Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

avg detected nircmd.exe trojan

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

avg detected nircmd.exe trojan

Unread postby cdoolake » November 12th, 2009, 3:24 pm

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:21:58 PM, on 11/12/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Windows\system32\spool\DRIVERS\W32X86\3\lxdjPSWX.EXE
C:\Windows\system32\spool\DRIVERS\W32X86\3\lxdjPSWX.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Comcast Toolbar - {79CEEA4E-C231-4614-9E3B-53B2A02F39B7} - C:\Program Files\comcasttb\comcastdx.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Comcast Toolbar - {79CEEA4E-C231-4614-9E3B-53B2A02F39B7} - C:\Program Files\comcasttb\comcastdx.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [AIMPro] "C:\Program Files\AIM\AIM Pro\aimpro.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\System32\msconfig.exe" /auto
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net ... plugin.cab
O16 - DPF: {0C92900E-4D5A-4F04-ACC9-729E1767BBAE} (Image Uploader Control) - http://cordcamera.lifepics.com/net/Uplo ... ader45.cab
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resour ... cctrl2.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/i ... ection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/s ... DEXAXO.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Comcast AntiSpyware (AntiSpywareService) - Unknown owner - C:\Program Files\comcasttb\ComcastSpywareScan\ComcastAntiSpyService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxdjCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdjserv.exe
O23 - Service: lxdj_device - - C:\Windows\system32\lxdjcoms.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 12802 bytes
cdoolake
Regular Member
 
Posts: 20
Joined: November 12th, 2009, 3:07 pm
Advertisement
Register to Remove

Re: avg detected nircmd.exe trojan

Unread postby MWR 3 day Mod » November 15th, 2009, 10:26 pm

Hi,

We are sorry to see your topic is over three days old and no one has yet been able to respond and offer help.

If you still require assistance, please post a link to your topic in our Waiting for help with malware removal? forum, and our staff will make an effort to assist you as promptly as possible. Only post a LINK to this topic, DO NOT post your DDS log!

Please do not reply to this topic.

If you haven't posted within two days in the "Waiting for help with malware removal?" forum, we will assume you have been able to get assistance in other ways and this topic will be closed.
MWR 3 day Mod
MRU Undergrad
MRU Undergrad
 
Posts: 2534
Joined: April 4th, 2008, 8:40 am

Re: avg detected nircmd.exe trojan

Unread postby xixo_12 » November 16th, 2009, 10:40 am

Hello and Welcome to Malware Removal Forums.
  • My name is xixo_12 and I will guide you to encounter the problem that you have now.
  • We will work together and I need your attention to read all those instruction carefully.
  • Refrain from running self fixes as this will hinder the malware removal process.
  • You may wish to print them off or copy the instruction into Notepad.
  • If you have any question please don't hesitate to ask.
  • The instructions that I will give to you are specific to your current problem and shouldn't be used on other systems.
  • If you are receiving help or have received help on this problem elsewhere, please let us know.
  • Please post your replies to this thread only and keep interact with me until your computer is clean.

Everything I post to you will be review by MRU Teacher. This process will impact my response time to you. Be patient. ;)
Please! If you need more time to do all the instructions, let me know before 72hours is done. Otherwise, your thread will be closed

***Note : WIndows Vista require user to right click > Run as an Administrator to use the tool that I will instruct to you.

Next,
Uninstall List.
  • Run the HiJack This.
  • Click on Open the Misc Tools section button.
  • Click on Misc Tools tab.
  • Under the System tools, click on Open Uninstall Manager button.
  • Find the Save list… button and save to the Desktop
  • Copy the content and paste the uninstall list here.

Next,
Checklist.
Please post.
  • Content of uninstall list.
User avatar
xixo_12
MRU Master Emeritus
 
Posts: 2340
Joined: October 14th, 2008, 11:40 am
Location: Malaysia

Re: avg detected nircmd.exe trojan

Unread postby cdoolake » November 16th, 2009, 4:02 pm

3ivx MPEG-4 5.0 Decoder (remove only)
Acrobat.com
Acrobat.com
Activation Assistant for the 2007 Microsoft Office suites
Ad-Aware
Ad-Aware
Adobe AIR
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.2
Adobe Shockwave Player
AIM 7
Apple Application Support
Apple Mobile Device Support
Apple Software Update
a-squared Free 3.1
AVG Free 8.5
Belarc Advisor 7.2
BitPim 1.0.6
Bonjour
Canon G.726 WMP-Decoder
Canon MovieEdit Task for ZoomBrowser EX
Canon RAW Image Task for ZoomBrowser EX
Canon Utilities CameraWindow
Canon Utilities CameraWindow DC
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
Canon Utilities MyCamera
Canon Utilities MyCamera DC
Canon Utilities PhotoStitch
Canon Utilities RemoteCapture DC
Canon Utilities RemoteCapture Task for ZoomBrowser EX
Canon Utilities ZoomBrowser EX
Canon ZoomBrowser EX Memory Card Utility
Comcast High-Speed Internet Install Wizard
Compatibility Pack for the 2007 Office system
Conexant HD Audio
Desktop Doctor
Download Updater (AOL LLC)
ESU for Microsoft Vista
FastImageResizer (remove only)
Foxit PDF IFilter
Foxit Reader
Foxit Toolbar
Google Chrome
Google Earth
Google Update Helper
Google Updater
Hauppauge MCE XP/Vista Software Encoder (2.0.24341)
HDAUDIO Soft Data Fax Modem with SmartCP
Hewlett-Packard Active Check for Health Check
Hewlett-Packard Asset Agent for Health Check
Hijackthis 1.99.1
HijackThis 1.99.1
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Active Support Library 32 bit components
HP Customer Experience Enhancements
HP Doc Viewer
HP Easy Setup - Frontend
HP Help and Support
HP Photosmart Essential 2.0
HP Product Detection
HP Quick Launch Buttons 6.20 B1
HP QuickPlay 3.2
HP Total Care Advisor
HP Update
HP User Guides 0057
HP Wireless Assistant
HPNetworkAssistant
iTunes
Java(TM) 6 Update 3
Java(TM) SE Runtime Environment 6
Lexmark 1400 Series
LG USB Modem driver
MediaMonkey 3.0
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Home and Student 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Live Add-in 1.4
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Mobile Broadband Generic Drivers
Mozilla Firefox (3.5.5)
MSCU for Microsoft Vista
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
muvee autoProducer 6.0
muvee Plugin 1.0
NVIDIA Drivers
Picasa 3
QuickTime
Rhapsody
Rhapsody Player Engine
Roxio Activation Module
Roxio Creator Audio
Roxio Creator Basic v9
Roxio Creator Copy
Roxio Creator Data
Roxio Creator EasyArchive
Roxio Creator Tools
Roxio Express Labeler 3
Roxio MyDVD Basic v9
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB973704)
Security Update for 2007 Microsoft Office System (KB973704)
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Excel 2007 (KB973593)
Security Update for Microsoft Office Excel 2007 (KB973593)
Security Update for Microsoft Office Outlook 2007 (KB972363)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office Publisher 2007 (KB969693)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
SmartAudio
Spelling Dictionaries Support For Adobe Reader 8
Spybot - Search & Destroy
SpywareBlaster 4.2
Synaptics Pointing Device Driver
Update for 2007 Microsoft Office System (KB967642)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 (KB974561)
Update for Microsoft Office Word 2007 (KB974561)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (kb975960)
V CAST Music Manager
V CAST Music with Rhapsody
Viewpoint Media Player
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VZAccess Manager
Windows Live ID Sign-in Assistant
Windows Live OneCare safety scanner
Windows Live OneCare safety scanner
Yahoo! Install Manager
Yahoo! Software Update
Yahoo! Toolb[/color] hope i did this correctly..thanks for helping me!
cdoolake
Regular Member
 
Posts: 20
Joined: November 12th, 2009, 3:07 pm

Re: avg detected nircmd.exe trojan

Unread postby xixo_12 » November 18th, 2009, 6:21 pm

Hi,
Let's proceed,

First,
Multiple Anti-virus Programs.
  • Anti-virus programs take up an enormous amount of your computer's resources when they are actively scanning your computer.
  • Having two anti-virus programs running at the same time can cause your computer to run very slow, become unstable and even, in rare cases, crash.
  • Installed antivirus on your system:
    a-squared Free 3.1
    AVG Free 8.5
  • Please remove one of them NOW.

Next,
Remove programs.
Please Click Start > Control Panel > Programs and Features
Remove the listed program(s) by clicking Uninstall/Change.
Foxit Toolbar
Spybot - Search & Destroy <<You can reinstall after the system is clean.
Ad-Aware <<You can reinstall after the system is clean.

If some program(s) listed above are not in present, please do not panic and proceed to the next step.

Next,
Fix entries.
  • Run the HiJack This by right click on the tool > Run as an Administrator.
  • Click on Do a system scan only button.
  • Search the entries as below and tick at the small box.
    O4 - HKLM\..\Run: [MSConfig] "C:\Windows\System32\msconfig.exe" /auto
  • Close any other program and leave HiJackThis program alone.
  • Click Fix checked.

Next,
Reboot.

Next,
RSIT by random/random.
Please download from from HERE and save to the desktop.
  • Right click on RSIT.exe > Run as an Administrator to run the tool.
  • Click Continue at the disclaimer screen.
  • Once it finishes, two logs will open.
    • log.txt will be opened maximized
    • info.txt will be opened minimized
  • Please post the contents of both logs in your next post.
***You can find manually the log at C:\rsit

Next,
GMER.
Please download from HERE and save to the desktop.
  • Unzip/extract the file to its own folder.
  • Disconnect from the Internet and close all running programs.
    There is a small chance this application may crash your computer so save any work you have open.
  • Right click on Gmer.exe > Run as an Administrator to start the program.
  • Allow the gmer.sys driver to load if asked.
  • If it gives you a warning at program start about rootkit activity and asks if you want to run a scan,click NO.
  • Click on >>> symbol and choose on the Rootkit tab.
  • Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive.
  • Make sure all other boxes on the right of the screen are checked, EXCEPT for "Show All".
  • Click on the Scan and wait for the scan to finish.
    Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan.
  • When completed, click on the Copy button and right-click on your Desktop, choose "New" > Text document. Once the file is created, open it and right-click again and choose Paste or Ctrl+V. Save the file as gmer.txt and copy the information in your next reply.
  • Note: If you have any problems, try running GMER in SAFE MODE"
Important! Please do not select the "Show all" checkbox during the scan..

Next,
Checklist.
Please post.
  • Content of log.txt and info.txt (Find both in c:\rsit)
  • Content of GMER.txt
User avatar
xixo_12
MRU Master Emeritus
 
Posts: 2340
Joined: October 14th, 2008, 11:40 am
Location: Malaysia

Re: avg detected nircmd.exe trojan

Unread postby cdoolake » November 18th, 2009, 8:59 pm

ok 1st off there are too many char. to post so i am going to have to make seperate posts..also i tried to run the gmer and it stopped working so i tried safe mode and it stopped there also...so now what do u suggest?? thanks..

info.txt logfile of random's system information tool 1.06 2009-11-18 19:03:45

======Uninstall list======

-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
3ivx MPEG-4 5.0 Decoder (remove only)-->"C:\Program Files\3ivx\3ivx MPEG-4 5.0 Decoder\uninstall.exe"
Acrobat.com-->msiexec /qb /x {6D8D64BE-F500-55B6-705D-DFD08AFE0624}
Acrobat.com-->MsiExec.exe /I{6D8D64BE-F500-55B6-705D-DFD08AFE0624}
Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Adobe AIR-->c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A92000000001}
Adobe Shockwave Player-->C:\Windows\System32\Macromed\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Macromed\SHOCKW~1\Install.log
AIM 7-->C:\Program Files\AIM\uninst.exe
Apple Application Support-->MsiExec.exe /I{B607C354-CD79-4D22-86D1-92DC94153F42}
Apple Mobile Device Support-->MsiExec.exe /I{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
AVG Free 8.5-->C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
Belarc Advisor 7.2-->C:\PROGRA~1\Belarc\Advisor\UNINST~1.EXE C:\PROGRA~1\Belarc\Advisor\INSTALL.LOG
BitPim 1.0.6-->"C:\Program Files\BitPim\unins000.exe"
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
Canon G.726 WMP-Decoder-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\G726Decoder\G726DecUnInstall.ini"
Canon MovieEdit Task for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX\Program\MVWUninst.ini"
Canon RAW Image Task for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\RAW Image Task\Uninst.ini"
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowDVC6\Uninst.ini"
Canon Utilities CameraWindow DC-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowDC\Uninst.ini"
Canon Utilities CameraWindow-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowLauncher\Uninst.ini"
Canon Utilities MyCamera DC-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\MyCameraDC\Uninst.ini"
Canon Utilities MyCamera-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\MyCamera\Uninst.ini"
Canon Utilities PhotoStitch-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\PhotoStitch\Uninst.ini"
Canon Utilities RemoteCapture DC-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\RemoteCaptureDC\Uninst.ini"
Canon Utilities RemoteCapture Task for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\RemoteCaptureTask DC\Uninst.ini"
Canon Utilities ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX\Program\Uninst.ini"
Canon ZoomBrowser EX Memory Card Utility-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX MCU\Uninst.ini"
Comcast High-Speed Internet Install Wizard-->C:\Program Files\support.com\uninstall\chsi_uninstaller.exe
Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
Conexant HD Audio-->C:\Program Files\CONEXANT\CNXT_HDAUDIO\UIU32a.exe -U -IQv30CFza.inf
Desktop Doctor-->MsiExec.exe /I{D87149B3-7A1D-4548-9CBF-032B791E5908}
Download Updater (AOL LLC)-->C:\Program Files\Common Files\Software Update Utility\uninstall.exe
ESU for Microsoft Vista-->MsiExec.exe /X{54F7A791-38DE-4439-AB3F-B3F7DDA89C75}
FastImageResizer (remove only)-->"C:\Program Files\Fast Image Resizer\uninstall.exe"
Foxit PDF IFilter-->MsiExec.exe /I{4448ABF6-786D-4C3D-A49D-7BB237E6DD17}
Foxit Reader-->C:\Program Files\Foxit Software\Foxit Reader\Uninstall.exe
Google Chrome-->"C:\Program Files\Google\Chrome\Application\3.0.195.33\Installer\setup.exe" --uninstall --system-level
Google Earth-->MsiExec.exe /X{3A05B900-A3E7-11DE-A9B7-005056806466}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Updater-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Hauppauge MCE XP/Vista Software Encoder (2.0.24341)-->C:\PROGRA~1\WinTV\UNSftMCE.EXE C:\PROGRA~1\WinTV\softMCE.LOG
HDAUDIO Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDA_HSF\UIU32m.exe -U -IwqcVenz.inf
Hewlett-Packard Active Check for Health Check-->MsiExec.exe /X{254C37AA-6B72-4300-84F6-98A82419187E}
Hewlett-Packard Asset Agent for Health Check-->MsiExec.exe /X{669D4A35-146B-4314-89F1-1AC3D7B88367}
Hijackthis 1.99.1-->"C:\Program Files\Hijackthis\unins000.exe"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP Active Support Library 32 bit components-->MsiExec.exe /I{FAB0C302-CB18-4A7A-BA03-C3DC23101A68}
HP Active Support Library-->C:\Program Files\InstallShield Installation Information\{290B83AA-093A-45BF-A917-D1C4A1E8D917}\setup.exe -runfromtemp -l0x0409
HP Customer Experience Enhancements-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB5E289E-76BF-4251-9F3F-9B763F681AE0}\setup.exe" -l0x9 -removeonly
HP Doc Viewer-->MsiExec.exe /I{082702D5-5DD8-4600-BCE5-48B15174687F}
HP Easy Setup - Frontend-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40F7AED3-0C7D-4582-99F6-484A515C73F2}\setup.exe" -l0x9 -removeonly
HP Help and Support-->MsiExec.exe /I{9061CEF2-51F5-42C9-8A70-9ED351C6597A}
HP Photosmart Essential 2.0-->C:\Program Files\HP\Digital Imaging\PhotoSmartEssential\hpzscr01.exe -datfile hpqbud13.dat
HP Product Detection-->MsiExec.exe /X{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}
HP Quick Launch Buttons 6.20 B1-->C:\Program Files\InstallShield Installation Information\{34D2AB40-150D-475D-AE32-BD23FB5EE355}\setup.exe -runfromtemp -l0x0009 uninst
HP QuickPlay 3.2-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\setup.exe" -uninstall
HP Total Care Advisor-->MsiExec.exe /X{F6B29003-A078-4491-AFBE-62EFB6CFFE19}
HP Update-->MsiExec.exe /X{8C6027FD-53DC-446D-BB75-CACD7028A134}
HP User Guides 0057-->MsiExec.exe /I{DDFD9BA2-8E26-4E49-92AE-882424DAB1BC}
HP Wireless Assistant-->MsiExec.exe /I{D32067CD-7409-4792-BFA0-1469BCD8F0C8}
HPNetworkAssistant-->MsiExec.exe /I{228C6B46-64E2-404E-898A-EF0830603EF4}
iTunes-->MsiExec.exe /I{D1A74FBB-CA8D-4CCA-9B89-BAAA436DB178}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) SE Runtime Environment 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000}
Lexmark 1400 Series-->C:\Program Files\Lexmark 1400 Series\Install\x86\Uninst.exe
LG USB Modem driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C3ABE126-2BB2-4246-BFE1-6797679B3579}\Setup.exe" -l0x9 LG
MediaMonkey 3.0-->"C:\Program Files\MediaMonkey\unins000.exe"
Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00BA-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0114-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007-->MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007-->MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office Live Add-in 1.4-->MsiExec.exe /I{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}
Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft VC9 runtime libraries-->MsiExec.exe /I{C4124E95-5061-4776-8D5D-E3D931C778E1}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Works-->MsiExec.exe /I{6D52C408-B09A-4520-9B18-475B81D393F1}
Mobile Broadband Generic Drivers-->MsiExec.exe /i{7B2ADCB5-3F3D-478A-90A9-A8C04EF82BF6}
Mozilla Firefox (3.5.5)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSCU for Microsoft Vista-->MsiExec.exe /I{F7F3B252-E772-48AA-93EB-7964BC326067}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
muvee autoProducer 6.0-->C:\Program Files\InstallShield Installation Information\{0BFC200F-C45D-4271-AF34-4CA969225DEB}\setup.exe -runfromtemp -l0x0009 -removeonly
muvee Plugin 1.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{82CA0A0C-A3EC-4167-B694-909205B2EDEC}\setup.exe" -l0x9
NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe"
QuickTime-->MsiExec.exe /I{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}
Rhapsody Player Engine-->MsiExec.exe /I{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}
Rhapsody-->C:\PROGRA~1\Rhapsody\Unwise32.exe /A C:\PROGRA~1\Rhapsody\INSTALL.LOG
Roxio Activation Module-->MsiExec.exe /I{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}
Roxio Creator Audio-->MsiExec.exe /I{83FFCFC7-88C6-41c6-8752-958A45325C82}
Roxio Creator Basic v9-->MsiExec.exe /I{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}
Roxio Creator Copy-->MsiExec.exe /I{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}
Roxio Creator Data-->MsiExec.exe /I{0D397393-9B50-4c52-84D5-77E344289F87}
Roxio Creator EasyArchive-->MsiExec.exe /I{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}
Roxio Creator Tools-->MsiExec.exe /I{0394CDC8-FABD-4ed8-B104-03393876DFDF}
Roxio Express Labeler 3-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Roxio MyDVD Basic v9-->MsiExec.exe /I{33C65B6A-5D73-4E3E-A1F9-127C27BD3F72}
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB973704)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {E626DC89-A787-4553-9BB3-DC2EC7E1593F}
Security Update for 2007 Microsoft Office System (KB973704)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {E626DC89-A787-4553-9BB3-DC2EC7E1593F}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Microsoft Office Excel 2007 (KB973593)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7D6255E3-3423-4D8B-A328-F6F8D28DD5FE}
Security Update for Microsoft Office Excel 2007 (KB973593)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7D6255E3-3423-4D8B-A328-F6F8D28DD5FE}
Security Update for Microsoft Office Outlook 2007 (KB972363)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {120BE9A0-9B09-4855-9E0C-7DEE45CB03C0}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office Publisher 2007 (KB969693)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E}
Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
SmartAudio-->C:\Program Files\Conexant\SmartAudio\SETUP.EXE -U -ISmartAudio /F1"C:\Program Files\InstallShield Installation Information\{E621DCAF-82F7-4F6D-B563-B6A4004B2397}\setup.iss" /S
Spelling Dictionaries Support For Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003}
SpywareBlaster 4.2-->"C:\Program Files\SpywareBlaster\unins000.exe"
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Microsoft Office 2007 Help for Common Features (KB963673)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42}
Update for Microsoft Office 2007 Help for Common Features (KB963673)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42}
Update for Microsoft Office Access 2007 Help (KB963663)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {6B76A18A-AA1E-42AB-A7AD-6C84BBB43987}
Update for Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9}
Update for Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9}
Update for Microsoft Office Infopath 2007 Help (KB963662)-->msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {716B81B8-B13C-41DF-8EAC-7A2F656CAB63}
Update for Microsoft Office OneNote 2007 Help (KB963670)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2744EF05-38E1-4D5D-B333-E021EDAEA245}
Update for Microsoft Office OneNote 2007 Help (KB963670)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2744EF05-38E1-4D5D-B333-E021EDAEA245}
Update for Microsoft Office Outlook 2007 Help (KB963677)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {0451F231-E3E3-4943-AB9F-58EB96171784}
Update for Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876}
Update for Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876}
Update for Microsoft Office Publisher 2007 Help (KB963667)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2E40DE55-B289-4C8B-8901-5D369B16814F}
Update for Microsoft Office Script Editor Help (KB963671)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
Update for Microsoft Office Script Editor Help (KB963671)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
Update for Microsoft Office Word 2007 (KB974561)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {0CDDBAA2-2111-4A0E-A1B0-76C40C635331}
Update for Microsoft Office Word 2007 (KB974561)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0CDDBAA2-2111-4A0E-A1B0-76C40C635331}
Update for Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726}
Update for Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726}
Update for Outlook 2007 Junk Email Filter (kb975960)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F1AB1BED-7477-4D5A-BD0C-04C2109459A5}
V CAST Music Manager -->C:\PROGRA~1\VERIZO~1\VCASTM~1\Setup.exe /remove /q0
V CAST Music with Rhapsody-->C:\PROGRA~1\VCASTM~1\Unwise32.exe /A C:\PROGRA~1\VCASTM~1\install.log
Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Media Player\mtsAxInstaller.exe /u
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\Windows\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
VZAccess Manager-->MsiExec.exe /I{7641FD7D-E94E-424E-A95C-0593C84DC0C0}
Windows Live ID Sign-in Assistant-->MsiExec.exe /X{10A44844-4465-456E-8C97-80BDD4F68845}
Windows Live OneCare safety scanner-->"C:\Program Files\Windows Live Safety Center\UnInstall.exe"
Windows Live OneCare safety scanner-->MsiExec.exe /X{FE0646A7-19D0-41B4-A2BB-2C35D644270D}
Yahoo! Install Manager-->C:\Windows\system32\regsvr32 /u C:\Windows\cache\YINSTH~1.DLL
Yahoo! Software Update-->C:\PROGRA~1\Yahoo!\SOFTWA~1\UNINST~1.EXE
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE

======Hosts File======

127.0.0.1 007guard.com
127.0.0.1 www.007guard.com
127.0.0.1 008i.com
127.0.0.1 008k.com
127.0.0.1 www.008k.com
127.0.0.1 00hq.com
127.0.0.1 www.00hq.com
127.0.0.1 010402.com
127.0.0.1 032439.com
127.0.0.1 www.032439.com

======Security center information======

AV: AVG Anti-Virus Free
AS: AVG Anti-Virus Free (disabled)
AS: Lavasoft Ad-Watch Live! (disabled)
AS: Windows Defender (disabled)

======System event log======

Computer Name: cdoo-PC
Event Code: 4001
Message: WLAN AutoConfig service has successfully stopped.

Record Number: 93425
Source Name: Microsoft-Windows-WLAN-AutoConfig
Time Written: 20090310002641.876800-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: cdoo-PC
Event Code: 19
Message: A corrected hardware error occurred.

Error Source: Corrected Machine Check

Error Type: TLB Error

Processor ID Valid: Yes
Processor ID: 0x1
Bank Number: 3
Transaction Type: Reserved
Processor Participation: N/A
Request Type: N/A
Memory/Io: N/A
Memory Hierarchy Level: Generic
Timeout: N/A
Record Number: 93394
Source Name: Microsoft-Windows-WHEA-Logger
Time Written: 20090309222034.509000-000
Event Type: Warning
User: NT AUTHORITY\LOCAL SERVICE

Computer Name: cdoo-PC
Event Code: 19
Message: A corrected hardware error occurred.

Error Source: Corrected Machine Check

Error Type: Bus/Interconnect Error

Processor ID Valid: Yes
Processor ID: 0x1
Bank Number: 2
Transaction Type: N/A
Processor Participation: Local node responded to the request
Request Type: Snoop
Memory/Io: I/O
Memory Hierarchy Level: Level 1
Timeout: No
Record Number: 93393
Source Name: Microsoft-Windows-WHEA-Logger
Time Written: 20090309221934.509000-000
Event Type: Warning
User: NT AUTHORITY\LOCAL SERVICE

Computer Name: cdoo-PC
Event Code: 19
Message: A corrected hardware error occurred.

Error Source: Corrected Machine Check

Error Type: Bus/Interconnect Error

Processor ID Valid: Yes
Processor ID: 0x1
Bank Number: 1
Transaction Type: N/A
Processor Participation: Generic
Request Type: 14
Memory/Io: Memory
Memory Hierarchy Level: Level 0
Timeout: Yes
Record Number: 93392
Source Name: Microsoft-Windows-WHEA-Logger
Time Written: 20090309221834.508000-000
Event Type: Warning
User: NT AUTHORITY\LOCAL SERVICE

Computer Name: cdoo-PC
Event Code: 1003
Message: Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 001A73AA7234. The following error occurred:
The operation was canceled by the user.. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
Record Number: 93386
Source Name: Microsoft-Windows-Dhcp-Client
Time Written: 20090309221743.000000-000
Event Type: Warning
User:

=====Application event log=====

Computer Name: cdoo-PC
Event Code: 1530
Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-2882669810-3521172830-2515113265-1000:
Process 888 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2882669810-3521172830-2515113265-1000

Record Number: 64944
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20080320112048.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: cdoo-PC
Event Code: 1002
Message: The program iexplore.exe version 7.0.6000.16609 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 5f4 Start Time: 01c887813523d1d0 Termination Time: 0
Record Number: 62021
Source Name: Application Hang
Time Written: 20080316212756.000000-000
Event Type: Error
User:

Computer Name: cdoo-PC
Event Code: 1000
Message: Faulting application iexplore.exe, version 7.0.6000.16609, time stamp 0x47575b9a, faulting module Flash9d.ocx, version 9.0.47.0, time stamp 0x466daac0, exception code 0xc0000005, fault offset 0x00099a25, process id 0x804, application start time 0x01c882984b3435ec.
Record Number: 58623
Source Name: Application Error
Time Written: 20080311221501.000000-000
Event Type: Error
User:

Computer Name: cdoo-PC
Event Code: 1000
Message: Faulting application iexplore.exe, version 7.0.6000.16609, time stamp 0x47575b9a, faulting module Flash9d.ocx, version 9.0.47.0, time stamp 0x466daac0, exception code 0xc0000005, fault offset 0x00099a25, process id 0x738, application start time 0x01c87fcf1ffb0ddf.
Record Number: 55619
Source Name: Application Error
Time Written: 20080306211958.000000-000
Event Type: Error
User:

Computer Name: cdoo-PC
Event Code: 1000
Message: Faulting application iexplore.exe, version 7.0.6000.16609, time stamp 0x47575b9a, faulting module Flash9d.ocx, version 9.0.47.0, time stamp 0x466daac0, exception code 0xc0000005, fault offset 0x00099a25, process id 0xc5c, application start time 0x01c87f6db3795fd0.
Record Number: 55387
Source Name: Application Error
Time Written: 20080306111631.000000-000
Event Type: Error
User:

=====Security event log=====

Computer Name: cdoo-PC
Event Code: 4672
Message: Special privileges assigned to new logon.

Subject:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7

Privileges: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 5193
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080109105842.718550-000
Event Type: Audit Success
User:

Computer Name: cdoo-PC
Event Code: 4624
Message: An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: CDOO-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7

Logon Type: 5

New Logon:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x280
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name:
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 5192
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080109105842.718550-000
Event Type: Audit Success
User:

Computer Name: cdoo-PC
Event Code: 4648
Message: A logon was attempted using explicit credentials.

Subject:
Security ID: S-1-5-18
Account Name: CDOO-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon GUID: {00000000-0000-0000-0000-000000000000}

Target Server:
Target Server Name: localhost
Additional Information: localhost

Process Information:
Process ID: 0x280
Process Name: C:\Windows\System32\services.exe

Network Information:
Network Address: -
Port: -

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Record Number: 5191
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080109105842.718550-000
Event Type: Audit Success
User:

Computer Name: cdoo-PC
Event Code: 4672
Message: Special privileges assigned to new logon.

Subject:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7

Privileges: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 5190
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080109105842.656150-000
Event Type: Audit Success
User:

Computer Name: cdoo-PC
Event Code: 4624
Message: An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: CDOO-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7

Logon Type: 5

New Logon:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x280
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name:
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 5189
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080109105842.656150-000
Event Type: Audit Success
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 104 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=6801
"NUMBER_OF_PROCESSORS"=2
"OnlineServices"=Online Services
"Path"=%CommonProgramFiles%\Microsoft Shared\Windows Live;%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\Common Files\Roxio Shared\DLLShared;C:\Program Files\Common Files\Roxio Shared\DLLShared;C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared;C:\Program Files\QuickTime\QTSystem;C:\Program Files\QuickTime\QTSystem\;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\
"PCBRAND"=Pavilion
"PLATFORM"=MCD
"RoxioCentral"=C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\
"USERPART"=E:
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip

-----------------EOF-----------------
cdoolake
Regular Member
 
Posts: 20
Joined: November 12th, 2009, 3:07 pm

Re: avg detected nircmd.exe trojan

Unread postby cdoolake » November 18th, 2009, 9:01 pm

ok here is the rest of it..

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2009-11-18 19:03:24
Microsoft® Windows Vista™ Ultimate Service Pack 2
System drive C: has 9 GB (6%) free of 144 GB
Total RAM: 1982 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:03:41 PM, on 11/18/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Users\Administrator\Downloads\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://downloads.yahoo.com/internetexplorer/welcome
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [AIMPro] "C:\Program Files\AIM\AIM Pro\aimpro.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net ... plugin.cab
O16 - DPF: {0C92900E-4D5A-4F04-ACC9-729E1767BBAE} (Image Uploader Control) - http://cordcamera.lifepics.com/net/Uplo ... ader45.cab
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resour ... cctrl2.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/i ... ection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/s ... DEXAXO.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxdjCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdjserv.exe
O23 - Service: lxdj_device - - C:\Windows\system32\lxdjcoms.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 11100 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Google Software Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\Spybot - Search & Destroy - Scheduled Task.job
C:\Windows\tasks\User_Feed_Synchronization-{076BC371-225E-46F2-BABB-7462A6B73100}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2008-11-20 911600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2009-11-04 1111320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll [2007-09-25 501136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-03-30 403824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-03-24 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
SingleInstance Class - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll [2008-11-20 160496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2008-11-20 911600]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"SynTPStart"=C:\Program Files\Synaptics\SynTP\SynTPStart.exe [2007-09-15 102400]
"AIMPro"=C:\Program Files\AIM\AIM Pro\aimpro.exe []
"HP Health Check Scheduler"=C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2007-03-12 50696]
"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2007-03-01 472776]
"QPService"=C:\Program Files\HP\QuickPlay\QPService.exe [2007-04-23 176128]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-09-15 1021224]
"WAWifiMessage"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [2007-01-10 317128]
"QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2007-02-13 159744]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2009-11-04 2028312]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-12-04 13556256]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-12-04 92704]
"ddoctorv2"=C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe [2008-04-24 202560]
""= []
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-10-28 141600]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]
"WindowsWelcomeCenter"=oobefldr.dll,ShowWelcomeCenter []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="avgrsstx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll [2008-01-23 233888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"RunStartupScriptSync"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\Program Files\Lexmark 1400 Series\app4r.exe"="C:\Program Files\Lexmark 1400 Series\app4r.exe:*:Enabled:Printing Application"

======List of files/folders created in the last 1 months======

2009-11-18 19:03:24 ----D---- C:\rsit
2009-11-18 05:22:36 ----D---- C:\Program Files\Windows Portable Devices
2009-11-17 19:51:33 ----A---- C:\Windows\system32\UIAnimation.dll
2009-11-17 19:51:32 ----A---- C:\Windows\system32\UIRibbonRes.dll
2009-11-17 19:51:32 ----A---- C:\Windows\system32\UIRibbon.dll
2009-11-17 19:50:49 ----A---- C:\Windows\system32\WMPhoto.dll
2009-11-17 19:50:47 ----A---- C:\Windows\system32\cdd.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\XpsRasterService.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\XpsPrint.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\WindowsCodecs.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe
2009-11-17 19:50:46 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\dxdiagn.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\dxdiag.exe
2009-11-17 19:50:46 ----A---- C:\Windows\system32\d3d10warp.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\d2d1.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\xpsservices.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\OpcServices.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\FntCache.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\dxgi.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\DWrite.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d11.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d10level9.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d10core.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d10_1core.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d10_1.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d10.dll
2009-11-17 19:49:50 ----A---- C:\Windows\system32\WPDShextAutoplay.exe
2009-11-17 19:49:50 ----A---- C:\Windows\system32\wpdbusenum.dll
2009-11-17 19:49:50 ----A---- C:\Windows\system32\BthMtpContextHandler.dll
2009-11-17 19:49:41 ----A---- C:\Windows\system32\PortableDeviceConnectApi.dll
2009-11-17 19:49:37 ----A---- C:\Windows\system32\wpdshext.dll
2009-11-17 19:49:37 ----A---- C:\Windows\system32\WpdMtpUS.dll
2009-11-17 19:49:37 ----A---- C:\Windows\system32\WpdConns.dll
2009-11-17 19:49:37 ----A---- C:\Windows\system32\wpd_ci.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\WPDSp.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\WPDShServiceObj.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\WpdMtp.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\PortableDeviceWMDRM.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\PortableDeviceTypes.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2009-11-17 19:47:25 ----A---- C:\Windows\system32\oleaccrc.dll
2009-11-17 19:47:23 ----A---- C:\Windows\system32\UIAutomationCore.dll
2009-11-17 19:47:23 ----A---- C:\Windows\system32\oleacc.dll
2009-11-16 14:09:13 ----D---- C:\Users\Administrator\AppData\Roaming\Mozilla
2009-11-14 20:20:47 ----D---- C:\Program Files\Common Files\Adobe
2009-11-14 20:17:42 ----D---- C:\Program Files\Common Files\Adobe AIR
2009-11-14 20:15:50 ----D---- C:\ProgramData\NOS
2009-11-14 20:12:03 ----D---- C:\Program Files\Adobe
2009-11-12 13:37:50 ----D---- C:\Program Files\Trend Micro
2009-11-10 20:07:46 ----A---- C:\Windows\system32\WSDApi.dll
2009-11-10 16:28:34 ----D---- C:\ProgramData\Verizon Wireless
2009-11-10 16:24:09 ----D---- C:\Program Files\Novatel Wireless
2009-11-08 14:56:45 ----D---- C:\Windows\system32\eu-ES
2009-11-08 14:56:45 ----D---- C:\Windows\system32\ca-ES
2009-11-08 14:56:41 ----D---- C:\Windows\system32\vi-VN
2009-11-08 14:36:55 ----D---- C:\Windows\system32\EventProviders
2009-11-08 07:27:48 ----A---- C:\Windows\system32\NlsLexicons0007.dll
2009-11-08 07:27:34 ----A---- C:\Windows\system32\SLsvc.exe
2009-11-08 07:27:34 ----A---- C:\Windows\system32\SLCExt.dll
2009-11-08 07:27:32 ----A---- C:\Windows\system32\FunctionDiscoveryFolder.dll
2009-11-08 07:27:32 ----A---- C:\Windows\system32\DevicePairingWizard.exe
2009-11-08 07:27:30 ----A---- C:\Windows\system32\NlsLexicons0009.dll
2009-11-08 07:27:25 ----A---- C:\Windows\system32\mssrch.dll
2009-11-08 07:27:22 ----A---- C:\Windows\system32\tquery.dll
2009-11-08 07:27:21 ----A---- C:\Windows\system32\PresentationNative_v0300.dll
2009-11-08 07:27:20 ----A---- C:\Windows\system32\RMActivate_isv.exe
2009-11-08 07:27:19 ----A---- C:\Windows\system32\scavenge.dll
2009-11-08 07:27:19 ----A---- C:\Windows\system32\RMActivate.exe
2009-11-08 07:27:18 ----A---- C:\Windows\system32\msi.dll
2009-11-08 07:27:17 ----A---- C:\Windows\system32\imapi2fs.dll
2009-11-08 07:27:15 ----A---- C:\Windows\system32\secproc_isv.dll
2009-11-08 07:27:14 ----A---- C:\Windows\system32\WscEapPr.dll
2009-11-08 07:27:14 ----A---- C:\Windows\system32\wcnwiz2.dll
2009-11-08 07:27:14 ----A---- C:\Windows\system32\sysmain.dll
2009-11-08 07:27:12 ----A---- C:\Windows\system32\icardagt.exe
2009-11-08 07:27:10 ----A---- C:\Windows\system32\EhStorShell.dll
2009-11-08 07:27:10 ----A---- C:\Windows\system32\AuxiliaryDisplayCpl.dll
2009-11-08 07:27:09 ----A---- C:\Windows\system32\spreview.exe
2009-11-08 07:27:09 ----A---- C:\Windows\system32\spinstall.exe
2009-11-08 07:27:09 ----A---- C:\Windows\system32\drmv2clt.dll
2009-11-08 07:27:01 ----A---- C:\Windows\system32\spwizui.dll
2009-11-08 07:27:00 ----A---- C:\Windows\system32\secproc.dll
2009-11-08 07:27:00 ----A---- C:\Windows\system32\mcupdate_GenuineIntel.dll
2009-11-08 07:26:58 ----A---- C:\Windows\system32\shell32.dll
2009-11-08 07:26:56 ----A---- C:\Windows\system32\SearchIndexer.exe
2009-11-08 07:26:56 ----A---- C:\Windows\system32\p2psvc.dll
2009-11-08 07:26:56 ----A---- C:\Windows\system32\mssvp.dll
2009-11-08 07:26:55 ----A---- C:\Windows\system32\mscoree.dll
2009-11-08 07:26:54 ----A---- C:\Windows\system32\mssphtb.dll
2009-11-08 07:26:54 ----A---- C:\Windows\system32\mssph.dll
2009-11-08 07:26:54 ----A---- C:\Windows\system32\MSMPEG2VDEC.DLL
2009-11-08 07:26:54 ----A---- C:\Windows\system32\imapi2.dll
2009-11-08 07:26:53 ----A---- C:\Windows\system32\sdohlp.dll
2009-11-08 07:26:53 ----A---- C:\Windows\system32\esent.dll
2009-11-08 07:26:52 ----A---- C:\Windows\system32\IMJP10K.DLL
2009-11-08 07:26:52 ----A---- C:\Windows\system32\DevicePairing.dll
2009-11-08 07:26:51 ----A---- C:\Windows\system32\wevtsvc.dll
2009-11-08 07:26:51 ----A---- C:\Windows\system32\sperror.dll
2009-11-08 07:26:51 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2009-11-08 07:26:51 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2009-11-08 07:26:51 ----A---- C:\Windows\system32\korwbrkr.dll
2009-11-08 07:26:50 ----A---- C:\Windows\system32\SLC.dll
2009-11-08 07:26:50 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2009-11-08 07:26:50 ----A---- C:\Windows\system32\IasMigReader.exe
2009-11-08 07:26:49 ----A---- C:\Windows\system32\msshsq.dll
2009-11-08 07:26:48 ----A---- C:\Windows\system32\pmcsnap.dll
2009-11-08 07:26:47 ----A---- C:\Windows\system32\msjet40.dll
2009-11-08 07:26:47 ----A---- C:\Windows\system32\MPSSVC.dll
2009-11-08 07:26:46 ----A---- C:\Windows\system32\Query.dll
2009-11-08 07:26:46 ----A---- C:\Windows\system32\qmgr.dll
2009-11-08 07:26:46 ----A---- C:\Windows\system32\msxml6.dll
2009-11-08 07:26:45 ----A---- C:\Windows\system32\P2PGraph.dll
2009-11-08 07:26:45 ----A---- C:\Windows\system32\msexch40.dll
2009-11-08 07:26:45 ----A---- C:\Windows\system32\diagperf.dll
2009-11-08 07:26:44 ----A---- C:\Windows\system32\srchadmin.dll
2009-11-08 07:26:44 ----A---- C:\Windows\system32\ole32.dll
2009-11-08 07:26:44 ----A---- C:\Windows\system32\ntdll.dll
2009-11-08 07:26:43 ----A---- C:\Windows\system32\winload.exe
2009-11-08 07:26:43 ----A---- C:\Windows\system32\uDWM.dll
2009-11-08 07:26:43 ----A---- C:\Windows\system32\msxml3.dll
2009-11-08 07:26:43 ----A---- C:\Windows\system32\mmc.exe
2009-11-08 07:26:43 ----A---- C:\Windows\system32\mblctr.exe
2009-11-08 07:26:43 ----A---- C:\Windows\system32\EncDec.dll
2009-11-08 07:26:42 ----A---- C:\Windows\system32\riched20.dll
2009-11-08 07:26:42 ----A---- C:\Windows\system32\IasMigPlugin.dll
2009-11-08 07:26:42 ----A---- C:\Windows\system32\dfsr.exe
2009-11-08 07:26:41 ----A---- C:\Windows\system32\RacEngn.dll
2009-11-08 07:26:41 ----A---- C:\Windows\system32\fdBth.dll
2009-11-08 07:26:40 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2009-11-08 07:26:40 ----A---- C:\Windows\system32\SearchFilterHost.exe
2009-11-08 07:26:40 ----A---- C:\Windows\system32\milcore.dll
2009-11-08 07:26:40 ----A---- C:\Windows\system32\kernel32.dll
2009-11-08 07:26:39 ----A---- C:\Windows\system32\spoolss.dll
2009-11-08 07:26:39 ----A---- C:\Windows\system32\schedsvc.dll
2009-11-08 07:26:39 ----A---- C:\Windows\system32\NaturalLanguage6.dll
2009-11-08 07:26:39 ----A---- C:\Windows\system32\EhStorAPI.dll
2009-11-08 07:26:39 ----A---- C:\Windows\system32\CertEnroll.dll
2009-11-08 07:26:38 ----A---- C:\Windows\system32\msjtes40.dll
2009-11-08 07:26:38 ----A---- C:\Windows\system32\AuxiliaryDisplayDriverLib.dll
2009-11-08 07:26:37 ----A---- C:\Windows\system32\msvcp60.dll
2009-11-08 07:26:37 ----A---- C:\Windows\system32\gpedit.dll
2009-11-08 07:26:36 ----A---- C:\Windows\system32\infocardapi.dll
2009-11-08 07:26:35 ----A---- C:\Windows\system32\WinSAT.exe
2009-11-08 07:26:34 ----A---- C:\Windows\system32\PresentationSettings.exe
2009-11-08 07:26:34 ----A---- C:\Windows\system32\Magnify.exe
2009-11-08 07:26:34 ----A---- C:\Windows\system32\fveapi.dll
2009-11-08 07:26:34 ----A---- C:\Windows\system32\es.dll
2009-11-08 07:26:34 ----A---- C:\Windows\system32\cscsvc.dll
2009-11-08 07:26:34 ----A---- C:\Windows\system32\AuxiliaryDisplayServices.dll
2009-11-08 07:26:33 ----A---- C:\Windows\system32\mstext40.dll
2009-11-08 07:26:33 ----A---- C:\Windows\system32\advapi32.dll
2009-11-08 07:26:32 ----A---- C:\Windows\system32\WebClnt.dll
2009-11-08 07:26:31 ----A---- C:\Windows\system32\slwmi.dll
2009-11-08 07:26:31 ----A---- C:\Windows\system32\msexcl40.dll
2009-11-08 07:26:31 ----A---- C:\Windows\system32\comsvcs.dll
2009-11-08 07:26:30 ----A---- C:\Windows\system32\vssapi.dll
2009-11-08 07:26:30 ----A---- C:\Windows\system32\msxbde40.dll
2009-11-08 07:26:30 ----A---- C:\Windows\system32\msfeeds.dll
2009-11-08 07:26:29 ----A---- C:\Windows\system32\vbscript.dll
2009-11-08 07:26:29 ----A---- C:\Windows\system32\NetProjW.dll
2009-11-08 07:26:29 ----A---- C:\Windows\system32\authui.dll
2009-11-08 07:26:28 ----A---- C:\Windows\system32\propsys.dll
2009-11-08 07:26:28 ----A---- C:\Windows\system32\PresentationHost.exe
2009-11-08 07:26:28 ----A---- C:\Windows\system32\newdev.dll
2009-11-08 07:26:28 ----A---- C:\Windows\system32\msrepl40.dll
2009-11-08 07:26:27 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-11-08 07:26:27 ----A---- C:\Windows\system32\iasrecst.dll
2009-11-08 07:26:27 ----A---- C:\Windows\system32\gpsvc.dll
2009-11-08 07:26:27 ----A---- C:\Windows\system32\eudcedit.exe
2009-11-08 07:26:27 ----A---- C:\Windows\system32\crypt32.dll
2009-11-08 07:26:27 ----A---- C:\Windows\explorer.exe
2009-11-08 07:26:26 ----A---- C:\Windows\system32\setupapi.dll
2009-11-08 07:26:26 ----A---- C:\Windows\system32\rpcss.dll
2009-11-08 07:26:26 ----A---- C:\Windows\system32\mspbde40.dll
2009-11-08 07:26:26 ----A---- C:\Windows\system32\iedkcs32.dll
2009-11-08 07:26:26 ----A---- C:\Windows\system32\d3d9.dll
2009-11-08 07:26:25 ----A---- C:\Windows\system32\msltus40.dll
2009-11-08 07:26:25 ----A---- C:\Windows\system32\mfc42.dll
2009-11-08 07:26:25 ----A---- C:\Windows\system32\davclnt.dll
2009-11-08 07:26:24 ----A---- C:\Windows\system32\shlwapi.dll
2009-11-08 07:26:24 ----A---- C:\Windows\system32\msrd3x40.dll
2009-11-08 07:26:24 ----A---- C:\Windows\system32\msdtctm.dll
2009-11-08 07:26:24 ----A---- C:\Windows\system32\EhStorPwdMgr.dll
2009-11-08 07:26:24 ----A---- C:\Windows\system32\EhStorAuthn.dll
2009-11-08 07:26:23 ----A---- C:\Windows\system32\wevtapi.dll
2009-11-08 07:26:23 ----A---- C:\Windows\system32\photowiz.dll
2009-11-08 07:26:23 ----A---- C:\Windows\system32\nlhtml.dll
2009-11-08 07:26:23 ----A---- C:\Windows\system32\browseui.dll
2009-11-08 07:26:20 ----A---- C:\Windows\system32\user32.dll
2009-11-08 07:26:19 ----A---- C:\Windows\system32\win32spl.dll
2009-11-08 07:26:19 ----A---- C:\Windows\system32\samsrv.dll
2009-11-08 07:26:19 ----A---- C:\Windows\system32\quartz.dll
2009-11-08 07:26:19 ----A---- C:\Windows\system32\ci.dll
2009-11-08 07:26:18 ----A---- C:\Windows\system32\WcnNetsh.dll
2009-11-08 07:26:18 ----A---- C:\Windows\system32\SLCommDlg.dll
2009-11-08 07:26:18 ----A---- C:\Windows\system32\oleaut32.dll
2009-11-08 07:26:18 ----A---- C:\Windows\system32\kerberos.dll
2009-11-08 07:26:18 ----A---- C:\Windows\system32\IKEEXT.DLL
2009-11-08 07:26:17 ----A---- C:\Windows\system32\winhttp.dll
2009-11-08 07:26:17 ----A---- C:\Windows\system32\netshell.dll
2009-11-08 07:26:17 ----A---- C:\Windows\system32\compcln.exe
2009-11-08 07:26:17 ----A---- C:\Windows\system32\apds.dll
2009-11-08 07:26:16 ----A---- C:\Windows\system32\xmlfilter.dll
2009-11-08 07:26:16 ----A---- C:\Windows\system32\mswstr10.dll
2009-11-08 07:26:16 ----A---- C:\Windows\system32\msctf.dll
2009-11-08 07:26:16 ----A---- C:\Windows\system32\emdmgmt.dll
2009-11-08 07:26:16 ----A---- C:\Windows\system32\audiosrv.dll
2009-11-08 07:26:15 ----A---- C:\Windows\system32\VSSVC.exe
2009-11-08 07:26:15 ----A---- C:\Windows\system32\QAGENTRT.DLL
2009-11-08 07:26:15 ----A---- C:\Windows\system32\msvcrt.dll
2009-11-08 07:26:15 ----A---- C:\Windows\system32\mfc42u.dll
2009-11-08 07:26:15 ----A---- C:\Windows\system32\iphlpsvc.dll
2009-11-08 07:26:15 ----A---- C:\Windows\system32\gdi32.dll
2009-11-08 07:26:14 ----A---- C:\Windows\system32\SLUI.exe
2009-11-08 07:26:14 ----A---- C:\Windows\system32\msrd2x40.dll
2009-11-08 07:26:14 ----A---- C:\Windows\system32\eapphost.dll
2009-11-08 07:26:13 ----A---- C:\Windows\system32\wbengine.exe
2009-11-08 07:26:13 ----A---- C:\Windows\system32\sqlsrv32.dll
2009-11-08 07:26:13 ----A---- C:\Windows\system32\odbc32.dll
2009-11-08 07:26:12 ----A---- C:\Windows\system32\winresume.exe
2009-11-08 07:26:12 ----A---- C:\Windows\system32\shdocvw.dll
2009-11-08 07:26:12 ----A---- C:\Windows\system32\propdefs.dll
2009-11-08 07:26:11 ----A---- C:\Windows\system32\wevtutil.exe
2009-11-08 07:26:11 ----A---- C:\Windows\system32\dbgeng.dll
2009-11-08 07:26:10 ----A---- C:\Windows\system32\mssitlb.dll
2009-11-08 07:26:09 ----A---- C:\Windows\system32\WsmSvc.dll
2009-11-08 07:26:09 ----A---- C:\Windows\system32\usp10.dll
2009-11-08 07:26:09 ----A---- C:\Windows\system32\swprv.dll
2009-11-08 07:26:09 ----A---- C:\Windows\system32\mmcndmgr.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\vds.exe
2009-11-08 07:26:08 ----A---- C:\Windows\system32\netlogon.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\msscb.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\mshtmled.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\msctfp.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\fdBthProxy.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\drvinst.exe
2009-11-08 07:26:08 ----A---- C:\Windows\system32\devmgr.dll
2009-11-08 07:26:07 ----A---- C:\Windows\system32\DevicePairingProxy.dll
2009-11-08 07:26:07 ----A---- C:\Windows\system32\BFE.DLL
2009-11-08 07:26:07 ----A---- C:\Windows\system32\adsldpc.dll
2009-11-08 07:26:06 ----A---- C:\Windows\system32\Wldap32.dll
2009-11-08 07:26:06 ----A---- C:\Windows\system32\WFS.exe
2009-11-08 07:26:06 ----A---- C:\Windows\system32\wcnwiz.dll
2009-11-08 07:26:06 ----A---- C:\Windows\system32\schannel.dll
2009-11-08 07:26:06 ----A---- C:\Windows\system32\evr.dll
2009-11-08 07:26:05 ----A---- C:\Windows\system32\WMVSDECD.DLL
2009-11-08 07:26:05 ----A---- C:\Windows\system32\services.exe
2009-11-08 07:26:04 ----A---- C:\Windows\system32\wercon.exe
2009-11-08 07:26:04 ----A---- C:\Windows\system32\wcncsvc.dll
2009-11-08 07:26:04 ----A---- C:\Windows\system32\mimefilt.dll
2009-11-08 07:26:04 ----A---- C:\Windows\system32\iertutil.dll
2009-11-08 07:26:04 ----A---- C:\Windows\system32\comdlg32.dll
2009-11-08 07:26:04 ----A---- C:\Windows\system32\adtschema.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\taskeng.exe
2009-11-08 07:26:03 ----A---- C:\Windows\system32\rtffilt.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\reg.exe
2009-11-08 07:26:03 ----A---- C:\Windows\system32\mswdat10.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\msjter40.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\msdtcprx.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\msdrm.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\ipsmsnap.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\dnsapi.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\certcli.dll
2009-11-08 07:26:02 ----A---- C:\Windows\system32\WMNetMgr.dll
2009-11-08 07:26:02 ----A---- C:\Windows\system32\umpnpmgr.dll
2009-11-08 07:26:02 ----A---- C:\Windows\system32\certutil.exe
2009-11-08 07:26:01 ----A---- C:\Windows\system32\w32time.dll
2009-11-08 07:26:01 ----A---- C:\Windows\system32\IPSECSVC.DLL
2009-11-08 07:26:00 ----A---- C:\Windows\system32\rsaenh.dll
2009-11-08 07:26:00 ----A---- C:\Windows\system32\msshooks.dll
2009-11-08 07:26:00 ----A---- C:\Windows\system32\msscntrs.dll
2009-11-08 07:26:00 ----A---- C:\Windows\system32\bthserv.dll
2009-11-08 07:26:00 ----A---- C:\Windows\system32\bcrypt.dll
2009-11-08 07:25:59 ----A---- C:\Windows\system32\msihnd.dll
2009-11-08 07:25:58 ----A---- C:\Windows\system32\TsWpfWrp.exe
2009-11-08 07:25:58 ----A---- C:\Windows\system32\MMDevAPI.dll
2009-11-08 07:25:57 ----A---- C:\Windows\system32\msstrc.dll
2009-11-08 07:25:56 ----A---- C:\Windows\system32\scrptadm.dll
2009-11-08 07:25:56 ----A---- C:\Windows\system32\inetcomm.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\netapi32.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\mtxclu.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\mscories.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\inetpp.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\hidserv.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\fundisc.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\dfshim.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\cryptsvc.dll
2009-11-08 07:25:54 ----A---- C:\Windows\system32\wmicmiplugin.dll
2009-11-08 07:25:54 ----A---- C:\Windows\system32\termsrv.dll
2009-11-08 07:25:54 ----A---- C:\Windows\system32\profsvc.dll
2009-11-08 07:25:54 ----A---- C:\Windows\system32\dhcpcsvc6.dll
2009-11-08 07:25:53 ----A---- C:\Windows\system32\wdc.dll
2009-11-08 07:25:53 ----A---- C:\Windows\system32\shsvcs.dll
2009-11-08 07:25:53 ----A---- C:\Windows\system32\msiexec.exe
2009-11-08 07:25:53 ----A---- C:\Windows\system32\imapi.dll
2009-11-08 07:25:53 ----A---- C:\Windows\system32\chsbrkr.dll
2009-11-08 07:25:52 ----A---- C:\Windows\system32\spoolsv.exe
2009-11-08 07:25:52 ----A---- C:\Windows\system32\rasmans.dll
2009-11-08 07:25:52 ----A---- C:\Windows\system32\pnidui.dll
2009-11-08 07:25:52 ----A---- C:\Windows\system32\icardres.dll
2009-11-08 07:25:52 ----A---- C:\Windows\system32\iassdo.dll
2009-11-08 07:25:52 ----A---- C:\Windows\system32\autofmt.exe
2009-11-08 07:25:51 ----A---- C:\Windows\system32\wersvc.dll
2009-11-08 07:25:51 ----A---- C:\Windows\system32\slmgr.vbs
2009-11-08 07:25:51 ----A---- C:\Windows\system32\scrrun.dll
2009-11-08 07:25:51 ----A---- C:\Windows\system32\PSHED.DLL
2009-11-08 07:25:50 ----A---- C:\Windows\system32\pidgenx.dll
2009-11-08 07:25:50 ----A---- C:\Windows\system32\pdh.dll
2009-11-08 07:25:50 ----A---- C:\Windows\system32\dhcpcsvc.dll
2009-11-08 07:25:50 ----A---- C:\Windows\system32\CertEnrollUI.dll
2009-11-08 07:25:50 ----A---- C:\Windows\system32\azroles.dll
2009-11-08 07:25:49 ----A---- C:\Windows\system32\wmpmde.dll
2009-11-08 07:25:49 ----A---- C:\Windows\system32\winlogon.exe
2009-11-08 07:25:49 ----A---- C:\Windows\system32\SyncCenter.dll
2009-11-08 07:25:48 ----A---- C:\Windows\system32\SLUINotify.dll
2009-11-08 07:25:48 ----A---- C:\Windows\system32\msjetoledb40.dll
2009-11-08 07:25:48 ----A---- C:\Windows\system32\comuid.dll
2009-11-08 07:25:47 ----A---- C:\Windows\system32\spp.dll
2009-11-08 07:25:47 ----A---- C:\Windows\system32\sethc.exe
2009-11-08 07:25:47 ----A---- C:\Windows\system32\ncrypt.dll
2009-11-08 07:25:47 ----A---- C:\Windows\system32\kd1394.dll
2009-11-08 07:25:47 ----A---- C:\Windows\system32\iassam.dll
2009-11-08 07:25:47 ----A---- C:\Windows\system32\certmgr.dll
2009-11-08 07:25:46 ----A---- C:\Windows\system32\wisptis.exe
2009-11-08 07:25:46 ----A---- C:\Windows\system32\untfs.dll
2009-11-08 07:25:46 ----A---- C:\Windows\system32\taskcomp.dll
2009-11-08 07:25:46 ----A---- C:\Windows\system32\scrobj.dll
2009-11-08 07:25:46 ----A---- C:\Windows\system32\rtutils.dll
2009-11-08 07:25:46 ----A---- C:\Windows\system32\dwm.exe
2009-11-08 07:25:45 ----A---- C:\Windows\system32\iasnap.dll
2009-11-08 07:25:45 ----A---- C:\Windows\system32\cscui.dll
2009-11-08 07:25:45 ----A---- C:\Windows\system32\autochk.exe
2009-11-08 07:25:44 ----A---- C:\Windows\system32\winsrv.dll
2009-11-08 07:25:44 ----A---- C:\Windows\system32\printui.dll
2009-11-08 07:25:44 ----A---- C:\Windows\system32\cscript.exe
2009-11-08 07:25:44 ----A---- C:\Windows\system32\autoconv.exe
2009-11-08 07:25:43 ----A---- C:\Windows\system32\wow32.dll
2009-11-08 07:25:43 ----A---- C:\Windows\system32\userenv.dll
2009-11-08 07:25:43 ----A---- C:\Windows\system32\onex.dll
2009-11-08 07:25:43 ----A---- C:\Windows\system32\kdcom.dll
2009-11-08 07:25:43 ----A---- C:\Windows\system32\basecsp.dll
2009-11-08 07:25:43 ----A---- C:\Windows\system32\audiodg.exe
2009-11-08 07:25:42 ----A---- C:\Windows\system32\osk.exe
2009-11-08 07:25:42 ----A---- C:\Windows\system32\mswsock.dll
2009-11-08 07:25:40 ----A---- C:\Windows\system32\winmm.dll
2009-11-08 07:25:40 ----A---- C:\Windows\system32\spcmsg.dll
2009-11-08 07:25:40 ----A---- C:\Windows\system32\RelMon.dll
2009-11-08 07:25:40 ----A---- C:\Windows\system32\rdpencom.dll
2009-11-08 07:25:40 ----A---- C:\Windows\system32\kdusb.dll
2009-11-08 07:25:39 ----A---- C:\Windows\system32\WinSCard.dll
2009-11-08 07:25:39 ----A---- C:\Windows\system32\WerFaultSecure.exe
2009-11-08 07:25:39 ----A---- C:\Windows\system32\offfilt.dll
2009-11-08 07:25:39 ----A---- C:\Windows\system32\msftedit.dll
2009-11-08 07:25:39 ----A---- C:\Windows\system32\dnsrslvr.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\wsepno.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\WerFault.exe
2009-11-08 07:25:38 ----A---- C:\Windows\system32\Utilman.exe
2009-11-08 07:25:38 ----A---- C:\Windows\system32\stobject.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\secproc_ssp.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\mfplat.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\diskraid.exe
2009-11-08 07:25:37 ----A---- C:\Windows\system32\wiaservc.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\sysclass.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\SndVol.exe
2009-11-08 07:25:37 ----A---- C:\Windows\system32\prnntfy.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\msnetobj.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\mscms.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\mcmde.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\apphelp.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\adsmsext.dll
2009-11-08 07:25:36 ----A---- C:\Windows\system32\wscript.exe
2009-11-08 07:25:36 ----A---- C:\Windows\system32\ulib.dll
2009-11-08 07:25:36 ----A---- C:\Windows\system32\odbccp32.dll
2009-11-08 07:25:36 ----A---- C:\Windows\system32\iasdatastore.dll
2009-11-08 07:25:36 ----A---- C:\Windows\system32\dsound.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\wscntfy.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\rastapi.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\pnpsetup.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\ipsecsnp.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\IPHLPAPI.DLL
2009-11-08 07:25:35 ----A---- C:\Windows\system32\fdProxy.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\cryptui.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\wscsvc.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\WMVENCOD.DLL
2009-11-08 07:25:34 ----A---- C:\Windows\system32\wlangpui.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\vdsdyn.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\rastls.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\logman.exe
2009-11-08 07:25:34 ----A---- C:\Windows\system32\iepeers.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\iashlpr.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\gpapi.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\diskpart.exe
2009-11-08 07:25:34 ----A---- C:\Windows\system32\brcpl.dll
2009-11-08 07:25:33 ----A---- C:\Windows\system32\regsvc.dll
2009-11-08 07:25:33 ----A---- C:\Windows\system32\rasapi32.dll
2009-11-08 07:25:33 ----A---- C:\Windows\system32\ntprint.dll
2009-11-08 07:25:33 ----A---- C:\Windows\system32\mscorier.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\zipfldr.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\wusa.exe
2009-11-08 07:25:32 ----A---- C:\Windows\system32\wshext.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\wpccpl.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\netcenter.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\iasrad.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\findstr.exe
2009-11-08 07:25:31 ----A---- C:\Windows\system32\wer.dll
2009-11-08 07:25:31 ----A---- C:\Windows\system32\webcheck.dll
2009-11-08 07:25:31 ----A---- C:\Windows\system32\rasdlg.dll
2009-11-08 07:25:31 ----A---- C:\Windows\system32\iassvcs.dll
2009-11-08 07:25:30 ----A---- C:\Windows\system32\wsnmp32.dll
2009-11-08 07:25:30 ----A---- C:\Windows\system32\themecpl.dll
2009-11-08 07:25:29 ----A---- C:\Windows\system32\uxsms.dll
2009-11-08 07:25:29 ----A---- C:\Windows\system32\srvsvc.dll
2009-11-08 07:25:29 ----A---- C:\Windows\system32\mssprxy.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\tsbyuv.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\slcc.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\scansetting.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\powrprof.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\ntmarta.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\msutb.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\mstlsapi.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\iasads.dll
2009-11-08 07:25:27 ----A---- C:\Windows\system32\powercpl.dll
2009-11-08 07:25:27 ----A---- C:\Windows\system32\PerfCenterCPL.dll
2009-11-08 07:25:27 ----A---- C:\Windows\system32\networkmap.dll
2009-11-08 07:25:27 ----A---- C:\Windows\system32\mstsc.exe
2009-11-08 07:25:27 ----A---- C:\Windows\system32\iasacct.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\umrdp.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\sud.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\newdev.exe
2009-11-08 07:25:26 ----A---- C:\Windows\system32\fveui.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\dot3svc.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\connect.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\authz.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\themeui.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\systemcpl.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\samlib.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\pcaui.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\mmci.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\accessibilitycpl.dll
2009-11-08 07:25:24 ----A---- C:\Windows\system32\wlanpref.dll
2009-11-08 07:25:24 ----A---- C:\Windows\system32\usercpl.dll
2009-11-08 07:25:24 ----A---- C:\Windows\system32\qdvd.dll
2009-11-08 07:25:24 ----A---- C:\Windows\system32\brcplsiw.dll
2009-11-08 07:25:24 ----A---- C:\Windows\system32\autoplay.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\wpcao.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\vdsutil.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\tapisrv.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\rpchttp.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\regapi.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\msinfo32.exe
2009-11-08 07:25:23 ----A---- C:\Windows\system32\ieaksie.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\fvecpl.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\cscobj.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\wscisvif.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\scksp.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\scesrv.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\rekeywiz.exe
2009-11-08 07:25:22 ----A---- C:\Windows\system32\psisdecd.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\oleprn.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\mpr.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\imm32.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\iaspolcy.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\feclient.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\Faultrep.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\dot3msm.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\AudioSes.dll
2009-11-08 07:25:21 ----A---- C:\Windows\system32\WindowsUltimateExtrasCPL.dll
2009-11-08 07:25:21 ----A---- C:\Windows\system32\sdclt.exe
2009-11-08 07:25:21 ----A---- C:\Windows\system32\ncryptui.dll
2009-11-08 07:25:21 ----A---- C:\Windows\system32\dpapimig.exe
2009-11-08 07:25:21 ----A---- C:\Windows\system32\DeviceEject.exe
2009-11-08 07:25:20 ----A---- C:\Windows\system32\TSTheme.exe
2009-11-08 07:25:20 ----A---- C:\Windows\system32\SmartcardCredentialProvider.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\scecli.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\rasplap.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\rasgcw.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\qedit.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\pnpui.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\perfdisk.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\hdwwiz.exe
2009-11-08 07:25:20 ----A---- C:\Windows\system32\FWPUCLNT.DLL
2009-11-08 07:25:20 ----A---- C:\Windows\system32\extmgr.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\certreq.exe
2009-11-08 07:25:19 ----A---- C:\Windows\system32\whealogr.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\tcpmon.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\tcpipcfg.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\srcore.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\spwinsat.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\PnPUnattend.exe
2009-11-08 07:25:19 ----A---- C:\Windows\system32\fdWSD.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\cmmon32.exe
2009-11-08 07:25:18 ----A---- C:\Windows\system32\wiaaut.dll
2009-11-08 07:25:18 ----A---- C:\Windows\system32\SnippingTool.exe
2009-11-08 07:25:18 ----A---- C:\Windows\system32\SCardSvr.dll
2009-11-08 07:25:18 ----A---- C:\Windows\system32\raschap.dll
2009-11-08 07:25:18 ----A---- C:\Windows\system32\MSVidCtl.dll
2009-11-08 07:25:18 ----A---- C:\Windows\system32\fontext.dll
2009-11-08 07:25:18 ----A---- C:\Windows\system32\conime.exe
2009-11-08 07:25:18 ----A---- C:\Windows\system32\cmdial32.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\WMVXENCD.DLL
2009-11-08 07:25:17 ----A---- C:\Windows\system32\wlanui.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\shwebsvc.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\rasppp.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\PnPutil.exe
2009-11-08 07:25:17 ----A---- C:\Windows\system32\oobefldr.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\dsprop.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\dimsroam.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\shsetup.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\rasmontr.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\occache.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\mscandui.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\modemui.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\chtbrkr.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\wmdrmsdk.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\wlgpclnt.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\tscfgwmi.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\rdpwsx.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\dataclen.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\blackbox.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\WSDMon.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\wmpeffects.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\smss.exe
2009-11-08 07:25:14 ----A---- C:\Windows\system32\netplwiz.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\CscMig.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\credui.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\appmgmts.dll
2009-11-08 07:25:13 ----A---- C:\Windows\system32\wpcsvc.dll
2009-11-08 07:25:13 ----A---- C:\Windows\system32\networkexplorer.dll
2009-11-08 07:25:13 ----A---- C:\Windows\system32\mstime.dll
2009-11-08 07:25:13 ----A---- C:\Windows\system32\logagent.exe
2009-11-08 07:25:13 ----A---- C:\Windows\system32\ifmon.dll
2009-11-08 07:25:13 ----A---- C:\Windows\system32\cipher.exe
2009-11-08 07:25:13 ----A---- C:\Windows\system32\certprop.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\wscapi.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\msscp.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\msrating.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\msimtf.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\InkEd.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\gpresult.exe
2009-11-08 07:25:11 ----A---- C:\Windows\system32\thawbrkr.dll
2009-11-08 07:25:11 ----A---- C:\Windows\system32\softkbd.dll
2009-11-08 07:25:11 ----A---- C:\Windows\system32\sendmail.dll
2009-11-08 07:25:11 ----A---- C:\Windows\system32\MediaMetadataHandler.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\version.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\rdpclip.exe
2009-11-08 07:25:10 ----A---- C:\Windows\system32\puiapi.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\olepro32.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\msctfui.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\mprapi.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\input.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\gpprnext.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\ExplorerFrame.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\drmmgrtn.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\dmsynth.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\wshbth.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\SLLUA.exe
2009-11-08 07:25:09 ----A---- C:\Windows\system32\rdpendp.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\msjint40.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\msisip.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\MsCtfMonitor.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\fdSSDP.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\fc.exe
2009-11-08 07:25:09 ----A---- C:\Windows\system32\dmusic.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\cscapi.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\wsdchngr.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\tscupgrd.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\Storprop.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\SMBHelperClass.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\slcinst.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\rasdial.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\rasdiag.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\PrintBrmUi.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\nslookup.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\networkitemfactory.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\msfeedsbs.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\l2nacp.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\ipconfig.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\gpscript.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\ftp.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\fdWCN.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\eappcfg.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\eapp3hst.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\dot3cfg.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\cscdll.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\CHxReadingStringIME.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\bthudtask.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\bthci.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\qprocess.exe
2009-11-08 07:25:07 ----A---- C:\Windows\system32\ocsetup.exe
2009-11-08 07:25:07 ----A---- C:\Windows\system32\mmcico.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\hbaapi.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\gpscript.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\FwRemoteSvr.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\fdeploy.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\eappgnui.dll
2009-11-08 07:25:06 ----A---- C:\Windows\system32\tscon.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\shadow.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\PNPXAssoc.dll
2009-11-08 07:25:06 ----A---- C:\Windows\system32\NcdProp.dll
2009-11-08 07:25:06 ----A---- C:\Windows\system32\logoff.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\iscsilog.dll
2009-11-08 07:25:06 ----A---- C:\Windows\system32\gpupdate.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\csrstub.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\chgusr.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\chgport.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\cbsra.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\bitsigd.dll
2009-11-08 07:25:05 ----A---- C:\Windows\system32\vdmdbg.dll
2009-11-08 07:25:05 ----A---- C:\Windows\system32\tskill.exe
2009-11-08 07:25:05 ----A---- C:\Windows\system32\tsdiscon.exe
2009-11-08 07:25:05 ----A---- C:\Windows\system32\rwinsta.exe
2009-11-08 07:25:05 ----A---- C:\Windows\system32\qappsrv.exe
2009-11-08 07:25:05 ----A---- C:\Windows\system32\chglogon.exe
2009-11-08 07:25:04 ----A---- C:\Windows\system32\winrnr.dll
2009-11-08 07:25:04 ----A---- C:\Windows\system32\slwga.dll
2009-11-08 07:25:04 ----A---- C:\Windows\system32\reset.exe
2009-11-08 07:25:04 ----A---- C:\Windows\system32\query.exe
2009-11-08 07:25:04 ----A---- C:\Windows\system32\odbcconf.dll
2009-11-08 07:25:04 ----A---- C:\Windows\system32\midimap.dll
2009-11-08 07:25:04 ----A---- C:\Windows\system32\inetppui.dll
2009-11-08 07:25:04 ----A---- C:\Windows\system32\change.exe
2009-11-08 07:24:58 ----A---- C:\Windows\system32\f3ahvoas.dll
2009-11-08 07:24:57 ----A---- C:\Windows\system32\msimsg.dll
2009-11-08 07:24:41 ----A---- C:\Windows\system32\SmiEngine.dll
2009-11-08 07:24:37 ----A---- C:\Windows\system32\wdscore.dll
2009-11-08 07:24:37 ----A---- C:\Windows\system32\PkgMgr.exe
2009-11-08 07:24:28 ----A---- C:\Windows\system32\drvstore.dll
2009-11-07 20:39:49 ----D---- C:\ProgramData\AIM
2009-11-07 20:39:26 ----D---- C:\Program Files\AIM
2009-11-07 20:39:18 ----D---- C:\Program Files\Common Files\Software Update Utility
2009-11-07 20:38:45 ----D---- C:\ProgramData\AOL Downloads
2009-11-06 14:11:54 ----D---- C:\Program Files\BitLocker
2009-11-06 14:01:49 ----A---- C:\Windows\system32\SecureKeyBackupCPL.dll
2009-11-06 13:47:37 ----A---- C:\Windows\system32\netfxperf.dll
2009-11-06 13:46:33 ----D---- C:\Windows\system32\WindowsPowerShell
2009-11-06 13:44:27 ----D---- C:\Program Files\Microsoft
2009-11-05 09:03:47 ----A---- C:\Windows\system32\mshtml.dll
2009-11-04 06:31:29 ----A---- C:\Windows\system32\ieframe.dll
2009-11-04 06:31:27 ----A---- C:\Windows\system32\wininet.dll
2009-11-04 06:31:27 ----A---- C:\Windows\system32\urlmon.dll
2009-11-04 06:31:24 ----A---- C:\Windows\system32\ieui.dll
2009-11-04 06:31:24 ----A---- C:\Windows\system32\ieapfltr.dll
2009-11-04 06:31:22 ----A---- C:\Windows\system32\ieencode.dll
2009-11-04 06:10:14 ----A---- C:\Windows\system32\tzres.dll
2009-11-03 19:03:45 ----A---- C:\Windows\system32\netiohlp.dll
2009-11-03 19:03:43 ----A---- C:\Windows\system32\TCPSVCS.EXE
2009-11-03 19:03:43 ----A---- C:\Windows\system32\ROUTE.EXE
2009-11-03 19:03:43 ----A---- C:\Windows\system32\NETSTAT.EXE
2009-11-03 19:03:43 ----A---- C:\Windows\system32\MRINFO.EXE
2009-11-03 19:03:43 ----A---- C:\Windows\system32\HOSTNAME.EXE
2009-11-03 19:03:43 ----A---- C:\Windows\system32\finger.exe
2009-11-03 19:03:43 ----A---- C:\Windows\system32\ARP.EXE
2009-11-03 19:03:42 ----A---- C:\Windows\system32\netevent.dll
2009-11-03 19:02:59 ----A---- C:\Windows\system32\wlansvc.dll
2009-11-03 19:02:59 ----A---- C:\Windows\system32\wlanmsm.dll
2009-11-03 19:02:59 ----A---- C:\Windows\system32\wlanhlp.dll
2009-11-03 19:02:59 ----A---- C:\Windows\system32\L2SecHC.dll
2009-11-03 19:02:58 ----A---- C:\Windows\system32\wlansec.dll
2009-11-03 19:02:58 ----A---- C:\Windows\system32\wlanapi.dll
2009-11-03 19:02:51 ----A---- C:\Windows\system32\t2embed.dll
2009-11-03 19:02:51 ----A---- C:\Windows\system32\fontsub.dll
2009-11-03 19:02:51 ----A---- C:\Windows\system32\atmfd.dll
2009-11-03 19:02:50 ----A---- C:\Windows\system32\lpk.dll
2009-11-03 19:02:50 ----A---- C:\Windows\system32\dciman32.dll
2009-11-03 19:02:50 ----A---- C:\Windows\system32\atmlib.dll
2009-11-03 19:02:45 ----A---- C:\Windows\system32\lsasrv.dll
2009-11-03 19:02:44 ----A---- C:\Windows\system32\wdigest.dll
2009-11-03 19:02:44 ----A---- C:\Windows\system32\msv1_0.dll
2009-11-03 19:02:43 ----A---- C:\Windows\system32\secur32.dll
2009-11-03 19:02:42 ----A---- C:\Windows\system32\lsass.exe
2009-11-03 19:02:36 ----A---- C:\Windows\system32\WMVCORE.DLL
2009-11-03 19:02:36 ----A---- C:\Windows\system32\mf.dll
2009-11-03 19:02:35 ----A---- C:\Windows\system32\rrinstaller.exe
2009-11-03 19:02:35 ----A---- C:\Windows\system32\mfps.dll
2009-11-03 19:02:35 ----A---- C:\Windows\system32\mfpmp.exe
2009-11-03 19:02:34 ----A---- C:\Windows\system32\mferror.dll
2009-11-03 19:02:31 ----A---- C:\Windows\system32\atl.dll
2009-11-03 19:02:27 ----A---- C:\Windows\system32\ntkrnlpa.exe
2009-11-03 19:02:26 ----A---- C:\Windows\system32\ntoskrnl.exe
2009-11-03 19:02:08 ----A---- C:\Windows\system32\wkssvc.dll
2009-11-03 19:02:04 ----A---- C:\Windows\system32\mstscax.dll
2009-11-03 19:02:03 ----A---- C:\Windows\system32\tsgqec.dll
2009-11-03 19:02:03 ----A---- C:\Windows\system32\aaclient.dll
2009-11-03 19:01:27 ----A---- C:\Windows\system32\localspl.dll
2009-11-03 19:01:24 ----A---- C:\Windows\system32\avifil32.dll
2009-11-03 19:01:21 ----A---- C:\Windows\system32\jscript.dll
2009-11-03 19:01:05 ----A---- C:\Windows\system32\jsproxy.dll
2009-11-03 19:00:49 ----A---- C:\Windows\system32\wmpdxm.dll
2009-11-03 19:00:39 ----A---- C:\Windows\system32\gameux.dll
2009-11-03 19:00:38 ----A---- C:\Windows\system32\Apphlpdm.dll
2009-11-03 19:00:37 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2009-11-03 19:00:11 ----A---- C:\Windows\system32\msasn1.dll
2009-11-03 19:00:07 ----A---- C:\Windows\system32\rpcrt4.dll
2009-11-03 19:00:03 ----A---- C:\Windows\system32\WMSPDMOD.DLL
2009-11-03 18:59:52 ----A---- C:\Windows\system32\wmp.dll
2009-11-03 18:59:48 ----A---- C:\Windows\system32\unregmp2.exe
2009-11-03 18:59:47 ----A---- C:\Windows\system32\wmploc.DLL
2009-11-03 18:59:47 ----A---- C:\Windows\system32\spwmp.dll
2009-11-03 18:59:47 ----A---- C:\Windows\system32\dxmasf.dll
2009-11-03 18:29:33 ----A---- C:\Windows\system32\wups2.dll
2009-11-03 18:29:33 ----A---- C:\Windows\system32\wuauclt.exe
2009-11-03 18:29:32 ----A---- C:\Windows\system32\wucltux.dll
2009-11-03 18:29:32 ----A---- C:\Windows\system32\wuaueng.dll
2009-11-03 18:28:57 ----A---- C:\Windows\system32\wups.dll
2009-11-03 18:28:57 ----A---- C:\Windows\system32\wudriver.dll
2009-11-03 18:28:57 ----A---- C:\Windows\system32\wuapi.dll
2009-11-03 18:28:43 ----A---- C:\Windows\system32\wuwebv.dll
2009-11-03 18:28:43 ----A---- C:\Windows\system32\wuapp.exe
2009-11-03 16:40:34 ----N---- C:\Windows\system32\MpSigStub.exe
2009-11-03 14:40:48 ----A---- C:\Windows\system32\GEARAspi.dll
2009-11-03 14:39:31 ----D---- C:\Program Files\iPod
2009-11-03 14:39:28 ----D---- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-11-03 14:39:28 ----D---- C:\Program Files\iTunes
2009-11-03 13:32:18 ----D---- C:\Program Files\Common Files\scanner
2009-11-03 13:32:08 ----D---- C:\Program Files\CA
2009-11-03 13:30:51 ----D---- C:\ProgramData\SupportSoft
2009-11-03 13:30:30 ----D---- C:\Program Files\Comcast

======List of files/folders modified in the last 1 months======

2009-11-18 19:03:36 ----D---- C:\Windows\Prefetch
2009-11-18 19:03:28 ----D---- C:\Windows\Temp
2009-11-18 19:02:22 ----D---- C:\Windows\Tasks
2009-11-18 19:00:16 ----D---- C:\Program Files\Mozilla Firefox
2009-11-18 18:56:12 ----D---- C:\Program Files\Hijackthis
2009-11-18 18:38:14 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-11-18 18:36:37 ----D---- C:\ProgramData\Spybot - Search & Destroy
2009-11-18 18:35:18 ----RD---- C:\Program Files
2009-11-18 18:31:12 ----HD---- C:\ProgramData
2009-11-18 18:27:56 ----D---- C:\Program Files\a-squared Free
2009-11-18 18:26:49 ----SHD---- C:\Windows\Installer
2009-11-18 18:26:39 ----D---- C:\Program Files\Lavasoft
2009-11-18 18:26:38 ----D---- C:\ProgramData\Lavasoft
2009-11-18 18:26:37 ----DC---- C:\Windows\system32\DRVSTORE
2009-11-18 18:26:37 ----D---- C:\Windows\system32\drivers
2009-11-18 18:26:34 ----D---- C:\Windows\system32\catroot
2009-11-18 18:26:31 ----D---- C:\Windows\System32
2009-11-18 15:39:12 ----SHD---- C:\System Volume Information
2009-11-18 08:13:15 ----D---- C:\ProgramData\Google Updater
2009-11-18 05:45:45 ----D---- C:\Program Files\Lx_cats
2009-11-18 05:41:46 ----D---- C:\Windows\rescache
2009-11-18 05:31:43 ----D---- C:\Windows\inf
2009-11-18 05:31:43 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-11-18 05:27:26 ----D---- C:\Windows\system32\Tasks
2009-11-18 05:22:52 ----D---- C:\Windows
2009-11-18 05:22:40 ----D---- C:\Windows\system32\en-US
2009-11-18 05:22:35 ----D---- C:\Windows\system32\wbem
2009-11-18 05:22:31 ----D---- C:\Windows\system32\pt-PT
2009-11-18 05:22:31 ----D---- C:\Windows\system32\pt-BR
2009-11-18 05:22:31 ----D---- C:\Windows\system32\pl-PL
2009-11-18 05:22:31 ----D---- C:\Windows\system32\it-IT
2009-11-18 05:22:31 ----D---- C:\Windows\system32\he-IL
2009-11-18 05:22:31 ----D---- C:\Windows\system32\bg-BG
2009-11-18 05:22:30 ----D---- C:\Windows\system32\zh-TW
2009-11-18 05:22:30 ----D---- C:\Windows\system32\zh-HK
2009-11-18 05:22:30 ----D---- C:\Windows\system32\uk-UA
2009-11-18 05:22:30 ----D---- C:\Windows\system32\tr-TR
2009-11-18 05:22:30 ----D---- C:\Windows\system32\th-TH
2009-11-18 05:22:30 ----D---- C:\Windows\system32\sv-SE
2009-11-18 05:22:30 ----D---- C:\Windows\system32\sr-Latn-CS
2009-11-18 05:22:30 ----D---- C:\Windows\system32\sl-SI
2009-11-18 05:22:30 ----D---- C:\Windows\system32\sk-SK
2009-11-18 05:22:30 ----D---- C:\Windows\system32\nl-NL
2009-11-18 05:22:30 ----D---- C:\Windows\system32\lv-LV
2009-11-18 05:22:30 ----D---- C:\Windows\system32\lt-LT
2009-11-18 05:22:30 ----D---- C:\Windows\system32\ko-KR
2009-11-18 05:22:30 ----D---- C:\Windows\system32\hu-HU
2009-11-18 05:22:30 ----D---- C:\Windows\system32\hr-HR
2009-11-18 05:22:30 ----D---- C:\Windows\system32\fr-FR
2009-11-18 05:22:30 ----D---- C:\Windows\system32\fi-FI
2009-11-18 05:22:30 ----D---- C:\Windows\system32\et-EE
2009-11-18 05:22:30 ----D---- C:\Windows\system32\es-ES
2009-11-18 05:22:30 ----D---- C:\Windows\system32\el-GR
2009-11-18 05:22:29 ----D---- C:\Windows\system32\zh-CN
2009-11-18 05:22:29 ----D---- C:\Windows\system32\ru-RU
2009-11-18 05:22:29 ----D---- C:\Windows\system32\ro-RO
2009-11-18 05:22:29 ----D---- C:\Windows\system32\nb-NO
2009-11-18 05:22:29 ----D---- C:\Windows\system32\ja-JP
2009-11-18 05:22:29 ----D---- C:\Windows\system32\de-DE
2009-11-18 05:22:29 ----D---- C:\Windows\system32\da-DK
2009-11-18 05:22:29 ----D---- C:\Windows\system32\cs-CZ
2009-11-18 05:22:29 ----D---- C:\Windows\system32\ar-SA
2009-11-17 19:51:48 ----D---- C:\Windows\winsxs
2009-11-17 19:51:45 ----D---- C:\Windows\system32\catroot2
2009-11-15 12:26:02 ----A---- C:\Windows\ntbtlog.txt
2009-11-15 11:33:24 ----HD---- C:\$AVG8.VAULT$
2009-11-14 20:21:53 ----D---- C:\ProgramData\Adobe
2009-11-14 20:20:47 ----D---- C:\Program Files\Common Files
2009-11-14 07:47:06 ----AD---- C:\ProgramData\TEMP
2009-11-14 07:47:02 ----D---- C:\Program Files\SpywareBlaster
2009-11-12 15:55:53 ----D---- C:\Program Files\Opera
2009-11-11 08:33:35 ----D---- C:\Program Files\Windows Mail
2009-11-11 04:46:15 ----D---- C:\ProgramData\Microsoft Help
2009-11-11 04:31:40 ----D---- C:\Windows\system32\spool
2009-11-10 16:30:41 ----D---- C:\Windows\ModemLogs
2009-11-10 16:28:34 ----D---- C:\Program Files\Verizon Wireless
2009-11-10 16:28:34 ----D---- C:\Program Files\Common Files\microsoft shared
2009-11-10 16:23:52 ----D---- C:\Windows\Downloaded Installations
2009-11-09 16:45:21 ----D---- C:\Windows\Microsoft.NET
2009-11-09 16:45:08 ----RSD---- C:\Windows\assembly
2009-11-08 15:10:01 ----SHD---- C:\boot
2009-11-08 15:00:34 ----D---- C:\Program Files\Windows Calendar
2009-11-08 15:00:33 ----D---- C:\Program Files\Movie Maker
2009-11-08 15:00:30 ----D---- C:\Program Files\Windows Sidebar
2009-11-08 15:00:30 ----D---- C:\Program Files\Windows Media Player
2009-11-08 15:00:30 ----D---- C:\Program Files\Internet Explorer
2009-11-08 15:00:29 ----D---- C:\Program Files\Windows Collaboration
2009-11-08 15:00:28 ----D---- C:\Program Files\Windows Journal
2009-11-08 15:00:25 ----D---- C:\Program Files\Windows Photo Gallery
2009-11-08 15:00:25 ----D---- C:\Program Files\Common Files\System
2009-11-08 15:00:17 ----D---- C:\Windows\servicing
2009-11-08 15:00:17 ----D---- C:\Windows\ehome
2009-11-08 15:00:17 ----D---- C:\Program Files\Windows Defender
2009-11-08 14:59:32 ----D---- C:\Windows\system32\XPSViewer
2009-11-08 14:59:32 ----D---- C:\Windows\PolicyDefinitions
2009-11-08 14:59:32 ----D---- C:\Windows\IME
2009-11-08 14:59:30 ----D---- C:\Windows\system32\oobe
2009-11-08 14:59:29 ----D---- C:\Windows\system32\migration
2009-11-08 14:59:21 ----D---- C:\Windows\system32\SLUI
2009-11-08 14:59:21 ----D---- C:\Windows\system32\setup
2009-11-08 14:59:21 ----D---- C:\Windows\system32\AdvancedInstallers
2009-11-08 14:59:20 ----D---- C:\Windows\system32\manifeststore
2009-11-08 14:59:20 ----D---- C:\Windows\system32\en
2009-11-08 14:59:09 ----D---- C:\Windows\system32\migwiz
2009-11-08 14:56:53 ----RSD---- C:\Windows\Fonts
2009-11-08 14:56:53 ----D---- C:\Windows\AppPatch
2009-11-08 14:56:46 ----D---- C:\Program Files\Microsoft Games
2009-11-08 14:56:41 ----D---- C:\Windows\system32\Boot
2009-11-05 21:27:31 ----D---- C:\Program Files\Google
2009-11-05 12:36:21 ----A---- C:\Windows\system32\mrt.exe
2009-11-04 08:06:19 ----A---- C:\Windows\system32\avgrsstx.dll
2009-11-04 06:15:52 ----D---- C:\Program Files\Microsoft Silverlight
2009-11-04 05:39:29 ----D---- C:\Program Files\Microsoft Works
2009-11-03 14:39:30 ----D---- C:\Program Files\Common Files\Apple
2009-11-03 14:36:45 ----D---- C:\Program Files\QuickTime
2009-11-03 14:30:20 ----D---- C:\ProgramData\Apple
2009-11-03 13:30:31 ----D---- C:\Program Files\Common Files\SupportSoft
2009-11-02 22:30:42 ----D---- C:\Windows\system32\config
2009-11-02 22:30:34 ----D---- C:\Windows\system32\Msdtc
2009-11-02 22:30:34 ----D---- C:\Windows\system32\CodeIntegrity
2009-11-02 22:30:33 ----D---- C:\Windows\registration

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\Windows\System32\Drivers\avgldx86.sys [2009-11-04 335240]
R1 AvgMfx86;AVG Minifilter x86 Resident Driver; C:\Windows\System32\Drivers\avgmfx86.sys [2009-11-04 27784]
R1 AvgTdiX;AVG8 Network Redirector; C:\Windows\System32\Drivers\avgtdix.sys [2009-11-04 108552]
R1 BANTExt;Belarc SMBios Access; C:\Windows\System32\Drivers\BANTExt.sys [2005-04-07 3840]
R1 CSC;Offline Files Driver; C:\Windows\system32\drivers\csc.sys [2009-04-10 351744]
R1 eabfiltr;eabfiltr; C:\Windows\system32\DRIVERS\eabfiltr.sys [2006-11-30 8192]
R2 MCSTRM;MCSTRM; C:\Windows\system32\drivers\MCSTRM.sys [2007-12-27 8413]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-18 12672]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-02-24 39936]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-01-23 42496]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-01-23 37376]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-07-10 8704]
R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2007-01-03 534016]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2009-05-18 26600]
R3 HBtnKey;HBtnKey; C:\Windows\system32\DRIVERS\cpqbttn.sys [2006-06-28 9472]
R3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDART.sys [2007-06-26 163328]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-06-20 984064]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-06-20 208896]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2007-03-06 1059112]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-12-04 7606688]
R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys [2007-02-16 12032]
R3 NWADI;NWADI Bus Enumerator; C:\Windows\system32\DRIVERS\NWADIenum.sys [2008-06-02 222720]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-10 89088]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-09-15 191408]
R3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-06-20 660480]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-19 11264]
S3 catchme;catchme; \??\C:\Users\cdoo\AppData\Local\Temp\catchme.sys []
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 hcw85bda;Hauppauge WinTV 885 Video Capture; C:\Windows\system32\drivers\HCW85BDA.sys [2006-12-01 622080]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NWUSBCDFIL;Novatel Wireless Installation CD; C:\Windows\system32\DRIVERS\NwUsbCdFil.sys [2008-07-07 20480]
S3 NWUSBModem;Novatel Wireless USB Modem Driver; C:\Windows\system32\DRIVERS\nwusbmdm.sys [2008-05-09 174336]
S3 NWUSBPort;Novatel Wireless USB Status Port Driver; C:\Windows\system32\DRIVERS\nwusbser.sys [2008-05-09 174336]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver; C:\Windows\system32\DRIVERS\nwusbser2.sys [2008-05-09 174336]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver; \??\C:\PROGRA~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [2009-03-20 32408]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-08-28 40448]
S3 usbbus;LGE CDMA Composite USB Device; C:\Windows\system32\DRIVERS\lgusbbus.sys [2007-04-09 12672]
S3 UsbDiag;LGE CDMA USB Serial Port; C:\Windows\system32\DRIVERS\lgusbdiag.sys [2007-04-09 21248]
S3 USBModem;LGE CDMA USB Modem; C:\Windows\system32\DRIVERS\lgusbmodem.sys [2007-04-09 22912]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-09-30 40448]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
R2 avg8emc;AVG Free8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2009-11-04 908056]
R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2009-11-04 297752]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 CLCapSvc;CyberLink Background Capture Service (CBCS); C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe [2007-04-23 262243]
R2 CLSched;CyberLink Task Scheduler (CTS); C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe [2007-04-23 106593]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 HP Health Check Service;HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2007-03-14 62984]
R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-05-02 135168]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-04-19 75304]
R2 lxdj_device;lxdj_device; C:\Windows\system32\lxdjcoms.exe [2007-06-11 537520]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-12-04 203296]
R2 sprtsvc_ddoctorv2;SupportSoft Sprocket Service (ddoctorv2); C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe [2008-04-24 202560]
R2 Viewpoint Manager Service;Viewpoint Manager Service; C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-03-30 1533808]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-07-10 386560]
R2 YahooAUService;Yahoo! Updater; C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe [2008-11-09 602392]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-10-28 545568]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-11-05 135664]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-24 183280]
S2 lxdjCATSCustConnectService;lxdjCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdjserv.exe [2007-06-11 99248]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 Com4Qlb;Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [2007-01-09 110592]
S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe [2008-01-19 523776]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 RoxMediaDB9;RoxMediaDB9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2007-02-12 880640]
S3 stllssvr;stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2007-02-17 74656]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2008-01-19 21504]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe [2009-04-11 918528]

-----------------EOF-----------------
cdoolake
Regular Member
 
Posts: 20
Joined: November 12th, 2009, 3:07 pm

Re: avg detected nircmd.exe trojan

Unread postby xixo_12 » November 19th, 2009, 10:12 am

Hi,
I have a reminder for you.
System drive C: has 9 GB (6%) free of 144 GB


You need to free up some space on your hard drive. Put some of your files on CD or DVD and then erase them from your drive.
You can check the Free Space on the drive by going to Start > My Computer > right clicking on the C: drive, and choosing properties.
You need to have 35 Gb free space on the C: drive for this machine to work properly.
If you don't know how to transfer files to DVD or CD, you can visit one of these forums:
Good System/Hardware Help Forums

You may need to do free registration in order to post at their forum ;)
After you're done with it, come back to me with following instruction.

First,
ATF by Atribune
Please download HERE and save to the desktop. Right click on ATF Cleaner.exe > Run as an Administrator to open it.
Under Main choose:
    choose: Select All
    Click the Empty Selected button.
if you use Firefox:
    Click Firefox at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
if you use Opera:
    Click Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program

Next,
RSIT.
Please run RSIT again to produce log.txt.
***You can find manually the log at C:\rsit

Next,
Checklist.
Please post.
  • Content of log.txt (Find it in c:\rsit)
User avatar
xixo_12
MRU Master Emeritus
 
Posts: 2340
Joined: October 14th, 2008, 11:40 am
Location: Malaysia

Re: avg detected nircmd.exe trojan

Unread postby cdoolake » November 19th, 2009, 5:21 pm

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2009-11-19 16:19:29
Microsoft® Windows Vista™ Ultimate Service Pack 2
System drive C: has 30 GB (21%) free of 144 GB
Total RAM: 1982 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:19:46 PM, on 11/19/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Administrator\Downloads\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://downloads.yahoo.com/internetexplorer/welcome
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [AIMPro] "C:\Program Files\AIM\AIM Pro\aimpro.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-2882669810-3521172830-2515113265-1000\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (User 'cdoo')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net ... plugin.cab
O16 - DPF: {0C92900E-4D5A-4F04-ACC9-729E1767BBAE} (Image Uploader Control) - http://cordcamera.lifepics.com/net/Uplo ... ader45.cab
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resour ... cctrl2.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/i ... ection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/s ... DEXAXO.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxdjCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdjserv.exe
O23 - Service: lxdj_device - - C:\Windows\system32\lxdjcoms.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 11063 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Google Software Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\Spybot - Search & Destroy - Scheduled Task.job
C:\Windows\tasks\User_Feed_Synchronization-{076BC371-225E-46F2-BABB-7462A6B73100}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2008-11-20 911600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2009-11-04 1111320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll [2007-09-25 501136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-03-30 403824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-03-24 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
SingleInstance Class - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll [2008-11-20 160496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2008-11-20 911600]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"SynTPStart"=C:\Program Files\Synaptics\SynTP\SynTPStart.exe [2007-09-15 102400]
"AIMPro"=C:\Program Files\AIM\AIM Pro\aimpro.exe []
"HP Health Check Scheduler"=C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2007-03-12 50696]
"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2007-03-01 472776]
"QPService"=C:\Program Files\HP\QuickPlay\QPService.exe [2007-04-23 176128]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-09-15 1021224]
"WAWifiMessage"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [2007-01-10 317128]
"QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2007-02-13 159744]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2009-11-04 2028312]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-12-04 13556256]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-12-04 92704]
"ddoctorv2"=C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe [2008-04-24 202560]
""= []
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-10-28 141600]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]
"WindowsWelcomeCenter"=oobefldr.dll,ShowWelcomeCenter []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="avgrsstx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll [2008-01-23 233888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"RunStartupScriptSync"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\Program Files\Lexmark 1400 Series\app4r.exe"="C:\Program Files\Lexmark 1400 Series\app4r.exe:*:Enabled:Printing Application"

======List of files/folders created in the last 1 months======

2009-11-18 19:03:24 ----D---- C:\rsit
2009-11-18 05:22:36 ----D---- C:\Program Files\Windows Portable Devices
2009-11-17 19:51:33 ----A---- C:\Windows\system32\UIAnimation.dll
2009-11-17 19:51:32 ----A---- C:\Windows\system32\UIRibbonRes.dll
2009-11-17 19:51:32 ----A---- C:\Windows\system32\UIRibbon.dll
2009-11-17 19:50:49 ----A---- C:\Windows\system32\WMPhoto.dll
2009-11-17 19:50:47 ----A---- C:\Windows\system32\cdd.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\XpsRasterService.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\XpsPrint.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\WindowsCodecs.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe
2009-11-17 19:50:46 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\dxdiagn.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\dxdiag.exe
2009-11-17 19:50:46 ----A---- C:\Windows\system32\d3d10warp.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\d2d1.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\xpsservices.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\OpcServices.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\FntCache.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\dxgi.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\DWrite.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d11.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d10level9.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d10core.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d10_1core.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d10_1.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d10.dll
2009-11-17 19:49:50 ----A---- C:\Windows\system32\WPDShextAutoplay.exe
2009-11-17 19:49:50 ----A---- C:\Windows\system32\wpdbusenum.dll
2009-11-17 19:49:50 ----A---- C:\Windows\system32\BthMtpContextHandler.dll
2009-11-17 19:49:41 ----A---- C:\Windows\system32\PortableDeviceConnectApi.dll
2009-11-17 19:49:37 ----A---- C:\Windows\system32\wpdshext.dll
2009-11-17 19:49:37 ----A---- C:\Windows\system32\WpdMtpUS.dll
2009-11-17 19:49:37 ----A---- C:\Windows\system32\WpdConns.dll
2009-11-17 19:49:37 ----A---- C:\Windows\system32\wpd_ci.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\WPDSp.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\WPDShServiceObj.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\WpdMtp.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\PortableDeviceWMDRM.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\PortableDeviceTypes.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2009-11-17 19:47:25 ----A---- C:\Windows\system32\oleaccrc.dll
2009-11-17 19:47:23 ----A---- C:\Windows\system32\UIAutomationCore.dll
2009-11-17 19:47:23 ----A---- C:\Windows\system32\oleacc.dll
2009-11-16 14:09:13 ----D---- C:\Users\Administrator\AppData\Roaming\Mozilla
2009-11-14 20:20:47 ----D---- C:\Program Files\Common Files\Adobe
2009-11-14 20:17:42 ----D---- C:\Program Files\Common Files\Adobe AIR
2009-11-14 20:15:50 ----D---- C:\ProgramData\NOS
2009-11-14 20:12:03 ----D---- C:\Program Files\Adobe
2009-11-12 13:37:50 ----D---- C:\Program Files\Trend Micro
2009-11-10 20:07:46 ----A---- C:\Windows\system32\WSDApi.dll
2009-11-10 16:28:34 ----D---- C:\ProgramData\Verizon Wireless
2009-11-10 16:24:09 ----D---- C:\Program Files\Novatel Wireless
2009-11-08 14:56:45 ----D---- C:\Windows\system32\eu-ES
2009-11-08 14:56:45 ----D---- C:\Windows\system32\ca-ES
2009-11-08 14:56:41 ----D---- C:\Windows\system32\vi-VN
2009-11-08 14:36:55 ----D---- C:\Windows\system32\EventProviders
2009-11-08 07:27:48 ----A---- C:\Windows\system32\NlsLexicons0007.dll
2009-11-08 07:27:34 ----A---- C:\Windows\system32\SLsvc.exe
2009-11-08 07:27:34 ----A---- C:\Windows\system32\SLCExt.dll
2009-11-08 07:27:32 ----A---- C:\Windows\system32\FunctionDiscoveryFolder.dll
2009-11-08 07:27:32 ----A---- C:\Windows\system32\DevicePairingWizard.exe
2009-11-08 07:27:30 ----A---- C:\Windows\system32\NlsLexicons0009.dll
2009-11-08 07:27:25 ----A---- C:\Windows\system32\mssrch.dll
2009-11-08 07:27:22 ----A---- C:\Windows\system32\tquery.dll
2009-11-08 07:27:21 ----A---- C:\Windows\system32\PresentationNative_v0300.dll
2009-11-08 07:27:20 ----A---- C:\Windows\system32\RMActivate_isv.exe
2009-11-08 07:27:19 ----A---- C:\Windows\system32\scavenge.dll
2009-11-08 07:27:19 ----A---- C:\Windows\system32\RMActivate.exe
2009-11-08 07:27:18 ----A---- C:\Windows\system32\msi.dll
2009-11-08 07:27:17 ----A---- C:\Windows\system32\imapi2fs.dll
2009-11-08 07:27:15 ----A---- C:\Windows\system32\secproc_isv.dll
2009-11-08 07:27:14 ----A---- C:\Windows\system32\WscEapPr.dll
2009-11-08 07:27:14 ----A---- C:\Windows\system32\wcnwiz2.dll
2009-11-08 07:27:14 ----A---- C:\Windows\system32\sysmain.dll
2009-11-08 07:27:12 ----A---- C:\Windows\system32\icardagt.exe
2009-11-08 07:27:10 ----A---- C:\Windows\system32\EhStorShell.dll
2009-11-08 07:27:10 ----A---- C:\Windows\system32\AuxiliaryDisplayCpl.dll
2009-11-08 07:27:09 ----A---- C:\Windows\system32\spreview.exe
2009-11-08 07:27:09 ----A---- C:\Windows\system32\spinstall.exe
2009-11-08 07:27:09 ----A---- C:\Windows\system32\drmv2clt.dll
2009-11-08 07:27:01 ----A---- C:\Windows\system32\spwizui.dll
2009-11-08 07:27:00 ----A---- C:\Windows\system32\secproc.dll
2009-11-08 07:27:00 ----A---- C:\Windows\system32\mcupdate_GenuineIntel.dll
2009-11-08 07:26:58 ----A---- C:\Windows\system32\shell32.dll
2009-11-08 07:26:56 ----A---- C:\Windows\system32\SearchIndexer.exe
2009-11-08 07:26:56 ----A---- C:\Windows\system32\p2psvc.dll
2009-11-08 07:26:56 ----A---- C:\Windows\system32\mssvp.dll
2009-11-08 07:26:55 ----A---- C:\Windows\system32\mscoree.dll
2009-11-08 07:26:54 ----A---- C:\Windows\system32\mssphtb.dll
2009-11-08 07:26:54 ----A---- C:\Windows\system32\mssph.dll
2009-11-08 07:26:54 ----A---- C:\Windows\system32\MSMPEG2VDEC.DLL
2009-11-08 07:26:54 ----A---- C:\Windows\system32\imapi2.dll
2009-11-08 07:26:53 ----A---- C:\Windows\system32\sdohlp.dll
2009-11-08 07:26:53 ----A---- C:\Windows\system32\esent.dll
2009-11-08 07:26:52 ----A---- C:\Windows\system32\IMJP10K.DLL
2009-11-08 07:26:52 ----A---- C:\Windows\system32\DevicePairing.dll
2009-11-08 07:26:51 ----A---- C:\Windows\system32\wevtsvc.dll
2009-11-08 07:26:51 ----A---- C:\Windows\system32\sperror.dll
2009-11-08 07:26:51 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2009-11-08 07:26:51 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2009-11-08 07:26:51 ----A---- C:\Windows\system32\korwbrkr.dll
2009-11-08 07:26:50 ----A---- C:\Windows\system32\SLC.dll
2009-11-08 07:26:50 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2009-11-08 07:26:50 ----A---- C:\Windows\system32\IasMigReader.exe
2009-11-08 07:26:49 ----A---- C:\Windows\system32\msshsq.dll
2009-11-08 07:26:48 ----A---- C:\Windows\system32\pmcsnap.dll
2009-11-08 07:26:47 ----A---- C:\Windows\system32\msjet40.dll
2009-11-08 07:26:47 ----A---- C:\Windows\system32\MPSSVC.dll
2009-11-08 07:26:46 ----A---- C:\Windows\system32\Query.dll
2009-11-08 07:26:46 ----A---- C:\Windows\system32\qmgr.dll
2009-11-08 07:26:46 ----A---- C:\Windows\system32\msxml6.dll
2009-11-08 07:26:45 ----A---- C:\Windows\system32\P2PGraph.dll
2009-11-08 07:26:45 ----A---- C:\Windows\system32\msexch40.dll
2009-11-08 07:26:45 ----A---- C:\Windows\system32\diagperf.dll
2009-11-08 07:26:44 ----A---- C:\Windows\system32\srchadmin.dll
2009-11-08 07:26:44 ----A---- C:\Windows\system32\ole32.dll
2009-11-08 07:26:44 ----A---- C:\Windows\system32\ntdll.dll
2009-11-08 07:26:43 ----A---- C:\Windows\system32\winload.exe
2009-11-08 07:26:43 ----A---- C:\Windows\system32\uDWM.dll
2009-11-08 07:26:43 ----A---- C:\Windows\system32\msxml3.dll
2009-11-08 07:26:43 ----A---- C:\Windows\system32\mmc.exe
2009-11-08 07:26:43 ----A---- C:\Windows\system32\mblctr.exe
2009-11-08 07:26:43 ----A---- C:\Windows\system32\EncDec.dll
2009-11-08 07:26:42 ----A---- C:\Windows\system32\riched20.dll
2009-11-08 07:26:42 ----A---- C:\Windows\system32\IasMigPlugin.dll
2009-11-08 07:26:42 ----A---- C:\Windows\system32\dfsr.exe
2009-11-08 07:26:41 ----A---- C:\Windows\system32\RacEngn.dll
2009-11-08 07:26:41 ----A---- C:\Windows\system32\fdBth.dll
2009-11-08 07:26:40 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2009-11-08 07:26:40 ----A---- C:\Windows\system32\SearchFilterHost.exe
2009-11-08 07:26:40 ----A---- C:\Windows\system32\milcore.dll
2009-11-08 07:26:40 ----A---- C:\Windows\system32\kernel32.dll
2009-11-08 07:26:39 ----A---- C:\Windows\system32\spoolss.dll
2009-11-08 07:26:39 ----A---- C:\Windows\system32\schedsvc.dll
2009-11-08 07:26:39 ----A---- C:\Windows\system32\NaturalLanguage6.dll
2009-11-08 07:26:39 ----A---- C:\Windows\system32\EhStorAPI.dll
2009-11-08 07:26:39 ----A---- C:\Windows\system32\CertEnroll.dll
2009-11-08 07:26:38 ----A---- C:\Windows\system32\msjtes40.dll
2009-11-08 07:26:38 ----A---- C:\Windows\system32\AuxiliaryDisplayDriverLib.dll
2009-11-08 07:26:37 ----A---- C:\Windows\system32\msvcp60.dll
2009-11-08 07:26:37 ----A---- C:\Windows\system32\gpedit.dll
2009-11-08 07:26:36 ----A---- C:\Windows\system32\infocardapi.dll
2009-11-08 07:26:35 ----A---- C:\Windows\system32\WinSAT.exe
2009-11-08 07:26:34 ----A---- C:\Windows\system32\PresentationSettings.exe
2009-11-08 07:26:34 ----A---- C:\Windows\system32\Magnify.exe
2009-11-08 07:26:34 ----A---- C:\Windows\system32\fveapi.dll
2009-11-08 07:26:34 ----A---- C:\Windows\system32\es.dll
2009-11-08 07:26:34 ----A---- C:\Windows\system32\cscsvc.dll
2009-11-08 07:26:34 ----A---- C:\Windows\system32\AuxiliaryDisplayServices.dll
2009-11-08 07:26:33 ----A---- C:\Windows\system32\mstext40.dll
2009-11-08 07:26:33 ----A---- C:\Windows\system32\advapi32.dll
2009-11-08 07:26:32 ----A---- C:\Windows\system32\WebClnt.dll
2009-11-08 07:26:31 ----A---- C:\Windows\system32\slwmi.dll
2009-11-08 07:26:31 ----A---- C:\Windows\system32\msexcl40.dll
2009-11-08 07:26:31 ----A---- C:\Windows\system32\comsvcs.dll
2009-11-08 07:26:30 ----A---- C:\Windows\system32\vssapi.dll
2009-11-08 07:26:30 ----A---- C:\Windows\system32\msxbde40.dll
2009-11-08 07:26:30 ----A---- C:\Windows\system32\msfeeds.dll
2009-11-08 07:26:29 ----A---- C:\Windows\system32\vbscript.dll
2009-11-08 07:26:29 ----A---- C:\Windows\system32\NetProjW.dll
2009-11-08 07:26:29 ----A---- C:\Windows\system32\authui.dll
2009-11-08 07:26:28 ----A---- C:\Windows\system32\propsys.dll
2009-11-08 07:26:28 ----A---- C:\Windows\system32\PresentationHost.exe
2009-11-08 07:26:28 ----A---- C:\Windows\system32\newdev.dll
2009-11-08 07:26:28 ----A---- C:\Windows\system32\msrepl40.dll
2009-11-08 07:26:27 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-11-08 07:26:27 ----A---- C:\Windows\system32\iasrecst.dll
2009-11-08 07:26:27 ----A---- C:\Windows\system32\gpsvc.dll
2009-11-08 07:26:27 ----A---- C:\Windows\system32\eudcedit.exe
2009-11-08 07:26:27 ----A---- C:\Windows\system32\crypt32.dll
2009-11-08 07:26:27 ----A---- C:\Windows\explorer.exe
2009-11-08 07:26:26 ----A---- C:\Windows\system32\setupapi.dll
2009-11-08 07:26:26 ----A---- C:\Windows\system32\rpcss.dll
2009-11-08 07:26:26 ----A---- C:\Windows\system32\mspbde40.dll
2009-11-08 07:26:26 ----A---- C:\Windows\system32\iedkcs32.dll
2009-11-08 07:26:26 ----A---- C:\Windows\system32\d3d9.dll
2009-11-08 07:26:25 ----A---- C:\Windows\system32\msltus40.dll
2009-11-08 07:26:25 ----A---- C:\Windows\system32\mfc42.dll
2009-11-08 07:26:25 ----A---- C:\Windows\system32\davclnt.dll
2009-11-08 07:26:24 ----A---- C:\Windows\system32\shlwapi.dll
2009-11-08 07:26:24 ----A---- C:\Windows\system32\msrd3x40.dll
2009-11-08 07:26:24 ----A---- C:\Windows\system32\msdtctm.dll
2009-11-08 07:26:24 ----A---- C:\Windows\system32\EhStorPwdMgr.dll
2009-11-08 07:26:24 ----A---- C:\Windows\system32\EhStorAuthn.dll
2009-11-08 07:26:23 ----A---- C:\Windows\system32\wevtapi.dll
2009-11-08 07:26:23 ----A---- C:\Windows\system32\photowiz.dll
2009-11-08 07:26:23 ----A---- C:\Windows\system32\nlhtml.dll
2009-11-08 07:26:23 ----A---- C:\Windows\system32\browseui.dll
2009-11-08 07:26:20 ----A---- C:\Windows\system32\user32.dll
2009-11-08 07:26:19 ----A---- C:\Windows\system32\win32spl.dll
2009-11-08 07:26:19 ----A---- C:\Windows\system32\samsrv.dll
2009-11-08 07:26:19 ----A---- C:\Windows\system32\quartz.dll
2009-11-08 07:26:19 ----A---- C:\Windows\system32\ci.dll
2009-11-08 07:26:18 ----A---- C:\Windows\system32\WcnNetsh.dll
2009-11-08 07:26:18 ----A---- C:\Windows\system32\SLCommDlg.dll
2009-11-08 07:26:18 ----A---- C:\Windows\system32\oleaut32.dll
2009-11-08 07:26:18 ----A---- C:\Windows\system32\kerberos.dll
2009-11-08 07:26:18 ----A---- C:\Windows\system32\IKEEXT.DLL
2009-11-08 07:26:17 ----A---- C:\Windows\system32\winhttp.dll
2009-11-08 07:26:17 ----A---- C:\Windows\system32\netshell.dll
2009-11-08 07:26:17 ----A---- C:\Windows\system32\compcln.exe
2009-11-08 07:26:17 ----A---- C:\Windows\system32\apds.dll
2009-11-08 07:26:16 ----A---- C:\Windows\system32\xmlfilter.dll
2009-11-08 07:26:16 ----A---- C:\Windows\system32\mswstr10.dll
2009-11-08 07:26:16 ----A---- C:\Windows\system32\msctf.dll
2009-11-08 07:26:16 ----A---- C:\Windows\system32\emdmgmt.dll
2009-11-08 07:26:16 ----A---- C:\Windows\system32\audiosrv.dll
2009-11-08 07:26:15 ----A---- C:\Windows\system32\VSSVC.exe
2009-11-08 07:26:15 ----A---- C:\Windows\system32\QAGENTRT.DLL
2009-11-08 07:26:15 ----A---- C:\Windows\system32\msvcrt.dll
2009-11-08 07:26:15 ----A---- C:\Windows\system32\mfc42u.dll
2009-11-08 07:26:15 ----A---- C:\Windows\system32\iphlpsvc.dll
2009-11-08 07:26:15 ----A---- C:\Windows\system32\gdi32.dll
2009-11-08 07:26:14 ----A---- C:\Windows\system32\SLUI.exe
2009-11-08 07:26:14 ----A---- C:\Windows\system32\msrd2x40.dll
2009-11-08 07:26:14 ----A---- C:\Windows\system32\eapphost.dll
2009-11-08 07:26:13 ----A---- C:\Windows\system32\wbengine.exe
2009-11-08 07:26:13 ----A---- C:\Windows\system32\sqlsrv32.dll
2009-11-08 07:26:13 ----A---- C:\Windows\system32\odbc32.dll
2009-11-08 07:26:12 ----A---- C:\Windows\system32\winresume.exe
2009-11-08 07:26:12 ----A---- C:\Windows\system32\shdocvw.dll
2009-11-08 07:26:12 ----A---- C:\Windows\system32\propdefs.dll
2009-11-08 07:26:11 ----A---- C:\Windows\system32\wevtutil.exe
2009-11-08 07:26:11 ----A---- C:\Windows\system32\dbgeng.dll
2009-11-08 07:26:10 ----A---- C:\Windows\system32\mssitlb.dll
2009-11-08 07:26:09 ----A---- C:\Windows\system32\WsmSvc.dll
2009-11-08 07:26:09 ----A---- C:\Windows\system32\usp10.dll
2009-11-08 07:26:09 ----A---- C:\Windows\system32\swprv.dll
2009-11-08 07:26:09 ----A---- C:\Windows\system32\mmcndmgr.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\vds.exe
2009-11-08 07:26:08 ----A---- C:\Windows\system32\netlogon.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\msscb.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\mshtmled.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\msctfp.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\fdBthProxy.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\drvinst.exe
2009-11-08 07:26:08 ----A---- C:\Windows\system32\devmgr.dll
2009-11-08 07:26:07 ----A---- C:\Windows\system32\DevicePairingProxy.dll
2009-11-08 07:26:07 ----A---- C:\Windows\system32\BFE.DLL
2009-11-08 07:26:07 ----A---- C:\Windows\system32\adsldpc.dll
2009-11-08 07:26:06 ----A---- C:\Windows\system32\Wldap32.dll
2009-11-08 07:26:06 ----A---- C:\Windows\system32\WFS.exe
2009-11-08 07:26:06 ----A---- C:\Windows\system32\wcnwiz.dll
2009-11-08 07:26:06 ----A---- C:\Windows\system32\schannel.dll
2009-11-08 07:26:06 ----A---- C:\Windows\system32\evr.dll
2009-11-08 07:26:05 ----A---- C:\Windows\system32\WMVSDECD.DLL
2009-11-08 07:26:05 ----A---- C:\Windows\system32\services.exe
2009-11-08 07:26:04 ----A---- C:\Windows\system32\wercon.exe
2009-11-08 07:26:04 ----A---- C:\Windows\system32\wcncsvc.dll
2009-11-08 07:26:04 ----A---- C:\Windows\system32\mimefilt.dll
2009-11-08 07:26:04 ----A---- C:\Windows\system32\iertutil.dll
2009-11-08 07:26:04 ----A---- C:\Windows\system32\comdlg32.dll
2009-11-08 07:26:04 ----A---- C:\Windows\system32\adtschema.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\taskeng.exe
2009-11-08 07:26:03 ----A---- C:\Windows\system32\rtffilt.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\reg.exe
2009-11-08 07:26:03 ----A---- C:\Windows\system32\mswdat10.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\msjter40.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\msdtcprx.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\msdrm.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\ipsmsnap.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\dnsapi.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\certcli.dll
2009-11-08 07:26:02 ----A---- C:\Windows\system32\WMNetMgr.dll
2009-11-08 07:26:02 ----A---- C:\Windows\system32\umpnpmgr.dll
2009-11-08 07:26:02 ----A---- C:\Windows\system32\certutil.exe
2009-11-08 07:26:01 ----A---- C:\Windows\system32\w32time.dll
2009-11-08 07:26:01 ----A---- C:\Windows\system32\IPSECSVC.DLL
2009-11-08 07:26:00 ----A---- C:\Windows\system32\rsaenh.dll
2009-11-08 07:26:00 ----A---- C:\Windows\system32\msshooks.dll
2009-11-08 07:26:00 ----A---- C:\Windows\system32\msscntrs.dll
2009-11-08 07:26:00 ----A---- C:\Windows\system32\bthserv.dll
2009-11-08 07:26:00 ----A---- C:\Windows\system32\bcrypt.dll
2009-11-08 07:25:59 ----A---- C:\Windows\system32\msihnd.dll
2009-11-08 07:25:58 ----A---- C:\Windows\system32\TsWpfWrp.exe
2009-11-08 07:25:58 ----A---- C:\Windows\system32\MMDevAPI.dll
2009-11-08 07:25:57 ----A---- C:\Windows\system32\msstrc.dll
2009-11-08 07:25:56 ----A---- C:\Windows\system32\scrptadm.dll
2009-11-08 07:25:56 ----A---- C:\Windows\system32\inetcomm.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\netapi32.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\mtxclu.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\mscories.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\inetpp.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\hidserv.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\fundisc.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\dfshim.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\cryptsvc.dll
2009-11-08 07:25:54 ----A---- C:\Windows\system32\wmicmiplugin.dll
2009-11-08 07:25:54 ----A---- C:\Windows\system32\termsrv.dll
2009-11-08 07:25:54 ----A---- C:\Windows\system32\profsvc.dll
2009-11-08 07:25:54 ----A---- C:\Windows\system32\dhcpcsvc6.dll
2009-11-08 07:25:53 ----A---- C:\Windows\system32\wdc.dll
2009-11-08 07:25:53 ----A---- C:\Windows\system32\shsvcs.dll
2009-11-08 07:25:53 ----A---- C:\Windows\system32\msiexec.exe
2009-11-08 07:25:53 ----A---- C:\Windows\system32\imapi.dll
2009-11-08 07:25:53 ----A---- C:\Windows\system32\chsbrkr.dll
2009-11-08 07:25:52 ----A---- C:\Windows\system32\spoolsv.exe
2009-11-08 07:25:52 ----A---- C:\Windows\system32\rasmans.dll
2009-11-08 07:25:52 ----A---- C:\Windows\system32\pnidui.dll
2009-11-08 07:25:52 ----A---- C:\Windows\system32\icardres.dll
2009-11-08 07:25:52 ----A---- C:\Windows\system32\iassdo.dll
2009-11-08 07:25:52 ----A---- C:\Windows\system32\autofmt.exe
2009-11-08 07:25:51 ----A---- C:\Windows\system32\wersvc.dll
2009-11-08 07:25:51 ----A---- C:\Windows\system32\slmgr.vbs
2009-11-08 07:25:51 ----A---- C:\Windows\system32\scrrun.dll
2009-11-08 07:25:51 ----A---- C:\Windows\system32\PSHED.DLL
2009-11-08 07:25:50 ----A---- C:\Windows\system32\pidgenx.dll
2009-11-08 07:25:50 ----A---- C:\Windows\system32\pdh.dll
2009-11-08 07:25:50 ----A---- C:\Windows\system32\dhcpcsvc.dll
2009-11-08 07:25:50 ----A---- C:\Windows\system32\CertEnrollUI.dll
2009-11-08 07:25:50 ----A---- C:\Windows\system32\azroles.dll
2009-11-08 07:25:49 ----A---- C:\Windows\system32\wmpmde.dll
2009-11-08 07:25:49 ----A---- C:\Windows\system32\winlogon.exe
2009-11-08 07:25:49 ----A---- C:\Windows\system32\SyncCenter.dll
2009-11-08 07:25:48 ----A---- C:\Windows\system32\SLUINotify.dll
2009-11-08 07:25:48 ----A---- C:\Windows\system32\msjetoledb40.dll
2009-11-08 07:25:48 ----A---- C:\Windows\system32\comuid.dll
2009-11-08 07:25:47 ----A---- C:\Windows\system32\spp.dll
2009-11-08 07:25:47 ----A---- C:\Windows\system32\sethc.exe
2009-11-08 07:25:47 ----A---- C:\Windows\system32\ncrypt.dll
2009-11-08 07:25:47 ----A---- C:\Windows\system32\kd1394.dll
2009-11-08 07:25:47 ----A---- C:\Windows\system32\iassam.dll
2009-11-08 07:25:47 ----A---- C:\Windows\system32\certmgr.dll
2009-11-08 07:25:46 ----A---- C:\Windows\system32\wisptis.exe
2009-11-08 07:25:46 ----A---- C:\Windows\system32\untfs.dll
2009-11-08 07:25:46 ----A---- C:\Windows\system32\taskcomp.dll
2009-11-08 07:25:46 ----A---- C:\Windows\system32\scrobj.dll
2009-11-08 07:25:46 ----A---- C:\Windows\system32\rtutils.dll
2009-11-08 07:25:46 ----A---- C:\Windows\system32\dwm.exe
2009-11-08 07:25:45 ----A---- C:\Windows\system32\iasnap.dll
2009-11-08 07:25:45 ----A---- C:\Windows\system32\cscui.dll
2009-11-08 07:25:45 ----A---- C:\Windows\system32\autochk.exe
2009-11-08 07:25:44 ----A---- C:\Windows\system32\winsrv.dll
2009-11-08 07:25:44 ----A---- C:\Windows\system32\printui.dll
2009-11-08 07:25:44 ----A---- C:\Windows\system32\cscript.exe
2009-11-08 07:25:44 ----A---- C:\Windows\system32\autoconv.exe
2009-11-08 07:25:43 ----A---- C:\Windows\system32\wow32.dll
2009-11-08 07:25:43 ----A---- C:\Windows\system32\userenv.dll
2009-11-08 07:25:43 ----A---- C:\Windows\system32\onex.dll
2009-11-08 07:25:43 ----A---- C:\Windows\system32\kdcom.dll
2009-11-08 07:25:43 ----A---- C:\Windows\system32\basecsp.dll
2009-11-08 07:25:43 ----A---- C:\Windows\system32\audiodg.exe
2009-11-08 07:25:42 ----A---- C:\Windows\system32\osk.exe
2009-11-08 07:25:42 ----A---- C:\Windows\system32\mswsock.dll
2009-11-08 07:25:40 ----A---- C:\Windows\system32\winmm.dll
2009-11-08 07:25:40 ----A---- C:\Windows\system32\spcmsg.dll
2009-11-08 07:25:40 ----A---- C:\Windows\system32\RelMon.dll
2009-11-08 07:25:40 ----A---- C:\Windows\system32\rdpencom.dll
2009-11-08 07:25:40 ----A---- C:\Windows\system32\kdusb.dll
2009-11-08 07:25:39 ----A---- C:\Windows\system32\WinSCard.dll
2009-11-08 07:25:39 ----A---- C:\Windows\system32\WerFaultSecure.exe
2009-11-08 07:25:39 ----A---- C:\Windows\system32\offfilt.dll
2009-11-08 07:25:39 ----A---- C:\Windows\system32\msftedit.dll
2009-11-08 07:25:39 ----A---- C:\Windows\system32\dnsrslvr.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\wsepno.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\WerFault.exe
2009-11-08 07:25:38 ----A---- C:\Windows\system32\Utilman.exe
2009-11-08 07:25:38 ----A---- C:\Windows\system32\stobject.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\secproc_ssp.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\mfplat.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\diskraid.exe
2009-11-08 07:25:37 ----A---- C:\Windows\system32\wiaservc.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\sysclass.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\SndVol.exe
2009-11-08 07:25:37 ----A---- C:\Windows\system32\prnntfy.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\msnetobj.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\mscms.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\mcmde.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\apphelp.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\adsmsext.dll
2009-11-08 07:25:36 ----A---- C:\Windows\system32\wscript.exe
2009-11-08 07:25:36 ----A---- C:\Windows\system32\ulib.dll
2009-11-08 07:25:36 ----A---- C:\Windows\system32\odbccp32.dll
2009-11-08 07:25:36 ----A---- C:\Windows\system32\iasdatastore.dll
2009-11-08 07:25:36 ----A---- C:\Windows\system32\dsound.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\wscntfy.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\rastapi.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\pnpsetup.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\ipsecsnp.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\IPHLPAPI.DLL
2009-11-08 07:25:35 ----A---- C:\Windows\system32\fdProxy.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\cryptui.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\wscsvc.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\WMVENCOD.DLL
2009-11-08 07:25:34 ----A---- C:\Windows\system32\wlangpui.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\vdsdyn.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\rastls.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\logman.exe
2009-11-08 07:25:34 ----A---- C:\Windows\system32\iepeers.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\iashlpr.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\gpapi.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\diskpart.exe
2009-11-08 07:25:34 ----A---- C:\Windows\system32\brcpl.dll
2009-11-08 07:25:33 ----A---- C:\Windows\system32\regsvc.dll
2009-11-08 07:25:33 ----A---- C:\Windows\system32\rasapi32.dll
2009-11-08 07:25:33 ----A---- C:\Windows\system32\ntprint.dll
2009-11-08 07:25:33 ----A---- C:\Windows\system32\mscorier.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\zipfldr.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\wusa.exe
2009-11-08 07:25:32 ----A---- C:\Windows\system32\wshext.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\wpccpl.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\netcenter.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\iasrad.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\findstr.exe
2009-11-08 07:25:31 ----A---- C:\Windows\system32\wer.dll
2009-11-08 07:25:31 ----A---- C:\Windows\system32\webcheck.dll
2009-11-08 07:25:31 ----A---- C:\Windows\system32\rasdlg.dll
2009-11-08 07:25:31 ----A---- C:\Windows\system32\iassvcs.dll
2009-11-08 07:25:30 ----A---- C:\Windows\system32\wsnmp32.dll
2009-11-08 07:25:30 ----A---- C:\Windows\system32\themecpl.dll
2009-11-08 07:25:29 ----A---- C:\Windows\system32\uxsms.dll
2009-11-08 07:25:29 ----A---- C:\Windows\system32\srvsvc.dll
2009-11-08 07:25:29 ----A---- C:\Windows\system32\mssprxy.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\tsbyuv.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\slcc.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\scansetting.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\powrprof.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\ntmarta.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\msutb.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\mstlsapi.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\iasads.dll
2009-11-08 07:25:27 ----A---- C:\Windows\system32\powercpl.dll
2009-11-08 07:25:27 ----A---- C:\Windows\system32\PerfCenterCPL.dll
2009-11-08 07:25:27 ----A---- C:\Windows\system32\networkmap.dll
2009-11-08 07:25:27 ----A---- C:\Windows\system32\mstsc.exe
2009-11-08 07:25:27 ----A---- C:\Windows\system32\iasacct.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\umrdp.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\sud.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\newdev.exe
2009-11-08 07:25:26 ----A---- C:\Windows\system32\fveui.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\dot3svc.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\connect.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\authz.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\themeui.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\systemcpl.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\samlib.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\pcaui.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\mmci.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\accessibilitycpl.dll
2009-11-08 07:25:24 ----A---- C:\Windows\system32\wlanpref.dll
2009-11-08 07:25:24 ----A---- C:\Windows\system32\usercpl.dll
2009-11-08 07:25:24 ----A---- C:\Windows\system32\qdvd.dll
2009-11-08 07:25:24 ----A---- C:\Windows\system32\brcplsiw.dll
2009-11-08 07:25:24 ----A---- C:\Windows\system32\autoplay.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\wpcao.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\vdsutil.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\tapisrv.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\rpchttp.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\regapi.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\msinfo32.exe
2009-11-08 07:25:23 ----A---- C:\Windows\system32\ieaksie.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\fvecpl.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\cscobj.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\wscisvif.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\scksp.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\scesrv.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\rekeywiz.exe
2009-11-08 07:25:22 ----A---- C:\Windows\system32\psisdecd.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\oleprn.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\mpr.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\imm32.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\iaspolcy.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\feclient.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\Faultrep.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\dot3msm.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\AudioSes.dll
2009-11-08 07:25:21 ----A---- C:\Windows\system32\WindowsUltimateExtrasCPL.dll
2009-11-08 07:25:21 ----A---- C:\Windows\system32\sdclt.exe
2009-11-08 07:25:21 ----A---- C:\Windows\system32\ncryptui.dll
2009-11-08 07:25:21 ----A---- C:\Windows\system32\dpapimig.exe
2009-11-08 07:25:21 ----A---- C:\Windows\system32\DeviceEject.exe
2009-11-08 07:25:20 ----A---- C:\Windows\system32\TSTheme.exe
2009-11-08 07:25:20 ----A---- C:\Windows\system32\SmartcardCredentialProvider.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\scecli.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\rasplap.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\rasgcw.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\qedit.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\pnpui.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\perfdisk.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\hdwwiz.exe
2009-11-08 07:25:20 ----A---- C:\Windows\system32\FWPUCLNT.DLL
2009-11-08 07:25:20 ----A---- C:\Windows\system32\extmgr.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\certreq.exe
2009-11-08 07:25:19 ----A---- C:\Windows\system32\whealogr.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\tcpmon.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\tcpipcfg.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\srcore.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\spwinsat.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\PnPUnattend.exe
2009-11-08 07:25:19 ----A---- C:\Windows\system32\fdWSD.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\cmmon32.exe
2009-11-08 07:25:18 ----A---- C:\Windows\system32\wiaaut.dll
2009-11-08 07:25:18 ----A---- C:\Windows\system32\SnippingTool.exe
2009-11-08 07:25:18 ----A---- C:\Windows\system32\SCardSvr.dll
2009-11-08 07:25:18 ----A---- C:\Windows\system32\raschap.dll
2009-11-08 07:25:18 ----A---- C:\Windows\system32\MSVidCtl.dll
2009-11-08 07:25:18 ----A---- C:\Windows\system32\fontext.dll
2009-11-08 07:25:18 ----A---- C:\Windows\system32\conime.exe
2009-11-08 07:25:18 ----A---- C:\Windows\system32\cmdial32.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\WMVXENCD.DLL
2009-11-08 07:25:17 ----A---- C:\Windows\system32\wlanui.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\shwebsvc.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\rasppp.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\PnPutil.exe
2009-11-08 07:25:17 ----A---- C:\Windows\system32\oobefldr.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\dsprop.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\dimsroam.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\shsetup.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\rasmontr.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\occache.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\mscandui.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\modemui.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\chtbrkr.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\wmdrmsdk.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\wlgpclnt.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\tscfgwmi.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\rdpwsx.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\dataclen.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\blackbox.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\WSDMon.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\wmpeffects.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\smss.exe
2009-11-08 07:25:14 ----A---- C:\Windows\system32\netplwiz.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\CscMig.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\credui.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\appmgmts.dll
2009-11-08 07:25:13 ----A---- C:\Windows\system32\wpcsvc.dll
2009-11-08 07:25:13 ----A---- C:\Windows\system32\networkexplorer.dll
2009-11-08 07:25:13 ----A---- C:\Windows\system32\mstime.dll
2009-11-08 07:25:13 ----A---- C:\Windows\system32\logagent.exe
2009-11-08 07:25:13 ----A---- C:\Windows\system32\ifmon.dll
2009-11-08 07:25:13 ----A---- C:\Windows\system32\cipher.exe
2009-11-08 07:25:13 ----A---- C:\Windows\system32\certprop.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\wscapi.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\msscp.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\msrating.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\msimtf.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\InkEd.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\gpresult.exe
2009-11-08 07:25:11 ----A---- C:\Windows\system32\thawbrkr.dll
2009-11-08 07:25:11 ----A---- C:\Windows\system32\softkbd.dll
2009-11-08 07:25:11 ----A---- C:\Windows\system32\sendmail.dll
2009-11-08 07:25:11 ----A---- C:\Windows\system32\MediaMetadataHandler.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\version.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\rdpclip.exe
2009-11-08 07:25:10 ----A---- C:\Windows\system32\puiapi.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\olepro32.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\msctfui.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\mprapi.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\input.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\gpprnext.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\ExplorerFrame.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\drmmgrtn.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\dmsynth.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\wshbth.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\SLLUA.exe
2009-11-08 07:25:09 ----A---- C:\Windows\system32\rdpendp.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\msjint40.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\msisip.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\MsCtfMonitor.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\fdSSDP.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\fc.exe
2009-11-08 07:25:09 ----A---- C:\Windows\system32\dmusic.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\cscapi.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\wsdchngr.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\tscupgrd.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\Storprop.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\SMBHelperClass.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\slcinst.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\rasdial.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\rasdiag.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\PrintBrmUi.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\nslookup.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\networkitemfactory.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\msfeedsbs.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\l2nacp.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\ipconfig.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\gpscript.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\ftp.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\fdWCN.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\eappcfg.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\eapp3hst.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\dot3cfg.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\cscdll.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\CHxReadingStringIME.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\bthudtask.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\bthci.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\qprocess.exe
2009-11-08 07:25:07 ----A---- C:\Windows\system32\ocsetup.exe
2009-11-08 07:25:07 ----A---- C:\Windows\system32\mmcico.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\hbaapi.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\gpscript.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\FwRemoteSvr.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\fdeploy.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\eappgnui.dll
2009-11-08 07:25:06 ----A---- C:\Windows\system32\tscon.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\shadow.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\PNPXAssoc.dll
2009-11-08 07:25:06 ----A---- C:\Windows\system32\NcdProp.dll
2009-11-08 07:25:06 ----A---- C:\Windows\system32\logoff.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\iscsilog.dll
2009-11-08 07:25:06 ----A---- C:\Windows\system32\gpupdate.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\csrstub.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\chgusr.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\chgport.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\cbsra.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\bitsigd.dll
2009-11-08 07:25:05 ----A---- C:\Windows\system32\vdmdbg.dll
2009-11-08 07:25:05 ----A---- C:\Windows\system32\tskill.exe
2009-11-08 07:25:05 ----A---- C:\Windows\system32\tsdiscon.exe
2009-11-08 07:25:05 ----A---- C:\Windows\system32\rwinsta.exe
2009-11-08 07:25:05 ----A---- C:\Windows\system32\qappsrv.exe
2009-11-08 07:25:05 ----A---- C:\Windows\system32\chglogon.exe
2009-11-08 07:25:04 ----A---- C:\Windows\system32\winrnr.dll
2009-11-08 07:25:04 ----A---- C:\Windows\system32\slwga.dll
2009-11-08 07:25:04 ----A---- C:\Windows\system32\reset.exe
2009-11-08 07:25:04 ----A---- C:\Windows\system32\query.exe
2009-11-08 07:25:04 ----A---- C:\Windows\system32\odbcconf.dll
2009-11-08 07:25:04 ----A---- C:\Windows\system32\midimap.dll
2009-11-08 07:25:04 ----A---- C:\Windows\system32\inetppui.dll
2009-11-08 07:25:04 ----A---- C:\Windows\system32\change.exe
2009-11-08 07:24:58 ----A---- C:\Windows\system32\f3ahvoas.dll
2009-11-08 07:24:57 ----A---- C:\Windows\system32\msimsg.dll
2009-11-08 07:24:41 ----A---- C:\Windows\system32\SmiEngine.dll
2009-11-08 07:24:37 ----A---- C:\Windows\system32\wdscore.dll
2009-11-08 07:24:37 ----A---- C:\Windows\system32\PkgMgr.exe
2009-11-08 07:24:28 ----A---- C:\Windows\system32\drvstore.dll
2009-11-07 20:39:49 ----D---- C:\ProgramData\AIM
2009-11-07 20:39:26 ----D---- C:\Program Files\AIM
2009-11-07 20:39:18 ----D---- C:\Program Files\Common Files\Software Update Utility
2009-11-07 20:38:45 ----D---- C:\ProgramData\AOL Downloads
2009-11-06 14:11:54 ----D---- C:\Program Files\BitLocker
2009-11-06 14:01:49 ----A---- C:\Windows\system32\SecureKeyBackupCPL.dll
2009-11-06 13:47:37 ----A---- C:\Windows\system32\netfxperf.dll
2009-11-06 13:46:33 ----D---- C:\Windows\system32\WindowsPowerShell
2009-11-06 13:44:27 ----D---- C:\Program Files\Microsoft
2009-11-05 09:03:47 ----A---- C:\Windows\system32\mshtml.dll
2009-11-04 06:31:29 ----A---- C:\Windows\system32\ieframe.dll
2009-11-04 06:31:27 ----A---- C:\Windows\system32\wininet.dll
2009-11-04 06:31:27 ----A---- C:\Windows\system32\urlmon.dll
2009-11-04 06:31:24 ----A---- C:\Windows\system32\ieui.dll
2009-11-04 06:31:24 ----A---- C:\Windows\system32\ieapfltr.dll
2009-11-04 06:31:22 ----A---- C:\Windows\system32\ieencode.dll
2009-11-04 06:10:14 ----A---- C:\Windows\system32\tzres.dll
2009-11-03 19:03:45 ----A---- C:\Windows\system32\netiohlp.dll
2009-11-03 19:03:43 ----A---- C:\Windows\system32\TCPSVCS.EXE
2009-11-03 19:03:43 ----A---- C:\Windows\system32\ROUTE.EXE
2009-11-03 19:03:43 ----A---- C:\Windows\system32\NETSTAT.EXE
2009-11-03 19:03:43 ----A---- C:\Windows\system32\MRINFO.EXE
2009-11-03 19:03:43 ----A---- C:\Windows\system32\HOSTNAME.EXE
2009-11-03 19:03:43 ----A---- C:\Windows\system32\finger.exe
2009-11-03 19:03:43 ----A---- C:\Windows\system32\ARP.EXE
2009-11-03 19:03:42 ----A---- C:\Windows\system32\netevent.dll
2009-11-03 19:02:59 ----A---- C:\Windows\system32\wlansvc.dll
2009-11-03 19:02:59 ----A---- C:\Windows\system32\wlanmsm.dll
2009-11-03 19:02:59 ----A---- C:\Windows\system32\wlanhlp.dll
2009-11-03 19:02:59 ----A---- C:\Windows\system32\L2SecHC.dll
2009-11-03 19:02:58 ----A---- C:\Windows\system32\wlansec.dll
2009-11-03 19:02:58 ----A---- C:\Windows\system32\wlanapi.dll
2009-11-03 19:02:51 ----A---- C:\Windows\system32\t2embed.dll
2009-11-03 19:02:51 ----A---- C:\Windows\system32\fontsub.dll
2009-11-03 19:02:51 ----A---- C:\Windows\system32\atmfd.dll
2009-11-03 19:02:50 ----A---- C:\Windows\system32\lpk.dll
2009-11-03 19:02:50 ----A---- C:\Windows\system32\dciman32.dll
2009-11-03 19:02:50 ----A---- C:\Windows\system32\atmlib.dll
2009-11-03 19:02:45 ----A---- C:\Windows\system32\lsasrv.dll
2009-11-03 19:02:44 ----A---- C:\Windows\system32\wdigest.dll
2009-11-03 19:02:44 ----A---- C:\Windows\system32\msv1_0.dll
2009-11-03 19:02:43 ----A---- C:\Windows\system32\secur32.dll
2009-11-03 19:02:42 ----A---- C:\Windows\system32\lsass.exe
2009-11-03 19:02:36 ----A---- C:\Windows\system32\WMVCORE.DLL
2009-11-03 19:02:36 ----A---- C:\Windows\system32\mf.dll
2009-11-03 19:02:35 ----A---- C:\Windows\system32\rrinstaller.exe
2009-11-03 19:02:35 ----A---- C:\Windows\system32\mfps.dll
2009-11-03 19:02:35 ----A---- C:\Windows\system32\mfpmp.exe
2009-11-03 19:02:34 ----A---- C:\Windows\system32\mferror.dll
2009-11-03 19:02:31 ----A---- C:\Windows\system32\atl.dll
2009-11-03 19:02:27 ----A---- C:\Windows\system32\ntkrnlpa.exe
2009-11-03 19:02:26 ----A---- C:\Windows\system32\ntoskrnl.exe
2009-11-03 19:02:08 ----A---- C:\Windows\system32\wkssvc.dll
2009-11-03 19:02:04 ----A---- C:\Windows\system32\mstscax.dll
2009-11-03 19:02:03 ----A---- C:\Windows\system32\tsgqec.dll
2009-11-03 19:02:03 ----A---- C:\Windows\system32\aaclient.dll
2009-11-03 19:01:27 ----A---- C:\Windows\system32\localspl.dll
2009-11-03 19:01:24 ----A---- C:\Windows\system32\avifil32.dll
2009-11-03 19:01:21 ----A---- C:\Windows\system32\jscript.dll
2009-11-03 19:01:05 ----A---- C:\Windows\system32\jsproxy.dll
2009-11-03 19:00:49 ----A---- C:\Windows\system32\wmpdxm.dll
2009-11-03 19:00:39 ----A---- C:\Windows\system32\gameux.dll
2009-11-03 19:00:38 ----A---- C:\Windows\system32\Apphlpdm.dll
2009-11-03 19:00:37 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2009-11-03 19:00:11 ----A---- C:\Windows\system32\msasn1.dll
2009-11-03 19:00:07 ----A---- C:\Windows\system32\rpcrt4.dll
2009-11-03 19:00:03 ----A---- C:\Windows\system32\WMSPDMOD.DLL
2009-11-03 18:59:52 ----A---- C:\Windows\system32\wmp.dll
2009-11-03 18:59:48 ----A---- C:\Windows\system32\unregmp2.exe
2009-11-03 18:59:47 ----A---- C:\Windows\system32\wmploc.DLL
2009-11-03 18:59:47 ----A---- C:\Windows\system32\spwmp.dll
2009-11-03 18:59:47 ----A---- C:\Windows\system32\dxmasf.dll
2009-11-03 18:29:33 ----A---- C:\Windows\system32\wups2.dll
2009-11-03 18:29:33 ----A---- C:\Windows\system32\wuauclt.exe
2009-11-03 18:29:32 ----A---- C:\Windows\system32\wucltux.dll
2009-11-03 18:29:32 ----A---- C:\Windows\system32\wuaueng.dll
2009-11-03 18:28:57 ----A---- C:\Windows\system32\wups.dll
2009-11-03 18:28:57 ----A---- C:\Windows\system32\wudriver.dll
2009-11-03 18:28:57 ----A---- C:\Windows\system32\wuapi.dll
2009-11-03 18:28:43 ----A---- C:\Windows\system32\wuwebv.dll
2009-11-03 18:28:43 ----A---- C:\Windows\system32\wuapp.exe
2009-11-03 16:40:34 ----N---- C:\Windows\system32\MpSigStub.exe
2009-11-03 14:40:48 ----A---- C:\Windows\system32\GEARAspi.dll
2009-11-03 14:39:31 ----D---- C:\Program Files\iPod
2009-11-03 14:39:28 ----D---- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-11-03 14:39:28 ----D---- C:\Program Files\iTunes
2009-11-03 13:32:18 ----D---- C:\Program Files\Common Files\scanner
2009-11-03 13:32:08 ----D---- C:\Program Files\CA
2009-11-03 13:30:51 ----D---- C:\ProgramData\SupportSoft
2009-11-03 13:30:30 ----D---- C:\Program Files\Comcast

======List of files/folders modified in the last 1 months======

2009-11-19 16:19:39 ----D---- C:\Windows\Prefetch
2009-11-19 16:19:35 ----D---- C:\Windows\Temp
2009-11-19 16:09:22 ----D---- C:\Program Files\Mozilla Firefox
2009-11-19 14:08:40 ----SHD---- C:\System Volume Information
2009-11-19 13:02:16 ----D---- C:\Windows\Tasks
2009-11-19 13:02:11 ----D---- C:\ProgramData\Google Updater
2009-11-18 20:36:41 ----D---- C:\Program Files\Lx_cats
2009-11-18 20:36:36 ----HD---- C:\ProgramData
2009-11-18 19:49:20 ----A---- C:\Windows\ntbtlog.txt
2009-11-18 18:56:12 ----D---- C:\Program Files\Hijackthis
2009-11-18 18:38:14 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-11-18 18:36:37 ----D---- C:\ProgramData\Spybot - Search & Destroy
2009-11-18 18:35:18 ----RD---- C:\Program Files
2009-11-18 18:27:56 ----D---- C:\Program Files\a-squared Free
2009-11-18 18:26:49 ----SHD---- C:\Windows\Installer
2009-11-18 18:26:39 ----D---- C:\Program Files\Lavasoft
2009-11-18 18:26:38 ----D---- C:\ProgramData\Lavasoft
2009-11-18 18:26:37 ----DC---- C:\Windows\system32\DRVSTORE
2009-11-18 18:26:37 ----D---- C:\Windows\system32\drivers
2009-11-18 18:26:34 ----D---- C:\Windows\system32\catroot
2009-11-18 18:26:31 ----D---- C:\Windows\System32
2009-11-18 05:41:46 ----D---- C:\Windows\rescache
2009-11-18 05:31:43 ----D---- C:\Windows\inf
2009-11-18 05:31:43 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-11-18 05:27:26 ----D---- C:\Windows\system32\Tasks
2009-11-18 05:22:52 ----D---- C:\Windows
2009-11-18 05:22:40 ----D---- C:\Windows\system32\en-US
2009-11-18 05:22:35 ----D---- C:\Windows\system32\wbem
2009-11-18 05:22:31 ----D---- C:\Windows\system32\pt-PT
2009-11-18 05:22:31 ----D---- C:\Windows\system32\pt-BR
2009-11-18 05:22:31 ----D---- C:\Windows\system32\pl-PL
2009-11-18 05:22:31 ----D---- C:\Windows\system32\it-IT
2009-11-18 05:22:31 ----D---- C:\Windows\system32\he-IL
2009-11-18 05:22:31 ----D---- C:\Windows\system32\bg-BG
2009-11-18 05:22:30 ----D---- C:\Windows\system32\zh-TW
2009-11-18 05:22:30 ----D---- C:\Windows\system32\zh-HK
2009-11-18 05:22:30 ----D---- C:\Windows\system32\uk-UA
2009-11-18 05:22:30 ----D---- C:\Windows\system32\tr-TR
2009-11-18 05:22:30 ----D---- C:\Windows\system32\th-TH
2009-11-18 05:22:30 ----D---- C:\Windows\system32\sv-SE
2009-11-18 05:22:30 ----D---- C:\Windows\system32\sr-Latn-CS
2009-11-18 05:22:30 ----D---- C:\Windows\system32\sl-SI
2009-11-18 05:22:30 ----D---- C:\Windows\system32\sk-SK
2009-11-18 05:22:30 ----D---- C:\Windows\system32\nl-NL
2009-11-18 05:22:30 ----D---- C:\Windows\system32\lv-LV
2009-11-18 05:22:30 ----D---- C:\Windows\system32\lt-LT
2009-11-18 05:22:30 ----D---- C:\Windows\system32\ko-KR
2009-11-18 05:22:30 ----D---- C:\Windows\system32\hu-HU
2009-11-18 05:22:30 ----D---- C:\Windows\system32\hr-HR
2009-11-18 05:22:30 ----D---- C:\Windows\system32\fr-FR
2009-11-18 05:22:30 ----D---- C:\Windows\system32\fi-FI
2009-11-18 05:22:30 ----D---- C:\Windows\system32\et-EE
2009-11-18 05:22:30 ----D---- C:\Windows\system32\es-ES
2009-11-18 05:22:30 ----D---- C:\Windows\system32\el-GR
2009-11-18 05:22:29 ----D---- C:\Windows\system32\zh-CN
2009-11-18 05:22:29 ----D---- C:\Windows\system32\ru-RU
2009-11-18 05:22:29 ----D---- C:\Windows\system32\ro-RO
2009-11-18 05:22:29 ----D---- C:\Windows\system32\nb-NO
2009-11-18 05:22:29 ----D---- C:\Windows\system32\ja-JP
2009-11-18 05:22:29 ----D---- C:\Windows\system32\de-DE
2009-11-18 05:22:29 ----D---- C:\Windows\system32\da-DK
2009-11-18 05:22:29 ----D---- C:\Windows\system32\cs-CZ
2009-11-18 05:22:29 ----D---- C:\Windows\system32\ar-SA
2009-11-17 19:51:48 ----D---- C:\Windows\winsxs
2009-11-17 19:51:45 ----D---- C:\Windows\system32\catroot2
2009-11-15 11:33:24 ----HD---- C:\$AVG8.VAULT$
2009-11-14 20:21:53 ----D---- C:\ProgramData\Adobe
2009-11-14 20:20:47 ----D---- C:\Program Files\Common Files
2009-11-14 07:47:06 ----AD---- C:\ProgramData\TEMP
2009-11-14 07:47:02 ----D---- C:\Program Files\SpywareBlaster
2009-11-12 15:55:53 ----D---- C:\Program Files\Opera
2009-11-11 08:33:35 ----D---- C:\Program Files\Windows Mail
2009-11-11 04:46:15 ----D---- C:\ProgramData\Microsoft Help
2009-11-11 04:31:40 ----D---- C:\Windows\system32\spool
2009-11-10 16:30:41 ----D---- C:\Windows\ModemLogs
2009-11-10 16:28:34 ----D---- C:\Program Files\Verizon Wireless
2009-11-10 16:28:34 ----D---- C:\Program Files\Common Files\microsoft shared
2009-11-10 16:23:52 ----D---- C:\Windows\Downloaded Installations
2009-11-09 16:45:21 ----D---- C:\Windows\Microsoft.NET
2009-11-09 16:45:08 ----RSD---- C:\Windows\assembly
2009-11-08 15:10:01 ----SHD---- C:\boot
2009-11-08 15:00:34 ----D---- C:\Program Files\Windows Calendar
2009-11-08 15:00:33 ----D---- C:\Program Files\Movie Maker
2009-11-08 15:00:30 ----D---- C:\Program Files\Windows Sidebar
2009-11-08 15:00:30 ----D---- C:\Program Files\Windows Media Player
2009-11-08 15:00:30 ----D---- C:\Program Files\Internet Explorer
2009-11-08 15:00:29 ----D---- C:\Program Files\Windows Collaboration
2009-11-08 15:00:28 ----D---- C:\Program Files\Windows Journal
2009-11-08 15:00:25 ----D---- C:\Program Files\Windows Photo Gallery
2009-11-08 15:00:25 ----D---- C:\Program Files\Common Files\System
2009-11-08 15:00:17 ----D---- C:\Windows\servicing
2009-11-08 15:00:17 ----D---- C:\Windows\ehome
2009-11-08 15:00:17 ----D---- C:\Program Files\Windows Defender
2009-11-08 14:59:32 ----D---- C:\Windows\system32\XPSViewer
2009-11-08 14:59:32 ----D---- C:\Windows\PolicyDefinitions
2009-11-08 14:59:32 ----D---- C:\Windows\IME
2009-11-08 14:59:30 ----D---- C:\Windows\system32\oobe
2009-11-08 14:59:29 ----D---- C:\Windows\system32\migration
2009-11-08 14:59:21 ----D---- C:\Windows\system32\SLUI
2009-11-08 14:59:21 ----D---- C:\Windows\system32\setup
2009-11-08 14:59:21 ----D---- C:\Windows\system32\AdvancedInstallers
2009-11-08 14:59:20 ----D---- C:\Windows\system32\manifeststore
2009-11-08 14:59:20 ----D---- C:\Windows\system32\en
2009-11-08 14:59:09 ----D---- C:\Windows\system32\migwiz
2009-11-08 14:56:53 ----RSD---- C:\Windows\Fonts
2009-11-08 14:56:53 ----D---- C:\Windows\AppPatch
2009-11-08 14:56:46 ----D---- C:\Program Files\Microsoft Games
2009-11-08 14:56:41 ----D---- C:\Windows\system32\Boot
2009-11-05 21:27:31 ----D---- C:\Program Files\Google
2009-11-05 12:36:21 ----A---- C:\Windows\system32\mrt.exe
2009-11-04 08:06:19 ----A---- C:\Windows\system32\avgrsstx.dll
2009-11-04 06:15:52 ----D---- C:\Program Files\Microsoft Silverlight
2009-11-04 05:39:29 ----D---- C:\Program Files\Microsoft Works
2009-11-03 14:39:30 ----D---- C:\Program Files\Common Files\Apple
2009-11-03 14:36:45 ----D---- C:\Program Files\QuickTime
2009-11-03 14:30:20 ----D---- C:\ProgramData\Apple
2009-11-03 13:30:31 ----D---- C:\Program Files\Common Files\SupportSoft
2009-11-02 22:30:42 ----D---- C:\Windows\system32\config
2009-11-02 22:30:34 ----D---- C:\Windows\system32\Msdtc
2009-11-02 22:30:34 ----D---- C:\Windows\system32\CodeIntegrity
2009-11-02 22:30:33 ----D---- C:\Windows\registration

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\Windows\System32\Drivers\avgldx86.sys [2009-11-04 335240]
R1 AvgMfx86;AVG Minifilter x86 Resident Driver; C:\Windows\System32\Drivers\avgmfx86.sys [2009-11-04 27784]
R1 AvgTdiX;AVG8 Network Redirector; C:\Windows\System32\Drivers\avgtdix.sys [2009-11-04 108552]
R1 BANTExt;Belarc SMBios Access; C:\Windows\System32\Drivers\BANTExt.sys [2005-04-07 3840]
R1 CSC;Offline Files Driver; C:\Windows\system32\drivers\csc.sys [2009-04-10 351744]
R1 eabfiltr;eabfiltr; C:\Windows\system32\DRIVERS\eabfiltr.sys [2006-11-30 8192]
R2 MCSTRM;MCSTRM; C:\Windows\system32\drivers\MCSTRM.sys [2007-12-27 8413]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-18 12672]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-02-24 39936]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-01-23 42496]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-01-23 37376]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-07-10 8704]
R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2007-01-03 534016]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2009-05-18 26600]
R3 HBtnKey;HBtnKey; C:\Windows\system32\DRIVERS\cpqbttn.sys [2006-06-28 9472]
R3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDART.sys [2007-06-26 163328]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-06-20 984064]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-06-20 208896]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2007-03-06 1059112]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-12-04 7606688]
R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys [2007-02-16 12032]
R3 NWADI;NWADI Bus Enumerator; C:\Windows\system32\DRIVERS\NWADIenum.sys [2008-06-02 222720]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-10 89088]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-09-15 191408]
R3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-06-20 660480]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-19 11264]
S3 catchme;catchme; \??\C:\Users\cdoo\AppData\Local\Temp\catchme.sys []
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 hcw85bda;Hauppauge WinTV 885 Video Capture; C:\Windows\system32\drivers\HCW85BDA.sys [2006-12-01 622080]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NWUSBCDFIL;Novatel Wireless Installation CD; C:\Windows\system32\DRIVERS\NwUsbCdFil.sys [2008-07-07 20480]
S3 NWUSBModem;Novatel Wireless USB Modem Driver; C:\Windows\system32\DRIVERS\nwusbmdm.sys [2008-05-09 174336]
S3 NWUSBPort;Novatel Wireless USB Status Port Driver; C:\Windows\system32\DRIVERS\nwusbser.sys [2008-05-09 174336]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver; C:\Windows\system32\DRIVERS\nwusbser2.sys [2008-05-09 174336]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver; \??\C:\PROGRA~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [2009-03-20 32408]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-08-28 40448]
S3 usbbus;LGE CDMA Composite USB Device; C:\Windows\system32\DRIVERS\lgusbbus.sys [2007-04-09 12672]
S3 UsbDiag;LGE CDMA USB Serial Port; C:\Windows\system32\DRIVERS\lgusbdiag.sys [2007-04-09 21248]
S3 USBModem;LGE CDMA USB Modem; C:\Windows\system32\DRIVERS\lgusbmodem.sys [2007-04-09 22912]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-09-30 40448]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
R2 avg8emc;AVG Free8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2009-11-04 908056]
R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2009-11-04 297752]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 CLCapSvc;CyberLink Background Capture Service (CBCS); C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe [2007-04-23 262243]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 HP Health Check Service;HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2007-03-14 62984]
R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-05-02 135168]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-04-19 75304]
R2 lxdj_device;lxdj_device; C:\Windows\system32\lxdjcoms.exe [2007-06-11 537520]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-12-04 203296]
R2 sprtsvc_ddoctorv2;SupportSoft Sprocket Service (ddoctorv2); C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe [2008-04-24 202560]
R2 Viewpoint Manager Service;Viewpoint Manager Service; C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-03-30 1533808]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-07-10 386560]
R2 YahooAUService;Yahoo! Updater; C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe [2008-11-09 602392]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-10-28 545568]
S2 CLSched;CyberLink Task Scheduler (CTS); C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe [2007-04-23 106593]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-11-05 135664]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-24 183280]
S2 lxdjCATSCustConnectService;lxdjCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdjserv.exe [2007-06-11 99248]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 Com4Qlb;Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [2007-01-09 110592]
S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe [2008-01-19 523776]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 RoxMediaDB9;RoxMediaDB9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2007-02-12 880640]
S3 stllssvr;stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2007-02-17 74656]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2008-01-19 21504]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe [2009-04-11 918528]

-----------------EOF-----------------
cdoolake
Regular Member
 
Posts: 20
Joined: November 12th, 2009, 3:07 pm

Re: avg detected nircmd.exe trojan

Unread postby xixo_12 » November 19th, 2009, 8:42 pm

Hi,
Good! :thumbleft:

First,
Delete folder.
Please open the window explorer.
  • Right click on the start button. Click on Open Windows explorer.
  • Navigate to the directory as below.
  • Delete the file or folder in red color (if exist).
    Folders :
    C:\Program Files\a-squared Free

Next,
GMER.
Please run it again in normal mode.
Please download from HERE and save to the desktop.
  • Unzip/extract the file to its own folder.
  • Disconnect from the Internet and close all running programs.
    There is a small chance this application may crash your computer so save any work you have open.
  • Right click on Gmer.exe > Run as an Administrator to start the program.
  • Allow the gmer.sys driver to load if asked.
  • If it gives you a warning at program start about rootkit activity and asks if you want to run a scan,click NO.
  • Click on >>> symbol and choose on the Rootkit tab.
  • Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive.
  • Make sure all other boxes on the right of the screen are checked, EXCEPT for "Show All".
  • Click on the Scan and wait for the scan to finish.
    Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan.
  • When completed, click on the Copy button and right-click on your Desktop, choose "New" > Text document. Once the file is created, open it and right-click again and choose Paste or Ctrl+V. Save the file as gmer.txt and copy the information in your next reply.
  • Note: If you have any problems, try running GMER in SAFE MODE"
Important! Please do not select the "Show all" checkbox during the scan..


Next,
Malwarebytes' Anti-Malware.
Download Malwarebytes' Anti-Malware here and save to the desktop.
  • Right click on mbam-setup.exe > Run as an Administrator and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to:
    Update Malwarebytes' Anti-Malware
    Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
    Image
  • Refer to above image and then click Remove Selected to proceed.
  • When completed, a log will open in Notepad. Please copy and paste the log back into your next reply
Note:
  • The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
  • Or via the Logs tab when Malwarebytes' Anti-Malware is started.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so. Failure to reboot will prevent MBAM from removing all the malware.


Next,
Checklist.
Please post.
  • Content of GMER.txt
  • Content of MBAM log.
User avatar
xixo_12
MRU Master Emeritus
 
Posts: 2340
Joined: October 14th, 2008, 11:40 am
Location: Malaysia

Re: avg detected nircmd.exe trojan

Unread postby cdoolake » November 20th, 2009, 5:25 am

Malwarebytes' Anti-Malware 1.41
Database version: 3200
Windows 6.0.6002 Service Pack 2

11/20/2009 4:20:34 AM
mbam-log-2009-11-20 (04-20-34).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 340481
Time elapsed: 2 hour(s), 18 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
PLEASE NOTE: GMER would still not run??? ALSO I am out of town for the holidays and will not be back to this computer until monday nov. 23rd...happy thanksgiving and thanks for your help to this point.
cdoolake
Regular Member
 
Posts: 20
Joined: November 12th, 2009, 3:07 pm

Re: avg detected nircmd.exe trojan

Unread postby xixo_12 » November 20th, 2009, 12:19 pm

Hi,
ALSO I am out of town for the holidays and will not be back to this computer until monday nov. 23rd.

Thanks for let me know about your availability. This thread will remain open. See you soon. Enjoy ;)

Let's try another tool.

First,
F-Secure Blacklight by © F-Secure Corporation.
Please download from HERE and save to the desktop.
  • Open Notepad. Copy and paste the following into Notepad:
    C:\Users\Username\Desktop\fsbl.exe /expert
  • Save the NotePad file:
    • Click on File from the top menu bar.
    • Select Save As... "Filename" entry = fsblroot.bat. The "Save As Type" entry = All Files.
    • Click Save.
  • Right click on fsblroot.bat. Select Run As Administrator to run it.
    Command Prompt will open, followed by the Blacklight application screen.
  • Read the license agreement. Select "I accept the agreement" and then click Next.
  • Click on Scan.
  • Once the scan is done, close F-Secure Blacklight. Don't do anything with the results found!
  • A log file will be created on your C:\ drive...called "fsbl-yyyymmddhhmmss.log", where the yyyymmddhhmmss = date and time.
    Please post the contents of the fsbl-yyyymmddhhmmss.log, file in your next reply.

Next,
RSIT.
Please run RSIT again to produce log.txt.
***You can find manually the log at C:\rsit

Next,
Checklist.
Please post.
  • Content of fsbl-yyyymmddhhmmss.log.
  • Content of log.txt. (Find in c:\rsit)
User avatar
xixo_12
MRU Master Emeritus
 
Posts: 2340
Joined: October 14th, 2008, 11:40 am
Location: Malaysia

Re: avg detected nircmd.exe trojan

Unread postby cdoolake » November 22nd, 2009, 6:51 pm

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2009-11-22 17:35:58
Microsoft® Windows Vista™ Ultimate Service Pack 2
System drive C: has 31 GB (21%) free of 144 GB
Total RAM: 1982 MB (43% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:36:14 PM, on 11/22/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\System32\notepad.exe
C:\Users\Administrator\Downloads\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://downloads.yahoo.com/internetexplorer/welcome
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [AIMPro] "C:\Program Files\AIM\AIM Pro\aimpro.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-2882669810-3521172830-2515113265-1000\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (User 'cdoo')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net ... plugin.cab
O16 - DPF: {0C92900E-4D5A-4F04-ACC9-729E1767BBAE} (Image Uploader Control) - http://cordcamera.lifepics.com/net/Uplo ... ader45.cab
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resour ... cctrl2.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/i ... ection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/s ... DEXAXO.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxdjCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdjserv.exe
O23 - Service: lxdj_device - - C:\Windows\system32\lxdjcoms.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 11096 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Google Software Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\Spybot - Search & Destroy - Scheduled Task.job
C:\Windows\tasks\User_Feed_Synchronization-{076BC371-225E-46F2-BABB-7462A6B73100}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2008-11-20 911600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2009-11-04 1111320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll [2007-09-25 501136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-03-30 403824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-03-24 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
SingleInstance Class - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll [2008-11-20 160496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2008-11-20 911600]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"SynTPStart"=C:\Program Files\Synaptics\SynTP\SynTPStart.exe [2007-09-15 102400]
"AIMPro"=C:\Program Files\AIM\AIM Pro\aimpro.exe []
"HP Health Check Scheduler"=C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2007-03-12 50696]
"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2007-03-01 472776]
"QPService"=C:\Program Files\HP\QuickPlay\QPService.exe [2007-04-23 176128]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-09-15 1021224]
"WAWifiMessage"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [2007-01-10 317128]
"QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2007-02-13 159744]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2009-11-04 2028312]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-12-04 13556256]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-12-04 92704]
"ddoctorv2"=C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe [2008-04-24 202560]
""= []
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-10-28 141600]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]
"WindowsWelcomeCenter"=oobefldr.dll,ShowWelcomeCenter []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="avgrsstx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll [2008-01-23 233888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"RunStartupScriptSync"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\Program Files\Lexmark 1400 Series\app4r.exe"="C:\Program Files\Lexmark 1400 Series\app4r.exe:*:Enabled:Printing Application"

======List of files/folders created in the last 1 months======

2009-11-19 22:02:46 ----D---- C:\Users\Administrator\AppData\Roaming\Malwarebytes
2009-11-19 22:02:40 ----D---- C:\ProgramData\Malwarebytes
2009-11-19 22:02:40 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-11-18 19:03:24 ----D---- C:\rsit
2009-11-18 05:22:36 ----D---- C:\Program Files\Windows Portable Devices
2009-11-17 19:51:33 ----A---- C:\Windows\system32\UIAnimation.dll
2009-11-17 19:51:32 ----A---- C:\Windows\system32\UIRibbonRes.dll
2009-11-17 19:51:32 ----A---- C:\Windows\system32\UIRibbon.dll
2009-11-17 19:50:49 ----A---- C:\Windows\system32\WMPhoto.dll
2009-11-17 19:50:47 ----A---- C:\Windows\system32\cdd.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\XpsRasterService.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\XpsPrint.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\WindowsCodecs.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe
2009-11-17 19:50:46 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\dxdiagn.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\dxdiag.exe
2009-11-17 19:50:46 ----A---- C:\Windows\system32\d3d10warp.dll
2009-11-17 19:50:46 ----A---- C:\Windows\system32\d2d1.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\xpsservices.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\OpcServices.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\FntCache.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\dxgi.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\DWrite.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d11.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d10level9.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d10core.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d10_1core.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d10_1.dll
2009-11-17 19:50:45 ----A---- C:\Windows\system32\d3d10.dll
2009-11-17 19:49:50 ----A---- C:\Windows\system32\WPDShextAutoplay.exe
2009-11-17 19:49:50 ----A---- C:\Windows\system32\wpdbusenum.dll
2009-11-17 19:49:50 ----A---- C:\Windows\system32\BthMtpContextHandler.dll
2009-11-17 19:49:41 ----A---- C:\Windows\system32\PortableDeviceConnectApi.dll
2009-11-17 19:49:37 ----A---- C:\Windows\system32\wpdshext.dll
2009-11-17 19:49:37 ----A---- C:\Windows\system32\WpdMtpUS.dll
2009-11-17 19:49:37 ----A---- C:\Windows\system32\WpdConns.dll
2009-11-17 19:49:37 ----A---- C:\Windows\system32\wpd_ci.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\WPDSp.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\WPDShServiceObj.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\WpdMtp.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\PortableDeviceWMDRM.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\PortableDeviceTypes.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll
2009-11-17 19:49:36 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2009-11-17 19:47:25 ----A---- C:\Windows\system32\oleaccrc.dll
2009-11-17 19:47:23 ----A---- C:\Windows\system32\UIAutomationCore.dll
2009-11-17 19:47:23 ----A---- C:\Windows\system32\oleacc.dll
2009-11-16 14:09:13 ----D---- C:\Users\Administrator\AppData\Roaming\Mozilla
2009-11-14 20:20:47 ----D---- C:\Program Files\Common Files\Adobe
2009-11-14 20:17:42 ----D---- C:\Program Files\Common Files\Adobe AIR
2009-11-14 20:15:50 ----D---- C:\ProgramData\NOS
2009-11-14 20:12:03 ----D---- C:\Program Files\Adobe
2009-11-12 13:37:50 ----D---- C:\Program Files\Trend Micro
2009-11-10 20:07:46 ----A---- C:\Windows\system32\WSDApi.dll
2009-11-10 16:28:34 ----D---- C:\ProgramData\Verizon Wireless
2009-11-10 16:24:09 ----D---- C:\Program Files\Novatel Wireless
2009-11-08 14:56:45 ----D---- C:\Windows\system32\eu-ES
2009-11-08 14:56:45 ----D---- C:\Windows\system32\ca-ES
2009-11-08 14:56:41 ----D---- C:\Windows\system32\vi-VN
2009-11-08 14:36:55 ----D---- C:\Windows\system32\EventProviders
2009-11-08 07:27:48 ----A---- C:\Windows\system32\NlsLexicons0007.dll
2009-11-08 07:27:34 ----A---- C:\Windows\system32\SLsvc.exe
2009-11-08 07:27:34 ----A---- C:\Windows\system32\SLCExt.dll
2009-11-08 07:27:32 ----A---- C:\Windows\system32\FunctionDiscoveryFolder.dll
2009-11-08 07:27:32 ----A---- C:\Windows\system32\DevicePairingWizard.exe
2009-11-08 07:27:30 ----A---- C:\Windows\system32\NlsLexicons0009.dll
2009-11-08 07:27:25 ----A---- C:\Windows\system32\mssrch.dll
2009-11-08 07:27:22 ----A---- C:\Windows\system32\tquery.dll
2009-11-08 07:27:21 ----A---- C:\Windows\system32\PresentationNative_v0300.dll
2009-11-08 07:27:20 ----A---- C:\Windows\system32\RMActivate_isv.exe
2009-11-08 07:27:19 ----A---- C:\Windows\system32\scavenge.dll
2009-11-08 07:27:19 ----A---- C:\Windows\system32\RMActivate.exe
2009-11-08 07:27:18 ----A---- C:\Windows\system32\msi.dll
2009-11-08 07:27:17 ----A---- C:\Windows\system32\imapi2fs.dll
2009-11-08 07:27:15 ----A---- C:\Windows\system32\secproc_isv.dll
2009-11-08 07:27:14 ----A---- C:\Windows\system32\WscEapPr.dll
2009-11-08 07:27:14 ----A---- C:\Windows\system32\wcnwiz2.dll
2009-11-08 07:27:14 ----A---- C:\Windows\system32\sysmain.dll
2009-11-08 07:27:12 ----A---- C:\Windows\system32\icardagt.exe
2009-11-08 07:27:10 ----A---- C:\Windows\system32\EhStorShell.dll
2009-11-08 07:27:10 ----A---- C:\Windows\system32\AuxiliaryDisplayCpl.dll
2009-11-08 07:27:09 ----A---- C:\Windows\system32\spreview.exe
2009-11-08 07:27:09 ----A---- C:\Windows\system32\spinstall.exe
2009-11-08 07:27:09 ----A---- C:\Windows\system32\drmv2clt.dll
2009-11-08 07:27:01 ----A---- C:\Windows\system32\spwizui.dll
2009-11-08 07:27:00 ----A---- C:\Windows\system32\secproc.dll
2009-11-08 07:27:00 ----A---- C:\Windows\system32\mcupdate_GenuineIntel.dll
2009-11-08 07:26:58 ----A---- C:\Windows\system32\shell32.dll
2009-11-08 07:26:56 ----A---- C:\Windows\system32\SearchIndexer.exe
2009-11-08 07:26:56 ----A---- C:\Windows\system32\p2psvc.dll
2009-11-08 07:26:56 ----A---- C:\Windows\system32\mssvp.dll
2009-11-08 07:26:55 ----A---- C:\Windows\system32\mscoree.dll
2009-11-08 07:26:54 ----A---- C:\Windows\system32\mssphtb.dll
2009-11-08 07:26:54 ----A---- C:\Windows\system32\mssph.dll
2009-11-08 07:26:54 ----A---- C:\Windows\system32\MSMPEG2VDEC.DLL
2009-11-08 07:26:54 ----A---- C:\Windows\system32\imapi2.dll
2009-11-08 07:26:53 ----A---- C:\Windows\system32\sdohlp.dll
2009-11-08 07:26:53 ----A---- C:\Windows\system32\esent.dll
2009-11-08 07:26:52 ----A---- C:\Windows\system32\IMJP10K.DLL
2009-11-08 07:26:52 ----A---- C:\Windows\system32\DevicePairing.dll
2009-11-08 07:26:51 ----A---- C:\Windows\system32\wevtsvc.dll
2009-11-08 07:26:51 ----A---- C:\Windows\system32\sperror.dll
2009-11-08 07:26:51 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2009-11-08 07:26:51 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2009-11-08 07:26:51 ----A---- C:\Windows\system32\korwbrkr.dll
2009-11-08 07:26:50 ----A---- C:\Windows\system32\SLC.dll
2009-11-08 07:26:50 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2009-11-08 07:26:50 ----A---- C:\Windows\system32\IasMigReader.exe
2009-11-08 07:26:49 ----A---- C:\Windows\system32\msshsq.dll
2009-11-08 07:26:48 ----A---- C:\Windows\system32\pmcsnap.dll
2009-11-08 07:26:47 ----A---- C:\Windows\system32\msjet40.dll
2009-11-08 07:26:47 ----A---- C:\Windows\system32\MPSSVC.dll
2009-11-08 07:26:46 ----A---- C:\Windows\system32\Query.dll
2009-11-08 07:26:46 ----A---- C:\Windows\system32\qmgr.dll
2009-11-08 07:26:46 ----A---- C:\Windows\system32\msxml6.dll
2009-11-08 07:26:45 ----A---- C:\Windows\system32\P2PGraph.dll
2009-11-08 07:26:45 ----A---- C:\Windows\system32\msexch40.dll
2009-11-08 07:26:45 ----A---- C:\Windows\system32\diagperf.dll
2009-11-08 07:26:44 ----A---- C:\Windows\system32\srchadmin.dll
2009-11-08 07:26:44 ----A---- C:\Windows\system32\ole32.dll
2009-11-08 07:26:44 ----A---- C:\Windows\system32\ntdll.dll
2009-11-08 07:26:43 ----A---- C:\Windows\system32\winload.exe
2009-11-08 07:26:43 ----A---- C:\Windows\system32\uDWM.dll
2009-11-08 07:26:43 ----A---- C:\Windows\system32\msxml3.dll
2009-11-08 07:26:43 ----A---- C:\Windows\system32\mmc.exe
2009-11-08 07:26:43 ----A---- C:\Windows\system32\mblctr.exe
2009-11-08 07:26:43 ----A---- C:\Windows\system32\EncDec.dll
2009-11-08 07:26:42 ----A---- C:\Windows\system32\riched20.dll
2009-11-08 07:26:42 ----A---- C:\Windows\system32\IasMigPlugin.dll
2009-11-08 07:26:42 ----A---- C:\Windows\system32\dfsr.exe
2009-11-08 07:26:41 ----A---- C:\Windows\system32\RacEngn.dll
2009-11-08 07:26:41 ----A---- C:\Windows\system32\fdBth.dll
2009-11-08 07:26:40 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2009-11-08 07:26:40 ----A---- C:\Windows\system32\SearchFilterHost.exe
2009-11-08 07:26:40 ----A---- C:\Windows\system32\milcore.dll
2009-11-08 07:26:40 ----A---- C:\Windows\system32\kernel32.dll
2009-11-08 07:26:39 ----A---- C:\Windows\system32\spoolss.dll
2009-11-08 07:26:39 ----A---- C:\Windows\system32\schedsvc.dll
2009-11-08 07:26:39 ----A---- C:\Windows\system32\NaturalLanguage6.dll
2009-11-08 07:26:39 ----A---- C:\Windows\system32\EhStorAPI.dll
2009-11-08 07:26:39 ----A---- C:\Windows\system32\CertEnroll.dll
2009-11-08 07:26:38 ----A---- C:\Windows\system32\msjtes40.dll
2009-11-08 07:26:38 ----A---- C:\Windows\system32\AuxiliaryDisplayDriverLib.dll
2009-11-08 07:26:37 ----A---- C:\Windows\system32\msvcp60.dll
2009-11-08 07:26:37 ----A---- C:\Windows\system32\gpedit.dll
2009-11-08 07:26:36 ----A---- C:\Windows\system32\infocardapi.dll
2009-11-08 07:26:35 ----A---- C:\Windows\system32\WinSAT.exe
2009-11-08 07:26:34 ----A---- C:\Windows\system32\PresentationSettings.exe
2009-11-08 07:26:34 ----A---- C:\Windows\system32\Magnify.exe
2009-11-08 07:26:34 ----A---- C:\Windows\system32\fveapi.dll
2009-11-08 07:26:34 ----A---- C:\Windows\system32\es.dll
2009-11-08 07:26:34 ----A---- C:\Windows\system32\cscsvc.dll
2009-11-08 07:26:34 ----A---- C:\Windows\system32\AuxiliaryDisplayServices.dll
2009-11-08 07:26:33 ----A---- C:\Windows\system32\mstext40.dll
2009-11-08 07:26:33 ----A---- C:\Windows\system32\advapi32.dll
2009-11-08 07:26:32 ----A---- C:\Windows\system32\WebClnt.dll
2009-11-08 07:26:31 ----A---- C:\Windows\system32\slwmi.dll
2009-11-08 07:26:31 ----A---- C:\Windows\system32\msexcl40.dll
2009-11-08 07:26:31 ----A---- C:\Windows\system32\comsvcs.dll
2009-11-08 07:26:30 ----A---- C:\Windows\system32\vssapi.dll
2009-11-08 07:26:30 ----A---- C:\Windows\system32\msxbde40.dll
2009-11-08 07:26:30 ----A---- C:\Windows\system32\msfeeds.dll
2009-11-08 07:26:29 ----A---- C:\Windows\system32\vbscript.dll
2009-11-08 07:26:29 ----A---- C:\Windows\system32\NetProjW.dll
2009-11-08 07:26:29 ----A---- C:\Windows\system32\authui.dll
2009-11-08 07:26:28 ----A---- C:\Windows\system32\propsys.dll
2009-11-08 07:26:28 ----A---- C:\Windows\system32\PresentationHost.exe
2009-11-08 07:26:28 ----A---- C:\Windows\system32\newdev.dll
2009-11-08 07:26:28 ----A---- C:\Windows\system32\msrepl40.dll
2009-11-08 07:26:27 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-11-08 07:26:27 ----A---- C:\Windows\system32\iasrecst.dll
2009-11-08 07:26:27 ----A---- C:\Windows\system32\gpsvc.dll
2009-11-08 07:26:27 ----A---- C:\Windows\system32\eudcedit.exe
2009-11-08 07:26:27 ----A---- C:\Windows\system32\crypt32.dll
2009-11-08 07:26:27 ----A---- C:\Windows\explorer.exe
2009-11-08 07:26:26 ----A---- C:\Windows\system32\setupapi.dll
2009-11-08 07:26:26 ----A---- C:\Windows\system32\rpcss.dll
2009-11-08 07:26:26 ----A---- C:\Windows\system32\mspbde40.dll
2009-11-08 07:26:26 ----A---- C:\Windows\system32\iedkcs32.dll
2009-11-08 07:26:26 ----A---- C:\Windows\system32\d3d9.dll
2009-11-08 07:26:25 ----A---- C:\Windows\system32\msltus40.dll
2009-11-08 07:26:25 ----A---- C:\Windows\system32\mfc42.dll
2009-11-08 07:26:25 ----A---- C:\Windows\system32\davclnt.dll
2009-11-08 07:26:24 ----A---- C:\Windows\system32\shlwapi.dll
2009-11-08 07:26:24 ----A---- C:\Windows\system32\msrd3x40.dll
2009-11-08 07:26:24 ----A---- C:\Windows\system32\msdtctm.dll
2009-11-08 07:26:24 ----A---- C:\Windows\system32\EhStorPwdMgr.dll
2009-11-08 07:26:24 ----A---- C:\Windows\system32\EhStorAuthn.dll
2009-11-08 07:26:23 ----A---- C:\Windows\system32\wevtapi.dll
2009-11-08 07:26:23 ----A---- C:\Windows\system32\photowiz.dll
2009-11-08 07:26:23 ----A---- C:\Windows\system32\nlhtml.dll
2009-11-08 07:26:23 ----A---- C:\Windows\system32\browseui.dll
2009-11-08 07:26:20 ----A---- C:\Windows\system32\user32.dll
2009-11-08 07:26:19 ----A---- C:\Windows\system32\win32spl.dll
2009-11-08 07:26:19 ----A---- C:\Windows\system32\samsrv.dll
2009-11-08 07:26:19 ----A---- C:\Windows\system32\quartz.dll
2009-11-08 07:26:19 ----A---- C:\Windows\system32\ci.dll
2009-11-08 07:26:18 ----A---- C:\Windows\system32\WcnNetsh.dll
2009-11-08 07:26:18 ----A---- C:\Windows\system32\SLCommDlg.dll
2009-11-08 07:26:18 ----A---- C:\Windows\system32\oleaut32.dll
2009-11-08 07:26:18 ----A---- C:\Windows\system32\kerberos.dll
2009-11-08 07:26:18 ----A---- C:\Windows\system32\IKEEXT.DLL
2009-11-08 07:26:17 ----A---- C:\Windows\system32\winhttp.dll
2009-11-08 07:26:17 ----A---- C:\Windows\system32\netshell.dll
2009-11-08 07:26:17 ----A---- C:\Windows\system32\compcln.exe
2009-11-08 07:26:17 ----A---- C:\Windows\system32\apds.dll
2009-11-08 07:26:16 ----A---- C:\Windows\system32\xmlfilter.dll
2009-11-08 07:26:16 ----A---- C:\Windows\system32\mswstr10.dll
2009-11-08 07:26:16 ----A---- C:\Windows\system32\msctf.dll
2009-11-08 07:26:16 ----A---- C:\Windows\system32\emdmgmt.dll
2009-11-08 07:26:16 ----A---- C:\Windows\system32\audiosrv.dll
2009-11-08 07:26:15 ----A---- C:\Windows\system32\VSSVC.exe
2009-11-08 07:26:15 ----A---- C:\Windows\system32\QAGENTRT.DLL
2009-11-08 07:26:15 ----A---- C:\Windows\system32\msvcrt.dll
2009-11-08 07:26:15 ----A---- C:\Windows\system32\mfc42u.dll
2009-11-08 07:26:15 ----A---- C:\Windows\system32\iphlpsvc.dll
2009-11-08 07:26:15 ----A---- C:\Windows\system32\gdi32.dll
2009-11-08 07:26:14 ----A---- C:\Windows\system32\SLUI.exe
2009-11-08 07:26:14 ----A---- C:\Windows\system32\msrd2x40.dll
2009-11-08 07:26:14 ----A---- C:\Windows\system32\eapphost.dll
2009-11-08 07:26:13 ----A---- C:\Windows\system32\wbengine.exe
2009-11-08 07:26:13 ----A---- C:\Windows\system32\sqlsrv32.dll
2009-11-08 07:26:13 ----A---- C:\Windows\system32\odbc32.dll
2009-11-08 07:26:12 ----A---- C:\Windows\system32\winresume.exe
2009-11-08 07:26:12 ----A---- C:\Windows\system32\shdocvw.dll
2009-11-08 07:26:12 ----A---- C:\Windows\system32\propdefs.dll
2009-11-08 07:26:11 ----A---- C:\Windows\system32\wevtutil.exe
2009-11-08 07:26:11 ----A---- C:\Windows\system32\dbgeng.dll
2009-11-08 07:26:10 ----A---- C:\Windows\system32\mssitlb.dll
2009-11-08 07:26:09 ----A---- C:\Windows\system32\WsmSvc.dll
2009-11-08 07:26:09 ----A---- C:\Windows\system32\usp10.dll
2009-11-08 07:26:09 ----A---- C:\Windows\system32\swprv.dll
2009-11-08 07:26:09 ----A---- C:\Windows\system32\mmcndmgr.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\vds.exe
2009-11-08 07:26:08 ----A---- C:\Windows\system32\netlogon.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\msscb.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\mshtmled.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\msctfp.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\fdBthProxy.dll
2009-11-08 07:26:08 ----A---- C:\Windows\system32\drvinst.exe
2009-11-08 07:26:08 ----A---- C:\Windows\system32\devmgr.dll
2009-11-08 07:26:07 ----A---- C:\Windows\system32\DevicePairingProxy.dll
2009-11-08 07:26:07 ----A---- C:\Windows\system32\BFE.DLL
2009-11-08 07:26:07 ----A---- C:\Windows\system32\adsldpc.dll
2009-11-08 07:26:06 ----A---- C:\Windows\system32\Wldap32.dll
2009-11-08 07:26:06 ----A---- C:\Windows\system32\WFS.exe
2009-11-08 07:26:06 ----A---- C:\Windows\system32\wcnwiz.dll
2009-11-08 07:26:06 ----A---- C:\Windows\system32\schannel.dll
2009-11-08 07:26:06 ----A---- C:\Windows\system32\evr.dll
2009-11-08 07:26:05 ----A---- C:\Windows\system32\WMVSDECD.DLL
2009-11-08 07:26:05 ----A---- C:\Windows\system32\services.exe
2009-11-08 07:26:04 ----A---- C:\Windows\system32\wercon.exe
2009-11-08 07:26:04 ----A---- C:\Windows\system32\wcncsvc.dll
2009-11-08 07:26:04 ----A---- C:\Windows\system32\mimefilt.dll
2009-11-08 07:26:04 ----A---- C:\Windows\system32\iertutil.dll
2009-11-08 07:26:04 ----A---- C:\Windows\system32\comdlg32.dll
2009-11-08 07:26:04 ----A---- C:\Windows\system32\adtschema.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\taskeng.exe
2009-11-08 07:26:03 ----A---- C:\Windows\system32\rtffilt.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\reg.exe
2009-11-08 07:26:03 ----A---- C:\Windows\system32\mswdat10.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\msjter40.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\msdtcprx.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\msdrm.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\ipsmsnap.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\dnsapi.dll
2009-11-08 07:26:03 ----A---- C:\Windows\system32\certcli.dll
2009-11-08 07:26:02 ----A---- C:\Windows\system32\WMNetMgr.dll
2009-11-08 07:26:02 ----A---- C:\Windows\system32\umpnpmgr.dll
2009-11-08 07:26:02 ----A---- C:\Windows\system32\certutil.exe
2009-11-08 07:26:01 ----A---- C:\Windows\system32\w32time.dll
2009-11-08 07:26:01 ----A---- C:\Windows\system32\IPSECSVC.DLL
2009-11-08 07:26:00 ----A---- C:\Windows\system32\rsaenh.dll
2009-11-08 07:26:00 ----A---- C:\Windows\system32\msshooks.dll
2009-11-08 07:26:00 ----A---- C:\Windows\system32\msscntrs.dll
2009-11-08 07:26:00 ----A---- C:\Windows\system32\bthserv.dll
2009-11-08 07:26:00 ----A---- C:\Windows\system32\bcrypt.dll
2009-11-08 07:25:59 ----A---- C:\Windows\system32\msihnd.dll
2009-11-08 07:25:58 ----A---- C:\Windows\system32\TsWpfWrp.exe
2009-11-08 07:25:58 ----A---- C:\Windows\system32\MMDevAPI.dll
2009-11-08 07:25:57 ----A---- C:\Windows\system32\msstrc.dll
2009-11-08 07:25:56 ----A---- C:\Windows\system32\scrptadm.dll
2009-11-08 07:25:56 ----A---- C:\Windows\system32\inetcomm.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\netapi32.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\mtxclu.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\mscories.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\inetpp.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\hidserv.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\fundisc.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\dfshim.dll
2009-11-08 07:25:55 ----A---- C:\Windows\system32\cryptsvc.dll
2009-11-08 07:25:54 ----A---- C:\Windows\system32\wmicmiplugin.dll
2009-11-08 07:25:54 ----A---- C:\Windows\system32\termsrv.dll
2009-11-08 07:25:54 ----A---- C:\Windows\system32\profsvc.dll
2009-11-08 07:25:54 ----A---- C:\Windows\system32\dhcpcsvc6.dll
2009-11-08 07:25:53 ----A---- C:\Windows\system32\wdc.dll
2009-11-08 07:25:53 ----A---- C:\Windows\system32\shsvcs.dll
2009-11-08 07:25:53 ----A---- C:\Windows\system32\msiexec.exe
2009-11-08 07:25:53 ----A---- C:\Windows\system32\imapi.dll
2009-11-08 07:25:53 ----A---- C:\Windows\system32\chsbrkr.dll
2009-11-08 07:25:52 ----A---- C:\Windows\system32\spoolsv.exe
2009-11-08 07:25:52 ----A---- C:\Windows\system32\rasmans.dll
2009-11-08 07:25:52 ----A---- C:\Windows\system32\pnidui.dll
2009-11-08 07:25:52 ----A---- C:\Windows\system32\icardres.dll
2009-11-08 07:25:52 ----A---- C:\Windows\system32\iassdo.dll
2009-11-08 07:25:52 ----A---- C:\Windows\system32\autofmt.exe
2009-11-08 07:25:51 ----A---- C:\Windows\system32\wersvc.dll
2009-11-08 07:25:51 ----A---- C:\Windows\system32\slmgr.vbs
2009-11-08 07:25:51 ----A---- C:\Windows\system32\scrrun.dll
2009-11-08 07:25:51 ----A---- C:\Windows\system32\PSHED.DLL
2009-11-08 07:25:50 ----A---- C:\Windows\system32\pidgenx.dll
2009-11-08 07:25:50 ----A---- C:\Windows\system32\pdh.dll
2009-11-08 07:25:50 ----A---- C:\Windows\system32\dhcpcsvc.dll
2009-11-08 07:25:50 ----A---- C:\Windows\system32\CertEnrollUI.dll
2009-11-08 07:25:50 ----A---- C:\Windows\system32\azroles.dll
2009-11-08 07:25:49 ----A---- C:\Windows\system32\wmpmde.dll
2009-11-08 07:25:49 ----A---- C:\Windows\system32\winlogon.exe
2009-11-08 07:25:49 ----A---- C:\Windows\system32\SyncCenter.dll
2009-11-08 07:25:48 ----A---- C:\Windows\system32\SLUINotify.dll
2009-11-08 07:25:48 ----A---- C:\Windows\system32\msjetoledb40.dll
2009-11-08 07:25:48 ----A---- C:\Windows\system32\comuid.dll
2009-11-08 07:25:47 ----A---- C:\Windows\system32\spp.dll
2009-11-08 07:25:47 ----A---- C:\Windows\system32\sethc.exe
2009-11-08 07:25:47 ----A---- C:\Windows\system32\ncrypt.dll
2009-11-08 07:25:47 ----A---- C:\Windows\system32\kd1394.dll
2009-11-08 07:25:47 ----A---- C:\Windows\system32\iassam.dll
2009-11-08 07:25:47 ----A---- C:\Windows\system32\certmgr.dll
2009-11-08 07:25:46 ----A---- C:\Windows\system32\wisptis.exe
2009-11-08 07:25:46 ----A---- C:\Windows\system32\untfs.dll
2009-11-08 07:25:46 ----A---- C:\Windows\system32\taskcomp.dll
2009-11-08 07:25:46 ----A---- C:\Windows\system32\scrobj.dll
2009-11-08 07:25:46 ----A---- C:\Windows\system32\rtutils.dll
2009-11-08 07:25:46 ----A---- C:\Windows\system32\dwm.exe
2009-11-08 07:25:45 ----A---- C:\Windows\system32\iasnap.dll
2009-11-08 07:25:45 ----A---- C:\Windows\system32\cscui.dll
2009-11-08 07:25:45 ----A---- C:\Windows\system32\autochk.exe
2009-11-08 07:25:44 ----A---- C:\Windows\system32\winsrv.dll
2009-11-08 07:25:44 ----A---- C:\Windows\system32\printui.dll
2009-11-08 07:25:44 ----A---- C:\Windows\system32\cscript.exe
2009-11-08 07:25:44 ----A---- C:\Windows\system32\autoconv.exe
2009-11-08 07:25:43 ----A---- C:\Windows\system32\wow32.dll
2009-11-08 07:25:43 ----A---- C:\Windows\system32\userenv.dll
2009-11-08 07:25:43 ----A---- C:\Windows\system32\onex.dll
2009-11-08 07:25:43 ----A---- C:\Windows\system32\kdcom.dll
2009-11-08 07:25:43 ----A---- C:\Windows\system32\basecsp.dll
2009-11-08 07:25:43 ----A---- C:\Windows\system32\audiodg.exe
2009-11-08 07:25:42 ----A---- C:\Windows\system32\osk.exe
2009-11-08 07:25:42 ----A---- C:\Windows\system32\mswsock.dll
2009-11-08 07:25:40 ----A---- C:\Windows\system32\winmm.dll
2009-11-08 07:25:40 ----A---- C:\Windows\system32\spcmsg.dll
2009-11-08 07:25:40 ----A---- C:\Windows\system32\RelMon.dll
2009-11-08 07:25:40 ----A---- C:\Windows\system32\rdpencom.dll
2009-11-08 07:25:40 ----A---- C:\Windows\system32\kdusb.dll
2009-11-08 07:25:39 ----A---- C:\Windows\system32\WinSCard.dll
2009-11-08 07:25:39 ----A---- C:\Windows\system32\WerFaultSecure.exe
2009-11-08 07:25:39 ----A---- C:\Windows\system32\offfilt.dll
2009-11-08 07:25:39 ----A---- C:\Windows\system32\msftedit.dll
2009-11-08 07:25:39 ----A---- C:\Windows\system32\dnsrslvr.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\wsepno.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\WerFault.exe
2009-11-08 07:25:38 ----A---- C:\Windows\system32\Utilman.exe
2009-11-08 07:25:38 ----A---- C:\Windows\system32\stobject.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\secproc_ssp.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\mfplat.dll
2009-11-08 07:25:38 ----A---- C:\Windows\system32\diskraid.exe
2009-11-08 07:25:37 ----A---- C:\Windows\system32\wiaservc.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\sysclass.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\SndVol.exe
2009-11-08 07:25:37 ----A---- C:\Windows\system32\prnntfy.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\msnetobj.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\mscms.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\mcmde.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\apphelp.dll
2009-11-08 07:25:37 ----A---- C:\Windows\system32\adsmsext.dll
2009-11-08 07:25:36 ----A---- C:\Windows\system32\wscript.exe
2009-11-08 07:25:36 ----A---- C:\Windows\system32\ulib.dll
2009-11-08 07:25:36 ----A---- C:\Windows\system32\odbccp32.dll
2009-11-08 07:25:36 ----A---- C:\Windows\system32\iasdatastore.dll
2009-11-08 07:25:36 ----A---- C:\Windows\system32\dsound.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\wscntfy.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\rastapi.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\pnpsetup.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\ipsecsnp.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\IPHLPAPI.DLL
2009-11-08 07:25:35 ----A---- C:\Windows\system32\fdProxy.dll
2009-11-08 07:25:35 ----A---- C:\Windows\system32\cryptui.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\wscsvc.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\WMVENCOD.DLL
2009-11-08 07:25:34 ----A---- C:\Windows\system32\wlangpui.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\vdsdyn.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\rastls.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\logman.exe
2009-11-08 07:25:34 ----A---- C:\Windows\system32\iepeers.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\iashlpr.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\gpapi.dll
2009-11-08 07:25:34 ----A---- C:\Windows\system32\diskpart.exe
2009-11-08 07:25:34 ----A---- C:\Windows\system32\brcpl.dll
2009-11-08 07:25:33 ----A---- C:\Windows\system32\regsvc.dll
2009-11-08 07:25:33 ----A---- C:\Windows\system32\rasapi32.dll
2009-11-08 07:25:33 ----A---- C:\Windows\system32\ntprint.dll
2009-11-08 07:25:33 ----A---- C:\Windows\system32\mscorier.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\zipfldr.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\wusa.exe
2009-11-08 07:25:32 ----A---- C:\Windows\system32\wshext.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\wpccpl.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\netcenter.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\iasrad.dll
2009-11-08 07:25:32 ----A---- C:\Windows\system32\findstr.exe
2009-11-08 07:25:31 ----A---- C:\Windows\system32\wer.dll
2009-11-08 07:25:31 ----A---- C:\Windows\system32\webcheck.dll
2009-11-08 07:25:31 ----A---- C:\Windows\system32\rasdlg.dll
2009-11-08 07:25:31 ----A---- C:\Windows\system32\iassvcs.dll
2009-11-08 07:25:30 ----A---- C:\Windows\system32\wsnmp32.dll
2009-11-08 07:25:30 ----A---- C:\Windows\system32\themecpl.dll
2009-11-08 07:25:29 ----A---- C:\Windows\system32\uxsms.dll
2009-11-08 07:25:29 ----A---- C:\Windows\system32\srvsvc.dll
2009-11-08 07:25:29 ----A---- C:\Windows\system32\mssprxy.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\tsbyuv.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\slcc.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\scansetting.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\powrprof.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\ntmarta.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\msutb.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\mstlsapi.dll
2009-11-08 07:25:28 ----A---- C:\Windows\system32\iasads.dll
2009-11-08 07:25:27 ----A---- C:\Windows\system32\powercpl.dll
2009-11-08 07:25:27 ----A---- C:\Windows\system32\PerfCenterCPL.dll
2009-11-08 07:25:27 ----A---- C:\Windows\system32\networkmap.dll
2009-11-08 07:25:27 ----A---- C:\Windows\system32\mstsc.exe
2009-11-08 07:25:27 ----A---- C:\Windows\system32\iasacct.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\umrdp.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\sud.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\newdev.exe
2009-11-08 07:25:26 ----A---- C:\Windows\system32\fveui.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\dot3svc.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\connect.dll
2009-11-08 07:25:26 ----A---- C:\Windows\system32\authz.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\themeui.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\systemcpl.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\samlib.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\pcaui.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\mmci.dll
2009-11-08 07:25:25 ----A---- C:\Windows\system32\accessibilitycpl.dll
2009-11-08 07:25:24 ----A---- C:\Windows\system32\wlanpref.dll
2009-11-08 07:25:24 ----A---- C:\Windows\system32\usercpl.dll
2009-11-08 07:25:24 ----A---- C:\Windows\system32\qdvd.dll
2009-11-08 07:25:24 ----A---- C:\Windows\system32\brcplsiw.dll
2009-11-08 07:25:24 ----A---- C:\Windows\system32\autoplay.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\wpcao.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\vdsutil.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\tapisrv.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\rpchttp.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\regapi.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\msinfo32.exe
2009-11-08 07:25:23 ----A---- C:\Windows\system32\ieaksie.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\fvecpl.dll
2009-11-08 07:25:23 ----A---- C:\Windows\system32\cscobj.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\wscisvif.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\scksp.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\scesrv.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\rekeywiz.exe
2009-11-08 07:25:22 ----A---- C:\Windows\system32\psisdecd.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\oleprn.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\mpr.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\imm32.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\iaspolcy.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\feclient.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\Faultrep.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\dot3msm.dll
2009-11-08 07:25:22 ----A---- C:\Windows\system32\AudioSes.dll
2009-11-08 07:25:21 ----A---- C:\Windows\system32\WindowsUltimateExtrasCPL.dll
2009-11-08 07:25:21 ----A---- C:\Windows\system32\sdclt.exe
2009-11-08 07:25:21 ----A---- C:\Windows\system32\ncryptui.dll
2009-11-08 07:25:21 ----A---- C:\Windows\system32\dpapimig.exe
2009-11-08 07:25:21 ----A---- C:\Windows\system32\DeviceEject.exe
2009-11-08 07:25:20 ----A---- C:\Windows\system32\TSTheme.exe
2009-11-08 07:25:20 ----A---- C:\Windows\system32\SmartcardCredentialProvider.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\scecli.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\rasplap.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\rasgcw.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\qedit.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\pnpui.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\perfdisk.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\hdwwiz.exe
2009-11-08 07:25:20 ----A---- C:\Windows\system32\FWPUCLNT.DLL
2009-11-08 07:25:20 ----A---- C:\Windows\system32\extmgr.dll
2009-11-08 07:25:20 ----A---- C:\Windows\system32\certreq.exe
2009-11-08 07:25:19 ----A---- C:\Windows\system32\whealogr.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\tcpmon.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\tcpipcfg.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\srcore.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\spwinsat.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\PnPUnattend.exe
2009-11-08 07:25:19 ----A---- C:\Windows\system32\fdWSD.dll
2009-11-08 07:25:19 ----A---- C:\Windows\system32\cmmon32.exe
2009-11-08 07:25:18 ----A---- C:\Windows\system32\wiaaut.dll
2009-11-08 07:25:18 ----A---- C:\Windows\system32\SnippingTool.exe
2009-11-08 07:25:18 ----A---- C:\Windows\system32\SCardSvr.dll
2009-11-08 07:25:18 ----A---- C:\Windows\system32\raschap.dll
2009-11-08 07:25:18 ----A---- C:\Windows\system32\MSVidCtl.dll
2009-11-08 07:25:18 ----A---- C:\Windows\system32\fontext.dll
2009-11-08 07:25:18 ----A---- C:\Windows\system32\conime.exe
2009-11-08 07:25:18 ----A---- C:\Windows\system32\cmdial32.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\WMVXENCD.DLL
2009-11-08 07:25:17 ----A---- C:\Windows\system32\wlanui.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\shwebsvc.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\rasppp.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\PnPutil.exe
2009-11-08 07:25:17 ----A---- C:\Windows\system32\oobefldr.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\dsprop.dll
2009-11-08 07:25:17 ----A---- C:\Windows\system32\dimsroam.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\shsetup.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\rasmontr.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\occache.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\mscandui.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\modemui.dll
2009-11-08 07:25:16 ----A---- C:\Windows\system32\chtbrkr.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\wmdrmsdk.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\wlgpclnt.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\tscfgwmi.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\rdpwsx.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\dataclen.dll
2009-11-08 07:25:15 ----A---- C:\Windows\system32\blackbox.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\WSDMon.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\wmpeffects.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\smss.exe
2009-11-08 07:25:14 ----A---- C:\Windows\system32\netplwiz.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\CscMig.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\credui.dll
2009-11-08 07:25:14 ----A---- C:\Windows\system32\appmgmts.dll
2009-11-08 07:25:13 ----A---- C:\Windows\system32\wpcsvc.dll
2009-11-08 07:25:13 ----A---- C:\Windows\system32\networkexplorer.dll
2009-11-08 07:25:13 ----A---- C:\Windows\system32\mstime.dll
2009-11-08 07:25:13 ----A---- C:\Windows\system32\logagent.exe
2009-11-08 07:25:13 ----A---- C:\Windows\system32\ifmon.dll
2009-11-08 07:25:13 ----A---- C:\Windows\system32\cipher.exe
2009-11-08 07:25:13 ----A---- C:\Windows\system32\certprop.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\wscapi.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\msscp.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\msrating.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\msimtf.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\InkEd.dll
2009-11-08 07:25:12 ----A---- C:\Windows\system32\gpresult.exe
2009-11-08 07:25:11 ----A---- C:\Windows\system32\thawbrkr.dll
2009-11-08 07:25:11 ----A---- C:\Windows\system32\softkbd.dll
2009-11-08 07:25:11 ----A---- C:\Windows\system32\sendmail.dll
2009-11-08 07:25:11 ----A---- C:\Windows\system32\MediaMetadataHandler.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\version.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\rdpclip.exe
2009-11-08 07:25:10 ----A---- C:\Windows\system32\puiapi.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\olepro32.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\msctfui.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\mprapi.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\input.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\gpprnext.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\ExplorerFrame.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\drmmgrtn.dll
2009-11-08 07:25:10 ----A---- C:\Windows\system32\dmsynth.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\wshbth.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\SLLUA.exe
2009-11-08 07:25:09 ----A---- C:\Windows\system32\rdpendp.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\msjint40.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\msisip.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\MsCtfMonitor.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\fdSSDP.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\fc.exe
2009-11-08 07:25:09 ----A---- C:\Windows\system32\dmusic.dll
2009-11-08 07:25:09 ----A---- C:\Windows\system32\cscapi.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\wsdchngr.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\tscupgrd.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\Storprop.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\SMBHelperClass.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\slcinst.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\rasdial.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\rasdiag.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\PrintBrmUi.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\nslookup.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\networkitemfactory.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\msfeedsbs.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\l2nacp.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\ipconfig.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\gpscript.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\ftp.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\fdWCN.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\eappcfg.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\eapp3hst.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\dot3cfg.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\cscdll.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\CHxReadingStringIME.dll
2009-11-08 07:25:08 ----A---- C:\Windows\system32\bthudtask.exe
2009-11-08 07:25:08 ----A---- C:\Windows\system32\bthci.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\qprocess.exe
2009-11-08 07:25:07 ----A---- C:\Windows\system32\ocsetup.exe
2009-11-08 07:25:07 ----A---- C:\Windows\system32\mmcico.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\hbaapi.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\gpscript.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\FwRemoteSvr.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\fdeploy.dll
2009-11-08 07:25:07 ----A---- C:\Windows\system32\eappgnui.dll
2009-11-08 07:25:06 ----A---- C:\Windows\system32\tscon.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\shadow.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\PNPXAssoc.dll
2009-11-08 07:25:06 ----A---- C:\Windows\system32\NcdProp.dll
2009-11-08 07:25:06 ----A---- C:\Windows\system32\logoff.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\iscsilog.dll
2009-11-08 07:25:06 ----A---- C:\Windows\system32\gpupdate.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\csrstub.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\chgusr.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\chgport.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\cbsra.exe
2009-11-08 07:25:06 ----A---- C:\Windows\system32\bitsigd.dll
2009-11-08 07:25:05 ----A---- C:\Windows\system32\vdmdbg.dll
2009-11-08 07:25:05 ----A---- C:\Windows\system32\tskill.exe
2009-11-08 07:25:05 ----A---- C:\Windows\system32\tsdiscon.exe
2009-11-08 07:25:05 ----A---- C:\Windows\system32\rwinsta.exe
2009-11-08 07:25:05 ----A---- C:\Windows\system32\qappsrv.exe
2009-11-08 07:25:05 ----A---- C:\Windows\system32\chglogon.exe
2009-11-08 07:25:04 ----A---- C:\Windows\system32\winrnr.dll
2009-11-08 07:25:04 ----A---- C:\Windows\system32\slwga.dll
2009-11-08 07:25:04 ----A---- C:\Windows\system32\reset.exe
2009-11-08 07:25:04 ----A---- C:\Windows\system32\query.exe
2009-11-08 07:25:04 ----A---- C:\Windows\system32\odbcconf.dll
2009-11-08 07:25:04 ----A---- C:\Windows\system32\midimap.dll
2009-11-08 07:25:04 ----A---- C:\Windows\system32\inetppui.dll
2009-11-08 07:25:04 ----A---- C:\Windows\system32\change.exe
2009-11-08 07:24:58 ----A---- C:\Windows\system32\f3ahvoas.dll
2009-11-08 07:24:57 ----A---- C:\Windows\system32\msimsg.dll
2009-11-08 07:24:41 ----A---- C:\Windows\system32\SmiEngine.dll
2009-11-08 07:24:37 ----A---- C:\Windows\system32\wdscore.dll
2009-11-08 07:24:37 ----A---- C:\Windows\system32\PkgMgr.exe
2009-11-08 07:24:28 ----A---- C:\Windows\system32\drvstore.dll
2009-11-07 20:39:49 ----D---- C:\ProgramData\AIM
2009-11-07 20:39:26 ----D---- C:\Program Files\AIM
2009-11-07 20:39:18 ----D---- C:\Program Files\Common Files\Software Update Utility
2009-11-07 20:38:45 ----D---- C:\ProgramData\AOL Downloads
2009-11-06 14:11:54 ----D---- C:\Program Files\BitLocker
2009-11-06 14:01:49 ----A---- C:\Windows\system32\SecureKeyBackupCPL.dll
2009-11-06 13:47:37 ----A---- C:\Windows\system32\netfxperf.dll
2009-11-06 13:46:33 ----D---- C:\Windows\system32\WindowsPowerShell
2009-11-06 13:44:27 ----D---- C:\Program Files\Microsoft
2009-11-05 09:03:47 ----A---- C:\Windows\system32\mshtml.dll
2009-11-04 06:31:29 ----A---- C:\Windows\system32\ieframe.dll
2009-11-04 06:31:27 ----A---- C:\Windows\system32\wininet.dll
2009-11-04 06:31:27 ----A---- C:\Windows\system32\urlmon.dll
2009-11-04 06:31:24 ----A---- C:\Windows\system32\ieui.dll
2009-11-04 06:31:24 ----A---- C:\Windows\system32\ieapfltr.dll
2009-11-04 06:31:22 ----A---- C:\Windows\system32\ieencode.dll
2009-11-04 06:10:14 ----A---- C:\Windows\system32\tzres.dll
2009-11-03 19:03:45 ----A---- C:\Windows\system32\netiohlp.dll
2009-11-03 19:03:43 ----A---- C:\Windows\system32\TCPSVCS.EXE
2009-11-03 19:03:43 ----A---- C:\Windows\system32\ROUTE.EXE
2009-11-03 19:03:43 ----A---- C:\Windows\system32\NETSTAT.EXE
2009-11-03 19:03:43 ----A---- C:\Windows\system32\MRINFO.EXE
2009-11-03 19:03:43 ----A---- C:\Windows\system32\HOSTNAME.EXE
2009-11-03 19:03:43 ----A---- C:\Windows\system32\finger.exe
2009-11-03 19:03:43 ----A---- C:\Windows\system32\ARP.EXE
2009-11-03 19:03:42 ----A---- C:\Windows\system32\netevent.dll
2009-11-03 19:02:59 ----A---- C:\Windows\system32\wlansvc.dll
2009-11-03 19:02:59 ----A---- C:\Windows\system32\wlanmsm.dll
2009-11-03 19:02:59 ----A---- C:\Windows\system32\wlanhlp.dll
2009-11-03 19:02:59 ----A---- C:\Windows\system32\L2SecHC.dll
2009-11-03 19:02:58 ----A---- C:\Windows\system32\wlansec.dll
2009-11-03 19:02:58 ----A---- C:\Windows\system32\wlanapi.dll
2009-11-03 19:02:51 ----A---- C:\Windows\system32\t2embed.dll
2009-11-03 19:02:51 ----A---- C:\Windows\system32\fontsub.dll
2009-11-03 19:02:51 ----A---- C:\Windows\system32\atmfd.dll
2009-11-03 19:02:50 ----A---- C:\Windows\system32\lpk.dll
2009-11-03 19:02:50 ----A---- C:\Windows\system32\dciman32.dll
2009-11-03 19:02:50 ----A---- C:\Windows\system32\atmlib.dll
2009-11-03 19:02:45 ----A---- C:\Windows\system32\lsasrv.dll
2009-11-03 19:02:44 ----A---- C:\Windows\system32\wdigest.dll
2009-11-03 19:02:44 ----A---- C:\Windows\system32\msv1_0.dll
2009-11-03 19:02:43 ----A---- C:\Windows\system32\secur32.dll
2009-11-03 19:02:42 ----A---- C:\Windows\system32\lsass.exe
2009-11-03 19:02:36 ----A---- C:\Windows\system32\WMVCORE.DLL
2009-11-03 19:02:36 ----A---- C:\Windows\system32\mf.dll
2009-11-03 19:02:35 ----A---- C:\Windows\system32\rrinstaller.exe
2009-11-03 19:02:35 ----A---- C:\Windows\system32\mfps.dll
2009-11-03 19:02:35 ----A---- C:\Windows\system32\mfpmp.exe
2009-11-03 19:02:34 ----A---- C:\Windows\system32\mferror.dll
2009-11-03 19:02:31 ----A---- C:\Windows\system32\atl.dll
2009-11-03 19:02:27 ----A---- C:\Windows\system32\ntkrnlpa.exe
2009-11-03 19:02:26 ----A---- C:\Windows\system32\ntoskrnl.exe
2009-11-03 19:02:08 ----A---- C:\Windows\system32\wkssvc.dll
2009-11-03 19:02:04 ----A---- C:\Windows\system32\mstscax.dll
2009-11-03 19:02:03 ----A---- C:\Windows\system32\tsgqec.dll
2009-11-03 19:02:03 ----A---- C:\Windows\system32\aaclient.dll
2009-11-03 19:01:27 ----A---- C:\Windows\system32\localspl.dll
2009-11-03 19:01:24 ----A---- C:\Windows\system32\avifil32.dll
2009-11-03 19:01:21 ----A---- C:\Windows\system32\jscript.dll
2009-11-03 19:01:05 ----A---- C:\Windows\system32\jsproxy.dll
2009-11-03 19:00:49 ----A---- C:\Windows\system32\wmpdxm.dll
2009-11-03 19:00:39 ----A---- C:\Windows\system32\gameux.dll
2009-11-03 19:00:38 ----A---- C:\Windows\system32\Apphlpdm.dll
2009-11-03 19:00:37 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2009-11-03 19:00:11 ----A---- C:\Windows\system32\msasn1.dll
2009-11-03 19:00:07 ----A---- C:\Windows\system32\rpcrt4.dll
2009-11-03 19:00:03 ----A---- C:\Windows\system32\WMSPDMOD.DLL
2009-11-03 18:59:52 ----A---- C:\Windows\system32\wmp.dll
2009-11-03 18:59:48 ----A---- C:\Windows\system32\unregmp2.exe
2009-11-03 18:59:47 ----A---- C:\Windows\system32\wmploc.DLL
2009-11-03 18:59:47 ----A---- C:\Windows\system32\spwmp.dll
2009-11-03 18:59:47 ----A---- C:\Windows\system32\dxmasf.dll
2009-11-03 18:29:33 ----A---- C:\Windows\system32\wups2.dll
2009-11-03 18:29:33 ----A---- C:\Windows\system32\wuauclt.exe
2009-11-03 18:29:32 ----A---- C:\Windows\system32\wucltux.dll
2009-11-03 18:29:32 ----A---- C:\Windows\system32\wuaueng.dll
2009-11-03 18:28:57 ----A---- C:\Windows\system32\wups.dll
2009-11-03 18:28:57 ----A---- C:\Windows\system32\wudriver.dll
2009-11-03 18:28:57 ----A---- C:\Windows\system32\wuapi.dll
2009-11-03 18:28:43 ----A---- C:\Windows\system32\wuwebv.dll
2009-11-03 18:28:43 ----A---- C:\Windows\system32\wuapp.exe
2009-11-03 16:40:34 ----N---- C:\Windows\system32\MpSigStub.exe
2009-11-03 14:40:48 ----A---- C:\Windows\system32\GEARAspi.dll
2009-11-03 14:39:31 ----D---- C:\Program Files\iPod
2009-11-03 14:39:28 ----D---- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-11-03 14:39:28 ----D---- C:\Program Files\iTunes
2009-11-03 13:32:18 ----D---- C:\Program Files\Common Files\scanner
2009-11-03 13:32:08 ----D---- C:\Program Files\CA
2009-11-03 13:30:51 ----D---- C:\ProgramData\SupportSoft
2009-11-03 13:30:30 ----D---- C:\Program Files\Comcast

======List of files/folders modified in the last 1 months======

2009-11-22 17:36:13 ----D---- C:\Windows\Prefetch
2009-11-22 17:36:04 ----D---- C:\Windows\Temp
2009-11-22 16:59:40 ----D---- C:\Program Files\Mozilla Firefox
2009-11-22 16:13:21 ----SHD---- C:\System Volume Information
2009-11-22 14:30:03 ----D---- C:\Windows\Tasks
2009-11-22 14:29:57 ----D---- C:\ProgramData\Google Updater
2009-11-20 04:53:50 ----AD---- C:\ProgramData\TEMP
2009-11-20 04:53:37 ----D---- C:\Program Files\SpywareBlaster
2009-11-20 04:40:42 ----A---- C:\Windows\ntbtlog.txt
2009-11-19 22:02:41 ----D---- C:\Windows\system32\drivers
2009-11-19 22:02:40 ----RD---- C:\Program Files
2009-11-19 22:02:40 ----HD---- C:\ProgramData
2009-11-19 21:51:26 ----D---- C:\Windows\Minidump
2009-11-19 21:51:07 ----D---- C:\Windows
2009-11-18 20:36:41 ----D---- C:\Program Files\Lx_cats
2009-11-18 18:56:12 ----D---- C:\Program Files\Hijackthis
2009-11-18 18:38:14 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-11-18 18:36:37 ----D---- C:\ProgramData\Spybot - Search & Destroy
2009-11-18 18:26:49 ----SHD---- C:\Windows\Installer
2009-11-18 18:26:39 ----D---- C:\Program Files\Lavasoft
2009-11-18 18:26:38 ----D---- C:\ProgramData\Lavasoft
2009-11-18 18:26:37 ----DC---- C:\Windows\system32\DRVSTORE
2009-11-18 18:26:34 ----D---- C:\Windows\system32\catroot
2009-11-18 18:26:31 ----D---- C:\Windows\System32
2009-11-18 05:41:46 ----D---- C:\Windows\rescache
2009-11-18 05:31:43 ----D---- C:\Windows\inf
2009-11-18 05:31:43 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-11-18 05:27:26 ----D---- C:\Windows\system32\Tasks
2009-11-18 05:22:40 ----D---- C:\Windows\system32\en-US
2009-11-18 05:22:35 ----D---- C:\Windows\system32\wbem
2009-11-18 05:22:31 ----D---- C:\Windows\system32\pt-PT
2009-11-18 05:22:31 ----D---- C:\Windows\system32\pt-BR
2009-11-18 05:22:31 ----D---- C:\Windows\system32\pl-PL
2009-11-18 05:22:31 ----D---- C:\Windows\system32\it-IT
2009-11-18 05:22:31 ----D---- C:\Windows\system32\he-IL
2009-11-18 05:22:31 ----D---- C:\Windows\system32\bg-BG
2009-11-18 05:22:30 ----D---- C:\Windows\system32\zh-TW
2009-11-18 05:22:30 ----D---- C:\Windows\system32\zh-HK
2009-11-18 05:22:30 ----D---- C:\Windows\system32\uk-UA
2009-11-18 05:22:30 ----D---- C:\Windows\system32\tr-TR
2009-11-18 05:22:30 ----D---- C:\Windows\system32\th-TH
2009-11-18 05:22:30 ----D---- C:\Windows\system32\sv-SE
2009-11-18 05:22:30 ----D---- C:\Windows\system32\sr-Latn-CS
2009-11-18 05:22:30 ----D---- C:\Windows\system32\sl-SI
2009-11-18 05:22:30 ----D---- C:\Windows\system32\sk-SK
2009-11-18 05:22:30 ----D---- C:\Windows\system32\nl-NL
2009-11-18 05:22:30 ----D---- C:\Windows\system32\lv-LV
2009-11-18 05:22:30 ----D---- C:\Windows\system32\lt-LT
2009-11-18 05:22:30 ----D---- C:\Windows\system32\ko-KR
2009-11-18 05:22:30 ----D---- C:\Windows\system32\hu-HU
2009-11-18 05:22:30 ----D---- C:\Windows\system32\hr-HR
2009-11-18 05:22:30 ----D---- C:\Windows\system32\fr-FR
2009-11-18 05:22:30 ----D---- C:\Windows\system32\fi-FI
2009-11-18 05:22:30 ----D---- C:\Windows\system32\et-EE
2009-11-18 05:22:30 ----D---- C:\Windows\system32\es-ES
2009-11-18 05:22:30 ----D---- C:\Windows\system32\el-GR
2009-11-18 05:22:29 ----D---- C:\Windows\system32\zh-CN
2009-11-18 05:22:29 ----D---- C:\Windows\system32\ru-RU
2009-11-18 05:22:29 ----D---- C:\Windows\system32\ro-RO
2009-11-18 05:22:29 ----D---- C:\Windows\system32\nb-NO
2009-11-18 05:22:29 ----D---- C:\Windows\system32\ja-JP
2009-11-18 05:22:29 ----D---- C:\Windows\system32\de-DE
2009-11-18 05:22:29 ----D---- C:\Windows\system32\da-DK
2009-11-18 05:22:29 ----D---- C:\Windows\system32\cs-CZ
2009-11-18 05:22:29 ----D---- C:\Windows\system32\ar-SA
2009-11-17 19:51:48 ----D---- C:\Windows\winsxs
2009-11-17 19:51:45 ----D---- C:\Windows\system32\catroot2
2009-11-15 11:33:24 ----HD---- C:\$AVG8.VAULT$
2009-11-14 20:21:53 ----D---- C:\ProgramData\Adobe
2009-11-14 20:20:47 ----D---- C:\Program Files\Common Files
2009-11-12 15:55:53 ----D---- C:\Program Files\Opera
2009-11-11 08:33:35 ----D---- C:\Program Files\Windows Mail
2009-11-11 04:46:15 ----D---- C:\ProgramData\Microsoft Help
2009-11-11 04:31:40 ----D---- C:\Windows\system32\spool
2009-11-10 16:30:41 ----D---- C:\Windows\ModemLogs
2009-11-10 16:28:34 ----D---- C:\Program Files\Verizon Wireless
2009-11-10 16:28:34 ----D---- C:\Program Files\Common Files\microsoft shared
2009-11-10 16:23:52 ----D---- C:\Windows\Downloaded Installations
2009-11-09 16:45:21 ----D---- C:\Windows\Microsoft.NET
2009-11-09 16:45:08 ----RSD---- C:\Windows\assembly
2009-11-08 15:10:01 ----SHD---- C:\boot
2009-11-08 15:00:34 ----D---- C:\Program Files\Windows Calendar
2009-11-08 15:00:33 ----D---- C:\Program Files\Movie Maker
2009-11-08 15:00:30 ----D---- C:\Program Files\Windows Sidebar
2009-11-08 15:00:30 ----D---- C:\Program Files\Windows Media Player
2009-11-08 15:00:30 ----D---- C:\Program Files\Internet Explorer
2009-11-08 15:00:29 ----D---- C:\Program Files\Windows Collaboration
2009-11-08 15:00:28 ----D---- C:\Program Files\Windows Journal
2009-11-08 15:00:25 ----D---- C:\Program Files\Windows Photo Gallery
2009-11-08 15:00:25 ----D---- C:\Program Files\Common Files\System
2009-11-08 15:00:17 ----D---- C:\Windows\servicing
2009-11-08 15:00:17 ----D---- C:\Windows\ehome
2009-11-08 15:00:17 ----D---- C:\Program Files\Windows Defender
2009-11-08 14:59:32 ----D---- C:\Windows\system32\XPSViewer
2009-11-08 14:59:32 ----D---- C:\Windows\PolicyDefinitions
2009-11-08 14:59:32 ----D---- C:\Windows\IME
2009-11-08 14:59:30 ----D---- C:\Windows\system32\oobe
2009-11-08 14:59:29 ----D---- C:\Windows\system32\migration
2009-11-08 14:59:21 ----D---- C:\Windows\system32\SLUI
2009-11-08 14:59:21 ----D---- C:\Windows\system32\setup
2009-11-08 14:59:21 ----D---- C:\Windows\system32\AdvancedInstallers
2009-11-08 14:59:20 ----D---- C:\Windows\system32\manifeststore
2009-11-08 14:59:20 ----D---- C:\Windows\system32\en
2009-11-08 14:59:09 ----D---- C:\Windows\system32\migwiz
2009-11-08 14:56:53 ----RSD---- C:\Windows\Fonts
2009-11-08 14:56:53 ----D---- C:\Windows\AppPatch
2009-11-08 14:56:46 ----D---- C:\Program Files\Microsoft Games
2009-11-08 14:56:41 ----D---- C:\Windows\system32\Boot
2009-11-05 21:27:31 ----D---- C:\Program Files\Google
2009-11-05 12:36:21 ----A---- C:\Windows\system32\mrt.exe
2009-11-04 08:06:19 ----A---- C:\Windows\system32\avgrsstx.dll
2009-11-04 06:15:52 ----D---- C:\Program Files\Microsoft Silverlight
2009-11-04 05:39:29 ----D---- C:\Program Files\Microsoft Works
2009-11-03 14:39:30 ----D---- C:\Program Files\Common Files\Apple
2009-11-03 14:36:45 ----D---- C:\Program Files\QuickTime
2009-11-03 14:30:20 ----D---- C:\ProgramData\Apple
2009-11-03 13:30:31 ----D---- C:\Program Files\Common Files\SupportSoft
2009-11-02 22:30:42 ----D---- C:\Windows\system32\config
2009-11-02 22:30:34 ----D---- C:\Windows\system32\Msdtc
2009-11-02 22:30:34 ----D---- C:\Windows\system32\CodeIntegrity
2009-11-02 22:30:33 ----D---- C:\Windows\registration

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\Windows\System32\Drivers\avgldx86.sys [2009-11-04 335240]
R1 AvgMfx86;AVG Minifilter x86 Resident Driver; C:\Windows\System32\Drivers\avgmfx86.sys [2009-11-04 27784]
R1 AvgTdiX;AVG8 Network Redirector; C:\Windows\System32\Drivers\avgtdix.sys [2009-11-04 108552]
R1 BANTExt;Belarc SMBios Access; C:\Windows\System32\Drivers\BANTExt.sys [2005-04-07 3840]
R1 CSC;Offline Files Driver; C:\Windows\system32\drivers\csc.sys [2009-04-10 351744]
R1 eabfiltr;eabfiltr; C:\Windows\system32\DRIVERS\eabfiltr.sys [2006-11-30 8192]
R2 MCSTRM;MCSTRM; C:\Windows\system32\drivers\MCSTRM.sys [2007-12-27 8413]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-18 12672]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-02-24 39936]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-01-23 42496]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-01-23 37376]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-07-10 8704]
R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2007-01-03 534016]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2009-05-18 26600]
R3 HBtnKey;HBtnKey; C:\Windows\system32\DRIVERS\cpqbttn.sys [2006-06-28 9472]
R3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDART.sys [2007-06-26 163328]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-06-20 984064]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-06-20 208896]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2007-03-06 1059112]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-12-04 7606688]
R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys [2007-02-16 12032]
R3 NWADI;NWADI Bus Enumerator; C:\Windows\system32\DRIVERS\NWADIenum.sys [2008-06-02 222720]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-10 89088]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-09-15 191408]
R3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-06-20 660480]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-19 11264]
S3 catchme;catchme; \??\C:\Users\cdoo\AppData\Local\Temp\catchme.sys []
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 hcw85bda;Hauppauge WinTV 885 Video Capture; C:\Windows\system32\drivers\HCW85BDA.sys [2006-12-01 622080]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NWUSBCDFIL;Novatel Wireless Installation CD; C:\Windows\system32\DRIVERS\NwUsbCdFil.sys [2008-07-07 20480]
S3 NWUSBModem;Novatel Wireless USB Modem Driver; C:\Windows\system32\DRIVERS\nwusbmdm.sys [2008-05-09 174336]
S3 NWUSBPort;Novatel Wireless USB Status Port Driver; C:\Windows\system32\DRIVERS\nwusbser.sys [2008-05-09 174336]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver; C:\Windows\system32\DRIVERS\nwusbser2.sys [2008-05-09 174336]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver; \??\C:\PROGRA~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [2009-03-20 32408]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-08-28 40448]
S3 usbbus;LGE CDMA Composite USB Device; C:\Windows\system32\DRIVERS\lgusbbus.sys [2007-04-09 12672]
S3 UsbDiag;LGE CDMA USB Serial Port; C:\Windows\system32\DRIVERS\lgusbdiag.sys [2007-04-09 21248]
S3 USBModem;LGE CDMA USB Modem; C:\Windows\system32\DRIVERS\lgusbmodem.sys [2007-04-09 22912]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-09-30 40448]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
R2 avg8emc;AVG Free8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2009-11-04 908056]
R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2009-11-04 297752]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 CLCapSvc;CyberLink Background Capture Service (CBCS); C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe [2007-04-23 262243]
R2 CLSched;CyberLink Task Scheduler (CTS); C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe [2007-04-23 106593]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 HP Health Check Service;HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2007-03-14 62984]
R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-05-02 135168]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-04-19 75304]
R2 lxdj_device;lxdj_device; C:\Windows\system32\lxdjcoms.exe [2007-06-11 537520]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-12-04 203296]
R2 sprtsvc_ddoctorv2;SupportSoft Sprocket Service (ddoctorv2); C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe [2008-04-24 202560]
R2 Viewpoint Manager Service;Viewpoint Manager Service; C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-03-30 1533808]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-07-10 386560]
R2 YahooAUService;Yahoo! Updater; C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe [2008-11-09 602392]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-10-28 545568]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-11-05 135664]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-24 183280]
S2 lxdjCATSCustConnectService;lxdjCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdjserv.exe [2007-06-11 99248]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 Com4Qlb;Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [2007-01-09 110592]
S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe [2008-01-19 523776]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 RoxMediaDB9;RoxMediaDB9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2007-02-12 880640]
S3 stllssvr;stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2007-02-17 74656]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2008-01-19 21504]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe [2009-04-11 918528]

-----------------EOF-----------------
ok....i downloaded fsbl and created what you told me to do with opening notepad ran the scan it showed nothing no hidden files detected......but i cannot find it on my c drive to post here....i ran that first than ran rsit so i posted the rsit above..so where else do i look for this file???? sorry for my confusion!
cdoolake
Regular Member
 
Posts: 20
Joined: November 12th, 2009, 3:07 pm

Re: avg detected nircmd.exe trojan

Unread postby cdoolake » November 22nd, 2009, 8:04 pm

11/22/09 17:08:56 [Info]: BlackLight Engine 2.2.1092 initialized
11/22/09 17:08:56 [Info]: OS: 6.0 build 6002 (Service Pack 2)
11/22/09 17:08:57 [Note]: 7019 4
11/22/09 17:08:57 [Note]: 7005 0
11/22/09 17:09:15 [Note]: 7006 0
11/22/09 17:09:15 [Note]: 7027 0
11/22/09 17:09:16 [Note]: 7035 0
11/22/09 17:09:16 [Note]: 7026 0
11/22/09 17:09:16 [Note]: 7026 0
11/22/09 17:09:19 [Note]: FSRAW library version 1.7.1024
11/22/09 17:09:52 [Note]: 4015 11530
11/22/09 17:09:52 [Note]: 4027 11530 5242880
11/22/09 17:09:52 [Note]: 4020 11320 3801088
11/22/09 17:09:52 [Note]: 4018 11320 3801088
11/22/09 17:12:08 [Note]: 4015 44656
11/22/09 17:12:08 [Note]: 4027 44656 1376256
11/22/09 17:12:08 [Note]: 4020 44586 1245184
11/22/09 17:12:08 [Note]: 4018 44586 1245184
11/22/09 17:13:55 [Note]: 4015 158187
11/22/09 17:13:55 [Note]: 4027 158187 65536
11/22/09 17:13:55 [Note]: 4020 157285 65536
11/22/09 17:13:55 [Note]: 4018 157285 65536
11/22/09 17:27:51 [Note]: 2000 1012
11/22/09 17:34:56 [Note]: 7007 0
ok...now this is all i found and i don't think this is what you were looking for????
cdoolake
Regular Member
 
Posts: 20
Joined: November 12th, 2009, 3:07 pm

Re: avg detected nircmd.exe trojan

Unread postby xixo_12 » November 23rd, 2009, 7:39 am

Hi,
Ok let's move.

First,
SystemLook by jpshortstuff.
Please download from one of the links below and save it to the Desktop.
Download Mirror #1
Download Mirror #2

  • Right click on SystemLook.exe > Run as Administrator to run it.
  • Copy the content of the following codebox into the main textfield:
    Code: Select all
    :filefind
    nircmd.exe
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Next,
Remove programs.
Please Click Start > Control Panel > Programs and Features
Remove the listed program(s) by clicking Uninstall/Change.
Java(TM) 6 Update 3
Java(TM) SE Runtime Environment 6

If some program(s) listed above are not in present, please do not panic and proceed to the next step.

Next,
Java SE Runtime Environment (JRE).
Please download from HERE.
  • Find Java SE Runtime Environment (JRE) 6 Update 17.
  • Click on Download.
  • Choose the correct Platform and Multi-language. Next, check the box that says I agree to the Java SE Runtime Environment 6 License Agreement.
  • Click the Continue button.
  • Click on the filename under Windows Offline Installation and save it to your desktop.
  • Close all active windows.
  • Install the program.

Next,
Kaspersky Online AV Scan
Note: Internet Explorer should be used.
Please go to Kaspersky website and perform an online antivirus scan.
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
    • Archives
    • Mail databases
  • Click on My Computer under Scan and then put the kettle on!
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As....
  • Save this report to a convenient place like your Desktop. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Copy and paste the report into your next.

Next,
Checklist.
Please post.
  • Content of SystemLook.txt
  • Content of Kaspersky log
User avatar
xixo_12
MRU Master Emeritus
 
Posts: 2340
Joined: October 14th, 2008, 11:40 am
Location: Malaysia
Advertisement
Register to Remove

Next

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 500 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware