Solved Trojan Vundo strikes

clubECGR · 2008/10/23

[Resolved] Trojan Vundo strikes

Im now using my sis's laptop to investigate on virus.

upon running the Malwarebytes Anti-Malware (as seen on other topics), I discovered that my sis's laptop was/is infected by the Trojan Vundo.

according to wikipedia, removing it is impossible as certain malware remover removes the dll but not the actual one.

Malwarebytes' Anti-Malware 1.29
Database version: 1276
Windows 5.1.2600 Service Pack 2

10/22/2008 3:00:58 PM
mbam-log-2008-10-22 (21-34-58).txt

Scan type: Quick Scan
Objects scanned: 69042
Time elapsed: 9 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 7
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS.0\system32\tuvWPigg.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b1cdc805-46cb-4b9c-a0e4-8ec5378a602d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b1cdc805-46cb-4b9c-a0e4-8ec5378a602d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dd4a65c7-61d7-445f-bcf1-5065f765eaf9} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tuvwpigg (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{dd4a65c7-61d7-445f-bcf1-5065f765eaf9} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{dd4a65c7-61d7-445f-bcf1-5065f765eaf9} (Trojan.Vundo.H) -> Delete on reboot.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows.0\system32\efcdtnge.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows.0\system32\efcdtnge.dll -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS.0\system32\efcDTNgE.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS.0\system32\EgNTDcfe.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS.0\system32\EgNTDcfe.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS.0\system32\tuvWPigg.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS.0\system32\jkkKbBRJ.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS.0\system32\byXQGxVL.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS.0\system32\awtrspOI.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS.0\system32\iiffGvUM.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\user.NEO\Local Settings\Temporary Internet Files\Content.IE5\SXKNEHC3\cntr[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS.0\system32\drivers\etc\services (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

after reading from wikipedia, im afraid it might show up again

EDIT: Im doing the Kasperky Online Scan. will post the log after it finishes

PS: I have the RSIT (HiJack This) at my arsenal if you want me to install it. but im too afraid to install it as you may said that it'll cause harm on my sis's laptop (computer)

Geri · 2008/10/23

Hi clubECGR

according to wikipedia, removing it is impossible as certain malware remover removes the dll but not the actual one.
Click to expand...

This is not true. It can be deleted successfully.

RSIT and HJT will not harm your computer.

Please post the Kaspersky scan and a log.txt from RSIT.

Thanks
Geri

clubECGR · 2008/10/24

Logfile of random's system information tool 1.04 (written by random/random)
Run by user at 2008-10-24 14:49:23
Microsoft Windows XP Professional Service Pack 2
System drive C: has 9 GB (12%) free of 76 GB
Total RAM: 502 MB (24% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:51:01 PM, on 10/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\csrss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS.0\Explorer.EXE
C:\WINDOWS.0\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS.0\eHome\ehRecvr.exe
C:\WINDOWS.0\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\alg.exe
C:\WINDOWS.0\RTHDCPL.EXE
C:\Program Files\Elantech\ktp.exe
C:\WINDOWS.0\mHotkey.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS.0\BisonCam\BisonTrayIcon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Desktop Sidebar\dsidebar.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\WINDOWS.0\system32\dllhost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS.0\system32\imapi.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS.0\system32\wuauclt.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\wbem\wmiprvse.exe
C:\WINDOWS.0\system32\wuauclt.exe
C:\WINDOWS.0\system32\msiexec.exe
C:\WINDOWS.0\system32\wbem\wmiprvse.exe
C:\RSIT.exe
C:\Program Files\trend micro\user.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neo.com.ph
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.neo.com.ph
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.neo.com.ph/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [BisonTrayIcon] C:\WINDOWS.0\BisonCam\BisonTrayIcon.exe
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKCU\..\Run: [SIDEBAR] "C:\Program Files\Desktop Sidebar\dsidebar.exe "
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.neo.com.ph
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 8853 bytes

======Scheduled tasks folder======

C:\WINDOWS.0\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-23 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}]
C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll [2007-02-19 97960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-10-02 370296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45AD732C-2CE2-4666-B366-B2214AD57A49}]
Idea2 SidebarBrowserMonitor Class - C:\Program Files\Desktop Sidebar\sbhelp.dll [2006-07-09 278528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll [2007-12-14 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{90222687-F593-4738-B738-FBEE9C7B26DF} - Show Norton Toolbar - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll [2007-02-19 609424]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut "=C:\WINDOWS.0\system32\HDAShCut.exe [2005-01-07 61952]
"RTHDCPL "=C:\WINDOWS.0\RTHDCPL.EXE [2006-01-12 15961088]
"KTPWare "=C:\Program Files\Elantech\ktp.exe [2005-10-28 512000]
"CHotkey "=C:\WINDOWS.0\mHotkey.exe [2001-12-26 472576]
"IntelZeroConfig "=C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe [2006-07-03 802816]
"IntelWireless "=C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe [2006-07-02 700416]
"BisonTrayIcon "=C:\WINDOWS.0\BisonCam\BisonTrayIcon.exe [2005-09-05 45056]
"ccApp "=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2007-01-10 115816]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SIDEBAR "=C:\Program Files\Desktop Sidebar\dsidebar.exe [2006-07-09 1777664]
"ctfmon.exe "=C:\WINDOWS.0\system32\ctfmon.exe [2006-03-15 15360]
"SpySweeper "=C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe [2004-06-28 3209728]
"Yahoo! Pager "=C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE [2007-11-06 3810544]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
C:\Program Files\Cyberlink\Shared Files\brs.exe [2007-11-17 91432]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe [2005-12-16 94208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BisonTrayIcon]
C:\WINDOWS.0\BisonCam\BisonTrayIcon.exe [2005-09-05 45056]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2008-02-19 267048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [2007-10-11 62760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
C:\Program Files\Musicmatch\Musicmatch Jukebox\mimboot.exe [2004-12-10 11776]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe [2004-12-10 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2004-08-04 1667584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS.0\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 14.0]
C:\Program Files\Norton Ghost\Agent\VProTray.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [2007-06-18 271360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
C:\Program Files\PowerISO\PWRISOVM.EXE [2008-01-20 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2008-01-31 385024]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]
C:\Program Files\Registry Mechanic\RegMech.exe /H []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2007-10-28 72736]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
C:\WINDOWS.0\sm56hlpr.exe [2005-11-10 557056]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe [2006-05-25 1372160]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe [2007-12-14 144784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-10-02 185896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
C:\Program Files\Unlocker\UnlockerAssistant.exe [2008-05-02 15872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe [2003-12-13 33792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2007-11-06 3810544]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [2005-09-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Start Menu^Programs^Startup^BlueSoleil.lnk]
C:\PROGRA~1\IVTCOR~1\BLUESO~1\BLUESO~1.EXE []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk]
C:\PROGRA~1\MICROS~2\OFFICE11\ONENOTEM.EXE /tsr []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Start Menu^Programs^Startup^SECRETMAKER.lnk]
C:\PROGRA~1\SECRET~1\SECRET~1.EXE /Logon []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
C:\PROGRA~1\WinZip\WZQKPICK.EXE [2007-04-11 394856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user.NEO^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
C:\PROGRA~1\MICROS~2\Office12\ONENOTEM.EXE [2006-10-26 98632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS.0\system32\igfxdev.dll [2006-02-07 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS.0\system32\WgaLogon.dll [2008-09-05 241704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername "=0
"legalnoticecaption "=
"legalnoticetext "=
"shutdownwithoutlogon "=1
"undockwithoutlogon "=1
"InstallVisualStyle "=C:\WINDOWS.0\Resources\Themes\Royale\Royale.msstyles
"InstallTheme "=C:\WINDOWS.0\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun "=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 "
"C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe "= "C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil "
"C:\Program Files\Messenger\msmsgs.exe "= "C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger "
"C:\Program Files\StepMania CVS\Program\StepMania.exe "= "C:\Program Files\StepMania CVS\Program\StepMania.exe:*:Enabled:StepMania "
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe "= "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger "
"C:\Program Files\Yahoo!\Messenger\YServer.exe "= "C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server "
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE "= "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook "
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE "= "C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove "
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE "= "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote "
"C:\Program Files\Bonjour\mDNSResponder.exe "= "C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour "
"C:\Program Files\iTunes\iTunes.exe "= "C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes "
"C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe "= "C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe:*:Enabled:CyberLink PowerDVD "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 "

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{42e2cb2a-8431-11dd-9496-00030d000001}]
shell\AutoRun\command - F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\SYS32.exe
shell\open\command - F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\SYS32.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4f9ceaa4-8167-11dd-948a-0013025fcab0}]
shell\AutoRun\command - 39lpji.com
shell\explore\command - 39lpji.com
shell\open\command - 39lpji.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dec31482-857b-11dd-94a0-00030d000001}]
shell\AutoRun\command - E:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\SYS32.exe
shell\open\command - E:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\SYS32.exe

clubECGR · 2008/10/24

======List of files/folders created in the last 3 months======

2008-10-24 14:50:32 ----HDC---- C:\WINDOWS.0\$NtUninstallKB946648$
2008-10-24 14:49:48 ----HDC---- C:\WINDOWS.0\$NtUninstallKB957095$
2008-10-24 14:49:00 ----HDC---- C:\WINDOWS.0\$NtUninstallKB954211$
2008-10-24 14:48:59 ----D---- C:\Program Files\trend micro
2008-10-24 14:48:56 ----D---- C:\rsit
2008-10-24 14:47:47 ----HDC---- C:\WINDOWS.0\$NtUninstallKB956841$
2008-10-24 14:46:55 ----HDC---- C:\WINDOWS.0\$NtUninstallKB944338-v2$
2008-10-24 14:46:33 ----HDC---- C:\WINDOWS.0\$NtUninstallKB936782_WMP10$
2008-10-24 14:46:07 ----D---- C:\WINDOWS.0\LastGood
2008-10-23 23:54:30 ----HDC---- C:\WINDOWS.0\$NtUninstallKB951376-v2$
2008-10-23 23:54:18 ----HDC---- C:\WINDOWS.0\$NtUninstallKB952954$
2008-10-23 23:54:07 ----HDC---- C:\WINDOWS.0\$NtUninstallKB941569$
2008-10-23 23:53:27 ----HDC---- C:\WINDOWS.0\$NtUninstallKB950762$
2008-10-23 23:53:06 ----HDC---- C:\WINDOWS.0\$NtUninstallKB938464$
2008-10-22 21:54:43 ----A---- C:\NDP1.1sp1-KB867460-X86.exe
2008-10-22 21:54:35 ----A---- C:\dotnetfx.exe
2008-10-22 21:53:12 ----D---- C:\WINDOWS.0\system32\appmgmt
2008-10-22 21:46:14 ----AD---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\TEMP
2008-10-22 21:44:31 ----A---- C:\RSIT.exe
2008-10-22 21:42:02 ----N---- C:\WINDOWS.0\system32\sbe.dll
2008-10-22 21:42:02 ----N---- C:\WINDOWS.0\system32\msvidctl.dll
2008-10-22 21:42:01 ----A---- C:\WINDOWS.0\system32\encdec.dll
2008-10-22 21:40:08 ----HDC---- C:\WINDOWS.0\$NtUninstallKB902841$
2008-10-22 21:39:54 ----HDC---- C:\WINDOWS.0\$NtUninstallKB888795$
2008-10-22 21:39:40 ----HDC---- C:\WINDOWS.0\$NtUninstallKB899510$
2008-10-22 21:39:23 ----HDC---- C:\WINDOWS.0\$NtUninstallKB911164$
2008-10-22 21:39:08 ----HDC---- C:\WINDOWS.0\$NtUninstallKB912945$
2008-10-22 21:38:53 ----HDC---- C:\WINDOWS.0\$NtUninstallKB899337$
2008-10-22 21:38:42 ----HDC---- C:\WINDOWS.0\$NtUninstallKB895961$
2008-10-22 21:38:32 ----HDC---- C:\WINDOWS.0\$NtUninstallKB891593$
2008-10-22 21:37:58 ----HDC---- C:\WINDOWS.0\$NtUninstallKB903157$
2008-10-22 21:35:49 ----A---- C:\mbam-setup.exe
2008-10-22 21:32:57 ----D---- C:\Program Files\Panda Security
2008-10-22 21:32:11 ----HDC---- C:\WINDOWS.0\$NtUninstallKB956803$
2008-10-22 21:31:59 ----HDC---- C:\WINDOWS.0\$NtUninstallKB935448$
2008-10-22 21:31:38 ----HDC---- C:\WINDOWS.0\$NtUninstallKB956391$
2008-10-22 21:25:40 ----A---- C:\WINDOWS.0\system32\eula.txt
2008-10-22 21:25:38 ----DC---- C:\WINDOWS.0\$NtUninstallKB900325$
2008-10-22 21:24:30 ----D---- C:\WINDOWS.0\system32\PreInstall
2008-10-22 21:24:29 ----N---- C:\WINDOWS.0\system32\spmsg.dll
2008-10-22 21:24:27 ----HDC---- C:\WINDOWS.0\$NtUninstallKB898461$
2008-10-22 21:23:54 ----D---- C:\Documents and Settings\user.NEO\Application Data\Malwarebytes
2008-10-22 21:23:44 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-22 21:23:44 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Malwarebytes
2008-10-22 21:11:47 ----A---- C:\WINDOWS.0\system32\BisonRem.dll
2008-10-22 21:11:47 ----A---- C:\WINDOWS.0\M2000Twn.ini
2008-10-22 21:11:46 ----D---- C:\WINDOWS.0\BisonCam
2008-10-22 20:59:58 ----A---- C:\WINDOWS.0\ModemLog_Motorola SM56 Data Fax Modem.txt
2008-10-22 20:59:52 ----RA---- C:\WINDOWS.0\system32\sm56co.dll
2008-10-22 20:59:50 ----D---- C:\WINDOWS.0\Motorola
2008-10-22 20:59:49 ----RA---- C:\WINDOWS.0\sm56spn.dll
2008-10-22 20:59:49 ----RA---- C:\WINDOWS.0\sm56jpn.dll
2008-10-22 20:59:49 ----RA---- C:\WINDOWS.0\sm56itl.dll
2008-10-22 20:59:48 ----RA---- C:\WINDOWS.0\sm56hlpr.exe
2008-10-22 20:59:48 ----RA---- C:\WINDOWS.0\sm56ger.dll
2008-10-22 20:59:48 ----RA---- C:\WINDOWS.0\sm56fra.dll
2008-10-22 20:59:48 ----RA---- C:\WINDOWS.0\sm56eng.dll
2008-10-22 20:59:48 ----RA---- C:\WINDOWS.0\sm56cht.dll
2008-10-22 20:59:48 ----RA---- C:\WINDOWS.0\sm56chs.dll
2008-10-22 20:59:48 ----RA---- C:\WINDOWS.0\sm56brz.dll
2008-10-21 17:08:05 ----A---- C:\WINDOWS.0\system32\ff_vfw.dll.manifest
2008-10-21 17:08:04 ----A---- C:\WINDOWS.0\system32\ff_vfw.dll
2008-10-21 17:08:03 ----A---- C:\WINDOWS.0\system32\pthreadGC2.dll
2008-10-21 17:06:13 ----D---- C:\Program Files\Combined Community Codec Pack
2008-10-21 17:03:26 ----A---- C:\Diagnostics.txt
2008-10-20 14:35:31 ----D---- C:\WINDOWS.0\CSC
2008-10-10 09:05:31 ----D---- C:\WINDOWS.0\system32\SoftwareDistribution
2008-10-10 04:20:40 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-07 02:34:36 ----A---- C:\WINDOWS.0\ModemLog_Nokia GSM Phone USB Modem #3.txt
2008-10-07 01:53:34 ----A---- C:\WINDOWS.0\ModemLog_Nokia GSM Phone USB Modem #2.txt
2008-10-05 20:47:26 ----D---- C:\Myself Yourself Image Song
2008-10-05 01:21:50 ----A---- C:\WINDOWS.0\ModemLog_Nokia GSM Phone USB Modem.txt
2008-10-04 15:36:03 ----D---- C:\Program Files\XP Codec Pack
2008-10-03 23:36:47 ----D---- C:\WINDOWS.0\system32\URTTEMP
2008-10-03 23:32:24 ----D---- C:\myself yourself
2008-10-03 20:13:55 ----A---- C:\WindowsXPMediaCenter2005-KB900325-usa.exe
2008-10-03 19:13:33 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\FLEXnet
2008-10-03 18:39:26 ----D---- C:\Program Files\Common Files\Macrovision Shared
2008-10-03 17:39:32 ----D---- C:\UltraDVDCreator
2008-10-03 16:53:36 ----A---- C:\WINDOWS.0\NeroDigital.ini
2008-10-03 15:56:03 ----D---- C:\Documents and Settings\user.NEO\Application Data\CyberLink
2008-10-03 02:42:14 ----D---- C:\Program Files\Norton 360
2008-10-03 02:39:45 ----A---- C:\WINDOWS.0\system32\S32EVNT1.DLL
2008-10-03 02:27:13 ----D---- C:\Documents and Settings\user.NEO\Application Data\Ashampoo
2008-10-03 02:26:38 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\ashampoo
2008-10-03 02:26:20 ----D---- C:\Program Files\Ashampoo
2008-10-03 02:19:53 ----D---- C:\WINDOWS.0\WinAVI Video Converter 9.0
2008-10-03 02:18:59 ----D---- C:\WINDOWS.0\system32\QuickTime
2008-10-03 02:18:58 ----D---- C:\Program Files\QuickTime Alternative
2008-10-03 02:18:58 ----D---- C:\Program Files\Media Player Classic
2008-10-03 02:11:27 ----D---- C:\WINDOWS.0\system32\XPToolsLicenseComponent
2008-10-03 02:10:34 ----D---- C:\Program Files\MSConfig CleanUp
2008-10-03 02:07:15 ----D---- C:\Program Files\Ultra Video Converter
2008-10-03 02:05:29 ----A---- C:\WINDOWS.0\system32\MPEGWriteFilter.dll
2008-10-03 02:05:29 ----A---- C:\WINDOWS.0\system32\MPEGFilter.dll
2008-10-03 02:05:29 ----A---- C:\WINDOWS.0\system32\DVDEncoder.dll
2008-10-03 02:05:26 ----D---- C:\Program Files\Ultra DVD Creator
2008-10-03 02:03:53 ----D---- C:\Program Files\DVD XCopy Deluxe
2008-10-03 02:03:53 ----A---- C:\WINDOWS.0\system32\wimadll.dll
2008-10-03 02:03:53 ----A---- C:\WINDOWS.0\system32\cypher.dll
2008-10-03 02:01:30 ----D---- C:\Program Files\SoftwrapLicense
2008-10-03 01:57:13 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\WinZip
2008-10-03 01:57:08 ----D---- C:\Program Files\WinZip
2008-10-03 01:55:56 ----HDC---- C:\WINDOWS.0\$NtServicePackUninstallNLSDownlevelMapping$
2008-10-03 01:55:13 ----HDC---- C:\WINDOWS.0\$NtUninstallKB915865$
2008-10-03 01:55:09 ----A---- C:\WINDOWS.0\system32\xmllite.dll
2008-10-03 01:52:02 ----D---- C:\Program Files\zabkat
2008-10-03 01:45:30 ----A---- C:\WINDOWS.0\system32\xactengine2_10.dll
2008-10-03 01:45:29 ----A---- C:\WINDOWS.0\system32\d3dx10_36.dll
2008-10-03 01:45:29 ----A---- C:\WINDOWS.0\system32\D3DCompiler_36.dll
2008-10-03 01:45:28 ----A---- C:\WINDOWS.0\system32\xactengine2_9.dll
2008-10-03 01:45:28 ----A---- C:\WINDOWS.0\system32\d3dx9_36.dll
2008-10-03 01:45:27 ----A---- C:\WINDOWS.0\system32\d3dx10_35.dll
2008-10-03 01:45:27 ----A---- C:\WINDOWS.0\system32\D3DCompiler_35.dll
2008-10-03 01:45:26 ----A---- C:\WINDOWS.0\system32\xactengine2_8.dll
2008-10-03 01:45:26 ----A---- C:\WINDOWS.0\system32\X3DAudio1_2.dll
2008-10-03 01:45:26 ----A---- C:\WINDOWS.0\system32\d3dx9_35.dll
2008-10-03 01:45:25 ----A---- C:\WINDOWS.0\system32\d3dx10_34.dll
2008-10-03 01:45:25 ----A---- C:\WINDOWS.0\system32\D3DCompiler_34.dll
2008-10-03 01:45:24 ----A---- C:\WINDOWS.0\system32\d3dx9_34.dll
2008-10-03 01:45:23 ----A---- C:\WINDOWS.0\system32\xinput1_3.dll
2008-10-03 01:45:22 ----A---- C:\WINDOWS.0\system32\xactengine2_7.dll
2008-10-03 01:45:21 ----A---- C:\WINDOWS.0\system32\d3dx10_33.dll
2008-10-03 01:45:21 ----A---- C:\WINDOWS.0\system32\D3DCompiler_33.dll
2008-10-03 01:45:20 ----A---- C:\WINDOWS.0\system32\d3dx9_33.dll
2008-10-03 01:45:19 ----A---- C:\WINDOWS.0\system32\xactengine2_6.dll
2008-10-03 01:45:19 ----A---- C:\WINDOWS.0\system32\xactengine2_5.dll
2008-10-03 01:45:19 ----A---- C:\WINDOWS.0\system32\d3dx9_32.dll
2008-10-03 01:45:18 ----A---- C:\WINDOWS.0\system32\xinput1_2.dll
2008-10-03 01:45:18 ----A---- C:\WINDOWS.0\system32\xactengine2_4.dll
2008-10-03 01:45:18 ----A---- C:\WINDOWS.0\system32\xactengine2_3.dll
2008-10-03 01:45:18 ----A---- C:\WINDOWS.0\system32\x3daudio1_1.dll
2008-10-03 01:45:18 ----A---- C:\WINDOWS.0\system32\d3dx9_31.dll
2008-10-03 01:45:17 ----A---- C:\WINDOWS.0\system32\xinput1_1.dll
2008-10-03 01:45:17 ----A---- C:\WINDOWS.0\system32\xactengine2_2.dll
2008-10-03 01:45:16 ----A---- C:\WINDOWS.0\system32\xactengine2_1.dll
2008-10-03 01:45:05 ----A---- C:\WINDOWS.0\system32\d3dx9_30.dll
2008-10-03 01:45:04 ----A---- C:\WINDOWS.0\system32\xactengine2_0.dll
2008-10-03 01:45:04 ----A---- C:\WINDOWS.0\system32\x3daudio1_0.dll
2008-10-03 01:45:04 ----A---- C:\WINDOWS.0\system32\d3dx9_29.dll
2008-10-03 01:45:04 ----A---- C:\WINDOWS.0\system32\d3dx9_28.dll
2008-10-03 01:45:03 ----A---- C:\WINDOWS.0\system32\xinput9_1_0.dll
2008-10-03 01:45:03 ----A---- C:\WINDOWS.0\system32\d3dx9_27.dll
2008-10-03 01:45:02 ----A---- C:\WINDOWS.0\system32\d3dx9_26.dll
2008-10-03 01:45:02 ----A---- C:\WINDOWS.0\system32\d3dx9_25.dll
2008-10-03 01:45:00 ----A---- C:\WINDOWS.0\system32\d3dx9_24.dll
2008-10-03 01:41:13 ----D---- C:\Program Files\PowerISO
2008-10-03 01:38:10 ----D---- C:\Program Files\Object Desktop
2008-10-03 01:35:09 ----A---- C:\WINDOWS.0\system32\mcdmsg7.dll
2008-10-03 01:32:19 ----D---- C:\Program Files\PowerQuest
2008-10-03 00:19:37 ----A---- C:\WINDOWS.0\system32\relog_ap(2).dll
2008-10-02 21:39:37 ----D---- C:\Program Files\WinAVI Video Capture
2008-10-02 21:38:58 ----A---- C:\WINDOWS.0\system32\dvdcopylogfile.txt
2008-10-02 21:35:42 ----D---- C:\Program Files\WinAVI FLV Converter
2008-10-02 21:34:35 ----D---- C:\Program Files\WinAVI MP4 Converter
2008-10-02 21:32:12 ----D---- C:\Program Files\WinAVI Video Converter 9.0
2008-10-02 21:31:46 ----A---- C:\WINDOWS.0\WinAVI Video Converter 9.0 Setup Log.txt
2008-10-02 21:05:00 ----D---- C:\Program Files\CursorXP
2008-10-02 20:45:41 ----D---- C:\Documents and Settings\user.NEO\Application Data\BitDefender
2008-10-02 20:40:21 ----D---- C:\Program Files\Softwin
2008-10-02 20:28:23 ----A---- C:\WINDOWS.0\system32\javaws.exe
2008-10-02 20:28:23 ----A---- C:\WINDOWS.0\system32\javaw.exe
2008-10-02 20:28:23 ----A---- C:\WINDOWS.0\system32\java.exe
2008-10-02 20:25:47 ----D---- C:\Documents and Settings\user.NEO\Application Data\Apple Computer
2008-10-02 20:24:25 ----D---- C:\Program Files\iPod
2008-10-02 20:23:31 ----D---- C:\Program Files\iTunes
2008-10-02 20:22:28 ----D---- C:\Documents and Settings\user.NEO\Application Data\Sun
2008-10-02 20:22:26 ----D---- C:\Program Files\Bonjour
2008-10-02 20:20:51 ----A---- C:\WINDOWS.0\iun6002.exe
2008-10-02 20:20:19 ----D---- C:\Program Files\Codec Pack - All In 1
2008-10-02 20:19:16 ----D---- C:\Program Files\QuickTime
2008-10-02 20:18:59 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Apple Computer
2008-10-02 20:17:50 ----A---- C:\WINDOWS.0\Codec Pack - All In 1 Setup Log.txt
2008-10-02 20:17:40 ----D---- C:\Program Files\Apple Software Update
2008-10-02 20:15:38 ----D---- C:\Program Files\Common Files\Apple
2008-10-02 20:15:28 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Apple
2008-10-02 20:03:59 ----D---- C:\Program Files\AVG
2008-10-02 20:03:57 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\avg8
2008-10-02 19:59:04 ----D---- C:\Documents and Settings\user.NEO\Application Data\Secretmaker
2008-10-02 19:50:56 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Adobe
2008-10-02 19:49:57 ----D---- C:\Program Files\Adobe
2008-10-02 19:48:17 ----D---- C:\Program Files\Common Files\Softwin
2008-10-02 19:46:41 ----D---- C:\Documents and Settings\user.NEO\Application Data\Ahead
2008-10-02 19:43:41 ----D---- C:\Program Files\CyberLink
2008-10-02 19:42:24 ----D---- C:\Program Files\Nero
2008-09-27 20:32:13 ----D---- C:\Documents and Settings\user.NEO\Application Data\Symantec
2008-09-27 20:14:45 ----D---- C:\Kirarin
2008-09-27 19:40:47 ----A---- C:\WINDOWS.0\system32\msonpmon.dll
2008-09-27 19:21:51 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Microsoft Help
2008-09-27 19:13:09 ----RA---- C:\WINDOWS.0\patchw32.dll
2008-09-27 19:10:33 ----RA---- C:\WINDOWS.0\pw32a.dll
2008-09-27 19:05:36 ----A---- C:\WINDOWS.0\system32\capicom.dll
2008-09-27 19:05:35 ----D---- C:\Program Files\Symantec
2008-09-27 19:03:43 ----D---- C:\Program Files\Common Files\Symantec Shared
2008-09-27 19:03:20 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Symantec
2008-09-24 15:24:20 ----D---- C:\Program Files\Microsoft Works
2008-09-23 18:25:20 ----D---- C:\WINDOWS.0\amcdl
2008-09-23 18:18:35 ----D---- C:\Program Files\FlashGet
2008-09-23 13:44:16 ----D---- C:\WINDOWS.0\RegisteredPackages
2008-09-23 13:39:28 ----D---- C:\Documents and Settings\user.NEO\Application Data\Desktop Sidebar
2008-09-23 13:39:00 ----D---- C:\Program Files\Desktop Sidebar
2008-09-23 13:33:47 ----HDC---- C:\WINDOWS.0\$MSI31Uninstall_KB893803v2$
2008-09-23 13:33:28 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\PC Suite
2008-09-23 13:32:26 ----D---- C:\Documents and Settings\user.NEO\Application Data\Nokia
2008-09-23 13:30:52 ----D---- C:\Documents and Settings\user.NEO\Application Data\PC Suite
2008-09-23 13:30:37 ----A---- C:\WINDOWS.0\system32\nmwcdcocls.dll
2008-09-23 13:30:36 ----A---- C:\WINDOWS.0\system32\nmwcdcls.dll
2008-09-23 13:30:35 ----D---- C:\Program Files\Nokia
2008-09-23 13:29:57 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Installations
2008-09-22 23:54:25 ----D---- C:\Cute Pictures
2008-09-20 13:19:50 ----D---- C:\4th NEED syaron CG Art Work Home (musics)
2008-09-20 13:10:04 ----D---- C:\vanBasco's Karaoke Player
2008-09-20 13:04:35 ----D---- C:\Program Files\TGTSoft
2008-09-20 12:59:00 ----D---- C:\Program Files\MIKSOFT
2008-09-20 12:56:39 ----D---- C:\Documents and Settings\user.NEO\Application Data\Macromedia
2008-09-20 12:48:49 ----D---- C:\Program Files\themexp
2008-09-20 12:42:44 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Yahoo!
2008-09-19 22:40:18 ----D---- C:\ECGR-RO server
2008-09-19 22:38:17 ----A---- C:\WINDOWS.0\cdplayer.ini
2008-09-19 22:33:16 ----A---- C:\WINDOWS.0\system32\rmoc3260.dll
2008-09-19 22:32:56 ----A---- C:\WINDOWS.0\system32\pxhpinst.exe
2008-09-19 22:32:55 ----A---- C:\WINDOWS.0\system32\vxblock.dll
2008-09-19 22:32:55 ----A---- C:\WINDOWS.0\system32\pxwave.dll
2008-09-19 22:32:55 ----A---- C:\WINDOWS.0\system32\pxmas.dll
2008-09-19 22:32:55 ----A---- C:\WINDOWS.0\system32\pxdrv.dll
2008-09-19 22:32:55 ----A---- C:\WINDOWS.0\system32\px.dll
2008-09-19 22:32:51 ----A---- C:\WINDOWS.0\system32\pndx5032.dll
2008-09-19 22:32:51 ----A---- C:\WINDOWS.0\system32\pndx5016.dll
2008-09-19 22:32:38 ----D---- C:\Program Files\Real
2008-09-19 22:32:31 ----D---- C:\Program Files\Winamp
2008-09-19 22:32:31 ----A---- C:\WINDOWS.0\winamp.ini
2008-09-19 22:32:22 ----D---- C:\Documents and Settings\user.NEO\Application Data\Real
2008-09-19 22:29:20 ----A---- C:\WINDOWS.0\system32\atl71.dll
2008-09-19 22:29:19 ----D---- C:\Program Files\Musicmatch
2008-09-19 22:28:40 ----A---- C:\WINDOWS.0\ODBC.INI
2008-09-19 22:28:08 ----D---- C:\Program Files\DivX
2008-09-19 22:26:14 ----D---- C:\WINDOWS.0\SHELLNEW
2008-09-19 22:26:08 ----D---- C:\Program Files\Microsoft Office
2008-09-19 22:24:00 ----RHD---- C:\MSOCache
2008-09-19 18:31:11 ----A---- C:\WINDOWS.0\system32\kbdkor.dll
2008-09-19 18:31:11 ----A---- C:\WINDOWS.0\system32\kbdjpn.dll
2008-09-19 18:31:11 ----A---- C:\WINDOWS.0\system32\kbd106.dll
2008-09-19 18:31:11 ----A---- C:\WINDOWS.0\system32\kbd103.dll
2008-09-19 18:31:11 ----A---- C:\WINDOWS.0\system32\kbd101c.dll
2008-09-19 18:31:06 ----A---- C:\WINDOWS.0\system32\kbd101b.dll
2008-09-19 17:16:43 ----D---- C:\Documents and Settings\user.NEO\Application Data\The Labyrinth Plus! Edition
2008-09-19 17:10:52 ----D---- C:\Documents and Settings\user.NEO\Application Data\Intel
2008-09-19 17:10:48 ----A---- C:\WINDOWS.0\system32\results.txt
2008-09-19 17:10:19 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Intel
2008-09-19 17:09:51 ----DC---- C:\WINDOWS.0\system32\DRVSTORE
2008-09-19 17:09:51 ----A---- C:\WINDOWS.0\system32\NETw3r32.dll
2008-09-19 17:09:51 ----A---- C:\WINDOWS.0\system32\NETw3c32.dll
2008-09-19 15:02:30 ----D---- C:\Clannad
2008-09-19 09:57:25 ----D---- C:\Documents and Settings\user.NEO\Application Data\dvdcss
2008-09-18 22:05:34 ----D---- C:\WINDOWS.0\system32\NtmsData
2008-09-17 20:38:04 ----D---- C:\Program Files\Unlocker
2008-09-17 20:38:04 ----D---- C:\Documents and Settings\user.NEO\Application Data\Desktopicon
2008-09-17 17:31:04 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Office Genuine Advantage
2008-09-17 17:30:33 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Windows Genuine Advantage
2008-09-17 13:53:10 ----D---- C:\Documents and Settings\user.NEO\Application Data\WinRAR
2008-09-17 13:52:24 ----D---- C:\Documents and Settings\user.NEO\Application Data\Webroot
2008-09-17 13:51:28 ----D---- C:\Documents and Settings\user.NEO\Application Data\Uniblue
2008-09-17 13:50:48 ----D---- C:\Documents and Settings\user.NEO\Application Data\Ulead Systems
2008-09-17 13:50:45 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Ulead Systems
2008-09-17 13:48:52 ----D---- C:\Documents and Settings\user.NEO\Application Data\Opera
2008-09-17 13:44:19 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\CyberLink
2008-09-17 13:42:37 ----D---- C:\Documents and Settings\user.NEO\Application Data\Adobe
2008-09-15 10:47:13 ----D---- C:\Documents and Settings\user.NEO\Application Data\Mozilla
2008-09-13 23:20:45 ----A---- C:\WINDOWS.0\system32\h323log.txt
2008-09-13 23:19:27 ----A---- C:\WINDOWS.0\system32\usbui.dll
2008-09-13 23:16:39 ----A---- C:\WINDOWS.0\imsins.BAK
2008-09-13 23:16:35 ----SHD---- C:\WINDOWS.0\Installer
2008-09-13 23:16:35 ----A---- C:\WINDOWS.0\system32\PerfStringBackup.INI
2008-09-13 23:16:34 ----A---- C:\WINDOWS.0\ODBCINST.INI
2008-09-13 23:16:28 ----RA---- C:\WINDOWS.0\system32\kbdtuq.dll
2008-09-13 23:16:28 ----RA---- C:\WINDOWS.0\system32\kbdtuf.dll
2008-09-13 23:16:28 ----RA---- C:\WINDOWS.0\system32\kbdazel.dll
2008-09-13 23:16:26 ----RA---- C:\WINDOWS.0\system32\kbdycc.dll
2008-09-13 23:16:26 ----RA---- C:\WINDOWS.0\system32\kbduzb.dll
2008-09-13 23:16:26 ----RA---- C:\WINDOWS.0\system32\kbdur.dll
2008-09-13 23:16:26 ----RA---- C:\WINDOWS.0\system32\kbdtat.dll
2008-09-13 23:16:26 ----RA---- C:\WINDOWS.0\system32\kbdru1.dll
2008-09-13 23:16:26 ----RA---- C:\WINDOWS.0\system32\kbdru.dll
2008-09-13 23:16:26 ----RA---- C:\WINDOWS.0\system32\kbdmon.dll
2008-09-13 23:16:26 ----RA---- C:\WINDOWS.0\system32\kbdkyr.dll
2008-09-13 23:16:26 ----RA---- C:\WINDOWS.0\system32\kbdkaz.dll
2008-09-13 23:16:26 ----RA---- C:\WINDOWS.0\system32\kbdbu.dll
2008-09-13 23:16:26 ----RA---- C:\WINDOWS.0\system32\kbdaze.dll
2008-09-13 23:16:25 ----RA---- C:\WINDOWS.0\system32\kbdblr.dll
2008-09-13 23:16:24 ----RA---- C:\WINDOWS.0\system32\kbdhept.dll
2008-09-13 23:16:24 ----RA---- C:\WINDOWS.0\system32\kbdhela3.dll
2008-09-13 23:16:24 ----RA---- C:\WINDOWS.0\system32\kbdhela2.dll
2008-09-13 23:16:24 ----RA---- C:\WINDOWS.0\system32\kbdhe319.dll
2008-09-13 23:16:24 ----RA---- C:\WINDOWS.0\system32\kbdhe220.dll
2008-09-13 23:16:24 ----RA---- C:\WINDOWS.0\system32\kbdgkl.dll
2008-09-13 23:16:23 ----RA---- C:\WINDOWS.0\system32\kbdhe.dll
2008-09-13 23:16:22 ----RA---- C:\WINDOWS.0\system32\kbdlv1.dll
2008-09-13 23:16:22 ----RA---- C:\WINDOWS.0\system32\kbdlv.dll
2008-09-13 23:16:22 ----RA---- C:\WINDOWS.0\system32\kbdlt1.dll
2008-09-13 23:16:22 ----RA---- C:\WINDOWS.0\system32\kbdlt.dll
2008-09-13 23:16:22 ----RA---- C:\WINDOWS.0\system32\kbdest.dll
2008-09-13 23:16:20 ----RA---- C:\WINDOWS.0\system32\kbdsl1.dll
2008-09-13 23:16:20 ----RA---- C:\WINDOWS.0\system32\kbdsl.dll
2008-09-13 23:16:20 ----RA---- C:\WINDOWS.0\system32\kbdro.dll
2008-09-13 23:16:20 ----RA---- C:\WINDOWS.0\system32\kbdpl1.dll
2008-09-13 23:16:20 ----RA---- C:\WINDOWS.0\system32\kbdpl.dll
2008-09-13 23:16:20 ----RA---- C:\WINDOWS.0\system32\kbdhu1.dll
2008-09-13 23:16:20 ----RA---- C:\WINDOWS.0\system32\kbdhu.dll
2008-09-13 23:16:20 ----RA---- C:\WINDOWS.0\system32\kbdcz2.dll
2008-09-13 23:16:20 ----RA---- C:\WINDOWS.0\system32\kbdcz1.dll
2008-09-13 23:16:20 ----RA---- C:\WINDOWS.0\system32\kbdcz.dll
2008-09-13 23:16:19 ----RA---- C:\WINDOWS.0\system32\kbdycl.dll
2008-09-13 23:16:19 ----RA---- C:\WINDOWS.0\system32\kbdcr.dll
2008-09-13 23:16:19 ----RA---- C:\WINDOWS.0\system32\KBDAL.DLL
2008-09-13 23:16:16 ----A---- C:\WINDOWS.0\system32\spxcoins.dll
2008-09-13 23:16:16 ----A---- C:\WINDOWS.0\system32\irclass.dll
2008-09-13 23:16:16 ----A---- C:\WINDOWS.0\system32\EqnClass.Dll
2008-09-13 23:16:16 ----A---- C:\WINDOWS.0\system32\dgsetup.dll
2008-09-13 23:16:16 ----A---- C:\WINDOWS.0\system32\dgrpsetu.dll
2008-09-13 23:16:13 ----A---- C:\WINDOWS.0\TASKMAN.EXE
2008-09-13 23:16:13 ----A---- C:\WINDOWS.0\system32\CONFIG.TMP
2008-09-13 23:16:13 ----A---- C:\WINDOWS.0\system32\batt.dll
2008-09-13 23:16:12 ----A---- C:\WINDOWS.0\NOTEPAD.EXE
2008-09-13 23:16:11 ----A---- C:\WINDOWS.0\system32\storprop.dll
2008-09-13 23:16:02 ----RA---- C:\WINDOWS.0\SET2E.tmp
2008-09-13 23:16:02 ----RA---- C:\WINDOWS.0\SET2D.tmp
2008-09-13 23:16:02 ----ASH---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\desktop.ini
2008-09-13 23:15:57 ----RA---- C:\WINDOWS.0\SET8.tmp
2008-09-13 23:15:54 ----RA---- C:\WINDOWS.0\SET4.tmp
2008-09-13 23:15:53 ----RA---- C:\WINDOWS.0\SET3.tmp
2008-09-13 23:15:47 ----D---- C:\WINDOWS.0\system32\CatRoot2
2008-09-13 23:15:47 ----D---- C:\WINDOWS.0\system32\CatRoot
2008-09-13 23:15:41 ----SD---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Microsoft
2008-09-13 23:15:19 ----A---- C:\WINDOWS.0\setuplog.txt
2008-09-13 23:04:16 ----RSHDC---- C:\WINDOWS.0\system32\dllcache
2008-09-13 23:04:16 ----RSD---- C:\WINDOWS.0\Fonts
2008-09-13 23:04:16 ----RD---- C:\WINDOWS.0\Web
2008-09-13 23:04:16 ----RAD---- C:\WINDOWS.0
2008-09-13 23:04:16 ----HD---- C:\WINDOWS.0\inf
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\WinSxS
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\twain_32
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\Temp
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\wins
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\wbem
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\usmt
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\spool
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\ShellExt
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\Setup
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\ras
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\oobe
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\npp
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\mui
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\inetsrv
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\IME
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\icsxml
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\ias
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\export
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\drivers
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\dhcp
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\config
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\3com_dmi
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\3076
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\2052
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\1054
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\1042
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\1041
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\1037
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\1033
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\1031
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\1028
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32\1025
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system32
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\system
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\security
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\Resources
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\repair
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\Provisioning
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\PeerNet
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\pchealth
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\mui
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\msapps
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\msagent
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\Media
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\java
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\ime
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\Help
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\ehome
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\Driver Cache
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\Debug
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\Cursors
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\Connection Wizard
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\Config
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\AppPatch
2008-09-13 23:04:16 ----D---- C:\WINDOWS.0\addins
2008-09-13 21:49:39 ----D---- C:\WINDOWS.0\pss
2008-09-13 21:34:45 ----D---- C:\Documents and Settings\user.NEO\Application Data\vlc
2008-09-13 16:22:25 ----A---- C:\WINDOWS.0\system32\wpa.bak
2008-09-13 16:08:51 ----D---- C:\WINDOWS.0\system32\Lang
2008-09-13 16:08:49 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Bluetooth
2008-09-13 16:08:36 ----A---- C:\WINDOWS.0\system32\igfxres.dll
2008-09-13 16:03:33 ----A---- C:\WINDOWS.0\system32\vfwwdm32.dll
2008-09-13 16:02:42 ----A---- C:\WINDOWS.0\ModemLog_Bluetooth DUN Modem.txt
2008-09-13 16:02:40 ----A---- C:\WINDOWS.0\ModemLog_Bluetooth Fax Modem.txt
2008-09-13 15:59:07 ----RA---- C:\WINDOWS.0\Record.exe
2008-09-13 15:59:07 ----A---- C:\WINDOWS.0\mHotkey.exe
2008-09-13 15:59:07 ----A---- C:\WINDOWS.0\HKNTDLL.dll
2008-09-13 15:58:45 ----D---- C:\WINDOWS.0\tiinst
2008-09-13 15:56:41 ----D---- C:\WINDOWS.0\OPTIONS
2008-09-13 15:54:15 ----A---- C:\WINDOWS.0\system32\RtlCPAPI.dll
2008-09-13 15:54:15 ----A---- C:\WINDOWS.0\system32\ChCfg.exe
2008-09-13 15:54:08 ----D---- C:\WINDOWS.0\system32\RTCOM
2008-09-13 15:53:33 ----A---- C:\WINDOWS.0\system32\ksuser.dll
2008-09-13 15:53:24 ----A---- C:\WINDOWS.0\system32\spupdsvc.exe
2008-09-13 15:53:22 ----HDC---- C:\WINDOWS.0\$NtUninstallKB888111WXPSP2$
2008-09-13 15:53:06 ----A---- C:\WINDOWS.0\RtlExUpd.dll
2008-09-13 15:51:24 ----D---- C:\WINDOWS.0\system32\ReinstallBackups
2008-09-13 15:48:45 ----SD---- C:\Documents and Settings\user.NEO\Application Data\Microsoft
2008-09-13 15:48:45 ----D---- C:\Documents and Settings\user.NEO\Application Data\Identities
2008-09-13 15:48:45 ----ASH---- C:\Documents and Settings\user.NEO\Application Data\desktop.ini
2008-09-13 15:40:16 ----A---- C:\WINDOWS.0\smscfg.ini
2008-09-13 15:37:38 ----A---- C:\WINDOWS.0\system32\w39NCPA.dll
2008-09-13 15:37:36 ----A---- C:\WINDOWS.0\system32\w39MLRes.dll
2008-09-13 15:36:33 ----D---- C:\WINDOWS.0\Drivers
2008-09-13 15:36:29 ----D---- C:\WINDOWS.0\SoftwareDistribution
2008-09-13 15:36:19 ----D---- C:\WINDOWS.0\Prefetch
2008-09-13 15:36:18 ----SD---- C:\WINDOWS.0\system32\Microsoft
2008-09-13 15:36:18 ----A---- C:\WINDOWS.0\SchedLgU.Txt
2008-09-13 15:30:43 ----D---- C:\WINDOWS.0\system32\xircom
2008-09-13 15:30:14 ----HD---- C:\WINDOWS.0\$hf_mig$
2008-09-13 15:30:12 ----A---- C:\WINDOWS.0\system32\xpsp3res.dll
2008-09-13 15:30:00 ----A---- C:\WINDOWS.0\control.ini
2008-09-13 15:30:00 ----A---- C:\AUTOEXEC.BAT
2008-09-13 15:29:44 ----A---- C:\WINDOWS.0\OEWABLog.txt
2008-09-13 15:29:37 ----A---- C:\WINDOWS.0\system32\mapi32.dll
2008-09-13 15:27:55 ----SD---- C:\WINDOWS.0\Downloaded Program Files
2008-09-13 15:27:55 ----RD---- C:\WINDOWS.0\Offline Web Pages
2008-09-13 15:27:55 ----RAH---- C:\WINDOWS.0\system32\logonui.exe.manifest
2008-09-13 15:27:46 ----RAH---- C:\WINDOWS.0\system32\cdplayer.exe.manifest
2008-09-13 15:27:15 ----D---- C:\WINDOWS.0\system32\DirectX
2008-09-13 15:26:52 ----A---- C:\WINDOWS.0\system32\atrace.dll
2008-09-13 15:26:50 ----A---- C:\WINDOWS.0\system32\desktop.ini
2008-09-13 15:26:50 ----A---- C:\WINDOWS.0\desktop.ini
2008-09-13 15:26:43 ----A---- C:\WINDOWS.0\system32\nmevtmsg.dll
2008-09-13 15:26:43 ----A---- C:\WINDOWS.0\system32\acctres.dll
2008-09-13 15:26:42 ----SD---- C:\WINDOWS.0\Tasks
2008-09-13 15:26:42 ----A---- C:\WINDOWS.0\system32\icfgnt5.dll
2008-09-13 15:26:38 ----D---- C:\WINDOWS.0\srchasst
2008-09-13 15:26:37 ----D---- C:\WINDOWS.0\system32\Macromed
2008-09-13 15:26:34 ----A---- C:\WINDOWS.0\system32\wuweb.dll
2008-09-13 15:26:34 ----A---- C:\WINDOWS.0\system32\wups.dll
2008-09-13 15:26:34 ----A---- C:\WINDOWS.0\system32\wucltui.dll
2008-09-13 15:26:34 ----A---- C:\WINDOWS.0\system32\wuauserv.dll
2008-09-13 15:26:34 ----A---- C:\WINDOWS.0\system32\wuaueng1.dll
2008-09-13 15:26:34 ----A---- C:\WINDOWS.0\system32\wuaueng.dll
2008-09-13 15:26:34 ----A---- C:\WINDOWS.0\system32\wuauclt1.exe
2008-09-13 15:26:33 ----A---- C:\WINDOWS.0\system32\wuauclt.exe
2008-09-13 15:26:33 ----A---- C:\WINDOWS.0\system32\wuapi.dll.wusetup.18352546.bak
2008-09-13 15:26:33 ----A---- C:\WINDOWS.0\system32\wuapi.dll
2008-09-13 15:26:33 ----A---- C:\WINDOWS.0\system32\qmgrprxy.dll
2008-09-13 15:26:33 ----A---- C:\WINDOWS.0\system32\qmgr.dll
2008-09-13 15:26:33 ----A---- C:\WINDOWS.0\system32\bitsprx3.dll
2008-09-13 15:26:33 ----A---- C:\WINDOWS.0\system32\bitsprx2.dll
2008-09-13 15:26:29 ----A---- C:\WINDOWS.0\system32\safrslv.dll
2008-09-13 15:26:29 ----A---- C:\WINDOWS.0\system32\safrdm.dll
2008-09-13 15:26:29 ----A---- C:\WINDOWS.0\system32\safrcdlg.dll
2008-09-13 15:26:29 ----A---- C:\WINDOWS.0\system32\racpldlg.dll
2008-09-13 15:26:24 ----A---- C:\WINDOWS.0\system32\fltMc.exe
2008-09-13 15:26:24 ----A---- C:\WINDOWS.0\system32\fltlib.dll
2008-09-13 15:26:23 ----D---- C:\WINDOWS.0\system32\Restore
2008-09-13 15:26:23 ----A---- C:\WINDOWS.0\system32\srsvc.dll
2008-09-13 15:26:23 ----A---- C:\WINDOWS.0\system32\srrstr.dll
2008-09-13 15:26:23 ----A---- C:\WINDOWS.0\system32\srclient.dll
2008-09-13 15:26:23 ----A---- C:\WINDOWS.0\system32\ils.dll
2008-09-13 15:26:22 ----A---- C:\WINDOWS.0\system32\nmmkcert.dll
2008-09-13 15:26:22 ----A---- C:\WINDOWS.0\system32\msoert2.dll
2008-09-13 15:26:22 ----A---- C:\WINDOWS.0\system32\msoeacct.dll
2008-09-13 15:26:22 ----A---- C:\WINDOWS.0\system32\msconf.dll
2008-09-13 15:26:22 ----A---- C:\WINDOWS.0\system32\mnmsrvc.exe
2008-09-13 15:26:22 ----A---- C:\WINDOWS.0\system32\mnmdd.dll
2008-09-13 15:26:22 ----A---- C:\WINDOWS.0\system32\isrdbg32.dll
2008-09-13 15:26:21 ----A---- C:\WINDOWS.0\system32\inetres.dll
2008-09-13 15:26:21 ----A---- C:\WINDOWS.0\system32\inetcomm.dll
2008-09-13 15:26:20 ----A---- C:\WINDOWS.0\system32\schedsvc.dll
2008-09-13 15:26:19 ----A---- C:\WINDOWS.0\system32\mstinit.exe
2008-09-13 15:26:19 ----A---- C:\WINDOWS.0\system32\mstask.dll
2008-09-13 15:26:19 ----A---- C:\WINDOWS.0\system32\isign32.dll
2008-09-13 15:26:19 ----A---- C:\WINDOWS.0\system32\icwphbk.dll
2008-09-13 15:26:19 ----A---- C:\WINDOWS.0\system32\icwdial.dll
2008-09-13 15:26:18 ----A---- C:\WINDOWS.0\system32\inetcfg.dll
2008-09-13 15:25:23 ----RSD---- C:\WINDOWS.0\assembly
2008-09-13 15:24:45 ----A---- C:\WINDOWS.0\vbaddin.ini
2008-09-13 15:24:45 ----A---- C:\WINDOWS.0\vb.ini
2008-09-13 15:24:38 ----D---- C:\WINDOWS.0\Registration
2008-09-13 15:24:06 ----D---- C:\WINDOWS.0\Microsoft.NET
2008-09-13 15:23:31 ----A---- C:\WINDOWS.0\system32\mhn.dll
2008-09-13 15:23:31 ----A---- C:\WINDOWS.0\system32\igdetect.dll
2008-09-13 15:22:10 ----A---- C:\WINDOWS.0\system32\write.exe
2008-09-13 15:22:05 ----A---- C:\WINDOWS.0\system32\sndvol32.exe
2008-09-13 15:22:05 ----A---- C:\WINDOWS.0\system32\hticons.dll
2008-09-13 15:22:05 ----A---- C:\WINDOWS.0\system32\avwav.dll
2008-09-13 15:22:04 ----A---- C:\WINDOWS.0\system32\winchat.exe
2008-09-13 15:22:04 ----A---- C:\WINDOWS.0\system32\avtapi.dll
2008-09-13 15:22:04 ----A---- C:\WINDOWS.0\system32\avmeter.dll
2008-09-13 15:21:57 ----A---- C:\WINDOWS.0\system32\sol.exe
2008-09-13 15:21:57 ----A---- C:\WINDOWS.0\system32\getuname.dll
2008-09-13 15:21:57 ----A---- C:\WINDOWS.0\system32\charmap.exe
2008-09-13 15:21:57 ----A---- C:\WINDOWS.0\system32\calc.exe
2008-09-13 15:21:56 ----A---- C:\WINDOWS.0\system32\winmine.exe
2008-09-13 15:21:56 ----A---- C:\WINDOWS.0\system32\reset.exe
2008-09-13 15:21:56 ----A---- C:\WINDOWS.0\system32\mshearts.exe
2008-09-13 15:21:56 ----A---- C:\WINDOWS.0\system32\freecell.exe
2008-09-13 15:21:55 ----A---- C:\WINDOWS.0\system32\usrlogon.cmd
2008-09-13 15:21:55 ----A---- C:\WINDOWS.0\system32\tsshutdn.exe
2008-09-13 15:21:55 ----A---- C:\WINDOWS.0\system32\tslabels.ini
2008-09-13 15:21:55 ----A---- C:\WINDOWS.0\system32\tskill.exe
2008-09-13 15:21:55 ----A---- C:\WINDOWS.0\system32\tsdiscon.exe
2008-09-13 15:21:55 ----A---- C:\WINDOWS.0\system32\tscon.exe
2008-09-13 15:21:55 ----A---- C:\WINDOWS.0\system32\shadow.exe
2008-09-13 15:21:55 ----A---- C:\WINDOWS.0\system32\rwinsta.exe
2008-09-13 15:21:55 ----A---- C:\WINDOWS.0\system32\regini.exe
2008-09-13 15:21:55 ----A---- C:\WINDOWS.0\system32\rdpcfgex.dll
2008-09-13 15:21:55 ----A---- C:\WINDOWS.0\system32\qwinsta.exe
2008-09-13 15:21:55 ----A---- C:\WINDOWS.0\system32\qappsrv.exe
2008-09-13 15:21:55 ----A---- C:\WINDOWS.0\system32\msg.exe
2008-09-13 15:21:54 ----A---- C:\WINDOWS.0\system32\msdtcprf.ini
2008-09-13 15:21:54 ----A---- C:\WINDOWS.0\system32\logoff.exe
2008-09-13 15:21:54 ----A---- C:\WINDOWS.0\system32\cdmodem.dll
2008-09-13 15:21:53 ----A---- C:\WINDOWS.0\system32\stclient.dll
2008-09-13 15:21:53 ----A---- C:\WINDOWS.0\system32\mtxlegih.dll
2008-09-13 15:21:53 ----A---- C:\WINDOWS.0\system32\mtxex.dll
2008-09-13 15:21:53 ----A---- C:\WINDOWS.0\system32\mtxdm.dll
2008-09-13 15:21:53 ----A---- C:\WINDOWS.0\system32\dcomcnfg.exe
2008-09-13 15:21:53 ----A---- C:\WINDOWS.0\system32\comsnap.dll
2008-09-13 15:21:53 ----A---- C:\WINDOWS.0\system32\comrepl.dll
2008-09-13 15:21:53 ----A---- C:\WINDOWS.0\system32\comaddin.dll
2008-09-13 15:21:48 ----A---- C:\WINDOWS.0\system32\wmimgmt.msc
2008-09-13 15:21:47 ----A---- C:\WINDOWS.0\system32\sndrec32.exe
2008-09-13 15:21:47 ----A---- C:\WINDOWS.0\system32\mspaint.exe
2008-09-13 15:21:47 ----A---- C:\WINDOWS.0\system32\mplay32.exe
2008-09-13 15:21:47 ----A---- C:\WINDOWS.0\system32\hypertrm.dll
2008-09-13 15:21:47 ----A---- C:\WINDOWS.0\system32\accwiz.exe
2008-09-13 15:21:46 ----A---- C:\WINDOWS.0\system32\spider.exe
2008-09-13 15:21:46 ----A---- C:\WINDOWS.0\system32\clipbrd.exe
2008-09-13 15:21:45 ----A---- C:\WINDOWS.0\system32\tscfgwmi.dll
2008-09-13 15:21:45 ----A---- C:\WINDOWS.0\system32\remotepg.dll
2008-09-13 15:21:45 ----A---- C:\WINDOWS.0\system32\rdshost.exe
2008-09-13 15:21:45 ----A---- C:\WINDOWS.0\system32\rdsaddin.exe
2008-09-13 15:21:45 ----A---- C:\WINDOWS.0\system32\mstscax.dll
2008-09-13 15:21:45 ----A---- C:\WINDOWS.0\system32\mstsc.exe
2008-09-13 15:21:44 ----A---- C:\WINDOWS.0\system32\tscupgrd.exe
2008-09-13 15:21:44 ----A---- C:\WINDOWS.0\system32\termsrv.dll
2008-09-13 15:21:44 ----A---- C:\WINDOWS.0\system32\sessmgr.exe
2008-09-13 15:21:44 ----A---- C:\WINDOWS.0\system32\rdpwsx.dll
2008-09-13 15:21:44 ----A---- C:\WINDOWS.0\system32\rdpsnd.dll
2008-09-13 15:21:44 ----A---- C:\WINDOWS.0\system32\rdpclip.exe
2008-09-13 15:21:44 ----A---- C:\WINDOWS.0\system32\rdchost.dll
2008-09-13 15:21:44 ----A---- C:\WINDOWS.0\system32\qprocess.exe
2008-09-13 15:21:44 ----A---- C:\WINDOWS.0\system32\icaapi.dll
2008-09-13 15:21:43 ----D---- C:\WINDOWS.0\system32\MsDtc
2008-09-13 15:21:43 ----A---- C:\WINDOWS.0\system32\mtxoci.dll
2008-09-13 15:21:43 ----A---- C:\WINDOWS.0\system32\msdtcuiu.dll
2008-09-13 15:21:43 ----A---- C:\WINDOWS.0\system32\msdtcprx.dll
2008-09-13 15:21:43 ----A---- C:\WINDOWS.0\system32\cfgbkend.dll
2008-09-13 15:21:42 ----A---- C:\WINDOWS.0\system32\xolehlp.dll
2008-09-13 15:21:42 ----A---- C:\WINDOWS.0\system32\msdtctm.dll
2008-09-13 15:21:42 ----A---- C:\WINDOWS.0\system32\msdtclog.dll
2008-09-13 15:21:42 ----A---- C:\WINDOWS.0\system32\msdtc.exe
2008-09-13 15:21:41 ----D---- C:\WINDOWS.0\system32\Com
2008-09-13 15:21:41 ----A---- C:\WINDOWS.0\system32\colbact.dll
2008-09-13 15:21:41 ----A---- C:\WINDOWS.0\system32\clbcatex.dll
2008-09-13 15:21:41 ----A---- C:\WINDOWS.0\system32\catsrvut.dll
2008-09-13 15:21:41 ----A---- C:\WINDOWS.0\system32\catsrvps.dll
2008-09-13 15:21:41 ----A---- C:\WINDOWS.0\system32\catsrv.dll
2008-09-13 15:21:40 ----A---- C:\WINDOWS.0\system32\comuid.dll
2008-09-13 15:21:40 ----A---- C:\WINDOWS.0\system32\comsvcs.dll
2008-09-13 15:21:40 ----A---- C:\WINDOWS.0\system32\clbcatq.dll
2008-09-13 15:21:34 ----A---- C:\WINDOWS.0\system32\servdeps.dll
2008-09-13 15:21:33 ----A---- C:\WINDOWS.0\system32\mmfutil.dll
2008-09-13 15:21:33 ----A---- C:\WINDOWS.0\system32\licwmi.dll
2008-09-13 15:21:33 ----A---- C:\WINDOWS.0\system32\cmprops.dll
2008-09-10 12:17:22 ----A---- C:\WINDOWS.0\system32\iglicd32.dll
2008-09-10 12:17:21 ----A---- C:\WINDOWS.0\system32\igldev32.dll
2008-09-10 12:17:21 ----A---- C:\WINDOWS.0\system32\igfxzoom.exe
2008-09-10 12:17:21 ----A---- C:\WINDOWS.0\system32\igfxtray.exe
2008-09-10 12:17:21 ----A---- C:\WINDOWS.0\system32\igfxsrvc.exe
2008-09-10 12:17:21 ----A---- C:\WINDOWS.0\system32\igfxsrvc.dll
2008-09-10 12:17:20 ----A---- C:\WINDOWS.0\system32\igfxress.dll
2008-09-10 12:17:19 ----A---- C:\WINDOWS.0\system32\igfxpph.dll
2008-09-10 12:17:19 ----A---- C:\WINDOWS.0\system32\igfxpers.exe
2008-09-10 12:17:19 ----A---- C:\WINDOWS.0\system32\igfxext.exe
2008-09-10 12:17:19 ----A---- C:\WINDOWS.0\system32\igfxexps.dll
2008-09-10 12:17:19 ----A---- C:\WINDOWS.0\system32\igfxdo.dll
2008-09-10 12:17:19 ----A---- C:\WINDOWS.0\system32\igfxdev.dll
2008-09-10 12:17:19 ----A---- C:\WINDOWS.0\system32\igfxcfg.exe
2008-09-10 12:17:18 ----A---- C:\WINDOWS.0\system32\ialmrnt5.dll
2008-09-10 12:17:18 ----A---- C:\WINDOWS.0\system32\ialmrem.dll
2008-09-10 12:17:18 ----A---- C:\WINDOWS.0\system32\ialmdnt5.dll
2008-09-10 12:17:18 ----A---- C:\WINDOWS.0\system32\ialmdev5.dll
2008-09-10 12:17:18 ----A---- C:\WINDOWS.0\system32\ialmdd5.dll
2008-09-10 12:17:17 ----A---- C:\WINDOWS.0\system32\iAlmCoIn_v4497.dll
2008-09-10 12:17:17 ----A---- C:\WINDOWS.0\system32\hkcmd.exe
2008-09-10 12:17:17 ----A---- C:\WINDOWS.0\system32\hccutils.dll
2008-09-05 23:30:42 ----A---- C:\WINDOWS.0\system32\WgaLogon.dll
2008-09-05 23:30:06 ----A---- C:\WINDOWS.0\system32\LegitCheckControl.dll
2008-09-05 23:29:58 ----A---- C:\WINDOWS.0\system32\WgaTray.exe
2008-08-30 12:54:59 ----SHD---- C:\Config.Msi
2008-08-14 17:22:10 ----D---- C:\Program Files\Common Files\xing shared

clubECGR · 2008/10/24

======List of files/folders modified in the last 3 months======

2008-10-24 14:50:38 ----D---- C:\Program Files\Messenger
2008-10-24 14:48:59 ----D---- C:\Program Files
2008-10-24 14:30:01 ----A---- C:\WINDOWS.0\win.ini
2008-10-24 01:01:19 ----D---- C:\Program Files\Mozilla Firefox
2008-10-22 21:44:19 ----ASH---- C:\boot.ini
2008-10-22 21:44:19 ----A---- C:\WINDOWS.0\system.ini
2008-10-22 21:39:16 ----D---- C:\Program Files\Internet Explorer
2008-10-22 21:26:04 ----SHD---- C:\System Volume Information
2008-10-20 23:10:01 ----SHD---- C:\RECYCLER
2008-10-20 15:23:38 ----A---- C:\WINDOWS.0\ntbtlog.txt
2008-10-17 18:43:15 ----D---- C:\To A Folder
2008-10-10 04:19:04 ----D---- C:\Program Files\Common Files
2008-10-07 22:50:48 ----D---- C:\Program Files\Elantech
2008-10-07 00:25:21 ----D---- C:\Mina
2008-10-05 21:08:19 ----D---- C:\pokemon
2008-10-04 14:38:16 ----HD---- C:\Program Files\InstallShield Installation Information
2008-10-03 19:04:05 ----D---- C:\Program Files\Common Files\Adobe
2008-10-03 18:06:31 ----D---- C:\anime mp3 2
2008-10-03 02:30:32 ----D---- C:\Program Files\WinRAR
2008-10-03 01:54:28 ----D---- C:\Program Files\Opera
2008-10-02 20:28:21 ----D---- C:\Program Files\Java
2008-10-02 20:19:45 ----A---- C:\WINDOWS.0\system32\msvcr71.dll
2008-10-02 20:03:49 ----D---- C:\Program Files\Common Files\Microsoft Shared
2008-10-02 19:42:25 ----D---- C:\Program Files\Common Files\Ahead
2008-09-27 20:31:00 ----D---- C:\Program Files\Common Files\DESIGNER
2008-09-27 19:38:51 ----D---- C:\Program Files\MSBuild
2008-09-20 12:42:32 ----A---- C:\YServer.txt
2008-09-19 17:49:40 ----D---- C:\Program Files\StepMania CVS
2008-09-13 15:48:44 ----D---- C:\Documents and Settings
2008-09-13 15:27:08 ----D---- C:\Program Files\Windows Media Player
2008-09-13 15:26:21 ----D---- C:\Program Files\Outlook Express
2008-09-13 15:26:21 ----D---- C:\Program Files\Common Files\System
2008-08-14 17:58:27 ----A---- C:\WINDOWS.0\system32\ntoskrnl.exe
2008-08-14 17:22:14 ----A---- C:\WINDOWS.0\system32\ntkrnlpa.exe
2008-08-14 17:21:45 ----D---- C:\Program Files\Common Files\Real

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys []
R1 intelppm;Intel Processor Driver; C:\WINDOWS.0\system32\DRIVERS\intelppm.sys [2006-03-15 36096]
R1 PQNTDrv;PQNTDrv; C:\WINDOWS.0\system32\drivers\PQNTDrv.sys [2002-09-16 4228]
R1 SCDEmu;SCDEmu; C:\WINDOWS.0\system32\drivers\SCDEmu.sys [2008-01-20 33292]
R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 SRTSPX;SRTSPX; C:\WINDOWS.0\System32\Drivers\SRTSPX.SYS [2007-11-30 43696]
R1 StyleXPHelper;StyleXPHelper; \??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe []
R1 SYMTDI;SYMTDI; C:\WINDOWS.0\System32\Drivers\SYMTDI.SYS [2007-01-09 191544]
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B}; \??\C:\Program Files\CyberLink\PowerDVD\000.fcl []
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.5.3.0; C:\WINDOWS.0\system32\DRIVERS\AegisP.sys [2008-09-19 21419]
R2 s24trans;WLAN Transport; C:\WINDOWS.0\system32\DRIVERS\s24trans.sys [2006-07-02 12544]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS.0\system32\DRIVERS\arp1394.sys [2006-03-15 60800]
R3 Cam5603D;BisonCam, NB Pro; C:\WINDOWS.0\System32\Drivers\BisonCam.sys [2005-12-19 649088]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS.0\system32\DRIVERS\CmBatt.sys [2004-08-04 14080]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS.0\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS.0\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 ialm;ialm; C:\WINDOWS.0\system32\DRIVERS\ialmnt5.sys [2006-02-08 1399615]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS.0\system32\drivers\RtkHDAud.sys [2006-01-14 4137984]
R3 Ktp;Elantech Touchpad; C:\WINDOWS.0\system32\DRIVERS\Ktp.sys [2005-11-29 27520]
R3 mouhid;Mouse HID Driver; C:\WINDOWS.0\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081023.003\NAVENG.SYS []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081023.003\NAVEX15.SYS []
R3 NETw3x32;Intel(R) PRO/Wireless 3945ABG Adapter Driver for Windows XP 32 Bit; C:\WINDOWS.0\system32\DRIVERS\NETw3x32.sys [2006-07-02 1706752]
R3 NIC1394;1394 Net Driver; C:\WINDOWS.0\system32\DRIVERS\nic1394.sys [2006-03-15 61824]
R3 RTL8023xp;Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver; C:\WINDOWS.0\system32\DRIVERS\Rtlnicxp.sys [2004-12-03 70912]
R3 sdbus;sdbus; C:\WINDOWS.0\system32\DRIVERS\sdbus.sys [2006-03-15 67584]
R3 smserial;smserial; C:\WINDOWS.0\system32\DRIVERS\smserial.sys [2005-11-10 854404]
R3 SRTSP;SRTSP; C:\WINDOWS.0\System32\Drivers\SRTSP.SYS [2007-11-30 279088]
R3 SYMDNS;SYMDNS; C:\WINDOWS.0\System32\Drivers\SYMDNS.SYS [2007-01-09 12984]
R3 SymEvent;SymEvent; \??\C:\WINDOWS.0\system32\Drivers\SYMEVENT.SYS []
R3 SYMFW;SYMFW; C:\WINDOWS.0\System32\Drivers\SYMFW.SYS [2007-01-09 145976]
R3 SYMIDS;SYMIDS; C:\WINDOWS.0\System32\Drivers\SYMIDS.SYS [2007-01-09 40120]
R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\idsdefs\20081014.001\SymIDSCo.sys []
R3 SYMNDIS;SYMNDIS; C:\WINDOWS.0\System32\Drivers\SYMNDIS.SYS [2007-01-09 35256]
R3 SYMREDRV;SYMREDRV; C:\WINDOWS.0\System32\Drivers\SYMREDRV.SYS [2007-01-09 27576]
R3 tifm21;tifm21; C:\WINDOWS.0\system32\drivers\tifm21.sys [2005-09-21 162432]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS.0\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS.0\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS.0\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S1 InCDPass;InCDPass; C:\WINDOWS.0\system32\drivers\InCDPass.sys []
S1 InCDRm;InCD Reader; C:\WINDOWS.0\system32\drivers\InCDRm.sys []
S3 BlueletAudio;Bluetooth Audio Service; C:\WINDOWS.0\system32\DRIVERS\blueletaudio.sys []
S3 BlueletSCOAudio;Bluetooth SCO Audio Service; C:\WINDOWS.0\system32\DRIVERS\BlueletSCOAudio.sys []
S3 BT;Bluetooth PAN Network Adapter; C:\WINDOWS.0\system32\DRIVERS\btnetdrv.sys []
S3 BTHidEnum;Bluetooth HID Enumerator; C:\WINDOWS.0\system32\DRIVERS\vbtenum.sys []
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS.0\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS.0\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS.0\system32\drivers\HdAudio.sys [2005-01-07 145920]
S3 MHNDRV;MHN driver; C:\WINDOWS.0\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS.0\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 MxlW2k;MxlW2k; C:\WINDOWS.0\system32\drivers\MxlW2k.sys [2008-09-19 28352]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS.0\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS.0\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS.0\system32\drivers\nmwcd.sys [2007-02-22 137216]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS.0\system32\drivers\nmwcdc.sys [2007-02-22 8320]
S3 nmwcdcj;Nokia USB Port; C:\WINDOWS.0\system32\drivers\nmwcdcj.sys [2007-02-22 12288]
S3 nmwcdcm;Nokia USB Modem; C:\WINDOWS.0\system32\drivers\nmwcdcm.sys [2007-02-22 12288]
S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS.0\System32\Drivers\RootMdm.sys [2006-03-15 5888]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS.0\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 SRTSPL;SRTSPL; C:\WINDOWS.0\System32\Drivers\SRTSPL.SYS [2007-11-30 317616]
S3 streamip;BDA IPSink; C:\WINDOWS.0\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS.0\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 VComm;Virtual Serial port driver; C:\WINDOWS.0\system32\DRIVERS\VComm.sys []
S3 VcommMgr;Bluetooth VComm Manager Service; C:\WINDOWS.0\System32\Drivers\VcommMgr.sys []
S3 w39n51;Intel(R) PRO/Wireless 3945ABG Adapter Driver; C:\WINDOWS.0\system32\DRIVERS\w39n51.sys [2005-12-05 1428096]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS.0\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 InCDFs;InCD File System; C:\WINDOWS.0\system32\drivers\InCDFs.sys []
S4 IntelIde;IntelIde; C:\WINDOWS.0\system32\drivers\IntelIde.sys []
S4 mchInjDrv;mchInjDrv; \??\C:\DOCUME~1\user.NEO\LOCALS~1\Temp\mc21.tmp []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-02-18 110592]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-01-10 108648]
R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-01-10 108648]
R2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-01-10 108648]
R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS.0\eHome\ehRecvr.exe [2004-08-10 194560]
R2 ehSched;Media Center Scheduler Service; C:\WINDOWS.0\eHome\ehSched.exe [2004-08-10 102912]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2006-07-02 434176]
R2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-01-10 108648]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2006-07-02 327680]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared files\RichVideo.exe [2007-10-16 243056]
R2 S24EventMonitor;Intel(R) PROSet/Wireless Service; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2006-07-02 937984]
R2 StyleXPService;StyleXPService; C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe [2006-05-25 372736]
R3 Symantec Core LC;Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2008-10-10 1251720]
S2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
S2 spupdsvc;Windows Service Pack Installer update service; C:\WINDOWS.0\system32\spupdsvc.exe [2005-06-28 22752]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS.0\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS.0\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 comHost;COM Host; C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe [2007-01-13 49248]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-10-03 654848]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-02-19 504104]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-09-12 2999664]
S3 MHN;MHN; C:\WINDOWS.0\System32\svchost.exe [2006-03-15 14336]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2007-06-15 300544]
S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS.0\system32\wdfmgr.exe [2004-08-11 38912]

-----------------EOF-----------------

got disconnected so I'll restart the kasperky scan

EDIT: I cant seem to fully dwnloa dthe kasperky online scan as i always get disconnecting with either at 4MB or at 10 MB out of 30+MB

EDIT 2: Im doing Panda Online Scan and I have 66 vulnerabilities and 9 infected files. im at 38%

EDIT 3: Panda scan is a bad idea. trying to get kasperky to work

EDIT 4: cant fully download kasperky at 10MB. it always fails

Geri · 2008/10/25

Hi
OK please do this.

Download ComboFix from Here to your Desktop.

It's best to disable realtime protection applications as they sometimes interfere with the tool.
Check this link for any applicable programs you may have.

Close all open programs and windows

Double click combofix.exe and follow the prompts.

Vista users right click Combofix.exe and select Run As Administrator.

When finished, it shall produce a log for you. Post the Combofix log

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.

Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.

Your Flash Drive(s) (USB Thumb Drive(s) are infected please do not use then until we can get them cleaned.

Thanks
Geri

clubECGR · 2008/10/26

Here's the log. took about 30 minutes or less

ComboFix 08-10-24.02 - user 2008-10-24 14:47:52.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.169 [GMT 8:00]
Running from: C:\Documents and Settings\user.NEO\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-09-24 to 2008-10-24 )))))))))))))))))))))))))))))))
.

2008-10-24 15:05 . 2008-10-24 15:05 <DIR> d-------- C:\WINDOWS.0\Sun
2008-10-24 15:05 . 2005-01-28 13:44 5,525,504 --a------ C:\WINDOWS.0\system32\setb0.tmp
2008-10-24 14:48 . 2008-10-24 14:51 <DIR> d-------- C:\rsit
2008-10-24 14:48 . 2008-10-24 14:51 <DIR> d-------- C:\Program Files\trend micro
2008-10-24 14:47 . 2008-10-24 15:16 <DIR> d-------- C:\WINDOWS.0\system32\CatRoot_bak
2008-10-24 14:46 . 2008-10-24 14:46 142 --a------ C:\WINDOWS.0\system32\spupdsvc.inf
2008-10-24 01:04 . 2008-08-14 18:00 2,180,352 -----c--- C:\WINDOWS.0\system32\dllcache\ntoskrnl.exe
2008-10-24 01:04 . 2008-08-14 17:58 2,136,064 -----c--- C:\WINDOWS.0\system32\dllcache\ntkrnlmp.exe
2008-10-24 01:03 . 2008-08-14 17:22 2,057,728 -----c--- C:\WINDOWS.0\system32\dllcache\ntkrnlpa.exe
2008-10-24 01:03 . 2008-08-14 17:22 2,015,744 -----c--- C:\WINDOWS.0\system32\dllcache\ntkrpamp.exe
2008-10-23 22:57 . 2008-06-13 21:10 272,128 --------- C:\WINDOWS.0\system32\drivers\bthport.sys
2008-10-23 22:57 . 2008-06-13 21:10 272,128 -----c--- C:\WINDOWS.0\system32\dllcache\bthport.sys
2008-10-22 21:54 . 2008-10-22 22:00 24,265,736 --a------ C:\dotnetfx.exe
2008-10-22 21:54 . 2008-10-22 21:57 10,703,680 --a------ C:\NDP1.1sp1-KB867460-X86.exe
2008-10-22 21:46 . 2008-10-22 21:21 <DIR> d-a------ C:\Documents and Settings\All Users.WINDOWS.0\Application Data\TEMP
2008-10-22 21:44 . 2008-10-22 21:44 305,705 --a------ C:\RSIT.exe
2008-10-22 21:39 . 2002-12-29 01:14 81,920 --a------ C:\WINDOWS.0\system32\Startup.cpl
2008-10-22 21:39 . 2005-06-29 07:43 46,592 --------- C:\WINDOWS.0\system32\drivers\irbus.sys
2008-10-22 21:39 . 2005-06-29 07:43 19,200 --------- C:\WINDOWS.0\system32\drivers\hidir.sys
2008-10-22 21:38 . 2008-10-22 21:38 58,671 --a------ C:\startupcpl.zip
2008-10-22 21:35 . 2008-10-22 21:37 2,351,120 --a------ C:\mbam-setup.exe
2008-10-22 21:34 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS.0\system32\drivers\pavboot.sys
2008-10-22 21:33 . 2008-10-22 21:33 <DIR> d---s---- C:\Documents and Settings\user.NEO\UserData
2008-10-22 21:32 . 2008-10-22 21:32 <DIR> d-------- C:\Program Files\Panda Security
2008-10-22 21:23 . 2008-10-22 21:56 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-22 21:23 . 2008-10-22 21:23 <DIR> d-------- C:\Documents and Settings\user.NEO\Application Data\Malwarebytes
2008-10-22 21:23 . 2008-10-22 21:23 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Malwarebytes
2008-10-22 21:23 . 2008-10-22 16:10 38,496 --a------ C:\WINDOWS.0\system32\drivers\mbamswissarmy.sys
2008-10-22 21:23 . 2008-10-22 16:10 15,504 --a------ C:\WINDOWS.0\system32\drivers\mbam.sys
2008-10-22 21:11 . 2008-10-22 21:11 <DIR> d-------- C:\WINDOWS.0\BisonCam
2008-10-22 21:11 . 2005-12-19 17:49 649,088 --a------ C:\WINDOWS.0\system32\drivers\BisonCam.sys
2008-10-22 21:11 . 2005-01-14 13:47 180,224 --a------ C:\WINDOWS.0\system\StillDrv.dll
2008-10-22 21:11 . 2005-09-30 14:41 126,976 --a------ C:\WINDOWS.0\system\BisonCam.dll
2008-10-22 21:11 . 2005-09-30 14:41 90,112 --a------ C:\WINDOWS.0\system\BisonVfw.dll
2008-10-22 21:11 . 2005-11-17 22:57 73,846 --a------ C:\WINDOWS.0\system32\BisonRem.dll
2008-10-22 21:11 . 2003-09-22 13:49 15,190 --a------ C:\WINDOWS.0\M2000Twn.ini
2008-10-22 21:11 . 2003-09-22 14:36 13,448 --a------ C:\WINDOWS.0\M2000Twn.src
2008-10-22 21:11 . 2005-12-05 12:08 2,264 --a------ C:\WINDOWS.0\system\S20H0220.csr
2008-10-22 21:11 . 2005-12-05 12:08 2,264 --a------ C:\WINDOWS.0\system\S20F0220.csr
2008-10-21 17:10 . 2008-07-30 17:42 23,888 --a------ C:\WINDOWS.0\system32\drivers\COH_Mon.sys
2008-10-21 17:10 . 2008-07-30 17:28 10,537 --a------ C:\WINDOWS.0\system32\drivers\COH_Mon.cat
2008-10-21 17:10 . 2008-07-30 17:28 706 --a------ C:\WINDOWS.0\system32\drivers\COH_Mon.inf
2008-10-21 17:08 . 2008-10-04 10:22 60,273 --a------ C:\WINDOWS.0\system32\pthreadGC2.dll
2008-10-21 17:08 . 2008-10-10 18:25 7,680 --a------ C:\WINDOWS.0\system32\ff_vfw.dll
2008-10-21 17:08 . 2008-10-10 18:25 6,144 --a------ C:\WINDOWS.0\system32\ff_acm.acm
2008-10-21 17:08 . 2008-10-04 10:22 547 --a------ C:\WINDOWS.0\system32\ff_vfw.dll.manifest
2008-10-21 17:06 . 2008-10-21 17:12 <DIR> d-------- C:\Program Files\Combined Community Codec Pack
2008-10-10 04:20 . 2008-10-10 04:20 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-10 04:05 . 2008-10-10 04:05 33 --a------ C:\WINDOWS.0\system32\7c11d680
2008-10-05 20:47 . 2008-10-05 20:47 <DIR> d-------- C:\Myself Yourself Image Song
2008-10-04 15:42 . 2007-08-18 15:54 380,928 --a------ C:\WINDOWS.0\system32\ac3filter.acm
2008-10-04 15:36 . 2008-10-04 15:42 <DIR> d-------- C:\Program Files\XP Codec Pack
2008-10-03 23:36 . 2008-10-03 23:36 <DIR> d-------- C:\WINDOWS.0\system32\URTTEMP
2008-10-03 23:32 . 2008-10-03 23:37 <DIR> d-------- C:\myself yourself
2008-10-03 20:13 . 2008-10-03 20:13 30,413,568 --a------ C:\WindowsXPMediaCenter2005-KB900325-usa.exe
2008-10-03 19:13 . 2008-10-03 19:13 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\FLEXnet
2008-10-03 18:39 . 2008-10-03 18:39 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-10-03 17:39 . 2008-10-03 17:39 <DIR> d-------- C:\UltraDVDCreator
2008-10-03 17:34 . 2008-10-03 17:35 13,560 --ahs---- C:\WINDOWS.0\system32\KGyGaAvL.sys
2008-10-03 16:53 . 2008-10-23 23:45 116 --a------ C:\WINDOWS.0\NeroDigital.ini
2008-10-03 15:56 . 2008-10-03 15:56 <DIR> d-------- C:\Documents and Settings\user.NEO\Application Data\CyberLink
2008-10-03 02:59 . 2008-10-03 13:50 16 --a------ C:\WINDOWS.0\system32\coh.cache
2008-10-03 02:42 . 2008-10-24 14:30 <DIR> d-------- C:\Program Files\Norton 360
2008-10-03 02:39 . 2008-10-10 04:23 123,952 --a------ C:\WINDOWS.0\system32\drivers\SYMEVENT.SYS
2008-10-03 02:39 . 2008-10-10 04:23 60,800 --a------ C:\WINDOWS.0\system32\S32EVNT1.DLL
2008-10-03 02:39 . 2008-10-10 04:23 10,671 --a------ C:\WINDOWS.0\system32\drivers\SYMEVENT.CAT
2008-10-03 02:39 . 2008-10-10 04:23 805 --a------ C:\WINDOWS.0\system32\drivers\SYMEVENT.INF
2008-10-03 02:27 . 2008-10-03 02:27 <DIR> d-------- C:\Documents and Settings\user.NEO\Application Data\Ashampoo
2008-10-03 02:26 . 2008-10-03 02:26 <DIR> d-------- C:\Program Files\Ashampoo
2008-10-03 02:26 . 2008-10-03 02:26 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\ashampoo
2008-10-03 02:19 . 2008-10-03 02:19 <DIR> d-------- C:\WINDOWS.0\WinAVI Video Converter 9.0
2008-10-03 02:19 . 2004-09-23 18:57 747,008 --a------ C:\WINDOWS.0\system32\Indeo4.qtx
2008-10-03 02:19 . 2002-12-20 12:40 675,328 --a------ C:\WINDOWS.0\system32\ir50_32.qtx
2008-10-03 02:18 . 2008-10-03 02:19 <DIR> d-------- C:\WINDOWS.0\system32\QuickTime
2008-10-03 02:18 . 2008-10-03 02:19 <DIR> d-------- C:\Program Files\QuickTime Alternative
2008-10-03 02:18 . 2008-10-03 02:18 <DIR> d-------- C:\Program Files\Media Player Classic
2008-10-03 02:18 . 2004-10-27 13:01 360,504 --a------ C:\WINDOWS.0\system32\QTPlugin.ocx
2008-10-03 02:18 . 2004-09-23 18:57 323,072 --a------ C:\WINDOWS.0\system32\QuickTime.cpl
2008-10-03 02:18 . 2004-01-12 17:57 86,016 --a------ C:\WINDOWS.0\system32\QuickTime.ax
2008-10-03 02:18 . 2004-09-23 18:57 70,144 --a------ C:\WINDOWS.0\system32\QuickTimeCheck.ocx
2008-10-03 02:11 . 2008-10-03 02:11 <DIR> d-------- C:\WINDOWS.0\system32\XPToolsLicenseComponent
2008-10-03 02:10 . 2008-10-03 02:10 <DIR> d-------- C:\Program Files\MSConfig CleanUp
2008-10-03 02:07 . 2008-10-03 02:07 <DIR> d-------- C:\Program Files\Ultra Video Converter
2008-10-03 02:07 . 2003-09-21 07:09 794,624 --a------ C:\WINDOWS.0\system32\mpgfiltr.ax
2008-10-03 02:05 . 2008-10-03 02:06 <DIR> d-------- C:\Program Files\Ultra DVD Creator
2008-10-03 02:05 . 2005-08-31 14:12 401,408 --a------ C:\WINDOWS.0\system32\MPEGWriteFilter.dll
2008-10-03 02:05 . 2005-08-31 14:04 135,168 --a------ C:\WINDOWS.0\system32\DVDEncoder.dll
2008-10-03 02:05 . 2005-08-31 14:09 81,920 --a------ C:\WINDOWS.0\system32\MPEGFilter.dll
2008-10-03 02:03 . 2008-10-03 15:41 <DIR> d-------- C:\Program Files\DVD XCopy Deluxe
2008-10-03 02:01 . 2008-10-03 02:01 <DIR> d-------- C:\Program Files\SoftwrapLicense
2008-10-03 01:57 . 2008-10-03 01:58 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\WinZip
2008-10-03 01:52 . 2008-10-03 01:52 <DIR> d-------- C:\Program Files\zabkat
2008-10-03 01:41 . 2008-10-03 01:41 <DIR> d-------- C:\Program Files\PowerISO
2008-10-03 01:38 . 2008-10-03 01:38 <DIR> d-------- C:\Program Files\Object Desktop
2008-10-03 01:35 . 2008-10-03 01:35 7,852 --a------ C:\WINDOWS.0\system32\mcdmsg7.dll
2008-10-03 01:32 . 2008-10-03 01:32 <DIR> d-------- C:\Program Files\PowerQuest
2008-10-03 00:19 . 2007-02-16 16:43 8,704 --a------ C:\WINDOWS.0\system32\relog_ap(2).dll
2008-10-02 21:39 . 2008-10-03 00:25 <DIR> d-------- C:\Program Files\WinAVI Video Capture
2008-10-02 21:35 . 2008-10-03 00:25 <DIR> d-------- C:\Program Files\WinAVI FLV Converter
2008-10-02 21:34 . 2008-10-03 02:17 <DIR> d-------- C:\Program Files\WinAVI MP4 Converter
2008-10-02 21:32 . 2008-10-03 02:19 <DIR> d-------- C:\Program Files\WinAVI Video Converter 9.0
2008-10-02 21:11 . 2008-10-02 21:11 <DIR> d-------- C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\Acronis
2008-10-02 21:05 . 2008-10-03 00:25 <DIR> d-------- C:\Program Files\CursorXP
2008-10-02 20:45 . 2008-10-02 20:45 <DIR> d-------- C:\Documents and Settings\user.NEO\Application Data\BitDefender
2008-10-02 20:40 . 2008-10-02 20:40 <DIR> d-------- C:\Program Files\Softwin
2008-10-02 20:28 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS.0\system32\javacpl.cpl
2008-10-02 20:25 . 2008-10-02 20:25 <DIR> d-------- C:\Documents and Settings\user.NEO\Application Data\Apple Computer
2008-10-02 20:24 . 2008-10-02 20:24 <DIR> d-------- C:\Program Files\iPod
2008-10-02 20:23 . 2008-10-02 20:24 <DIR> d-------- C:\Program Files\iTunes
2008-10-02 20:22 . 2008-10-02 20:22 <DIR> d-------- C:\Program Files\Bonjour
2008-10-02 20:20 . 2008-10-02 20:20 <DIR> d-------- C:\Program Files\Codec Pack - All In 1
2008-10-02 20:20 . 2008-10-02 20:18 737,280 --a------ C:\WINDOWS.0\iun6002.exe
2008-10-02 20:19 . 2008-10-02 20:22 <DIR> d-------- C:\Program Files\QuickTime
2008-10-02 20:18 . 2008-10-02 20:23 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Apple Computer
2008-10-02 20:17 . 2008-10-02 20:17 <DIR> d-------- C:\Program Files\Apple Software Update
2008-10-02 20:15 . 2008-10-02 20:15 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-10-02 20:15 . 2008-10-02 20:15 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Apple
2008-10-02 20:03 . 2008-10-02 20:03 <DIR> d-------- C:\Program Files\AVG
2008-10-02 20:03 . 2008-10-02 20:05 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\avg8
2008-10-02 19:59 . 2008-10-02 19:59 <DIR> d-------- C:\Documents and Settings\user.NEO\Application Data\Secretmaker
2008-10-02 19:48 . 2008-10-02 20:41 <DIR> d-------- C:\Program Files\Common Files\Softwin
2008-10-02 19:46 . 2008-10-02 19:46 <DIR> d-------- C:\Documents and Settings\user.NEO\Application Data\Ahead
2008-10-02 19:43 . 2008-10-04 14:36 <DIR> d-------- C:\Program Files\CyberLink
2008-10-02 19:42 . 2008-10-02 19:42 <DIR> d-------- C:\Program Files\Nero
2008-09-30 15:33 . 2008-09-30 15:41 1,173,568 --a------ C:\WINDOWS.0\system32\SYM 2008-09-30 15_33_39.m01

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-24 07:24 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\Desktop Sidebar
2008-10-20 15:28 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\dvdcss
2008-10-07 15:00 --------- d-----w C:\Program Files\DivX
2008-10-07 14:50 --------- d-----w C:\Program Files\Elantech
2008-10-04 17:42 --------- d-----w C:\Program Files\Unlocker
2008-10-04 17:22 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\PC Suite
2008-10-04 06:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-04 06:37 --------- d-----w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\CyberLink
2008-10-03 11:04 --------- d-----w C:\Program Files\Common Files\Adobe
2008-10-02 18:01 560 ---ha-w C:\WINDOWS.0\Fonts\SWFont9.fnt
2008-10-02 18:01 560 ----a-w C:\Program Files\Global.sw
2008-10-02 17:54 --------- d-----w C:\Program Files\Opera
2008-10-02 12:28 --------- d-----w C:\Program Files\Java
2008-10-02 12:19 348,160 ----a-w C:\WINDOWS.0\system32\msvcr71.dll
2008-10-02 11:42 --------- d-----w C:\Program Files\Common Files\Ahead
2008-09-27 11:38 --------- d-----w C:\Program Files\MSBuild
2008-09-23 10:45 --------- d-----w C:\Program Files\FlashGet
2008-09-23 05:39 --------- d-----w C:\Program Files\Desktop Sidebar
2008-09-23 05:33 --------- d-----w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\PC Suite
2008-09-23 05:32 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\Nokia
2008-09-23 05:31 --------- d-----w C:\Program Files\Nokia
2008-09-23 05:29 --------- d-----w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Installations
2008-09-22 14:31 --------- d-----w C:\Program Files\themexp
2008-09-20 05:04 --------- d-----w C:\Program Files\TGTSoft
2008-09-20 04:59 --------- d-----w C:\Program Files\MIKSOFT
2008-09-20 04:42 --------- d-----w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Yahoo!
2008-09-19 14:33 --------- d-----w C:\Program Files\Winamp
2008-09-19 14:32 --------- d-----w C:\Program Files\Real
2008-09-19 14:30 28,352 ----a-w C:\WINDOWS.0\system32\drivers\MxlW2k.sys
2008-09-19 14:29 --------- d-----w C:\Program Files\Musicmatch
2008-09-19 09:49 --------- d-----w C:\Program Files\StepMania CVS
2008-09-19 09:16 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\The Labyrinth Plus! Edition
2008-09-19 09:10 21,419 ----a-w C:\WINDOWS.0\system32\drivers\AegisP.sys
2008-09-19 09:10 --------- d-----w C:\WINDOWS.0\system32\config\systemprofile\Application Data\Intel
2008-09-19 09:10 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\Intel
2008-09-19 09:10 --------- d-----w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Intel
2008-09-19 09:10 --------- d-----w C:\Documents and Settings\Administrator.NEO\Application Data\Intel
2008-09-17 12:38 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\Desktopicon
2008-09-17 09:31 --------- d-----w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Office Genuine Advantage
2008-09-17 05:52 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\Webroot
2008-09-17 05:51 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\Uniblue
2008-09-17 05:50 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\Ulead Systems
2008-09-17 05:50 --------- d-----w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Ulead Systems
2008-09-15 11:57 1,846,016 ----a-w C:\WINDOWS.0\system32\win32k.sys
2008-09-13 13:34 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\vlc
2008-09-13 08:08 --------- d-----w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Bluetooth
2008-09-11 15:56 --------- d-----w C:\Documents and Settings\user\Application Data\AVG7
2008-09-06 14:09 --------- d-----w C:\Documents and Settings\user\Application Data\dvdcss
2008-09-05 13:38 --------- d-----w C:\Documents and Settings\Administrator\Application Data\vlc
2008-09-05 13:35 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Webroot
2008-08-31 13:57 --------- d-----w C:\Documents and Settings\user\Application Data\LimeWire
2008-08-28 10:04 333,056 ----a-w C:\WINDOWS.0\system32\drivers\srv.sys
2008-08-20 05:33 667,648 ----a-w C:\WINDOWS.0\system32\wininet.dll
2008-08-14 09:58 2,136,064 ----a-w C:\WINDOWS.0\system32\ntoskrnl.exe
2008-08-14 09:22 2,015,744 ----a-w C:\WINDOWS.0\system32\ntkrnlpa.exe
2008-08-05 07:40 5,294 ----a-w C:\Documents and Settings\user\Application Data\wklnhst.dat
2006-05-06 16:42 7,260,160 ----a-w C:\Program Files\mozilla firefox\plugins\libvlc.dll
2007-05-24 15:25 108 --sha-r C:\WINDOWS.0\neoqaz2.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SIDEBAR "= "C:\Program Files\Desktop Sidebar\dsidebar.exe" [2006-07-09 1777664]
"ctfmon.exe "= "C:\WINDOWS.0\system32\ctfmon.exe" [2006-03-15 15360]
"Yahoo! Pager "= "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-11-06 3810544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KTPWare "= "C:\Program Files\Elantech\ktp.exe" [2005-10-28 512000]
"IntelZeroConfig "= "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-07-03 802816]
"IntelWireless "= "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-07-02 700416]
"BisonTrayIcon "= "C:\WINDOWS.0\BisonCam\BisonTrayIcon.exe" [2005-09-05 45056]
"ccApp "= "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 115816]
"High Definition Audio Property Page Shortcut "= "HDAShCut.exe" [2005-01-07 C:\WINDOWS.0\system32\HdAShCut.exe]
"RTHDCPL "= "RTHDCPL.EXE" [2006-01-12 C:\WINDOWS.0\RTHDCPL.exe]
"CHotkey "= "mHotkey.exe" [2001-12-26 C:\WINDOWS.0\mHotkey.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync "= "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle "= C:\WINDOWS.0\Resources\Themes\Royale\Royale.msstyles
"InstallTheme "= C:\WINDOWS.0\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter "= ac3filter.acm
"msacm.avis "= ff_acm.acm
"vidc.ffds "= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users.WINDOWS.0\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS.0\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Start Menu^Programs^Startup^BlueSoleil.lnk]
path=C:\Documents and Settings\All Users.WINDOWS.0\Start Menu\Programs\Startup\BlueSoleil.lnk
backup=C:\WINDOWS.0\pss\BlueSoleil.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk]
path=C:\Documents and Settings\All Users.WINDOWS.0\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk
backup=C:\WINDOWS.0\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users.WINDOWS.0\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS.0\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^user.NEO^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=C:\Documents and Settings\user.NEO\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=C:\WINDOWS.0\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
-r------- 2007-11-17 11:20 91432 C:\Program Files\CyberLink\Shared files\brs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2005-12-16 12:57 94208 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BisonTrayIcon]
--a------ 2005-09-05 16:51 45056 C:\WINDOWS.0\BisonCam\BisonTrayIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-02-19 13:10 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--------- 2007-10-11 12:06 62760 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
--a------ 2004-12-10 19:44 11776 C:\Program Files\Musicmatch\Musicmatch Jukebox\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
--a------ 2004-12-10 19:44 110592 C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-08-04 01:06 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS.0\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2007-06-18 15:10 271360 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 2008-01-20 15:05 217088 C:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-31 23:13 385024 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2007-10-28 09:35 72736 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
--a------ 2006-05-25 02:31 1372160 C:\Program Files\TGTSoft\StyleXP\StyleXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-12-14 03:42 144784 C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-10-02 20:19 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 2008-05-02 12:15 15872 C:\Program Files\Unlocker\UnlockerAssistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2003-12-13 08:50 33792 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-11-06 19:51 3810544 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
-ra------ 2005-11-10 03:44 557056 C:\WINDOWS.0\sm56hlpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"C:\\Program Files\\Messenger\\msmsgs.exe "=
"C:\\ECGR-RO server\\Raine\\Raine.exe "=
"C:\\ECGR-RO server\\Janine\\Janine.exe "=
"C:\\ECGR-RO server\\Cheska\\Cheska.exe "=
"C:\\ECGR-RO server\\Ashe\\Ashe.exe "=
"C:\\ECGR-RO server\\Ashe\\Ashe_Online.exe "=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"C:\\Program Files\\iTunes\\iTunes.exe "=
"C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe "=

R0 pavboot;pavboot;C:\WINDOWS.0\system32\drivers\pavboot.sys [2008-06-19 28544]
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\000.fcl [2007-11-03 00:12 41456]
R3 Ktp;Elantech Touchpad;C:\WINDOWS.0\system32\DRIVERS\Ktp.sys [2005-11-29 27520]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{42e2cb2a-8431-11dd-9496-00030d000001}]
\Shell\AutoRun\command - F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\SYS32.exe
\Shell\open\command - F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\SYS32.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4f9ceaa4-8167-11dd-948a-0013025fcab0}]
\Shell\AutoRun\command - 39lpji.com
\Shell\explore\Command - 39lpji.com
\Shell\open\Command - 39lpji.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dec31482-857b-11dd-94a0-00030d000001}]
\Shell\AutoRun\command - E:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\SYS32.exe
\Shell\open\command - E:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\SYS32.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
*Newly Created Service* - PROCEXP90

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4FCB-11CF-AAX5-21CX1C642121}]
C:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\SYS32.exe
.
Contents of the 'Scheduled Tasks' folder

2008-10-10 C:\WINDOWS.0\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-Norton Ghost 14 - C:\Program Files\Norton Ghost\Agent\VProTray.exe

.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\user.NEO\Application Data\Mozilla\Firefox\Profiles\2vrb27np.default\
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npvlc.dll
FF -: plugin - C:\Program Files\QuickTime Alternative\Plugins\npqtplugin.dll
FF -: plugin - C:\Program Files\QuickTime Alternative\Plugins\npqtplugin2.dll
FF -: plugin - C:\Program Files\QuickTime Alternative\Plugins\npqtplugin3.dll
FF -: plugin - C:\Program Files\QuickTime Alternative\Plugins\npqtplugin4.dll
FF -: plugin - C:\Program Files\QuickTime Alternative\Plugins\npqtplugin5.dll
FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-24 14:54:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\mchInjDrv]
"ImagePath "= "\??\C:\DOCUME~1\user.NEO\LOCALS~1\Temp\mc21.tmp "

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath "= "\??\C:\Program Files\CyberLink\PowerDVD\000.fcl "
.
Completion time: 2008-10-24 15:04:05
ComboFix-quarantined-files.txt 2008-10-24 07:03:34

Pre-Run: 8,031,059,968 bytes free
Post-Run: 8,126,439,424 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS.0
[operating systems]
C:\CMDCONS\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS.0= "Windows XP Media Center Edition" /noexecute=optin /fastdetect

367 --- E O F --- 2008-10-24 06:42:43

Geri · 2008/10/26

Hi
OK please do the following.

Highlight and copy the contents of the code box below and paste it into a blank Notepad, then save it to your desktop as;

Filename: CFScript.txt
Save As Type: All Files (*.*)

Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.
Click here to see how to use CFScript.txt
Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.

Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
Code:
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{42e2cb2a-8431-11dd-9496-00030d000001}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4f9ceaa4-8167-11dd-948a-0013025fcab0}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dec31482-857b-11dd-94a0-00030d000001}]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4FCB-11CF-AAX5-21CX1C642121}] 
Please download Flash_Disinfector.exe by sUBs and save it to your desktop:

http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe

NOTE: In the event you already have Flash_Disinfector, this is a new version that I need you to download.

Hold down the Shift key and insert your flash drive. (USB thumb drives)
It is important to hold the shift key while plugging in flash drive so the virus does not run and re-infect system.

Double-click Flash_Disinfector.exe to run it.
Follow any prompts that may appear.
Your desktop will vanish for a while, and then reappear. This is normal.
Wait until the program has finished scanning, then please exit the program.

Repeat this step if you have more than one flash drives.

Please post the Combofix log.

Thanks
Geri

clubECGR · 2008/10/26

here's the new log for ComboFix. The correct time is October 27, 2008 10am onwards. the clock battery might be destroyed or whatever

ComboFix 08-10-24.02 - user 2008-10-24 15:00:41.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.141 [GMT 8:00]
Running from: C:\Documents and Settings\user.NEO\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\user.NEO\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS.0\IE4 Error Log.txt

.
((((((((((((((((((((((((( Files Created from 2008-09-24 to 2008-10-24 )))))))))))))))))))))))))))))))
.

2008-10-24 15:05 . 2008-10-24 15:05 <DIR> d-------- C:\WINDOWS.0\Sun
2008-10-24 15:05 . 2005-01-28 13:44 5,525,504 --a------ C:\WINDOWS.0\system32\setb0.tmp
2008-10-24 14:51 . 2008-10-04 01:41 6,066,176 -----c--- C:\WINDOWS.0\system32\dllcache\ieframe.dll
2008-10-24 14:51 . 2007-04-17 17:32 2,455,488 -----c--- C:\WINDOWS.0\system32\dllcache\ieapfltr.dat
2008-10-24 14:51 . 2007-03-08 13:10 991,232 -----c--- C:\WINDOWS.0\system32\dllcache\ieframe.dll.mui
2008-10-24 14:51 . 2008-08-26 15:24 459,264 -----c--- C:\WINDOWS.0\system32\dllcache\msfeeds.dll
2008-10-24 14:51 . 2008-08-26 15:24 383,488 -----c--- C:\WINDOWS.0\system32\dllcache\ieapfltr.dll
2008-10-24 14:51 . 2008-08-26 15:24 267,776 -----c--- C:\WINDOWS.0\system32\dllcache\iertutil.dll
2008-10-24 14:51 . 2008-08-26 15:24 63,488 -----c--- C:\WINDOWS.0\system32\dllcache\icardie.dll
2008-10-24 14:51 . 2008-08-26 15:24 52,224 -----c--- C:\WINDOWS.0\system32\dllcache\msfeedsbs.dll
2008-10-24 14:51 . 2008-08-25 16:38 13,824 -----c--- C:\WINDOWS.0\system32\dllcache\ieudinit.exe
2008-10-24 14:48 . 2008-10-24 14:51 <DIR> d-------- C:\rsit
2008-10-24 14:48 . 2008-10-24 14:51 <DIR> d-------- C:\Program Files\trend micro
2008-10-24 14:47 . 2008-10-24 15:16 <DIR> d-------- C:\WINDOWS.0\system32\CatRoot_bak
2008-10-24 14:46 . 2008-10-24 14:50 817 --a------ C:\WINDOWS.0\system32\spupdsvc.inf
2008-10-24 14:43 . 2008-10-24 14:43 <DIR> d--hs---- C:\found.000
2008-10-24 01:04 . 2008-08-14 18:00 2,180,352 -----c--- C:\WINDOWS.0\system32\dllcache\ntoskrnl.exe
2008-10-24 01:04 . 2008-08-14 17:58 2,136,064 -----c--- C:\WINDOWS.0\system32\dllcache\ntkrnlmp.exe
2008-10-24 01:03 . 2008-08-14 17:22 2,057,728 -----c--- C:\WINDOWS.0\system32\dllcache\ntkrnlpa.exe
2008-10-24 01:03 . 2008-08-14 17:22 2,015,744 -----c--- C:\WINDOWS.0\system32\dllcache\ntkrpamp.exe
2008-10-23 22:57 . 2008-06-13 21:10 272,128 --------- C:\WINDOWS.0\system32\drivers\bthport.sys
2008-10-23 22:57 . 2008-06-13 21:10 272,128 -----c--- C:\WINDOWS.0\system32\dllcache\bthport.sys
2008-10-22 21:54 . 2008-10-22 22:00 24,265,736 --a------ C:\dotnetfx.exe
2008-10-22 21:54 . 2008-10-22 21:57 10,703,680 --a------ C:\NDP1.1sp1-KB867460-X86.exe
2008-10-22 21:46 . 2008-10-22 21:21 <DIR> d-a------ C:\Documents and Settings\All Users.WINDOWS.0\Application Data\TEMP
2008-10-22 21:44 . 2008-10-22 21:44 305,705 --a------ C:\RSIT.exe
2008-10-22 21:39 . 2002-12-29 01:14 81,920 --a------ C:\WINDOWS.0\system32\Startup.cpl
2008-10-22 21:39 . 2005-06-29 07:43 46,592 --------- C:\WINDOWS.0\system32\drivers\irbus.sys
2008-10-22 21:39 . 2005-06-29 07:43 19,200 --------- C:\WINDOWS.0\system32\drivers\hidir.sys
2008-10-22 21:38 . 2008-10-22 21:38 58,671 --a------ C:\startupcpl.zip
2008-10-22 21:35 . 2008-10-22 21:37 2,351,120 --a------ C:\mbam-setup.exe
2008-10-22 21:34 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS.0\system32\drivers\pavboot.sys
2008-10-22 21:33 . 2008-10-22 21:33 <DIR> d---s---- C:\Documents and Settings\user.NEO\UserData
2008-10-22 21:32 . 2008-10-22 21:32 <DIR> d-------- C:\Program Files\Panda Security
2008-10-22 21:23 . 2008-10-22 21:56 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-22 21:23 . 2008-10-22 21:23 <DIR> d-------- C:\Documents and Settings\user.NEO\Application Data\Malwarebytes
2008-10-22 21:23 . 2008-10-22 21:23 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Malwarebytes
2008-10-22 21:23 . 2008-10-22 16:10 38,496 --a------ C:\WINDOWS.0\system32\drivers\mbamswissarmy.sys
2008-10-22 21:23 . 2008-10-22 16:10 15,504 --a------ C:\WINDOWS.0\system32\drivers\mbam.sys
2008-10-22 21:11 . 2008-10-22 21:11 <DIR> d-------- C:\WINDOWS.0\BisonCam
2008-10-22 21:11 . 2005-12-19 17:49 649,088 --a------ C:\WINDOWS.0\system32\drivers\BisonCam.sys
2008-10-22 21:11 . 2005-01-14 13:47 180,224 --a------ C:\WINDOWS.0\system\StillDrv.dll
2008-10-22 21:11 . 2005-09-30 14:41 126,976 --a------ C:\WINDOWS.0\system\BisonCam.dll
2008-10-22 21:11 . 2005-09-30 14:41 90,112 --a------ C:\WINDOWS.0\system\BisonVfw.dll
2008-10-22 21:11 . 2005-11-17 22:57 73,846 --a------ C:\WINDOWS.0\system32\BisonRem.dll
2008-10-22 21:11 . 2003-09-22 13:49 15,190 --a------ C:\WINDOWS.0\M2000Twn.ini
2008-10-22 21:11 . 2003-09-22 14:36 13,448 --a------ C:\WINDOWS.0\M2000Twn.src
2008-10-22 21:11 . 2005-12-05 12:08 2,264 --a------ C:\WINDOWS.0\system\S20H0220.csr
2008-10-22 21:11 . 2005-12-05 12:08 2,264 --a------ C:\WINDOWS.0\system\S20F0220.csr
2008-10-21 17:10 . 2008-07-30 17:42 23,888 --a------ C:\WINDOWS.0\system32\drivers\COH_Mon.sys
2008-10-21 17:10 . 2008-07-30 17:28 10,537 --a------ C:\WINDOWS.0\system32\drivers\COH_Mon.cat
2008-10-21 17:10 . 2008-07-30 17:28 706 --a------ C:\WINDOWS.0\system32\drivers\COH_Mon.inf
2008-10-21 17:08 . 2008-10-04 10:22 60,273 --a------ C:\WINDOWS.0\system32\pthreadGC2.dll
2008-10-21 17:08 . 2008-10-10 18:25 7,680 --a------ C:\WINDOWS.0\system32\ff_vfw.dll
2008-10-21 17:08 . 2008-10-10 18:25 6,144 --a------ C:\WINDOWS.0\system32\ff_acm.acm
2008-10-21 17:08 . 2008-10-04 10:22 547 --a------ C:\WINDOWS.0\system32\ff_vfw.dll.manifest
2008-10-21 17:06 . 2008-10-21 17:12 <DIR> d-------- C:\Program Files\Combined Community Codec Pack
2008-10-10 04:20 . 2008-10-10 04:20 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-10 04:05 . 2008-10-10 04:05 33 --a------ C:\WINDOWS.0\system32\7c11d680
2008-10-05 20:47 . 2008-10-05 20:47 <DIR> d-------- C:\Myself Yourself Image Song
2008-10-04 15:42 . 2007-08-18 15:54 380,928 --a------ C:\WINDOWS.0\system32\ac3filter.acm
2008-10-04 15:36 . 2008-10-04 15:42 <DIR> d-------- C:\Program Files\XP Codec Pack
2008-10-03 23:36 . 2008-10-03 23:36 <DIR> d-------- C:\WINDOWS.0\system32\URTTEMP
2008-10-03 23:32 . 2008-10-03 23:37 <DIR> d-------- C:\myself yourself
2008-10-03 20:13 . 2008-10-03 20:13 30,413,568 --a------ C:\WindowsXPMediaCenter2005-KB900325-usa.exe
2008-10-03 19:13 . 2008-10-03 19:13 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\FLEXnet
2008-10-03 18:39 . 2008-10-03 18:39 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-10-03 17:39 . 2008-10-03 17:39 <DIR> d-------- C:\UltraDVDCreator
2008-10-03 17:34 . 2008-10-03 17:35 13,560 --ahs---- C:\WINDOWS.0\system32\KGyGaAvL.sys
2008-10-03 16:53 . 2008-10-23 23:45 116 --a------ C:\WINDOWS.0\NeroDigital.ini
2008-10-03 15:56 . 2008-10-03 15:56 <DIR> d-------- C:\Documents and Settings\user.NEO\Application Data\CyberLink
2008-10-03 02:59 . 2008-10-03 13:50 16 --a------ C:\WINDOWS.0\system32\coh.cache
2008-10-03 02:42 . 2008-10-24 14:37 <DIR> d-------- C:\Program Files\Norton 360
2008-10-03 02:39 . 2008-10-10 04:23 123,952 --a------ C:\WINDOWS.0\system32\drivers\SYMEVENT.SYS
2008-10-03 02:39 . 2008-10-10 04:23 60,800 --a------ C:\WINDOWS.0\system32\S32EVNT1.DLL
2008-10-03 02:39 . 2008-10-10 04:23 10,671 --a------ C:\WINDOWS.0\system32\drivers\SYMEVENT.CAT
2008-10-03 02:39 . 2008-10-10 04:23 805 --a------ C:\WINDOWS.0\system32\drivers\SYMEVENT.INF
2008-10-03 02:27 . 2008-10-03 02:27 <DIR> d-------- C:\Documents and Settings\user.NEO\Application Data\Ashampoo
2008-10-03 02:26 . 2008-10-03 02:26 <DIR> d-------- C:\Program Files\Ashampoo
2008-10-03 02:26 . 2008-10-03 02:26 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\ashampoo
2008-10-03 02:19 . 2008-10-03 02:19 <DIR> d-------- C:\WINDOWS.0\WinAVI Video Converter 9.0
2008-10-03 02:19 . 2004-09-23 18:57 747,008 --a------ C:\WINDOWS.0\system32\Indeo4.qtx
2008-10-03 02:19 . 2002-12-20 12:40 675,328 --a------ C:\WINDOWS.0\system32\ir50_32.qtx
2008-10-03 02:18 . 2008-10-03 02:19 <DIR> d-------- C:\WINDOWS.0\system32\QuickTime
2008-10-03 02:18 . 2008-10-03 02:19 <DIR> d-------- C:\Program Files\QuickTime Alternative
2008-10-03 02:18 . 2008-10-03 02:18 <DIR> d-------- C:\Program Files\Media Player Classic
2008-10-03 02:18 . 2004-10-27 13:01 360,504 --a------ C:\WINDOWS.0\system32\QTPlugin.ocx
2008-10-03 02:18 . 2004-09-23 18:57 323,072 --a------ C:\WINDOWS.0\system32\QuickTime.cpl
2008-10-03 02:18 . 2004-01-12 17:57 86,016 --a------ C:\WINDOWS.0\system32\QuickTime.ax
2008-10-03 02:18 . 2004-09-23 18:57 70,144 --a------ C:\WINDOWS.0\system32\QuickTimeCheck.ocx
2008-10-03 02:11 . 2008-10-03 02:11 <DIR> d-------- C:\WINDOWS.0\system32\XPToolsLicenseComponent
2008-10-03 02:10 . 2008-10-03 02:10 <DIR> d-------- C:\Program Files\MSConfig CleanUp
2008-10-03 02:07 . 2008-10-03 02:07 <DIR> d-------- C:\Program Files\Ultra Video Converter
2008-10-03 02:07 . 2003-09-21 07:09 794,624 --a------ C:\WINDOWS.0\system32\mpgfiltr.ax
2008-10-03 02:05 . 2008-10-03 02:06 <DIR> d-------- C:\Program Files\Ultra DVD Creator
2008-10-03 02:05 . 2005-08-31 14:12 401,408 --a------ C:\WINDOWS.0\system32\MPEGWriteFilter.dll
2008-10-03 02:05 . 2005-08-31 14:04 135,168 --a------ C:\WINDOWS.0\system32\DVDEncoder.dll
2008-10-03 02:05 . 2005-08-31 14:09 81,920 --a------ C:\WINDOWS.0\system32\MPEGFilter.dll
2008-10-03 02:03 . 2008-10-03 15:41 <DIR> d-------- C:\Program Files\DVD XCopy Deluxe
2008-10-03 02:01 . 2008-10-03 02:01 <DIR> d-------- C:\Program Files\SoftwrapLicense
2008-10-03 01:57 . 2008-10-03 01:58 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\WinZip
2008-10-03 01:52 . 2008-10-03 01:52 <DIR> d-------- C:\Program Files\zabkat
2008-10-03 01:41 . 2008-10-03 01:41 <DIR> d-------- C:\Program Files\PowerISO
2008-10-03 01:38 . 2008-10-03 01:38 <DIR> d-------- C:\Program Files\Object Desktop
2008-10-03 01:35 . 2008-10-03 01:35 7,852 --a------ C:\WINDOWS.0\system32\mcdmsg7.dll
2008-10-03 01:32 . 2008-10-03 01:32 <DIR> d-------- C:\Program Files\PowerQuest
2008-10-03 00:19 . 2007-02-16 16:43 8,704 --a------ C:\WINDOWS.0\system32\relog_ap(2).dll
2008-10-02 21:39 . 2008-10-03 00:25 <DIR> d-------- C:\Program Files\WinAVI Video Capture
2008-10-02 21:35 . 2008-10-03 00:25 <DIR> d-------- C:\Program Files\WinAVI FLV Converter
2008-10-02 21:34 . 2008-10-03 02:17 <DIR> d-------- C:\Program Files\WinAVI MP4 Converter
2008-10-02 21:32 . 2008-10-03 02:19 <DIR> d-------- C:\Program Files\WinAVI Video Converter 9.0
2008-10-02 21:11 . 2008-10-02 21:11 <DIR> d-------- C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\Acronis
2008-10-02 21:05 . 2008-10-03 00:25 <DIR> d-------- C:\Program Files\CursorXP
2008-10-02 20:45 . 2008-10-02 20:45 <DIR> d-------- C:\Documents and Settings\user.NEO\Application Data\BitDefender
2008-10-02 20:40 . 2008-10-02 20:40 <DIR> d-------- C:\Program Files\Softwin
2008-10-02 20:28 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS.0\system32\javacpl.cpl
2008-10-02 20:25 . 2008-10-02 20:25 <DIR> d-------- C:\Documents and Settings\user.NEO\Application Data\Apple Computer
2008-10-02 20:24 . 2008-10-02 20:24 <DIR> d-------- C:\Program Files\iPod
2008-10-02 20:23 . 2008-10-02 20:24 <DIR> d-------- C:\Program Files\iTunes
2008-10-02 20:22 . 2008-10-02 20:22 <DIR> d-------- C:\Program Files\Bonjour
2008-10-02 20:20 . 2008-10-02 20:20 <DIR> d-------- C:\Program Files\Codec Pack - All In 1
2008-10-02 20:20 . 2008-10-02 20:18 737,280 --a------ C:\WINDOWS.0\iun6002.exe
2008-10-02 20:19 . 2008-10-02 20:22 <DIR> d-------- C:\Program Files\QuickTime
2008-10-02 20:18 . 2008-10-02 20:23 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Apple Computer
2008-10-02 20:17 . 2008-10-02 20:17 <DIR> d-------- C:\Program Files\Apple Software Update

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-24 06:53 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\Desktop Sidebar
2008-10-20 15:28 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\dvdcss
2008-10-07 15:00 --------- d-----w C:\Program Files\DivX
2008-10-07 14:50 --------- d-----w C:\Program Files\Elantech
2008-10-04 17:42 --------- d-----w C:\Program Files\Unlocker
2008-10-04 17:22 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\PC Suite
2008-10-04 06:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-04 06:37 --------- d-----w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\CyberLink
2008-10-03 11:04 --------- d-----w C:\Program Files\Common Files\Adobe
2008-10-02 18:01 560 ---ha-w C:\WINDOWS.0\Fonts\SWFont9.fnt
2008-10-02 18:01 560 ----a-w C:\Program Files\Global.sw
2008-10-02 17:54 --------- d-----w C:\Program Files\Opera
2008-10-02 12:28 --------- d-----w C:\Program Files\Java
2008-10-02 11:42 --------- d-----w C:\Program Files\Common Files\Ahead
2008-09-27 11:38 --------- d-----w C:\Program Files\MSBuild
2008-09-23 10:45 --------- d-----w C:\Program Files\FlashGet
2008-09-23 05:39 --------- d-----w C:\Program Files\Desktop Sidebar
2008-09-23 05:33 --------- d-----w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\PC Suite
2008-09-23 05:32 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\Nokia
2008-09-23 05:31 --------- d-----w C:\Program Files\Nokia
2008-09-23 05:29 --------- d-----w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Installations
2008-09-22 14:31 --------- d-----w C:\Program Files\themexp
2008-09-20 05:04 --------- d-----w C:\Program Files\TGTSoft
2008-09-20 04:59 --------- d-----w C:\Program Files\MIKSOFT
2008-09-20 04:42 --------- d-----w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Yahoo!
2008-09-19 14:33 --------- d-----w C:\Program Files\Winamp
2008-09-19 14:32 --------- d-----w C:\Program Files\Real
2008-09-19 14:30 28,352 ----a-w C:\WINDOWS.0\system32\drivers\MxlW2k.sys
2008-09-19 14:29 --------- d-----w C:\Program Files\Musicmatch
2008-09-19 09:49 --------- d-----w C:\Program Files\StepMania CVS
2008-09-19 09:16 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\The Labyrinth Plus! Edition
2008-09-19 09:10 21,419 ----a-w C:\WINDOWS.0\system32\drivers\AegisP.sys
2008-09-19 09:10 --------- d-----w C:\WINDOWS.0\system32\config\systemprofile\Application Data\Intel
2008-09-19 09:10 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\Intel
2008-09-19 09:10 --------- d-----w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Intel
2008-09-19 09:10 --------- d-----w C:\Documents and Settings\Administrator.NEO\Application Data\Intel
2008-09-17 12:38 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\Desktopicon
2008-09-17 09:31 --------- d-----w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Office Genuine Advantage
2008-09-17 05:52 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\Webroot
2008-09-17 05:51 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\Uniblue
2008-09-17 05:50 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\Ulead Systems
2008-09-17 05:50 --------- d-----w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Ulead Systems
2008-09-13 13:34 --------- d-----w C:\Documents and Settings\user.NEO\Application Data\vlc
2008-09-13 08:08 --------- d-----w C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Bluetooth
2008-09-05 13:38 --------- d-----w C:\Documents and Settings\Administrator\Application Data\vlc
2008-09-05 13:35 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Webroot
2008-08-28 10:04 333,056 ----a-w C:\WINDOWS.0\system32\drivers\srv.sys
2006-05-06 16:42 7,260,160 ----a-w C:\Program Files\mozilla firefox\plugins\libvlc.dll
2007-05-24 15:25 108 --sha-r C:\WINDOWS.0\neoqaz2.dll
.

((((((((((((((((((((((((((((( snapshot@2008-10-24_15.03.09.35 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-03-15 12:00:00 61,440 -c--a-w C:\WINDOWS.0\ie7\admparse.dll
+ 2006-03-15 12:00:00 99,840 -c--a-w C:\WINDOWS.0\ie7\advpack.dll
+ 2006-03-15 12:00:00 35,328 -c--a-w C:\WINDOWS.0\ie7\corpol.dll
+ 2006-06-03 11:40:49 33,792 -c--a-w C:\WINDOWS.0\ie7\custsat.dll
+ 2008-08-20 05:33:18 357,888 -c--a-w C:\WINDOWS.0\ie7\dxtmsft.dll
+ 2008-08-20 05:33:18 205,312 -c--a-w C:\WINDOWS.0\ie7\dxtrans.dll
+ 2008-08-20 05:33:18 55,808 -c--a-w C:\WINDOWS.0\ie7\extmgr.dll
+ 2006-03-15 12:00:00 38,912 -c--a-w C:\WINDOWS.0\ie7\hmmapi.dll
+ 2006-03-15 12:00:00 34,304 -c--a-w C:\WINDOWS.0\ie7\ie4uinit.exe
+ 2006-03-15 12:00:00 139,264 -c--a-w C:\WINDOWS.0\ie7\ieakeng.dll
+ 2006-03-15 12:00:00 216,576 -c--a-w C:\WINDOWS.0\ie7\ieaksie.dll
+ 2006-03-15 12:00:00 221,184 -c--a-w C:\WINDOWS.0\ie7\ieakui.dll
+ 2006-03-15 12:00:00 323,584 -c--a-w C:\WINDOWS.0\ie7\iedkcs32.dll
+ 2008-08-19 09:38:57 18,432 -c--a-w C:\WINDOWS.0\ie7\iedw.exe
+ 2006-03-15 12:00:00 81,920 -c--a-w C:\WINDOWS.0\ie7\ieencode.dll
+ 2008-08-20 05:33:18 251,904 -c--a-w C:\WINDOWS.0\ie7\iepeers.dll
+ 2006-11-07 13:03:36 287,744 -c--a-w C:\WINDOWS.0\ie7\ieproxy.dll
+ 2006-03-15 12:00:00 48,640 -c--a-w C:\WINDOWS.0\ie7\iernonce.dll
+ 2006-03-15 12:00:00 62,976 -c--a-w C:\WINDOWS.0\ie7\iesetup.dll
+ 2006-03-15 12:00:00 93,184 -c--a-w C:\WINDOWS.0\ie7\iexplore.exe
+ 2006-03-15 12:00:00 35,840 -c--a-w C:\WINDOWS.0\ie7\imgutil.dll
+ 2008-08-20 05:33:18 96,256 -c--a-w C:\WINDOWS.0\ie7\inseng.dll
+ 2007-12-18 14:40:58 450,560 -c--a-w C:\WINDOWS.0\ie7\jscript.dll
+ 2008-08-20 05:33:19 16,384 -c--a-w C:\WINDOWS.0\ie7\jsproxy.dll
+ 2006-03-15 12:00:00 22,016 -c--a-w C:\WINDOWS.0\ie7\licmgr10.dll
+ 2006-03-15 12:00:00 29,184 -c--a-w C:\WINDOWS.0\ie7\mshta.exe
+ 2008-08-20 05:33:20 3,067,392 -c--a-w C:\WINDOWS.0\ie7\mshtml.dll
+ 2008-08-20 05:33:19 449,024 -c--a-w C:\WINDOWS.0\ie7\mshtmled.dll
+ 2006-03-15 12:00:00 56,832 -c--a-w C:\WINDOWS.0\ie7\mshtmler.dll
+ 2006-03-15 12:00:00 146,432 -c--a-w C:\WINDOWS.0\ie7\msls31.dll
+ 2008-08-20 05:33:18 146,432 -c--a-w C:\WINDOWS.0\ie7\msrating.dll
+ 2008-08-20 05:33:18 532,480 -c--a-w C:\WINDOWS.0\ie7\mstime.dll
+ 2006-03-15 12:00:00 96,256 -c--a-w C:\WINDOWS.0\ie7\occache.dll
+ 2008-08-20 05:33:18 39,424 -c--a-w C:\WINDOWS.0\ie7\pngfilt.dll
+ 2007-08-13 10:54:42 32,960 -c--a-w C:\WINDOWS.0\ie7\spuninst\iecustom.dll
+ 2007-08-13 10:52:06 66,048 -c--a-w C:\WINDOWS.0\ie7\spuninst\ieResetIcons.exe
+ 2006-09-06 09:43:16 213,216 -c--a-w C:\WINDOWS.0\ie7\spuninst\spuninst.exe
+ 2006-09-06 09:43:18 371,424 -c--a-w C:\WINDOWS.0\ie7\spuninst\updspapi.dll
+ 2006-03-15 12:00:00 37,888 -c--a-w C:\WINDOWS.0\ie7\url.dll
+ 2008-08-20 05:33:19 619,008 -c--a-w C:\WINDOWS.0\ie7\urlmon.dll
+ 2007-12-18 14:40:58 417,792 -c--a-w C:\WINDOWS.0\ie7\vbscript.dll
+ 2006-03-15 12:00:00 848,384 -c--a-w C:\WINDOWS.0\ie7\vgx.dll
+ 2006-03-15 12:00:00 276,480 -c--a-w C:\WINDOWS.0\ie7\webcheck.dll
+ 2008-08-20 05:33:19 667,648 -c--a-w C:\WINDOWS.0\ie7\wininet.dll
+ 2007-08-13 10:39:00 123,904 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\advpack.dll
+ 2007-08-13 10:35:46 346,624 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\dxtmsft.dll
+ 2007-08-13 10:35:38 214,528 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\dxtrans.dll
+ 2007-08-13 10:54:10 131,584 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\extmgr.dll
+ 2007-08-13 10:36:26 61,952 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\icardie.dll
+ 2007-08-13 10:39:06 54,784 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\ie4uinit.exe
+ 2007-08-13 10:39:26 152,064 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\ieakeng.dll
+ 2007-08-13 10:39:54 229,376 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\ieaksie.dll
+ 2007-08-13 09:56:54 161,792 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\ieakui.dll
+ 2007-02-12 08:10:12 2,451,312 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\ieapfltr.dat
+ 2007-07-11 04:27:48 383,488 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\ieapfltr.dll
+ 2007-08-13 10:39:50 382,976 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\iedkcs32.dll
+ 2007-08-13 10:54:10 6,049,280 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\ieframe.dll
+ 2007-08-13 10:39:10 43,008 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\iernonce.dll
+ 2007-08-13 10:34:04 266,752 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\iertutil.dll
+ 2007-08-13 10:39:10 13,312 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\ieudinit.exe
+ 2007-08-13 10:43:56 622,080 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\iexplore.exe
+ 2007-08-13 10:54:10 27,136 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\jsproxy.dll
+ 2007-08-13 10:54:10 458,752 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\msfeeds.dll
+ 2007-08-13 10:54:10 50,688 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\msfeedsbs.dll
+ 2007-08-13 10:54:12 3,578,368 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\mshtml.dll
+ 2007-08-13 10:54:10 475,648 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\mshtmled.dll
+ 2007-08-13 10:44:26 192,000 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\msrating.dll
+ 2007-08-13 10:54:10 670,720 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\mstime.dll
+ 2007-08-13 10:44:06 101,376 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\occache.dll
+ 2007-08-13 10:36:12 44,544 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\pngfilt.dll
+ 2007-03-06 01:22:39 213,216 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\spuninst\updspapi.dll
+ 2007-08-13 10:44:30 105,984 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\url.dll
+ 2007-08-13 10:54:10 1,162,240 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\urlmon.dll
+ 2007-08-13 10:54:10 231,424 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\webcheck.dll
+ 2007-08-13 10:54:10 818,688 -c----w C:\WINDOWS.0\ie7updates\KB953838-IE7\wininet.dll
+ 2008-06-23 16:57:27 124,928 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\advpack.dll
+ 2008-06-23 16:57:27 124,928 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\advpack.dll.000
+ 2008-06-23 16:57:27 347,136 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\dxtmsft.dll
+ 2008-06-23 16:57:27 214,528 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\dxtrans.dll
+ 2008-06-23 16:57:27 133,120 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\extmgr.dll
+ 2008-06-23 16:57:28 63,488 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\icardie.dll
+ 2008-06-23 16:57:28 63,488 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\icardie.dll.000
+ 2008-06-23 09:20:25 70,656 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\ie4uinit.exe
+ 2008-06-23 16:57:29 153,088 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\ieakeng.dll
+ 2008-06-23 16:57:29 230,400 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\ieaksie.dll
+ 2008-06-21 05:23:54 161,792 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\ieakui.dll
+ 2007-04-17 09:32:38 2,455,488 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\ieapfltr.dat
+ 2008-06-23 16:57:29 383,488 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\ieapfltr.dll
+ 2008-06-23 16:57:29 383,488 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\ieapfltr.dll.000
+ 2008-06-23 16:57:29 384,512 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\iedkcs32.dll
+ 2008-06-23 16:57:33 6,066,176 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\ieframe.dll
+ 2008-06-23 16:57:33 6,066,176 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\ieframe.dll.000
+ 2008-06-23 16:57:33 44,544 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\iernonce.dll
+ 2008-06-23 16:57:34 267,776 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\iertutil.dll
+ 2008-06-23 16:57:34 267,776 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\iertutil.dll.000
+ 2008-06-23 09:20:26 13,824 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\ieudinit.exe
+ 2008-06-23 09:20:52 625,664 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\iexplore.exe
+ 2008-06-23 16:57:35 27,648 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\jsproxy.dll
+ 2008-06-23 16:57:36 459,264 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\msfeeds.dll
+ 2008-06-23 16:57:36 459,264 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\msfeeds.dll.000
+ 2008-06-23 16:57:36 52,224 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\msfeedsbs.dll
+ 2008-06-23 16:57:36 52,224 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\msfeedsbs.dll.000
+ 2008-06-24 02:57:40 3,592,192 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\mshtml.dll
+ 2008-06-24 02:57:40 3,592,192 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\mshtml.dll.000
+ 2008-06-23 16:57:39 477,696 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\mshtmled.dll
+ 2008-06-23 16:57:39 193,024 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\msrating.dll
+ 2008-06-23 16:57:40 671,232 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\mstime.dll
+ 2008-06-23 16:57:40 102,912 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\occache.dll
+ 2008-06-23 16:57:40 44,544 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\pngfilt.dll
+ 2007-03-06 01:22:39 213,216 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\spuninst\updspapi.dll
+ 2008-06-23 16:57:40 105,984 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\url.dll
+ 2008-06-23 16:57:40 105,984 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\url.dll.000
+ 2008-06-23 16:57:40 1,159,680 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\urlmon.dll
+ 2008-06-23 16:57:40 1,159,680 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\urlmon.dll.000
+ 2008-06-23 16:57:41 233,472 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\webcheck.dll
+ 2008-06-23 16:57:41 233,472 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\webcheck.dll.000
+ 2008-06-23 16:57:41 826,368 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\wininet.dll
+ 2008-06-23 16:57:41 826,368 -c----w C:\WINDOWS.0\ie7updates\KB956390-IE7\wininet.dll.000
+ 2006-06-03 11:40:49 33,792 ------w C:\WINDOWS.0\network diagnostic\custsat.dll
+ 2006-10-10 12:44:50 557,568 ------w C:\WINDOWS.0\network diagnostic\xpnetdiag.exe
- 2006-03-15 12:00:00 61,440 ----a-w C:\WINDOWS.0\system32\admparse.dll
+ 2007-08-13 10:39:20 71,680 ----a-w C:\WINDOWS.0\system32\admparse.dll
- 2006-03-15 12:00:00 99,840 ----a-w C:\WINDOWS.0\system32\advpack.dll
+ 2008-08-26 07:24:28 124,928 ----a-w C:\WINDOWS.0\system32\advpack.dll
- 2006-03-15 12:00:00 61,440 -c--a-w C:\WINDOWS.0\system32\dllcache\admparse.dll
+ 2007-08-13 10:39:20 71,680 -c--a-w C:\WINDOWS.0\system32\dllcache\admparse.dll
- 2006-03-15 12:00:00 99,840 -c--a-w C:\WINDOWS.0\system32\dllcache\advpack.dll
+ 2008-08-26 07:24:28 124,928 -c----w C:\WINDOWS.0\system32\dllcache\advpack.dll
- 2005-01-28 05:44:28 28,672 -c--a-w C:\WINDOWS.0\system32\dllcache\custsat.dll
+ 2007-08-13 10:54:10 33,792 -c--a-w C:\WINDOWS.0\system32\dllcache\custsat.dll
- 2008-08-20 05:33:18 357,888 -c--a-w C:\WINDOWS.0\system32\dllcache\dxtmsft.dll
+ 2008-08-26 07:24:28 347,136 -c----w C:\WINDOWS.0\system32\dllcache\dxtmsft.dll
- 2008-08-20 05:33:18 205,312 -c--a-w C:\WINDOWS.0\system32\dllcache\dxtrans.dll
+ 2008-08-26 07:24:28 214,528 -c----w C:\WINDOWS.0\system32\dllcache\dxtrans.dll
- 2008-08-20 05:33:18 55,808 -c--a-w C:\WINDOWS.0\system32\dllcache\extmgr.dll
+ 2008-08-26 07:24:28 133,120 -c----w C:\WINDOWS.0\system32\dllcache\extmgr.dll
- 2006-03-15 12:00:00 38,912 -c--a-w C:\WINDOWS.0\system32\dllcache\hmmapi.dll
+ 2007-08-13 10:18:02 60,416 -c--a-w C:\WINDOWS.0\system32\dllcache\hmmapi.dll
- 2006-03-15 12:00:00 34,304 -c--a-w C:\WINDOWS.0\system32\dllcache\ie4uinit.exe
+ 2008-08-25 08:37:59 70,656 -c----w C:\WINDOWS.0\system32\dllcache\ie4uinit.exe
- 2006-03-15 12:00:00 139,264 -c--a-w C:\WINDOWS.0\system32\dllcache\ieakeng.dll
+ 2008-08-26 07:24:28 153,088 -c----w C:\WINDOWS.0\system32\dllcache\ieakeng.dll
- 2006-03-15 12:00:00 216,576 -c--a-w C:\WINDOWS.0\system32\dllcache\ieaksie.dll
+ 2008-08-26 07:24:28 230,400 -c----w C:\WINDOWS.0\system32\dllcache\ieaksie.dll
- 2006-03-15 12:00:00 221,184 -c--a-w C:\WINDOWS.0\system32\dllcache\ieakui.dll
+ 2008-08-23 05:54:51 161,792 -c----w C:\WINDOWS.0\system32\dllcache\ieakui.dll
- 2006-03-15 12:00:00 323,584 -c--a-w C:\WINDOWS.0\system32\dllcache\iedkcs32.dll
+ 2008-08-26 07:24:29 384,512 -c----w C:\WINDOWS.0\system32\dllcache\iedkcs32.dll
- 2008-08-19 09:38:57 18,432 -c--a-w C:\WINDOWS.0\system32\dllcache\iedw.exe
+ 2007-08-13 10:44:02 69,120 -c--a-w C:\WINDOWS.0\system32\dllcache\iedw.exe
- 2006-03-15 12:00:00 81,920 -c--a-w C:\WINDOWS.0\system32\dllcache\ieencode.dll
+ 2007-08-13 10:45:18 78,336 -c--a-w C:\WINDOWS.0\system32\dllcache\ieencode.dll
- 2008-08-20 05:33:18 251,904 -c--a-w C:\WINDOWS.0\system32\dllcache\iepeers.dll
+ 2007-08-13 10:54:10 191,488 -c--a-w C:\WINDOWS.0\system32\dllcache\iepeers.dll
- 2006-03-15 12:00:00 48,640 -c--a-w C:\WINDOWS.0\system32\dllcache\iernonce.dll
+ 2008-08-26 07:24:29 44,544 -c----w C:\WINDOWS.0\system32\dllcache\iernonce.dll
- 2006-03-15 12:00:00 62,976 -c--a-w C:\WINDOWS.0\system32\dllcache\iesetup.dll
+ 2007-08-13 10:39:12 55,296 -c--a-w C:\WINDOWS.0\system32\dllcache\iesetup.dll
- 2006-03-15 12:00:00 93,184 -c--a-w C:\WINDOWS.0\system32\dllcache\iexplore.exe
+ 2008-08-23 05:56:15 635,848 -c----w C:\WINDOWS.0\system32\dllcache\iexplore.exe
- 2006-03-15 12:00:00 35,840 -c--a-w C:\WINDOWS.0\system32\dllcache\imgutil.dll
+ 2007-08-13 10:36:06 36,352 -c--a-w C:\WINDOWS.0\system32\dllcache\imgutil.dll
- 2008-08-20 05:33:18 96,256 -c--a-w C:\WINDOWS.0\system32\dllcache\inseng.dll
+ 2007-08-13 10:39:02 92,672 -c--a-w C:\WINDOWS.0\system32\dllcache\inseng.dll
- 2007-12-18 14:40:58 450,560 -c--a-w C:\WINDOWS.0\system32\dllcache\jscript.dll
+ 2007-08-13 10:38:04 491,520 -c--a-w C:\WINDOWS.0\system32\dllcache\jscript.dll
- 2008-08-20 05:33:19 16,384 -c--a-w C:\WINDOWS.0\system32\dllcache\jsproxy.dll
+ 2008-08-26 07:24:30 27,648 -c----w C:\WINDOWS.0\system32\dllcache\jsproxy.dll
- 2006-03-15 12:00:00 22,016 -c--a-w C:\WINDOWS.0\system32\dllcache\licmgr10.dll
+ 2007-08-13 10:44:18 40,960 -c--a-w C:\WINDOWS.0\system32\dllcache\licmgr10.dll
- 2006-03-15 12:00:00 29,184 -c--a-w C:\WINDOWS.0\system32\dllcache\mshta.exe
+ 2007-08-13 10:32:30 45,568 -c--a-w C:\WINDOWS.0\system32\dllcache\mshta.exe
- 2008-08-20 05:33:20 3,067,392 -c--a-w C:\WINDOWS.0\system32\dllcache\mshtml.dll
+ 2008-08-27 05:54:32 3,593,216 -c----w C:\WINDOWS.0\system32\dllcache\mshtml.dll
- 2008-08-20 05:33:19 449,024 -c--a-w C:\WINDOWS.0\system32\dllcache\mshtmled.dll
+ 2008-08-26 07:24:30 477,696 -c----w C:\WINDOWS.0\system32\dllcache\mshtmled.dll
- 2006-03-15 12:00:00 56,832 -c--a-w C:\WINDOWS.0\system32\dllcache\mshtmler.dll
+ 2007-08-13 10:01:12 48,128 -c--a-w C:\WINDOWS.0\system32\dllcache\mshtmler.dll
- 2006-03-15 12:00:00 146,432 -c--a-w C:\WINDOWS.0\system32\dllcache\msls31.dll
+ 2007-08-13 10:54:10 156,160 -c--a-w C:\WINDOWS.0\system32\dllcache\msls31.dll
- 2008-08-20 05:33:18 146,432 -c--a-w C:\WINDOWS.0\system32\dllcache\msrating.dll
+ 2008-08-26 07:24:30 193,024 -c----w C:\WINDOWS.0\system32\dllcache\msrating.dll
- 2008-08-20 05:33:18 532,480 -c--a-w C:\WINDOWS.0\system32\dllcache\mstime.dll
+ 2008-08-26 07:24:30 671,232 -c----w C:\WINDOWS.0\system32\dllcache\mstime.dll
- 2006-03-15 12:00:00 332,288 -c--a-w C:\WINDOWS.0\system32\dllcache\netapi32.dll
+ 2008-10-15 16:57:55 332,800 -c--a-w C:\WINDOWS.0\system32\dllcache\netapi32.dll
- 2006-03-15 12:00:00 96,256 -c--a-w C:\WINDOWS.0\system32\dllcache\occache.dll
+ 2008-08-26 07:24:30 102,912 -c----w C:\WINDOWS.0\system32\dllcache\occache.dll
- 2008-08-20 05:33:18 39,424 -c--a-w C:\WINDOWS.0\system32\dllcache\pngfilt.dll
+ 2008-08-26 07:24:30 44,544 -c----w C:\WINDOWS.0\system32\dllcache\pngfilt.dll
- 2006-03-15 12:00:00 37,888 -c--a-w C:\WINDOWS.0\system32\dllcache\url.dll
+ 2008-08-26 07:24:30 105,984 -c----w C:\WINDOWS.0\system32\dllcache\url.dll
- 2008-08-20 05:33:19 619,008 -c--a-w C:\WINDOWS.0\system32\dllcache\urlmon.dll
+ 2008-08-26 07:24:31 1,159,680 -c----w C:\WINDOWS.0\system32\dllcache\urlmon.dll
- 2007-12-18 14:40:58 417,792 -c--a-w C:\WINDOWS.0\system32\dllcache\vbscript.dll
+ 2007-08-13 10:54:10 413,696 -c--a-w C:\WINDOWS.0\system32\dllcache\vbscript.dll
- 2006-03-15 12:00:00 848,384 -c--a-w C:\WINDOWS.0\system32\dllcache\vgx.dll
+ 2007-08-13 10:54:10 765,952 -c--a-w C:\WINDOWS.0\system32\dllcache\VGX.dll
- 2006-03-15 12:00:00 49,152 -c--a-w C:\WINDOWS.0\system32\dllcache\wdigest.dll
+ 2006-03-24 04:37:50 49,152 -c--a-w C:\WINDOWS.0\system32\dllcache\wdigest.dll
- 2006-03-15 12:00:00 276,480 -c--a-w C:\WINDOWS.0\system32\dllcache\webcheck.dll
+ 2008-08-26 07:24:31 233,472 -c----w C:\WINDOWS.0\system32\dllcache\webcheck.dll
- 2006-03-15 12:00:00 1,835,904 -c--a-w C:\WINDOWS.0\system32\dllcache\win32k.sys
+ 2008-09-15 11:57:41 1,846,016 -c--a-w C:\WINDOWS.0\system32\dllcache\win32k.sys
- 2008-08-20 05:33:19 667,648 -c--a-w C:\WINDOWS.0\system32\dllcache\wininet.dll
+ 2008-08-26 07:24:31 826,368 -c----w C:\WINDOWS.0\system32\dllcache\wininet.dll
- 2008-08-20 05:33:18 357,888 ----a-w C:\WINDOWS.0\system32\dxtmsft.dll
+ 2008-08-26 07:24:28 347,136 ------w C:\WINDOWS.0\system32\dxtmsft.dll
- 2008-08-20 05:33:18 205,312 ----a-w C:\WINDOWS.0\system32\dxtrans.dll
+ 2008-08-26 07:24:28 214,528 ------w C:\WINDOWS.0\system32\dxtrans.dll
- 2008-08-20 05:33:18 55,808 ----a-w C:\WINDOWS.0\system32\extmgr.dll
+ 2008-08-26 07:24:28 133,120 ------w C:\WINDOWS.0\system32\extmgr.dll
+ 2008-08-26 07:24:28 63,488 ----a-w C:\WINDOWS.0\system32\icardie.dll
+ 2006-06-29 00:05:44 26,112 ------w C:\WINDOWS.0\system32\idndl.dll
- 2006-03-15 12:00:00 34,304 ----a-w C:\WINDOWS.0\system32\ie4uinit.exe
+ 2008-08-25 08:37:59 70,656 ------w C:\WINDOWS.0\system32\ie4uinit.exe
- 2006-03-15 12:00:00 139,264 ----a-w C:\WINDOWS.0\system32\ieakeng.dll
+ 2008-08-26 07:24:28 153,088 ------w C:\WINDOWS.0\system32\ieakeng.dll
- 2006-03-15 12:00:00 216,576 ----a-w C:\WINDOWS.0\system32\ieaksie.dll
+ 2008-08-26 07:24:28 230,400 ------w C:\WINDOWS.0\system32\ieaksie.dll
- 2006-03-15 12:00:00 221,184 ----a-w C:\WINDOWS.0\system32\ieakui.dll
+ 2008-08-23 05:54:51 161,792 ------w C:\WINDOWS.0\system32\ieakui.dll
+ 2007-04-17 09:32:38 2,455,488 ----a-w C:\WINDOWS.0\system32\ieapfltr.dat
+ 2008-08-26 07:24:28 383,488 ----a-w C:\WINDOWS.0\system32\ieapfltr.dll
- 2006-03-15 12:00:00 323,584 ----a-w C:\WINDOWS.0\system32\iedkcs32.dll
+ 2008-08-26 07:24:29 384,512 ------w C:\WINDOWS.0\system32\iedkcs32.dll
- 2006-03-15 12:00:00 81,920 ----a-w C:\WINDOWS.0\system32\ieencode.dll
+ 2007-08-13 10:45:18 78,336 ----a-w C:\WINDOWS.0\system32\ieencode.dll
+ 2008-10-03 17:41:15 6,066,176 ----a-w C:\WINDOWS.0\system32\ieframe.dll
- 2008-08-20 05:33:18 251,904 ----a-w C:\WINDOWS.0\system32\iepeers.dll
+ 2007-08-13 10:54:10 191,488 ----a-w C:\WINDOWS.0\system32\iepeers.dll
- 2006-03-15 12:00:00 48,640 ----a-w C:\WINDOWS.0\system32\iernonce.dll
+ 2008-08-26 07:24:29 44,544 ------w C:\WINDOWS.0\system32\iernonce.dll
+ 2008-08-26 07:24:29 267,776 ----a-w C:\WINDOWS.0\system32\iertutil.dll
- 2006-03-15 12:00:00 62,976 ----a-w C:\WINDOWS.0\system32\iesetup.dll
+ 2007-08-13 10:39:12 55,296 ----a-w C:\WINDOWS.0\system32\iesetup.dll
+ 2008-08-25 08:38:00 13,824 ----a-w C:\WINDOWS.0\system32\ieudinit.exe
+ 2007-08-13 10:54:10 180,736 ------w C:\WINDOWS.0\system32\ieui.dll
- 2006-03-15 12:00:00 35,840 ----a-w C:\WINDOWS.0\system32\imgutil.dll
+ 2007-08-13 10:36:06 36,352 ----a-w C:\WINDOWS.0\system32\imgutil.dll
- 2008-08-20 05:33:18 96,256 ----a-w C:\WINDOWS.0\system32\inseng.dll
+ 2007-08-13 10:39:02 92,672 ----a-w C:\WINDOWS.0\system32\inseng.dll
- 2007-12-18 14:40:58 450,560 ----a-w C:\WINDOWS.0\system32\jscript.dll
+ 2007-08-13 10:38:04 491,520 ----a-w C:\WINDOWS.0\system32\jscript.dll
- 2008-08-20 05:33:19 16,384 ----a-w C:\WINDOWS.0\system32\jsproxy.dll
+ 2008-08-26 07:24:30 27,648 ------w C:\WINDOWS.0\system32\jsproxy.dll
- 2006-03-15 12:00:00 22,016 ----a-w C:\WINDOWS.0\system32\licmgr10.dll
+ 2007-08-13 10:44:18 40,960 ----a-w C:\WINDOWS.0\system32\licmgr10.dll
+ 2008-10-07 04:19:42 16,721,856 ----a-w C:\WINDOWS.0\system32\MRT.exe
+ 2008-08-26 07:24:30 459,264 ----a-w C:\WINDOWS.0\system32\msfeeds.dll
+ 2008-08-26 07:24:30 52,224 ----a-w C:\WINDOWS.0\system32\msfeedsbs.dll
+ 2007-08-13 10:36:40 12,288 ------w C:\WINDOWS.0\system32\msfeedssync.exe
- 2006-03-15 12:00:00 29,184 ----a-w C:\WINDOWS.0\system32\mshta.exe
+ 2007-08-13 10:32:30 45,568 ----a-w C:\WINDOWS.0\system32\mshta.exe
- 2008-08-20 05:33:20 3,067,392 ----a-w C:\WINDOWS.0\system32\mshtml.dll
+ 2008-08-27 05:54:32 3,593,216 ----a-w C:\WINDOWS.0\system32\mshtml.dll
- 2008-08-20 05:33:19 449,024 ----a-w C:\WINDOWS.0\system32\mshtmled.dll
+ 2008-08-26 07:24:30 477,696 ------w C:\WINDOWS.0\system32\mshtmled.dll
- 2006-03-15 12:00:00 56,832 ----a-w C:\WINDOWS.0\system32\mshtmler.dll
+ 2007-08-13 10:01:12 48,128 ----a-w C:\WINDOWS.0\system32\mshtmler.dll
- 2006-03-15 12:00:00 146,432 ----a-w C:\WINDOWS.0\system32\msls31.dll
+ 2007-08-13 10:54:10 156,160 ----a-w C:\WINDOWS.0\system32\msls31.dll
- 2008-08-20 05:33:18 146,432 ----a-w C:\WINDOWS.0\system32\msrating.dll
+ 2008-08-26 07:24:30 193,024 ------w C:\WINDOWS.0\system32\msrating.dll
- 2008-08-20 05:33:18 532,480 ----a-w C:\WINDOWS.0\system32\mstime.dll
+ 2008-08-26 07:24:30 671,232 ------w C:\WINDOWS.0\system32\mstime.dll
- 2006-03-15 12:00:00 332,288 ----a-w C:\WINDOWS.0\system32\netapi32.dll
+ 2008-10-15 16:57:55 332,800 ----a-w C:\WINDOWS.0\system32\netapi32.dll
+ 2006-06-29 00:05:44 23,552 ------w C:\WINDOWS.0\system32\normaliz.dll
- 2006-03-15 12:00:00 96,256 ----a-w C:\WINDOWS.0\system32\occache.dll
+ 2008-08-26 07:24:30 102,912 ------w C:\WINDOWS.0\system32\occache.dll
- 2008-08-20 05:33:18 39,424 ----a-w C:\WINDOWS.0\system32\pngfilt.dll
+ 2008-08-26 07:24:30 44,544 ------w C:\WINDOWS.0\system32\pngfilt.dll
- 2007-11-30 11:18:51 17,272 ------w C:\WINDOWS.0\system32\spmsg.dll
+ 2007-11-30 12:39:22 17,272 ------w C:\WINDOWS.0\system32\spmsg.dll
- 2005-06-28 02:21:34 22,752 ----a-w C:\WINDOWS.0\system32\spupdsvc.exe
+ 2006-09-06 09:43:16 22,752 ----a-w C:\WINDOWS.0\system32\spupdsvc.exe
- 2006-03-15 12:00:00 37,888 ----a-w C:\WINDOWS.0\system32\url.dll
+ 2008-08-26 07:24:30 105,984 ----a-w C:\WINDOWS.0\system32\url.dll
- 2008-08-20 05:33:19 619,008 ----a-w C:\WINDOWS.0\system32\urlmon.dll
+ 2008-08-26 07:24:31 1,159,680 ----a-w C:\WINDOWS.0\system32\urlmon.dll
- 2007-12-18 14:40:58 417,792 ----a-w C:\WINDOWS.0\system32\vbscript.dll
+ 2007-08-13 10:54:10 413,696 ----a-w C:\WINDOWS.0\system32\vbscript.dll
- 2006-03-15 12:00:00 49,152 ----a-w C:\WINDOWS.0\system32\wdigest.dll
+ 2006-03-24 04:37:50 49,152 ----a-w C:\WINDOWS.0\system32\wdigest.dll
- 2006-03-15 12:00:00 276,480 ----a-w C:\WINDOWS.0\system32\webcheck.dll
+ 2008-08-26 07:24:31 233,472 ----a-w C:\WINDOWS.0\system32\webcheck.dll
+ 2007-08-13 10:45:16 206,336 ------w C:\WINDOWS.0\system32\WinFXDocObj.exe
- 2008-08-20 05:33:19 667,648 ----a-w C:\WINDOWS.0\system32\wininet.dll
+ 2008-08-26 07:24:31 826,368 ----a-w C:\WINDOWS.0\system32\wininet.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SIDEBAR "= "C:\Program Files\Desktop Sidebar\dsidebar.exe" [2006-07-09 1777664]
"ctfmon.exe "= "C:\WINDOWS.0\system32\ctfmon.exe" [2006-03-15 15360]
"Yahoo! Pager "= "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-11-06 3810544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KTPWare "= "C:\Program Files\Elantech\ktp.exe" [2005-10-28 512000]
"IntelZeroConfig "= "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-07-03 802816]
"IntelWireless "= "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-07-02 700416]
"BisonTrayIcon "= "C:\WINDOWS.0\BisonCam\BisonTrayIcon.exe" [2005-09-05 45056]
"ccApp "= "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 115816]
"High Definition Audio Property Page Shortcut "= "HDAShCut.exe" [2005-01-07 C:\WINDOWS.0\system32\HdAShCut.exe]
"RTHDCPL "= "RTHDCPL.EXE" [2006-01-12 C:\WINDOWS.0\RTHDCPL.exe]
"CHotkey "= "mHotkey.exe" [2001-12-26 C:\WINDOWS.0\mHotkey.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync "= "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle "= C:\WINDOWS.0\Resources\Themes\Royale\Royale.msstyles
"InstallTheme "= C:\WINDOWS.0\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter "= ac3filter.acm
"msacm.avis "= ff_acm.acm
"vidc.ffds "= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users.WINDOWS.0\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS.0\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Start Menu^Programs^Startup^BlueSoleil.lnk]
path=C:\Documents and Settings\All Users.WINDOWS.0\Start Menu\Programs\Startup\BlueSoleil.lnk
backup=C:\WINDOWS.0\pss\BlueSoleil.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk]
path=C:\Documents and Settings\All Users.WINDOWS.0\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk
backup=C:\WINDOWS.0\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS.0^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users.WINDOWS.0\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS.0\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^user.NEO^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=C:\Documents and Settings\user.NEO\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=C:\WINDOWS.0\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
-r------- 2007-11-17 11:20 91432 C:\Program Files\CyberLink\Shared files\brs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2005-12-16 12:57 94208 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BisonTrayIcon]
--a------ 2005-09-05 16:51 45056 C:\WINDOWS.0\BisonCam\BisonTrayIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-02-19 13:10 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--------- 2007-10-11 12:06 62760 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
--a------ 2004-12-10 19:44 11776 C:\Program Files\Musicmatch\Musicmatch Jukebox\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
--a------ 2004-12-10 19:44 110592 C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-08-04 01:06 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS.0\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2007-06-18 15:10 271360 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 2008-01-20 15:05 217088 C:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-31 23:13 385024 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2007-10-28 09:35 72736 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
--a------ 2006-05-25 02:31 1372160 C:\Program Files\TGTSoft\StyleXP\StyleXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-12-14 03:42 144784 C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-10-02 20:19 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 2008-05-02 12:15 15872 C:\Program Files\Unlocker\UnlockerAssistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2003-12-13 08:50 33792 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-11-06 19:51 3810544 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
-ra------ 2005-11-10 03:44 557056 C:\WINDOWS.0\sm56hlpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"C:\\Program Files\\Messenger\\msmsgs.exe "=
"C:\\ECGR-RO server\\Raine\\Raine.exe "=
"C:\\ECGR-RO server\\Janine\\Janine.exe "=
"C:\\ECGR-RO server\\Cheska\\Cheska.exe "=
"C:\\ECGR-RO server\\Ashe\\Ashe.exe "=
"C:\\ECGR-RO server\\Ashe\\Ashe_Online.exe "=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"C:\\Program Files\\iTunes\\iTunes.exe "=
"C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=

R0 pavboot;pavboot;C:\WINDOWS.0\system32\drivers\pavboot.sys [2008-06-19 28544]
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\000.fcl [2007-11-03 00:12 41456]
R3 Ktp;Elantech Touchpad;C:\WINDOWS.0\system32\DRIVERS\Ktp.sys [2005-11-29 27520]

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2008-10-10 C:\WINDOWS.0\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-24 15:12:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath "= "\??\C:\Program Files\CyberLink\PowerDVD\000.fcl "
.
Completion time: 2008-10-24 15:20:35
ComboFix-quarantined-files.txt 2008-10-24 07:19:29
ComboFix2.txt 2008-10-24 07:04:06

Pre-Run: 7,699,804,160 bytes free
Post-Run: 7,719,268,352 bytes free

620 --- E O F --- 2008-10-24 06:56:59

Geri · 2008/10/27

Hi
OK lets try to get a kaspersky scan. Make sure you disable your Anti Virus program before doing the scan.

Please follow these directions.

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

Now the scan.

Please do an online scan with Kaspersky WebScanner

Click on “Accept” If your pop –up blocker blocks any windows from opening.

Click Run on the window that opens.
Windows Vista users you must open the web browser using the Run as Administrator command.

The program will launch and then begin downloading the latest definition files:

Under Scan on the left side.Click on My Computer

This will start the program and scan your system.

Click the “Scan Report” On the left side.

The scan will take a while so be patient and let it run.

Once the scan is complete it will display if your system has been infected.

Click the Save Report As button, and in the Browse dialog box, type a name for the scan report file that you want to create and select its type Text file. Click OK to save the file.:

Save the text file to your desktop.

Copy and paste that information in your next post.

Please post the Kaspersky results.

Thanks
Geri

clubECGR · 2008/10/29

got our new connection awhile ago so here's the report.

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, October 28, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, October 29, 2008 03:24:23
Records in database: 1355093
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - Critical Areas:
C:\Documents and Settings\All Users.WINDOWS.0\Start Menu\Programs\Startup
C:\Documents and Settings\user.NEO\Start Menu\Programs\Startup
C:\Program Files
C:\WINDOWS.0

Scan statistics:
Files scanned: 78990
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 02:09:00

No malware has been detected. The scan area is clean.

The selected area was scanned.

got to delete most of the files due to being back up

Geri · 2008/10/29

Hi
Ok that shows clean.
Can I ask why you did not scan "My Computer" as asked?

Critical Areas is all good and fine, But malware can hide in other places.

How many user accounts are on the machine?

clubECGR · 2008/10/29

Nah...i deleted almost everything in my sis's laptop anyway and besides, the scan already began before i know it. it only has 1 useraccound (when we switch it on it's already in the desktop and we dont choose user accounts)

Thank you very much for your help. I love this site. Wish I can repay you.

Geri · 2008/10/29

Hi
Ok, Glad I could help.

Please do this.

Click Start > Run in the run box copy and paste or type ComboFix /u then hit Enter to uninstall ComboFix and remove the files/folders it created. This action will also reset the System Restore points, removing any infected files there as well.
Please check and verify that C:\Qoobox and C:\ComboFix folders were removed, as well as the C:\ComboFix.txt file.

Delete RSIT.exe and this folder C:\rsit

Please look at this link for some preventive recommendations, It could keep you from ending up back here to the Malware and Virus Removal Forums.
http://www.windowsbbs.com/showthread.php?t=67958

I'll mark this one resolved.

Wish I can repay you.
Click to expand...

I do this for free, but if you are ever able you can always subscribe to the site.

Surf Safely
Geri

Log in or Sign up

Solved Trojan Vundo strikes

clubECGR Inactive Thread Starter

Geri Inactive Alumni

clubECGR Inactive Thread Starter

clubECGR Inactive Thread Starter

clubECGR Inactive Thread Starter

Geri Inactive Alumni

clubECGR Inactive Thread Starter

Geri Inactive Alumni

clubECGR Inactive Thread Starter

Geri Inactive Alumni

clubECGR Inactive Thread Starter

Geri Inactive Alumni

clubECGR Inactive Thread Starter

Geri Inactive Alumni

Share This Page

Log in or Sign up

Solved Trojan Vundo strikes

clubECGR Inactive Thread Starter

Geri Inactive Alumni

clubECGR Inactive Thread Starter

clubECGR Inactive Thread Starter

clubECGR Inactive Thread Starter

Geri Inactive Alumni

clubECGR Inactive Thread Starter

Geri Inactive Alumni

clubECGR Inactive Thread Starter

Geri Inactive Alumni

clubECGR Inactive Thread Starter

Geri Inactive Alumni

clubECGR Inactive Thread Starter

Geri Inactive Alumni

Share This Page

Useful Searches