Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Hyjacked Browsers & Blocked From Runnig Certain exe Files

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Hyjacked Browsers & Blocked From Runnig Certain exe Files

Unread postby peevee » June 17th, 2009, 8:41 am

Hiya,

I have had to download hijack this on a clean computer & rename it to run the file on this laptop.

I cannot download or run certain other programms such as Microsoft Malicious Software Removal Tool.

My browsers (IE & Google) have been hijacked & won't correctly follow links that I have searched for in google.

The Laptop freezes quite regularly, whilst the mouse pointer still moves, everything else is inopp.

Sometimes on a restart it will hangup and not finish loading the settings.

I had this problem last week and decided to format the HD and reload xp, the problem is now back.

I run an external hard drive for music and films which was not flattened when the Laptop was done

I was runnig Vuze but have now deleted this before posting and had a good clean up withinin E drive (external hd)

Any help would be really appreciated
Thanks in advance
Phil


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:24:17, on 17/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Documents and Settings\Kasia\Desktop\gonnagetya.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [HPWH myPrintMileage Agent] C:\Program Files\Hewlett-Packard\hp business inkjet 1100 series\Toolbox\mpm.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Kasia')
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1003\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'Kasia')
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1004\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'phil')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 4465004859
O17 - HKLM\System\CCS\Services\Tcpip\..\{23524266-4016-4609-919D-D30A829F0928}: NameServer = 85.255.112.208,85.255.112.79
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.208,85.255.112.79
O17 - HKLM\System\CS1\Services\Tcpip\..\{23524266-4016-4609-919D-D30A829F0928}: NameServer = 85.255.112.208,85.255.112.79
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.208,85.255.112.79
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe

--
End of file - 7775 bytes
peevee
Regular Member
 
Posts: 28
Joined: May 29th, 2009, 8:30 am
Advertisement
Register to Remove

Re: Hyjacked Browsers & Blocked From Runnig Certain exe Files

Unread postby peku006 » June 20th, 2009, 3:32 am

Hello and welcome to Malware Removal.

My name is peku006 and I will be helping you to remove any infection(s) that you may have.
I will be giving you a series of instructions that need to be followed in the order in which I give them to you.

Please observe these rules while we work:

  • If you don't know or understand something please don't hesitate to ask
  • Please DO NOT run any other tools or scans whilst I am helping you.
  • It is important that you reply to this thread. Do not start a new topic.
  • Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
  • Absence of symptoms does not mean that everything is clear.

1 - Download and Run Malwarebytes' Anti-Malware
Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Full Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

2 - download and run RSIT

  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt<- (will be maximized) and info.txt<- (will be minimized)

3 - Status Check
Please reply with

1.the logs from RSIT (log.txt ,info.txt)
2. the Malwarebytes' Anti-Malware Log

Thanks peku006
User avatar
peku006
MRU Emeritus
MRU Emeritus
 
Posts: 3357
Joined: May 14th, 2007, 2:18 pm
Location: Norway

Re: Hyjacked Browsers & Blocked From Runnig Certain exe Files

Unread postby peevee » June 20th, 2009, 8:10 am

Hi Peku,

Thanks for taking the time to reply.

Although I can download & install Malwarebytes, it won't let me run it, even if I run as administrator.

I have attached the RSIT logs anyway.

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2009-06-20 13:03:23
Microsoft Windows XP Professional Service Pack 3
System drive C: has 48 GB (84%) free of 57 GB
Total RAM: 1918 MB (75% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:03:32, on 20/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Hewlett-Packard\hp business inkjet 1100 series\Toolbox\HPWHTBX.exe
C:\Documents and Settings\Kasia\Desktop\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [HPWH myPrintMileage Agent] C:\Program Files\Hewlett-Packard\hp business inkjet 1100 series\Toolbox\mpm.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Kasia')
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1003\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'Kasia')
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1004\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'phil')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 4465004859
O17 - HKLM\System\CCS\Services\Tcpip\..\{23524266-4016-4609-919D-D30A829F0928}: NameServer = 85.255.112.208,85.255.112.79
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.208,85.255.112.79
O17 - HKLM\System\CS1\Services\Tcpip\..\{23524266-4016-4609-919D-D30A829F0928}: NameServer = 85.255.112.208,85.255.112.79
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.208,85.255.112.79
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe

--
End of file - 7902 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\McDefragTask.job
C:\WINDOWS\tasks\McQcTask.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - C:\Program Files\McAfee\VirusScan\scriptsn.dll [2009-03-25 62784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll [2009-01-29 145424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-06-07 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-06-07 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll [2009-01-29 145424]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2005-12-11 344064]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-06-28 16248320]
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"DDWMon"=C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe [2006-04-28 262144]
"AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2006-03-18 89541]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-05-26 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-05-30 292136]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-06-07 148888]
"mcagent_exe"=C:\Program Files\McAfee.com\Agent\mcagent.exe [2009-03-25 645328]
"HPWH myPrintMileage Agent"=C:\Program Files\Hewlett-Packard\hp business inkjet 1100 series\Toolbox\mpm.exe [2003-11-19 102400]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-10-18 204288]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE
RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-12-11 47104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MpfService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe"="C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Vuze\Azureus.exe"="C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2009-06-20 13:03:23 ----D---- C:\rsit
2009-06-20 12:53:36 ----D---- C:\Program Files\Malware
2009-06-20 12:53:36 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-06-18 18:28:52 ----A---- C:\WINDOWS\system32\GAPI.DLL
2009-06-18 18:28:51 ----D---- C:\SUBARUEX2
2009-06-18 18:28:51 ----A---- C:\WINDOWS\system32\VB5DB.DLL
2009-06-18 18:28:51 ----A---- C:\WINDOWS\system32\MSREPL35.DLL
2009-06-18 18:28:51 ----A---- C:\WINDOWS\system32\MSRD2X35.DLL
2009-06-18 18:28:51 ----A---- C:\WINDOWS\system32\MSJTER35.DLL
2009-06-18 18:28:51 ----A---- C:\WINDOWS\system32\MSJINT35.DLL
2009-06-18 18:28:51 ----A---- C:\WINDOWS\system32\MSJET35.DLL
2009-06-18 18:27:18 ----D---- C:\SUBARUEX
2009-06-18 14:04:52 ----D---- C:\Program Files\CC-leaner
2009-06-16 21:29:52 ----D---- C:\Documents and Settings\Administrator\Application Data\Macromedia
2009-06-16 21:29:52 ----D---- C:\Documents and Settings\Administrator\Application Data\Adobe
2009-06-16 21:26:33 ----D---- C:\WINDOWS\CSC
2009-06-16 13:32:01 ----D---- C:\Program Files\Trend Micro
2009-06-16 13:24:58 ----D---- C:\Program Files\Common Files\Adobe
2009-06-16 13:24:22 ----D---- C:\Program Files\Adobe
2009-06-16 13:24:02 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2009-06-16 13:23:59 ----D---- C:\Program Files\Common Files\Adobe AIR
2009-06-16 13:22:41 ----D---- C:\Program Files\NOS
2009-06-16 13:22:41 ----D---- C:\Documents and Settings\All Users\Application Data\NOS
2009-06-13 20:38:24 ----D---- C:\Program Files\BHVideo
2009-06-13 19:59:10 ----D---- C:\Program Files\AC3Filter
2009-06-13 19:53:35 ----D---- C:\Program Files\GPL MPEG Decoder
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\vxblock.dll
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\pxsfs.dll
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\pxinsi64.exe
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\pxinsa64.exe
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\pxhpinst.exe
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\pxdrv.dll
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\pxcpyi64.exe
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\pxcpya64.exe
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\pxafs.dll
2009-06-13 00:42:16 ----N---- C:\WINDOWS\system32\pxwave.dll
2009-06-13 00:42:16 ----N---- C:\WINDOWS\system32\pxmas.dll
2009-06-13 00:42:16 ----N---- C:\WINDOWS\system32\px.dll
2009-06-13 00:41:48 ----D---- C:\Program Files\Common Files\DivX Shared
2009-06-13 00:41:47 ----D---- C:\Program Files\DivX
2009-06-12 13:40:26 ----D---- C:\Documents and Settings\All Users\Application Data\Azureus
2009-06-12 13:40:03 ----D---- C:\Documents and Settings\Administrator\Application Data\Azureus
2009-06-12 03:01:50 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$
2009-06-12 03:01:33 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2009-06-12 03:01:05 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$
2009-06-12 03:01:01 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2009-06-12 03:00:43 ----HDC---- C:\WINDOWS\$NtUninstallKB936782_WMP11$
2009-06-11 20:27:45 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-06-11 20:27:38 ----HDC---- C:\WINDOWS\$NtUninstallKB969898$
2009-06-11 20:25:09 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-06-11 20:24:36 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2009-06-11 13:23:43 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-06-11 13:23:37 ----HDC---- C:\WINDOWS\$NtUninstallMSCompPackV1$
2009-06-11 13:22:32 ----D---- C:\Program Files\Windows Media Connect 2
2009-06-11 13:22:19 ----HDC---- C:\WINDOWS\$NtUninstallwmp11$
2009-06-11 13:19:25 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2009-06-11 13:18:27 ----D---- C:\WINDOWS\system32\LogFiles
2009-06-11 13:18:15 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2009-06-10 21:46:44 ----D---- C:\WINDOWS\RegisteredPackages
2009-06-10 21:43:42 ----D---- C:\Program Files\Common Files\Hypnotizer
2009-06-10 21:27:02 ----D---- C:\Documents and Settings\Administrator\Application Data\Media Player Classic
2009-06-10 13:28:11 ----A---- C:\WINDOWS\scrub2k.exe
2009-06-10 13:28:11 ----A---- C:\WINDOWS\hpw1100k.ini
2009-06-10 13:28:06 ----D---- C:\Program Files\Hewlett-Packard
2009-06-10 13:26:19 ----A---- C:\WINDOWS\hpbj1100.ini
2009-06-10 03:03:52 ----D---- C:\WINDOWS\ie7updates
2009-06-08 21:44:26 ----D---- C:\WINDOWS\WBEM
2009-06-08 21:42:54 ----HDC---- C:\WINDOWS\ie7
2009-06-08 21:42:38 ----HDC---- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
2009-06-08 21:42:13 ----HDC---- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
2009-06-08 20:31:55 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-06-08 20:31:43 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-06-08 20:31:23 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-06-08 20:31:12 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
2009-06-08 20:30:28 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-06-08 20:30:17 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
2009-06-08 20:30:08 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2009-06-08 20:29:59 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-06-08 20:29:49 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$
2009-06-08 20:29:40 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-06-08 20:29:30 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-06-08 20:29:19 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-06-08 20:29:11 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2009-06-08 20:28:59 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-06-08 20:28:49 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2009-06-08 20:28:40 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-06-08 20:28:30 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-06-08 20:28:20 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-06-08 20:28:11 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-06-08 20:28:02 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-06-08 20:27:50 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-06-08 20:27:37 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2009-06-08 20:27:27 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-06-08 20:27:18 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-06-08 20:27:02 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$
2009-06-08 20:15:24 ----D---- C:\WINDOWS\Prefetch
2009-06-08 18:13:17 ----D---- C:\WINDOWS\system32\CatRoot_bak
2009-06-08 18:11:14 ----HDC---- C:\WINDOWS\$NtUninstallKB963027$
2009-06-08 18:11:04 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-06-08 18:10:54 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-06-08 18:10:45 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-06-08 18:10:36 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-06-08 18:10:27 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-06-08 18:10:17 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-06-08 18:05:22 ----D---- C:\WINDOWS\system32\scripting
2009-06-08 18:05:22 ----D---- C:\WINDOWS\system32\en-us
2009-06-08 18:05:21 ----D---- C:\WINDOWS\system32\en
2009-06-08 18:05:21 ----D---- C:\WINDOWS\l2schemas
2009-06-08 18:05:20 ----D---- C:\WINDOWS\system32\bits
2009-06-08 18:02:27 ----D---- C:\WINDOWS\ServicePackFiles
2009-06-08 17:58:54 ----D---- C:\WINDOWS\network diagnostic
2009-06-08 17:52:45 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2009-06-08 17:45:54 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2009-06-08 17:45:54 ----A---- C:\WINDOWS\system32\mucltui.dll
2009-06-08 13:54:37 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2009-06-08 13:42:37 ----A---- C:\WINDOWS\system32\MRT.exe
2009-06-08 13:42:23 ----HDC---- C:\WINDOWS\$NtUninstallKB960803_0$
2009-06-08 13:42:12 ----HDC---- C:\WINDOWS\$NtUninstallKB954600_0$
2009-06-08 13:42:01 ----HDC---- C:\WINDOWS\$NtUninstallKB958644_0$
2009-06-08 13:41:50 ----HDC---- C:\WINDOWS\$NtUninstallKB955069_0$
2009-06-08 13:41:33 ----HDC---- C:\WINDOWS\$NtUninstallKB956802_0$
2009-06-08 13:40:31 ----HDC---- C:\WINDOWS\$NtUninstallKB963027_0$
2009-06-08 13:40:11 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$
2009-06-08 13:39:38 ----HDC---- C:\WINDOWS\$NtUninstallKB923561_0$
2009-06-08 08:03:50 ----N---- C:\WINDOWS\system32\xpsp4res.dll
2009-06-08 03:00:46 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2009-06-08 03:00:22 ----D---- C:\WINDOWS\system32\PreInstall
2009-06-08 03:00:20 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2009-06-07 19:24:52 ----D---- C:\Documents and Settings\Administrator\Application Data\Mozilla
2009-06-07 19:04:46 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2009-06-07 16:54:15 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-07 16:12:07 ----D---- C:\Program Files\AskSearch
2009-06-07 16:05:32 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2009-06-07 16:05:22 ----D---- C:\Program Files\SpywareBlaster
2009-06-07 16:02:22 ----D---- C:\Program Files\CCleaner
2009-06-07 12:30:06 ----D---- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2009-06-07 12:26:52 ----D---- C:\Program Files\Common Files\McAfee
2009-06-07 12:26:48 ----D---- C:\Program Files\McAfee.com
2009-06-07 12:26:35 ----D---- C:\Program Files\McAfee
2009-06-07 12:21:34 ----A---- C:\WINDOWS\system32\wmpns.dll
2009-06-07 12:18:40 ----SD---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2009-06-07 12:18:40 ----ASH---- C:\Documents and Settings\Administrator\Application Data\desktop.ini
2009-06-07 12:13:20 ----D---- C:\WINDOWS\Sun
2009-06-07 12:12:58 ----A---- C:\WINDOWS\system32\javaws.exe
2009-06-07 12:12:58 ----A---- C:\WINDOWS\system32\javaw.exe
2009-06-07 12:12:58 ----A---- C:\WINDOWS\system32\java.exe
2009-06-07 12:12:58 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-06-07 12:12:47 ----D---- C:\Program Files\Java
2009-06-07 02:32:02 ----D---- C:\Documents and Settings\All Users\Application Data\McAfee
2009-06-07 02:12:32 ----A---- C:\WINDOWS\system32\GEARAspi.dll
2009-06-07 02:12:16 ----D---- C:\Program Files\iPod
2009-06-07 02:12:13 ----D---- C:\Program Files\iTunes
2009-06-07 02:12:13 ----D---- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-06-07 02:12:01 ----D---- C:\Program Files\Bonjour
2009-06-07 02:11:34 ----D---- C:\Program Files\QuickTime
2009-06-07 02:11:33 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2009-06-07 02:11:22 ----D---- C:\Program Files\Apple Software Update
2009-06-07 02:11:15 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-06-07 02:11:01 ----D---- C:\Program Files\Common Files\Apple
2009-06-07 02:11:00 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2009-06-07 00:56:55 ----A---- C:\WINDOWS\ODBC.INI
2009-06-07 00:56:26 ----SHD---- C:\RECYCLER
2009-06-07 00:56:25 ----D---- C:\Program Files\Microsoft ActiveSync
2009-06-07 00:56:12 ----D---- C:\Program Files\Microsoft Visual Studio
2009-06-07 00:56:12 ----D---- C:\Program Files\Common Files\Designer
2009-06-07 00:55:37 ----D---- C:\WINDOWS\ShellNew
2009-06-07 00:55:36 ----D---- C:\Program Files\Common Files\L&H
2009-06-07 00:55:32 ----D---- C:\Program Files\Microsoft Office
2009-06-07 00:48:23 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2009-06-07 00:45:50 ----D---- C:\Program Files\Mozilla Firefox
2009-06-07 00:35:27 ----N---- C:\WINDOWS\agrsmdel.exe
2009-06-07 00:35:27 ----D---- C:\Program Files\ltmoh
2009-06-07 00:35:27 ----A---- C:\WINDOWS\system32\tosmreg.ini
2009-06-07 00:35:27 ----A---- C:\WINDOWS\system32\tosmreg.exe
2009-06-07 00:35:27 ----A---- C:\WINDOWS\system32\cseltbl.ini
2009-06-07 00:35:27 ----A---- C:\WINDOWS\system32\csellang.ini
2009-06-07 00:35:27 ----A---- C:\WINDOWS\system32\csellang.dll
2009-06-07 00:35:27 ----A---- C:\WINDOWS\system32\cselect.exe
2009-06-07 00:35:27 ----A---- C:\WINDOWS\agrsmmsg.exe
2009-06-07 00:32:58 ----D---- C:\WINDOWS\system32\Lang
2009-06-07 00:30:01 ----A---- C:\WINDOWS\system32\TODDSrv.exe
2009-06-07 00:29:58 ----D---- C:\Program Files\TOSHIBA
2009-06-07 00:29:22 ----D---- C:\Program Files\DVD-RAM
2009-06-07 00:29:22 ----A---- C:\WINDOWS\system32\RAMASST.exe
2009-06-07 00:29:22 ----A---- C:\WINDOWS\system32\DVDRAMSV.exe
2009-06-07 00:29:22 ----A---- C:\WINDOWS\system32\DVDMenu.dll
2009-06-07 00:26:59 ----A---- C:\WINDOWS\system32\RtlCPAPI.dll
2009-06-07 00:26:59 ----A---- C:\WINDOWS\system32\ChCfg.exe
2009-06-07 00:26:37 ----D---- C:\WINDOWS\system32\RTCOM
2009-06-07 00:26:35 ----A---- C:\WINDOWS\system32\ksuser.dll
2009-06-07 00:26:04 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2009-06-07 00:26:03 ----HDC---- C:\WINDOWS\$NtUninstallKB888111WXPSP2$
2009-06-07 00:26:01 ----A---- C:\WINDOWS\SoundMan.exe
2009-06-07 00:26:01 ----A---- C:\WINDOWS\SkyTel.exe
2009-06-07 00:26:01 ----A---- C:\WINDOWS\RtlUpd.exe
2009-06-07 00:26:01 ----A---- C:\WINDOWS\RTLCPL.exe
2009-06-07 00:25:59 ----A---- C:\WINDOWS\RTHDCPL.exe
2009-06-07 00:25:58 ----A---- C:\WINDOWS\MicCal.exe
2009-06-07 00:25:57 ----A---- C:\WINDOWS\alcwzrd.exe
2009-06-07 00:25:57 ----A---- C:\WINDOWS\Alcmtr.exe
2009-06-07 00:25:51 ----A---- C:\WINDOWS\RtlExUpd.dll
2009-06-07 00:25:37 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-06-07 00:25:28 ----D---- C:\WINDOWS\OPTIONS
2009-06-07 00:25:28 ----D---- C:\Program Files\Realtek
2009-06-07 00:21:59 ----D---- C:\Program Files\ATI Technologies
2009-06-07 00:21:31 ----HD---- C:\Program Files\InstallShield Installation Information
2009-06-07 00:20:59 ----D---- C:\Program Files\Common Files\InstallShield
2009-06-07 00:11:55 ----HD---- C:\Program Files\Uninstall Information
2009-06-07 00:11:06 ----A---- C:\WINDOWS\system32\wpa.bak
2009-06-07 00:08:54 ----D---- C:\WINDOWS\SoftwareDistribution
2009-06-07 00:08:43 ----SD---- C:\WINDOWS\system32\Microsoft
2009-06-07 00:08:43 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-06-06 22:30:38 ----A---- C:\WINDOWS\system32\h323log.txt
2009-06-06 22:18:30 ----A---- C:\WINDOWS\system32\usbui.dll
2009-06-06 22:17:07 ----SHD---- C:\WINDOWS\Installer
2009-06-06 22:17:07 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-06-06 22:17:06 ----D---- C:\Program Files\Common Files\ODBC
2009-06-06 22:17:06 ----A---- C:\WINDOWS\ODBCINST.INI
2009-06-06 22:17:01 ----D---- C:\Program Files\Common Files\SpeechEngines
2009-06-06 22:17:00 ----RD---- C:\Program Files
2009-06-06 22:17:00 ----D---- C:\Program Files\Common Files\Microsoft Shared
2009-06-06 22:17:00 ----D---- C:\Program Files\Common Files
2009-06-06 22:16:57 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2009-06-06 22:16:57 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2009-06-06 22:16:57 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdur.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdru.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2009-06-06 22:16:51 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2009-06-06 22:16:51 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2009-06-06 22:16:51 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2009-06-06 22:16:51 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2009-06-06 22:16:51 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2009-06-06 22:16:51 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2009-06-06 22:16:51 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2009-06-06 22:16:48 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2009-06-06 22:16:48 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2009-06-06 22:16:48 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2009-06-06 22:16:48 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2009-06-06 22:16:48 ----RA---- C:\WINDOWS\system32\kbdest.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdro.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2009-06-06 22:16:42 ----A---- C:\WINDOWS\system32\spxcoins.dll
2009-06-06 22:16:42 ----A---- C:\WINDOWS\system32\irclass.dll
2009-06-06 22:16:42 ----A---- C:\WINDOWS\system32\dgsetup.dll
2009-06-06 22:16:42 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2009-06-06 22:16:41 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2009-06-06 22:16:38 ----A---- C:\WINDOWS\TASKMAN.EXE
2009-06-06 22:16:37 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2009-06-06 22:16:37 ----A---- C:\WINDOWS\system32\batt.dll
2009-06-06 22:16:36 ----A---- C:\WINDOWS\notepad.exe
2009-06-06 22:16:35 ----A---- C:\WINDOWS\system32\storprop.dll
2009-06-06 22:16:26 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2009-06-06 22:16:25 ----RA---- C:\WINDOWS\SET29.tmp
2009-06-06 22:16:21 ----RA---- C:\WINDOWS\SET8.tmp
2009-06-06 22:16:18 ----RA---- C:\WINDOWS\SET4.tmp
2009-06-06 22:16:16 ----RA---- C:\WINDOWS\SET3.tmp
2009-06-06 22:16:09 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-06 22:16:09 ----D---- C:\WINDOWS\system32\CatRoot
2009-06-06 22:16:03 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-06-06 22:15:23 ----D---- C:\Documents and Settings
2009-06-06 22:15:22 ----SHD---- C:\System Volume Information
2009-06-06 22:14:23 ----SH---- C:\boot.ini
2009-06-06 22:04:26 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-06-06 22:04:26 ----RSD---- C:\WINDOWS\Fonts
2009-06-06 22:04:26 ----RD---- C:\WINDOWS\Web
2009-06-06 22:04:26 ----HD---- C:\WINDOWS\inf
2009-06-06 22:04:26 ----D---- C:\WINDOWS\WinSxS
2009-06-06 22:04:26 ----D---- C:\WINDOWS\twain_32
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Temp
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\wins
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\wbem
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\usmt
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\spool
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\ShellExt
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\Setup
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\ras
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\oobe
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\npp
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\mui
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\inetsrv
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\IME
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\icsxml
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\ias
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\export
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\drivers
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\dhcp
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\config
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\3com_dmi
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\3076
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\2052
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\1054
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\1042
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\1041
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\1037
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\1033
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\1031
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\1028
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\1025
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system
2009-06-06 22:04:26 ----D---- C:\WINDOWS\security
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Resources
2009-06-06 22:04:26 ----D---- C:\WINDOWS\repair
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Provisioning
2009-06-06 22:04:26 ----D---- C:\WINDOWS\PeerNet
2009-06-06 22:04:26 ----D---- C:\WINDOWS\pchealth
2009-06-06 22:04:26 ----D---- C:\WINDOWS\mui
2009-06-06 22:04:26 ----D---- C:\WINDOWS\msapps
2009-06-06 22:04:26 ----D---- C:\WINDOWS\msagent
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Media
2009-06-06 22:04:26 ----D---- C:\WINDOWS\java
2009-06-06 22:04:26 ----D---- C:\WINDOWS\ime
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Help
2009-06-06 22:04:26 ----D---- C:\WINDOWS\ehome
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Driver Cache
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Debug
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Cursors
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Connection Wizard
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Config
2009-06-06 22:04:26 ----D---- C:\WINDOWS\AppPatch
2009-06-06 22:04:26 ----D---- C:\WINDOWS\addins
2009-06-06 22:04:26 ----D---- C:\WINDOWS
2009-06-06 21:40:10 ----D---- C:\WINDOWS\system32\xircom
2009-06-06 21:40:10 ----D---- C:\Program Files\xerox
2009-06-06 21:40:10 ----D---- C:\Program Files\microsoft frontpage
2009-06-06 21:39:54 ----HD---- C:\WINDOWS\$hf_mig$
2009-06-06 21:39:53 ----A---- C:\WINDOWS\system32\xpsp3res.dll
2009-06-06 21:39:38 ----A---- C:\WINDOWS\control.ini
2009-06-06 21:39:38 ----A---- C:\AUTOEXEC.BAT
2009-06-06 21:39:16 ----A---- C:\WINDOWS\system32\mapi32.dll
2009-06-06 21:38:08 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-06-06 21:38:08 ----RD---- C:\WINDOWS\Offline Web Pages
2009-06-06 21:38:08 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-06-06 21:38:01 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-06-06 21:37:55 ----HD---- C:\Program Files\WindowsUpdate
2009-06-06 21:37:30 ----D---- C:\WINDOWS\system32\DirectX
2009-06-06 21:37:00 ----A---- C:\WINDOWS\system32\atrace.dll
2009-06-06 21:36:56 ----A---- C:\WINDOWS\system32\desktop.ini
2009-06-06 21:36:56 ----A---- C:\WINDOWS\desktop.ini
2009-06-06 21:36:46 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2009-06-06 21:36:45 ----A---- C:\WINDOWS\system32\acctres.dll
2009-06-06 21:36:44 ----D---- C:\Program Files\Common Files\Services
2009-06-06 21:36:41 ----SD---- C:\WINDOWS\Tasks
2009-06-06 21:36:41 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2009-06-06 21:36:39 ----D---- C:\Program Files\Common Files\MSSoap
2009-06-06 21:36:33 ----D---- C:\WINDOWS\srchasst
2009-06-06 21:36:31 ----D---- C:\WINDOWS\system32\Macromed
2009-06-06 21:36:27 ----A---- C:\WINDOWS\system32\wuweb.dll
2009-06-06 21:36:27 ----A---- C:\WINDOWS\system32\wucltui.dll
2009-06-06 21:36:27 ----A---- C:\WINDOWS\system32\wuauserv.dll
2009-06-06 21:36:27 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2009-06-06 21:36:26 ----A---- C:\WINDOWS\system32\wups.dll
2009-06-06 21:36:26 ----A---- C:\WINDOWS\system32\wuaueng.dll
2009-06-06 21:36:26 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2009-06-06 21:36:26 ----A---- C:\WINDOWS\system32\wuauclt.exe
2009-06-06 21:36:26 ----A---- C:\WINDOWS\system32\wuapi.dll
2009-06-06 21:36:25 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2009-06-06 21:36:25 ----A---- C:\WINDOWS\system32\qmgr.dll
2009-06-06 21:36:25 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2009-06-06 21:36:25 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2009-06-06 21:36:19 ----D---- C:\Program Files\Movie Maker
2009-06-06 21:36:13 ----A---- C:\WINDOWS\system32\safrslv.dll
2009-06-06 21:36:13 ----A---- C:\WINDOWS\system32\safrdm.dll
2009-06-06 21:36:13 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2009-06-06 21:36:13 ----A---- C:\WINDOWS\system32\racpldlg.dll
2009-06-06 21:36:07 ----A---- C:\WINDOWS\system32\fltmc.exe
2009-06-06 21:36:07 ----A---- C:\WINDOWS\system32\fltlib.dll
2009-06-06 21:36:06 ----D---- C:\WINDOWS\system32\Restore
2009-06-06 21:36:06 ----A---- C:\WINDOWS\system32\srsvc.dll
2009-06-06 21:36:06 ----A---- C:\WINDOWS\system32\srrstr.dll
2009-06-06 21:36:06 ----A---- C:\WINDOWS\system32\srclient.dll
2009-06-06 21:36:05 ----A---- C:\WINDOWS\system32\mnmdd.dll
2009-06-06 21:36:05 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2009-06-06 21:36:05 ----A---- C:\WINDOWS\system32\ils.dll
2009-06-06 21:36:04 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2009-06-06 21:36:04 ----A---- C:\WINDOWS\system32\msconf.dll
2009-06-06 21:36:04 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2009-06-06 21:36:00 ----D---- C:\Program Files\NetMeeting
2009-06-06 21:36:00 ----A---- C:\WINDOWS\system32\msoert2.dll
2009-06-06 21:35:59 ----A---- C:\WINDOWS\system32\msoeacct.dll
2009-06-06 21:35:58 ----A---- C:\WINDOWS\system32\inetres.dll
2009-06-06 21:35:57 ----A---- C:\WINDOWS\system32\inetcomm.dll
2009-06-06 21:35:54 ----D---- C:\Program Files\Outlook Express
2009-06-06 21:35:54 ----A---- C:\WINDOWS\system32\schedsvc.dll
2009-06-06 21:35:54 ----A---- C:\WINDOWS\system32\mstinit.exe
2009-06-06 21:35:54 ----A---- C:\WINDOWS\system32\mstask.dll
2009-06-06 21:35:53 ----A---- C:\WINDOWS\system32\isign32.dll
2009-06-06 21:35:53 ----A---- C:\WINDOWS\system32\inetcfg.dll
2009-06-06 21:35:53 ----A---- C:\WINDOWS\system32\icwphbk.dll
2009-06-06 21:35:53 ----A---- C:\WINDOWS\system32\icwdial.dll
2009-06-06 21:35:44 ----D---- C:\Program Files\Common Files\System
2009-06-06 21:35:40 ----D---- C:\Program Files\Internet Explorer
2009-06-06 21:35:00 ----D---- C:\Program Files\ComPlus Applications
2009-06-06 21:34:57 ----A---- C:\WINDOWS\vbaddin.ini
2009-06-06 21:34:57 ----A---- C:\WINDOWS\vb.ini
2009-06-06 21:34:51 ----D---- C:\WINDOWS\Registration
2009-06-06 21:34:42 ----D---- C:\Program Files\Windows Media Player
2009-06-06 21:34:42 ----D---- C:\Program Files\Online Services
2009-06-06 21:34:33 ----D---- C:\Program Files\Messenger
2009-06-06 21:34:27 ----D---- C:\Program Files\MSN Gaming Zone
2009-06-06 21:34:27 ----A---- C:\WINDOWS\system32\write.exe
2009-06-06 21:34:15 ----A---- C:\WINDOWS\system32\sndvol32.exe
2009-06-06 21:34:15 ----A---- C:\WINDOWS\system32\hticons.dll
2009-06-06 21:34:14 ----A---- C:\WINDOWS\system32\winchat.exe
2009-06-06 21:34:14 ----A---- C:\WINDOWS\system32\avwav.dll
2009-06-06 21:34:14 ----A---- C:\WINDOWS\system32\avtapi.dll
2009-06-06 21:34:14 ----A---- C:\WINDOWS\system32\avmeter.dll
2009-06-06 21:34:04 ----A---- C:\WINDOWS\system32\getuname.dll
2009-06-06 21:34:04 ----A---- C:\WINDOWS\system32\charmap.exe
2009-06-06 21:34:03 ----A---- C:\WINDOWS\system32\sol.exe
2009-06-06 21:34:03 ----A---- C:\WINDOWS\system32\calc.exe
2009-06-06 21:34:02 ----A---- C:\WINDOWS\system32\winmine.exe
2009-06-06 21:34:02 ----A---- C:\WINDOWS\system32\reset.exe
2009-06-06 21:34:02 ----A---- C:\WINDOWS\system32\mshearts.exe
2009-06-06 21:34:02 ----A---- C:\WINDOWS\system32\freecell.exe
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\tslabels.ini
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\tskill.exe
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\tscon.exe
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\shadow.exe
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\rwinsta.exe
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\regini.exe
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\qwinsta.exe
2009-06-06 21:34:00 ----A---- C:\WINDOWS\system32\qappsrv.exe
2009-06-06 21:34:00 ----A---- C:\WINDOWS\system32\msg.exe
2009-06-06 21:34:00 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2009-06-06 21:34:00 ----A---- C:\WINDOWS\system32\logoff.exe
2009-06-06 21:34:00 ----A---- C:\WINDOWS\system32\cdmodem.dll
2009-06-06 21:33:59 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2009-06-06 21:33:59 ----A---- C:\WINDOWS\system32\mtxex.dll
2009-06-06 21:33:59 ----A---- C:\WINDOWS\system32\mtxdm.dll
2009-06-06 21:33:59 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2009-06-06 21:33:58 ----A---- C:\WINDOWS\system32\stclient.dll
2009-06-06 21:33:58 ----A---- C:\WINDOWS\system32\comsnap.dll
2009-06-06 21:33:58 ----A---- C:\WINDOWS\system32\comrepl.dll
2009-06-06 21:33:58 ----A---- C:\WINDOWS\system32\comaddin.dll
2009-06-06 21:33:51 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2009-06-06 21:33:29 ----D---- C:\Program Files\MSN
2009-06-06 21:33:27 ----A---- C:\WINDOWS\system32\sndrec32.exe
2009-06-06 21:33:27 ----A---- C:\WINDOWS\system32\mplay32.exe
2009-06-06 21:33:27 ----A---- C:\WINDOWS\system32\accwiz.exe
2009-06-06 21:33:26 ----D---- C:\Program Files\Windows NT
2009-06-06 21:33:26 ----A---- C:\WINDOWS\system32\hypertrm.dll
2009-06-06 21:33:25 ----A---- C:\WINDOWS\system32\spider.exe
2009-06-06 21:33:25 ----A---- C:\WINDOWS\system32\mspaint.exe
2009-06-06 21:33:25 ----A---- C:\WINDOWS\system32\clipbrd.exe
2009-06-06 21:33:24 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2009-06-06 21:33:23 ----A---- C:\WINDOWS\system32\remotepg.dll
2009-06-06 21:33:23 ----A---- C:\WINDOWS\system32\rdshost.exe
2009-06-06 21:33:23 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2009-06-06 21:33:23 ----A---- C:\WINDOWS\system32\mstscax.dll
2009-06-06 21:33:23 ----A---- C:\WINDOWS\system32\mstsc.exe
2009-06-06 21:33:22 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2009-06-06 21:33:22 ----A---- C:\WINDOWS\system32\termsrv.dll
2009-06-06 21:33:22 ----A---- C:\WINDOWS\system32\sessmgr.exe
2009-06-06 21:33:22 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2009-06-06 21:33:22 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2009-06-06 21:33:22 ----A---- C:\WINDOWS\system32\rdchost.dll
2009-06-06 21:33:21 ----D---- C:\WINDOWS\system32\MsDtc
2009-06-06 21:33:21 ----A---- C:\WINDOWS\system32\rdpclip.exe
2009-06-06 21:33:21 ----A---- C:\WINDOWS\system32\qprocess.exe
2009-06-06 21:33:21 ----A---- C:\WINDOWS\system32\mtxoci.dll
2009-06-06 21:33:21 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2009-06-06 21:33:21 ----A---- C:\WINDOWS\system32\icaapi.dll
2009-06-06 21:33:21 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2009-06-06 21:33:20 ----A---- C:\WINDOWS\system32\msdtctm.dll
2009-06-06 21:33:20 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2009-06-06 21:33:19 ----A---- C:\WINDOWS\system32\xolehlp.dll
2009-06-06 21:33:19 ----A---- C:\WINDOWS\system32\msdtclog.dll
2009-06-06 21:33:19 ----A---- C:\WINDOWS\system32\msdtc.exe
2009-06-06 21:33:18 ----D---- C:\WINDOWS\system32\Com
2009-06-06 21:33:18 ----A---- C:\WINDOWS\system32\colbact.dll
2009-06-06 21:33:18 ----A---- C:\WINDOWS\system32\clbcatex.dll
2009-06-06 21:33:18 ----A---- C:\WINDOWS\system32\catsrvps.dll
2009-06-06 21:33:17 ----A---- C:\WINDOWS\system32\catsrvut.dll
2009-06-06 21:33:17 ----A---- C:\WINDOWS\system32\catsrv.dll
2009-06-06 21:33:16 ----A---- C:\WINDOWS\system32\comuid.dll
2009-06-06 21:33:16 ----A---- C:\WINDOWS\system32\comsvcs.dll
2009-06-06 21:33:15 ----A---- C:\WINDOWS\system32\clbcatq.dll
2009-06-06 21:33:06 ----A---- C:\WINDOWS\system32\servdeps.dll
2009-06-06 21:33:06 ----A---- C:\WINDOWS\system32\mmfutil.dll
2009-06-06 21:33:06 ----A---- C:\WINDOWS\system32\licwmi.dll
2009-06-06 21:33:06 ----A---- C:\WINDOWS\system32\cmprops.dll

======List of files/folders modified in the last 1 months======

2009-06-11 13:23:03 ----A---- C:\WINDOWS\win.ini
2009-06-06 22:26:12 ----A---- C:\WINDOWS\system.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 meiudf;meiudf; C:\WINDOWS\System32\Drivers\meiudf.sys [2005-06-02 102384]
R1 mfehidk;McAfee Inc. mfehidk; C:\WINDOWS\system32\drivers\mfehidk.sys [2009-03-25 214024]
R1 MPFP;MPFP; C:\WINDOWS\System32\Drivers\Mpfp.sys [2008-10-23 120136]
R2 tdudf;TOSHIBA UDF File System Driver; C:\WINDOWS\system32\DRIVERS\tdudf.sys [2006-06-28 98816]
R3 AgereSoftModem;TOSHIBA V92 Software Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2006-03-18 1155584]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-12-11 1414656]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-06-28 4304384]
R3 mfeavfk;McAfee Inc. mfeavfk; C:\WINDOWS\system32\drivers\mfeavfk.sys [2009-03-25 79880]
R3 mfebopk;McAfee Inc. mfebopk; C:\WINDOWS\system32\drivers\mfebopk.sys [2009-03-25 35272]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2006-02-27 81408]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver; C:\WINDOWS\system32\DRIVERS\tdcmdpst.sys [2006-03-02 15360]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 mferkdk;McAfee Inc. mferkdk; C:\WINDOWS\system32\drivers\mferkdk.sys [2009-03-25 34216]
S3 mfesmfk;McAfee Inc. mfesmfk; C:\WINDOWS\system32\drivers\mfesmfk.sys [2009-03-25 40552]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-05-29 144712]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-12-11 393216]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 DVD-RAM_Service;DVD-RAM_Service; C:\WINDOWS\system32\DVDRAMSV.exe [2004-08-28 110592]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-06-07 152984]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; C:\Program Files\McAfee\SiteAdvisor\McSACore.exe [2009-01-23 203280]
R2 mcmscsvc;McAfee Services; C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [2009-03-25 797864]
R2 McNASvc;McAfee Network Agent; c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe [2009-01-09 2482848]
R2 McProxy;McAfee Proxy Service; c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [2009-01-09 359952]
R2 McShield;McAfee Real-time Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [2009-03-25 144704]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2003-06-19 322120]
R2 MpfService;McAfee Personal Firewall Service; C:\Program Files\McAfee\MPF\MPFSrv.exe [2009-03-19 884360]
R2 TODDSrv;TOSHIBA Optical Disc Drive Service; C:\WINDOWS\system32\TODDSrv.exe [2006-05-25 114688]
R2 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-05-30 541992]
S3 getPlus(R) Helper;getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2009-06-04 66048]
S3 McODS;McAfee Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [2009-04-01 365072]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 McSysmon;McAfee SystemGuards; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [2009-03-24 606736]

-----------------EOF-----------------


info.txt logfile of random's system information tool 1.06 2009-06-20 13:03:35

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->C:\WINDOWS\system32\RunDll32.Exe C:\WINDOWS\system32\SetupAPI.Dll,InstallHinfSection DefaultUninstall.NTx86 4 C:\WINDOWS\INF\tdudf.Inf
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
AC3Filter (remove only)-->C:\Program Files\AC3Filter\uninstall.exe
Acrobat.com-->MsiExec.exe /X{6D8D64BE-F500-55B6-705D-DFD08AFE0624}
Adobe AIR-->c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Download Manager-->"C:\Program Files\NOS\bin\getPlus_HelperSvc.exe" /UninstallGet1
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A91000000001}
Apple Mobile Device Support-->MsiExec.exe /I{659B48CD-0608-4ED5-94C0-0B6C87114F10}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ATI Control Panel-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
BHVideo-->"C:\Program Files\BHVideo\Uninstall.exe"
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
CCleaner (remove only)-->"C:\Program Files\CC-leaner\uninst.exe"
Critical Update for Windows Media Player 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Program Files\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
DVD-RAM Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9D765FA6-F2BC-40AF-8145-50808F9BDF4E}\setup.exe" -l0x9 DVD-RAM Driver
GPL MPEG-1/2 DirectShow Decoder Filter-->MsiExec.exe /I{870815CA-6B60-47B6-88DD-A67F42D2F03E}
High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
hp business inkjet 1100-->msiexec /x{242B9150-74EC-4606-AAB1-2F0C719378D7}
iTunes-->MsiExec.exe /I{CC5702D7-86E2-45A8-99D7-E8B976ADCC56}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malware\unins000.exe"
McAfee SecurityCenter-->C:\Program Files\McAfee\MSC\mcuninst.exe
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office XP Professional with FrontPage-->MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Mozilla Firefox (3.0.11)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68}
REALTEK GbE & FE Ethernet PCI NIC Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}\setup.exe" -l0x9 -removeonly
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe" -l0x9 -removeonly
Security Update for Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB969897)-->"C:\WINDOWS\ie7updates\KB969897-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Security Update for Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Security Update for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Security Update for Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Security Update for Windows XP (KB963027)-->"C:\WINDOWS\$NtUninstallKB963027$\spuninst\spuninst.exe"
Security Update for Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Security Update for Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"
Security Update for Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
SpywareBlaster 4.2-->"C:\Program Files\SpywareBlaster\unins000.exe"
SUBARU-FAST 2-->C:\SUBARU~1\UNINSFAE.EXE C:\SUBARU~1\SUBARU.LOG
TOSHIBA Direct Disc Writer-->MsiExec.exe /X{400830CA-F056-4BBE-80A3-9DF9CA4FB889}
TOSHIBA Software Modem-->Tosmreg -U
Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Update for Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AV: McAfee VirusScan (disabled)
FW: McAfee Personal Firewall (disabled)

======System event log======

Computer Name: LAPTOP
Event Code: 20
Message: Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 8 for Windows XP.

Record Number: 429
Source Name: Windows Update Agent
Time Written: 20090608213308.000000+060
Event Type: error
User:

Computer Name: LAPTOP
Event Code: 7022
Message: The Windows Firewall/Internet Connection Sharing (ICS) service hung on starting.

Record Number: 355
Source Name: Service Control Manager
Time Written: 20090608201823.000000+060
Event Type: error
User:

Computer Name: LAPTOP
Event Code: 4373
Message: Windows XP Service Pack 3 installation failed.
The system cannot find the path specified.


Record Number: 260
Source Name: NtServicePack
Time Written: 20090608081617.000000+060
Event Type: error
User: NT AUTHORITY\SYSTEM

Computer Name: LAPTOP
Event Code: 10010
Message: The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

Record Number: 158
Source Name: DCOM
Time Written: 20090607190152.000000+060
Event Type: error
User: NT AUTHORITY\SYSTEM

Computer Name: LAPTOP
Event Code: 7
Message: The device, \Device\CdRom0, has a bad block.

Record Number: 59
Source Name: Cdrom
Time Written: 20090607002630.000000+060
Event Type: error
User:

=====Application event log=====

Computer Name: LAPTOP
Event Code: 5603
Message: A provider, OffProv10, has been registered in the WMI namespace, Root\MSAPPS10, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

Record Number: 248
Source Name: WinMgmt
Time Written: 20090613202045.000000+060
Event Type: warning
User: LAPTOP\phil

Computer Name: LAPTOP
Event Code: 5603
Message: A provider, OffProv10, has been registered in the WMI namespace, Root\MSAPPS10, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

Record Number: 247
Source Name: WinMgmt
Time Written: 20090613202045.000000+060
Event Type: warning
User: LAPTOP\phil

Computer Name: LAPTOP
Event Code: 1002
Message: Hanging application wmplayer.exe, version 11.0.5721.5145, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Record Number: 246
Source Name: Application Hang
Time Written: 20090613200220.000000+060
Event Type: error
User:

Computer Name: LAPTOP
Event Code: 1002
Message: Hanging application DivX Player.exe, version 7.2.0.19, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Record Number: 245
Source Name: Application Hang
Time Written: 20090613200139.000000+060
Event Type: error
User:

Computer Name: LAPTOP
Event Code: 1002
Message: Hanging application wmplayer.exe, version 11.0.5721.5145, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Record Number: 244
Source Name: Application Hang
Time Written: 20090613200103.000000+060
Event Type: error
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Common Files\DivX Shared\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 14 Stepping 8, GenuineIntel
"PROCESSOR_REVISION"=0e08
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip

-----------------EOF-----------------


Phil
peevee
Regular Member
 
Posts: 28
Joined: May 29th, 2009, 8:30 am

Re: Hyjacked Browsers & Blocked From Runnig Certain exe Files

Unread postby peku006 » June 20th, 2009, 8:37 am

Hi peevee

If MBAM does not start, go to C:\Program Files\Malwarebytes' Anti-Malware and find the file mbam.exe, right-click on the file and select Rename. Rename the file to peevee.exe and double-click on it to see if it will run.

Thanks peku006
User avatar
peku006
MRU Emeritus
MRU Emeritus
 
Posts: 3357
Joined: May 14th, 2007, 2:18 pm
Location: Norway

Re: Hyjacked Browsers & Blocked From Runnig Certain exe Files

Unread postby peevee » June 20th, 2009, 1:41 pm

I got MBAM to run but could not update it, I kept getting redirected to search pages.

If I try to update in Safe Mode, I get an error msg saying that the page cannot be found.

I ran the scan anyway & here are the results

Malwarebytes' Anti-Malware 1.38
Database version: 2297
Windows 5.1.2600 Service Pack 3

20/06/2009 18:16:51
mbam-log-2009-06-20 (18-16-51).txt

Scan type: Full Scan (C:\|D:\|E:\|)
Objects scanned: 163808
Time elapsed: 21 minute(s), 25 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 8
Folders Infected: 2
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
\\?\globalroot\systemroot\system32\MSIVXnuvaixlttknpboewrynumnitqmgjoeyb.dll (Spyware.Agent) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BHVideo (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.208,85.255.112.79 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{23524266-4016-4609-919d-d30a829f0928}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.208,85.255.112.79 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.208,85.255.112.79 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{23524266-4016-4609-919d-d30a829f0928}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.208,85.255.112.79 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.208,85.255.112.79 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{23524266-4016-4609-919d-d30a829f0928}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.208,85.255.112.79 -> Quarantined and deleted successfully.

Folders Infected:
c:\documents and settings\Administrator\Start Menu\Programs\BHVideo (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Program Files\BHVideo (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Files Infected:
\\?\globalroot\systemroot\system32\MSIVXnuvaixlttknpboewrynumnitqmgjoeyb.dll (Spyware.Agent) -> Quarantined and deleted successfully.
c:\program files\BHVideo\Uninstall.exe (Trojan.DNSChanger) -> Quarantined and deleted successfully.
c:\documents and settings\administrator\start menu\Programs\BHVideo\Uninstall.lnk (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\MSIVXcount (Trojan.Agent) -> Delete on reboot.


I have re run RSIT but only get one log now

Logfile of random's system information tool 1.06 (written by random/random)
Run by phil at 2009-06-20 18:34:21
Microsoft Windows XP Professional Service Pack 3
System drive C: has 48 GB (84%) free of 57 GB
Total RAM: 1918 MB (69% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:34:41, on 20/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\WINDOWS\system32\svchost.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hewlett-Packard\hp business inkjet 1100 series\Toolbox\mpm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Malware\peevee.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\phil\Desktop\RSIT.exe
C:\Program Files\trend micro\phil.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=101756&l=dir
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [HPWH myPrintMileage Agent] C:\Program Files\Hewlett-Packard\hp business inkjet 1100 series\Toolbox\mpm.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 4465004859
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe

--
End of file - 7950 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\McDefragTask.job
C:\WINDOWS\tasks\McQcTask.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - C:\Program Files\McAfee\VirusScan\scriptsn.dll [2009-03-25 62784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll [2009-01-29 145424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-06-07 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-06-07 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll [2009-01-29 145424]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2005-12-11 344064]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-06-28 16248320]
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"DDWMon"=C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe [2006-04-28 262144]
"AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2006-03-18 89541]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-05-26 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-05-30 292136]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-06-07 148888]
"mcagent_exe"=C:\Program Files\McAfee.com\Agent\mcagent.exe [2009-03-25 645328]
"HPWH myPrintMileage Agent"=C:\Program Files\Hewlett-Packard\hp business inkjet 1100 series\Toolbox\mpm.exe [2003-11-19 102400]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE
RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-12-11 47104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MpfService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe"="C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Vuze\Azureus.exe"="C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2009-06-20 18:25:03 ----D---- C:\Avenger
2009-06-20 17:52:52 ----D---- C:\Documents and Settings\phil\Application Data\Malwarebytes
2009-06-20 17:27:39 ----A---- C:\WINDOWS\ntbtlog.txt
2009-06-20 13:03:23 ----D---- C:\rsit
2009-06-20 12:53:36 ----D---- C:\Program Files\Malware
2009-06-20 12:53:36 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-06-18 18:28:52 ----A---- C:\WINDOWS\system32\GAPI.DLL
2009-06-18 18:28:51 ----D---- C:\SUBARUEX2
2009-06-18 18:28:51 ----A---- C:\WINDOWS\system32\VB5DB.DLL
2009-06-18 18:28:51 ----A---- C:\WINDOWS\system32\MSREPL35.DLL
2009-06-18 18:28:51 ----A---- C:\WINDOWS\system32\MSRD2X35.DLL
2009-06-18 18:28:51 ----A---- C:\WINDOWS\system32\MSJTER35.DLL
2009-06-18 18:28:51 ----A---- C:\WINDOWS\system32\MSJINT35.DLL
2009-06-18 18:28:51 ----A---- C:\WINDOWS\system32\MSJET35.DLL
2009-06-18 18:27:18 ----D---- C:\SUBARUEX
2009-06-18 14:04:52 ----D---- C:\Program Files\CC-leaner
2009-06-16 21:26:33 ----SHD---- C:\WINDOWS\CSC
2009-06-16 13:32:01 ----D---- C:\Program Files\Trend Micro
2009-06-16 13:24:58 ----D---- C:\Program Files\Common Files\Adobe
2009-06-16 13:24:22 ----D---- C:\Program Files\Adobe
2009-06-16 13:24:02 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2009-06-16 13:23:59 ----D---- C:\Program Files\Common Files\Adobe AIR
2009-06-16 13:22:41 ----D---- C:\Program Files\NOS
2009-06-16 13:22:41 ----D---- C:\Documents and Settings\All Users\Application Data\NOS
2009-06-13 20:03:39 ----D---- C:\Documents and Settings\phil\Application Data\Macromedia
2009-06-13 20:03:39 ----D---- C:\Documents and Settings\phil\Application Data\Adobe
2009-06-13 19:59:10 ----D---- C:\Program Files\AC3Filter
2009-06-13 19:53:35 ----D---- C:\Program Files\GPL MPEG Decoder
2009-06-13 14:49:05 ----D---- C:\Documents and Settings\phil\Application Data\DivX
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\vxblock.dll
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\pxsfs.dll
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\pxinsi64.exe
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\pxinsa64.exe
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\pxhpinst.exe
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\pxdrv.dll
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\pxcpyi64.exe
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\pxcpya64.exe
2009-06-13 00:42:17 ----N---- C:\WINDOWS\system32\pxafs.dll
2009-06-13 00:42:16 ----N---- C:\WINDOWS\system32\pxwave.dll
2009-06-13 00:42:16 ----N---- C:\WINDOWS\system32\pxmas.dll
2009-06-13 00:42:16 ----N---- C:\WINDOWS\system32\px.dll
2009-06-13 00:41:48 ----D---- C:\Program Files\Common Files\DivX Shared
2009-06-13 00:41:47 ----D---- C:\Program Files\DivX
2009-06-12 13:40:26 ----D---- C:\Documents and Settings\All Users\Application Data\Azureus
2009-06-12 03:01:50 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$
2009-06-12 03:01:33 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2009-06-12 03:01:05 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$
2009-06-12 03:01:01 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2009-06-12 03:00:43 ----HDC---- C:\WINDOWS\$NtUninstallKB936782_WMP11$
2009-06-11 20:27:45 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-06-11 20:27:38 ----HDC---- C:\WINDOWS\$NtUninstallKB969898$
2009-06-11 20:25:09 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-06-11 20:24:36 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2009-06-11 13:23:43 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-06-11 13:23:37 ----HDC---- C:\WINDOWS\$NtUninstallMSCompPackV1$
2009-06-11 13:22:32 ----D---- C:\Program Files\Windows Media Connect 2
2009-06-11 13:22:19 ----HDC---- C:\WINDOWS\$NtUninstallwmp11$
2009-06-11 13:19:25 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2009-06-11 13:18:27 ----D---- C:\WINDOWS\system32\LogFiles
2009-06-11 13:18:15 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2009-06-10 21:46:44 ----D---- C:\WINDOWS\RegisteredPackages
2009-06-10 21:43:42 ----D---- C:\Program Files\Common Files\Hypnotizer
2009-06-10 13:28:11 ----A---- C:\WINDOWS\scrub2k.exe
2009-06-10 13:28:11 ----A---- C:\WINDOWS\hpw1100k.ini
2009-06-10 13:28:06 ----D---- C:\Program Files\Hewlett-Packard
2009-06-10 13:26:19 ----A---- C:\WINDOWS\hpbj1100.ini
2009-06-10 03:03:52 ----D---- C:\WINDOWS\ie7updates
2009-06-08 21:44:26 ----D---- C:\WINDOWS\WBEM
2009-06-08 21:42:54 ----HDC---- C:\WINDOWS\ie7
2009-06-08 21:42:38 ----HDC---- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
2009-06-08 21:42:13 ----HDC---- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
2009-06-08 20:31:55 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-06-08 20:31:43 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-06-08 20:31:23 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-06-08 20:31:12 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
2009-06-08 20:30:28 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-06-08 20:30:17 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
2009-06-08 20:30:08 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2009-06-08 20:29:59 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-06-08 20:29:49 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$
2009-06-08 20:29:40 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-06-08 20:29:30 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-06-08 20:29:19 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-06-08 20:29:11 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2009-06-08 20:28:59 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-06-08 20:28:49 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2009-06-08 20:28:40 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-06-08 20:28:30 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-06-08 20:28:20 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-06-08 20:28:11 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-06-08 20:28:02 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-06-08 20:27:50 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-06-08 20:27:37 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2009-06-08 20:27:27 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-06-08 20:27:18 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-06-08 20:27:02 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$
2009-06-08 20:15:24 ----D---- C:\WINDOWS\Prefetch
2009-06-08 18:13:17 ----D---- C:\WINDOWS\system32\CatRoot_bak
2009-06-08 18:11:14 ----HDC---- C:\WINDOWS\$NtUninstallKB963027$
2009-06-08 18:11:04 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-06-08 18:10:54 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-06-08 18:10:45 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-06-08 18:10:36 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-06-08 18:10:27 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-06-08 18:10:17 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-06-08 18:05:22 ----D---- C:\WINDOWS\system32\scripting
2009-06-08 18:05:22 ----D---- C:\WINDOWS\system32\en-us
2009-06-08 18:05:21 ----D---- C:\WINDOWS\system32\en
2009-06-08 18:05:21 ----D---- C:\WINDOWS\l2schemas
2009-06-08 18:05:20 ----D---- C:\WINDOWS\system32\bits
2009-06-08 18:02:27 ----D---- C:\WINDOWS\ServicePackFiles
2009-06-08 17:58:54 ----D---- C:\WINDOWS\network diagnostic
2009-06-08 17:52:45 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2009-06-08 17:45:54 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2009-06-08 17:45:54 ----A---- C:\WINDOWS\system32\mucltui.dll
2009-06-08 13:54:37 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2009-06-08 13:42:37 ----A---- C:\WINDOWS\system32\MRT.exe
2009-06-08 13:42:23 ----HDC---- C:\WINDOWS\$NtUninstallKB960803_0$
2009-06-08 13:42:12 ----HDC---- C:\WINDOWS\$NtUninstallKB954600_0$
2009-06-08 13:42:01 ----HDC---- C:\WINDOWS\$NtUninstallKB958644_0$
2009-06-08 13:41:50 ----HDC---- C:\WINDOWS\$NtUninstallKB955069_0$
2009-06-08 13:41:33 ----HDC---- C:\WINDOWS\$NtUninstallKB956802_0$
2009-06-08 13:40:31 ----HDC---- C:\WINDOWS\$NtUninstallKB963027_0$
2009-06-08 13:40:11 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$
2009-06-08 13:39:38 ----HDC---- C:\WINDOWS\$NtUninstallKB923561_0$
2009-06-08 08:03:50 ----N---- C:\WINDOWS\system32\xpsp4res.dll
2009-06-08 03:00:46 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2009-06-08 03:00:22 ----D---- C:\WINDOWS\system32\PreInstall
2009-06-08 03:00:20 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2009-06-07 19:04:46 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2009-06-07 16:54:15 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-07 16:12:07 ----D---- C:\Program Files\AskSearch
2009-06-07 16:05:32 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2009-06-07 16:05:22 ----D---- C:\Program Files\SpywareBlaster
2009-06-07 16:02:22 ----D---- C:\Program Files\CCleaner
2009-06-07 12:30:06 ----D---- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2009-06-07 12:26:52 ----D---- C:\Program Files\Common Files\McAfee
2009-06-07 12:26:48 ----D---- C:\Program Files\McAfee.com
2009-06-07 12:26:35 ----D---- C:\Program Files\McAfee
2009-06-07 12:21:34 ----A---- C:\WINDOWS\system32\wmpns.dll
2009-06-07 12:13:20 ----D---- C:\WINDOWS\Sun
2009-06-07 12:12:58 ----A---- C:\WINDOWS\system32\javaws.exe
2009-06-07 12:12:58 ----A---- C:\WINDOWS\system32\javaw.exe
2009-06-07 12:12:58 ----A---- C:\WINDOWS\system32\java.exe
2009-06-07 12:12:58 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-06-07 12:12:47 ----D---- C:\Program Files\Java
2009-06-07 12:11:44 ----D---- C:\Documents and Settings\phil\Application Data\Sun
2009-06-07 02:32:02 ----D---- C:\Documents and Settings\All Users\Application Data\McAfee
2009-06-07 02:12:36 ----D---- C:\Documents and Settings\phil\Application Data\Apple Computer
2009-06-07 02:12:32 ----A---- C:\WINDOWS\system32\GEARAspi.dll
2009-06-07 02:12:16 ----D---- C:\Program Files\iPod
2009-06-07 02:12:13 ----D---- C:\Program Files\iTunes
2009-06-07 02:12:13 ----D---- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-06-07 02:12:01 ----D---- C:\Program Files\Bonjour
2009-06-07 02:11:34 ----D---- C:\Program Files\QuickTime
2009-06-07 02:11:33 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2009-06-07 02:11:22 ----D---- C:\Program Files\Apple Software Update
2009-06-07 02:11:15 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-06-07 02:11:01 ----D---- C:\Program Files\Common Files\Apple
2009-06-07 02:11:00 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2009-06-07 00:56:55 ----A---- C:\WINDOWS\ODBC.INI
2009-06-07 00:56:26 ----SHD---- C:\RECYCLER
2009-06-07 00:56:25 ----D---- C:\Program Files\Microsoft ActiveSync
2009-06-07 00:56:12 ----D---- C:\Program Files\Microsoft Visual Studio
2009-06-07 00:56:12 ----D---- C:\Program Files\Common Files\Designer
2009-06-07 00:55:37 ----D---- C:\WINDOWS\ShellNew
2009-06-07 00:55:36 ----D---- C:\Program Files\Common Files\L&H
2009-06-07 00:55:32 ----D---- C:\Program Files\Microsoft Office
2009-06-07 00:48:23 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2009-06-07 00:45:57 ----D---- C:\Documents and Settings\phil\Application Data\Mozilla
2009-06-07 00:45:50 ----D---- C:\Program Files\Mozilla Firefox
2009-06-07 00:35:27 ----N---- C:\WINDOWS\agrsmdel.exe
2009-06-07 00:35:27 ----D---- C:\Program Files\ltmoh
2009-06-07 00:35:27 ----A---- C:\WINDOWS\system32\tosmreg.ini
2009-06-07 00:35:27 ----A---- C:\WINDOWS\system32\tosmreg.exe
2009-06-07 00:35:27 ----A---- C:\WINDOWS\system32\cseltbl.ini
2009-06-07 00:35:27 ----A---- C:\WINDOWS\system32\csellang.ini
2009-06-07 00:35:27 ----A---- C:\WINDOWS\system32\csellang.dll
2009-06-07 00:35:27 ----A---- C:\WINDOWS\system32\cselect.exe
2009-06-07 00:35:27 ----A---- C:\WINDOWS\agrsmmsg.exe
2009-06-07 00:32:58 ----D---- C:\WINDOWS\system32\Lang
2009-06-07 00:30:01 ----A---- C:\WINDOWS\system32\TODDSrv.exe
2009-06-07 00:29:58 ----D---- C:\Program Files\TOSHIBA
2009-06-07 00:29:22 ----D---- C:\Program Files\DVD-RAM
2009-06-07 00:29:22 ----A---- C:\WINDOWS\system32\RAMASST.exe
2009-06-07 00:29:22 ----A---- C:\WINDOWS\system32\DVDRAMSV.exe
2009-06-07 00:29:22 ----A---- C:\WINDOWS\system32\DVDMenu.dll
2009-06-07 00:26:59 ----A---- C:\WINDOWS\system32\RtlCPAPI.dll
2009-06-07 00:26:59 ----A---- C:\WINDOWS\system32\ChCfg.exe
2009-06-07 00:26:37 ----D---- C:\WINDOWS\system32\RTCOM
2009-06-07 00:26:35 ----A---- C:\WINDOWS\system32\ksuser.dll
2009-06-07 00:26:04 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2009-06-07 00:26:03 ----HDC---- C:\WINDOWS\$NtUninstallKB888111WXPSP2$
2009-06-07 00:26:01 ----A---- C:\WINDOWS\SoundMan.exe
2009-06-07 00:26:01 ----A---- C:\WINDOWS\SkyTel.exe
2009-06-07 00:26:01 ----A---- C:\WINDOWS\RtlUpd.exe
2009-06-07 00:26:01 ----A---- C:\WINDOWS\RTLCPL.exe
2009-06-07 00:25:59 ----A---- C:\WINDOWS\RTHDCPL.exe
2009-06-07 00:25:58 ----A---- C:\WINDOWS\MicCal.exe
2009-06-07 00:25:57 ----A---- C:\WINDOWS\alcwzrd.exe
2009-06-07 00:25:57 ----A---- C:\WINDOWS\Alcmtr.exe
2009-06-07 00:25:51 ----A---- C:\WINDOWS\RtlExUpd.dll
2009-06-07 00:25:37 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-06-07 00:25:28 ----D---- C:\WINDOWS\OPTIONS
2009-06-07 00:25:28 ----D---- C:\Program Files\Realtek
2009-06-07 00:23:57 ----D---- C:\Documents and Settings\phil\Application Data\Help
2009-06-07 00:23:46 ----D---- C:\Documents and Settings\phil\Application Data\Identities
2009-06-07 00:23:36 ----ASH---- C:\Documents and Settings\phil\Application Data\desktop.ini
2009-06-07 00:23:35 ----SD---- C:\Documents and Settings\phil\Application Data\Microsoft
2009-06-07 00:21:59 ----D---- C:\Program Files\ATI Technologies
2009-06-07 00:21:31 ----HD---- C:\Program Files\InstallShield Installation Information
2009-06-07 00:20:59 ----D---- C:\Program Files\Common Files\InstallShield
2009-06-07 00:11:55 ----HD---- C:\Program Files\Uninstall Information
2009-06-07 00:11:06 ----A---- C:\WINDOWS\system32\wpa.bak
2009-06-07 00:08:54 ----D---- C:\WINDOWS\SoftwareDistribution
2009-06-07 00:08:43 ----SD---- C:\WINDOWS\system32\Microsoft
2009-06-07 00:08:43 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-06-06 22:30:38 ----A---- C:\WINDOWS\system32\h323log.txt
2009-06-06 22:18:30 ----A---- C:\WINDOWS\system32\usbui.dll
2009-06-06 22:17:07 ----SHD---- C:\WINDOWS\Installer
2009-06-06 22:17:07 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-06-06 22:17:06 ----D---- C:\Program Files\Common Files\ODBC
2009-06-06 22:17:06 ----A---- C:\WINDOWS\ODBCINST.INI
2009-06-06 22:17:01 ----D---- C:\Program Files\Common Files\SpeechEngines
2009-06-06 22:17:00 ----RD---- C:\Program Files
2009-06-06 22:17:00 ----D---- C:\Program Files\Common Files\Microsoft Shared
2009-06-06 22:17:00 ----D---- C:\Program Files\Common Files
2009-06-06 22:16:57 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2009-06-06 22:16:57 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2009-06-06 22:16:57 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdur.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdru.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2009-06-06 22:16:54 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2009-06-06 22:16:51 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2009-06-06 22:16:51 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2009-06-06 22:16:51 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2009-06-06 22:16:51 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2009-06-06 22:16:51 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2009-06-06 22:16:51 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2009-06-06 22:16:51 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2009-06-06 22:16:48 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2009-06-06 22:16:48 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2009-06-06 22:16:48 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2009-06-06 22:16:48 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2009-06-06 22:16:48 ----RA---- C:\WINDOWS\system32\kbdest.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdro.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2009-06-06 22:16:45 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2009-06-06 22:16:42 ----A---- C:\WINDOWS\system32\spxcoins.dll
2009-06-06 22:16:42 ----A---- C:\WINDOWS\system32\irclass.dll
2009-06-06 22:16:42 ----A---- C:\WINDOWS\system32\dgsetup.dll
2009-06-06 22:16:42 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2009-06-06 22:16:41 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2009-06-06 22:16:38 ----A---- C:\WINDOWS\TASKMAN.EXE
2009-06-06 22:16:37 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2009-06-06 22:16:37 ----A---- C:\WINDOWS\system32\batt.dll
2009-06-06 22:16:36 ----A---- C:\WINDOWS\notepad.exe
2009-06-06 22:16:35 ----A---- C:\WINDOWS\system32\storprop.dll
2009-06-06 22:16:26 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2009-06-06 22:16:25 ----RA---- C:\WINDOWS\SET29.tmp
2009-06-06 22:16:21 ----RA---- C:\WINDOWS\SET8.tmp
2009-06-06 22:16:18 ----RA---- C:\WINDOWS\SET4.tmp
2009-06-06 22:16:16 ----RA---- C:\WINDOWS\SET3.tmp
2009-06-06 22:16:09 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-06 22:16:09 ----D---- C:\WINDOWS\system32\CatRoot
2009-06-06 22:16:03 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-06-06 22:15:23 ----D---- C:\Documents and Settings
2009-06-06 22:15:22 ----SHD---- C:\System Volume Information
2009-06-06 22:14:23 ----SH---- C:\boot.ini
2009-06-06 22:04:26 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-06-06 22:04:26 ----RSD---- C:\WINDOWS\Fonts
2009-06-06 22:04:26 ----RD---- C:\WINDOWS\Web
2009-06-06 22:04:26 ----HD---- C:\WINDOWS\inf
2009-06-06 22:04:26 ----D---- C:\WINDOWS\WinSxS
2009-06-06 22:04:26 ----D---- C:\WINDOWS\twain_32
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Temp
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\wins
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\wbem
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\usmt
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\spool
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\ShellExt
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\Setup
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\ras
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\oobe
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\npp
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\mui
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\inetsrv
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\IME
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\icsxml
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\ias
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\export
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\drivers
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\dhcp
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\config
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\3com_dmi
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\3076
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\2052
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\1054
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\1042
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\1041
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\1037
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\1033
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\1031
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\1028
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32\1025
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system32
2009-06-06 22:04:26 ----D---- C:\WINDOWS\system
2009-06-06 22:04:26 ----D---- C:\WINDOWS\security
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Resources
2009-06-06 22:04:26 ----D---- C:\WINDOWS\repair
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Provisioning
2009-06-06 22:04:26 ----D---- C:\WINDOWS\PeerNet
2009-06-06 22:04:26 ----D---- C:\WINDOWS\pchealth
2009-06-06 22:04:26 ----D---- C:\WINDOWS\mui
2009-06-06 22:04:26 ----D---- C:\WINDOWS\msapps
2009-06-06 22:04:26 ----D---- C:\WINDOWS\msagent
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Media
2009-06-06 22:04:26 ----D---- C:\WINDOWS\java
2009-06-06 22:04:26 ----D---- C:\WINDOWS\ime
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Help
2009-06-06 22:04:26 ----D---- C:\WINDOWS\ehome
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Driver Cache
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Debug
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Cursors
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Connection Wizard
2009-06-06 22:04:26 ----D---- C:\WINDOWS\Config
2009-06-06 22:04:26 ----D---- C:\WINDOWS\AppPatch
2009-06-06 22:04:26 ----D---- C:\WINDOWS\addins
2009-06-06 22:04:26 ----D---- C:\WINDOWS
2009-06-06 21:40:10 ----D---- C:\WINDOWS\system32\xircom
2009-06-06 21:40:10 ----D---- C:\Program Files\xerox
2009-06-06 21:40:10 ----D---- C:\Program Files\microsoft frontpage
2009-06-06 21:39:54 ----HD---- C:\WINDOWS\$hf_mig$
2009-06-06 21:39:53 ----A---- C:\WINDOWS\system32\xpsp3res.dll
2009-06-06 21:39:38 ----A---- C:\WINDOWS\control.ini
2009-06-06 21:39:38 ----A---- C:\AUTOEXEC.BAT
2009-06-06 21:39:16 ----A---- C:\WINDOWS\system32\mapi32.dll
2009-06-06 21:38:08 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-06-06 21:38:08 ----RD---- C:\WINDOWS\Offline Web Pages
2009-06-06 21:38:08 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-06-06 21:38:01 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-06-06 21:37:55 ----HD---- C:\Program Files\WindowsUpdate
2009-06-06 21:37:30 ----D---- C:\WINDOWS\system32\DirectX
2009-06-06 21:37:00 ----A---- C:\WINDOWS\system32\atrace.dll
2009-06-06 21:36:56 ----A---- C:\WINDOWS\system32\desktop.ini
2009-06-06 21:36:56 ----A---- C:\WINDOWS\desktop.ini
2009-06-06 21:36:46 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2009-06-06 21:36:45 ----A---- C:\WINDOWS\system32\acctres.dll
2009-06-06 21:36:44 ----D---- C:\Program Files\Common Files\Services
2009-06-06 21:36:41 ----SD---- C:\WINDOWS\Tasks
2009-06-06 21:36:41 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2009-06-06 21:36:39 ----D---- C:\Program Files\Common Files\MSSoap
2009-06-06 21:36:33 ----D---- C:\WINDOWS\srchasst
2009-06-06 21:36:31 ----D---- C:\WINDOWS\system32\Macromed
2009-06-06 21:36:27 ----A---- C:\WINDOWS\system32\wuweb.dll
2009-06-06 21:36:27 ----A---- C:\WINDOWS\system32\wucltui.dll
2009-06-06 21:36:27 ----A---- C:\WINDOWS\system32\wuauserv.dll
2009-06-06 21:36:27 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2009-06-06 21:36:26 ----A---- C:\WINDOWS\system32\wups.dll
2009-06-06 21:36:26 ----A---- C:\WINDOWS\system32\wuaueng.dll
2009-06-06 21:36:26 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2009-06-06 21:36:26 ----A---- C:\WINDOWS\system32\wuauclt.exe
2009-06-06 21:36:26 ----A---- C:\WINDOWS\system32\wuapi.dll
2009-06-06 21:36:25 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2009-06-06 21:36:25 ----A---- C:\WINDOWS\system32\qmgr.dll
2009-06-06 21:36:25 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2009-06-06 21:36:25 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2009-06-06 21:36:19 ----D---- C:\Program Files\Movie Maker
2009-06-06 21:36:13 ----A---- C:\WINDOWS\system32\safrslv.dll
2009-06-06 21:36:13 ----A---- C:\WINDOWS\system32\safrdm.dll
2009-06-06 21:36:13 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2009-06-06 21:36:13 ----A---- C:\WINDOWS\system32\racpldlg.dll
2009-06-06 21:36:07 ----A---- C:\WINDOWS\system32\fltmc.exe
2009-06-06 21:36:07 ----A---- C:\WINDOWS\system32\fltlib.dll
2009-06-06 21:36:06 ----D---- C:\WINDOWS\system32\Restore
2009-06-06 21:36:06 ----A---- C:\WINDOWS\system32\srsvc.dll
2009-06-06 21:36:06 ----A---- C:\WINDOWS\system32\srrstr.dll
2009-06-06 21:36:06 ----A---- C:\WINDOWS\system32\srclient.dll
2009-06-06 21:36:05 ----A---- C:\WINDOWS\system32\mnmdd.dll
2009-06-06 21:36:05 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2009-06-06 21:36:05 ----A---- C:\WINDOWS\system32\ils.dll
2009-06-06 21:36:04 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2009-06-06 21:36:04 ----A---- C:\WINDOWS\system32\msconf.dll
2009-06-06 21:36:04 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2009-06-06 21:36:00 ----D---- C:\Program Files\NetMeeting
2009-06-06 21:36:00 ----A---- C:\WINDOWS\system32\msoert2.dll
2009-06-06 21:35:59 ----A---- C:\WINDOWS\system32\msoeacct.dll
2009-06-06 21:35:58 ----A---- C:\WINDOWS\system32\inetres.dll
2009-06-06 21:35:57 ----A---- C:\WINDOWS\system32\inetcomm.dll
2009-06-06 21:35:54 ----D---- C:\Program Files\Outlook Express
2009-06-06 21:35:54 ----A---- C:\WINDOWS\system32\schedsvc.dll
2009-06-06 21:35:54 ----A---- C:\WINDOWS\system32\mstinit.exe
2009-06-06 21:35:54 ----A---- C:\WINDOWS\system32\mstask.dll
2009-06-06 21:35:53 ----A---- C:\WINDOWS\system32\isign32.dll
2009-06-06 21:35:53 ----A---- C:\WINDOWS\system32\inetcfg.dll
2009-06-06 21:35:53 ----A---- C:\WINDOWS\system32\icwphbk.dll
2009-06-06 21:35:53 ----A---- C:\WINDOWS\system32\icwdial.dll
2009-06-06 21:35:44 ----D---- C:\Program Files\Common Files\System
2009-06-06 21:35:40 ----D---- C:\Program Files\Internet Explorer
2009-06-06 21:35:00 ----D---- C:\Program Files\ComPlus Applications
2009-06-06 21:34:57 ----A---- C:\WINDOWS\vbaddin.ini
2009-06-06 21:34:57 ----A---- C:\WINDOWS\vb.ini
2009-06-06 21:34:51 ----D---- C:\WINDOWS\Registration
2009-06-06 21:34:42 ----D---- C:\Program Files\Windows Media Player
2009-06-06 21:34:42 ----D---- C:\Program Files\Online Services
2009-06-06 21:34:33 ----D---- C:\Program Files\Messenger
2009-06-06 21:34:27 ----D---- C:\Program Files\MSN Gaming Zone
2009-06-06 21:34:27 ----A---- C:\WINDOWS\system32\write.exe
2009-06-06 21:34:15 ----A---- C:\WINDOWS\system32\sndvol32.exe
2009-06-06 21:34:15 ----A---- C:\WINDOWS\system32\hticons.dll
2009-06-06 21:34:14 ----A---- C:\WINDOWS\system32\winchat.exe
2009-06-06 21:34:14 ----A---- C:\WINDOWS\system32\avwav.dll
2009-06-06 21:34:14 ----A---- C:\WINDOWS\system32\avtapi.dll
2009-06-06 21:34:14 ----A---- C:\WINDOWS\system32\avmeter.dll
2009-06-06 21:34:04 ----A---- C:\WINDOWS\system32\getuname.dll
2009-06-06 21:34:04 ----A---- C:\WINDOWS\system32\charmap.exe
2009-06-06 21:34:03 ----A---- C:\WINDOWS\system32\sol.exe
2009-06-06 21:34:03 ----A---- C:\WINDOWS\system32\calc.exe
2009-06-06 21:34:02 ----A---- C:\WINDOWS\system32\winmine.exe
2009-06-06 21:34:02 ----A---- C:\WINDOWS\system32\reset.exe
2009-06-06 21:34:02 ----A---- C:\WINDOWS\system32\mshearts.exe
2009-06-06 21:34:02 ----A---- C:\WINDOWS\system32\freecell.exe
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\tslabels.ini
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\tskill.exe
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\tscon.exe
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\shadow.exe
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\rwinsta.exe
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\regini.exe
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2009-06-06 21:34:01 ----A---- C:\WINDOWS\system32\qwinsta.exe
2009-06-06 21:34:00 ----A---- C:\WINDOWS\system32\qappsrv.exe
2009-06-06 21:34:00 ----A---- C:\WINDOWS\system32\msg.exe
2009-06-06 21:34:00 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2009-06-06 21:34:00 ----A---- C:\WINDOWS\system32\logoff.exe
2009-06-06 21:34:00 ----A---- C:\WINDOWS\system32\cdmodem.dll
2009-06-06 21:33:59 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2009-06-06 21:33:59 ----A---- C:\WINDOWS\system32\mtxex.dll
2009-06-06 21:33:59 ----A---- C:\WINDOWS\system32\mtxdm.dll
2009-06-06 21:33:59 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2009-06-06 21:33:58 ----A---- C:\WINDOWS\system32\stclient.dll
2009-06-06 21:33:58 ----A---- C:\WINDOWS\system32\comsnap.dll
2009-06-06 21:33:58 ----A---- C:\WINDOWS\system32\comrepl.dll
2009-06-06 21:33:58 ----A---- C:\WINDOWS\system32\comaddin.dll
2009-06-06 21:33:51 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2009-06-06 21:33:29 ----D---- C:\Program Files\MSN
2009-06-06 21:33:27 ----A---- C:\WINDOWS\system32\sndrec32.exe
2009-06-06 21:33:27 ----A---- C:\WINDOWS\system32\mplay32.exe
2009-06-06 21:33:27 ----A---- C:\WINDOWS\system32\accwiz.exe
2009-06-06 21:33:26 ----D---- C:\Program Files\Windows NT
2009-06-06 21:33:26 ----A---- C:\WINDOWS\system32\hypertrm.dll
2009-06-06 21:33:25 ----A---- C:\WINDOWS\system32\spider.exe
2009-06-06 21:33:25 ----A---- C:\WINDOWS\system32\mspaint.exe
2009-06-06 21:33:25 ----A---- C:\WINDOWS\system32\clipbrd.exe
2009-06-06 21:33:24 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2009-06-06 21:33:23 ----A---- C:\WINDOWS\system32\remotepg.dll
2009-06-06 21:33:23 ----A---- C:\WINDOWS\system32\rdshost.exe
2009-06-06 21:33:23 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2009-06-06 21:33:23 ----A---- C:\WINDOWS\system32\mstscax.dll
2009-06-06 21:33:23 ----A---- C:\WINDOWS\system32\mstsc.exe
2009-06-06 21:33:22 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2009-06-06 21:33:22 ----A---- C:\WINDOWS\system32\termsrv.dll
2009-06-06 21:33:22 ----A---- C:\WINDOWS\system32\sessmgr.exe
2009-06-06 21:33:22 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2009-06-06 21:33:22 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2009-06-06 21:33:22 ----A---- C:\WINDOWS\system32\rdchost.dll
2009-06-06 21:33:21 ----D---- C:\WINDOWS\system32\MsDtc
2009-06-06 21:33:21 ----A---- C:\WINDOWS\system32\rdpclip.exe
2009-06-06 21:33:21 ----A---- C:\WINDOWS\system32\qprocess.exe
2009-06-06 21:33:21 ----A---- C:\WINDOWS\system32\mtxoci.dll
2009-06-06 21:33:21 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2009-06-06 21:33:21 ----A---- C:\WINDOWS\system32\icaapi.dll
2009-06-06 21:33:21 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2009-06-06 21:33:20 ----A---- C:\WINDOWS\system32\msdtctm.dll
2009-06-06 21:33:20 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2009-06-06 21:33:19 ----A---- C:\WINDOWS\system32\xolehlp.dll
2009-06-06 21:33:19 ----A---- C:\WINDOWS\system32\msdtclog.dll
2009-06-06 21:33:19 ----A---- C:\WINDOWS\system32\msdtc.exe
2009-06-06 21:33:18 ----D---- C:\WINDOWS\system32\Com
2009-06-06 21:33:18 ----A---- C:\WINDOWS\system32\colbact.dll
2009-06-06 21:33:18 ----A---- C:\WINDOWS\system32\clbcatex.dll
2009-06-06 21:33:18 ----A---- C:\WINDOWS\system32\catsrvps.dll
2009-06-06 21:33:17 ----A---- C:\WINDOWS\system32\catsrvut.dll
2009-06-06 21:33:17 ----A---- C:\WINDOWS\system32\catsrv.dll
2009-06-06 21:33:16 ----A---- C:\WINDOWS\system32\comuid.dll
2009-06-06 21:33:16 ----A---- C:\WINDOWS\system32\comsvcs.dll
2009-06-06 21:33:15 ----A---- C:\WINDOWS\system32\clbcatq.dll
2009-06-06 21:33:06 ----A---- C:\WINDOWS\system32\servdeps.dll
2009-06-06 21:33:06 ----A---- C:\WINDOWS\system32\mmfutil.dll
2009-06-06 21:33:06 ----A---- C:\WINDOWS\system32\licwmi.dll
2009-06-06 21:33:06 ----A---- C:\WINDOWS\system32\cmprops.dll

======List of files/folders modified in the last 1 months======

2009-06-11 13:23:03 ----A---- C:\WINDOWS\win.ini
2009-06-06 22:26:12 ----A---- C:\WINDOWS\system.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 meiudf;meiudf; C:\WINDOWS\System32\Drivers\meiudf.sys [2005-06-02 102384]
R1 mfehidk;McAfee Inc. mfehidk; C:\WINDOWS\system32\drivers\mfehidk.sys [2009-03-25 214024]
R1 MPFP;MPFP; C:\WINDOWS\System32\Drivers\Mpfp.sys [2008-10-23 120136]
R2 tdudf;TOSHIBA UDF File System Driver; C:\WINDOWS\system32\DRIVERS\tdudf.sys [2006-06-28 98816]
R3 AgereSoftModem;TOSHIBA V92 Software Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2006-03-18 1155584]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-12-11 1414656]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-06-28 4304384]
R3 mfeavfk;McAfee Inc. mfeavfk; C:\WINDOWS\system32\drivers\mfeavfk.sys [2009-03-25 79880]
R3 mfebopk;McAfee Inc. mfebopk; C:\WINDOWS\system32\drivers\mfebopk.sys [2009-03-25 35272]
R3 mfesmfk;McAfee Inc. mfesmfk; C:\WINDOWS\system32\drivers\mfesmfk.sys [2009-03-25 40552]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2006-02-27 81408]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver; C:\WINDOWS\system32\DRIVERS\tdcmdpst.sys [2006-03-02 15360]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 mferkdk;McAfee Inc. mferkdk; C:\WINDOWS\system32\drivers\mferkdk.sys [2009-03-25 34216]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-05-29 144712]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-12-11 393216]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 DVD-RAM_Service;DVD-RAM_Service; C:\WINDOWS\system32\DVDRAMSV.exe [2004-08-28 110592]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-06-07 152984]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; C:\Program Files\McAfee\SiteAdvisor\McSACore.exe [2009-01-23 203280]
R2 mcmscsvc;McAfee Services; C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [2009-03-25 797864]
R2 McNASvc;McAfee Network Agent; c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe [2009-01-09 2482848]
R2 McProxy;McAfee Proxy Service; c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [2009-01-09 359952]
R2 McShield;McAfee Real-time Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [2009-03-25 144704]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2003-06-19 322120]
R2 MpfService;McAfee Personal Firewall Service; C:\Program Files\McAfee\MPF\MPFSrv.exe [2009-03-19 884360]
R2 TODDSrv;TOSHIBA Optical Disc Drive Service; C:\WINDOWS\system32\TODDSrv.exe [2006-05-25 114688]
R2 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-05-30 541992]
R3 McSysmon;McAfee SystemGuards; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [2009-03-24 606736]
S3 getPlus(R) Helper;getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2009-06-04 66048]
S3 McODS;McAfee Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [2009-04-01 365072]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

-----------------EOF-----------------
peevee
Regular Member
 
Posts: 28
Joined: May 29th, 2009, 8:30 am

Re: Hyjacked Browsers & Blocked From Runnig Certain exe Files

Unread postby peku006 » June 20th, 2009, 2:02 pm

Hi peevee

1 - Download and Run ComboFix
We will continue with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper


http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
If you need help to disable your protection programs see here.

When finished, it will produce a log for you
Please include the C:\ComboFix.txt in your next reply for further review.

2 - Status Check
Please reply with


1. the ComboFix log(C:\ComboFix.txt)


Thanks peku006
User avatar
peku006
MRU Emeritus
MRU Emeritus
 
Posts: 3357
Joined: May 14th, 2007, 2:18 pm
Location: Norway

Re: Hyjacked Browsers & Blocked From Runnig Certain exe Files

Unread postby peevee » June 20th, 2009, 4:36 pm

Hi peku

Combo Log:

ComboFix 09-06-20.02 - phil 20/06/2009 21:22.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1918.1536 [GMT 1:00]
Running from: c:\documents and settings\phil\Desktop\peeveecomb.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\MSIVXuhoghncsqdsnbvofnaymhrmbyljxwdvd.sys
c:\windows\system32\MSIVXcount
c:\windows\system32\MSIVXjyfednlqrqomnpbstebvmeciltkagrlm.dll
c:\windows\system32\MSIVXnuvaixlttknpboewrynumnitqmgjoeyb.dll
E:\desktop.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_MSIVXserv.sys


((((((((((((((((((((((((( Files Created from 2009-05-20 to 2009-06-20 )))))))))))))))))))))))))))))))
.

2009-06-20 16:52 . 2009-06-20 16:52 -------- d-----w- c:\documents and settings\phil\Application Data\Malwarebytes
2009-06-20 16:29 . 2009-06-20 16:29 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-06-20 12:03 . 2009-06-20 12:03 -------- d-----w- C:\rsit
2009-06-20 11:53 . 2009-06-17 10:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-20 11:53 . 2009-06-20 16:04 -------- d-----w- c:\program files\Malware
2009-06-20 11:53 . 2009-06-20 11:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-20 11:53 . 2009-06-17 10:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-18 17:31 . 2009-06-19 20:32 -------- d-----w- c:\documents and settings\Kasia\Local Settings\Application Data\Adobe
2009-06-18 17:28 . 1998-06-12 19:01 81184 ----a-w- c:\windows\system32\GAPI.DLL
2009-06-18 17:28 . 2009-06-18 17:40 -------- d-----w- C:\SUBARUEX2
2009-06-18 17:28 . 1999-04-23 21:22 430080 ----a-w- c:\windows\system32\MSREPL35.DLL
2009-06-18 17:28 . 1999-04-23 21:22 1056768 ----a-w- c:\windows\system32\MSJET35.DLL
2009-06-18 17:28 . 1998-06-17 23:00 89360 ----a-w- c:\windows\system32\VB5DB.DLL
2009-06-18 17:28 . 1998-04-23 23:00 252176 ----a-w- c:\windows\system32\MSRD2X35.DLL
2009-06-18 17:28 . 1998-04-23 23:00 24848 ----a-w- c:\windows\system32\MSJTER35.DLL
2009-06-18 17:28 . 1998-04-23 23:00 123664 ----a-w- c:\windows\system32\MSJINT35.DLL
2009-06-18 17:27 . 2009-06-18 17:27 -------- d-----w- C:\SUBARUEX
2009-06-18 13:04 . 2009-06-18 13:04 -------- d-----w- c:\program files\CC-leaner
2009-06-16 12:32 . 2009-06-20 17:38 -------- d-----w- c:\program files\Trend Micro
2009-06-16 12:24 . 2009-06-16 12:25 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-16 12:23 . 2009-06-16 12:23 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-06-16 12:23 . 2009-06-18 12:55 -------- d-----w- c:\documents and settings\phil\Local Settings\Application Data\Adobe
2009-06-16 12:23 . 2009-06-16 12:23 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2009-06-16 12:22 . 2009-06-16 12:35 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-06-16 12:22 . 2009-06-16 12:22 -------- d-----w- c:\program files\NOS
2009-06-16 12:22 . 2009-06-04 09:53 31944 ----a-w- c:\documents and settings\phil\Application Data\Mozilla\Firefox\Profiles\lui9ho22.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2009-06-16 12:22 . 2009-06-04 09:53 22848 ----a-w- c:\documents and settings\phil\Application Data\Mozilla\Firefox\Profiles\lui9ho22.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg_bootstrap.exe
2009-06-16 12:22 . 2009-06-04 09:53 18776 ----a-w- c:\documents and settings\phil\Application Data\Mozilla\Firefox\Profiles\lui9ho22.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2009-06-13 22:09 . 2009-06-13 22:09 -------- d-----w- c:\documents and settings\NetworkService\Application Data\DivX
2009-06-13 18:59 . 2009-06-13 18:59 -------- d-----w- c:\program files\AC3Filter
2009-06-13 18:53 . 2009-06-13 18:53 -------- d-----w- c:\program files\GPL MPEG Decoder
2009-06-13 13:49 . 2009-06-13 13:55 -------- d-----w- c:\documents and settings\phil\Application Data\DivX
2009-06-12 23:44 . 2009-06-12 23:56 -------- d-----w- c:\documents and settings\Kasia\Application Data\DivX
2009-06-12 23:41 . 2009-06-12 23:41 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-06-12 23:41 . 2009-06-12 23:42 -------- d-----w- c:\program files\DivX
2009-06-12 12:52 . 2009-06-12 12:52 6516755 ----a-w- c:\documents and settings\Kasia\Application Data\Azureus\plugins\vuzexcode\ffmpeg.exe
2009-06-12 12:52 . 2009-06-12 12:52 4141117 ----a-w- c:\documents and settings\Kasia\Application Data\Azureus\plugins\vuzexcode\mediainfo.exe
2009-06-12 12:49 . 2009-06-12 12:49 15884 ----a-w- c:\documents and settings\Kasia\Application Data\Azureus\plugins\azitunes\libProcessAccess.dll
2009-06-12 12:49 . 2009-06-12 12:49 102400 ----a-w- c:\documents and settings\Kasia\Application Data\Azureus\plugins\azitunes\jacob-1.14.3-x86.dll
2009-06-12 12:46 . 2009-06-15 12:33 -------- d-----w- c:\documents and settings\Kasia\Application Data\Azureus
2009-06-12 12:40 . 2009-06-12 12:40 20328 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-12 12:40 . 2009-06-12 12:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Azureus
2009-06-12 12:40 . 2009-06-12 12:46 -------- d-----w- c:\documents and settings\Administrator\Application Data\Azureus
2009-06-11 12:24 . 2008-04-14 00:12 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-06-11 12:22 . 2009-06-11 12:22 -------- d-----w- c:\program files\Windows Media Connect 2
2009-06-11 12:18 . 2009-06-11 12:19 -------- d-----w- c:\windows\system32\drivers\UMDF
2009-06-11 12:18 . 2009-06-11 12:18 -------- d-----w- c:\windows\system32\LogFiles
2009-06-10 20:43 . 2009-06-10 20:43 -------- d-----w- c:\program files\Common Files\Hypnotizer
2009-06-10 20:27 . 2009-06-10 20:27 -------- d-----w- c:\documents and settings\Administrator\Application Data\Media Player Classic
2009-06-10 12:28 . 2003-11-18 17:14 61440 ----a-w- c:\windows\scrub2k.exe
2009-06-10 12:28 . 2009-06-10 12:28 -------- d-----w- c:\program files\Hewlett-Packard
2009-06-10 12:27 . 2008-04-13 18:47 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-06-10 12:27 . 2008-04-13 18:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-06-10 08:14 . 2009-06-10 08:14 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-06-09 21:45 . 2009-06-09 21:45 20328 ----a-w- c:\documents and settings\Kasia\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-09 12:40 . 2009-06-09 12:45 664 ----a-w- c:\documents and settings\Kasia\Local Settings\Application Data\d3d9caps.dat
2009-06-09 12:35 . 2009-06-12 23:40 -------- d-----w- c:\documents and settings\Kasia\Application Data\Apple Computer
2009-06-08 17:13 . 2009-06-08 17:13 -------- d-----w- c:\windows\system32\CatRoot_bak
2009-06-08 17:05 . 2009-06-08 17:05 -------- d-----w- c:\windows\system32\scripting
2009-06-08 17:05 . 2009-06-08 17:05 -------- d-----w- c:\windows\system32\en
2009-06-08 17:05 . 2009-06-08 17:05 -------- d-----w- c:\windows\l2schemas
2009-06-08 17:05 . 2009-06-08 17:05 -------- d-----w- c:\windows\system32\bits
2009-06-08 17:02 . 2009-06-08 17:05 -------- d-----w- c:\windows\ServicePackFiles
2009-06-08 16:45 . 2008-10-16 13:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-06-08 13:06 . 2004-08-03 21:29 73216 ------w- c:\windows\system32\drivers\atintuxx.sys
2009-06-08 07:04 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2009-06-08 07:04 . 2008-05-01 14:33 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2009-06-08 07:03 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll
2009-06-08 07:03 . 2008-04-21 12:08 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2009-06-08 07:03 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-06-08 07:03 . 2008-12-11 10:57 333952 -c----w- c:\windows\system32\dllcache\srv.sys
2009-06-08 07:02 . 2008-04-11 19:04 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2009-06-08 07:02 . 2008-10-15 16:34 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2009-06-07 19:53 . 2009-06-07 19:53 -------- d-----w- c:\documents and settings\Kasia\Local Settings\Application Data\Identities
2009-06-07 18:31 . 2009-06-07 18:31 -------- d-----w- c:\documents and settings\Kasia\Local Settings\Application Data\Google
2009-06-07 18:31 . 2009-01-19 04:48 43008 ----a-w- c:\documents and settings\Kasia\Application Data\Mozilla\Firefox\Profiles\puamwk1i.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll
2009-06-07 18:31 . 2009-01-19 04:48 43008 ----a-w- c:\documents and settings\Kasia\Application Data\Mozilla\Firefox\Profiles\puamwk1i.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-06-07 18:31 . 2009-01-19 04:48 245248 ----a-w- c:\documents and settings\Kasia\Application Data\Mozilla\Firefox\Profiles\puamwk1i.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\metrics-ff2.dll
2009-06-07 18:31 . 2009-01-19 04:48 239616 ----a-w- c:\documents and settings\Kasia\Application Data\Mozilla\Firefox\Profiles\puamwk1i.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-06-07 18:31 . 2009-01-19 04:48 233984 ----a-w- c:\documents and settings\Kasia\Application Data\Mozilla\Firefox\Profiles\puamwk1i.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-06-07 18:31 . 2009-01-19 04:48 243200 ----a-w- c:\documents and settings\Kasia\Application Data\Mozilla\Firefox\Profiles\puamwk1i.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\metrics-ff3.dll
2009-06-07 18:29 . 2009-06-07 18:29 -------- d-----w- c:\documents and settings\Kasia\Local Settings\Application Data\Mozilla
2009-06-07 18:27 . 2009-06-07 18:27 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Google
2009-06-07 18:27 . 2009-01-19 04:48 43008 ----a-w- c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\u9rjn57j.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll
2009-06-07 18:27 . 2009-01-19 04:48 43008 ----a-w- c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\u9rjn57j.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-06-07 18:27 . 2009-01-19 04:48 245248 ----a-w- c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\u9rjn57j.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\metrics-ff2.dll
2009-06-07 18:27 . 2009-01-19 04:48 243200 ----a-w- c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\u9rjn57j.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\metrics-ff3.dll
2009-06-07 18:27 . 2009-01-19 04:48 239616 ----a-w- c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\u9rjn57j.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-06-07 18:27 . 2009-01-19 04:48 233984 ----a-w- c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\u9rjn57j.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-06-07 18:24 . 2009-06-07 18:24 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-06-07 15:54 . 2009-06-14 12:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-07 15:12 . 2009-06-07 15:12 -------- d-----w- c:\program files\AskSearch
2009-06-07 15:05 . 2009-06-18 14:12 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-07 15:05 . 2009-06-18 14:10 -------- d-----w- c:\program files\SpywareBlaster
2009-06-07 15:02 . 2009-06-07 15:02 -------- d-----w- c:\program files\CCleaner
2009-06-07 14:59 . 2009-06-13 18:49 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2009-06-07 11:30 . 2009-06-07 11:30 -------- d-----w- c:\documents and settings\All Users\Application Data\SiteAdvisor
2009-06-07 11:27 . 2009-03-25 10:06 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-06-07 11:27 . 2009-03-25 10:06 79880 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-06-07 11:27 . 2009-03-25 10:06 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-06-07 11:27 . 2008-10-23 12:08 120136 ----a-w- c:\windows\system32\drivers\Mpfp.sys
2009-06-07 11:26 . 2009-06-07 11:27 -------- d-----w- c:\program files\Common Files\McAfee
2009-06-07 11:26 . 2009-06-07 11:27 -------- d-----w- c:\program files\McAfee.com
2009-06-07 11:26 . 2009-06-08 12:47 -------- d-----w- c:\program files\McAfee
2009-06-07 11:23 . 2009-03-25 10:05 34216 ----a-w- c:\windows\system32\drivers\mferkdk.sys
2009-06-07 11:21 . 2008-04-14 00:12 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-06-07 11:13 . 2009-06-07 11:13 -------- d-----w- c:\windows\Sun
2009-06-07 11:12 . 2009-06-07 11:12 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-07 11:12 . 2009-06-07 11:12 -------- d-----w- c:\program files\Java
2009-06-07 11:12 . 2009-06-07 11:12 152576 ----a-w- c:\documents and settings\phil\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-06-07 11:05 . 2009-06-13 19:20 20328 ----a-w- c:\documents and settings\phil\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-07 09:06 . 2009-06-07 09:06 -------- d-s---w- c:\documents and settings\Kasia\UserData
2009-06-07 09:00 . 2009-06-09 12:35 -------- d-----w- c:\documents and settings\Kasia\Local Settings\Application Data\Apple Computer
2009-06-07 01:32 . 2009-06-07 11:45 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-06-07 01:11 . 2009-06-07 01:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-06-07 01:10 . 2009-06-07 01:12 -------- d-----w- c:\documents and settings\phil\Local Settings\Application Data\Apple Computer
2009-06-07 00:54 . 2009-06-07 00:54 -------- d-----w- c:\documents and settings\phil\Local Settings\Application Data\Identities
2009-06-06 23:56 . 2009-06-06 23:56 -------- d-----w- c:\program files\Microsoft ActiveSync
2009-06-06 23:55 . 2009-06-06 23:56 -------- d-----w- c:\windows\ShellNew
2009-06-06 23:55 . 2009-06-06 23:55 -------- d-----w- c:\program files\Common Files\L&H
2009-06-06 23:48 . 2009-06-06 23:48 -------- d-----w- c:\documents and settings\phil\Local Settings\Application Data\Google
2009-06-06 23:48 . 2009-01-19 04:48 43008 ----a-w- c:\documents and settings\phil\Application Data\Mozilla\Firefox\Profiles\lui9ho22.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll
2009-06-06 23:48 . 2009-01-19 04:48 43008 ----a-w- c:\documents and settings\phil\Application Data\Mozilla\Firefox\Profiles\lui9ho22.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-06-06 23:48 . 2009-01-19 04:48 239616 ----a-w- c:\documents and settings\phil\Application Data\Mozilla\Firefox\Profiles\lui9ho22.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-06-06 23:48 . 2009-01-19 04:48 233984 ----a-w- c:\documents and settings\phil\Application Data\Mozilla\Firefox\Profiles\lui9ho22.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-08 17:08 . 2009-06-06 20:38 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-07 01:12 . 2009-06-07 01:12 -------- d-----w- c:\documents and settings\phil\Application Data\Apple Computer
2009-06-07 01:12 . 2009-06-07 01:12 -------- d-----w- c:\program files\iTunes
2009-06-07 01:12 . 2009-06-07 01:12 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-06-07 01:12 . 2009-06-07 01:12 -------- d-----w- c:\program files\iPod
2009-06-07 01:12 . 2009-06-07 01:11 -------- d-----w- c:\program files\Common Files\Apple
2009-06-07 01:12 . 2009-06-07 01:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-06-07 01:12 . 2009-06-07 01:12 -------- d-----w- c:\program files\Bonjour
2009-06-07 01:11 . 2009-06-07 01:11 -------- d-----w- c:\program files\QuickTime
2009-06-07 01:11 . 2009-06-07 01:11 -------- d-----w- c:\program files\Apple Software Update
2009-06-06 20:40 . 2009-06-06 20:40 -------- d-----w- c:\program files\microsoft frontpage
2009-06-06 20:35 . 2009-06-06 20:35 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-05-30 11:50 . 2009-05-30 11:50 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-05-07 15:32 . 2006-02-28 12:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-01 21:03 . 2009-06-12 23:42 9464 ------w- c:\windows\system32\drivers\cdralw2k.sys
2009-05-01 21:03 . 2009-06-12 23:42 9336 ------w- c:\windows\system32\drivers\cdr4_xp.sys
2009-05-01 21:03 . 2009-06-12 23:42 43528 ------w- c:\windows\system32\drivers\PxHelp20.sys
2009-05-01 21:03 . 2009-06-12 23:42 129784 ------w- c:\windows\system32\pxafs.dll
2009-05-01 21:03 . 2009-06-12 23:42 120056 ------w- c:\windows\system32\pxcpyi64.exe
2009-05-01 21:03 . 2009-06-12 23:42 118520 ------w- c:\windows\system32\pxinsi64.exe
2009-05-01 21:02 . 2009-05-01 21:02 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx07.dll
2009-05-01 21:02 . 2009-05-01 21:02 815104 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-05-01 21:02 . 2009-05-01 21:02 811008 ----a-w- c:\windows\system32\divx_xx16.dll
2009-05-01 21:02 . 2009-05-01 21:02 802816 ----a-w- c:\windows\system32\divx_xx11.dll
2009-05-01 21:02 . 2009-05-01 21:02 685056 ----a-w- c:\windows\system32\DivX.dll
2009-04-29 04:56 . 2006-02-28 12:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2006-02-28 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-17 12:26 . 2006-02-28 12:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2006-02-28 12:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-03-25 10:06 . 2009-03-25 10:06 214024 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-12-11 344064]
"DDWMon"="c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe" [2006-04-28 262144]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-05-30 292136]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-07 148888]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-03-25 645328]
"HPWH myPrintMileage Agent"="c:\program files\Hewlett-Packard\hp business inkjet 1100 series\Toolbox\mpm.exe" [2003-11-19 102400]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-06-28 16248320]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\agrsmmsg.exe [2006-03-18 89541]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2009-6-7 155648]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [07/06/2009 12:29 203280]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [28/06/2006 11:50 98816]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [16/06/2009 13:22 66048]
.
Contents of the 'Scheduled Tasks' folder

2009-06-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-06-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-06-07 09:53]

2009-06-07 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-06-07 09:53]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.ask.com/?o=101756&l=dir
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-20 21:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(516)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-06-20 21:28
ComboFix-quarantined-files.txt 2009-06-20 20:28

Pre-Run: 50,135,601,152 bytes free
Post-Run: 50,177,073,152 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

269 --- E O F --- 2009-06-12 02:01
peevee
Regular Member
 
Posts: 28
Joined: May 29th, 2009, 8:30 am

Re: Hyjacked Browsers & Blocked From Runnig Certain exe Files

Unread postby peku006 » June 21st, 2009, 1:46 am

Hi peevee

1 - Clean temp files

    Download and Run ATF Cleaner
    Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.Double-click ATF Cleaner.exe to open it.

    Under Main choose:
      Windows Temp
      Current User Temp
      All Users Temp
      Temporary Internet Files
      Prefetch
      Java Cache

      *The other boxes are optional*
      Then click the Empty Selected button.
    if you use Firefox:
      Click Firefox at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
    if you use Opera:
      Click Opera at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    Click Exit on the Main menu to close the program

2 - Kaspersky Online Scan

Please go to Kaspersky website and perform an online antivirus scan.

  1. Read through the requirements and privacy statement and click on Accept button.
  2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  3. When the downloads have finished, click on Settings.
  4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  5. Click on My Computer under Scan.
  6. Once the scan is complete, it will display the results. Click on View Scan Report.
  7. You will see a list of infected items there. Click on Save Report As....
  8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  9. Please post this log in your next reply.

3 - Run Hijackthis
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad

4 - Status Check
Please reply with

1. the Kaspersky online scanner report
2. a fresh HijackThis log
How's the computer running now? Any problems?

Thanks peku006
User avatar
peku006
MRU Emeritus
MRU Emeritus
 
Posts: 3357
Joined: May 14th, 2007, 2:18 pm
Location: Norway

Re: Hyjacked Browsers & Blocked From Runnig Certain exe Files

Unread postby peevee » June 21st, 2009, 10:18 am

Hi Peku

All tasks that you requested have been completed, logs are below

The browsers are now back under my control thanks.

Everything appears to be ok, but I havn't really done much with the pc apart from carry out your instuctions, but it's looking good thanks.

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Sunday, June 21, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Sunday, June 21, 2009 12:27:58
Records in database: 2373744
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 61275
Threat name: 2
Infected objects: 2
Suspicious objects: 0
Duration of the scan: 01:21:59


File name / Threat name / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_MSIVXuhoghncsqdsnbvofnaymhrmbyljxwdvd_.sys.zip Infected: Trojan.Win32.Tdss.ahpu 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\MSIVXnuvaixlttknpboewrynumnitqmgjoeyb.dll.vir Infected: Trojan.Win32.Agent.clxm 1

The selected area was scanned.





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:11:34, on 21/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\phil\Local Settings\temp\jkos-phil\binaries\ScanningProcess.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=101756&l=dir
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [HPWH myPrintMileage Agent] C:\Program Files\Hewlett-Packard\hp business inkjet 1100 series\Toolbox\mpm.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Kasia')
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1003\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (User 'Kasia')
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1003\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User 'Kasia')
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1003\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'Kasia')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 4465004859
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe

--
End of file - 7756 bytes

Phil
peevee
Regular Member
 
Posts: 28
Joined: May 29th, 2009, 8:30 am

Re: Hyjacked Browsers & Blocked From Runnig Certain exe Files

Unread postby peku006 » June 21st, 2009, 10:44 am

Hi Phil

good that everything works normally again :D

1 - Ask toolbar

I would remove this toolbar. You can read more about it HERE.

  • Click Start
  • Go to Control Panel
  • Go to Add/Remove Programs
  • Find and click Remove for the following (if present):

    ASk toolbar

NOTE: Take care when answering any questions posed by an uninstaller. Some questions may be worded to deceive you into keeping the program.

2 - Remove bad HijackThis entries
  • Run HijackThis
  • Click on the Scan button
  • Put a check beside all of the items listed below (if present):

      R3 - URLSearchHook: (no name) - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file)
  • Close all open windows and browsers/email, etc...
  • Click on the "Fix Checked" button
  • When completed, close the application.

Please reply with

a fresh HijackThis log

Thanks peku006
User avatar
peku006
MRU Emeritus
MRU Emeritus
 
Posts: 3357
Joined: May 14th, 2007, 2:18 pm
Location: Norway

Re: Hyjacked Browsers & Blocked From Runnig Certain exe Files

Unread postby peevee » June 22nd, 2009, 3:05 pm

Hi Peku,

I cannot un install the Ask toolbar as it does not appear in the "Add / Remove Programs"

I never wanted ASK in the first place, It just seemed to appear & I had tried to find a way of removing it prior to me posting here, but to no avail.

Is there another way of getting rid of it??

I have removed the bad Hijack this entry & here is the log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:57:31, on 22/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [HPWH myPrintMileage Agent] C:\Program Files\Hewlett-Packard\hp business inkjet 1100 series\Toolbox\mpm.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Kasia')
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1003\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (User 'Kasia')
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1003\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User 'Kasia')
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1003\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'Kasia')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 4465004859
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe

--
End of file - 7644 bytes


Phil :)
peevee
Regular Member
 
Posts: 28
Joined: May 29th, 2009, 8:30 am

Re: Hyjacked Browsers & Blocked From Runnig Certain exe Files

Unread postby peku006 » June 22nd, 2009, 3:43 pm

Hi Phil

  • Click Start
  • Go to Control Panel
  • Go to Add/Remove Programs
  • Find and click Remove for the following (if present):

    AskSearch

Remove bad HijackThis entries
  • Run HijackThis
  • Click on the Scan button
  • Put a check beside all of the items listed below (if present):

  • Close all open windows and browsers/email, etc...
  • Click on the "Fix Checked" button
  • When completed, close the application.

Please delete the following folder
C:\Program Files\AskSearch

Please reply with

a fresh HijackThis log

Thanks peku006
User avatar
peku006
MRU Emeritus
MRU Emeritus
 
Posts: 3357
Joined: May 14th, 2007, 2:18 pm
Location: Norway

Re: Hyjacked Browsers & Blocked From Runnig Certain exe Files

Unread postby peevee » June 22nd, 2009, 4:08 pm

Hi Peku,

All done, although I notice that I still have an ASK Search Toolbar on the Admin account Firefox browser.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:07:55, on 22/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\WINDOWS\system32\svchost.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hewlett-Packard\hp business inkjet 1100 series\Toolbox\mpm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Java\jre6\bin\jucheck.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [HPWH myPrintMileage Agent] C:\Program Files\Hewlett-Packard\hp business inkjet 1100 series\Toolbox\mpm.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Kasia')
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1003\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (User 'Kasia')
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1003\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User 'Kasia')
O4 - HKUS\S-1-5-21-1757981266-879983540-725345543-1003\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'Kasia')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-1757981266-879983540-725345543-1003 Startup: BBC iPlayer Desktop.lnk = C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe (User 'Kasia')
O4 - S-1-5-21-1757981266-879983540-725345543-1003 User Startup: BBC iPlayer Desktop.lnk = C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe (User 'Kasia')
O4 - Startup: BBC iPlayer Desktop.lnk = C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 4465004859
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe

--
End of file - 8362 bytes

Phil
peevee
Regular Member
 
Posts: 28
Joined: May 29th, 2009, 8:30 am

Re: Hyjacked Browsers & Blocked From Runnig Certain exe Files

Unread postby peevee » June 25th, 2009, 4:54 pm

Hi Peku,

Have you forgotten me?

Havn't heard from you for 3 days

Phil
peevee
Regular Member
 
Posts: 28
Joined: May 29th, 2009, 8:30 am

Re: Hyjacked Browsers & Blocked From Runnig Certain exe Files

Unread postby Carolyn » June 26th, 2009, 4:42 pm

Hi Phil

I am sure Peku would not have forgotten you. Let me see what I can find out. I will get back to you ASAP. :)
User avatar
Carolyn
MRU Emeritus
MRU Emeritus
 
Posts: 4701
Joined: April 18th, 2007, 9:36 am
Location: Maine
Advertisement
Register to Remove

Next

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 286 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware