbdbase.sve
29/08/2002 05:00 AM 4,096 wdl.trm
29/08/2002 05:00 AM 40,448 webhits.dll
29/08/2002 05:00 AM 450,560 infosoft.dll
29/08/2002 05:00 AM 110,592 inetcplc.dll
29/08/2002 05:00 AM 70,656 ifsutil.dll
29/08/2002 05:00 AM 18,432 cacls.exe
29/08/2002 05:00 AM 42,339 certmgr.msc
29/08/2002 05:00 AM 66,594 c_865.nls
29/08/2002 05:00 AM 221,184 ieakui.dll
29/08/2002 05:00 AM 54,784 icmui.dll
29/08/2002 05:00 AM 59,392 iassvcs.dll
29/08/2002 05:00 AM 247,808 iassdo.dll
29/08/2002 05:00 AM 86,528 iassam.dll
29/08/2002 05:00 AM 141,312 iasrecst.dll
29/08/2002 05:00 AM 17,920 iaspolcy.dll
29/08/2002 05:00 AM 62,464 iasnap.dll
29/08/2002 05:00 AM 32,256 iashlpr.dll
29/08/2002 05:00 AM 23,552 iasacct.dll
29/08/2002 05:00 AM 5,632 kbdus.dll
29/08/2002 05:00 AM 41,472 iasads.dll
29/08/2002 05:00 AM 7,680 hostname.exe
29/08/2002 05:00 AM 262,148 sortkey.nls
29/08/2002 05:00 AM 14,848 hnetmon.dll
29/08/2002 05:00 AM 4,768 himem.sys
29/08/2002 05:00 AM 14,848 help.exe
29/08/2002 05:00 AM 7,040 kdcom.dll
29/08/2002 05:00 AM 21,232 graphics.pro
29/08/2002 05:00 AM 19,694 graphics.com
29/08/2002 05:00 AM 26,112 graftabl.com
29/08/2002 05:00 AM 101,888 gpkcsp.dll
29/08/2002 05:00 AM 285,184 glmf32.dll
29/08/2002 05:00 AM 49,211 usrsdpia.dll
29/08/2002 05:00 AM 24,772 geo.nls
29/08/2002 05:00 AM 24,576 gdi.exe
29/08/2002 05:00 AM 76,800 gcdef.dll
29/08/2002 05:00 AM 163,840 mindex.dll
29/08/2002 05:00 AM 41,472 g711codc.ax
29/08/2002 05:00 AM 176,128 ftsrch.dll
29/08/2002 05:00 AM 56,320 fsutil.exe
29/08/2002 05:00 AM 81,408 fsusd.dll
29/08/2002 05:00 AM 32,760 fsmgmt.msc
29/08/2002 05:00 AM 1,696 noise.chs
29/08/2002 05:00 AM 25,600 format.com
29/08/2002 05:00 AM 7,168 forcedos.exe
29/08/2002 05:00 AM 79,360 fontsub.dll
29/08/2002 05:00 AM 16,384 fmifs.dll
29/08/2002 05:00 AM 3,072 fixmapi.exe
29/08/2002 05:00 AM 9,216 finger.exe
29/08/2002 05:00 AM 9,216 find.exe
29/08/2002 05:00 AM 14,848 fc.exe
29/08/2002 05:00 AM 882 fastopen.exe
29/08/2002 05:00 AM 121,856 exts.dll
29/08/2002 05:00 AM 15,872 expand.exe
29/08/2002 05:00 AM 8,424 exe2bin.exe
29/08/2002 05:00 AM 56,678 eventvwr.msc
29/08/2002 05:00 AM 8,704 eventvwr.exe
29/08/2002 05:00 AM 33,280 eventcls.dll
29/08/2002 05:00 AM 37,668 eula.txt
29/08/2002 05:00 AM 39,424 esentutl.exe
29/08/2002 05:00 AM 1,015,477 esentprf.ini
29/08/2002 05:00 AM 6,708 esentprf.hxx
29/08/2002 05:00 AM 17,408 esentprf.dll
29/08/2002 05:00 AM 1,114,896 esent97.dll
29/08/2002 05:00 AM 12,642 edlin.exe
29/08/2002 05:00 AM 55,296 dvdplay.exe
29/08/2002 05:00 AM 8,386 ctype.nls
29/08/2002 05:00 AM 1,696 noise.cht
29/08/2002 05:00 AM 218,003 dssec.dat
29/08/2002 05:00 AM 81 dsound.vxd
29/08/2002 05:00 AM 20,480 dbmsadsn.dll
29/08/2002 05:00 AM 144,384 dskquoui.dll
29/08/2002 05:00 AM 62,976 dsauth.dll
29/08/2002 05:00 AM 4,656 ds16gt.dLL
29/08/2002 05:00 AM 29,146 ntdos404.sys
29/08/2002 05:00 AM 45,568 drwtsn32.exe
29/08/2002 05:00 AM 368,710 msisam11.dll
29/08/2002 05:00 AM 28,112 drwatson.exe
29/08/2002 05:00 AM 42,768 dpwsock.dll
29/08/2002 05:00 AM 53,520 dpserial.dll
29/08/2002 05:00 AM 61,952 dpnwsock.dll
29/08/2002 05:00 AM 27,136 ctl3d32.dll
29/08/2002 05:00 AM 62,464 dpnmodem.dll
29/08/2002 05:00 AM 142,848 capesnpn.dll
29/08/2002 05:00 AM 66,082 c_28592.nls
29/08/2002 05:00 AM 33,040 dplay.dll
29/08/2002 05:00 AM 241,725 msuni11.dll
29/08/2002 05:00 AM 10,752 doskey.exe
29/08/2002 05:00 AM 46,080 docprop.dll
29/08/2002 05:00 AM 61,440 dmview.ocx
29/08/2002 05:00 AM 590,336 d3dramp.dll
29/08/2002 05:00 AM 19,456 dmocx.dll
29/08/2002 05:00 AM 18,432 dmintf.dll
29/08/2002 05:00 AM 118,784 dmdskres.dll
29/08/2002 05:00 AM 273,920 dmdlgs.dll
29/08/2002 05:00 AM 330,752 dmconfig.dll
29/08/2002 05:00 AM 4,608 dllhst3g.exe
29/08/2002 05:00 AM 45,083 dispex.dll
29/08/2002 05:00 AM 17,920 diskperf.exe
29/08/2002 05:00 AM 69,120 olethk32.dll
29/08/2002 05:00 AM 33,673 diskmgmt.msc
29/08/2002 05:00 AM 1,501,696 diskcopy.dll
29/08/2002 05:00 AM 7,168 diskcopy.com
29/08/2002 05:00 AM 9,216 diskcomp.com
29/08/2002 05:00 AM 44,032 dimap.dll
29/08/2002 05:00 AM 394,240 diactfrm.dll
29/08/2002 05:00 AM 74,240 dhcpsapi.dll
29/08/2002 05:00 AM 370,176 dhcpmon.dll
29/08/2002 05:00 AM 41,397 dfrg.msc
29/08/2002 05:00 AM 33,079 devmgmt.msc
29/08/2002 05:00 AM 18,432 deskperf.dll
29/08/2002 05:00 AM 16,896 deskmon.dll
29/08/2002 05:00 AM 16,384 deskadp.dll
29/08/2002 05:00 AM 20,634 debug.exe
29/08/2002 05:00 AM 69,700 usrshuta.exe
29/08/2002 05:00 AM 27,648 ccfgnt.dll
29/08/2002 05:00 AM 39,424 ddeml.dll
29/08/2002 05:00 AM 847,872 dbgeng.dll
29/08/2002 05:00 AM 152,064 datime.dll
29/08/2002 05:00 AM 47,616 d3dxof.dll
29/08/2002 05:00 AM 350,208 d3drm.dll
29/08/2002 05:00 AM 34,816 d3dpmesh.dll
29/08/2002 05:00 AM 436,224 d3dim.dll
29/08/2002 05:00 AM 82,944 olecli.dll
29/08/2002 05:00 AM 27,200 ctl3dv2.dll
29/08/2002 05:00 AM 73,728 csseqchk.dll
29/08/2002 05:00 AM 27,097 country.sys
29/08/2002 05:00 AM 13,824 convert.exe
29/08/2002 05:00 AM 8,192 control.exe
29/08/2002 05:00 AM 345,600 confmsp.dll
29/08/2002 05:00 AM 30,160 compobj.dll
29/08/2002 05:00 AM 38,302 compmgmt.msc
29/08/2002 05:00 AM 17,408 compact.exe
29/08/2002 05:00 AM 15,872 comp.exe
29/08/2002 05:00 AM 32,816 commdlg.dll
29/08/2002 05:00 AM 50,620 command.com
29/08/2002 05:00 AM 10,544 comm.drv
29/08/2002 05:00 AM 3,584 comcat.dll
29/08/2002 05:00 AM 26,624 cnvfat.dll
29/08/2002 05:00 AM 9,344 vga.dll
29/08/2002 05:00 AM 32,768 cnetcfg.dll
29/08/2002 05:00 AM 14,336 cmpbk32.dll
29/08/2002 05:00 AM 64 cmos.ram
29/08/2002 05:00 AM 359,936 cards.dll
29/08/2002 05:00 AM 12,288 bootvid.dll
29/08/2002 03:41 AM 150,528 ptpusd.dll
09/08/2002 02:17 PM 209,608 Tabctl32.ocx
09/08/2002 02:13 PM 0 BIPORT
20/06/2002 05:22 AM 31,744 hlp95en.dll
20/06/2002 05:19 AM 37,888 ochlp30e.dll
20/06/2002 05:19 AM 91,136 msls2.dll
12/06/2002 09:37 AM 91,136 mp4fil32.dll
07/06/2002 05:02 AM 716,288 Ltwvc11n.dll
07/06/2002 05:02 AM 392,192 ltkrn11n.dll
07/06/2002 05:02 AM 212,480 PCDLIB32.DLL
07/06/2002 05:02 AM 127,488 ltimg11n.dll
07/06/2002 05:02 AM 36,864 lfbmp11n.dll
07/06/2002 05:02 AM 41,472 lfgif11n.dll
07/06/2002 05:02 AM 26,112 lfpcd11n.dll
07/06/2002 05:02 AM 31,232 lfeps11n.dll
07/06/2002 05:02 AM 56,320 lfpsd11n.dll
07/06/2002 05:02 AM 27,648 lftga11n.dll
07/06/2002 05:02 AM 152,064 lftif11n.dll
07/06/2002 05:02 AM 81,408 lffax11n.dll
07/06/2002 05:02 AM 285,184 LFCMP11n.DLL
07/06/2002 05:02 AM 172,032 Lfpng11n.dll
07/06/2002 05:02 AM 33,280 lfpcx11n.dll
07/06/2002 05:02 AM 59,392 lfwmf11n.dll
07/06/2002 05:02 AM 118,784 ltfil11n.DLL
07/06/2002 05:02 AM 262,656 LTDIS11n.dll
14/03/2002 12:00 PM 38,567 pcpbios.exe
19/02/2002 05:13 PM 65,536 HydraPnp.dll
05/02/2002 01:54 PM 141,016 ALSNDMGR.WAV
08/01/2002 04:57 PM 110,592 Jpeg32.dll
08/01/2002 03:51 PM 155,648 ppremove.dll
08/01/2002 03:51 PM 57,344 pport_res.dll
08/01/2002 03:51 PM 1,462,353 MYDLL.dll
08/01/2002 03:51 PM 229,888 Tiff32.dll
05/01/2002 07:48 AM 974,848 MFC70.dll
05/01/2002 06:40 AM 487,424 MSVCP70.dll
05/01/2002 06:38 AM 54,784 MSVCI70.dll
05/01/2002 06:37 AM 344,064 MSVCR70.dll
11/12/2001 04:12 AM 28,720 SG62CPL.DLL
11/12/2001 04:12 AM 114,688 SG62UUD.DLL
11/12/2001 04:12 AM 323,644 UCS32P.DLL
23/11/2001 12:08 PM 712,704 a3d.dll
11/10/2001 05:04 AM 422,400 imscan.dll
20/09/2001 08:01 PM 339,968 N067UFW.dll
19/09/2001 01:41 PM 73,728 opcode.dll
18/08/2001 07:00 PM 42,064 OEMLOGO.BMP
18/08/2001 05:00 AM 13,107,200 oembios.bin
18/08/2001 05:00 AM 4,483 oembios.dat
18/08/2001 05:00 AM 6,788 oembios.sig
17/08/2001 10:36 PM 5,632 ptpusb.dll
17/08/2001 10:36 PM 8,704 kbdjpn.dll
17/08/2001 10:36 PM 8,192 kbdkor.dll
17/08/2001 10:36 PM 9,759 HSF_INST.dll
17/08/2001 02:55 PM 6,144 kbd106.dll
17/08/2001 02:55 PM 6,144 kbd101c.dll
17/08/2001 02:55 PM 6,144 kbd101b.dll
17/08/2001 02:55 PM 5,632 kbd103.dll
18/07/2001 08:25 PM 86,016 PrintAPI.dll
09/05/2001 05:05 PM 102,400 wmrmcmp.exe
09/05/2001 04:47 PM 466,944 wmv8dmoe.dll
01/05/2001 05:05 PM 53,248 declrds.ax
08/09/2000 05:53 PM 73,839 KodakOneTouch.dll
15/07/2000 12:00 AM 101,888 VB6STKIT.DLL
22/05/2000 05:58 PM 140,488 comdlg32.ocx
22/05/2000 04:58 PM 608,448 comctl32.ocx
14/04/2000 02:24 PM 133,120 sprof32.dll
14/04/2000 02:23 PM 197,632 kpcp32.dll
14/04/2000 02:23 PM 37,376 kpsys32.dll
14/04/2000 02:23 PM 19,456 kcm2sp.dll
11/04/2000 06:00 AM 4,693 apvxdut.vxd
03/04/2000 08:05 PM 118,784 msstdfmt.dll
03/04/2000 05:52 PM 164,144 comct232.ocx
20/03/2000 12:05 AM 64,388 Vbshell.tlb
16/03/2000 12:56 AM 69,632 voxmvdec.ax
16/03/2000 12:56 AM 69,632 voxmsdec.ax
20/12/1999 01:16 PM 8,704 npwmsdrm.dll
30/10/1999 02:36 AM 278,016 vct3216.dll
30/10/1999 02:36 AM 281,600 mvoice.vwp
30/10/1999 02:36 AM 82,944 vct3216.acm
30/10/1999 02:36 AM 424,960 msms001.vwp
09/08/1999 02:40 PM 163,600 wmaudsdk.dll
20/10/1998 02:28 AM 61,952 nabapi32.dll
16/08/1998 06:00 AM 4,096 sysres.dll
30/06/1998 03:13 PM 287,504 msxbse35.dll
30/06/1998 03:13 PM 165,648 mstext35.dll
30/06/1998 03:13 PM 252,176 msrd2x35.dll
30/06/1998 03:13 PM 250,128 mspdox35.dll
30/06/1998 03:13 PM 166,160 msltus35.dll
30/06/1998 03:13 PM 1,045,776 msjet35.dll
30/06/1998 03:13 PM 250,128 msexcl35.dll
30/06/1998 03:13 PM 78,608 Vb5db.dll
30/06/1998 03:13 PM 368,912 vbar332.dll
30/06/1998 03:13 PM 407,312 msrepl35.dll
30/06/1998 03:12 PM 24,848 msjter35.dll
30/06/1998 03:12 PM 123,664 Msjint35.dll
18/06/1998 11:58 AM 94,208 MSSTKPRP.DLL
27/08/1997 10:53 AM 391,168 i263_32.drv
1996 File(s) 368,766,886 bytes
0 Dir(s) 25,384,222,720 bytes free

chomedeylaval · 01-08-2006, 12:14 PM

AND EWEDO FILE

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 1:59:03 PM, 08/01/2006
+ Report-Checksum: D2815121

+ Scan result:

C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1161\A0121464.tlb -> Downloader.Zlob.eg : Cleaned with backup
C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1162\A0121514.tlb -> Downloader.Zlob.eg : Cleaned with backup
C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1163\A0121618.tlb -> Downloader.Zlob.eg : Cleaned with backup
C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1163\A0121673.tlb -> Downloader.Zlob.eg : Cleaned with backup
C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1163\A0121682.tlb -> Downloader.Zlob.eg : Cleaned with backup
C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1163\A0121689.tlb -> Downloader.Zlob.eg : Cleaned with backup
C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1163\A0121710.tlb -> Downloader.Zlob.eg : Cleaned with backup
C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1164\A0121780.exe -> Downloader.Zlob.eb : Cleaned with backup
C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1164\A0121833.exe -> Downloader.Zlob.ee : Cleaned with backup
C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1164\A0121852.tlb -> Downloader.Zlob.eg : Cleaned with backup
C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1164\A0121861.tlb -> Downloader.Zlob.eg : Cleaned with backup
C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1164\A0121883.tlb -> Downloader.Zlob.eg : Cleaned with backup
C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1164\A0121885.exe -> Downloader.Zlob.ef : Cleaned with backup
C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1127\A0117942.tlb -> Downloader.Zlob.eg : Cleaned with backup
C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1129\A0118064.tlb -> Downloader.Zlob.eg : Cleaned with backup

::Report End

sUBs · 01-08-2006, 12:33 PM

The smitfiles.txt you posted appears erronous. The one you posted looks like the directory listing of your system32 folder. Please take a look at this location for the file - C:\smitfiles.txt

In the meanwhile, please download O18fix.zip
Unzip the .reg file inside to your desktop.
Double click the file to merge it into the registry and click YES if it asks.

Then delete this file - C:\WINDOWS\system32\InstaFinder_inst245.exe

Reboot & post a fresh HJT log. Please tell me how your machine is behaving now.

chomedeylaval · 01-08-2006, 01:51 PM

Logfile of HijackThis v1.99.1
Scan saved at 4:50:12 PM, on 08/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Common Files\soft602\pdfSaver.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\dcfssvc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ZipCentral\ZCentral.exe
C:\DOCUME~1\Nick\LOCALS~1\Temp\_ZCTmp.Dir\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [602PC SUITE PDF Saver] "C:\Program Files\Common Files\soft602\pdfSaver.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE"
O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh309190.dll/201
O14 - IERESET.INF: START_PAGE_URL=http://www.futureshop.ca
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/CA/install.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe
O16 - DPF: {525A15D0-4938-11D4-94C7-0050DA20189B} - http://www.easports.com/downloads/ga...y/iesnoopy.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v6.cab
O18 - Protocol: start - (no CLSID) - (no file)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

sUBs · 01-08-2006, 02:20 PM

I gather that you couldnt find the proper smitfiles .txt.
No worry ... please download this other file - peek2.zip
From within it, double click on peek2.bat
It shall produce a log for you to post back here

chomedeylaval · 01-08-2006, 02:44 PM

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\Class Install Handler]
@="AP Class Install Handler filter"
"CLSID"="{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\deflate]
@="AP Deflate Encoding/Decoding Filter "
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\gzip]
@="AP GZIP Encoding/Decoding Filter "
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml]
@="AP lzdhtml encoding/decoding Filter"
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\about]
"CLSID"="{3050F406-98B5-11CF-BB82-00AA00BDCE0B}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\cdl]
@="CDL: Asychronous Pluggable Protocol Handler"
"CLSID"="{3dd53d40-7b8b-11D0-b013-00aa0059ce02}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\dvd]
@="DVD: Pluggable Protocol"
"CLSID"="{12D51199-0DB5-46FE-A120-47A3D7D937CC}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\file]
@="file:, local: Asychronous Pluggable Protocol Handler"
"CLSID"="{79eac9e7-baf9-11ce-8c82-00aa004ba90b}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ftp]
@="ftp: Asychronous Pluggable Protocol Handler"
"CLSID"="{79eac9e3-baf9-11ce-8c82-00aa004ba90b}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\gopher]
@="gopher: Asychronous Pluggable Protocol Handler"
"CLSID"="{79eac9e4-baf9-11ce-8c82-00aa004ba90b}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http]
@="http: Asychronous Pluggable Protocol Handler"
"CLSID"="{79eac9e2-baf9-11ce-8c82-00aa004ba90b}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http\0x00000001]
@="Microsoft OLE DB Moniker Binder for Internet Publishing"
"CLSID"="{E1D2BF42-A96B-11d1-9C6B-0000F875AC61}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http\oledb]
"CLSID"="{E1D2BF40-A96B-11d1-9C6B-0000F875AC61}"
@="Microsoft OLE DB Provider for Internet Publishing"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https]
@="https: Asychronous Pluggable Protocol Handler"
"CLSID"="{79eac9e5-baf9-11ce-8c82-00aa004ba90b}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https\0x00000001]
@="Microsoft OLE DB Moniker Binder for Internet Publishing"
"CLSID"="{E1D2BF42-A96B-11d1-9C6B-0000F875AC61}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https\oledb]
@="Microsoft OLE DB Provider for Internet Publishing"
"CLSID"="{E1D2BF40-A96B-11d1-9C6B-0000F875AC61}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ipp]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ipp\0x00000001]
@="Microsoft OLE DB Moniker Binder for Internet Publishing"
"CLSID"="{E1D2BF42-A96B-11d1-9C6B-0000F875AC61}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\its]
@="its: Asychronous Pluggable Protocol Handler"
"CLSID"="{9D148291-B9C8-11D0-A4CC-0000F80149F6}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\javascript]
"CLSID"="{3050F3B2-98B5-11CF-BB82-00AA00BDCE0B}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local]
@="file:, local: Asychronous Pluggable Protocol Handler"
"CLSID"="{79eac9e7-baf9-11ce-8c82-00aa004ba90b}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mailto]
"CLSID"="{3050f3DA-98B5-11CF-BB82-00AA00BDCE0B}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mhtml]
@="MHTML Asychronous Pluggable Protocol Handler"
"CLSID"="{05300401-BCBC-11d0-85E3-00C04FD85AB4}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mk]
@="mk: Asychronous Pluggable Protocol Handler"
"CLSID"="{79eac9e6-baf9-11ce-8c82-00aa004ba90b}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\0x00000001]
@="Microsoft OLE DB Moniker Binder for Internet Publishing"
"CLSID"="{E1D2BF42-A96B-11d1-9C6B-0000F875AC61}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\oledb]
@="Microsoft OLE DB Provider for Internet Publishing"
"CLSID"="{E1D2BF40-A96B-11d1-9C6B-0000F875AC61}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\res]
"CLSID"="{3050F3BC-98B5-11CF-BB82-00AA00BDCE0B}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\start]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\sysimage]
"CLSID"="{76E67A63-06E9-11D2-A840-006008059382}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\tv]
@="TV: Pluggable Protocol"
"CLSID"="{CBD30858-AF45-11D2-B6D6-00C04FBBDE6E}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\vbscript]
"CLSID"="{3050F3B2-98B5-11CF-BB82-00AA00BDCE0B}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wia]
@="wia: Asychronous Pluggable Protocol Handler for WIA devices"
"CLSID"="{13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\mk]
@="NameSpace Filter for MK:@MSITStore:..."

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\mk\*]
"CLSID"="{9D148291-B9C8-11D0-A4CC-0000F80149F6}"

Thanks again

My computer seems to be running ok.

My homepage is no longer hijacked.

How does the file look.

sUBs · 01-08-2006, 02:49 PM

Please download the file attached - regdel.zip

Unzip the .reg file inside to your desktop.

Double click the file to merge it into the registry and click YES if it asks.

Post a HijackThis log after you have done so.

chomedeylaval · 01-08-2006, 02:58 PM

Logfile of HijackThis v1.99.1
Scan saved at 5:57:35 PM, on 08/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Common Files\soft602\pdfSaver.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\dcfssvc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ZipCentral\ZCentral.exe
C:\DOCUME~1\Nick\LOCALS~1\Temp\_ZCTmp.Dir\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [602PC SUITE PDF Saver] "C:\Program Files\Common Files\soft602\pdfSaver.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE"
O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh309190.dll/201
O14 - IERESET.INF: START_PAGE_URL=http://www.futureshop.ca
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/CA/install.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe
O16 - DPF: {525A15D0-4938-11D4-94C7-0050DA20189B} - http://www.easports.com/downloads/ga...y/iesnoopy.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v6.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

sUBs · 01-08-2006, 03:08 PM

Your system is clean. Have you patched yourself against the WMF exploit yet? If not, please refer to my sig. Kindly follow these simple steps in order to keep your computer clean and secure:

CLEAR & RESET SYSTEM RESTORE'S CACHE - (System Volume Information folder)
Go to Start >> Run - type control sysdm.cpl,,4 & press Enter
- Tick on the checkbox - Turn off System Restore on all drives
- Click Apply
Turn it back 'On' by unticking the same checkbox & click OK
DISABLE THE VIEWING OF SYSTEM FILES
From Windows Explorer, go to Tools>Folder Options> View tab.
- Untick - Show hidden files and folder
- Tick - Hide file extensions for known types
- Tick - Hide protected operating system files
Click Yes to confirm & then click OK
SECURING INTERNET EXPLORER
From within Internet Explorer click on the Tools menu and then click on Internet Options.
- Select the Security tab
  - Click once on the Internet icon so it becomes highlighted.
  - Select Custom Level .
    - Change 'Download signed ActiveX controls' to Prompt
    - Change 'Download unsigned ActiveX controls' to Disable
    - Change 'Initialize and script ActiveX controls not marked as safe' to Disable
    - Change 'Installation of desktop items' to Prompt
    - Change 'Launching programs and files in an IFRAME' to Prompt
    - Change 'Navigate sub-frames across different domains' to Prompt
    - When all these changes have been made, click on the OK button.
  - If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Select OK to exit the Internet Properties page.
ANTIVIRUS SOFTWARE
It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

See this link for a listing of some online & their stand-alone antivirus programs:

Virus, Spyware, and Malware Protection and Removal Resources

It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
FIREWALL
Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here.
Microsoft Windows Update
Visit windowsupdate.com regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
SPYBOT - SEARCH & DESTROY
Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here
AD-AWARE
Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here
SPYWAREBLASTER
SpywareBlaster prevents the installation of malicious ActiveX, adware, browser hijackers, dialers, and other potentially unwanted software. Blocks spyware/tracking cookies & restricts the actions of potentially unwanted sites.

Unlike other programs, SpywareBlaster does not have to remain running in the background. A tutorial on installing & using this product can be found here
IE-SPYAD
IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here
MVPS HOST FILE
The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. It can be downloaded here - MVPS Hosts file

Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.

Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.
Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.
Google Toolbar - Get the free google toolbar to help stop pop up windows.
CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.

ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.
Winpatrol - Download and install the free version of Winpatrol.
A tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein

After doing all these, your system will be optimised against future threats.

It's okay to delete the Hijack This folder in a couple weeks if everything is working okay.
Have a safe & happy computing day.

Please respond to this thread one more time so we can mark this thread as resolved.

chomedeylaval · 01-08-2006, 03:21 PM

OMG

What a diffrence. You have brought back my computer. I thank you

Nick

01-07-2006, 08:07 PM	#1 (permalink)
chomedeylaval Registered User Join Date: Jan 2006 Posts: 9 OS: XP/SvcPack2	Please help with http://www.updatesystempage.com/ I have downloaded ewido , adaware, ieprosetup, but nothing seems to work.] Here is a hicjackthis scan. Any help would be appreciated Thanx,Nick Logfile of HijackThis v1.99.1 Scan saved at 11:02:57 PM, on 07/01/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Unable to get Internet Explorer version! Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvctrl.exe C:\WINDOWS\system32\mssearchnet.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe C:\Program Files\Common Files\soft602\pdfSaver.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\system32\drivers\dcfssvc.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\ewido anti-malware\ewidoguard.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\ZipCentral\ZCentral.exe C:\DOCUME~1\Nick\LOCALS~1\Temp\_ZCTmp.Dir\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = \SOFTWARE\Microsoft\Internet Explorer\Search R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: (no name) - {27150f81-0877-42e9-af13-55e5a3439a26} - C:\WINDOWS\system32\hp7DAB.tmp O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe O4 - HKLM\..\Run: [602PC SUITE PDF Saver] "C:\Program Files\Common Files\soft602\pdfSaver.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh309190.dll/201 O14 - IERESET.INF: START_PAGE_URL=http://www.futureshop.ca O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/CA/install.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe O16 - DPF: {525A15D0-4938-11D4-94C7-0050DA20189B} - http://www.easports.com/downloads/ga...y/iesnoopy.cab O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v6.cab O16 - DPF: {E62A47D8-74B1-4A93-963A-E5E43B7CC5C2} - http://www.zuvio.com/opnste/UCSearch.CAB O18 - Protocol: start - (no CLSID) - (no file) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

01-08-2006, 01:26 AM	#2 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 23,238 OS: N/A	Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. * * * * * * ADDITIONAL DOWNLOADS * * * * * * * * * * * * * * Download & install - CleanUp.exe (not recommended for WinXP64) Download & extract it to it's own folder - smitRem.exe You will need to update Ewido to the latest definition files. Launch Ewido & click Update from the left pane Then click on Start Update. If you are having problems with the updater, you can use this link to manually update Ewido When you have finished updating, EXIT Ewido. If you have not already installed Ad-Aware SE 1.06, download and update aawsepersonal.exe 'UNPLUG'/DISCONNECT your computer from the Internet when you have finished downlaoding. It is IMPORTANT that you don't miss a step & perform everything in the correct order. Before proceeding, please disable EwidoGuard as it may hinder the removal of some entries. Keep it disabled till I tell you it's clean. To disable Ewido's real-time scanner: Double click on the Ewido icon in system try Click on the status button Select Remove Guard * * * * * * FIXING ENTRIES WITH HIJACKTHIS * * * * * * * * * * HijackThis is able to create backups whenever if fixes any entry. These are stored in a subfolder called backups. As such, we advise against placing the program in any temporary folders. Please create a new directory, C:\Program Files\HijackThis\, and re-locate the program & it's associate files there. Do a HijackThis scan & place a check next to these items and select "Fix checked": R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = \SOFTWARE\Microsoft\Internet Explorer\Search O2 - BHO: (no name) - {27150f81-0877-42e9-af13-55e5a3439a26} - C:\WINDOWS\system32\hp7DAB.tmp O16 - DPF: {E62A47D8-74B1-4A93-963A-E5E43B7CC5C2} - http://www.zuvio.com/opnste/UCSearch.CAB O18 - Protocol: start - (no CLSID) - (no file) * * * * * * RESTART WINDOWS IN SAFE MODE * * * * * * * * * * 1. Restart your computer 2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3. Instead of Windows loading as normal, a menu should appear 4. Select the option to run Windows in Safe Mode. * * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * * Run Cleanup! using the following configuration: 1. Click Options... 2. Set the slider initially to Standard CleanUp! 3. Uncheck the following: Delete Newsgroup cache Delete Newsgroup Subscriptions Scan local drives for temporary files 4. Click OK 5. Press the CleanUp! button to start the program. 6. Do NOT reboot/logoff if prompted. * CleanUp! will not create any backups!! * * * * * * RUNNING ADDITIONAL SCANNERS * * * * * * * * * * * Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen. Wait for the tool to complete and disk cleanup to finish. The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply. * * * * Next go to Control Panel click Display>Desktop>Customize Desktop>Website Under the 'Web pages' box, Uncheck everything present. * * * * Open Ad-aware and close ALL other windows. 1. Click on the ‘Gear’ icon (second from the left at the top of the window) to access the preferences/settings window: In the General window make sure the following are selected in green: Automatically save log-file Automatically quarantine objects prior to removal Safe Mode (always request confirmation) Prompt to update outdated definitions - set the number of days = 7 Click on the Scanning button on the left and select in green: Scan Within Archives Under Select drives & folders to scan: choose all hard drives Scan Active Processes Scan Registry Deep Scan Registry Scan my IE favorites for banned URL’s Scan my Hosts file Click on the Advanced button on the left and select in green: Move deleted files to recycle bin include addtional object information DeSelect - include negligible objects information Don't log streams smaller than 0 bytes Don't log ADS with the following names: CA_INOCULATEIT Click the Tweak button: Under Scanning Engine: Unload recognized processes during scanning Ignore spanned files when scanning cab archives Scan registry for all users instead of current user only Under Cleaning Engine: Let Windows remove files in use at next reboot Under Log Files: Include basic Ad-aware SE settings in logfile Include additional Ad-aware SE settings in logfile Include computer & username in logfile Please DeSelect: Include Module list in logfile 2. Click on Proceed to save the settings. 3. Click Start 4. Choose - Perform Full System Scan 5. DeSelect "Search for negligible risk entries", as negligible risk entries (MRU's) are not considered to be a threat. 6. Click Next and Ad-Aware SE will scan your hard drive(s) with the options you have selected and clean automatically. 7. If Ad-Aware SE finds bad entries, you will receive a list of what it found in the window 8. Right-click on the list and choose Select All 9. Click Next to finish removing the items that were found * * * * * Run Ewido with it's updated definitions:(...it's important that all windows must be closed) Click Scanner Click Complete System Scan to begin scanning. Click OK when prompted to clean files With the first file it prompts to clean, select the option: "Perform action on all infections" .Choose clean and click OK. Once finished, click the Save report button & save the report to your desktop ** Ewido scan would require at least an hour. I suggest that you go grab a cup of coffee & do something else while you wait for it to complete. * * * * * * REBOOT TO NORMAL MODE * * * * * * * * * * * * * * Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component. The program will then begin downloading the latest definition files. Once the files have been downloaded click on NEXT Locate the Scan Settings button & configure to: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Bases Click OK & have it scan My Computer Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply * Turn off the real time scanner of any existing antivirus program while performing the online scan * * * * * * CHECK LIST * * * * * * * * * * * * * * * * * * * * * In your next post, please include fresh copies of: HiJackThis log Online scan Smitfiles.txt Ewido's log Let us know if any problems persist. __________________

01-08-2006, 12:33 PM	#7 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 23,238 OS: N/A	The smitfiles.txt you posted appears erronous. The one you posted looks like the directory listing of your system32 folder. Please take a look at this location for the file - C:\smitfiles.txt In the meanwhile, please download O18fix.zip Unzip the .reg file inside to your desktop. Double click the file to merge it into the registry and click YES if it asks. Then delete this file - C:\WINDOWS\system32\InstaFinder_inst245.exe Reboot & post a fresh HJT log. Please tell me how your machine is behaving now. __________________

01-08-2006, 01:51 PM	#8 (permalink)
chomedeylaval Registered User Join Date: Jan 2006 Posts: 9 OS: XP/SvcPack2	As requested Logfile of HijackThis v1.99.1 Scan saved at 4:50:12 PM, on 08/01/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Unable to get Internet Explorer version! Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe C:\Program Files\Common Files\soft602\pdfSaver.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\system32\drivers\dcfssvc.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\ZipCentral\ZCentral.exe C:\DOCUME~1\Nick\LOCALS~1\Temp\_ZCTmp.Dir\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe O4 - HKLM\..\Run: [602PC SUITE PDF Saver] "C:\Program Files\Common Files\soft602\pdfSaver.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE" O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh309190.dll/201 O14 - IERESET.INF: START_PAGE_URL=http://www.futureshop.ca O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/CA/install.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe O16 - DPF: {525A15D0-4938-11D4-94C7-0050DA20189B} - http://www.easports.com/downloads/ga...y/iesnoopy.cab O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v6.cab O18 - Protocol: start - (no CLSID) - (no file) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

01-08-2006, 02:20 PM	#9 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 23,238 OS: N/A	I gather that you couldnt find the proper smitfiles .txt. No worry ... please download this other file - peek2.zip From within it, double click on peek2.bat It shall produce a log for you to post back here __________________ Last edited by sUBs; 01-16-2006 at 03:06 PM.

01-08-2006, 12:07 PM	#3 (permalink)
chomedeylaval Registered User Join Date: Jan 2006 Posts: 9 OS: XP/SvcPack2	Hi, First of all I would like to thank you for the time you took to help me out. It is highly appreciated. God bless you. Here is the hijackthis file. Logfile of HijackThis v1.99.1 Scan saved at 2:54:29 PM, on 08/01/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Unable to get Internet Explorer version! Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\WINDOWS\SOUNDMAN.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\system32\drivers\dcfssvc.exe C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Common Files\soft602\pdfSaver.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\ZipCentral\ZCentral.exe C:\DOCUME~1\Nick\LOCALS~1\Temp\_ZCTmp.Dir\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe O4 - HKLM\..\Run: [602PC SUITE PDF Saver] "C:\Program Files\Common Files\soft602\pdfSaver.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE" O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh309190.dll/201 O14 - IERESET.INF: START_PAGE_URL=http://www.futureshop.ca O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/CA/install.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe O16 - DPF: {525A15D0-4938-11D4-94C7-0050DA20189B} - http://www.easports.com/downloads/ga...y/iesnoopy.cab O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v6.cab O18 - Protocol: start - (no CLSID) - (no file) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe Here is the Online Scan ------------------------------------------------------------------------------- KASPERSKY ON-LINE SCANNER REPORT Sunday, January 08, 2006 14:51:29 Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky On-line Scanner version: 5.0.67.0 Kaspersky Anti-Virus database last update: 8/01/2006 Kaspersky Anti-Virus database records: 169924 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ Scan Statistics: Total number of scanned objects: 50028 Number of viruses found: 1 Number of infected objects: 2 Number of suspicious objects: 0 Duration of the scan process: 2292 sec Infected Object Name - Virus Name C:\WINDOWS\system32\InstaFinder_inst245.exe/stream Infected: not-a-virus:AdWare.Win32.InstaFinder.a C:\WINDOWS\system32\InstaFinder_inst245.exe Infected: not-a-virus:AdWare.Win32.InstaFinder.a Scan process completed.

01-08-2006, 12:14 PM	#6 (permalink)
chomedeylaval Registered User Join Date: Jan 2006 Posts: 9 OS: XP/SvcPack2	AND EWEDO FILE --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 1:59:03 PM, 08/01/2006 + Report-Checksum: D2815121 + Scan result: C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1161\A0121464.tlb -> Downloader.Zlob.eg : Cleaned with backup C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1162\A0121514.tlb -> Downloader.Zlob.eg : Cleaned with backup C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1163\A0121618.tlb -> Downloader.Zlob.eg : Cleaned with backup C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1163\A0121673.tlb -> Downloader.Zlob.eg : Cleaned with backup C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1163\A0121682.tlb -> Downloader.Zlob.eg : Cleaned with backup C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1163\A0121689.tlb -> Downloader.Zlob.eg : Cleaned with backup C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1163\A0121710.tlb -> Downloader.Zlob.eg : Cleaned with backup C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1164\A0121780.exe -> Downloader.Zlob.eb : Cleaned with backup C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1164\A0121833.exe -> Downloader.Zlob.ee : Cleaned with backup C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1164\A0121852.tlb -> Downloader.Zlob.eg : Cleaned with backup C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1164\A0121861.tlb -> Downloader.Zlob.eg : Cleaned with backup C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1164\A0121883.tlb -> Downloader.Zlob.eg : Cleaned with backup C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1164\A0121885.exe -> Downloader.Zlob.ef : Cleaned with backup C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1127\A0117942.tlb -> Downloader.Zlob.eg : Cleaned with backup C:\System Volume Information\_restore{932FCB4E-2D9F-43D6-9747-02F57FAADF33}\RP1129\A0118064.tlb -> Downloader.Zlob.eg : Cleaned with backup ::Report End

01-08-2006, 02:44 PM	#10 (permalink)
chomedeylaval Registered User Join Date: Jan 2006 Posts: 9 OS: XP/SvcPack2	Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\Class Install Handler] @="AP Class Install Handler filter" "CLSID"="{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\deflate] @="AP Deflate Encoding/Decoding Filter " "CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\gzip] @="AP GZIP Encoding/Decoding Filter " "CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml] @="AP lzdhtml encoding/decoding Filter" "CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\about] "CLSID"="{3050F406-98B5-11CF-BB82-00AA00BDCE0B}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\cdl] @="CDL: Asychronous Pluggable Protocol Handler" "CLSID"="{3dd53d40-7b8b-11D0-b013-00aa0059ce02}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\dvd] @="DVD: Pluggable Protocol" "CLSID"="{12D51199-0DB5-46FE-A120-47A3D7D937CC}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\file] @="file:, local: Asychronous Pluggable Protocol Handler" "CLSID"="{79eac9e7-baf9-11ce-8c82-00aa004ba90b}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ftp] @="ftp: Asychronous Pluggable Protocol Handler" "CLSID"="{79eac9e3-baf9-11ce-8c82-00aa004ba90b}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\gopher] @="gopher: Asychronous Pluggable Protocol Handler" "CLSID"="{79eac9e4-baf9-11ce-8c82-00aa004ba90b}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http] @="http: Asychronous Pluggable Protocol Handler" "CLSID"="{79eac9e2-baf9-11ce-8c82-00aa004ba90b}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http\0x00000001] @="Microsoft OLE DB Moniker Binder for Internet Publishing" "CLSID"="{E1D2BF42-A96B-11d1-9C6B-0000F875AC61}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http\oledb] "CLSID"="{E1D2BF40-A96B-11d1-9C6B-0000F875AC61}" @="Microsoft OLE DB Provider for Internet Publishing" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https] @="https: Asychronous Pluggable Protocol Handler" "CLSID"="{79eac9e5-baf9-11ce-8c82-00aa004ba90b}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https\0x00000001] @="Microsoft OLE DB Moniker Binder for Internet Publishing" "CLSID"="{E1D2BF42-A96B-11d1-9C6B-0000F875AC61}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https\oledb] @="Microsoft OLE DB Provider for Internet Publishing" "CLSID"="{E1D2BF40-A96B-11d1-9C6B-0000F875AC61}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ipp] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ipp\0x00000001] @="Microsoft OLE DB Moniker Binder for Internet Publishing" "CLSID"="{E1D2BF42-A96B-11d1-9C6B-0000F875AC61}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\its] @="its: Asychronous Pluggable Protocol Handler" "CLSID"="{9D148291-B9C8-11D0-A4CC-0000F80149F6}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\javascript] "CLSID"="{3050F3B2-98B5-11CF-BB82-00AA00BDCE0B}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local] @="file:, local: Asychronous Pluggable Protocol Handler" "CLSID"="{79eac9e7-baf9-11ce-8c82-00aa004ba90b}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mailto] "CLSID"="{3050f3DA-98B5-11CF-BB82-00AA00BDCE0B}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mhtml] @="MHTML Asychronous Pluggable Protocol Handler" "CLSID"="{05300401-BCBC-11d0-85E3-00C04FD85AB4}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mk] @="mk: Asychronous Pluggable Protocol Handler" "CLSID"="{79eac9e6-baf9-11ce-8c82-00aa004ba90b}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\0x00000001] @="Microsoft OLE DB Moniker Binder for Internet Publishing" "CLSID"="{E1D2BF42-A96B-11d1-9C6B-0000F875AC61}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\oledb] @="Microsoft OLE DB Provider for Internet Publishing" "CLSID"="{E1D2BF40-A96B-11d1-9C6B-0000F875AC61}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\res] "CLSID"="{3050F3BC-98B5-11CF-BB82-00AA00BDCE0B}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\start] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\sysimage] "CLSID"="{76E67A63-06E9-11D2-A840-006008059382}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\tv] @="TV: Pluggable Protocol" "CLSID"="{CBD30858-AF45-11D2-B6D6-00C04FBBDE6E}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\vbscript] "CLSID"="{3050F3B2-98B5-11CF-BB82-00AA00BDCE0B}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wia] @="wia: Asychronous Pluggable Protocol Handler for WIA devices" "CLSID"="{13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\mk] @="NameSpace Filter for MK:@MSITStore:..." [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\mk\*] "CLSID"="{9D148291-B9C8-11D0-A4CC-0000F80149F6}" Thanks again My computer seems to be running ok. My homepage is no longer hijacked. How does the file look.

01-08-2006, 02:49 PM	#11 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 23,238 OS: N/A	Please download the file attached - regdel.zip Unzip the .reg file inside to your desktop. Double click the file to merge it into the registry and click YES if it asks. Post a HijackThis log after you have done so. __________________ Last edited by sUBs; 01-16-2006 at 03:06 PM.

01-08-2006, 02:58 PM	#12 (permalink)
chomedeylaval Registered User Join Date: Jan 2006 Posts: 9 OS: XP/SvcPack2	Logfile of HijackThis v1.99.1 Scan saved at 5:57:35 PM, on 08/01/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Unable to get Internet Explorer version! Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe C:\Program Files\Common Files\soft602\pdfSaver.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\system32\drivers\dcfssvc.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\ZipCentral\ZCentral.exe C:\DOCUME~1\Nick\LOCALS~1\Temp\_ZCTmp.Dir\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe O4 - HKLM\..\Run: [602PC SUITE PDF Saver] "C:\Program Files\Common Files\soft602\pdfSaver.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE" O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh309190.dll/201 O14 - IERESET.INF: START_PAGE_URL=http://www.futureshop.ca O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/CA/install.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe O16 - DPF: {525A15D0-4938-11D4-94C7-0050DA20189B} - http://www.easports.com/downloads/ga...y/iesnoopy.cab O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v6.cab O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

01-08-2006, 03:08 PM	#13 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 23,238 OS: N/A	Your system is clean. Have you patched yourself against the WMF exploit yet? If not, please refer to my sig. Kindly follow these simple steps in order to keep your computer clean and secure: CLEAR & RESET SYSTEM RESTORE'S CACHE - (System Volume Information folder) Go to Start >> Run - type control sysdm.cpl,,4 & press Enter Tick on the checkbox - Turn off System Restore on all drives Click Apply Turn it back 'On' by unticking the same checkbox & click OK DISABLE THE VIEWING OF SYSTEM FILES From Windows Explorer, go to Tools>Folder Options> View tab. Untick - Show hidden files and folder Tick - Hide file extensions for known types Tick - Hide protected operating system files Click Yes to confirm & then click OK SECURING INTERNET EXPLORER From within Internet Explorer click on the Tools menu and then click on Internet Options. Select the Security tab Click once on the Internet icon so it becomes highlighted. Select Custom Level . Change 'Download signed ActiveX controls' to Prompt Change 'Download unsigned ActiveX controls' to Disable Change 'Initialize and script ActiveX controls not marked as safe' to Disable Change 'Installation of desktop items' to Prompt Change 'Launching programs and files in an IFRAME' to Prompt Change 'Navigate sub-frames across different domains' to Prompt When all these changes have been made, click on the OK button. If it prompts you as to whether or not you want to save the settings, press the Yes button. Select OK to exit the Internet Properties page. ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some online & their stand-alone antivirus programs: Virus, Spyware, and Malware Protection and Removal Resources It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out. FIREWALL Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here. Microsoft Windows Update Visit windowsupdate.com regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates. SPYBOT - SEARCH & DESTROY Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here AD-AWARE Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here SPYWAREBLASTER SpywareBlaster prevents the installation of malicious ActiveX, adware, browser hijackers, dialers, and other potentially unwanted software. Blocks spyware/tracking cookies & restricts the actions of potentially unwanted sites. Unlike other programs, SpywareBlaster does not have to remain running in the background. A tutorial on installing & using this product can be found here IE-SPYAD IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here MVPS HOST FILE The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. It can be downloaded here - MVPS Hosts file Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety. Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN) Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness. Sun's Java - It's much more secure than Microsoft's Java Virtual Machine. Google Toolbar - Get the free google toolbar to help stop pop up windows. CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders. ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT. ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry. NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster. Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer from malicious software To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day. Please respond to this thread one more time so we can mark this thread as resolved. __________________

01-08-2006, 03:21 PM	#14 (permalink)
chomedeylaval Registered User Join Date: Jan 2006 Posts: 9 OS: XP/SvcPack2	OMG What a diffrence. You have brought back my computer. I thank you Nick