HJT Log

hjt log and then bitdefender log::


Logfile of HijackThis v1.99.1
Scan saved at 7:46:21 PM, on 9/4/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender Professional Edition\vsserv.exe
C:\WINDOWS\system32\sstray.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\DAP\DAP.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
G:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Silicon Image\SiISATARaid\SATARaid.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMdtr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\hjt\HijackThis.exe

O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: (no name) - {a43385f0-7113-496d-96d7-b9b550e3fcca} - C:\WINDOWS\system32\ixt0.dll (file missing)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - G:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - G:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Safety Bar - {052b12f7-86fa-4921-8482-26c42316b522} - C:\Program Files\Safety Bar\Safety Bar.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] G:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title= "CorelDRAW Graphics Suite 12" /date=091606 serial=dr12wex-1504397-kty lang=EN
O4 - HKLM\..\Run: [b27e07b6.exe] C:\WINDOWS\system32\b27e07b6.exe
O4 - HKLM\..\Run: [TrojanScanner] i:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\PROGRA~1\Softwin\BITDEF~1\bdnagent.exe
O4 - HKLM\..\Run: [BDSwitchAgent] C:\Program Files\Softwin\BitDefender Professional Edition\bdswitch.exe
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe "
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [b27e07b6.exe] C:\Documents and Settings\kula\Local Settings\Application Data\b27e07b6.exe
O4 - Global Startup: Acrobat Assistant.lnk = G:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SATARaid.lnk = ?
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{55DE5D3A-3C71-4483-8EA9-A97C6ADED59C}: NameServer = 81.93.64.1 81.83.64.9
O20 - Winlogon Notify: msldr32 - msldr32.dll (file missing)
O20 - Winlogon Notify: wingho32 - wingho32.dll (file missing)
O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - C:\WINDOWS\system32\urroxtl.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender Professional Edition\vsserv.exe" /service (file missing)
O23 - Service: Windows Log - Unknown owner - C:\WINDOWS\system32\nvsvcd.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

 

bitdefender log::




//-----------------------------------------------------------------
//
// Product: BitDefender Professional Edition v7.2
// Version: (no ver)
//
// Created on: 04/09/2006 17:16:07
//
//-----------------------------------------------------------------


Statistics

Scan path : C:\
D:\
G:\
H:\
I:\
J:\
Folders : 7563
Files : 515493
Archives : 2266
Packed files : 91516
Identified viruses : 21
Infected files : 147
Warnings : 0
Suspect files : 0
Disinfected files : 0
Deleted files : 33
Copied files : 0
Moved files : 62
Renamed files : 0
I/O errors : 45
Scan time : 01:31:40
Scan speed (files/sec) : 93

Virus definitions : 452403
Scan plugins : 13
Archive plugins : 38
Unpack plugins : 6
Mail plugins : 6
System plugins : 1

Scan options

Detection
[X] Scan boot sectors
[X] Scan archives
[X] Scan packed files
[X] Scan email

File mask
[ ] Programs
[X] All files
[ ] User defined extensions:
[ ] Exclude extensions: ;

Action

Infected objects
[ ] Ignore
[X] Disinfect
[ ] Delete
[ ] Copy to quarantine
[ ] Move to quarantine
[ ] Rename
[ ] Prompt user

Second action
[ ] Ignore
[ ] Delete
[ ] Copy to quarantine
[X] Move to quarantine
[ ] Rename
[ ] Prompt user

Scan options
[X] Enable warnings
[X] Enable heuristics
[ ] Show all files in log
[X] Report file: vscan.log
[ ] Append to existing report

Summary:

C:\Documents and Settings\kula\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst=>[Subject: YOUR ACCOUNT (LIMITED ACCESS TT-022-421-683)][From: PayPal Account Review Department]=>TT-022-421-683.zip=>TT-022-421-683.exe Infected Trojan.Downloader.Agent.AUM
C:\Documents and Settings\kula\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst=>[Subject: YOUR ACCOUNT (LIMITED ACCESS TT-022-421-683)][From: PayPal Account Review Department]=>TT-022-421-683.zip=>TT-022-421-683.exe Disinfection failed
C:\Documents and Settings\kula\Local Settings\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\Cache\72E981EDd01 Infected Trojan.Spy.Agent.AB
C:\Documents and Settings\kula\Local Settings\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\Cache\72E981EDd01 Disinfection failed
C:\Documents and Settings\kula\Local Settings\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\Cache\72E981EDd01 Moved
C:\Documents and Settings\kula\Local Settings\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\Cache\94FEAA35d01 Infected Trojan.Spy.Agent.AB
C:\Documents and Settings\kula\Local Settings\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\Cache\94FEAA35d01 Disinfection failed
C:\Documents and Settings\kula\Local Settings\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\Cache\94FEAA35d01 Moved
C:\Documents and Settings\kula\Local Settings\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\Cache\CD5544FEd01 Infected Trojan.Spy.Agent.AB
C:\Documents and Settings\kula\Local Settings\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\Cache\CD5544FEd01 Disinfection failed
C:\Documents and Settings\kula\Local Settings\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\Cache\CD5544FEd01 Moved
C:\Documents and Settings\kula\Local Settings\Temp\mst227.tmp Infected Trojan.Spy.Agent.AB
C:\Documents and Settings\kula\Local Settings\Temp\mst227.tmp Disinfection failed
C:\Documents and Settings\kula\Local Settings\Temp\mst227.tmp Moved
C:\Documents and Settings\kula\Local Settings\Temp\mst233.tmp Infected Trojan.Spy.Agent.AB
C:\Documents and Settings\kula\Local Settings\Temp\mst233.tmp Disinfection failed
C:\Documents and Settings\kula\Local Settings\Temp\mst233.tmp Moved
C:\Documents and Settings\kula\Local Settings\Temp\mst47.tmp Infected Trojan.Spy.Agent.AB
C:\Documents and Settings\kula\Local Settings\Temp\mst47.tmp Disinfection failed
C:\Documents and Settings\kula\Local Settings\Temp\mst47.tmp Moved
C:\Documents and Settings\kula\Local Settings\Temp\mst4A.tmp Infected Trojan.Spy.Agent.AB
C:\Documents and Settings\kula\Local Settings\Temp\mst4A.tmp Disinfection failed
C:\Documents and Settings\kula\Local Settings\Temp\mst4A.tmp Moved
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\0TUBIFC5\srvmks[1].exe Infected Trojan.Downloader.Agent.XXX
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\0TUBIFC5\srvmks[1].exe Disinfection failed
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\0TUBIFC5\srvmks[1].exe Moved
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\0TUBIFC5\wlzip32[1].exe=>(NSIS o)=>lzma_solid_nsis0003 Infected Trojan.Starter.V
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\0TUBIFC5\wlzip32[1].exe=>(NSIS o)=>lzma_solid_nsis0003 Disinfection failed
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\0TUBIFC5\wlzip32[1].exe=>(NSIS o)=>lzma_solid_nsis0003 Move failed
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\AV09CHCZ\35[1].htm Infected Exploit.Html.Codebase.Exec.C
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\AV09CHCZ\35[1].htm Disinfection failed
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\AV09CHCZ\35[1].htm Moved
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\AV09CHCZ\srvbov[1].exe Infected Trojan.Downloader.Agent.XXX
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\AV09CHCZ\srvbov[1].exe Disinfection failed
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\AV09CHCZ\srvbov[1].exe Moved
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\GXOBE90H\35[1].htm Infected Exploit.Html.Codebase.Exec.C
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\GXOBE90H\35[1].htm Disinfection failed
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\GXOBE90H\35[1].htm Moved
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\GXOBE90H\bgates[1].exe Infected Trojan.Dialer.QO
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\GXOBE90H\bgates[1].exe Disinfection failed
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\GXOBE90H\bgates[1].exe Moved
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\GXOBE90H\wlzip32[1].exe Infected Trojan.Downloader.Agent.YL
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\GXOBE90H\wlzip32[1].exe Disinfection failed
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\GXOBE90H\wlzip32[1].exe Moved
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\OP2T4ZUH\35[1].htm Infected Exploit.Html.Codebase.Exec.C
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\OP2T4ZUH\35[1].htm Disinfection failed
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\OP2T4ZUH\35[1].htm Moved
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\OP2T4ZUH\srvcux[1].exe Infected Trojan.Downloader.Agent.XXX
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\OP2T4ZUH\srvcux[1].exe Disinfection failed
C:\Documents and Settings\kula\Local Settings\Temporary Internet Files\Content.IE5\OP2T4ZUH\srvcux[1].exe Moved
C:\Program Files\Common Files\{580C6A2D-0726-1033-0804-041022030001}\Update.exe Infected Trojan.Starter.V
C:\Program Files\Common Files\{580C6A2D-0726-1033-0804-041022030001}\Update.exe Disinfection failed
C:\Program Files\Common Files\{580C6A2D-0726-1033-0804-041022030001}\Update.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\00137AD4.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AE
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\00137AD4.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\00137AD4.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0452784E.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AE
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0452784E.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0452784E.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0FE2344C.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0FE2344C.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0FE2344C.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\1A6F66BE.exe=>(Quarantine-2) Infected Trojan.Downloader.Agent.YL
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\1A6F66BE.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\1A6F66BE.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\1B72704B.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\1B72704B.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\1B72704B.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\23111B4E.dll=>(Quarantine-2) Infected Trojan.Downloader.Small.CWS
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\23111B4E.dll=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\23111B4E.dll Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\236908ED.dll=>(Quarantine-2) Infected Trojan.Downloader.Small.CWS
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\236908ED.dll=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\236908ED.dll Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\285D0A2B.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AV
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\285D0A2B.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\285D0A2B.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\29421EC7.dll=>(Quarantine-2) Infected Trojan.Downloader.Small.CWS
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\29421EC7.dll=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\29421EC7.dll Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\29E577D3.tmp=>(Quarantine-2) Infected Trojan.Downloader.Inservice.LL
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\29E577D3.tmp=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\29E577D3.tmp Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\2F7D5C27.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\2F7D5C27.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\2F7D5C27.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\35D806A4.dll=>(Quarantine-2) Infected Trojan.Downloader.Small.CWS
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\35D806A4.dll=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\35D806A4.dll Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\367C57F8.EXE=>(Quarantine-2) Infected Joke.Winshoot.A
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\367C57F8.EXE=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\367C57F8.EXE Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\38C770F8.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AE
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\38C770F8.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\38C770F8.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\397C012C.exe=>(Quarantine-2) Infected Trojan.Downloader.Agent.YL
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\397C012C.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\397C012C.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3E891A4E.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AV
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3E891A4E.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3E891A4E.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43D6713E.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AV
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43D6713E.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43D6713E.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43D91B3B.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AE
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43D91B3B.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43D91B3B.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43DD4537.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AV
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43DD4537.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43DD4537.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43E06F34.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43E06F34.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43E06F34.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43E31930.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AV
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\

 

43E31930.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43E31930.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43E7432C.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AE
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43E7432C.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43E7432C.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43EA6D29.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43EA6D29.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\43EA6D29.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\44F06588.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\44F06588.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\44F06588.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A1A564D.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A1A564D.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A1A564D.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\50A81982.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AV
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\50A81982.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\50A81982.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\55AA124B.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AV
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\55AA124B.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\55AA124B.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\57C86B7D.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AV
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\57C86B7D.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\57C86B7D.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\5D352753.exe=>(Quarantine-2) Infected Trojan.Downloader.InService.TW
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\5D352753.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\5D352753.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\5D414EAA.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AE
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\5D414EAA.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\5D414EAA.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\613A4E4A.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\613A4E4A.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\613A4E4A.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\78F228D8.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\78F228D8.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\78F228D8.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7CB94928.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7CB94928.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7CB94928.exe Moved
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7DB81920.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7DB81920.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7DB81920.exe Moved
C:\Program Files\Safety Bar\Uninstall.bat Infected Adware.Safetybar.B
C:\Program Files\Safety Bar\Uninstall.bat Disinfection failed
C:\Program Files\Safety Bar\Uninstall.bat Moved
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\00137AD4.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AE
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\00137AD4.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\00137AD4.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\0452784E.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AE
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\0452784E.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\0452784E.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\0FE2344C.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\0FE2344C.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\0FE2344C.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\1A6F66BE.exe=>(Quarantine-2) Infected Trojan.Downloader.Agent.YL
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\1A6F66BE.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\1A6F66BE.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\1B72704B.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\1B72704B.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\1B72704B.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\23111B4E.dll=>(Quarantine-2) Infected Trojan.Downloader.Small.CWS
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\23111B4E.dll=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\23111B4E.dll Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\236908ED.dll=>(Quarantine-2) Infected Trojan.Downloader.Small.CWS
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\236908ED.dll=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\236908ED.dll Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\285D0A2B.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AV
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\285D0A2B.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\285D0A2B.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\29421EC7.dll=>(Quarantine-2) Infected Trojan.Downloader.Small.CWS
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\29421EC7.dll=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\29421EC7.dll Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\29E577D3.tmp=>(Quarantine-2) Infected Trojan.Downloader.Inservice.LL
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\29E577D3.tmp=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\29E577D3.tmp Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\2F7D5C27.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\2F7D5C27.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\2F7D5C27.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\35D806A4.dll=>(Quarantine-2) Infected Trojan.Downloader.Small.CWS
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\35D806A4.dll=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\35D806A4.dll Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\35[1].htm Infected Exploit.Html.Codebase.Exec.C
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\35[1].htm Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\35[1].htm Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\367C57F8.EXE=>(Quarantine-2) Infected Joke.Winshoot.A
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\367C57F8.EXE=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\367C57F8.EXE Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\38C770F8.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AE
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\38C770F8.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\38C770F8.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\397C012C.exe=>(Quarantine-2) Infected Trojan.Downloader.Agent.YL
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\397C012C.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\397C012C.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\3E891A4E.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AV
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\3E891A4E.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\3E891A4E.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43D6713E.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AV
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43D6713E.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43D6713E.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43D91B3B.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AE
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43D91B3B.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43D91B3B.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43DD4537.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AV
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43DD4537.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43DD4537.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43E06F34.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43E06F34.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43E06F34.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43E31930.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AV
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43E31930.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43E31930.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43E7432C.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AE
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43E7432C.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43E7432C.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43EA6D29.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43EA6D29.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\43EA6D29.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\44F06588.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\44F06588.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\44F06588.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\4A1A564D.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\4A1A564D.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\4A1A564D.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\50A81982.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AV
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\50A81982.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\50A81982.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\55AA124B.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AV
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\55AA124B.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\55AA124B.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\57C86B7D.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AV
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\57C86B7D.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\57C86B7D.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\5D352753.exe=>(Quarantine-2) Infected Trojan.Downloader.InService.TW
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\5D352753.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\5D352753.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\5D414EAA.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AE
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\5D414EAA.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\5D414EAA.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\613A4E4A.exe=>(Quarantine-2) Infected Trojan.Proxy.Horst.AN
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\613A4E4A.exe=>(Quarantine-2) Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\613A4E4A.exe Move failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\72E981EDd01 Infected Trojan.Spy.Agent.AB
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\72E981EDd01 Disinfection failed
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\72E981EDd01 Move failed

 

Hi qure and welcome to WindowsBBS forums.

What you have there ia a SmithFraud\Zlob infection and some other bits of malware.

Lets run the first part of the removal process and another file locating tool as well.

Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter "; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool "; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore you may get an alert.

If you are required a reboot, sometimes the tool requires that, please run the following tool.

Download combofix.exe

• Double click combofix.exe & follow the prompts.
• When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

After the SmithFraud and Combofix have been run, please give me a fresh HJT log file along with the other logs pasted back into this thread.

 

here it is...tata

Logfile of HijackThis v1.99.1
Scan saved at 10:30:49 PM, on 9/4/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\sstray.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\DAP\DAP.EXE
C:\PROGRA~1\SYMNET~1\SNDMon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
G:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Silicon Image\SiISATARaid\SATARaid.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender Professional Edition\vsserv.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\MsiExec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\MsiExec.exe
C:\hjt\HijackThis.exe

O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {a43385f0-7113-496d-96d7-b9b550e3fcca} - C:\WINDOWS\system32\ixt0.dll (file missing)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - G:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] G:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title= "CorelDRAW Graphics Suite 12" /date=091606 serial=dr12wex-1504397-kty lang=EN
O4 - HKLM\..\Run: [b27e07b6.exe] C:\WINDOWS\system32\b27e07b6.exe
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\PROGRA~1\Softwin\BITDEF~1\bdnagent.exe
O4 - HKLM\..\Run: [BDSwitchAgent] C:\Program Files\Softwin\BitDefender Professional Edition\bdswitch.exe
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe "
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [b27e07b6.exe] C:\Documents and Settings\kula\Local Settings\Application Data\b27e07b6.exe
O4 - Global Startup: Acrobat Assistant.lnk = G:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SATARaid.lnk = ?
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: msldr32 - msldr32.dll (file missing)
O20 - Winlogon Notify: wingho32 - wingho32.dll (file missing)
O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - C:\WINDOWS\system32\urroxtl.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender Professional Edition\vsserv.exe" /service (file missing)
O23 - Service: Windows Log - Unknown owner - C:\WINDOWS\system32\nvsvcd.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

 

kula - 06-09-04 22:25:56.64
ComboFix 06.09.04BT - Running from: C:\Documents and Settings\kula\Desktop

Microsoft Windows XP [Version 5.1.2600]

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\components
C:\Program Files\Common Files\{580C6A2D-0726-1033-0804-041022030001}
C:\Program Files\Safety Bar


((((((((((((((((((((((((((((((( Files Created from 2006-08-04 to 2006-09-04 ))))))))))))))))))))))))))))))))))


2006-09-04 22:24 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-09-04 22:24 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-09-04 22:24 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-09-04 22:24 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-09-04 19:22 299,520 --a------ C:\WINDOWS\uninst.exe
2006-09-04 19:16 21,312 --a------ C:\WINDOWS\choice.exe
2006-09-04 17:29 90,112 --a------ C:\WINDOWS\unvise32.exe
2006-08-31 12:27 37,376 --a------ C:\WINDOWS\system32\hpz3l3xu.dll
2006-08-31 12:26 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2006-08-31 12:26 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2006-08-31 12:26 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2006-08-31 12:26 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2006-08-31 12:26 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2006-08-31 12:26 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2006-08-25 14:58 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2006-08-21 12:40 49,152 --a------ C:\WINDOWS\system32\nvsvcd.exe
2006-08-21 09:06 306,688 --a------ C:\WINDOWS\IsUninst.exe
2006-08-19 09:41 245,248 --a------ C:\WINDOWS\UNINST16.EXE
2006-08-18 21:45 50,688 --a------ C:\WINDOWS\system32\wbhelp2.dll
2006-08-18 21:35 569,344 --a------ C:\WINDOWS\system32\imagr5.dll
2006-08-18 21:35 544,768 --a------ C:\WINDOWS\system32\imagx5.dll
2006-08-18 21:35 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2006-08-18 21:35 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll
2006-08-18 21:35 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2006-08-18 21:35 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2006-08-18 21:06 91,904 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2006-08-18 20:51 4,274,816 --a------ C:\WINDOWS\system32\nv4_disp.dll
2006-08-18 20:51 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2006-08-18 20:50 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2006-08-18 20:49 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2006-08-18 20:49 7,168 -ra------ C:\WINDOWS\system32\kbdcz.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdycl.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdsl1.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdsl.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdpl.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdhu.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdcz2.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdcz1.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdcr.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\KBDAL.DLL
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdycc.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbduzb.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdur.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdtat.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdru1.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdru.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdro.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdpl1.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdkaz.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdhu1.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdbu.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdblr.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdaze.dll
2006-08-18 20:48 85,020 --a------ C:\WINDOWS\system32\dgsetup.dll
2006-08-18 20:48 8,704 --a------ C:\WINDOWS\system32\batt.dll
2006-08-18 20:48 74,752 --a------ C:\WINDOWS\system32\storprop.dll
2006-08-18 20:48 69,120 --a------ C:\WINDOWS\NOTEPAD.EXE
2006-08-18 20:48 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2006-08-18 20:48 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2006-08-18 20:48 15,360 --a------ C:\WINDOWS\TASKMAN.EXE
2006-08-18 20:48 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2006-08-18 20:48 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll
2006-08-18 20:05 16,384 --a------ C:\WINDOWS\system32\FileOps.exe
2006-08-18 19:42 462,848 --a------ C:\WINDOWS\sm56hlpr.exe
2006-08-18 19:42 327,680 --a------ C:\WINDOWS\sm56set.exe
2006-08-18 19:42 245,760 --a------ C:\WINDOWS\sm56unst.exe
2006-08-18 19:18 94,208 --a------ C:\WINDOWS\system32\NVUninst.exe
2006-08-18 19:18 61,440 -ra------ C:\WINDOWS\system32\SStrmZHT.dll
2006-08-18 19:18 509,984 -ra------ C:\WINDOWS\50comupd.exe
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplZHT.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplZHC.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplTR.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplTH.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplSV.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplSL.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplSK.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplRU.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplPTB.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplPT.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplPL.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplNO.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplNL.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplKO.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplJA.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplIT.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplHU.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplHE.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplFR.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplFI.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplES.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplENG.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplEL.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplDE.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplDA.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplCS.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplAR.dll
2006-08-18 19:17 98,304 -ra------ C:\WINDOWS\system32\SStrmSK.dll
2006-08-18 19:17 98,304 -ra------ C:\WINDOWS\system32\SStrmPTB.dll
2006-08-18 19:17 98,304 -ra------ C:\WINDOWS\system32\SStrmDA.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmTR.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmTH.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmSV.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmPT.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmNO.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmFI.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\sstrmenu.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmENG.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmCS.dll
2006-08-18 19:17 90,112 -ra------ C:\WINDOWS\system32\SStrmSL.dll
2006-08-18 19:17 86,016 -ra------ C:\WINDOWS\system32\SStrmHE.dll
2006-08-18 19:17 86,016 -ra------ C:\WINDOWS\system32\SStrmAR.dll
2006-08-18 19:17 73,728 -ra------ C:\WINDOWS\system32\sstray.exe
2006-08-18 19:17 7,168 -ra------ C:\WINDOWS\system32\nvack.dll
2006-08-18 19:17 69,632 -ra------ C:\WINDOWS\system32\SStrmKO.dll
2006-08-18 19:17 69,632 -ra------ C:\WINDOWS\system32\SStrmJA.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraZHT.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraZHC.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraTR.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraTH.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraSV.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraSL.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraSK.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraRU.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraPTB.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraPT.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraPL.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraNO.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraNL.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraKO.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraJA.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraIT.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraHU.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraHE.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraFR.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraFI.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraES.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraENG.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraEL.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraDE.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraDA.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraCS.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraAR.dll
2006-08-18 19:17 57,344 -ra------ C:\WINDOWS\system32\SStrmZHC.dll
2006-08-18 19:17 5,120 -ra------ C:\WINDOWS\system32\ALut.dll
2006-08-18 19:17 491,599 -ra------ C:\WINDOWS\system32\sndstorm.exe
2006-08-18 19:17 46,592 -ra------ C:\WINDOWS\system32\nvopenal.dll
2006-08-18 19:17 29,696 -ra------ C:\WINDOWS\system32\nvasio.dll
2006-08-18 19:17 19,456 -ra------ C:\WINDOWS\system32\OpenAL32.dll
2006-08-18 19:17 126,976 -ra------ C:\WINDOWS\system32\nvuide.exe
2006-08-18 19:17 126,976 -ra------ C:\WINDOWS\system32\nvuautl.exe
2006-08-18 19:17 126,976 -ra------ C:\WINDOWS\system32\nvuaudio.exe
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmRU.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmPL.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmNL.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmIT.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmHU.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmFR.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmES.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmEL.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmDE.dll
2006-08-18 19:17 1,589,248 -ra------ C:\WINDOWS\system32\sstrmres.dll
2006-08-18 19:16 77,824 -ra------ C:\WINDOWS\system32\nvugart.exe
2006-08-18 19:16 77,824 -ra------ C:\WINDOWS\system32\nvuenet.exe
2006-08-18 19:16 77,824 --------- C:\WINDOWS\system32\nvusmb.exe
2006-08-18 19:01 0 -rahs---- C:\MSDOS.SYS
2006-08-18 19:01 0 -rahs---- C:\IO.SYS
2006-08-18 19:01 0 --a------ C:\CONFIG.SYS
2006-08-18 19:01 0 --a------ C:\AUTOEXEC.BAT
2006-08-18 19:00 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2006-08-18 18:58 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll
2006-08-18 18:58 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2006-08-18 18:58 64,512 --a------ C:\WINDOWS\system32\acctres.dll
2006-08-18 18:58 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll
2006-08-18 18:58 465,176 --a------ C:\WINDOWS\system32\wuapi.dll
2006-08-18 18:58 45,568 --a------ C:\WINDOWS\system32\safrslv.dll
2006-08-18 18:58 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2006-08-18 18:58 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll
2006-08-18 18:58 41,240 --a------ C:\WINDOWS\system32\wups.dll
2006-08-18 18:58 382,464 --a------ C:\WINDOWS\system32\qmgr.dll
2006-08-18 18:58 29,696 --a------ C:\WINDOWS\system32\safrdm.dll
2006-08-18 18:58 194,328 --a------ C:\WINDOWS\system32\wuaueng1.dll
2006-08-18 18:58 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2006-08-18 18:58 173,536 --a------ C:\WINDOWS\system32\wuweb.dll
2006-08-18 18:58 172,312 --a------ C:\WINDOWS\system32\wuauclt1.exe
2006-08-18 18:58 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2006-08-18 18:58 127,256 --a------ C:\WINDOWS\system32\wucltui.dll
2006-08-18 18:58 124,184 --a------ C:\WINDOWS\system32\wuauclt.exe
2006-08-18 18:58 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2006-08-18 18:58 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2006-08-18 18:58 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll
2006-08-18 18:57 81,920 --a------ C:\WINDOWS\system32\isign32.dll
2006-08-18 18:57 81,920 --a------ C:\WINDOWS\system32\ils.dll
2006-08-18 18:57 73,728 --a------ C:\WINDOWS\system32\icwdial.dll
2006-08-18 18:57 69,632 --a------ C:\WINDOWS\system32\msconf.dll
2006-08-18 18:57 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-08-18 18:57 67,584 --a------ C:\WINDOWS\system32\srclient.dll
2006-08-18 18:57 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll
2006-08-18 18:57 48,128 --a------ C:\WINDOWS\system32\inetres.dll
2006-08-18 18:57 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll
2006-08-18 18:57 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2006-08-18 18:57 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll
2006-08-18 18:57 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll
2006-08-18 18:57 274,944 --a------ C:\WINDOWS\system32\mstask.dll
2006-08-18 18:57 274,432 --a------ C:\WINDOWS\system32\inetcfg.dll
2006-08-18 18:57 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll
2006-08-18 18:57 239,104 --a------ C:\WINDOWS\system32\srrstr.dll
2006-08-18 18:57 22,528 --a------ C:\WINDOWS\system32\fltMc.exe
2006-08-18 18:57 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll
2006-08-18 18:57 170,496 --a------ C:\WINDOWS\system32\srsvc.dll
2006-08-18 18:57 16,896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-18 18:57 12,288 --a------ C:\WINDOWS\system32\mstinit.exe
2006-08-18 18:57 105,984 --a------ C:\WINDOWS\system32\msoert2.dll
2006-08-18 18:56 9,728 --a------ C:\WINDOWS\system32\reset.exe
2006-08-18 18:56 82,432 --a------ C:\WINDOWS\system32\comrepl.dll
2006-08-18 18:56 80,384 --a------ C:\WINDOWS\system32\charmap.exe
2006-08-18 18:56 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2006-08-18 18:56 605,696 --a------ C:\WINDOWS\system32\getuname.dll
2006-08-18 18:56 56,832 --a------ C:\WINDOWS\system32\sol.exe
2006-08-18 18:56 55,296 --a------ C:\WINDOWS\system32\freecell.exe
2006-08-18 18:56 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2006-08-18 18:56 5,632 --a------ C:\WINDOWS\system32\write.exe
2006-08-18 18:56 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2006-08-18 18:56 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2006-08-18 18:56 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2006-08-18 18:56 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2006-08-18 18:56 35,328 --a------ C:\WINDOWS\system32\winchat.exe
2006-08-18 18:56 33,792 --a------ C:\WINDOWS\system32\regini.exe

 

2006-08-18 18:56 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2006-08-18 18:56 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2006-08-18 18:56 227,840 --a------ C:\WINDOWS\system32\avtapi.dll
2006-08-18 18:56 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe
2006-08-18 18:56 20,992 --a------ C:\WINDOWS\system32\msg.exe
2006-08-18 18:56 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2006-08-18 18:56 16,896 --a------ C:\WINDOWS\system32\tsshutdn.exe
2006-08-18 18:56 16,896 --a------ C:\WINDOWS\system32\qappsrv.exe
2006-08-18 18:56 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2006-08-18 18:56 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2006-08-18 18:56 15,872 --a------ C:\WINDOWS\system32\rwinsta.exe
2006-08-18 18:56 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2006-08-18 18:56 15,360 --a------ C:\WINDOWS\system32\logoff.exe
2006-08-18 18:56 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2006-08-18 18:56 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe
2006-08-18 18:56 14,848 --a------ C:\WINDOWS\system32\tscon.exe
2006-08-18 18:56 14,848 --a------ C:\WINDOWS\system32\shadow.exe
2006-08-18 18:56 138,752 --a------ C:\WINDOWS\system32\sndvol32.exe
2006-08-18 18:56 126,976 --a------ C:\WINDOWS\system32\mshearts.exe
2006-08-18 18:56 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2006-08-18 18:56 114,688 --a------ C:\WINDOWS\system32\calc.exe
2006-08-18 18:56 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd
2006-08-18 18:55 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll
2006-08-18 18:55 93,696 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2006-08-18 18:55 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll
2006-08-18 18:55 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll
2006-08-18 18:55 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2006-08-18 18:55 67,072 --a------ C:\WINDOWS\system32\rdshost.exe
2006-08-18 18:55 655,360 --a------ C:\WINDOWS\system32\mstscax.dll
2006-08-18 18:55 628,224 --a------ C:\WINDOWS\system32\catsrvut.dll
2006-08-18 18:55 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe
2006-08-18 18:55 62,464 --a------ C:\WINDOWS\system32\colbact.dll
2006-08-18 18:55 60,416 --a------ C:\WINDOWS\system32\remotepg.dll
2006-08-18 18:55 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2006-08-18 18:55 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll
2006-08-18 18:55 58,880 --a------ C:\WINDOWS\system32\licwmi.dll
2006-08-18 18:55 56,320 --a------ C:\WINDOWS\system32\servdeps.dll
2006-08-18 18:55 540,160 --a------ C:\WINDOWS\system32\comuid.dll
2006-08-18 18:55 538,624 --a------ C:\WINDOWS\system32\spider.exe
2006-08-18 18:55 501,248 --a------ C:\WINDOWS\system32\clbcatq.dll
2006-08-18 18:55 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe
2006-08-18 18:55 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll
2006-08-18 18:55 407,552 --a------ C:\WINDOWS\system32\mstsc.exe
2006-08-18 18:55 38,912 --a------ C:\WINDOWS\system32\cfgbkend.dll
2006-08-18 18:55 347,136 --a------ C:\WINDOWS\system32\hypertrm.dll
2006-08-18 18:55 343,040 --a------ C:\WINDOWS\system32\mspaint.exe
2006-08-18 18:55 295,424 --a------ C:\WINDOWS\system32\termsrv.dll
2006-08-18 18:55 229,888 --a------ C:\WINDOWS\system32\catsrv.dll
2006-08-18 18:55 20,480 --a------ C:\WINDOWS\system32\qprocess.exe
2006-08-18 18:55 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll
2006-08-18 18:55 185,344 --a------ C:\WINDOWS\system32\cmprops.dll
2006-08-18 18:55 183,808 --a------ C:\WINDOWS\system32\accwiz.exe
2006-08-18 18:55 17,408 --a------ C:\WINDOWS\system32\mmfutil.dll
2006-08-18 18:55 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2006-08-18 18:55 147,968 --a------ C:\WINDOWS\system32\rdchost.dll
2006-08-18 18:55 140,800 --a------ C:\WINDOWS\system32\sessmgr.exe
2006-08-18 18:55 131,584 --a------ C:\WINDOWS\system32\sndrec32.exe
2006-08-18 18:55 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe
2006-08-18 18:55 123,392 --a------ C:\WINDOWS\system32\mplay32.exe
2006-08-18 18:55 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll
2006-08-18 18:55 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll
2006-08-18 18:55 11,264 --a------ C:\WINDOWS\system32\icaapi.dll
2006-08-18 18:55 102,912 --a------ C:\WINDOWS\system32\clipbrd.exe
2006-08-18 18:55 1,251,840 --a------ C:\WINDOWS\system32\comsvcs.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-04 22:27 -------- d-------- C:\Program Files\Common Files\Symantec Shared
2006-09-04 22:26 -------- d-------- C:\Program Files\Common Files
2006-09-04 22:20 -------- d-------- C:\Program Files\Symantec
2006-09-04 22:19 -------- d-------- C:\Program Files\Common Files\Adobe
2006-09-04 22:18 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-09-04 21:16 -------- d-------- C:\Program Files\Windows Media Player
2006-09-04 20:57 -------- d-------- C:\Program Files\Mozilla Firefox
2006-09-04 19:23 -------- d-------- C:\Program Files\BillP Studios
2006-09-04 19:23 -------- d-------- C:\Documents and Settings\kula\Application Data\WinPatrol
2006-09-04 17:28 -------- d-------- C:\Program Files\DivX
2006-09-04 17:20 -------- d-------- C:\Program Files\Webteh
2006-09-04 16:54 -------- d-------- C:\Program Files\ffdshow
2006-09-04 16:38 73728 --a------ C:\WINDOWS\system32\sockspy.dll
2006-09-04 16:26 -------- d-------- C:\Documents and Settings\kula\Application Data\Help
2006-09-04 16:07 -------- d-------- C:\Program Files\Softwin
2006-09-04 16:07 -------- d-------- C:\Program Files\Common Files\Softwin
2006-09-04 15:09 -------- d-------- C:\Program Files\Outlook Express
2006-09-04 15:09 -------- d-------- C:\Program Files\Common Files\System
2006-09-04 09:53 -------- d-------- C:\Documents and Settings\kula\Application Data\Adobe
2006-09-01 17:20 -------- d-------- C:\Program Files\CyberLink
2006-09-01 13:00 -------- d-------- C:\Documents and Settings\kula\Application Data\Corel
2006-09-01 12:59 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-08-31 13:49 -------- d-------- C:\Documents and Settings\kula\Application Data\AdobeUM
2006-08-31 12:30 -------- d-------- C:\Program Files\HP
2006-08-31 12:30 -------- d-------- C:\Program Files\Common Files\HP
2006-08-31 12:28 -------- d-------- C:\Program Files\Hewlett-Packard
2006-08-31 12:23 -------- d-------- C:\Documents and Settings\kula\Application Data\HP
2006-08-30 13:20 -------- d-------- C:\Program Files\Adobe
2006-08-30 11:26 -------- d-------- C:\Program Files\Common Files\Corel
2006-08-30 11:11 -------- d-------- C:\Program Files\Microsoft ActiveSync
2006-08-30 11:11 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-08-30 11:11 -------- d-------- C:\Program Files\Common Files\Designer
2006-08-30 11:05 -------- d-------- C:\Program Files\Microsoft Office
2006-08-30 10:22 -------- d-------- C:\Documents and Settings\kula\Application Data\Macromedia
2006-08-29 14:30 -------- d-------- C:\Program Files\QuickTime
2006-08-24 13:25 -------- d---s---- C:\Documents and Settings\kula\Application Data\Microsoft
2006-08-24 10:52 595632 --a------ C:\Documents and Settings\kula\Application Data\GDIPFONTCACHEV1.DAT
2006-08-24 08:21 -------- d-------- C:\Program Files\SymNetDrv
2006-08-20 13:29 -------- d-------- C:\Documents and Settings\kula\Application Data\Apple Computer
2006-08-19 15:13 -------- d-------- C:\Documents and Settings\kula\Application Data\CyberLink
2006-08-18 22:35 -------- d-------- C:\Documents and Settings\kula\Application Data\Mozilla
2006-08-18 21:50 -------- d-------- C:\Documents and Settings\kula\Application Data\Ahead
2006-08-18 21:46 -------- d-------- C:\Program Files\DAP
2006-08-18 21:44 -------- d-------- C:\Program Files\XviD
2006-08-18 21:43 -------- d-------- C:\Program Files\DivXCodec
2006-08-18 21:35 -------- d-------- C:\Program Files\Common Files\Ahead
2006-08-18 21:35 -------- d-------- C:\Program Files\Ahead
2006-08-18 21:27 -------- d-------- C:\Program Files\WinRAR
2006-08-18 21:22 -------- d-------- C:\Documents and Settings\kula\Application Data\Symantec
2006-08-18 21:18 -------- d-------- C:\Program Files\Winamp
2006-08-18 21:00 -------- d-------- C:\Program Files\Lavasoft
2006-08-18 21:00 -------- d-------- C:\Documents and Settings\kula\Application Data\Lavasoft
2006-08-18 20:49 -------- d-------- C:\Program Files\Common Files\SpeechEngines
2006-08-18 20:49 -------- d-------- C:\Program Files\Common Files\ODBC
2006-08-18 20:48 62 --ahs---- C:\Documents and Settings\kula\Application Data\desktop.ini
2006-08-18 20:21 -------- d-------- C:\Program Files\ABBYY FineReader 6.0
2006-08-18 20:20 -------- d-------- C:\Documents and Settings\kula\Application Data\ABBYY
2006-08-18 19:55 -------- d-------- C:\Program Files\Common Files\Adobe Systems Shared
2006-08-18 19:45 -------- d-------- C:\Program Files\Marvell
2006-08-18 19:23 -------- d-------- C:\Program Files\Silicon Image
2006-08-18 19:06 -------- d--h----- C:\Program Files\Uninstall Information
2006-08-18 19:06 -------- d-------- C:\Documents and Settings\kula\Application Data\Identities
2006-08-18 19:01 -------- d-------- C:\Program Files\xerox
2006-08-18 19:01 -------- d-------- C:\Program Files\microsoft frontpage
2006-08-18 18:59 -------- d--h----- C:\Program Files\WindowsUpdate
2006-08-18 18:59 -------- d-------- C:\Program Files\Internet Explorer
2006-08-18 18:58 -------- d-------- C:\Program Files\NetMeeting
2006-08-18 18:58 -------- d-------- C:\Program Files\Movie Maker
2006-08-18 18:58 -------- d-------- C:\Program Files\Common Files\Services
2006-08-18 18:58 -------- d-------- C:\Program Files\Common Files\MSSoap
2006-08-18 18:56 -------- d-------- C:\Program Files\Windows NT
2006-08-18 18:56 -------- d-------- C:\Program Files\Online Services
2006-08-18 18:56 -------- d-------- C:\Program Files\MSN Gaming Zone
2006-08-18 18:56 -------- d-------- C:\Program Files\Messenger
2006-08-18 18:56 -------- d-------- C:\Program Files\ComPlus Applications
2006-08-18 18:55 -------- d-------- C:\Program Files\MSN
2006-07-21 10:24 72704 --a------ C:\WINDOWS\system32\hlink.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nForce Tray Options "= "sstray.exe /r "
"SMSERIAL "= "sm56hlpr.exe "
"WinampAgent "= "C:\\Program Files\\Winamp\\winampa.exe "
"NeroFilterCheck "= "C:\\WINDOWS\\system32\\NeroCheck.exe "
"DownloadAccelerator "= "C:\\PROGRA~1\\DAP\\DAP.EXE /STARTUP "
"Symantec NetDriver Monitor "= "C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer "
"HP Software Update "= "C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe "
"CorelDRAW Graphics Suite 11b "= "G:\\Program Files\\Corel\\Corel Graphics 12\\Languages\\EN\\Programs\\Registration.exe /title=\ "CorelDRAW Graphics Suite 12\" /date=091606 serial=dr12wex-1504397-kty lang=EN "
"b27e07b6.exe "= "C:\\WINDOWS\\system32\\b27e07b6.exe "
"BDMCon "= "C:\\PROGRA~1\\Softwin\\BITDEF~1\\bdmcon.exe "
"BDNewsAgent "= "C:\\PROGRA~1\\Softwin\\BITDEF~1\\bdnagent.exe "
"BDSwitchAgent "= "C:\\Program Files\\Softwin\\BitDefender Professional Edition\\bdswitch.exe "
"WinPatrol "= "\ "C:\\PROGRA~1\\BILLPS~1\\WINPAT~1\\WinPatrol.exe\" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed "= "1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed "= "1 "
"NoChange "= "1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed "= "1 "

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS "= "\ "C:\\Program Files\\Messenger\\msmsgs.exe\" /background "
"CTFMON.EXE "= "C:\\WINDOWS\\system32\\ctfmon.exe "
"b27e07b6.exe "= "C:\\Documents and Settings\\kula\\Local Settings\\Application Data\\b27e07b6.exe "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce]
"isDeleteMe "= "\ "C:\\WINDOWS\\system32\\cmd.exe\" /c \ "C:\\DOCUME~1\\kula\\LOCALS~1\\Temp\\isDel.bat\" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername "=dword:00000000
"legalnoticecaption "=" "
"legalnoticetext "=" "
"shutdownwithoutlogon "=dword:00000001
"undockwithoutlogon "=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion "=dword:00000110
"DeskHtmlMinorVersion "=dword:00000005
"Settings "=dword:00000001
"GeneralFlags "=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source "= "About:Home "
"SubscribedURL "= "About:Home "
"FriendlyName "= "My Current Home Page "
"Flags "=dword:00000002
"Position "=hex:2c,00,00,00,96,00,00,00,00,00,00,00,6a,04,00,00,c6,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState "=hex:04,00,00,40
"OriginalStateInfo "=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo "=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972} "=" "

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\msldr32
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wingho32


Completion time: Mon 09/04/2006 22:27:54.89
ComboFix.txt

 

SmitFraudFix v2.83

Scan done at 22:24:26.57, Mon 09/04/2006
Run from C:\Documents and Settings\kula\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\ot.ico FOUND !
C:\WINDOWS\system32\ts.ico FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\kula\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\kula\FAVORI~1

C:\DOCUME~1\kula\FAVORI~1\Antivirus Test Online.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\Safety Bar\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source "= "About:Home "
"SubscribedURL "= "About:Home "
"FriendlyName "= "My Current Home Page "


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"incestuously "= "{03413bf7-e34c-445b-bfc0-a2b127255871} "



»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs "= "sockspy.dll "

»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

 

WOW!!

Tons of things there, tho some were cleaned up by CopmboFix. Lets run the second part of the SmithFraud removal along with a anti-spyware scan.

You should print out these instructions, or copy them to a Notepad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site. Please follow the instructions exactly in the order listed; this is very important!

Please download, install, and update the free version of Ewido Anti-Malware:

1. When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu ".
2. When you run Ewido for the first time, you will get a warning "Database could not be found! ". Click OK. We will fix this in a moment.
3. From the main Ewido screen, click on update in the left menu, then click the Start update button.
4. After the update finishes, the status bar at the bottom will display "Update successful "
5. Exit Ewido. DO NOT run a scan yet.

Reboot, into safe mode, this way:
Turn on the computer
Immediately begin tapping the F8 key.
Use the arrow keys to highlight Safe Mode and press the Enter key.

Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ? "; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter ".

The tool may need to restart your computer to finish the cleaning process. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.

AFTER SmitfraudFix finishes (and after a reboot if required), please open Ewido. (If a reboot is required, please boot BACK into Safe Mode.)

• Click on Scanner
• Click on Complete System Scan and the scan will begin.
• If ewido finds anything, it will pop up a notification. You can select "Remove" and check the boxes "Perform action with all infections" and "Create encrypted backup" before clicking on OK.
• When the scan is finished, click the Save report button at the bottom of the screen.
• Save the report to your desktop
• Close Ewido

Then please restart it into Normal Windows.

Once back into normal mode, run ComboFix first, then HJT and post both logs back into this thread along with the Ewido log.(pleasse edit out all cookie references).

 

here it is...

SmitFraudFix v2.83

Scan done at 21:31:31.43, Wed 09/06/2006
Run from I:\virualat\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

 

kula - 06-09-06 22:17:15.98
ComboFix 06.09.04BT - Running from: I:\virualat

Microsoft Windows XP [Version 5.1.2600]

((((((((((((((((((((((((((((((( Files Created from 2006-08-06 to 2006-09-06 ))))))))))))))))))))))))))))))))))


2006-09-04 22:24 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-09-04 22:24 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-09-04 22:24 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-09-04 22:24 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-09-04 19:22 299,520 --a------ C:\WINDOWS\uninst.exe
2006-09-04 19:16 21,312 --a------ C:\WINDOWS\choice.exe
2006-09-04 17:29 90,112 --a------ C:\WINDOWS\unvise32.exe
2006-08-31 12:27 37,376 --a------ C:\WINDOWS\system32\hpz3l3xu.dll
2006-08-31 12:26 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2006-08-31 12:26 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2006-08-31 12:26 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2006-08-31 12:26 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2006-08-31 12:26 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2006-08-31 12:26 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2006-08-25 14:58 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2006-08-21 12:40 49,152 --a------ C:\WINDOWS\system32\nvsvcd.exe
2006-08-21 09:06 306,688 --a------ C:\WINDOWS\IsUninst.exe
2006-08-19 09:41 245,248 --a------ C:\WINDOWS\UNINST16.EXE
2006-08-18 21:45 50,688 --a------ C:\WINDOWS\system32\wbhelp2.dll
2006-08-18 21:35 569,344 --a------ C:\WINDOWS\system32\imagr5.dll
2006-08-18 21:35 544,768 --a------ C:\WINDOWS\system32\imagx5.dll
2006-08-18 21:35 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2006-08-18 21:35 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll
2006-08-18 21:35 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2006-08-18 21:35 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2006-08-18 20:51 4,274,816 --a------ C:\WINDOWS\system32\nv4_disp.dll
2006-08-18 20:51 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2006-08-18 20:50 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2006-08-18 20:49 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2006-08-18 20:49 7,168 -ra------ C:\WINDOWS\system32\kbdcz.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdycl.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdsl1.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdsl.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdpl.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdhu.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdcz2.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdcz1.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdcr.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\KBDAL.DLL
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdycc.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbduzb.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdur.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdtat.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdru1.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdru.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdro.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdpl1.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdkaz.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdhu1.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdbu.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdblr.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdaze.dll
2006-08-18 20:48 85,020 --a------ C:\WINDOWS\system32\dgsetup.dll
2006-08-18 20:48 8,704 --a------ C:\WINDOWS\system32\batt.dll
2006-08-18 20:48 74,752 --a------ C:\WINDOWS\system32\storprop.dll
2006-08-18 20:48 69,120 --a------ C:\WINDOWS\NOTEPAD.EXE
2006-08-18 20:48 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2006-08-18 20:48 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2006-08-18 20:48 15,360 --a------ C:\WINDOWS\TASKMAN.EXE
2006-08-18 20:48 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2006-08-18 20:48 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll
2006-08-18 20:05 16,384 --a------ C:\WINDOWS\system32\FileOps.exe
2006-08-18 19:42 462,848 --a------ C:\WINDOWS\sm56hlpr.exe
2006-08-18 19:42 327,680 --a------ C:\WINDOWS\sm56set.exe
2006-08-18 19:42 245,760 --a------ C:\WINDOWS\sm56unst.exe
2006-08-18 19:18 94,208 --a------ C:\WINDOWS\system32\NVUninst.exe
2006-08-18 19:18 61,440 -ra------ C:\WINDOWS\system32\SStrmZHT.dll
2006-08-18 19:18 509,984 -ra------ C:\WINDOWS\50comupd.exe
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplZHT.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplZHC.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplTR.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplTH.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplSV.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplSL.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplSK.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplRU.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplPTB.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplPT.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplPL.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplNO.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplNL.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplKO.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplJA.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplIT.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplHU.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplHE.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplFR.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplFI.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplES.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplENG.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplEL.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplDE.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplDA.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplCS.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplAR.dll
2006-08-18 19:17 98,304 -ra------ C:\WINDOWS\system32\SStrmSK.dll
2006-08-18 19:17 98,304 -ra------ C:\WINDOWS\system32\SStrmPTB.dll
2006-08-18 19:17 98,304 -ra------ C:\WINDOWS\system32\SStrmDA.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmTR.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmTH.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmSV.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmPT.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmNO.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmFI.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\sstrmenu.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmENG.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmCS.dll
2006-08-18 19:17 90,112 -ra------ C:\WINDOWS\system32\SStrmSL.dll
2006-08-18 19:17 86,016 -ra------ C:\WINDOWS\system32\SStrmHE.dll
2006-08-18 19:17 86,016 -ra------ C:\WINDOWS\system32\SStrmAR.dll
2006-08-18 19:17 73,728 -ra------ C:\WINDOWS\system32\sstray.exe
2006-08-18 19:17 7,168 -ra------ C:\WINDOWS\system32\nvack.dll
2006-08-18 19:17 69,632 -ra------ C:\WINDOWS\system32\SStrmKO.dll
2006-08-18 19:17 69,632 -ra------ C:\WINDOWS\system32\SStrmJA.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraZHT.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraZHC.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraTR.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraTH.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraSV.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraSL.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraSK.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraRU.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraPTB.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraPT.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraPL.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraNO.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraNL.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraKO.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraJA.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraIT.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraHU.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraHE.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraFR.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraFI.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraES.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraENG.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraEL.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraDE.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraDA.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraCS.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraAR.dll
2006-08-18 19:17 57,344 -ra------ C:\WINDOWS\system32\SStrmZHC.dll
2006-08-18 19:17 5,120 -ra------ C:\WINDOWS\system32\ALut.dll
2006-08-18 19:17 491,599 -ra------ C:\WINDOWS\system32\sndstorm.exe
2006-08-18 19:17 46,592 -ra------ C:\WINDOWS\system32\nvopenal.dll
2006-08-18 19:17 29,696 -ra------ C:\WINDOWS\system32\nvasio.dll
2006-08-18 19:17 19,456 -ra------ C:\WINDOWS\system32\OpenAL32.dll
2006-08-18 19:17 126,976 -ra------ C:\WINDOWS\system32\nvuide.exe
2006-08-18 19:17 126,976 -ra------ C:\WINDOWS\system32\nvuautl.exe
2006-08-18 19:17 126,976 -ra------ C:\WINDOWS\system32\nvuaudio.exe
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmRU.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmPL.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmNL.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmIT.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmHU.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmFR.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmES.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmEL.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmDE.dll
2006-08-18 19:17 1,589,248 -ra------ C:\WINDOWS\system32\sstrmres.dll
2006-08-18 19:16 77,824 -ra------ C:\WINDOWS\system32\nvugart.exe
2006-08-18 19:16 77,824 -ra------ C:\WINDOWS\system32\nvuenet.exe
2006-08-18 19:16 77,824 --------- C:\WINDOWS\system32\nvusmb.exe
2006-08-18 19:01 0 -rahs---- C:\MSDOS.SYS
2006-08-18 19:01 0 -rahs---- C:\IO.SYS
2006-08-18 19:01 0 --a------ C:\CONFIG.SYS
2006-08-18 19:01 0 --a------ C:\AUTOEXEC.BAT
2006-08-18 19:00 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2006-08-18 18:58 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll
2006-08-18 18:58 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2006-08-18 18:58 64,512 --a------ C:\WINDOWS\system32\acctres.dll
2006-08-18 18:58 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll
2006-08-18 18:58 465,176 --a------ C:\WINDOWS\system32\wuapi.dll
2006-08-18 18:58 45,568 --a------ C:\WINDOWS\system32\safrslv.dll

 

2006-08-18 18:58 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2006-08-18 18:58 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll
2006-08-18 18:58 41,240 --a------ C:\WINDOWS\system32\wups.dll
2006-08-18 18:58 382,464 --a------ C:\WINDOWS\system32\qmgr.dll
2006-08-18 18:58 29,696 --a------ C:\WINDOWS\system32\safrdm.dll
2006-08-18 18:58 194,328 --a------ C:\WINDOWS\system32\wuaueng1.dll
2006-08-18 18:58 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2006-08-18 18:58 173,536 --a------ C:\WINDOWS\system32\wuweb.dll
2006-08-18 18:58 172,312 --a------ C:\WINDOWS\system32\wuauclt1.exe
2006-08-18 18:58 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2006-08-18 18:58 127,256 --a------ C:\WINDOWS\system32\wucltui.dll
2006-08-18 18:58 124,184 --a------ C:\WINDOWS\system32\wuauclt.exe
2006-08-18 18:58 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2006-08-18 18:58 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2006-08-18 18:58 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll
2006-08-18 18:57 81,920 --a------ C:\WINDOWS\system32\isign32.dll
2006-08-18 18:57 81,920 --a------ C:\WINDOWS\system32\ils.dll
2006-08-18 18:57 73,728 --a------ C:\WINDOWS\system32\icwdial.dll
2006-08-18 18:57 69,632 --a------ C:\WINDOWS\system32\msconf.dll
2006-08-18 18:57 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-08-18 18:57 67,584 --a------ C:\WINDOWS\system32\srclient.dll
2006-08-18 18:57 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll
2006-08-18 18:57 48,128 --a------ C:\WINDOWS\system32\inetres.dll
2006-08-18 18:57 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll
2006-08-18 18:57 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2006-08-18 18:57 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll
2006-08-18 18:57 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll
2006-08-18 18:57 274,944 --a------ C:\WINDOWS\system32\mstask.dll
2006-08-18 18:57 274,432 --a------ C:\WINDOWS\system32\inetcfg.dll
2006-08-18 18:57 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll
2006-08-18 18:57 239,104 --a------ C:\WINDOWS\system32\srrstr.dll
2006-08-18 18:57 22,528 --a------ C:\WINDOWS\system32\fltMc.exe
2006-08-18 18:57 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll
2006-08-18 18:57 170,496 --a------ C:\WINDOWS\system32\srsvc.dll
2006-08-18 18:57 16,896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-18 18:57 12,288 --a------ C:\WINDOWS\system32\mstinit.exe
2006-08-18 18:57 105,984 --a------ C:\WINDOWS\system32\msoert2.dll
2006-08-18 18:56 97,792 --a------ C:\WINDOWS\system32\comrepl.dll
2006-08-18 18:56 9,728 --a------ C:\WINDOWS\system32\reset.exe
2006-08-18 18:56 80,384 --a------ C:\WINDOWS\system32\charmap.exe
2006-08-18 18:56 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2006-08-18 18:56 605,696 --a------ C:\WINDOWS\system32\getuname.dll
2006-08-18 18:56 56,832 --a------ C:\WINDOWS\system32\sol.exe
2006-08-18 18:56 55,296 --a------ C:\WINDOWS\system32\freecell.exe
2006-08-18 18:56 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2006-08-18 18:56 5,632 --a------ C:\WINDOWS\system32\write.exe
2006-08-18 18:56 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2006-08-18 18:56 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2006-08-18 18:56 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2006-08-18 18:56 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2006-08-18 18:56 35,328 --a------ C:\WINDOWS\system32\winchat.exe
2006-08-18 18:56 33,792 --a------ C:\WINDOWS\system32\regini.exe
2006-08-18 18:56 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2006-08-18 18:56 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2006-08-18 18:56 227,840 --a------ C:\WINDOWS\system32\avtapi.dll
2006-08-18 18:56 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe
2006-08-18 18:56 20,992 --a------ C:\WINDOWS\system32\msg.exe
2006-08-18 18:56 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2006-08-18 18:56 16,896 --a------ C:\WINDOWS\system32\tsshutdn.exe
2006-08-18 18:56 16,896 --a------ C:\WINDOWS\system32\qappsrv.exe
2006-08-18 18:56 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2006-08-18 18:56 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2006-08-18 18:56 15,872 --a------ C:\WINDOWS\system32\rwinsta.exe
2006-08-18 18:56 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2006-08-18 18:56 15,360 --a------ C:\WINDOWS\system32\logoff.exe
2006-08-18 18:56 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2006-08-18 18:56 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe
2006-08-18 18:56 14,848 --a------ C:\WINDOWS\system32\tscon.exe
2006-08-18 18:56 14,848 --a------ C:\WINDOWS\system32\shadow.exe
2006-08-18 18:56 138,752 --a------ C:\WINDOWS\system32\sndvol32.exe
2006-08-18 18:56 126,976 --a------ C:\WINDOWS\system32\mshearts.exe
2006-08-18 18:56 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2006-08-18 18:56 114,688 --a------ C:\WINDOWS\system32\calc.exe
2006-08-18 18:56 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd
2006-08-18 18:55 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll
2006-08-18 18:55 93,696 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2006-08-18 18:55 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll
2006-08-18 18:55 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll
2006-08-18 18:55 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2006-08-18 18:55 67,072 --a------ C:\WINDOWS\system32\rdshost.exe
2006-08-18 18:55 655,360 --a------ C:\WINDOWS\system32\mstscax.dll
2006-08-18 18:55 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll
2006-08-18 18:55 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe
2006-08-18 18:55 60,416 --a------ C:\WINDOWS\system32\remotepg.dll
2006-08-18 18:55 60,416 --a------ C:\WINDOWS\system32\colbact.dll
2006-08-18 18:55 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2006-08-18 18:55 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll
2006-08-18 18:55 58,880 --a------ C:\WINDOWS\system32\licwmi.dll
2006-08-18 18:55 56,320 --a------ C:\WINDOWS\system32\servdeps.dll
2006-08-18 18:55 540,160 --a------ C:\WINDOWS\system32\comuid.dll
2006-08-18 18:55 538,624 --a------ C:\WINDOWS\system32\spider.exe
2006-08-18 18:55 498,688 --a------ C:\WINDOWS\system32\clbcatq.dll
2006-08-18 18:55 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe
2006-08-18 18:55 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll
2006-08-18 18:55 407,552 --a------ C:\WINDOWS\system32\mstsc.exe
2006-08-18 18:55 38,912 --a------ C:\WINDOWS\system32\cfgbkend.dll
2006-08-18 18:55 347,136 --a------ C:\WINDOWS\system32\hypertrm.dll
2006-08-18 18:55 343,040 --a------ C:\WINDOWS\system32\mspaint.exe
2006-08-18 18:55 295,424 --a------ C:\WINDOWS\system32\termsrv.dll
2006-08-18 18:55 225,792 --a------ C:\WINDOWS\system32\catsrv.dll
2006-08-18 18:55 20,480 --a------ C:\WINDOWS\system32\qprocess.exe
2006-08-18 18:55 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll
2006-08-18 18:55 185,344 --a------ C:\WINDOWS\system32\cmprops.dll
2006-08-18 18:55 183,808 --a------ C:\WINDOWS\system32\accwiz.exe
2006-08-18 18:55 17,408 --a------ C:\WINDOWS\system32\mmfutil.dll
2006-08-18 18:55 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2006-08-18 18:55 147,968 --a------ C:\WINDOWS\system32\rdchost.dll
2006-08-18 18:55 140,800 --a------ C:\WINDOWS\system32\sessmgr.exe
2006-08-18 18:55 131,584 --a------ C:\WINDOWS\system32\sndrec32.exe
2006-08-18 18:55 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe
2006-08-18 18:55 123,392 --a------ C:\WINDOWS\system32\mplay32.exe
2006-08-18 18:55 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll
2006-08-18 18:55 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll
2006-08-18 18:55 11,264 --a------ C:\WINDOWS\system32\icaapi.dll
2006-08-18 18:55 102,912 --a------ C:\WINDOWS\system32\clipbrd.exe
2006-08-18 18:55 1,267,200 --a------ C:\WINDOWS\system32\comsvcs.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-06 21:31 -------- d-------- C:\Program Files\ewido anti-spyware 4.0
2006-09-06 21:20 -------- d-------- C:\Program Files\DAP
2006-09-06 15:46 -------- d-------- C:\Program Files\Mozilla Firefox
2006-09-06 11:53 -------- d-------- C:\Documents and Settings\kula\Application Data\Adobe
2006-09-06 11:16 596472 --a------ C:\Documents and Settings\kula\Application Data\GDIPFONTCACHEV1.DAT
2006-09-06 01:20 -------- d-------- C:\Program Files\Internet Explorer
2006-09-05 15:02 -------- d-------- C:\Program Files\Messenger
2006-09-04 22:31 -------- d-------- C:\Program Files\Symantec
2006-09-04 22:31 -------- d-------- C:\Program Files\Common Files\Symantec Shared
2006-09-04 22:30 -------- d-------- C:\Program Files\Common Files
2006-09-04 22:19 -------- d-------- C:\Program Files\Common Files\Adobe
2006-09-04 22:18 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-09-04 21:16 -------- d-------- C:\Program Files\Windows Media Player
2006-09-04 19:23 -------- d-------- C:\Program Files\BillP Studios
2006-09-04 19:23 -------- d-------- C:\Documents and Settings\kula\Application Data\WinPatrol
2006-09-04 17:28 -------- d-------- C:\Program Files\DivX
2006-09-04 17:20 -------- d-------- C:\Program Files\Webteh
2006-09-04 16:54 -------- d-------- C:\Program Files\ffdshow
2006-09-04 16:38 73728 --a------ C:\WINDOWS\system32\sockspy.dll
2006-09-04 16:26 -------- d-------- C:\Documents and Settings\kula\Application Data\Help
2006-09-04 16:07 -------- d-------- C:\Program Files\Softwin
2006-09-04 16:07 -------- d-------- C:\Program Files\Common Files\Softwin
2006-09-04 15:09 -------- d-------- C:\Program Files\Outlook Express
2006-09-04 15:09 -------- d-------- C:\Program Files\Common Files\System
2006-09-01 17:20 -------- d-------- C:\Program Files\CyberLink
2006-09-01 13:00 -------- d-------- C:\Documents and Settings\kula\Application Data\Corel
2006-09-01 12:59 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-08-31 13:49 -------- d-------- C:\Documents and Settings\kula\Application Data\AdobeUM
2006-08-31 12:30 -------- d-------- C:\Program Files\HP
2006-08-31 12:30 -------- d-------- C:\Program Files\Common Files\HP
2006-08-31 12:28 -------- d-------- C:\Program Files\Hewlett-Packard
2006-08-31 12:23 -------- d-------- C:\Documents and Settings\kula\Application Data\HP
2006-08-30 13:20 -------- d-------- C:\Program Files\Adobe
2006-08-30 11:26 -------- d-------- C:\Program Files\Common Files\Corel
2006-08-30 11:11 -------- d-------- C:\Program Files\Microsoft ActiveSync
2006-08-30 11:11 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-08-30 11:11 -------- d-------- C:\Program Files\Common Files\Designer
2006-08-30 11:05 -------- d-------- C:\Program Files\Microsoft Office
2006-08-30 10:22 -------- d-------- C:\Documents and Settings\kula\Application Data\Macromedia
2006-08-29 14:30 -------- d-------- C:\Program Files\QuickTime
2006-08-24 13:25 -------- d---s---- C:\Documents and Settings\kula\Application Data\Microsoft
2006-08-20 13:29 -------- d-------- C:\Documents and Settings\kula\Application Data\Apple Computer
2006-08-19 15:13 -------- d-------- C:\Documents and Settings\kula\Application Data\CyberLink
2006-08-18 22:35 -------- d-------- C:\Documents and Settings\kula\Application Data\Mozilla
2006-08-18 21:50 -------- d-------- C:\Documents and Settings\kula\Application Data\Ahead
2006-08-18 21:44 -------- d-------- C:\Program Files\XviD
2006-08-18 21:43 -------- d-------- C:\Program Files\DivXCodec
2006-08-18 21:35 -------- d-------- C:\Program Files\Common Files\Ahead
2006-08-18 21:35 -------- d-------- C:\Program Files\Ahead
2006-08-18 21:27 -------- d-------- C:\Program Files\WinRAR
2006-08-18 21:22 -------- d-------- C:\Documents and Settings\kula\Application Data\Symantec
2006-08-18 21:18 -------- d-------- C:\Program Files\Winamp
2006-08-18 21:00 -------- d-------- C:\Program Files\Lavasoft
2006-08-18 21:00 -------- d-------- C:\Documents and Settings\kula\Application Data\Lavasoft
2006-08-18 20:49 -------- d-------- C:\Program Files\Common Files\SpeechEngines
2006-08-18 20:49 -------- d-------- C:\Program Files\Common Files\ODBC
2006-08-18 20:48 62 --ahs---- C:\Documents and Settings\kula\Application Data\desktop.ini
2006-08-18 20:21 -------- d-------- C:\Program Files\ABBYY FineReader 6.0
2006-08-18 20:20 -------- d-------- C:\Documents and Settings\kula\Application Data\ABBYY
2006-08-18 19:55 -------- d-------- C:\Program Files\Common Files\Adobe Systems Shared
2006-08-18 19:45 -------- d-------- C:\Program Files\Marvell
2006-08-18 19:23 -------- d-------- C:\Program Files\Silicon Image
2006-08-18 19:06 -------- d--h----- C:\Program Files\Uninstall Information
2006-08-18 19:06 -------- d-------- C:\Documents and Settings\kula\Application Data\Identities
2006-08-18 19:01 -------- d-------- C:\Program Files\xerox
2006-08-18 19:01 -------- d-------- C:\Program Files\microsoft frontpage
2006-08-18 18:59 -------- d--h----- C:\Program Files\WindowsUpdate
2006-08-18 18:58 -------- d-------- C:\Program Files\NetMeeting
2006-08-18 18:58 -------- d-------- C:\Program Files\Movie Maker
2006-08-18 18:58 -------- d-------- C:\Program Files\Common Files\Services
2006-08-18 18:58 -------- d-------- C:\Program Files\Common Files\MSSoap
2006-08-18 18:56 -------- d-------- C:\Program Files\Windows NT
2006-08-18 18:56 -------- d-------- C:\Program Files\Online Services
2006-08-18 18:56 -------- d-------- C:\Program Files\MSN Gaming Zone
2006-08-18 18:56 -------- d-------- C:\Program Files\ComPlus Applications
2006-08-18 18:55 -------- d-------- C:\Program Files\MSN
2006-07-21 10:24 72704 --a------ C:\WINDOWS\system32\hlink.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nForce Tray Options "= "sstray.exe /r "
"SMSERIAL "= "sm56hlpr.exe "
"WinampAgent "= "C:\\Program Files\\Winamp\\winampa.exe "
"NeroFilterCheck "= "C:\\WINDOWS\\system32\\NeroCheck.exe "
"DownloadAccelerator "= "C:\\PROGRA~1\\DAP\\DAP.EXE /STARTUP "
"HP Software Update "= "C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe "
"CorelDRAW Graphics Suite 11b "= "G:\\Program Files\\Corel\\Corel Graphics 12\\Languages\\EN\\Programs\\Registration.exe /title=\ "CorelDRAW Graphics Suite 12\" /date=091606 serial=dr12wex-1504397-kty lang=EN "
"b27e07b6.exe "= "C:\\WINDOWS\\system32\\b27e07b6.exe "
"BDMCon "= "C:\\PROGRA~1\\Softwin\\BITDEF~1\\bdmcon.exe "
"BDNewsAgent "= "C:\\PROGRA~1\\Softwin\\BITDEF~1\\bdnagent.exe "
"BDSwitchAgent "= "C:\\Program Files\\Softwin\\BitDefender Professional Edition\\bdswitch.exe "
"WinPatrol "= "\ "C:\\PROGRA~1\\BILLPS~1\\WINPAT~1\\WinPatrol.exe\" "
"!ewido "= "\ "C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed "= "1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed "= "1 "
"NoChange "= "1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed "= "1 "

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS "= "\ "C:\\Program Files\\Messenger\\msmsgs.exe\" /background "
"CTFMON.EXE "= "C:\\WINDOWS\\system32\\ctfmon.exe "
"b27e07b6.exe "= "C:\\Documents and Settings\\kula\\Local Settings\\Application Data\\b27e07b6.exe "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername "=dword:00000000
"legalnoticecaption "=" "
"legalnoticetext "=" "
"shutdownwithoutlogon "=dword:00000001
"undockwithoutlogon "=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion "=dword:00000110
"DeskHtmlMinorVersion "=dword:00000005
"Settings "=dword:00000001
"GeneralFlags "=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972} "=" "
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8} "= "ewido anti-spyware 4.0 "

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\msldr32
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wingho32


Completion time: Wed 09/06/2006 22:18:40.50
ComboFix.txt
ComboFix2.txt

 

ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 10:12:08 PM 9/6/2006

+ Scan result:



HKU\S-1-5-21-1844237615-1326574676-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{052B12F7-86FA-4921-8482-26C42316B522} -> Adware.Generic : No action taken.
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\Dc125.exe -> Downloader.Obfuscated.a : No action taken.
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\ishost.exe -> Downloader.Zlob.adn : No action taken.
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\issearch.exe -> Downloader.Zlob.aih : No action taken.
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\ixt0.dll -> Downloader.Zlob.aih : No action taken.
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\flx6.dll -> Not-A-Virus.Hoax.Win32.Renos.ds : No action taken.
:mozilla.105:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.130:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.103:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.104:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
C:\Documents and Settings\kula\Cookies\kula@admarketplace[2].txt -> TrackingCookie.Admarketplace : No action taken.
:mozilla.91:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Adtech : No action taken.
:mozilla.92:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Adtech : No action taken.
:mozilla.113:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.114:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.115:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.116:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.117:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.118:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.119:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.129:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Ivwbox : No action taken.
:mozilla.23:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Qksrv : No action taken.
:mozilla.24:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Qksrv : No action taken.
:mozilla.39:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.40:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.41:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.75:C:\Documents and Settings\kula\Application Data\Mozilla\Firefox\Profiles\je816jt0.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
C:\Documents and Settings\kula\Cookies\kula@yadro[2].txt -> TrackingCookie.Yadro : No action taken.
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\Dc104.exe -> Trojan.Pakes : No action taken.
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\Dc373.exe -> Trojan.Pakes : No action taken.
C:\Program Files\Softwin\BitDefender Professional Edition\Infected\Dc722.exe -> Trojan.Pakes : No action taken.


::Report end

 

xxx )) lots of smut

 

Logfile of HijackThis v1.99.1
Scan saved at 10:22:02 PM, on 9/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender Professional Edition\vsserv.exe
C:\WINDOWS\system32\sstray.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\DAP\DAP.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
G:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Silicon Image\SiISATARaid\SATARaid.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\system32\wuauclt.exe
C:\hjt\HijackThis.exe

O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {a43385f0-7113-496d-96d7-b9b550e3fcca} - C:\WINDOWS\system32\ixt0.dll (file missing)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - G:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] G:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title= "CorelDRAW Graphics Suite 12" /date=091606 serial=dr12wex-1504397-kty lang=EN
O4 - HKLM\..\Run: [b27e07b6.exe] C:\WINDOWS\system32\b27e07b6.exe
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\PROGRA~1\Softwin\BITDEF~1\bdnagent.exe
O4 - HKLM\..\Run: [BDSwitchAgent] C:\Program Files\Softwin\BitDefender Professional Edition\bdswitch.exe
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe "
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [b27e07b6.exe] C:\Documents and Settings\kula\Local Settings\Application Data\b27e07b6.exe
O4 - Global Startup: Acrobat Assistant.lnk = G:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SATARaid.lnk = ?
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: msldr32 - msldr32.dll (file missing)
O20 - Winlogon Notify: wingho32 - wingho32.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender Professional Edition\vsserv.exe" /service (file missing)
O23 - Service: Windows Log - Unknown owner - C:\WINDOWS\system32\nvsvcd.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

 

Yowza!!

Ok, I finally finiished getting thru those files. I'm guessing you just loaded this OS recently? Tons of these files seem like they are related to updating the OS.

And after all that, we have just a few which need killing.

1) Please download the Killbox.
Save it to the desktop and run it.

2) Select "Delete on Reboot ", and then select "All files ".

3) Copy the file names below to the clipboard by highlighting them and pressing Control-C:
C:\Program Files\Webteh
C:\Program Files\ffdshow
C:\WINDOWS\system32\ixt0.dll
C:\WINDOWS\system32\b27e07b6.exe
C:\Documents and Settings\kula\Local Settings\Application Data\b27e07b6.exe
C:\WINDOWS\system32\nvsvcd.exe
msldr32.dll
wingho32.dll

4) Return to Killbox, go to the File menu, and choose "Paste from Clipboard ".

5) Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

Do not reboot yet.

Run Hijackthis and look over the following entries I have listed, check the boxes next to them and press the "Fix Checked" button with HijackThis(some entries may not be present due to previous procedures). When you are doing this, make sure you have No IE windows, or other browsers open, including this one. Reboot if I have specified below, and post a fresh HijackThis log.


O2 - BHO: (no name) - {a43385f0-7113-496d-96d7-b9b550e3fcca} - C:\WINDOWS\system32\ixt0.dll (file missing)


O4 - HKLM\..\Run: [b27e07b6.exe] C:\WINDOWS\system32\b27e07b6.exe

O4 - HKCU\..\Run: [b27e07b6.exe] C:\Documents and Settings\kula\Local Settings\Application Data\b27e07b6.exe


O20 - Winlogon Notify: msldr32 - msldr32.dll (file missing)

O20 - Winlogon Notify: wingho32 - wingho32.dll (file missing)


O23 - Service: Windows Log - Unknown owner - C:\WINDOWS\system32\nvsvcd.exe

Reboot and run ComboFix first, then HJT and post both logs back into this thread.

 

kula - 06-09-08 17:38:43.01
ComboFix 06.09.04BT - Running from: I:\virualat

Microsoft Windows XP [Version 5.1.2600]

((((((((((((((((((((((((((((((( Files Created from 2006-08-08 to 2006-09-08 ))))))))))))))))))))))))))))))))))


2006-09-04 22:24 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-09-04 22:24 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-09-04 22:24 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-09-04 22:24 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-09-04 19:22 299,520 --a------ C:\WINDOWS\uninst.exe
2006-09-04 19:16 21,312 --a------ C:\WINDOWS\choice.exe
2006-09-04 17:29 90,112 --a------ C:\WINDOWS\unvise32.exe
2006-08-31 12:27 37,376 --a------ C:\WINDOWS\system32\hpz3l3xu.dll
2006-08-31 12:26 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2006-08-31 12:26 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2006-08-31 12:26 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2006-08-31 12:26 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2006-08-31 12:26 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2006-08-31 12:26 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2006-08-25 14:58 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2006-08-21 09:06 306,688 --a------ C:\WINDOWS\IsUninst.exe
2006-08-19 09:41 245,248 --a------ C:\WINDOWS\UNINST16.EXE
2006-08-18 21:45 50,688 --a------ C:\WINDOWS\system32\wbhelp2.dll
2006-08-18 21:35 569,344 --a------ C:\WINDOWS\system32\imagr5.dll
2006-08-18 21:35 544,768 --a------ C:\WINDOWS\system32\imagx5.dll
2006-08-18 21:35 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2006-08-18 21:35 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll
2006-08-18 21:35 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2006-08-18 21:35 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2006-08-18 20:51 4,274,816 --a------ C:\WINDOWS\system32\nv4_disp.dll
2006-08-18 20:51 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2006-08-18 20:50 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2006-08-18 20:49 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2006-08-18 20:49 7,168 -ra------ C:\WINDOWS\system32\kbdcz.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdycl.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdsl1.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdsl.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdpl.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdhu.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdcz2.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdcz1.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\kbdcr.dll
2006-08-18 20:49 6,656 -ra------ C:\WINDOWS\system32\KBDAL.DLL
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2006-08-18 20:49 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdycc.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbduzb.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdur.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdtat.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdru1.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdru.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdro.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdpl1.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdkaz.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdhu1.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdbu.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdblr.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2006-08-18 20:49 5,632 -ra------ C:\WINDOWS\system32\kbdaze.dll
2006-08-18 20:48 85,020 --a------ C:\WINDOWS\system32\dgsetup.dll
2006-08-18 20:48 8,704 --a------ C:\WINDOWS\system32\batt.dll
2006-08-18 20:48 74,752 --a------ C:\WINDOWS\system32\storprop.dll
2006-08-18 20:48 69,120 --a------ C:\WINDOWS\NOTEPAD.EXE
2006-08-18 20:48 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2006-08-18 20:48 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2006-08-18 20:48 15,360 --a------ C:\WINDOWS\TASKMAN.EXE
2006-08-18 20:48 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2006-08-18 20:48 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll
2006-08-18 20:05 16,384 --a------ C:\WINDOWS\system32\FileOps.exe
2006-08-18 19:42 462,848 --a------ C:\WINDOWS\sm56hlpr.exe
2006-08-18 19:42 327,680 --a------ C:\WINDOWS\sm56set.exe
2006-08-18 19:42 245,760 --a------ C:\WINDOWS\sm56unst.exe
2006-08-18 19:18 94,208 --a------ C:\WINDOWS\system32\NVUninst.exe
2006-08-18 19:18 61,440 -ra------ C:\WINDOWS\system32\SStrmZHT.dll
2006-08-18 19:18 509,984 -ra------ C:\WINDOWS\50comupd.exe
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplZHT.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplZHC.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplTR.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplTH.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplSV.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplSL.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplSK.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplRU.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplPTB.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplPT.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplPL.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplNO.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplNL.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplKO.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplJA.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplIT.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplHU.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplHE.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplFR.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplFI.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplES.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplENG.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplEL.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplDE.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplDA.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplCS.dll
2006-08-18 19:18 36,864 -ra------ C:\WINDOWS\system32\SSCplAR.dll
2006-08-18 19:17 98,304 -ra------ C:\WINDOWS\system32\SStrmSK.dll
2006-08-18 19:17 98,304 -ra------ C:\WINDOWS\system32\SStrmPTB.dll
2006-08-18 19:17 98,304 -ra------ C:\WINDOWS\system32\SStrmDA.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmTR.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmTH.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmSV.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmPT.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmNO.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmFI.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\sstrmenu.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmENG.dll
2006-08-18 19:17 94,208 -ra------ C:\WINDOWS\system32\SStrmCS.dll
2006-08-18 19:17 90,112 -ra------ C:\WINDOWS\system32\SStrmSL.dll
2006-08-18 19:17 86,016 -ra------ C:\WINDOWS\system32\SStrmHE.dll
2006-08-18 19:17 86,016 -ra------ C:\WINDOWS\system32\SStrmAR.dll
2006-08-18 19:17 73,728 -ra------ C:\WINDOWS\system32\sstray.exe
2006-08-18 19:17 7,168 -ra------ C:\WINDOWS\system32\nvack.dll
2006-08-18 19:17 69,632 -ra------ C:\WINDOWS\system32\SStrmKO.dll
2006-08-18 19:17 69,632 -ra------ C:\WINDOWS\system32\SStrmJA.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraZHT.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraZHC.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraTR.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraTH.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraSV.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraSL.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraSK.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraRU.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraPTB.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraPT.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraPL.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraNO.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraNL.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraKO.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraJA.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraIT.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraHU.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraHE.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraFR.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraFI.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraES.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraENG.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraEL.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraDE.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraDA.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraCS.dll
2006-08-18 19:17 61,440 -ra------ C:\WINDOWS\system32\SSTraAR.dll
2006-08-18 19:17 57,344 -ra------ C:\WINDOWS\system32\SStrmZHC.dll
2006-08-18 19:17 5,120 -ra------ C:\WINDOWS\system32\ALut.dll
2006-08-18 19:17 491,599 -ra------ C:\WINDOWS\system32\sndstorm.exe
2006-08-18 19:17 46,592 -ra------ C:\WINDOWS\system32\nvopenal.dll
2006-08-18 19:17 29,696 -ra------ C:\WINDOWS\system32\nvasio.dll
2006-08-18 19:17 19,456 -ra------ C:\WINDOWS\system32\OpenAL32.dll
2006-08-18 19:17 126,976 -ra------ C:\WINDOWS\system32\nvuide.exe
2006-08-18 19:17 126,976 -ra------ C:\WINDOWS\system32\nvuautl.exe
2006-08-18 19:17 126,976 -ra------ C:\WINDOWS\system32\nvuaudio.exe
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmRU.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmPL.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmNL.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmIT.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmHU.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmFR.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmES.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmEL.dll
2006-08-18 19:17 102,400 -ra------ C:\WINDOWS\system32\SStrmDE.dll
2006-08-18 19:17 1,589,248 -ra------ C:\WINDOWS\system32\sstrmres.dll
2006-08-18 19:16 77,824 -ra------ C:\WINDOWS\system32\nvugart.exe
2006-08-18 19:16 77,824 -ra------ C:\WINDOWS\system32\nvuenet.exe
2006-08-18 19:16 77,824 --------- C:\WINDOWS\system32\nvusmb.exe
2006-08-18 19:01 0 -rahs---- C:\MSDOS.SYS
2006-08-18 19:01 0 -rahs---- C:\IO.SYS
2006-08-18 19:01 0 --a------ C:\CONFIG.SYS
2006-08-18 19:01 0 --a------ C:\AUTOEXEC.BAT

 

2006-08-18 19:00 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2006-08-18 18:58 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll
2006-08-18 18:58 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2006-08-18 18:58 64,512 --a------ C:\WINDOWS\system32\acctres.dll
2006-08-18 18:58 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll
2006-08-18 18:58 465,176 --a------ C:\WINDOWS\system32\wuapi.dll
2006-08-18 18:58 45,568 --a------ C:\WINDOWS\system32\safrslv.dll
2006-08-18 18:58 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2006-08-18 18:58 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll
2006-08-18 18:58 41,240 --a------ C:\WINDOWS\system32\wups.dll
2006-08-18 18:58 382,464 --a------ C:\WINDOWS\system32\qmgr.dll
2006-08-18 18:58 29,696 --a------ C:\WINDOWS\system32\safrdm.dll
2006-08-18 18:58 194,328 --a------ C:\WINDOWS\system32\wuaueng1.dll
2006-08-18 18:58 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2006-08-18 18:58 173,536 --a------ C:\WINDOWS\system32\wuweb.dll
2006-08-18 18:58 172,312 --a------ C:\WINDOWS\system32\wuauclt1.exe
2006-08-18 18:58 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2006-08-18 18:58 127,256 --a------ C:\WINDOWS\system32\wucltui.dll
2006-08-18 18:58 124,184 --a------ C:\WINDOWS\system32\wuauclt.exe
2006-08-18 18:58 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2006-08-18 18:58 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2006-08-18 18:58 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll
2006-08-18 18:57 81,920 --a------ C:\WINDOWS\system32\isign32.dll
2006-08-18 18:57 81,920 --a------ C:\WINDOWS\system32\ils.dll
2006-08-18 18:57 73,728 --a------ C:\WINDOWS\system32\icwdial.dll
2006-08-18 18:57 69,632 --a------ C:\WINDOWS\system32\msconf.dll
2006-08-18 18:57 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-08-18 18:57 67,584 --a------ C:\WINDOWS\system32\srclient.dll
2006-08-18 18:57 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll
2006-08-18 18:57 48,128 --a------ C:\WINDOWS\system32\inetres.dll
2006-08-18 18:57 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll
2006-08-18 18:57 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2006-08-18 18:57 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll
2006-08-18 18:57 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll
2006-08-18 18:57 274,944 --a------ C:\WINDOWS\system32\mstask.dll
2006-08-18 18:57 274,432 --a------ C:\WINDOWS\system32\inetcfg.dll
2006-08-18 18:57 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll
2006-08-18 18:57 239,104 --a------ C:\WINDOWS\system32\srrstr.dll
2006-08-18 18:57 22,528 --a------ C:\WINDOWS\system32\fltMc.exe
2006-08-18 18:57 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll
2006-08-18 18:57 170,496 --a------ C:\WINDOWS\system32\srsvc.dll
2006-08-18 18:57 16,896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-18 18:57 12,288 --a------ C:\WINDOWS\system32\mstinit.exe
2006-08-18 18:57 105,984 --a------ C:\WINDOWS\system32\msoert2.dll
2006-08-18 18:56 97,792 --a------ C:\WINDOWS\system32\comrepl.dll
2006-08-18 18:56 9,728 --a------ C:\WINDOWS\system32\reset.exe
2006-08-18 18:56 80,384 --a------ C:\WINDOWS\system32\charmap.exe
2006-08-18 18:56 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2006-08-18 18:56 605,696 --a------ C:\WINDOWS\system32\getuname.dll
2006-08-18 18:56 56,832 --a------ C:\WINDOWS\system32\sol.exe
2006-08-18 18:56 55,296 --a------ C:\WINDOWS\system32\freecell.exe
2006-08-18 18:56 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2006-08-18 18:56 5,632 --a------ C:\WINDOWS\system32\write.exe
2006-08-18 18:56 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2006-08-18 18:56 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2006-08-18 18:56 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2006-08-18 18:56 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2006-08-18 18:56 35,328 --a------ C:\WINDOWS\system32\winchat.exe
2006-08-18 18:56 33,792 --a------ C:\WINDOWS\system32\regini.exe
2006-08-18 18:56 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2006-08-18 18:56 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2006-08-18 18:56 227,840 --a------ C:\WINDOWS\system32\avtapi.dll
2006-08-18 18:56 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe
2006-08-18 18:56 20,992 --a------ C:\WINDOWS\system32\msg.exe
2006-08-18 18:56 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2006-08-18 18:56 16,896 --a------ C:\WINDOWS\system32\tsshutdn.exe
2006-08-18 18:56 16,896 --a------ C:\WINDOWS\system32\qappsrv.exe
2006-08-18 18:56 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2006-08-18 18:56 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2006-08-18 18:56 15,872 --a------ C:\WINDOWS\system32\rwinsta.exe
2006-08-18 18:56 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2006-08-18 18:56 15,360 --a------ C:\WINDOWS\system32\logoff.exe
2006-08-18 18:56 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2006-08-18 18:56 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe
2006-08-18 18:56 14,848 --a------ C:\WINDOWS\system32\tscon.exe
2006-08-18 18:56 14,848 --a------ C:\WINDOWS\system32\shadow.exe
2006-08-18 18:56 138,752 --a------ C:\WINDOWS\system32\sndvol32.exe
2006-08-18 18:56 126,976 --a------ C:\WINDOWS\system32\mshearts.exe
2006-08-18 18:56 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2006-08-18 18:56 114,688 --a------ C:\WINDOWS\system32\calc.exe
2006-08-18 18:56 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd
2006-08-18 18:55 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll
2006-08-18 18:55 93,696 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2006-08-18 18:55 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll
2006-08-18 18:55 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll
2006-08-18 18:55 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2006-08-18 18:55 67,072 --a------ C:\WINDOWS\system32\rdshost.exe
2006-08-18 18:55 655,360 --a------ C:\WINDOWS\system32\mstscax.dll
2006-08-18 18:55 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll
2006-08-18 18:55 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe
2006-08-18 18:55 60,416 --a------ C:\WINDOWS\system32\remotepg.dll
2006-08-18 18:55 60,416 --a------ C:\WINDOWS\system32\colbact.dll
2006-08-18 18:55 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2006-08-18 18:55 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll
2006-08-18 18:55 58,880 --a------ C:\WINDOWS\system32\licwmi.dll
2006-08-18 18:55 56,320 --a------ C:\WINDOWS\system32\servdeps.dll
2006-08-18 18:55 540,160 --a------ C:\WINDOWS\system32\comuid.dll
2006-08-18 18:55 538,624 --a------ C:\WINDOWS\system32\spider.exe
2006-08-18 18:55 498,688 --a------ C:\WINDOWS\system32\clbcatq.dll
2006-08-18 18:55 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe
2006-08-18 18:55 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll
2006-08-18 18:55 407,552 --a------ C:\WINDOWS\system32\mstsc.exe
2006-08-18 18:55 38,912 --a------ C:\WINDOWS\system32\cfgbkend.dll
2006-08-18 18:55 347,136 --a------ C:\WINDOWS\system32\hypertrm.dll
2006-08-18 18:55 343,040 --a------ C:\WINDOWS\system32\mspaint.exe
2006-08-18 18:55 295,424 --a------ C:\WINDOWS\system32\termsrv.dll
2006-08-18 18:55 225,792 --a------ C:\WINDOWS\system32\catsrv.dll
2006-08-18 18:55 20,480 --a------ C:\WINDOWS\system32\qprocess.exe
2006-08-18 18:55 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll
2006-08-18 18:55 185,344 --a------ C:\WINDOWS\system32\cmprops.dll
2006-08-18 18:55 183,808 --a------ C:\WINDOWS\system32\accwiz.exe
2006-08-18 18:55 17,408 --a------ C:\WINDOWS\system32\mmfutil.dll
2006-08-18 18:55 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2006-08-18 18:55 147,968 --a------ C:\WINDOWS\system32\rdchost.dll
2006-08-18 18:55 140,800 --a------ C:\WINDOWS\system32\sessmgr.exe
2006-08-18 18:55 131,584 --a------ C:\WINDOWS\system32\sndrec32.exe
2006-08-18 18:55 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe
2006-08-18 18:55 123,392 --a------ C:\WINDOWS\system32\mplay32.exe
2006-08-18 18:55 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll
2006-08-18 18:55 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll
2006-08-18 18:55 11,264 --a------ C:\WINDOWS\system32\icaapi.dll
2006-08-18 18:55 102,912 --a------ C:\WINDOWS\system32\clipbrd.exe
2006-08-18 18:55 1,267,200 --a------ C:\WINDOWS\system32\comsvcs.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-08 17:06 -------- d-------- C:\Program Files\ewido anti-spyware 4.0
2006-09-08 12:28 -------- d-------- C:\Documents and Settings\kula\Application Data\Adobe
2006-09-08 10:56 -------- d-------- C:\Program Files\Mozilla Firefox
2006-09-06 23:59 -------- d-------- C:\Documents and Settings\kula\Application Data\AdobeUM
2006-09-06 21:20 -------- d-------- C:\Program Files\DAP
2006-09-06 11:16 596472 --a------ C:\Documents and Settings\kula\Application Data\GDIPFONTCACHEV1.DAT
2006-09-06 01:20 -------- d-------- C:\Program Files\Internet Explorer
2006-09-05 15:02 -------- d-------- C:\Program Files\Messenger
2006-09-04 22:31 -------- d-------- C:\Program Files\Symantec
2006-09-04 22:31 -------- d-------- C:\Program Files\Common Files\Symantec Shared
2006-09-04 22:30 -------- d-------- C:\Program Files\Common Files
2006-09-04 22:19 -------- d-------- C:\Program Files\Common Files\Adobe
2006-09-04 22:18 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-09-04 21:16 -------- d-------- C:\Program Files\Windows Media Player
2006-09-04 19:23 -------- d-------- C:\Program Files\BillP Studios
2006-09-04 19:23 -------- d-------- C:\Documents and Settings\kula\Application Data\WinPatrol
2006-09-04 17:28 -------- d-------- C:\Program Files\DivX
2006-09-04 17:20 -------- d-------- C:\Program Files\Webteh
2006-09-04 16:54 -------- d-------- C:\Program Files\ffdshow
2006-09-04 16:38 73728 --a------ C:\WINDOWS\system32\sockspy.dll
2006-09-04 16:26 -------- d-------- C:\Documents and Settings\kula\Application Data\Help
2006-09-04 16:07 -------- d-------- C:\Program Files\Softwin
2006-09-04 16:07 -------- d-------- C:\Program Files\Common Files\Softwin
2006-09-04 15:09 -------- d-------- C:\Program Files\Outlook Express
2006-09-04 15:09 -------- d-------- C:\Program Files\Common Files\System
2006-09-01 17:20 -------- d-------- C:\Program Files\CyberLink
2006-09-01 13:00 -------- d-------- C:\Documents and Settings\kula\Application Data\Corel
2006-09-01 12:59 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-08-31 12:30 -------- d-------- C:\Program Files\HP
2006-08-31 12:30 -------- d-------- C:\Program Files\Common Files\HP
2006-08-31 12:28 -------- d-------- C:\Program Files\Hewlett-Packard
2006-08-31 12:23 -------- d-------- C:\Documents and Settings\kula\Application Data\HP
2006-08-30 13:20 -------- d-------- C:\Program Files\Adobe
2006-08-30 11:26 -------- d-------- C:\Program Files\Common Files\Corel
2006-08-30 11:11 -------- d-------- C:\Program Files\Microsoft ActiveSync
2006-08-30 11:11 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-08-30 11:11 -------- d-------- C:\Program Files\Common Files\Designer
2006-08-30 11:05 -------- d-------- C:\Program Files\Microsoft Office
2006-08-30 10:22 -------- d-------- C:\Documents and Settings\kula\Application Data\Macromedia
2006-08-29 14:30 -------- d-------- C:\Program Files\QuickTime
2006-08-24 13:25 -------- d---s---- C:\Documents and Settings\kula\Application Data\Microsoft
2006-08-20 13:29 -------- d-------- C:\Documents and Settings\kula\Application Data\Apple Computer
2006-08-19 15:13 -------- d-------- C:\Documents and Settings\kula\Application Data\CyberLink
2006-08-18 22:35 -------- d-------- C:\Documents and Settings\kula\Application Data\Mozilla
2006-08-18 21:50 -------- d-------- C:\Documents and Settings\kula\Application Data\Ahead
2006-08-18 21:44 -------- d-------- C:\Program Files\XviD
2006-08-18 21:43 -------- d-------- C:\Program Files\DivXCodec
2006-08-18 21:35 -------- d-------- C:\Program Files\Common Files\Ahead
2006-08-18 21:35 -------- d-------- C:\Program Files\Ahead
2006-08-18 21:27 -------- d-------- C:\Program Files\WinRAR
2006-08-18 21:22 -------- d-------- C:\Documents and Settings\kula\Application Data\Symantec
2006-08-18 21:18 -------- d-------- C:\Program Files\Winamp
2006-08-18 21:00 -------- d-------- C:\Program Files\Lavasoft
2006-08-18 21:00 -------- d-------- C:\Documents and Settings\kula\Application Data\Lavasoft
2006-08-18 20:49 -------- d-------- C:\Program Files\Common Files\SpeechEngines
2006-08-18 20:49 -------- d-------- C:\Program Files\Common Files\ODBC
2006-08-18 20:48 62 --ahs---- C:\Documents and Settings\kula\Application Data\desktop.ini
2006-08-18 20:21 -------- d-------- C:\Program Files\ABBYY FineReader 6.0
2006-08-18 20:20 -------- d-------- C:\Documents and Settings\kula\Application Data\ABBYY
2006-08-18 19:55 -------- d-------- C:\Program Files\Common Files\Adobe Systems Shared
2006-08-18 19:45 -------- d-------- C:\Program Files\Marvell
2006-08-18 19:23 -------- d-------- C:\Program Files\Silicon Image
2006-08-18 19:06 -------- d--h----- C:\Program Files\Uninstall Information
2006-08-18 19:06 -------- d-------- C:\Documents and Settings\kula\Application Data\Identities
2006-08-18 19:01 -------- d-------- C:\Program Files\xerox
2006-08-18 19:01 -------- d-------- C:\Program Files\microsoft frontpage
2006-08-18 18:59 -------- d--h----- C:\Program Files\WindowsUpdate
2006-08-18 18:58 -------- d-------- C:\Program Files\NetMeeting
2006-08-18 18:58 -------- d-------- C:\Program Files\Movie Maker
2006-08-18 18:58 -------- d-------- C:\Program Files\Common Files\Services
2006-08-18 18:58 -------- d-------- C:\Program Files\Common Files\MSSoap
2006-08-18 18:56 -------- d-------- C:\Program Files\Windows NT
2006-08-18 18:56 -------- d-------- C:\Program Files\Online Services
2006-08-18 18:56 -------- d-------- C:\Program Files\MSN Gaming Zone
2006-08-18 18:56 -------- d-------- C:\Program Files\ComPlus Applications
2006-08-18 18:55 -------- d-------- C:\Program Files\MSN
2006-07-21 10:24 72704 --a------ C:\WINDOWS\system32\hlink.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nForce Tray Options "= "sstray.exe /r "
"SMSERIAL "= "sm56hlpr.exe "
"WinampAgent "= "C:\\Program Files\\Winamp\\winampa.exe "
"NeroFilterCheck "= "C:\\WINDOWS\\system32\\NeroCheck.exe "
"DownloadAccelerator "= "C:\\PROGRA~1\\DAP\\DAP.EXE /STARTUP "
"HP Software Update "= "C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe "
"CorelDRAW Graphics Suite 11b "= "G:\\Program Files\\Corel\\Corel Graphics 12\\Languages\\EN\\Programs\\Registration.exe /title=\ "CorelDRAW Graphics Suite 12\" /date=091606 serial=dr12wex-1504397-kty lang=EN "
"BDMCon "= "C:\\PROGRA~1\\Softwin\\BITDEF~1\\bdmcon.exe "
"BDNewsAgent "= "C:\\PROGRA~1\\Softwin\\BITDEF~1\\bdnagent.exe "
"BDSwitchAgent "= "C:\\Program Files\\Softwin\\BitDefender Professional Edition\\bdswitch.exe "
"WinPatrol "= "\ "C:\\PROGRA~1\\BILLPS~1\\WINPAT~1\\WinPatrol.exe\" "
"!ewido "= "\ "C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed "= "1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed "= "1 "
"NoChange "= "1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed "= "1 "

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS "= "\ "C:\\Program Files\\Messenger\\msmsgs.exe\" /background "
"CTFMON.EXE "= "C:\\WINDOWS\\system32\\ctfmon.exe "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername "=dword:00000000
"legalnoticecaption "=" "
"legalnoticetext "=" "
"shutdownwithoutlogon "=dword:00000001
"undockwithoutlogon "=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion "=dword:00000110
"DeskHtmlMinorVersion "=dword:00000005
"Settings "=dword:00000001
"GeneralFlags "=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun "=dword:00000091

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972} "=" "
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8} "= "ewido anti-spyware 4.0 "



Completion time: Fri 09/08/2006 17:39:18.45
ComboFix.txt
ComboFix2.txt

 

Looks as tho two folders survived Killbox, did you get any errors?
C:\Program Files\Webteh
C:\Program Files\ffdshow

I'm also still needing to see a new HJT log and can you tel me what if any problems you're having.

Thanks.