1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Virtumonde back after Fdisk reinstall

Discussion in 'Malware and Virus Removal Archive' started by JohnnyQuad, 2008/07/24.

  1. 2008/07/24
    JohnnyQuad

    JohnnyQuad Inactive Thread Starter

    Joined:
    2008/07/22
    Messages:
    9
    Likes Received:
    0
    [Resolved] Virtumonde back after Fdisk reinstall

    I just Fdisked my C drive yesterday and did a fresh install of XP Pro. I seem to have downloaded or ran the wrong program. I now infected again. Spybot S&D is now showing both virtumonde.dll and virtumonde.prx. Any help would be greatly appriciated. Automatic Updates will no longer start either.

    Device ID: PCI\VEN_11AB&DEV_4362&SUBSYS_81421043&REV_20\4&8D68EE5&0&00E4
    Manufacturer: Marvell
    Name: Marvell Yukon 88E8053 PCI-E Gigabit Ethernet Controller
    PNP Device ID: PCI\VEN_11AB&DEV_4362&SUBSYS_81421043&REV_20\4&8D68EE5&0&00E4
    Service: yukonwxp


    -- Files created between 2008-06-24 and 2008-07-24 -----------------------------

    2008-07-24 10:58:25 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-07-24 10:18:27 0 d-------- C:\WINDOWS\pss
    2008-07-24 10:02:46 0 d-------- C:\Documents and Settings\LocalService\Start Menu
    2008-07-24 09:51:54 0 d-------- C:\Program Files\Trend Micro
    2008-07-24 09:05:19 0 d-------- C:\Logs
    2008-07-24 08:07:22 5775 --a------ C:\WINDOWS\system32\xwnfanfr.dll
    2008-07-24 08:04:15 1844 --ahs---- C:\WINDOWS\system32\MUuxaJlm.ini2
    2008-07-24 08:01:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro
    2008-07-24 07:59:02 26112 --a------ C:\WINDOWS\system32\qoMeBqoP.dll
    2008-07-24 00:18:56 0 d-------- C:\Program Files\Common Files\Logitech
    2008-07-24 00:18:20 0 d-------- C:\Documents and Settings\All Users\Application Data\LogiShrd
    2008-07-24 00:18:17 0 d-------- C:\Documents and Settings\John\Application Data\Logitech
    2008-07-24 00:15:56 0 d-------- C:\Documents and Settings\All Users\Application Data\Logitech
    2008-07-24 00:15:49 0 d-------- C:\Program Files\Common Files\Logishrd
    2008-07-24 00:15:47 0 d-------- C:\Program Files\Logitech
    2008-07-24 00:15:47 0 d-------- C:\Documents and Settings\John\Application Data\InstallShield
    2008-07-24 00:12:34 0 d-------- C:\Program Files\Common Files\Blizzard Entertainment
    2008-07-24 00:11:30 0 d-------- C:\Program Files\World of Warcraft
    2008-07-23 23:33:47 0 d-------- C:\WINDOWS\Prefetch
    2008-07-23 23:28:18 0 d-------- C:\WINDOWS\ServicePackFiles
    2008-07-23 23:06:10 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
    2008-07-23 23:06:10 0 d-------- C:\Documents and Settings\John\Application Data\skypePM
    2008-07-23 23:01:30 0 d-------- C:\Documents and Settings\John\Application Data\Skype
    2008-07-23 23:01:14 0 d-------- C:\Program Files\Skype
    2008-07-23 23:01:14 0 d-------- C:\Program Files\Common Files\Skype
    2008-07-23 23:01:10 0 d-------- C:\Documents and Settings\All Users\Application Data\Skype
    2008-07-23 22:23:16 0 d-------- C:\Program Files\Microsoft Works
    2008-07-23 22:22:28 0 d-------- C:\Program Files\Microsoft.NET
    2008-07-23 22:20:37 0 d-------- C:\Program Files\Microsoft Visual Studio 8
    2008-07-23 22:20:01 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-07-23 22:08:12 0 d-------- C:\Documents and Settings\John\Application Data\BitTorrent
    2008-07-23 22:05:15 0 d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
    2008-07-23 22:02:50 0 d-------- C:\WINDOWS\SHELLNEW
    2008-07-23 22:01:08 0 d-------- C:\Program Files\DNA
    2008-07-23 22:01:08 0 d-------- C:\Program Files\BitTorrent
    2008-07-23 22:01:08 0 d-------- C:\Documents and Settings\John\Application Data\DNA
    2008-07-23 21:44:50 0 dr-h----- C:\MSOCache
    2008-07-23 21:27:10 0 d-------- C:\Documents and Settings\John\Application Data\Macromedia
    2008-07-23 21:27:09 0 d-------- C:\Documents and Settings\John\Application Data\Adobe
    2008-07-23 21:25:39 0 d-------- C:\Program Files\GS
    2008-07-23 21:22:16 0 d-------- C:\Documents and Settings\John\Application Data\WinRAR
    2008-07-23 21:06:45 0 d------c- C:\WINDOWS\system32\DRVSTORE
    2008-07-23 21:04:57 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
    2008-07-23 21:04:30 0 d-------- C:\Program Files\Windows Live
    2008-07-23 21:04:23 0 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-07-23 20:48:38 0 d-------- C:\Program Files\Intel
    2008-07-23 20:45:31 5685 --a------ C:\WINDOWS\system32\drivers\AsIO.sys
    2008-07-23 20:45:31 24576 --a------ C:\WINDOWS\system32\AsIO.dll <Not Verified; ; AsIO Dynamic Link Library>
    2008-07-23 20:44:52 0 d-------- C:\Program Files\ASUS
    2008-07-23 20:42:22 43008 --a------ C:\WINDOWS\system32\wnvyv12.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 66560 --a------ C:\WINDOWS\system32\wnvyuv8.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 93184 --a------ C:\WINDOWS\system32\wnvwinx.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 160256 --a------ C:\WINDOWS\system32\wnvwav32.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 40448 --a------ C:\WINDOWS\system32\wnvw32.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 89088 --a------ C:\WINDOWS\system32\wnvvsrc.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 56320 --a------ C:\WINDOWS\system32\wnvvolb.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 183296 --a------ C:\WINDOWS\system32\wnvvid32.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 51200 --a------ C:\WINDOWS\system32\wnvvfe32.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 79872 --a------ C:\WINDOWS\system32\wnvvcap1.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 64512 --a------ C:\WINDOWS\system32\wnvtune2.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 37888 --a------ C:\WINDOWS\system32\WnvStill.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 36864 --a------ C:\WINDOWS\system32\WnvRemot.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 78848 --a------ C:\WINDOWS\system32\wnvreg32.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 82432 --a------ C:\WINDOWS\system32\wnvptz.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 135680 --a------ C:\WINDOWS\system32\wnvplay1.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 603136 --a------ C:\WINDOWS\system32\wnvmxr.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 38400 --a------ C:\WINDOWS\system32\wnvmem.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 150528 --a------ C:\WINDOWS\system32\WnvJpeg.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 137216 --a------ C:\WINDOWS\system32\WnvIRQ32.EXE <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 116736 --a------ C:\WINDOWS\system32\wnvim.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 34816 --a------ C:\WINDOWS\system32\WnvI2C.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 109568 --a------ C:\WINDOWS\system32\wnvhad.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 101376 --a------ C:\WINDOWS\system32\wnvasrc.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 45056 --a------ C:\WINDOWS\system32\Videum Bounce.SCR <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 69632 --a------ C:\WINDOWS\system32\TWUNK_32.EXE <Not Verified; Twain Working Group; Twain Thunker>
    2008-07-23 20:42:22 48560 --a------ C:\WINDOWS\system32\TWUNK_16.EXE <Not Verified; Twain Working Group; Twain Thunker>
    2008-07-23 20:42:22 77312 --a------ C:\WINDOWS\system32\TWAIN_32.DLL <Not Verified; Twain Working Group; Twain_32 Source Manager>
    2008-07-23 20:42:22 87328 --a------ C:\WINDOWS\system32\TWAIN.DLL <Not Verified; Twain Working Group; Twain Source Manager>
    2008-07-23 20:42:22 28160 --a------ C:\WINDOWS\system32\SaveAsASF.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 254272 --a------ C:\WINDOWS\system32\ompg4c32.dll <Not Verified; Microsoft Corporation; Microsoft MPEG-4 Video Codec>
    2008-07-23 20:42:22 56832 --a------ C:\WINDOWS\system32\iyvu9_32.DLL
    2008-07-23 20:42:22 245480 --a------ C:\WINDOWS\system32\drivers\WnvKVid.sys <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 107232 --a------ C:\WINDOWS\system32\drivers\WnvKAud.sys <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 21536 --a------ C:\WINDOWS\system32\drivers\WnvCOM.sys <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 528719 --a------ C:\WINDOWS\system32\drivers\Winnov32.sys <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:18 0 d-------- C:\Program Files\Winnov Videum NT
    2008-07-23 20:42:13 314880 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
    2008-07-23 20:42:12 0 d-------- C:\Documents and Settings\John\WINDOWS
    2008-07-23 20:40:07 118784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
    2008-07-23 20:40:07 28672 --a------ C:\WINDOWS\system32\hcwsched.dll <Not Verified; Hauppauge Computer Works; HCW Scheduler>
    2008-07-23 20:40:07 65536 --a------ C:\WINDOWS\system32\dmcrypto.dll
    2008-07-23 20:40:07 69632 --a------ C:\WINDOWS\system32\3DES.dll <Not Verified; Hauppauge Computer Works; 3DES>
    2008-07-23 20:38:54 0 d-------- C:\Program Files\Common Files\IviSDK
    2008-07-23 20:37:10 770121 --a------ C:\WINDOWS\system32\hcwtvwnd.dll <Not Verified; Hauppauge Computer Works; HCWTVWND>
    2008-07-23 20:37:10 106559 --a------ C:\WINDOWS\system32\hcwTVDlg.dll <Not Verified; Hauppauge Computer Works; WinTV>
    2008-07-23 20:37:10 61440 --a------ C:\WINDOWS\system32\Hcwtuner.dll <Not Verified; Hauppauge Computer Works; WinTV>
    2008-07-23 20:37:10 393216 --a------ C:\WINDOWS\system32\hcwsnbd9.dll <Not Verified; Snowbound Software Corporation (www.Snowbnd.com); SnowBound RasterMaster for NT/W2000>
    2008-07-23 20:37:10 270392 --a------ C:\WINDOWS\system32\hcwpnp32.dll <Not Verified; Hauppauge Computer Works; WinTV>
    2008-07-23 20:37:10 94264 --a------ C:\WINDOWS\system32\hcwi2c32.dll <Not Verified; Hauppauge Computer Works, Inc.; WinTV>
    2008-07-23 20:37:10 11264 --a------ C:\WINDOWS\system32\hcwhook.dll <Not Verified; Hauppauge Computer Works; HCW hcwhook>
    2008-07-23 20:37:10 213050 --a------ C:\WINDOWS\system32\Hcwchan.dll <Not Verified; Hauppauge Computer Works; WinTV>
    2008-07-23 20:37:10 192571 --a------ C:\WINDOWS\system32\hcwav.dll <Not Verified; Hauppauge Computer Works, Inc.; WinTV>
    2008-07-23 20:37:10 139329 --a------ C:\WINDOWS\system32\hcwaud32.dll <Not Verified; Hauppauge Computer Works; WinTV>
    2008-07-23 20:37:10 90190 --a------ C:\WINDOWS\system32\Bt848WST.DLL <Not Verified; Hauppauge Computer Works; WinTV>
    2008-07-23 20:37:10 0 d-------- C:\Program Files\WinTV
    2008-07-23 20:37:10 0 d-------- C:\MyVideos
    2008-07-23 20:28:06 0 d-------- C:\Documents and Settings\John\Application Data\Windows Desktop Search
    2008-07-23 20:27:51 0 d-------- C:\WINDOWS\system32\GroupPolicy
    2008-07-23 20:27:51 0 d-------- C:\Program Files\Windows Desktop Search
    2008-07-23 20:27:17 0 d-------- C:\Program Files\Windows Media Connect 2
    2008-07-23 20:26:41 0 d-------- C:\WINDOWS\system32\LogFiles
    2008-07-23 20:26:41 0 d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-07-23 20:26:10 0 d-------- C:\Program Files\MSBuild
    2008-07-23 20:24:22 0 d-------- C:\WINDOWS\system32\XPSViewer
    2008-07-23 20:24:03 0 d-------- C:\Program Files\Reference Assemblies
    2008-07-23 20:23:31 0 d-------- C:\150b1b56dc552bb820d11aeaeab9
    2008-07-23 20:23:20 0 d-------- C:\Documents and Settings\John\Contacts
    2008-07-23 20:23:04 0 d-------- C:\WINDOWS\RegisteredPackages
    2008-07-23 20:22:11 0 d-------- C:\WINDOWS\system32\URTTEMP
    2008-07-23 20:07:00 0 d-------- C:\Documents and Settings\John\Application Data\ATI
    2008-07-23 20:07:00 0 d-------- C:\Documents and Settings\All Users\Application Data\ATI
    2008-07-23 20:06:38 0 --a------ C:\WINDOWS\ativpsrm.bin
    2008-07-23 19:11:13 0 d--hs---- C:\Documents and Settings\John\UserData
    2008-07-23 18:34:54 0 d-------- C:\Documents and Settings\John\Application Data\Identities
    2008-07-23 18:34:36 0 d--h----- C:\Documents and Settings\John\Templates
    2008-07-23 18:34:36 0 dr------- C:\Documents and Settings\John\Start Menu
    2008-07-23 18:34:36 0 dr-h----- C:\Documents and Settings\John\SendTo
    2008-07-23 18:34:36 0 dr-h----- C:\Documents and Settings\John\Recent
    2008-07-23 18:34:36 0 d--h----- C:\Documents and Settings\John\PrintHood
    2008-07-23 18:34:36 4456448 --ah----- C:\Documents and Settings\John\NTUSER.DAT
    2008-07-23 18:34:36 0 d--h----- C:\Documents and Settings\John\NetHood
    2008-07-23 18:34:36 0 dr------- C:\Documents and Settings\John\My Documents
    2008-07-23 18:34:36 0 d--h----- C:\Documents and Settings\John\Local Settings
    2008-07-23 18:34:36 0 dr------- C:\Documents and Settings\John\Favorites
    2008-07-23 18:34:36 0 d-------- C:\Documents and Settings\John\Desktop
    2008-07-23 18:34:36 0 d--hs---- C:\Documents and Settings\John\Cookies
    2008-07-23 18:34:36 0 dr-h----- C:\Documents and Settings\John\Application Data
    2008-07-23 18:28:45 593920 --a------ C:\WINDOWS\system32\ati2sgag.exe <Not Verified; ; ATI Smart>
    2008-07-23 18:28:32 0 d-------- C:\Program Files\ATI Technologies
    2008-07-23 18:23:28 0 d-------- C:\ATI
    2008-07-23 18:22:49 0 d-------- C:\WINDOWS\system32\Lang
    2008-07-23 18:21:13 49152 --a------ C:\WINDOWS\system32\ChCfg.exe
    2008-07-23 18:20:59 0 d-------- C:\WINDOWS\system32\RTCOM
    2008-07-23 18:20:51 0 d-------- C:\Program Files\Realtek
    2008-07-23 18:20:51 0 d--h----- C:\Program Files\InstallShield Installation Information
    2008-07-23 18:20:48 520192 --a------ C:\WINDOWS\RtlExUpd.dll <Not Verified; Realtek Semiconductor Corp.; RtlExUpd Dynamic Link Library>
    2008-07-23 18:19:43 315392 --a------ C:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program>
    2008-07-23 17:57:03 0 d-------- C:\WINDOWS\system32\scripting
    2008-07-23 17:57:03 0 d-------- C:\WINDOWS\l2schemas
    2008-07-23 17:57:02 0 d-------- C:\WINDOWS\system32\en
    2008-07-23 17:57:02 0 d-------- C:\WINDOWS\system32\bits
    2008-07-23 17:54:37 0 d-------- C:\WINDOWS\network diagnostic
    2008-07-23 17:53:56 0 d-------- C:\WINDOWS\system32\ReinstallBackups
    2008-07-23 17:34:32 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
    2008-07-23 15:51:43 0 d-------- C:\WINDOWS\system32\PreInstall
    2008-07-23 15:51:42 0 d--h----- C:\WINDOWS\$hf_mig$
    2008-07-23 15:36:57 0 d-------- C:\WINDOWS\system32\SoftwareDistribution
    2008-07-23 15:36:21 0 d---s---- C:\Documents and Settings\Administrator\UserData
    2008-07-23 15:35:27 0 d-------- C:\Program Files\Marvell
    2008-07-23 15:35:16 0 d-------- C:\Program Files\Common Files\InstallShield
    2008-07-23 15:27:22 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities
    2008-07-23 15:27:15 0 d--h----- C:\Documents and Settings\Administrator\Templates
    2008-07-23 15:27:15 0 dr------- C:\Documents and Settings\Administrator\Start Menu
    2008-07-23 15:27:15 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
    2008-07-23 15:27:15 0 dr-h----- C:\Documents and Settings\Administrator\Recent
    2008-07-23 15:27:15 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
    2008-07-23 15:27:15 3407872 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT
    2008-07-23 15:27:15 0 d--h----- C:\Documents and Settings\Administrator\NetHood
    2008-07-23 15:27:15 0 dr------- C:\Documents and Settings\Administrator\My Documents
    2008-07-23 15:27:15 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
    2008-07-23 15:27:15 0 dr------- C:\Documents and Settings\Administrator\Favorites
    2008-07-23 15:27:15 0 d-------- C:\Documents and Settings\Administrator\Desktop
    2008-07-23 15:27:15 0 d---s---- C:\Documents and Settings\Administrator\Cookies
    2008-07-23 15:27:15 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
    2008-07-23 15:27:15 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
    2008-07-23 14:02:20 0 d-------- C:\WINDOWS\SoftwareDistribution
    2008-07-23 14:02:18 0 d---s---- C:\WINDOWS\system32\Microsoft
    2008-07-23 14:02:17 262144 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT
    2008-07-23 14:02:17 0 d--h----- C:\Documents and Settings\LocalService\Local Settings
    2008-07-23 14:02:17 0 d--hs---- C:\Documents and Settings\LocalService\Cookies
    2008-07-23 14:02:17 0 d-------- C:\Documents and Settings\LocalService\Application Data
    2008-07-23 14:02:17 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
    2008-07-23 14:02:12 0 d---s---- C:\Documents and Settings\NetworkService\Cookies
    2008-07-23 14:02:12 0 d-------- C:\Documents and Settings\NetworkService\Application Data
    2008-07-23 14:02:12 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
    2008-07-23 14:02:11 262144 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT
    2008-07-23 14:02:11 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings
    2008-07-23 13:55:31 0 d-------- C:\WINDOWS\system32\xircom
    2008-07-23 13:55:31 0 d-------- C:\Program Files\microsoft frontpage
    2008-07-23 13:55:25 262144 --ah----- C:\Documents and
     
    JohnnyQuad,
    #1
  2. 2008/07/24
    JohnnyQuad

    JohnnyQuad Inactive Thread Starter

    Joined:
    2008/07/22
    Messages:
    9
    Likes Received:
    0
    cont

    Settings\Default User\NTUSER.DAT
    2008-07-23 13:55:22 0 -rahs---- C:\MSDOS.SYS
    2008-07-23 13:55:22 0 -rahs---- C:\IO.SYS
    2008-07-23 13:55:22 0 --a------ C:\CONFIG.SYS
    2008-07-23 13:55:22 0 --a------ C:\AUTOEXEC.BAT
    2008-07-23 13:54:47 0 d--hs---- C:\Documents and Settings\All Users\DRM
    2008-07-23 13:54:42 0 dr------- C:\WINDOWS\Offline Web Pages
    2008-07-23 13:54:42 0 d---s---- C:\WINDOWS\Downloaded Program Files
    2008-07-23 13:54:35 0 d--h----- C:\Program Files\WindowsUpdate
    2008-07-23 13:54:24 0 d-------- C:\WINDOWS\system32\DirectX
    2008-07-23 13:54:02 0 d---s---- C:\WINDOWS\Tasks
    2008-07-23 13:54:01 0 d-------- C:\Program Files\Common Files\MSSoap
    2008-07-23 13:53:59 0 d-------- C:\WINDOWS\srchasst
    2008-07-23 13:53:58 0 d-------- C:\WINDOWS\system32\Macromed
    2008-07-23 13:53:53 0 d-------- C:\Program Files\Movie Maker
    2008-07-23 13:53:47 0 d-------- C:\WINDOWS\system32\Restore
    2008-07-23 13:53:25 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
    2008-07-23 13:53:14 0 d-------- C:\WINDOWS\Registration
    2008-07-23 13:53:09 0 d-------- C:\Program Files\Online Services
    2008-07-23 13:53:05 0 d-------- C:\Program Files\Messenger
    2008-07-23 13:53:03 0 d-------- C:\Program Files\MSN Gaming Zone
    2008-07-23 13:52:37 0 d-------- C:\Program Files\Windows NT
    2008-07-23 13:52:35 0 d-------- C:\WINDOWS\system32\MsDtc
    2008-07-23 13:52:34 0 d-------- C:\WINDOWS\system32\Com
    2008-07-23 06:46:17 0 d--hs---- C:\WINDOWS\Installer
    2008-07-23 06:46:16 0 d-------- C:\Program Files\Common Files\ODBC
    2008-07-23 06:46:14 0 dr------- C:\Program Files
    2008-07-23 06:46:14 0 d-------- C:\Program Files\Common Files
    2008-07-23 06:46:14 0 d-------- C:\Program Files\Common Files\SpeechEngines
    2008-07-23 06:45:58 0 d--h----- C:\Documents and Settings\Default User\Templates
    2008-07-23 06:45:58 0 dr------- C:\Documents and Settings\Default User\Start Menu
    2008-07-23 06:45:58 0 dr-h----- C:\Documents and Settings\Default User\SendTo
    2008-07-23 06:45:58 0 d--h----- C:\Documents and Settings\Default User\Recent
    2008-07-23 06:45:58 0 d--h----- C:\Documents and Settings\Default User\PrintHood
    2008-07-23 06:45:58 0 d--h----- C:\Documents and Settings\Default User\NetHood
    2008-07-23 06:45:58 0 d-------- C:\Documents and Settings\Default User\My Documents
    2008-07-23 06:45:58 0 dr-h----- C:\Documents and Settings\Default User\Local Settings
    2008-07-23 06:45:58 0 d-------- C:\Documents and Settings\Default User\Favorites
    2008-07-23 06:45:58 0 d-------- C:\Documents and Settings\Default User\Desktop
    2008-07-23 06:45:58 0 d---s---- C:\Documents and Settings\Default User\Cookies
    2008-07-23 06:45:58 0 d--h----- C:\Documents and Settings\All Users\Templates
    2008-07-23 06:45:58 0 dr------- C:\Documents and Settings\All Users\Start Menu
    2008-07-23 06:45:58 0 d-------- C:\Documents and Settings\All Users\Favorites
    2008-07-23 06:45:58 0 dr------- C:\Documents and Settings\All Users\Documents
    2008-07-23 06:45:58 0 d-------- C:\Documents and Settings\All Users\Desktop
    2008-07-23 06:45:48 0 d-------- C:\WINDOWS\system32\CatRoot2
    2008-07-23 06:45:48 0 d-------- C:\WINDOWS\system32\CatRoot
    2008-07-23 06:45:43 0 dr-h----- C:\Documents and Settings\Default User\Application Data
    2008-07-23 06:45:43 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
    2008-07-23 06:45:43 0 dr-h----- C:\Documents and Settings\All Users\Application Data
    2008-07-23 06:45:43 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
    2008-07-23 06:45:22 0 d--hs---- C:\System Volume Information
    2008-07-23 06:45:22 0 d-------- C:\Documents and Settings
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\WinSxS
    2008-07-23 06:41:04 0 dr------- C:\WINDOWS\Web
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\twain_32
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\wins
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\wbem
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\usmt
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\spool
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\ShellExt
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\Setup
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\ras
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\oobe
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\npp
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\mui
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\inetsrv
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\IME
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\icsxml
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\ias
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\export
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\drivers
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\drivers\etc
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\drivers\disdn
    2008-07-23 06:41:04 0 dr-hs--c- C:\WINDOWS\system32\dllcache
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\dhcp
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\config
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\3com_dmi
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\3076
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\2052
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\1054
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\1042
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\1041
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\1037
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\1033
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\1031
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\1028
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\1025
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\security
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Resources
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\repair
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Provisioning
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\PeerNet
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\pchealth
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\mui
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\msapps
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\msagent
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Media
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\java
    2008-07-23 06:41:04 0 d--h----- C:\WINDOWS\inf
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\ime
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Help
    2008-07-23 06:41:04 0 dr--s---- C:\WINDOWS\Fonts
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\ehome
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Driver Cache
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Debug
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Cursors
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Connection Wizard
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Config
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\AppPatch
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\addins


    -- Find3M Report ---------------------------------------------------------------

    2008-07-23 06:45:58 62 --ahs---- C:\Documents and Settings\John\Application Data\desktop.ini


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{018B27FF-E05F-4CB5-8763-540CB3FD457A}]
    07/24/2008 07:59 AM 26112 --a------ C:\WINDOWS\system32\qoMeBqoP.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7FF7C21C-046C-45C2-923E-63B41319F76B}]
    C:\WINDOWS\system32\mlJaxuUM.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "StartCCC "= "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [01/21/2008 12:17 PM]
    "RTHDCPL "= "RTHDCPL.EXE" [05/10/2007 06:08 PM C:\WINDOWS\RTHDCPL.exe]
    "Alcmtr "= "ALCMTR.EXE" [05/03/2005 06:43 PM C:\WINDOWS\Alcmtr.exe]
    "AsusServiceProvider "= "C:\Program Files\ASUS\AASP\1.00.12\aaCenter.exe" [10/23/2006 09:28 PM]
    "AsusStartupHelp "= "C:\Program Files\ASUS\AASP\1.00.12\AsRunHelp.exe" [10/30/2006 04:07 PM]
    "Kernel and Hardware Abstraction Layer "= "KHALMNPR.EXE" [02/29/2008 03:12 AM C:\WINDOWS\KHALMNPR.Exe]
    "Launch LCDMon "= "C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe" [04/26/2007 04:54 PM]
    "Launch LGDCore "= "C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" [04/26/2007 05:22 PM]
    "pccguide.exe "= "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe" [04/12/2007 03:58 AM]
    "BMaf8ec848 "= "C:\WINDOWS\system32\lmqcsmbl.dll" []

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [04/13/2008 05:12 PM]
    "MsnMsgr "= "C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [10/18/2007 11:34 AM]
    "BitTorrent DNA "= "C:\Program Files\DNA\btdna.exe" [07/23/2008 10:01 PM]
    "Skype "= "C:\Program Files\Skype\Phone\Skype.exe" [05/30/2008 03:54 PM]
    "SpybotSD TeaTimer "= "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [07/07/2008 09:42 AM]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
    "SpybotDeletingB9585 "=command /c del "C:\WINDOWS\system32\qoMeBqoP.dll "
    "SpybotDeletingD8164 "=cmd /c del "C:\WINDOWS\system32\qoMeBqoP.dll "
    "SpybotDeletingB1568 "=command /c del "C:\WINDOWS\system32\mlJaxuUM.dll_old "
    "SpybotDeletingD7733 "=cmd /c del "C:\WINDOWS\system32\mlJaxuUM.dll_old "
    "SpybotDeletingB9192 "=command /c del "C:\WINDOWS\system32\lmqcsmbl.dll_old "
    "SpybotDeletingD9405 "=cmd /c del "C:\WINDOWS\system32\lmqcsmbl.dll_old "

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
    "Spybot - Search & Destroy "= "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
    "SpybotDeletingA9967 "=command /c del "C:\WINDOWS\system32\qoMeBqoP.dll "
    "SpybotDeletingC4320 "=cmd /c del "C:\WINDOWS\system32\qoMeBqoP.dll "
    "SpybotDeletingA7362 "=command /c del "C:\WINDOWS\system32\mlJaxuUM.dll_old "
    "SpybotDeletingC3908 "=cmd /c del "C:\WINDOWS\system32\mlJaxuUM.dll_old "
    "SpybotDeletingA128 "=command /c del "C:\WINDOWS\system32\lmqcsmbl.dll_old "
    "SpybotDeletingC3092 "=cmd /c del "C:\WINDOWS\system32\lmqcsmbl.dll_old "

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [7/24/2008 12:16:17 AM]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5} "= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [05/26/2008 10:19 PM 304128]
    "{018B27FF-E05F-4CB5-8763-540CB3FD457A} "= C:\WINDOWS\system32\qoMeBqoP.dll [07/24/2008 07:59 AM 26112]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
    C:\WINDOWS\System32\dimsntfy.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 05/02/2008 02:42 AM 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qoMeBqoP]
    qoMeBqoP.dll 07/24/2008 07:59 AM 26112 C:\WINDOWS\system32\qoMeBqoP.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Authentication Packages "= msv1_0 C:\WINDOWS\system32\mlJaxuUM
    "Notification Packages "= scecli scecli

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=" "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMaf8ec848]
    Rundll32.exe "C:\WINDOWS\system32\lmqcsmbl.dll ",s

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
    "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch Ai Booster]
    "C:\Program Files\ASUS\AI Booster\OverClk.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winnov Menu]
    "C:\Program Files\Winnov Videum NT\WnvMenu.Exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winnov Remote]
    "C:\Program Files\Winnov Videum NT\WnvRsvr.Exe" -AutoStart

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winnov Status]
    "C:\Program Files\Winnov Videum NT\WvStatus.Exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    eapsvcs eaphost
    dot3svc dot3svc

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    napagent
    hkmsvc




    -- Hosts -----------------------------------------------------------------------

    127.0.0.1 www.007guard.com
    127.0.0.1 007guard.com
    127.0.0.1 008i.com
    127.0.0.1 www.008k.com
    127.0.0.1 008k.com
    127.0.0.1 www.00hq.com
    127.0.0.1 00hq.com
    127.0.0.1 010402.com
    127.0.0.1 www.032439.com
    127.0.0.1 032439.com

    8910 more entries in hosts file.


    -- End of Deckard's System Scanner: finished at 2008-07-24 12:13:40 ------------
     
    JohnnyQuad,
    #2


  3. to hide this advert.

  4. 2008/07/24
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Welcome to WindowsBBS JohnnyQuad :)

    If you have not restarted the computer since running Spybot, please do so now.

    Then, Since your Deckards log is missing the top portion, I cannot tell what revision your operating system is. If it is pre-Service Pack 1 and you have not yet installed SP1, please do so now, else any attempt at cleaning would be in vain. You would/could become infected again within minutes of connecting to the internet. Please do not install any other Service Packs until we get you cleaned up.

    Now, download ComboFix by sUBs from here, saving the file to your desktop.


    Please disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall
     
    noahdfear,
    #3
  5. 2008/07/24
    JohnnyQuad

    JohnnyQuad Inactive Thread Starter

    Joined:
    2008/07/22
    Messages:
    9
    Likes Received:
    0
    ComboFix 08-07-24.1 - John 2008-07-24 19:21:05.1 - NTFSx86
    Running from: C:\Documents and Settings\John\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((( Files Created from 2008-06-25 to 2008-07-25 )))))))))))))))))))))))))))))))
    .

    2008-07-24 16:35 . 2008-07-24 16:35 <DIR> d-------- C:\WINDOWS\Sun
    2008-07-24 16:34 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-07-24 16:32 . 2008-07-24 16:34 <DIR> d-------- C:\Program Files\Java
    2008-07-24 16:31 . 2008-07-24 16:31 <DIR> d-------- C:\Program Files\Common Files\Java
    2008-07-24 14:35 . 2008-07-24 14:35 <DIR> d-------- C:\Documents and Settings\John\Application Data\Malwarebytes
    2008-07-24 14:32 . 2008-07-24 14:34 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-07-24 14:32 . 2008-07-24 14:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-07-24 14:32 . 2008-07-23 20:09 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-07-24 14:32 . 2008-07-23 20:09 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-07-24 11:50 . 2008-07-24 11:50 <DIR> d-------- C:\Deckard
    2008-07-24 11:30 . 2008-07-24 14:39 428 --a------ C:\WINDOWS\wininit.ini
    2008-07-24 10:58 . 2008-07-24 10:58 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-07-24 10:58 . 2008-07-24 16:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-07-24 09:52 . 2008-05-02 16:17 1,169,240 --a------ C:\WINDOWS\system32\drivers\vsapint.sys
    2008-07-24 09:52 . 2007-04-12 03:58 300,816 --a------ C:\WINDOWS\system32\drivers\TM_CFW.sys
    2008-07-24 09:52 . 2008-05-02 16:22 205,328 --a------ C:\WINDOWS\system32\drivers\tmxpflt.sys
    2008-07-24 09:52 . 2007-04-12 03:58 112,400 --a------ C:\WINDOWS\system32\drivers\tm_mbd_c.sys
    2008-07-24 09:52 . 2007-04-12 03:58 75,792 --a------ C:\WINDOWS\system32\drivers\tmtdi.sys
    2008-07-24 09:52 . 2008-05-02 16:21 36,368 --a------ C:\WINDOWS\system32\drivers\tmpreflt.sys
    2008-07-24 09:51 . 2008-07-24 11:44 <DIR> d-------- C:\Program Files\Trend Micro
    2008-07-24 09:05 . 2008-07-24 09:05 <DIR> d-------- C:\Logs
    2008-07-24 08:07 . 2008-07-24 08:07 5,775 --a------ C:\WINDOWS\system32\xwnfanfr.dll
    2008-07-24 08:01 . 2008-07-24 09:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro
    2008-07-24 00:18 . 2008-07-24 00:18 <DIR> d-------- C:\Program Files\Common Files\Logitech
    2008-07-24 00:18 . 2008-07-24 00:18 <DIR> d-------- C:\Documents and Settings\John\Application Data\Logitech
    2008-07-24 00:18 . 2008-07-24 00:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\LogiShrd
    2008-07-24 00:17 . 2008-07-24 00:17 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
    2008-07-24 00:17 . 2008-07-24 00:17 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
    2008-07-24 00:16 . 2008-05-02 02:38 301,656 --a------ C:\WINDOWS\system32\BtCoreIf.dll
    2008-07-24 00:16 . 2008-05-02 02:39 170,512 --a------ C:\WINDOWS\system32\kemutb.dll
    2008-07-24 00:16 . 2008-05-02 02:39 145,936 --a------ C:\WINDOWS\system32\KemUtil.dll
    2008-07-24 00:16 . 2008-05-02 02:40 117,264 --a------ C:\WINDOWS\system32\KemWnd.dll
    2008-07-24 00:16 . 2008-05-02 02:40 84,496 --a------ C:\WINDOWS\system32\KemXML.dll
    2008-07-24 00:15 . 2008-07-24 00:18 <DIR> d-------- C:\Program Files\Logitech
    2008-07-24 00:15 . 2008-07-24 00:16 <DIR> d-------- C:\Program Files\Common Files\Logishrd
    2008-07-24 00:15 . 2008-07-24 00:15 <DIR> d-------- C:\Documents and Settings\John\Application Data\InstallShield
    2008-07-24 00:15 . 2008-07-24 00:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Logitech
    2008-07-24 00:12 . 2008-07-24 00:12 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment
    2008-07-24 00:11 . 2008-07-24 09:27 <DIR> d-------- C:\Program Files\World of Warcraft
    2008-07-23 23:28 . 2008-07-23 23:28 <DIR> d-------- C:\WINDOWS\ServicePackFiles
    2008-07-23 23:18 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
    2008-07-23 23:18 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
    2008-07-23 23:06 . 2008-07-24 16:00 <DIR> d-------- C:\Documents and Settings\John\Application Data\skypePM
    2008-07-23 23:06 . 2008-07-23 23:06 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
    2008-07-23 23:01 . 2008-07-23 23:01 <DIR> d-------- C:\Program Files\Skype
    2008-07-23 23:01 . 2008-07-23 23:01 <DIR> d-------- C:\Program Files\Common Files\Skype
    2008-07-23 23:01 . 2008-07-24 19:01 <DIR> d-------- C:\Documents and Settings\John\Application Data\Skype
    2008-07-23 23:01 . 2008-07-23 23:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype
    2008-07-23 22:24 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
    2008-07-23 22:23 . 2008-07-23 22:23 <DIR> d-------- C:\Program Files\Microsoft Works
    2008-07-23 22:22 . 2008-07-23 22:22 <DIR> d-------- C:\Program Files\Microsoft.NET
    2008-07-23 22:20 . 2008-07-23 22:20 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
    2008-07-23 22:20 . 2008-07-24 00:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-07-23 22:08 . 2008-07-24 14:03 <DIR> d-------- C:\Documents and Settings\John\Application Data\BitTorrent
    2008-07-23 22:05 . 2008-07-23 22:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
    2008-07-23 22:03 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
    2008-07-23 22:03 . 2008-07-23 22:03 376 --a------ C:\WINDOWS\ODBC.INI
    2008-07-23 22:02 . 2008-07-23 22:26 <DIR> d-------- C:\WINDOWS\SHELLNEW
    2008-07-23 22:01 . 2008-07-23 22:01 <DIR> d-------- C:\Program Files\DNA
    2008-07-23 22:01 . 2008-07-23 22:01 <DIR> d-------- C:\Program Files\BitTorrent
    2008-07-23 22:01 . 2008-07-24 19:25 <DIR> d-------- C:\Documents and Settings\John\Application Data\DNA
    2008-07-23 21:44 . 2008-07-23 21:44 <DIR> dr-h----- C:\MSOCache
    2008-07-23 21:25 . 2008-07-23 21:25 <DIR> d-------- C:\Program Files\GS
    2008-07-23 21:06 . 2008-07-23 21:06 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
    2008-07-23 21:04 . 2008-07-23 21:06 <DIR> d-------- C:\Program Files\Windows Live
    2008-07-23 21:04 . 2008-07-23 21:06 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
    2008-07-23 21:04 . 2008-07-23 21:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-07-23 20:48 . 2008-07-23 20:48 <DIR> d-------- C:\Program Files\Intel
    2008-07-23 20:45 . 2006-01-10 16:50 24,576 --a------ C:\WINDOWS\system32\AsIO.dll
    2008-07-23 20:45 . 2006-10-19 03:11 12,096 --a------ C:\WINDOWS\system32\drivers\AsInsHelp64.sys
    2008-07-23 20:45 . 2006-10-19 03:11 10,304 --a------ C:\WINDOWS\system32\drivers\AsInsHelp32.sys
    2008-07-23 20:45 . 2005-12-22 10:22 5,685 --a------ C:\WINDOWS\system32\drivers\AsIO.sys
    2008-07-23 20:44 . 2008-07-23 20:45 <DIR> d-------- C:\Program Files\ASUS
    2008-07-23 20:42 . 2008-07-23 20:42 <DIR> d-------- C:\Program Files\Winnov Videum NT
    2008-07-23 20:42 . 2008-07-23 20:42 <DIR> d-------- C:\Documents and Settings\John\WINDOWS
    2008-07-23 20:40 . 2006-05-08 09:54 647,872 --a------ C:\WINDOWS\system32\MSComCt2.ocx
    2008-07-23 20:38 . 2008-07-23 20:38 <DIR> d-------- C:\Program Files\Common Files\IviSDK
    2008-07-23 20:38 . 2008-07-23 20:38 2,109 --a------ C:\WINDOWS\HCWPNP.INI
    2008-07-23 20:37 . 2008-07-23 20:40 <DIR> d-------- C:\Program Files\WinTV
    2008-07-23 20:28 . 2008-07-23 20:28 <DIR> d-------- C:\Documents and Settings\John\Application Data\Windows Desktop Search
    2008-07-23 20:27 . 2008-07-23 20:27 <DIR> d-------- C:\WINDOWS\system32\GroupPolicy
    2008-07-23 20:27 . 2008-07-23 20:27 <DIR> d-------- C:\Program Files\Windows Media Connect 2
    2008-07-23 20:27 . 2008-07-23 20:27 <DIR> d-------- C:\Program Files\Windows Desktop Search
    2008-07-23 20:26 . 2008-07-23 20:26 <DIR> d-------- C:\WINDOWS\system32\LogFiles
    2008-07-23 20:26 . 2008-07-23 20:26 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-07-23 20:26 . 2008-07-23 22:23 <DIR> d-------- C:\Program Files\MSBuild
    2008-07-23 20:24 . 2008-07-23 20:24 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
    2008-07-23 20:24 . 2008-07-23 20:24 <DIR> d-------- C:\Program Files\Reference Assemblies
    2008-07-23 20:23 . 2008-07-23 20:23 <DIR> d-------- C:\Documents and Settings\John\Contacts
    2008-07-23 20:23 . 2008-07-23 20:23 <DIR> d-------- C:\150b1b56dc552bb820d11aeaeab9
    2008-07-23 20:23 . 2006-06-29 13:07 14,048 --a------ C:\WINDOWS\system32\spmsg2.dll
    2008-07-23 20:22 . 2008-07-23 20:22 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
    2008-07-23 20:21 . 2008-04-13 17:12 290,304 --a------ C:\WINDOWS\system32\rhttpaa.dll
    2008-07-23 20:21 . 2008-04-13 17:11 136,192 --a------ C:\WINDOWS\system32\aaclient.dll
    2008-07-23 20:21 . 2008-04-13 17:12 53,248 --a------ C:\WINDOWS\system32\tsgqec.dll
    2008-07-23 20:07 . 2008-07-23 20:07 <DIR> d-------- C:\Documents and Settings\John\Application Data\ATI
    2008-07-23 20:07 . 2008-07-23 20:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI
    2008-07-23 20:06 . 2008-07-23 20:06 0 --a------ C:\WINDOWS\ativpsrm.bin
    2008-07-23 20:01 . 2008-05-06 22:12 1,288,192 -----c--- C:\WINDOWS\system32\dllcache\quartz.dll
    2008-07-23 19:54 . 2008-04-13 17:12 28,672 --a------ C:\WINDOWS\system32\vidcap.ax
    2008-07-23 19:11 . 2008-07-23 19:11 <DIR> d--hs---- C:\Documents and Settings\John\UserData
    2008-07-23 18:34 . 2008-07-24 10:33 <DIR> d-------- C:\Documents and Settings\John
    2008-07-23 18:34 . 2008-04-13 17:12 91,136 --a------ C:\WINDOWS\system32\kswdmcap.ax
    2008-07-23 18:34 . 2008-04-13 17:12 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax
    2008-07-23 18:34 . 2008-04-13 17:12 56,832 --a------ C:\WINDOWS\system32\msdvbnp.ax
    2008-07-23 18:34 . 2008-04-13 17:12 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax
    2008-07-23 18:34 . 2008-04-13 17:12 18,432 --a------ C:\WINDOWS\system32\bdaplgin.ax
    2008-07-23 18:34 . 2008-04-13 11:46 11,776 --a------ C:\WINDOWS\system32\drivers\bdasup.sys
    2008-07-23 18:28 . 2008-07-23 20:04 <DIR> d-------- C:\Program Files\ATI Technologies
    2008-07-23 18:28 . 2008-07-03 21:05 593,920 --a------ C:\WINDOWS\system32\ati2sgag.exe
    2008-07-23 18:28 . 2008-05-14 18:24 171,520 --a------ C:\WINDOWS\system32\drivers\atinavt2.sys
    2008-07-23 18:28 . 2008-05-14 18:25 106,496 --a------ C:\WINDOWS\system32\atinppt2.ax
    2008-07-23 18:28 . 2005-12-02 14:49 64,352 --a------ C:\WINDOWS\system32\drivers\ativmc01.cod
    2008-07-23 18:23 . 2008-07-23 18:23 <DIR> d-------- C:\ATI
    2008-07-23 18:22 . 2008-07-23 18:22 <DIR> d-------- C:\WINDOWS\system32\Lang
    2008-07-23 18:22 . 2008-07-23 18:22 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
    2008-07-23 18:22 . 2008-07-23 18:22 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
    2008-07-23 18:20 . 2008-07-23 20:10 <DIR> d-------- C:\WINDOWS\system32\RTCOM
    2008-07-23 18:20 . 2008-07-23 20:09 <DIR> d-------- C:\Program Files\Realtek
    2008-07-23 18:20 . 2008-07-24 00:15 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
    2008-07-23 18:19 . 2008-07-23 18:19 315,392 --a------ C:\WINDOWS\HideWin.exe
    2008-07-23 18:16 . 2008-06-13 04:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
    2008-07-23 18:16 . 2008-05-08 07:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-07-23 17:57 . 2008-07-23 23:29 <DIR> d-------- C:\WINDOWS\system32\scripting
    2008-07-23 17:57 . 2008-07-23 23:29 <DIR> d-------- C:\WINDOWS\system32\en

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-07-23 20:55 --------- d-----w C:\Program Files\microsoft frontpage
    2008-07-04 06:33 3,230,720 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
    2008-07-04 03:48 9,490,432 ----a-w C:\WINDOWS\system32\atioglx2.dll
    2008-07-04 03:25 421,888 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
    2008-07-04 03:23 309,248 ----a-w C:\WINDOWS\system32\ati2dvag.dll
    2008-07-04 03:14 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
    2008-07-04 03:14 184,320 ----a-w C:\WINDOWS\system32\atipdlxx.dll
    2008-07-04 03:14 143,360 ----a-w C:\WINDOWS\system32\Oemdspif.dll
    2008-07-04 03:13 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
    2008-07-04 03:13 139,264 ----a-w C:\WINDOWS\system32\ati2evxx.dll
    2008-07-04 03:12 561,152 ----a-w C:\WINDOWS\system32\ati2evxx.exe
    2008-07-04 03:10 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
    2008-07-04 03:06 253,952 ----a-w C:\WINDOWS\system32\atiok3x2.dll
    2008-07-04 03:00 3,786,144 ----a-w C:\WINDOWS\system32\ati3duag.dll
    2008-07-04 02:55 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
    2008-07-04 02:49 2,140,672 ----a-w C:\WINDOWS\system32\ativvaxx.dll
    2008-07-04 02:30 348,160 ----a-w C:\WINDOWS\system32\atikvmag.dll
    2008-07-04 02:28 53,248 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
    2008-07-04 02:28 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
    2008-07-04 02:25 5,439,488 ----a-w C:\WINDOWS\system32\atioglxx.dll
    2008-07-04 02:22 565,248 ----a-w C:\WINDOWS\system32\ati2cqag.dll
    2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
    2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
    2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys
    2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
    2008-06-13 11:05 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
    2008-05-27 05:21 1,582,592 ----a-w C:\WINDOWS\system32\tquery.dll
    2008-05-27 05:21 1,418,240 ----a-w C:\WINDOWS\system32\mssrch.dll
    2008-05-27 05:19 97,792 ----a-w C:\WINDOWS\system32\UncCplExt.dll
    2008-05-27 05:19 273,408 ----a-w C:\WINDOWS\system32\oeph.dll
    2008-05-27 05:19 2,048 ----a-w C:\WINDOWS\system32\UncRes.dll
    2008-05-27 05:19 143,872 ----a-w C:\WINDOWS\system32\UncDMS.dll
    2008-05-27 05:19 131,072 ----a-w C:\WINDOWS\system32\UncPH.dll
    2008-05-27 05:19 11,264 ----a-w C:\WINDOWS\system32\oephRes.dll
    2008-05-27 05:19 108,032 ----a-w C:\WINDOWS\system32\UncNE.dll
    2008-05-27 05:18 71,680 ----a-w C:\WINDOWS\system32\propdefs.dll
    2008-05-27 05:18 56,320 ----a-w C:\WINDOWS\system32\xmlfilter.dll
    2008-05-27 05:18 44,032 ----a-w C:\WINDOWS\system32\msstrc.dll
    2008-05-27 05:18 439,808 ----a-w C:\WINDOWS\system32\searchindexer.exe
    2008-05-27 05:18 38,400 ----a-w C:\WINDOWS\system32\rtffilt.dll
    2008-05-27 05:18 350,208 ----a-w C:\WINDOWS\system32\mssph.dll
    2008-05-27 05:18 231,936 ----a-w C:\WINDOWS\system32\msshsq.dll
    2008-05-27 05:18 203,776 ----a-w C:\WINDOWS\system32\mssphtb.dll
    2008-05-27 05:18 184,832 ----a-w C:\WINDOWS\system32\searchprotocolhost.exe
    2008-05-27 05:17 87,552 ----a-w C:\WINDOWS\system32\searchfilterhost.exe
    2008-05-27 05:17 87,552 ----a-w C:\WINDOWS\system32\mssitlb.dll
    2008-05-27 05:17 754,176 ----a-w C:\WINDOWS\system32\propsys.dll
    2008-05-27 05:17 60,416 ----a-w C:\WINDOWS\system32\msscntrs.dll
    2008-05-27 05:17 34,816 ----a-w C:\WINDOWS\system32\msscb.dll
    2008-05-27 05:17 32,768 ----a-w C:\WINDOWS\system32\mssprxy.dll
    2008-05-27 05:17 301,568 ----a-w C:\WINDOWS\system32\srchadmin.dll
    2008-05-27 05:17 11,776 ----a-w C:\WINDOWS\system32\msshooks.dll
    2008-05-27 04:59 18,904 ----a-w C:\WINDOWS\system32\structuredqueryschematrivial.bin
    2008-05-27 04:59 106,605 ----a-w C:\WINDOWS\system32\structuredqueryschema.bin
    2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 17:12 15360]
    "MsnMsgr "= "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
    "BitTorrent DNA "= "C:\Program Files\DNA\btdna.exe" [2008-07-23 22:01 341824]
    "Skype "= "C:\Program Files\Skype\Phone\Skype.exe" [2008-05-30 15:54 21718312]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "StartCCC "= "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
    "AsusServiceProvider "= "C:\Program Files\ASUS\AASP\1.00.12\aaCenter.exe" [2006-10-23 21:28 593920]
    "AsusStartupHelp "= "C:\Program Files\ASUS\AASP\1.00.12\AsRunHelp.exe" [2006-10-30 16:07 362496]
    "Launch LCDMon "= "C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe" [2007-04-26 16:54 774168]
    "Launch LGDCore "= "C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" [2007-04-26 17:22 1132056]
    "pccguide.exe "= "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe" [2007-04-12 03:58 3429904]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
    "RTHDCPL "= "RTHDCPL.EXE" [2007-05-10 18:08 16342528 C:\WINDOWS\RTHDCPL.exe]
    "Kernel and Hardware Abstraction Layer "= "KHALMNPR.EXE" [2008-02-29 03:12 76304 C:\WINDOWS\KHALMNPR.Exe]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-07-24 00:16:17 805392]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5} "= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 22:19 304128]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    2008-05-02 02:42 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.I420 "= WnvYV12.dll
    "VIDC.IYUV "= WnvYV12.dll
    "VIDC.YUY2 "= WnvPlay1.dll
    "WAVE1 "= WnvWav32.dll
    "MIXER1 "= WnvMxr.dll
    "VIDC.WNV1 "= WnvPlay1.dll
    "VIDC.YUV8 "= WnvYUV8.DLL
    "VIDC.WINX "= WnvWINX.dll
    "VIDC.YV12 "= WnvYV12.dll
    "VIDC.MPG4 "= ompg4c32.DLL
    "MIXER8 "= WnvMxr.dll
    "WAVE8 "= WnvWav32.dll
    "MSVIDEO "= WnvVid32.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Notification Packages REG_MULTI_SZ scecli scecli

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=" "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
    --a------ 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch Ai Booster]
    --a------ 2006-07-13 16:32 3712512 C:\Program Files\ASUS\AI Booster\OverClk.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winnov Menu]
    --a------ 2002-03-06 14:01 32768 C:\Program Files\Winnov Videum NT\WnvMenu.Exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winnov Remote]
    --a------ 2002-03-06 14:01 73728 C:\Program Files\Winnov Videum NT\WnvRsvr.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winnov Status]
    --a------ 2002-03-06 14:01 55808 C:\Program Files\Winnov Videum NT\wvstatus.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
    "DisableMonitoring "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\Winnov Videum NT\\WnvRsvr.EXE "=
    "C:\\Program Files\\GS\\REDIPlus\\Primary\\Redi.exe "=
    "C:\\Program Files\\DNA\\btdna.exe "=
    "C:\\Program Files\\BitTorrent\\bittorrent.exe "=
    "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
    "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
    "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
    "C:\\Program Files\\World of Warcraft\\WoW-2.3.0-enUS-downloader.exe "=
    "C:\\WINDOWS\\system32\\ftp.exe "=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3724:TCP "= 3724:TCP:Blizzard Downloader: 3724

    R1 Winnov32;Winnov32;C:\WINDOWS\system32\DRIVERS\Winnov32.sys [2002-03-06 10:42]
    R2 Wnvirq32Service;WnvIRQ32;C:\WINDOWS\system32\WnvIRQ32.exe [2002-03-06 09:33]
    R3 hcwPVRP2;Hauppauge WinTV PVR PCI II (Encoder);C:\WINDOWS\system32\DRIVERS\hcwPVRP2.sys [2005-09-14 18:01]
    R3 RTLWUSB;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;C:\WINDOWS\system32\DRIVERS\RTL8187.sys [2008-01-28 13:13]
    R3 WnvCOM;WnvCOM;C:\WINDOWS\system32\DRIVERS\WnvCOM.sys [2002-03-06 10:04]
    R3 WnvKVid;Winnov Kernel Video;C:\WINDOWS\system32\DRIVERS\WnvKVid.sys [2002-03-06 10:27]
    S3 WnvKAud;Winnov Kernel Audio;C:\WINDOWS\system32\DRIVERS\WnvKAud.sys [2002-03-06 10:15]
    .
    - - - - ORPHANS REMOVED - - - -

    BHO-{7FF7C21C-046C-45C2-923E-63B41319F76B} - C:\WINDOWS\system32\mlJaxuUM.dll
    HKLM-Run-BMaf8ec848 - C:\WINDOWS\system32\lmqcsmbl.dll
    MSConfigStartUp-BMaf8ec848 - C:\WINDOWS\system32\lmqcsmbl.dll


    .
    ------- Supplementary Scan -------
    .
    O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000


    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-07-24 19:29:59
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    C:\WINDOWS\explorer.exe [728] 0x89C053F8

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\WINDOWS\system32\ati2evxx.exe
    C:\WINDOWS\system32\ati2evxx.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
    C:\WINDOWS\system32\searchindexer.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\pccguide.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDPOP3.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDCountdown.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDMedia.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
    .
    **************************************************************************
    .
    Completion time: 2008-07-24 19:33:51 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-07-25 02:33:48

    Pre-Run: 277,330,186,240 bytes free
    Post-Run: 277,237,051,392 bytes free

    321 --- E O F --- 2008-07-24 07:02:57
     
    JohnnyQuad,
    #4
  6. 2008/07/24
    JohnnyQuad

    JohnnyQuad Inactive Thread Starter

    Joined:
    2008/07/22
    Messages:
    9
    Likes Received:
    0
    Deckard's System Scanner v20071014.68
    Run by John on 2008-07-24 19:37:55
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------



    -- HijackThis (run as John.exe) ------------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:38:01 PM, on 7/24/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
    C:\WINDOWS\system32\WnvIRQ32.exe
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
    C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\ASUS\AASP\1.00.12\aaCenter.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe
    C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDPOP3.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDCountdown.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDMedia.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\WINDOWS\explorer.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\WINDOWS\system32\SearchProtocolHost.exe
    C:\Documents and Settings\John\Desktop\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\John.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [AsusServiceProvider] C:\Program Files\ASUS\AASP\1.00.12\aaCenter.exe
    O4 - HKLM\..\Run: [AsusStartupHelp] C:\Program Files\ASUS\AASP\1.00.12\AsRunHelp.exe
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe "
    O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
    O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe "
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1216852594432
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1216877463531
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/J...4c/&filename=jinstall-6u7-windows-i586-jc.cab
    O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/en-US/TSEasyInstallX.CAB
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
    O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
    O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
    O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
    O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
    O23 - Service: WnvIRQ32 (Wnvirq32Service) - Winnov - C:\WINDOWS\system32\WnvIRQ32.exe

    --
    End of file - 8271 bytes

    -- Files created between 2008-06-24 and 2008-07-24 -----------------------------

    2008-07-24 19:04:02 68096 --a------ C:\WINDOWS\zip.exe
    2008-07-24 19:04:02 49152 --a------ C:\WINDOWS\VFind.exe
    2008-07-24 19:04:02 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
    2008-07-24 19:04:02 98816 --a------ C:\WINDOWS\sed.exe
    2008-07-24 19:04:02 80412 --a------ C:\WINDOWS\grep.exe
    2008-07-24 19:04:02 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
    2008-07-24 19:04:01 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
    2008-07-24 19:04:01 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
    2008-07-24 16:35:19 0 d-------- C:\WINDOWS\Sun
    2008-07-24 16:35:19 0 d-------- C:\Documents and Settings\John\Application Data\Sun
    2008-07-24 16:32:30 0 d-------- C:\Program Files\Java
    2008-07-24 16:31:47 0 d-------- C:\Program Files\Common Files\Java
    2008-07-24 14:35:11 0 d-------- C:\Documents and Settings\John\Application Data\Malwarebytes
    2008-07-24 14:32:21 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-07-24 14:32:19 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-07-24 10:58:25 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-07-24 10:18:27 0 d-------- C:\WINDOWS\pss
    2008-07-24 10:02:46 0 d-------- C:\Documents and Settings\LocalService\Start Menu
    2008-07-24 09:51:54 0 d-------- C:\Program Files\Trend Micro
    2008-07-24 09:05:19 0 d-------- C:\Logs
    2008-07-24 08:07:22 5775 --a------ C:\WINDOWS\system32\xwnfanfr.dll
    2008-07-24 08:01:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro
    2008-07-24 00:18:56 0 d-------- C:\Program Files\Common Files\Logitech
    2008-07-24 00:18:20 0 d-------- C:\Documents and Settings\All Users\Application Data\LogiShrd
    2008-07-24 00:18:17 0 d-------- C:\Documents and Settings\John\Application Data\Logitech
    2008-07-24 00:15:56 0 d-------- C:\Documents and Settings\All Users\Application Data\Logitech
    2008-07-24 00:15:49 0 d-------- C:\Program Files\Common Files\Logishrd
    2008-07-24 00:15:47 0 d-------- C:\Program Files\Logitech
    2008-07-24 00:15:47 0 d-------- C:\Documents and Settings\John\Application Data\InstallShield
    2008-07-24 00:12:34 0 d-------- C:\Program Files\Common Files\Blizzard Entertainment
    2008-07-24 00:11:30 0 d-------- C:\Program Files\World of Warcraft
    2008-07-23 23:33:47 0 d-------- C:\WINDOWS\Prefetch
    2008-07-23 23:28:18 0 d-------- C:\WINDOWS\ServicePackFiles
    2008-07-23 23:06:10 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
    2008-07-23 23:06:10 0 d-------- C:\Documents and Settings\John\Application Data\skypePM
    2008-07-23 23:01:30 0 d-------- C:\Documents and Settings\John\Application Data\Skype
    2008-07-23 23:01:14 0 d-------- C:\Program Files\Skype
    2008-07-23 23:01:14 0 d-------- C:\Program Files\Common Files\Skype
    2008-07-23 23:01:10 0 d-------- C:\Documents and Settings\All Users\Application Data\Skype
    2008-07-23 22:23:16 0 d-------- C:\Program Files\Microsoft Works
    2008-07-23 22:22:28 0 d-------- C:\Program Files\Microsoft.NET
    2008-07-23 22:20:37 0 d-------- C:\Program Files\Microsoft Visual Studio 8
    2008-07-23 22:20:01 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-07-23 22:08:12 0 d-------- C:\Documents and Settings\John\Application Data\BitTorrent
    2008-07-23 22:05:15 0 d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
    2008-07-23 22:02:50 0 d-------- C:\WINDOWS\SHELLNEW
    2008-07-23 22:01:08 0 d-------- C:\Program Files\DNA
    2008-07-23 22:01:08 0 d-------- C:\Program Files\BitTorrent
    2008-07-23 22:01:08 0 d-------- C:\Documents and Settings\John\Application Data\DNA
    2008-07-23 21:44:50 0 dr-h----- C:\MSOCache
    2008-07-23 21:27:10 0 d-------- C:\Documents and Settings\John\Application Data\Macromedia
    2008-07-23 21:27:09 0 d-------- C:\Documents and Settings\John\Application Data\Adobe
    2008-07-23 21:25:39 0 d-------- C:\Program Files\GS
    2008-07-23 21:22:16 0 d-------- C:\Documents and Settings\John\Application Data\WinRAR
    2008-07-23 21:06:45 0 d------c- C:\WINDOWS\system32\DRVSTORE
    2008-07-23 21:04:57 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
    2008-07-23 21:04:30 0 d-------- C:\Program Files\Windows Live
    2008-07-23 21:04:23 0 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-07-23 20:48:38 0 d-------- C:\Program Files\Intel
    2008-07-23 20:45:31 5685 --a------ C:\WINDOWS\system32\drivers\AsIO.sys
    2008-07-23 20:45:31 24576 --a------ C:\WINDOWS\system32\AsIO.dll <Not Verified; ; AsIO Dynamic Link Library>
    2008-07-23 20:44:52 0 d-------- C:\Program Files\ASUS
    2008-07-23 20:42:22 43008 --a------ C:\WINDOWS\system32\wnvyv12.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 66560 --a------ C:\WINDOWS\system32\wnvyuv8.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 93184 --a------ C:\WINDOWS\system32\wnvwinx.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 160256 --a------ C:\WINDOWS\system32\wnvwav32.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 40448 --a------ C:\WINDOWS\system32\wnvw32.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 89088 --a------ C:\WINDOWS\system32\wnvvsrc.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 56320 --a------ C:\WINDOWS\system32\wnvvolb.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 183296 --a------ C:\WINDOWS\system32\wnvvid32.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 51200 --a------ C:\WINDOWS\system32\wnvvfe32.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 79872 --a------ C:\WINDOWS\system32\wnvvcap1.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 64512 --a------ C:\WINDOWS\system32\wnvtune2.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 37888 --a------ C:\WINDOWS\system32\WnvStill.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 36864 --a------ C:\WINDOWS\system32\WnvRemot.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 78848 --a------ C:\WINDOWS\system32\wnvreg32.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 82432 --a------ C:\WINDOWS\system32\wnvptz.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 135680 --a------ C:\WINDOWS\system32\wnvplay1.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 603136 --a------ C:\WINDOWS\system32\wnvmxr.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 38400 --a------ C:\WINDOWS\system32\wnvmem.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 150528 --a------ C:\WINDOWS\system32\WnvJpeg.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 137216 --a------ C:\WINDOWS\system32\WnvIRQ32.EXE <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 116736 --a------ C:\WINDOWS\system32\wnvim.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 34816 --a------ C:\WINDOWS\system32\WnvI2C.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 109568 --a------ C:\WINDOWS\system32\wnvhad.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 101376 --a------ C:\WINDOWS\system32\wnvasrc.DLL <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 45056 --a------ C:\WINDOWS\system32\Videum Bounce.SCR <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 69632 --a------ C:\WINDOWS\system32\TWUNK_32.EXE <Not Verified; Twain Working Group; Twain Thunker>
    2008-07-23 20:42:22 48560 --a------ C:\WINDOWS\system32\TWUNK_16.EXE <Not Verified; Twain Working Group; Twain Thunker>
    2008-07-23 20:42:22 77312 --a------ C:\WINDOWS\system32\TWAIN_32.DLL <Not Verified; Twain Working Group; Twain_32 Source Manager>
    2008-07-23 20:42:22 87328 --a------ C:\WINDOWS\system32\TWAIN.DLL <Not Verified; Twain Working Group; Twain Source Manager>
    2008-07-23 20:42:22 28160 --a------ C:\WINDOWS\system32\SaveAsASF.dll <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 254272 --a------ C:\WINDOWS\system32\ompg4c32.dll <Not Verified; Microsoft Corporation; Microsoft MPEG-4 Video Codec>
    2008-07-23 20:42:22 56832 --a------ C:\WINDOWS\system32\iyvu9_32.DLL
    2008-07-23 20:42:22 245480 --a------ C:\WINDOWS\system32\drivers\WnvKVid.sys <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 107232 --a------ C:\WINDOWS\system32\drivers\WnvKAud.sys <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 21536 --a------ C:\WINDOWS\system32\drivers\WnvCOM.sys <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:22 528719 --a------ C:\WINDOWS\system32\drivers\Winnov32.sys <Not Verified; Winnov; Video capture by Winnov>
    2008-07-23 20:42:18 0 d-------- C:\Program Files\Winnov Videum NT
    2008-07-23 20:42:13 314880 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
    2008-07-23 20:42:12 0 d-------- C:\Documents and Settings\John\WINDOWS
    2008-07-23 20:40:07 118784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
    2008-07-23 20:40:07 28672 --a------ C:\WINDOWS\system32\hcwsched.dll <Not Verified; Hauppauge Computer Works; HCW Scheduler>
    2008-07-23 20:40:07 65536 --a------ C:\WINDOWS\system32\dmcrypto.dll
    2008-07-23 20:40:07 69632 --a------ C:\WINDOWS\system32\3DES.dll <Not Verified; Hauppauge Computer Works; 3DES>
    2008-07-23 20:38:54 0 d-------- C:\Program Files\Common Files\IviSDK
    2008-07-23 20:37:10 770121 --a------ C:\WINDOWS\system32\hcwtvwnd.dll <Not Verified; Hauppauge Computer Works; HCWTVWND>
    2008-07-23 20:37:10 106559 --a------ C:\WINDOWS\system32\hcwTVDlg.dll <Not Verified; Hauppauge Computer Works; WinTV>
    2008-07-23 20:37:10 61440 --a------ C:\WINDOWS\system32\Hcwtuner.dll <Not Verified; Hauppauge Computer Works; WinTV>
    2008-07-23 20:37:10 393216 --a------ C:\WINDOWS\system32\hcwsnbd9.dll <Not Verified; Snowbound Software Corporation (www.Snowbnd.com); SnowBound RasterMaster for NT/W2000>
    2008-07-23 20:37:10 270392 --a------ C:\WINDOWS\system32\hcwpnp32.dll <Not Verified; Hauppauge Computer Works; WinTV>
    2008-07-23 20:37:10 94264 --a------ C:\WINDOWS\system32\hcwi2c32.dll <Not Verified; Hauppauge Computer Works, Inc.; WinTV>
    2008-07-23 20:37:10 11264 --a------ C:\WINDOWS\system32\hcwhook.dll <Not Verified; Hauppauge Computer Works; HCW hcwhook>
    2008-07-23 20:37:10 213050 --a------ C:\WINDOWS\system32\Hcwchan.dll <Not Verified; Hauppauge Computer Works; WinTV>
    2008-07-23 20:37:10 192571 --a------ C:\WINDOWS\system32\hcwav.dll <Not Verified; Hauppauge Computer Works, Inc.; WinTV>
    2008-07-23 20:37:10 139329 --a------ C:\WINDOWS\system32\hcwaud32.dll <Not Verified; Hauppauge Computer Works; WinTV>
    2008-07-23 20:37:10 90190 --a------ C:\WINDOWS\system32\Bt848WST.DLL <Not Verified; Hauppauge Computer Works; WinTV>
    2008-07-23 20:37:10 0 d-------- C:\Program Files\WinTV
    2008-07-23 20:37:10 0 d-------- C:\MyVideos
    2008-07-23 20:28:06 0 d-------- C:\Documents and Settings\John\Application Data\Windows Desktop Search
    2008-07-23 20:27:51 0 d-------- C:\WINDOWS\system32\GroupPolicy
    2008-07-23 20:27:51 0 d-------- C:\Program Files\Windows Desktop Search
    2008-07-23 20:27:17 0 d-------- C:\Program Files\Windows Media Connect 2
    2008-07-23 20:26:41 0 d-------- C:\WINDOWS\system32\LogFiles
    2008-07-23 20:26:41 0 d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-07-23 20:26:10 0 d-------- C:\Program Files\MSBuild
    2008-07-23 20:24:22 0 d-------- C:\WINDOWS\system32\XPSViewer
    2008-07-23 20:24:03 0 d-------- C:\Program Files\Reference Assemblies
    2008-07-23 20:23:31 0 d-------- C:\150b1b56dc552bb820d11aeaeab9
    2008-07-23 20:23:20 0 d-------- C:\Documents and Settings\John\Contacts
    2008-07-23 20:23:04 0 d-------- C:\WINDOWS\RegisteredPackages
    2008-07-23 20:22:11 0 d-------- C:\WINDOWS\system32\URTTEMP
    2008-07-23 20:07:00 0 d-------- C:\Documents and Settings\John\Application Data\ATI
    2008-07-23 20:07:00 0 d-------- C:\Documents and Settings\All Users\Application Data\ATI
    2008-07-23 20:06:38 0 --a------ C:\WINDOWS\ativpsrm.bin
    2008-07-23 19:11:13 0 d--hs---- C:\Documents and Settings\John\UserData
    2008-07-23 18:34:54 0 d-------- C:\Documents and Settings\John\Application Data\Identities
    2008-07-23 18:34:36 0 d--h----- C:\Documents and Settings\John\Templates
    2008-07-23 18:34:36 0 dr------- C:\Documents and Settings\John\Start Menu
    2008-07-23 18:34:36 0 dr-h----- C:\Documents and Settings\John\SendTo
    2008-07-23 18:34:36 0 dr-h----- C:\Documents and Settings\John\Recent
    2008-07-23 18:34:36 0 d--h----- C:\Documents and Settings\John\PrintHood
    2008-07-23 18:34:36 4456448 --ah----- C:\Documents and Settings\John\NTUSER.DAT
    2008-07-23 18:34:36 0 d--h----- C:\Documents and Settings\John\NetHood
    2008-07-23 18:34:36 0 dr------- C:\Documents and Settings\John\My Documents
    2008-07-23 18:34:36 0 d--h----- C:\Documents and Settings\John\Local Settings
    2008-07-23 18:34:36 0 dr------- C:\Documents and Settings\John\Favorites
    2008-07-23 18:34:36 0 d-------- C:\Documents and Settings\John\Desktop
    2008-07-23 18:34:36 0 d--hs---- C:\Documents and Settings\John\Cookies
    2008-07-23 18:34:36 0 dr-h----- C:\Documents and Settings\John\Application Data
    2008-07-23 18:28:45 593920 --a------ C:\WINDOWS\system32\ati2sgag.exe <Not Verified; ; ATI Smart>
    2008-07-23 18:28:32 0 d-------- C:\Program Files\ATI Technologies
    2008-07-23 18:23:28 0 d-------- C:\ATI
    2008-07-23 18:22:49 0 d-------- C:\WINDOWS\system32\Lang
    2008-07-23 18:21:13 49152 --a------ C:\WINDOWS\system32\ChCfg.exe
    2008-07-23 18:20:59 0 d-------- C:\WINDOWS\system32\RTCOM
    2008-07-23 18:20:51 0 d-------- C:\Program Files\Realtek
    2008-07-23 18:20:51 0 d--h----- C:\Program Files\InstallShield Installation Information
    2008-07-23 18:20:48 520192 --a------ C:\WINDOWS\RtlExUpd.dll <Not Verified; Realtek Semiconductor Corp.; RtlExUpd Dynamic Link Library>
    2008-07-23 18:19:43 315392 --a------ C:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program>
    2008-07-23 17:57:03 0 d-------- C:\WINDOWS\system32\scripting
    2008-07-23 17:57:03 0 d-------- C:\WINDOWS\l2schemas
    2008-07-23 17:57:02 0 d-------- C:\WINDOWS\system32\en
    2008-07-23 17:57:02 0 d-------- C:\WINDOWS\system32\bits
    2008-07-23 17:54:37 0 d-------- C:\WINDOWS\network diagnostic
    2008-07-23 17:53:56 0 d-------- C:\WINDOWS\system32\ReinstallBackups
    2008-07-23 17:34:32 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
    2008-07-23 15:51:43 0 d-------- C:\WINDOWS\system32\PreInstall
    2008-07-23 15:51:42 0 d--h----- C:\WINDOWS\$hf_mig$
    2008-07-23 15:36:57 0 d-------- C:\WINDOWS\system32\SoftwareDistribution
    2008-07-23 15:36:21 0 d---s---- C:\Documents and Settings\Administrator\UserData
    2008-07-23 15:35:27 0 d-------- C:\Program Files\Marvell
    2008-07-23 15:35:16 0 d-------- C:\Program Files\Common Files\InstallShield
    2008-07-23 15:27:22 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities
    2008-07-23 15:27:15 0 d--h----- C:\Documents and Settings\Administrator\Templates
    2008-07-23 15:27:15 0 dr------- C:\Documents and Settings\Administrator\Start Menu
    2008-07-23 15:27:15 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
    2008-07-23 15:27:15 0 dr-h----- C:\Documents and Settings\Administrator\Recent
    2008-07-23 15:27:15 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
    2008-07-23 15:27:15 3407872 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT
    2008-07-23 15:27:15 0 d--h----- C:\Documents and Settings\Administrator\NetHood
    2008-07-23 15:27:15 0 dr------- C:\Documents and Settings\Administrator\My Documents
    2008-07-23 15:27:15 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
    2008-07-23 15:27:15 0 dr------- C:\Documents and Settings\Administrator\Favorites
    2008-07-23 15:27:15 0 d-------- C:\Documents and Settings\Administrator\Desktop
    2008-07-23 15:27:15 0 d---s---- C:\Documents and Settings\Administrator\Cookies
    2008-07-23 15:27:15 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
    2008-07-23 15:27:15 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
    2008-07-23 14:02:20 0 d-------- C:\WINDOWS\SoftwareDistribution
    2008-07-23 14:02:18 0 d---s---- C:\WINDOWS\system32\Microsoft
    2008-07-23 14:02:17 262144 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT
    2008-07-23 14:02:17 0 d--h----- C:\Documents and Settings\LocalService\Local Settings
    2008-07-23 14:02:17 0 d--hs---- C:\Documents and Settings\LocalService\Cookies
    2008-07-23 14:02:17 0 d-------- C:\Documents and Settings\LocalService\Application Data
    2008-07-23 14:02:17 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
    2008-07-23 14:02:12 0 d---s---- C:\Documents and Settings\NetworkService\Cookies
    2008-07-23 14:02:12 0 d-------- C:\Documents and Settings\NetworkService\Application Data
    2008-07-23 14:02:12 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
    2008-07-23 14:02:11 262144 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT
    2008-07-23 14:02:11 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings
    2008-07-23 13:55:31 0 d-------- C:\WINDOWS\system32\xircom
    2008-07-23 13:55:31 0 d-------- C:\Program Files\microsoft frontpage
    2008-07-23 13:55:25 262144 --ah----- C:\Documents and Settings\Default User\NTUSER.DAT
    2008-07-23 13:55:22 0 -rahs---- C:\MSDOS.SYS
    2008-07-23 13:55:22 0 -rahs---- C:\IO.SYS
    2008-07-23 13:55:22 0 --a------ C:\CONFIG.SYS
    2008-07-23 13:55:22 0 --a------ C:\AUTOEXEC.BAT
    2008-07-23 13:54:47 0 d--hs---- C:\Documents and Settings\All Users\DRM
    2008-07-23 13:54:42 0 dr------- C:\WINDOWS\Offline Web Pages
    2008-07-23 13:54:42 0 d---s---- C:\WINDOWS\Downloaded Program
     
    JohnnyQuad,
    #5
  7. 2008/07/24
    JohnnyQuad

    JohnnyQuad Inactive Thread Starter

    Joined:
    2008/07/22
    Messages:
    9
    Likes Received:
    0
    Files
    2008-07-23 13:54:35 0 d--h----- C:\Program Files\WindowsUpdate
    2008-07-23 13:54:24 0 d-------- C:\WINDOWS\system32\DirectX
    2008-07-23 13:54:02 0 d---s---- C:\WINDOWS\Tasks
    2008-07-23 13:54:01 0 d-------- C:\Program Files\Common Files\MSSoap
    2008-07-23 13:53:59 0 d-------- C:\WINDOWS\srchasst
    2008-07-23 13:53:58 0 d-------- C:\WINDOWS\system32\Macromed
    2008-07-23 13:53:53 0 d-------- C:\Program Files\Movie Maker
    2008-07-23 13:53:47 0 d-------- C:\WINDOWS\system32\Restore
    2008-07-23 13:53:25 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
    2008-07-23 13:53:14 0 d-------- C:\WINDOWS\Registration
    2008-07-23 13:53:09 0 d-------- C:\Program Files\Online Services
    2008-07-23 13:53:05 0 d-------- C:\Program Files\Messenger
    2008-07-23 13:53:03 0 d-------- C:\Program Files\MSN Gaming Zone
    2008-07-23 13:52:37 0 d-------- C:\Program Files\Windows NT
    2008-07-23 13:52:35 0 d-------- C:\WINDOWS\system32\MsDtc
    2008-07-23 13:52:34 0 d-------- C:\WINDOWS\system32\Com
    2008-07-23 06:46:17 0 d--hs---- C:\WINDOWS\Installer
    2008-07-23 06:46:16 0 d-------- C:\Program Files\Common Files\ODBC
    2008-07-23 06:46:14 0 dr------- C:\Program Files
    2008-07-23 06:46:14 0 d-------- C:\Program Files\Common Files
    2008-07-23 06:46:14 0 d-------- C:\Program Files\Common Files\SpeechEngines
    2008-07-23 06:45:58 0 d--h----- C:\Documents and Settings\Default User\Templates
    2008-07-23 06:45:58 0 dr------- C:\Documents and Settings\Default User\Start Menu
    2008-07-23 06:45:58 0 dr-h----- C:\Documents and Settings\Default User\SendTo
    2008-07-23 06:45:58 0 d--h----- C:\Documents and Settings\Default User\Recent
    2008-07-23 06:45:58 0 d--h----- C:\Documents and Settings\Default User\PrintHood
    2008-07-23 06:45:58 0 d--h----- C:\Documents and Settings\Default User\NetHood
    2008-07-23 06:45:58 0 d-------- C:\Documents and Settings\Default User\My Documents
    2008-07-23 06:45:58 0 dr-h----- C:\Documents and Settings\Default User\Local Settings
    2008-07-23 06:45:58 0 d-------- C:\Documents and Settings\Default User\Favorites
    2008-07-23 06:45:58 0 d-------- C:\Documents and Settings\Default User\Desktop
    2008-07-23 06:45:58 0 d---s---- C:\Documents and Settings\Default User\Cookies
    2008-07-23 06:45:58 0 d--h----- C:\Documents and Settings\All Users\Templates
    2008-07-23 06:45:58 0 dr------- C:\Documents and Settings\All Users\Start Menu
    2008-07-23 06:45:58 0 d-------- C:\Documents and Settings\All Users\Favorites
    2008-07-23 06:45:58 0 dr------- C:\Documents and Settings\All Users\Documents
    2008-07-23 06:45:58 0 d-------- C:\Documents and Settings\All Users\Desktop
    2008-07-23 06:45:48 0 d-------- C:\WINDOWS\system32\CatRoot2
    2008-07-23 06:45:48 0 d-------- C:\WINDOWS\system32\CatRoot
    2008-07-23 06:45:43 0 dr-h----- C:\Documents and Settings\Default User\Application Data
    2008-07-23 06:45:43 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
    2008-07-23 06:45:43 0 dr-h----- C:\Documents and Settings\All Users\Application Data
    2008-07-23 06:45:43 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
    2008-07-23 06:45:22 0 d--hs---- C:\System Volume Information
    2008-07-23 06:45:22 0 d-------- C:\Documents and Settings
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\WinSxS
    2008-07-23 06:41:04 0 dr------- C:\WINDOWS\Web
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\twain_32
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\wins
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\wbem
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\usmt
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\spool
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\ShellExt
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\Setup
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\ras
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\oobe
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\npp
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\mui
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\inetsrv
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\IME
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\icsxml
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\ias
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\export
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\drivers
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\drivers\etc
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\drivers\disdn
    2008-07-23 06:41:04 0 dr-hs--c- C:\WINDOWS\system32\dllcache
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\dhcp
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\config
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\3com_dmi
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\3076
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\2052
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\1054
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\1042
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\1041
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\1037
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\1033
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\1031
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\1028
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system32\1025
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\system
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\security
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Resources
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\repair
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Provisioning
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\PeerNet
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\pchealth
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\mui
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\msapps
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\msagent
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Media
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\java
    2008-07-23 06:41:04 0 d--h----- C:\WINDOWS\inf
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\ime
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Help
    2008-07-23 06:41:04 0 dr--s---- C:\WINDOWS\Fonts
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\ehome
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Driver Cache
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Debug
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Cursors
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Connection Wizard
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\Config
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\AppPatch
    2008-07-23 06:41:04 0 d-------- C:\WINDOWS\addins


    -- Find3M Report ---------------------------------------------------------------

    2008-07-23 06:45:58 62 --ahs---- C:\Documents and Settings\John\Application Data\desktop.ini


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "StartCCC "= "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [01/21/2008 12:17 PM]
    "RTHDCPL "= "RTHDCPL.EXE" [05/10/2007 06:08 PM C:\WINDOWS\RTHDCPL.exe]
    "AsusServiceProvider "= "C:\Program Files\ASUS\AASP\1.00.12\aaCenter.exe" [10/23/2006 09:28 PM]
    "AsusStartupHelp "= "C:\Program Files\ASUS\AASP\1.00.12\AsRunHelp.exe" [10/30/2006 04:07 PM]
    "Kernel and Hardware Abstraction Layer "= "KHALMNPR.EXE" [02/29/2008 03:12 AM C:\WINDOWS\KHALMNPR.Exe]
    "Launch LCDMon "= "C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe" [04/26/2007 04:54 PM]
    "Launch LGDCore "= "C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" [04/26/2007 05:22 PM]
    "pccguide.exe "= "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe" [04/12/2007 03:58 AM]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [06/10/2008 04:27 AM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [04/13/2008 05:12 PM]
    "MsnMsgr "= "C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [10/18/2007 11:34 AM]
    "BitTorrent DNA "= "C:\Program Files\DNA\btdna.exe" [07/23/2008 10:01 PM]
    "Skype "= "C:\Program Files\Skype\Phone\Skype.exe" [05/30/2008 03:54 PM]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [7/24/2008 12:16:17 AM]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools "=0 (0x0)
    "HideLegacyLogonScripts "=0 (0x0)
    "HideLogoffScripts "=0 (0x0)
    "RunLogonScriptSync "=1 (0x1)
    "RunStartupScriptSync "=0 (0x0)
    "HideStartupScripts "=0 (0x0)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "HideLegacyLogonScripts "=0 (0x0)
    "HideLogoffScripts "=0 (0x0)
    "RunLogonScriptSync "=1 (0x1)
    "RunStartupScriptSync "=0 (0x0)
    "HideStartupScripts "=0 (0x0)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5} "= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [05/26/2008 10:19 PM 304128]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
    C:\WINDOWS\System32\dimsntfy.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 05/02/2008 02:42 AM 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Notification Packages "= scecli scecli

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=" "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
    "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch Ai Booster]
    "C:\Program Files\ASUS\AI Booster\OverClk.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winnov Menu]
    "C:\Program Files\Winnov Videum NT\WnvMenu.Exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winnov Remote]
    "C:\Program Files\Winnov Videum NT\WnvRsvr.Exe" -AutoStart

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winnov Status]
    "C:\Program Files\Winnov Videum NT\WvStatus.Exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    eapsvcs eaphost
    dot3svc dot3svc

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    napagent
    hkmsvc




    -- End of Deckard's System Scanner: finished at 2008-07-24 19:38:45 ------------
     
    JohnnyQuad,
    #6
  8. 2008/07/24
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please upload the following file to my submission channel for analysis. Leave a link back to this topic.

    C:\WINDOWS\system32\xwnfanfr.dll

    Thanks!

    Please open MBAM and select the Logs tab. Copy the logs and post them here please.
     
    noahdfear,
    #7
  9. 2008/07/24
    JohnnyQuad

    JohnnyQuad Inactive Thread Starter

    Joined:
    2008/07/22
    Messages:
    9
    Likes Received:
    0
    while I was waiting for your initial reply I downloaded and ran Malwarebytes Anti-Malware program. It found and seems to have elimitated 51 problems. The system seems to be running better and I am now able to start Automatic Updates again. I also ran a scan on Kaspersky.com, it found no problems. I do however see a (no name) on this latest HijackThis report. Please let me know what I should do next. Thanks in advance.
     
    JohnnyQuad,
    #8
  10. 2008/07/24
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    For the record, that wrong program might well be the P2P program BitTorrent. I'm not passing judgment on file-sharing as a concept. However, I will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

    Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

    References for the risk of these programs are here,
    here and here.

    I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.


    Additionally, these apps often run in the background when you start your computer, consuming cpu cycles and bandwidth. This could be a major contributor to system slowdown.
     
    noahdfear,
    #9
  11. 2008/07/24
    JohnnyQuad

    JohnnyQuad Inactive Thread Starter

    Joined:
    2008/07/22
    Messages:
    9
    Likes Received:
    0
    Malwarebytes' Anti-Malware 1.23
    Database version: 988
    Windows 5.1.2600 Service Pack 3

    4:02:18 PM 7/24/2008
    mbam-log-7-24-2008 (16-02-18).txt

    Scan type: Quick Scan
    Objects scanned: 44163
    Time elapsed: 1 hour(s), 16 minute(s), 48 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 2
    Registry Keys Infected: 9
    Registry Values Infected: 29
    Registry Data Items Infected: 1
    Folders Infected: 0
    Files Infected: 10

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    C:\WINDOWS\system32\iefilter.dll (Trojan.FakeAlert) -> Delete on reboot.
    C:\WINDOWS\system32\qoMeBqoP.dll (Trojan.Vundo) -> Delete on reboot.

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\TypeLib\{15c7d7ad-a87a-4c0d-9d8b-637fcd3488ef} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{caf9d798-c659-4b9b-8e19-ee27c3d04ee7} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{018b27ff-e05f-4cb5-8763-540cb3fd457a} (Trojan.BHO) -> Delete on reboot.
    HKEY_CLASSES_ROOT\CLSID\{018b27ff-e05f-4cb5-8763-540cb3fd457a} (Trojan.BHO) -> Delete on reboot.
    HKEY_CLASSES_ROOT\bhonew.bho (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\bhonew.bho.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\qomebqop (Trojan.Vundo) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb1568 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd7733 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb3881 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd4569 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga7362 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc3908 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga3815 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc3489 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb1747 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd586 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga9663 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc7818 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb9192 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd9405 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga128 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc3092 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb9585 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd8164 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb3743 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd6710 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb1273 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd3419 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga9967 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc4320 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga119 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc5073 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga5873 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc7219 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{018b27ff-e05f-4cb5-8763-540cb3fd457a} (Trojan.Vundo) -> Delete on reboot.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\mljaxuum -> Delete on reboot.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\WINDOWS\system32\mlJaxuUM.dll_old (Trojan.Vundo) -> Delete on reboot.
    C:\WINDOWS\system32\MUuxaJlm.ini (Trojan.Vundo) -> Delete on reboot.
     
    JohnnyQuad,
    #10
  12. 2008/07/24
    JohnnyQuad

    JohnnyQuad Inactive Thread Starter

    Joined:
    2008/07/22
    Messages:
    9
    Likes Received:
    0
    The file you asked for has been uploaded. Here is the 2nd scan from MBAM

    Malwarebytes' Anti-Malware 1.23
    Database version: 988
    Windows 5.1.2600 Service Pack 3

    8:10:14 PM 7/24/2008
    mbam-log-7-24-2008 (20-10-14).txt

    Scan type: Quick Scan
    Objects scanned: 41087
    Time elapsed: 2 minute(s), 30 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     
    JohnnyQuad,
    #11
  13. 2008/07/24
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Looks like you're all cleaned up. :)
    The uploaded file is a part of Trend Micro.
    That file missing entry is for Windows Live Messenger, and isn't really missing. HijackThis just can't verify it's existence due to the way the registry value was created.

    Click Start>Run and type ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined (rogue registry items removed). This action will also reset the System Restore points, removing the infected files there as well. The C:\Deckard's folder will also be removed. You can delete any logs that were created/saved too.

    Purge the quarantined items from MBAM and Spybot (Recovery in Spybot).

    Download ATF Cleaner by Atribune and save it to your Desktop.
    • Double click ATF-Cleaner.exe to run the program.
    • Check the boxes to the left of:

      • Windows Temp
      • Current User Temp
      • All Users Temp
      • Temporary Internet Files
      • Prefetch
      • Java Cache
      • Recycle bin

    • The rest are optional - if you want it to remove everything check "Select All ".
    • Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.
    Reboot


    I would recommend you now head on over to Windows Update and install Service Pack 3. Then, check out Geri's helpful information and recommendations regarding future protection in the following link.

    http://www.windowsbbs.com/showthread.php?t=67958

    Surf safe!
     
    noahdfear,
    #12
  14. 2008/07/30
    JohnnyQuad

    JohnnyQuad Inactive Thread Starter

    Joined:
    2008/07/22
    Messages:
    9
    Likes Received:
    0
    Everything seems to be fine now. I am recommending Malwarebytes to everyone I know. That program rocks. Thanks for all the help.
     
    JohnnyQuad,
    #13

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...