# got a trojan and want to start over - format my hardrive!



## kona

How can I do this....please help!


----------



## voyagerfan99

1:Is it a pre-built or custom built?
2:If it's a pre-built, is there a recovery partition?
3:If there is no recovery partition, do you have a Windows disc to reinstall Windows with?


----------



## kona

custom built

I don't know about another partition

I havems works suite - is that part of windos disc?



voyagerfan99 said:


> 1:Is it a pre-built or custom built?
> 2:If it's a pre-built, is there a recovery partition?
> 3:If there is no recovery partition, do you have a Windows disc to reinstall Windows with?


----------



## tremmor

Why not wait for JohnB to reply and fix it.
He will find it. On the other hand it should have been
posted in the computer security section. just wait.
Save your self some trouble. Will likely get fixed by him.


----------



## voyagerfan99

kona said:


> I havems works suite - is that part of windos disc?



No. Works is just productivity software.

Like Trem said, let's see if John can help you remove that trojan first. However, let's get you started on the right track. Head over and have a look at this thread:
http://www.computerforum.com/131398-important-please-read-before-posting.html


----------



## kona

I found some more stuff - discs that came with the pc that the builder gave me.

1) drivers & utilities
2)restore image made aug 22 / 07
 there might be more I'll look


----------



## kona

I went over and took a look at the link here - wow.....

I have a very good antivirus program (shawsecure) and I spoke at length with a tech there regarding my problem.  The shaw secure antivirus antimalware was not able to remove my Trogen virus.  Their advise was to take my pc into a tech and give it over to them.  I may do that but you folks have helped me HUGE in the past so I thought I'd give it a try here.

I have most of my stuff backed up before I got infected with the Trogen.  Fortunately for me my backup on my external HD was NOT plugged in for the past two days so I'm not worried about loosing stuff on my pc - I can FORMAT away - I just need to know how to clean this pc up and put everything back no it once that is done.

The Torgen names that came up when the ShawSecure scan finished were:
Trogen.Patched.HE
Trogen.Generic.6131647

AND it looks like the filename is fsdfwd.exe


If that helps



voyagerfan99 said:


> No. Works is just productivity software.
> 
> Like Trem said, let's see if John can help you remove that trojan first. However, let's get you started on the right track. Head over and have a look at this thread:
> http://www.computerforum.com/131398-important-please-read-before-posting.html


----------



## voyagerfan99

I'd still give MalwareBytes a try and see if that can't get it for you. If not, John can suggest something else.

Antivirus programs are very poor at actually removing virus' once you've become infected. Trying to disinfect your machine will be a lot easier than formatting the hard drive and reinstalling Windows.


----------



## kona

Thanks,
So - I may go to that link now.

Is there anything you can suggest as I do this...........is it pretty straight forward?   I know a little bit about computers - enough to get myself in trouble probably.  I'll wait for your reply before I go to the malwear site



voyagerfan99 said:


> I'd still give MalwareBytes a try and see if that can't get it for you. If not, John can suggest something else.
> 
> Antivirus programs are very poor at actually removing virus' once you've become infected. Trying to disinfect your machine will be a lot easier than formatting the hard drive and reinstalling Windows.



I got impatiant and I'm using the suggested antivirus antimalware link above - it's in operation now


----------



## voyagerfan99

kona said:


> I got impatiant and I'm using the suggested antivirus antimalware link above - it's in operation now



I told you to run MalwareBytes anyway


----------



## kona

I ran one on the link - and now it's asking me for $105

I think I will go back and find that malwarebytes - right?

can't find the one it says to click on in the link..........
This one is there:
rcpsetup_dcnew_300_new

Is it the right one to put on my desktop and run?


----------



## tremmor

never mind. thats the buy too i think. 
i will look.


----------



## johnb35

Follow the instructions here.

Please download *Malwarebytes' Anti-Malware *from *here* or *here* and save it to your desktop.

Double-click *mbam-setup.exe* and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to
*Update Malwarebytes' Anti-Malware*
and *Launch Malwarebytes' Anti-Malware*
 
then click *Finish*.
If an update is found, it will download and install the latest version.  *Please keep updating until it says you have the latest version.*
Once the program has loaded, select *Perform quick scan*, then click *Scan*.
When the scan is complete, click *OK*, then *Show Results* to view the results.
Be sure that everything is checked, and click *Remove Selected*.
A log will be saved automatically which you can access by clicking on the *Logs* tab within Malwarebytes' Anti-Malware

If for some reason Malwarebytes will not install or run please download and run *Rkill.scr*,  *Rkill.exe*, or *Rkill.com*.  If you are still having issues running rkill then try downloading these renamed versions of the same program.

*EXPLORER.EXE*
*IEXPLORE.EXE*
*USERINIT.EXE*
*WINLOGON.EXE*

But *DO NOT *reboot the system and then try installing or running Malwarebytes.  If Rkill (which is a black box) appears and then disappears right away or you get a message saying rkill is infected, keep trying to run rkill until it over powers the infection and temporarily kills it.  Once a log appears on the screen, you can try running malwarebytes or downloading other programs.



Download the *HijackThis* installer from *here*.  
Run the installer and choose *Install*, indicating that you accept the licence agreement.  The installer will place a shortcut on your desktop and launch HijackThis.

Click *Do a system scan and save a logfile*

_Most of what HijackThis lists will be harmless or even essential, don't fix anything yet._

When the hijackthis log appears in a notepad file, click on the edit menu, click select all, then click on the edit menu again and click on copy.  Come back to your reply and right click on your mouse and click on paste.

Post the logfile that HijackThis produces along with the Malwarebytes Anti-Malware log


----------



## kona

I clicked on malwarebytes and saved it to my desktop and then when I clicked on it to run it Regclean Pro is there.  Is that the one I want on my PC?





johnb35 said:


> Follow the instructions here.
> 
> Please download *Malwarebytes' Anti-Malware *from *here* or *here* and save it to your desktop.
> 
> Double-click *mbam-setup.exe* and follow the prompts to install the program.
> At the end, be sure a checkmark is placed next to
> *Update Malwarebytes' Anti-Malware*
> and *Launch Malwarebytes' Anti-Malware*
> 
> then click *Finish*.
> If an update is found, it will download and install the latest version.  *Please keep updating until it says you have the latest version.*
> Once the program has loaded, select *Perform quick scan*, then click *Scan*.
> When the scan is complete, click *OK*, then *Show Results* to view the results.
> Be sure that everything is checked, and click *Remove Selected*.
> A log will be saved automatically which you can access by clicking on the *Logs* tab within Malwarebytes' Anti-Malware
> 
> If for some reason Malwarebytes will not install or run please download and run *Rkill.scr*,  *Rkill.exe*, or *Rkill.com*.  If you are still having issues running rkill then try downloading these renamed versions of the same program.
> 
> *EXPLORER.EXE*
> *IEXPLORE.EXE*
> *USERINIT.EXE*
> *WINLOGON.EXE*
> 
> But *DO NOT *reboot the system and then try installing or running Malwarebytes.  If Rkill (which is a black box) appears and then disappears right away or you get a message saying rkill is infected, keep trying to run rkill until it over powers the infection and temporarily kills it.  Once a log appears on the screen, you can try running malwarebytes or downloading other programs.
> 
> 
> 
> Download the *HijackThis* installer from *here*.
> Run the installer and choose *Install*, indicating that you accept the licence agreement.  The installer will place a shortcut on your desktop and launch HijackThis.
> 
> Click *Do a system scan and save a logfile*
> 
> _Most of what HijackThis lists will be harmless or even essential, don't fix anything yet._
> 
> When the hijackthis log appears in a notepad file, click on the edit menu, click select all, then click on the edit menu again and click on copy.  Come back to your reply and right click on your mouse and click on paste.
> 
> Post the logfile that HijackThis produces along with the Malwarebytes Anti-Malware log


----------



## johnb35

No it is not, you clicked on the wrong one.  If you went to the cnet download link, click on the big green box where it says download now on the left side of the screen, it also has the cnet logo inside the box.  do not click on the box on the right hand side of the screen.


----------



## kona

Okay - I removed the ones I installed by mistake.
Now I clicked on the one you suggested below.  It's hanging there with a message my program will begin shortly.  I noticed I had a picture blocker activated on my pc (box at top) I clicked it to allow download - it's running now.  I went through the prompts as you suggested.



johnb35 said:


> No it is not, you clicked on the wrong one.  If you went to the cnet download link, click on the big green box where it says download now on the left side of the screen, it also has the cnet logo inside the box.  do not click on the box on the right hand side of the screen.


----------



## johnb35

Just make sure you click on remove selected after its done scanning and you copy and paste the log that it provides back here along with a hijackthis log.


----------



## kona

I had a bit of a time getting past a few minutes useing the malware software  - my antivirus program kept kicking in and freezing the malware program.  I turned my ShawSecure software off - to allow certain internet access now it seems to be running okay.

just to get clear here - you want me to select and copy and paste the log (to my desktop) and attach it and post it here after the malware finishes?  And, the hijackthis log is there also?

Please be patient with me I'm really new at this....but like I said in the past...you guys helped me before and I gladly gave a donation when that trauma was over.  :good:

13 minutes into the latest scan attempt and already we're at 8 infected.



johnb35 said:


> Just make sure you click on remove selected after its done scanning and you copy and paste the log that it provides back here along with a hijackthis log.



here's the log - text file attached

I selected all the infected files that Malware found and then selected "clean' and rebooted my computer like the message there said.  
After about a minute my ShawSecure antivirus found the virus still on my PC and is attempting to remove it right now.

*It's the same Trojan virus   Trogan.Patched.HE  file name wuauclt.exe*

I booted my PC this morning and I got one of those white pages with the triangle with the Active Desktop Recovery message 

Is there something more I can do?  Should I run a scan with Malwarebytes again??


----------



## voyagerfan99

You should have selected "Remove Selected", not clean. I just looked at the log and you didn't remove anything. Rescan with MalwreBytes and at the end, click "Remove Selected".

Run HijackThis (Instructions from John on another page) and copy the log into this thread.


----------



## kona

I turned my PC antivirus off and ran Malwarebytes again - it's running right now.  So far no infected files found but Malware has "successfully blocked outgoing to potential harmful websites."  
Is that the Trogan working on my PC - the Trogan.Patched.He virus??

This is the log from today's Malwarebytes scan.  There were NO viruses - infected files - found.  Does this mean the problem is solved - or is it that the Trogan has dug in and hasn't been located on my PC yet?

After the scan (and while the scan was running) I got a message that Malwarebytes has blocked access to a potentially malicious website.  One website did appear however - saying I can win a cell phone - I xed out of that one.......

I will be leaving for work in an hour or so and I will check this Foum website from my work pc from time to time if I get a chance - other than that I will be back here after 17:30 hours Pacific Standard Time.

Cheers,
Gary

I rebooted the pc a few minutes ago and got this message from my ANtivirus program - ShawSecure - Shaw is my internet provider:

Malicous code found in Windows\system32\wuauclt.exe
Infection: trogan.Patched.HE

There were other 'boxed' messages after I clicked out of that one.  They were similar..........trogan.Generic.6131647.....was one of them.   Sorry, didn't get the third one - it was a numbered trogan virus like the Generic on above.


----------



## voyagerfan99

Okay, let's just wait for John to reply again.


----------



## kona

Thanks - yes - my pc crashed - froze up as I was posting the last - 06:49 - message there.  I will be on my way to work in a few minutes so I will attempt to shut my pc down.  I haven't been able to do that the last few times I tried......it just got hung up and I had to hold the power (turn on button) down until the PC quit running.  It was the only way it would shut down.


----------



## johnb35

Ok, do the following in order.  Follow directions precisely.

1.  

Please download and run TDSSkiller

When the program opens, click on the start scan button.

TDSSKiller will now scan your computer for the TDSS infection. When the scan has finished it will display a result screen stating whether or not the infection was found on your computer. If it was found it will display a screen similar to the one below.






To remove the infection simply click on the Continue button and TDSSKiller will attempt to clean the infection.

When it has finished cleaning the infection you will see a report stating whether or not it was successful as shown below.






If the log says will be cured after reboot, please reboot the system by pressing the reboot now button.

After running there will be a log that will be located at the root of your c:\ drive labeled tdsskiller with a series of numbers after it.  Please open the log and copy and paste it back here.

2.

*Download and Run ComboFix*
*If you already have Combofix, please delete this copy and download it again as it's being updated regularly.*

*Download this file* here :

*Combofix*


When the page loads click on the blue combofix download link next to the BleepingComputer Mirror.
Save the file to your windows desktop.  The combofix icon will look like this when it has downloaded to your desktop.




We are almost ready to start ComboFix, but before we do so, we need to take some preventative measures so that there are no conflicts with other programs when running ComboFix. At this point you should do the following:


Close all open Windows including this one. 

Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix. Instructions on disabling these type of programs can be found *here*.
Once these two steps have been completed, double-click on the ComboFix icon found on your desktop. Please note, that once you start ComboFix you should not click anywhere on the ComboFix window as it can cause the program to stall. In fact, when ComboFix is running, do not touch your computer at all. The scan could take a while, so please be patient.

Please click on I agree on the disclaimer window.
ComboFix will now install itself on to your computer. When it is done, a blue screen will appear as shown below.





ComboFix is now preparing to run. When it has finished ComboFix will automatically attempt to create a System Restore point so that if any problems occur while using the program you can restore back to your previous configuration. When ComboFix has finished creating the restore point, it will then backup your Windows Registry as shown in the image below.





Once the Windows Registry has finished being backed up, ComboFix will attempt to detect if you have the Windows Recovery Console installed. If you already have it installed, you can skip to this section and continue reading. Otherwise you will see the following message as shown below:





At the above message box, please click on the Yes button in order for ComboFix to continue. Please follow the steps and instructions given by ComboFix in order to finish the installation of the Recovery Console.

Please click on yes in the next window to continue scanning for malware.

ComboFix will now disconnect your computer from the Internet, so do not be surprised or concerned if you receive any warnings stating that you are no longer on the Internet. When ComboFix has finished it will automatically restore your Internet connection.

ComboFix will now start scanning your computer for known infections. This procedure can take some time, so please be patient.

While the program is scanning your computer, it will change your clock format, so do not be concerned when you see this happen. When ComboFix is finished it will restore your clock settings to their previous settings. You will also see the text in the ComboFix window being updated as it goes through the various stages of its scan. An example of this can be seen below.





When ComboFix has finished running, you will see a screen stating that it is preparing the log report.

This can take a while, so please be patient. If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt.

When ComboFix has finished, it will automatically close the program and change your clock back to its original format. It will then display the log file automatically for you.  

Now you just click on the edit menu and click on select all, then click on the edit menu again and click on copy.  Then come to the forum in your reply and right click on your mouse and click on paste.  



In your next reply please post:

The ComboFix log
A fresh HiJackThis log
An update on how your computer is running


----------



## kona

John - I'm at work right now -  on my work pc - and I will follow your instructions......wheeew....lots haha.....when I get home.  I printed them off here (5pgs) and I'm looking forward to the task.

I will for sure get back here with the results.   You're pretty awesome to do this service man.  It is very much appreciated.  A great Forum - thanks all.

I'm reading through the instruction above and I'm still not clear on what a HiJackThis log is.....??

I'm at work right now and accessing from my work pc


----------



## johnb35

Hijackthis, a bit outdated though, tells us what is running on your system, lets me know if you are running outdated software as far as java, adobe reader or anything else that might pose a security issue to your pc.  Its safe and won't harm your system.


----------



## turbodiesel

get a program like avast antivirus and do a full system scan then a boot scan


----------



## voyagerfan99

ryan.white said:


> get a program like avast antivirus and do a full system scan then a boot scan



Please do not interject. Running Avast will not help. John knows how to help him out.


----------



## kona

Just thinking about this - still at my work desk, not at  home right now.  Do I run the suggested programs above while in SAFE MODE or can I just log onto Windows normally?


----------



## johnb35

If it allows you to do it, do it in normal boot mode,  If not, then do it in safe mode.


----------



## kona

John - I ran the TDSSkiller and got this log:

17:10:22.0625 3356	TDSS rootkit removing tool 2.6.16.0 Nov  7 2011 16:26:51
17:10:23.0187 3356	============================================================
17:10:23.0187 3356	Current date / time: 2011/11/07 17:10:23.0187
17:10:23.0187 3356	SystemInfo:
17:10:23.0187 3356	
17:10:23.0187 3356	OS Version: 5.1.2600 ServicePack: 3.0
17:10:23.0187 3356	Product type: Workstation
17:10:23.0187 3356	ComputerName: NEW
17:10:23.0187 3356	UserName: MSI
17:10:23.0187 3356	Windows directory: C:\WINDOWS
17:10:23.0187 3356	System windows directory: C:\WINDOWS
17:10:23.0187 3356	Processor architecture: Intel x86
17:10:23.0187 3356	Number of processors: 2
17:10:23.0187 3356	Page size: 0x1000
17:10:23.0187 3356	Boot type: Normal boot
17:10:23.0187 3356	============================================================
17:10:23.0750 3356	Initialize success
17:10:32.0562 2896	============================================================
17:10:32.0562 2896	Scan started
17:10:32.0562 2896	Mode: Manual; 
17:10:32.0562 2896	============================================================
17:10:33.0562 2896	Abiosdsk - ok
17:10:33.0578 2896	abp480n5 - ok
17:10:33.0625 2896	ACPI            (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
17:10:33.0625 2896	ACPI - ok
17:10:33.0656 2896	ACPIEC          (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
17:10:33.0656 2896	ACPIEC - ok
17:10:33.0671 2896	adpu160m - ok
17:10:33.0734 2896	aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
17:10:33.0734 2896	aec - ok
17:10:33.0765 2896	AFD             (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
17:10:33.0765 2896	AFD - ok
17:10:33.0812 2896	AFS2K           (0ebb674888cbdefd5773341c16dd6a07) C:\WINDOWS\system32\drivers\AFS2K.sys
17:10:33.0812 2896	AFS2K - ok
17:10:33.0859 2896	Aha154x - ok
17:10:33.0906 2896	aic78u2 - ok
17:10:33.0937 2896	aic78xx - ok
17:10:33.0953 2896	AliIde - ok
17:10:34.0000 2896	AmdK8           (59301936898ae62245a6f09c0aba9475) C:\WINDOWS\system32\DRIVERS\AmdK8.sys
17:10:34.0000 2896	AmdK8 - ok
17:10:34.0015 2896	amsint - ok
17:10:34.0062 2896	Arp1394         (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
17:10:34.0062 2896	Arp1394 - ok
17:10:34.0093 2896	asc - ok
17:10:34.0093 2896	asc3350p - ok
17:10:34.0109 2896	asc3550 - ok
17:10:34.0171 2896	AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
17:10:34.0171 2896	AsyncMac - ok
17:10:34.0203 2896	atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
17:10:34.0203 2896	atapi - ok
17:10:34.0203 2896	Atdisk - ok
17:10:34.0250 2896	Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
17:10:34.0250 2896	Atmarpc - ok
17:10:34.0296 2896	audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
17:10:34.0296 2896	audstub - ok
17:10:34.0359 2896	Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
17:10:34.0359 2896	Beep - ok
17:10:34.0406 2896	cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
17:10:34.0406 2896	cbidf2k - ok
17:10:34.0421 2896	CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
17:10:34.0437 2896	CCDECODE - ok
17:10:34.0437 2896	cd20xrnt - ok
17:10:34.0468 2896	Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
17:10:34.0468 2896	Cdaudio - ok
17:10:34.0484 2896	Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
17:10:34.0484 2896	Cdfs - ok
17:10:34.0515 2896	Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
17:10:34.0515 2896	Cdrom - ok
17:10:34.0515 2896	Changer - ok
17:10:34.0546 2896	CmdIde - ok
17:10:34.0593 2896	Cpqarray - ok
17:10:34.0671 2896	cpuz134 - ok
17:10:34.0734 2896	CX23880         (fce8506d1c61f05319e85c70638abd21) C:\WINDOWS\system32\drivers\cx88vid.sys
17:10:34.0734 2896	CX23880 - ok
17:10:34.0750 2896	CXAVXBAR        (e80185c7ac234c9b045513de2cbeff4c) C:\WINDOWS\system32\drivers\cxavxbar.sys
17:10:34.0750 2896	CXAVXBAR - ok
17:10:34.0796 2896	CXTUNE          (b5e3d476efaf08a2cd2cf77835018123) C:\WINDOWS\system32\drivers\CX88TUNE.sys
17:10:34.0796 2896	CXTUNE - ok
17:10:34.0812 2896	dac2w2k - ok
17:10:34.0828 2896	dac960nt - ok
17:10:34.0937 2896	Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
17:10:34.0937 2896	Disk - ok
17:10:35.0000 2896	dmboot          (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
17:10:35.0046 2896	dmboot - ok
17:10:35.0093 2896	dmio            (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
17:10:35.0093 2896	dmio - ok
17:10:35.0125 2896	dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
17:10:35.0125 2896	dmload - ok
17:10:35.0156 2896	DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
17:10:35.0156 2896	DMusic - ok
17:10:35.0171 2896	dpti2o - ok
17:10:35.0187 2896	drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
17:10:35.0187 2896	drmkaud - ok
17:10:35.0234 2896	ENTECH          (bdd170fecb0e496a914318009d85b819) C:\WINDOWS\system32\DRIVERS\ENTECH.sys
17:10:35.0234 2896	ENTECH - ok
17:10:35.0343 2896	F-Secure Gatekeeper (29d12e1e45d93b45d2598e2663bbeff4) C:\Program Files\Shaw Secure\Anti-Virus\minifilter\fsgk.sys
17:10:35.0343 2896	F-Secure Gatekeeper - ok
17:10:35.0390 2896	F-Secure HIPS   (f5aca65237c7511d5803cdc5e7003d75) C:\Program Files\Shaw Secure\HIPS\drivers\fshs.sys
17:10:35.0390 2896	F-Secure HIPS - ok
17:10:35.0453 2896	Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
17:10:35.0453 2896	Fastfat - ok
17:10:35.0484 2896	Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
17:10:35.0484 2896	Fdc - ok
17:10:35.0500 2896	Fips            (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
17:10:35.0500 2896	Fips - ok
17:10:35.0531 2896	Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
17:10:35.0531 2896	Flpydisk - ok
17:10:35.0578 2896	FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
17:10:35.0578 2896	FltMgr - ok
17:10:35.0609 2896	fsbts           (343786e182b9c9ae3066e00dec650f50) C:\WINDOWS\system32\Drivers\fsbts.sys
17:10:35.0609 2896	fsbts - ok
17:10:35.0656 2896	FSFW            (aca3910a53a057b8c3a6ebf4ef788c7c) C:\WINDOWS\system32\drivers\fsdfw.sys
17:10:35.0656 2896	FSFW - ok
17:10:35.0843 2896	fssfltr         (c6ee3a87fe609d3e1db9dbd072a248de) C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys
17:10:35.0859 2896	fssfltr - ok
17:10:35.0906 2896	Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
17:10:35.0906 2896	Fs_Rec - ok
17:10:35.0937 2896	Ftdisk          (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
17:10:35.0937 2896	Ftdisk - ok
17:10:35.0984 2896	GEARAspiWDM     (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
17:10:35.0984 2896	GEARAspiWDM - ok
17:10:35.0984 2896	GMSIPCI - ok
17:10:36.0031 2896	Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
17:10:36.0031 2896	Gpc - ok
17:10:36.0062 2896	HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
17:10:36.0062 2896	HDAudBus - ok
17:10:36.0093 2896	HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
17:10:36.0093 2896	HidUsb - ok
17:10:36.0109 2896	hpn - ok
17:10:36.0171 2896	HPZid412        (287a63bd8509bd78e7978823b38afa81) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
17:10:36.0171 2896	HPZid412 - ok
17:10:36.0203 2896	HPZipr12        (0b4fda2657c3e0315eaa57f9c6d4fd1f) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
17:10:36.0218 2896	HPZipr12 - ok
17:10:36.0265 2896	HPZius12        (29559db25258b60510a60c4e470fce32) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
17:10:36.0265 2896	HPZius12 - ok
17:10:36.0359 2896	HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
17:10:36.0359 2896	HTTP - ok
17:10:36.0375 2896	HwIOctl - ok
17:10:36.0390 2896	i2omgmt - ok
17:10:36.0406 2896	i2omp - ok
17:10:36.0437 2896	i8042prt        (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
17:10:36.0437 2896	i8042prt - ok
17:10:36.0500 2896	Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
17:10:36.0500 2896	Imapi - ok
17:10:36.0562 2896	InCDfs          (b87fc7c71632240dac8f4d20e9ce8377) C:\WINDOWS\system32\drivers\InCDfs.sys
17:10:36.0562 2896	InCDfs - ok
17:10:36.0578 2896	InCDPass        (2e878405128ec98886eb9c2216ac7bd6) C:\WINDOWS\system32\DRIVERS\InCDPass.sys
17:10:36.0578 2896	InCDPass - ok
17:10:36.0593 2896	InCDrec         (ddf078917a42f105385d7eb6debb3433) C:\WINDOWS\system32\drivers\InCDrec.sys
17:10:36.0593 2896	InCDrec - ok
17:10:36.0640 2896	incdrm          (7f352360e947ad2cd4ba60de27b1a299) C:\WINDOWS\system32\drivers\incdrm.sys
17:10:36.0640 2896	incdrm - ok
17:10:36.0656 2896	ini910u - ok
17:10:36.0781 2896	IntcAzAudAddService (60d7460b07012d364ced11dd9fd83e1f) C:\WINDOWS\system32\drivers\RtkHDAud.sys
17:10:36.0906 2896	IntcAzAudAddService - ok
17:10:36.0921 2896	IntelIde - ok
17:10:36.0953 2896	Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
17:10:36.0953 2896	Ip6Fw - ok
17:10:37.0000 2896	IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
17:10:37.0000 2896	IpFilterDriver - ok
17:10:37.0031 2896	IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
17:10:37.0031 2896	IpInIp - ok
17:10:37.0078 2896	IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
17:10:37.0078 2896	IpNat - ok
17:10:37.0093 2896	IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
17:10:37.0093 2896	IPSec - ok
17:10:37.0125 2896	irda            (aca5e7b54409f9cb5eed97ed0c81120e) C:\WINDOWS\system32\DRIVERS\irda.sys
17:10:37.0125 2896	irda - ok
17:10:37.0156 2896	IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
17:10:37.0156 2896	IRENUM - ok
17:10:37.0171 2896	irsir           (0501f0b9ab08425f8c0eacbdcc04aa32) C:\WINDOWS\system32\DRIVERS\irsir.sys
17:10:37.0171 2896	irsir - ok
17:10:37.0218 2896	isapnp          (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
17:10:37.0218 2896	isapnp - ok
17:10:37.0250 2896	itchfltr        (936123d83e80c1cb3ea042d7fb98da25) C:\WINDOWS\system32\DRIVERS\itchfltr.sys
17:10:37.0250 2896	itchfltr - ok
17:10:37.0296 2896	Kbdclass        (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
17:10:37.0296 2896	Kbdclass - ok
17:10:37.0390 2896	kbdhid          (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
17:10:37.0390 2896	kbdhid - ok
17:10:37.0468 2896	kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
17:10:37.0468 2896	kmixer - ok
17:10:37.0484 2896	KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
17:10:37.0500 2896	KSecDD - ok
17:10:37.0531 2896	L8042pr2        (733ececf4371ac99410ee0f00bfd51e7) C:\WINDOWS\system32\DRIVERS\L8042pr2.Sys
17:10:37.0531 2896	L8042pr2 - ok
17:10:37.0562 2896	lbrtfdc - ok
17:10:37.0609 2896	LMouFlt2        (128f0b4cd156872d440ae77202923a32) C:\WINDOWS\system32\DRIVERS\LMouFlt2.Sys
17:10:37.0609 2896	LMouFlt2 - ok
17:10:37.0656 2896	m5287           (73b4c8c9657f376274738d2b18c9308c) C:\WINDOWS\system32\DRIVERS\m5287.sys
17:10:37.0656 2896	m5287 - ok
17:10:37.0687 2896	MBAMProtector   (69a6268d7f81e53d568ab4e7e991caf3) C:\WINDOWS\system32\drivers\mbam.sys
17:10:37.0687 2896	MBAMProtector - ok
17:10:37.0687 2896	Memctl - ok
17:10:37.0734 2896	mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
17:10:37.0734 2896	mnmdd - ok
17:10:37.0796 2896	Modem           (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
17:10:37.0812 2896	Modem - ok
17:10:37.0859 2896	motccgp         (201bfc4ef8b33d02d133fbf6535e515b) C:\WINDOWS\system32\DRIVERS\motccgp.sys
17:10:37.0859 2896	motccgp - ok
17:10:37.0921 2896	motccgpfl       (d0242a3832eb7c97801bb25889561e23) C:\WINDOWS\system32\DRIVERS\motccgpfl.sys
17:10:37.0921 2896	motccgpfl - ok
17:10:37.0968 2896	motmodem        (fe80c18ba448ddd76b7bead9eb203d37) C:\WINDOWS\system32\DRIVERS\motmodem.sys
17:10:37.0968 2896	motmodem - ok
17:10:38.0015 2896	motport         (fe80c18ba448ddd76b7bead9eb203d37) C:\WINDOWS\system32\DRIVERS\motport.sys
17:10:38.0015 2896	motport - ok
17:10:38.0046 2896	Mouclass        (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
17:10:38.0046 2896	Mouclass - ok
17:10:38.0093 2896	mouhid          (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
17:10:38.0093 2896	mouhid - ok
17:10:38.0109 2896	MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
17:10:38.0109 2896	MountMgr - ok
17:10:38.0125 2896	mraid35x - ok
17:10:38.0156 2896	MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
17:10:38.0156 2896	MRxDAV - ok
17:10:38.0203 2896	MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
17:10:38.0203 2896	MRxSmb - ok
17:10:38.0265 2896	Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
17:10:38.0265 2896	Msfs - ok
17:10:38.0359 2896	MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
17:10:38.0359 2896	MSKSSRV - ok
17:10:38.0390 2896	MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
17:10:38.0390 2896	MSPCLOCK - ok
17:10:38.0421 2896	MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
17:10:38.0421 2896	MSPQM - ok
17:10:38.0468 2896	mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
17:10:38.0468 2896	mssmbios - ok
17:10:38.0500 2896	MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
17:10:38.0500 2896	MSTEE - ok
17:10:38.0546 2896	Mup             (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
17:10:38.0546 2896	Mup - ok
17:10:38.0578 2896	NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
17:10:38.0578 2896	NABTSFEC - ok
17:10:38.0609 2896	NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
17:10:38.0609 2896	NDIS - ok
17:10:38.0640 2896	NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
17:10:38.0656 2896	NdisIP - ok
17:10:38.0687 2896	NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
17:10:38.0687 2896	NdisTapi - ok
17:10:38.0718 2896	Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
17:10:38.0718 2896	Ndisuio - ok
17:10:38.0734 2896	NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
17:10:38.0734 2896	NdisWan - ok
17:10:38.0781 2896	NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
17:10:38.0781 2896	NDProxy - ok
17:10:38.0781 2896	NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
17:10:38.0781 2896	NetBIOS - ok
17:10:38.0812 2896	NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
17:10:38.0812 2896	NetBT - ok
17:10:38.0859 2896	NIC1394         (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
17:10:38.0859 2896	NIC1394 - ok
17:10:38.0875 2896	Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
17:10:38.0875 2896	Npfs - ok
17:10:38.0921 2896	Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
17:10:38.0921 2896	Ntfs - ok
17:10:38.0953 2896	Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
17:10:38.0953 2896	Null - ok
17:10:39.0078 2896	nv              (5645072033c2e51386e91bc137c0beb5) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
17:10:39.0187 2896	nv - ok
17:10:39.0218 2896	nvata           (4d6c6b46b3edf6f2e219a86b61d104ae) C:\WINDOWS\system32\DRIVERS\nvata.sys
17:10:39.0218 2896	nvata - ok
17:10:39.0250 2896	NVENETFD        (cc34564bca235ebad8b308d871efa2df) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
17:10:39.0250 2896	NVENETFD - ok
17:10:39.0296 2896	nvnetbus        (46fdb8d07dd4fc81093b0acb243a525d) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
17:10:39.0296 2896	nvnetbus - ok
17:10:39.0343 2896	nvraid          (78a7baf00d238b442a056f951a2ab434) C:\WINDOWS\system32\DRIVERS\nvraid.sys
17:10:39.0343 2896	nvraid - ok
17:10:39.0375 2896	NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
17:10:39.0375 2896	NwlnkFlt - ok
17:10:39.0406 2896	NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
17:10:39.0421 2896	NwlnkFwd - ok
17:10:39.0453 2896	ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
17:10:39.0453 2896	ohci1394 - ok
17:10:39.0484 2896	Parport         (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
17:10:39.0484 2896	Parport - ok
17:10:39.0515 2896	PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
17:10:39.0515 2896	PartMgr - ok
17:10:39.0546 2896	ParVdm          (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
17:10:39.0546 2896	ParVdm - ok
17:10:39.0562 2896	PCI             (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
17:10:39.0562 2896	PCI - ok
17:10:39.0578 2896	PCIDump - ok
17:10:39.0593 2896	PCIIde          (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
17:10:39.0593 2896	PCIIde - ok
17:10:39.0640 2896	Pcmcia          (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
17:10:39.0640 2896	Pcmcia - ok
17:10:39.0671 2896	PDCOMP - ok
17:10:39.0687 2896	PDFRAME - ok
17:10:39.0687 2896	PDRELI - ok
17:10:39.0703 2896	PDRFRAME - ok
17:10:39.0718 2896	perc2 - ok
17:10:39.0734 2896	perc2hib - ok
17:10:39.0796 2896	pfc             (444f122e68db44c0589227781f3c8b3f) C:\WINDOWS\system32\drivers\pfc.sys
17:10:39.0796 2896	pfc - ok
17:10:39.0828 2896	PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
17:10:39.0828 2896	PptpMiniport - ok
17:10:39.0843 2896	Processor       (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
17:10:39.0843 2896	Processor - ok
17:10:39.0859 2896	PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
17:10:39.0859 2896	PSched - ok
17:10:39.0890 2896	Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
17:10:39.0890 2896	Ptilink - ok
17:10:39.0921 2896	PxHelp20        (40fedd328f98245ad201cf5f9f311724) C:\WINDOWS\system32\Drivers\PxHelp20.sys
17:10:39.0921 2896	PxHelp20 - ok
17:10:39.0937 2896	ql1080 - ok
17:10:39.0953 2896	Ql10wnt - ok
17:10:40.0000 2896	ql12160 - ok
17:10:40.0000 2896	ql1240 - ok
17:10:40.0031 2896	ql1280 - ok
17:10:40.0078 2896	RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
17:10:40.0078 2896	RasAcd - ok
17:10:40.0109 2896	Rasirda         (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
17:10:40.0109 2896	Rasirda - ok
17:10:40.0125 2896	Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
17:10:40.0140 2896	Rasl2tp - ok
17:10:40.0156 2896	RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
17:10:40.0156 2896	RasPppoe - ok
17:10:40.0171 2896	Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
17:10:40.0171 2896	Raspti - ok
17:10:40.0203 2896	Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
17:10:40.0203 2896	Rdbss - ok
17:10:40.0203 2896	RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
17:10:40.0203 2896	RDPCDD - ok
17:10:40.0265 2896	RDPWD           (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
17:10:40.0265 2896	RDPWD - ok
17:10:40.0296 2896	redbook         (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
17:10:40.0296 2896	redbook - ok
17:10:40.0328 2896	sbp2port        (b244960e5a1db8e9d5d17086de37c1e4) C:\WINDOWS\system32\DRIVERS\sbp2port.sys
17:10:40.0328 2896	sbp2port - ok
17:10:40.0375 2896	Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
17:10:40.0375 2896	Secdrv - ok
17:10:40.0406 2896	serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
17:10:40.0406 2896	serenum - ok
17:10:40.0437 2896	Serial          (6e968c6d2cb1d5bc6d22a355e72d307a) C:\WINDOWS\system32\DRIVERS\serial.sys
17:10:40.0437 2896	Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\serial.sys. Real md5: 6e968c6d2cb1d5bc6d22a355e72d307a, Fake md5: cca207a8896d4c6a0c9ce29a4ae411a7
17:10:40.0453 2896	Serial ( Rootkit.Win32.ZAccess.aml ) - infected
17:10:40.0453 2896	Serial - detected Rootkit.Win32.ZAccess.aml (0)
17:10:40.0500 2896	Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
17:10:40.0500 2896	Sfloppy - ok
17:10:40.0515 2896	Simbad - ok
17:10:40.0562 2896	SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
17:10:40.0562 2896	SLIP - ok
17:10:40.0625 2896	SONYPVU1        (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
17:10:40.0625 2896	SONYPVU1 - ok
17:10:40.0656 2896	Sparrow - ok
17:10:40.0718 2896	splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
17:10:40.0718 2896	splitter - ok
17:10:40.0781 2896	sptd            (71e276f6d189413266ea22171806597b) C:\WINDOWS\system32\Drivers\sptd.sys
17:10:40.0781 2896	Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: 71e276f6d189413266ea22171806597b
17:10:40.0781 2896	sptd ( LockedFile.Multi.Generic ) - warning
17:10:40.0781 2896	sptd - detected LockedFile.Multi.Generic (1)
17:10:40.0796 2896	sr              (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
17:10:40.0796 2896	sr - ok
17:10:40.0843 2896	Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
17:10:40.0843 2896	Srv - ok
17:10:40.0906 2896	streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
17:10:40.0921 2896	streamip - ok
17:10:40.0953 2896	SunkFilt6 - ok
17:10:41.0000 2896	SunkFilt62      (38cc705ff41cc49daed796cfb419bea2) C:\WINDOWS\System32\Drivers\sunkfilt62.sys
17:10:41.0015 2896	SunkFilt62 - ok
17:10:41.0015 2896	Sunkfiltp - ok
17:10:41.0062 2896	swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
17:10:41.0062 2896	swenum - ok
17:10:41.0093 2896	swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
17:10:41.0093 2896	swmidi - ok
17:10:41.0109 2896	symc810 - ok
17:10:41.0125 2896	symc8xx - ok
17:10:41.0140 2896	sym_hi - ok
17:10:41.0171 2896	sym_u3 - ok
17:10:41.0187 2896	sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
17:10:41.0187 2896	sysaudio - ok
17:10:41.0250 2896	Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
17:10:41.0250 2896	Tcpip - ok
17:10:41.0281 2896	TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
17:10:41.0281 2896	TDPIPE - ok
17:10:41.0390 2896	TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
17:10:41.0390 2896	TDTCP - ok
17:10:41.0406 2896	TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
17:10:41.0406 2896	TermDD - ok
17:10:41.0437 2896	TosIde - ok
17:10:41.0484 2896	Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
17:10:41.0515 2896	Udfs - ok
17:10:41.0562 2896	ULCDRHlp        (a4e07da3ae2078bd96e84d4baa07b71d) C:\WINDOWS\system32\Drivers\ULCDRHlp.sys
17:10:41.0562 2896	ULCDRHlp - ok
17:10:41.0578 2896	ultra - ok
17:10:41.0640 2896	Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
17:10:41.0640 2896	Update - ok
17:10:41.0687 2896	usbaudio        (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
17:10:41.0687 2896	usbaudio - ok
17:10:41.0703 2896	usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
17:10:41.0703 2896	usbccgp - ok
17:10:41.0734 2896	usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
17:10:41.0734 2896	usbehci - ok
17:10:41.0750 2896	usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
17:10:41.0750 2896	usbhub - ok
17:10:41.0781 2896	usbohci         (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
17:10:41.0781 2896	usbohci - ok
17:10:41.0812 2896	usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
17:10:41.0812 2896	usbprint - ok
17:10:41.0843 2896	usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
17:10:41.0843 2896	usbscan - ok
17:10:41.0875 2896	USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
17:10:41.0875 2896	USBSTOR - ok
17:10:41.0890 2896	VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
17:10:41.0890 2896	VgaSave - ok
17:10:41.0906 2896	ViaIde - ok
17:10:41.0953 2896	VolSnap         (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
17:10:41.0968 2896	VolSnap - ok
17:10:42.0062 2896	VX3000          (88322300247273203665c3ffa892e425) C:\WINDOWS\system32\DRIVERS\VX3000.sys
17:10:42.0171 2896	VX3000 - ok
17:10:42.0203 2896	Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
17:10:42.0203 2896	Wanarp - ok
17:10:42.0250 2896	Wdf01000        (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
17:10:42.0265 2896	Wdf01000 - ok
17:10:42.0265 2896	WDICA - ok
17:10:42.0500 2896	wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
17:10:42.0500 2896	wdmaud - ok
17:10:42.0578 2896	WD_FireWire_HID (0aac22d28116e45b85e16021fd988a3a) C:\WINDOWS\system32\DRIVERS\wdfwhid.sys
17:10:42.0578 2896	WD_FireWire_HID - ok
17:10:42.0687 2896	WFIOCTL         (9bc98a4e3401d52ed860cf883ccb7478) C:\Program Files\WinFast\WFTVFM\WFIOCTL.SYS
17:10:42.0687 2896	WFIOCTL - ok
17:10:42.0765 2896	WS2IFSL         (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
17:10:42.0765 2896	WS2IFSL - ok
17:10:42.0843 2896	WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
17:10:42.0859 2896	WSTCODEC - ok
17:10:42.0906 2896	WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
17:10:42.0937 2896	WudfPf - ok
17:10:42.0968 2896	WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
17:10:42.0968 2896	WudfRd - ok
17:10:43.0046 2896	ZSMC303         (07f90a3574769a28ad3f45ccc61394ec) C:\WINDOWS\system32\Drivers\usbVM303.sys
17:10:43.0046 2896	ZSMC303 - ok
17:10:43.0093 2896	MBR (0x1B8)     (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
17:10:43.0140 2896	\Device\Harddisk0\DR0 - ok
17:10:43.0140 2896	MBR (0x1B8)     (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR1
17:10:43.0312 2896	\Device\Harddisk1\DR1 - ok
17:10:43.0343 2896	Boot (0x1200)   (3089a9ea28ed913949e1920446801dcc) \Device\Harddisk0\DR0\Partition0
17:10:43.0375 2896	\Device\Harddisk0\DR0\Partition0 - ok
17:10:43.0375 2896	Boot (0x1200)   (dbea40fd9e56ac5bbc6464d3551898d1) \Device\Harddisk1\DR1\Partition0
17:10:43.0375 2896	\Device\Harddisk1\DR1\Partition0 - ok
17:10:43.0375 2896	============================================================
17:10:43.0375 2896	Scan finished
17:10:43.0375 2896	============================================================
17:10:43.0390 0256	Detected object count: 2
17:10:43.0390 0256	Actual detected object count: 2
17:11:00.0468 0256	Backup copy found, using it..
17:11:00.0468 0256	C:\WINDOWS\system32\DRIVERS\serial.sys - will be cured on reboot
17:11:00.0468 0256	Serial ( Rootkit.Win32.ZAccess.aml ) - User select action: Cure 
17:11:00.0468 0256	sptd ( LockedFile.Multi.Generic ) - skipped by user
17:11:00.0468 0256	sptd ( LockedFile.Multi.Generic ) - User select action: Skip 
17:11:42.0375 3324	Deinitialize success


----------



## voyagerfan99

Also download and run Combofix as John said above and when it's finished post that log as well.


----------



## kona

I've downloaded Combofix saved it to my desktop and deactivated malware as per instruction.  I right clicked on my shaw secure antivirus and started the combofix scan. I got a message that a realtime scanner (shaw secure 9.0) was active.  I can't see how to deactivate it.......any suggestions before I continue?


----------



## kona

I clicked ok to continue and I got a very loud two beep warning telling me my antivirus scanner was still active and to continue at my own risk.....
Maybe I should just go into my add/remove programs and remove shaw secure altogether.  I don't like it - it's too big and it really did not protect my pc.  I will ask here if there is a better universally accepted software I should be using after I get through here.

Should I remove f-Secure antivirus software now?



voyagerfan99 said:


> If it's possible to completely exit and/or shutdown the AV, then do that. Otherwise just check that the realtime scanner is disabled and continue.


----------



## johnb35

You can remove it if you want to and then we can install something else afterwards.


----------



## kona

John the file is 8000 plus characters and the Foum will only allow 6000.  Should I save the txt file to an attachment and post it that way?


----------



## johnb35

Split the log into 2 separate posts. Just remember where you left off.


----------



## kona

FIRST HALF OF COMBOFIX LOG


ComboFix 11-11-07.03 - MSI 11/07/2011  18:05:39.1.2 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.3071.2676 [GMT -8:00]
Running from: c:\documents and settings\MSI\Desktop\ComboFix.exe
AV: Shaw Secure 9.01 *Enabled/Updated* {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
FW: Shaw Secure 9.01 *Enabled* {D4747503-0346-49EB-9262-997542F79BF4}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\MSI\Local Settings\Application Data\12eba47c\U
c:\documents and settings\MSI\Local Settings\Application Data\12eba47c\U\80000000.@
c:\documents and settings\MSI\Local Settings\Application Data\12eba47c\U\800000cf.@
c:\documents and settings\MSI\WINDOWS
C:\Thumbs.db
c:\windows\$NtUninstallKB18792$
c:\windows\$NtUninstallKB18792$\1871407118
c:\windows\$NtUninstallKB18792$\317432956\@
c:\windows\$NtUninstallKB18792$\317432956\L\xaxkqrup
c:\windows\$NtUninstallKB18792$\317432956\loader.tlb
c:\windows\$NtUninstallKB18792$\317432956\U\@00000001
c:\windows\$NtUninstallKB18792$\317432956\U\@000000c0
c:\windows\$NtUninstallKB18792$\317432956\U\@000000cb
c:\windows\$NtUninstallKB18792$\317432956\U\@000000cf
c:\windows\$NtUninstallKB18792$\317432956\U\@80000000
c:\windows\$NtUninstallKB18792$\317432956\U\@800000c0
c:\windows\$NtUninstallKB18792$\317432956\U\@800000cb
c:\windows\$NtUninstallKB18792$\317432956\U\@800000cf
c:\windows\assembly\GAC_MSIL\desktop.ini
c:\windows\Downloaded Program Files\popcaploader.dll
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\system32\ 
.
.
(((((((((((((((((((((((((   Files Created from 2011-10-08 to 2011-11-08  )))))))))))))))))))))))))))))))
.
.
2011-11-07 02:54 . 2011-09-01 01:00	22216	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-11-07 02:54 . 2011-11-07 03:09	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-11-07 02:14 . 2011-11-07 02:14	--------	d-----w-	c:\documents and settings\MSI\Application Data\BabylonToolbar
2011-11-07 02:13 . 2011-11-07 02:13	--------	d-----w-	c:\program files\Babylon
2011-11-07 02:12 . 2011-11-07 02:47	--------	d-----w-	c:\documents and settings\MSI\Application Data\Systweak
2011-11-07 02:12 . 2011-09-30 23:37	17280	----a-w-	c:\windows\system32\roboot.exe
2011-11-06 20:05 . 2011-11-06 20:05	--------	d-sh--w-	c:\windows\system32\config\systemprofile\PrivacIE
2011-11-06 20:05 . 2011-11-06 20:05	--------	d-sh--w-	c:\windows\system32\config\systemprofile\IETldCache
2011-11-06 18:48 . 2011-11-08 02:15	--------	d-sh--w-	c:\documents and settings\MSI\Local Settings\Application Data\12eba47c
2011-10-13 05:58 . 2011-10-13 05:58	--------	d-----w-	c:\program files\iPod
2011-10-13 05:58 . 2011-10-13 05:59	--------	d-----w-	c:\program files\iTunes
2011-10-13 05:55 . 2011-10-13 05:55	--------	d-----w-	c:\documents and settings\LocalService\Application Data\Apple Computer
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-08 01:13 . 2004-08-04 12:00	64512	----a-w-	c:\windows\system32\drivers\serial.sys
2011-10-13 14:06 . 2011-05-17 00:32	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-03 12:06 . 2010-05-08 17:33	472808	----a-w-	c:\windows\system32\deployJava1.dll
2011-10-03 09:37 . 2007-06-18 18:56	73728	----a-w-	c:\windows\system32\javacpl.cpl
2011-09-26 18:41 . 2007-10-09 21:03	611328	----a-w-	c:\windows\system32\uiautomationcore.dll
2011-09-26 18:41 . 2004-08-04 12:00	220160	----a-w-	c:\windows\system32\oleacc.dll
2011-09-26 18:41 . 2004-08-04 12:00	20480	----a-w-	c:\windows\system32\oleaccrc.dll
2011-09-09 09:12 . 2004-08-04 12:00	599040	----a-w-	c:\windows\system32\crypt32.dll
2011-09-06 13:20 . 2004-08-04 12:00	1858944	----a-w-	c:\windows\system32\win32k.sys
2011-08-22 23:48 . 2004-08-04 12:00	916480	----a-w-	c:\windows\system32\wininet.dll
2011-08-22 23:48 . 2004-08-04 12:00	43520	----a-w-	c:\windows\system32\licmgr10.dll
2011-08-22 23:48 . 2004-08-04 12:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2011-08-22 11:56 . 2004-08-04 12:00	385024	----a-w-	c:\windows\system32\html.iec
2011-08-17 13:49 . 2004-08-04 12:00	138496	----a-w-	c:\windows\system32\drivers\afd.sys
2010-06-02 15:15 . 2010-06-02 15:15	436	----a-w-	c:\program files\060220108152078.bat
2010-06-02 15:09 . 2010-06-02 15:09	445	----a-w-	c:\program files\060220108094678.bat
2004-10-01 22:00 . 2006-09-16 22:42	40960	----a-w-	c:\program files\Uninstall_CDS.exe
2009-05-01 21:02 . 2009-05-01 21:02	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
2007-12-26 21:06 . 2007-12-26 21:06	133120	----a-w-	c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\drivers\atapi.sys
[7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys
[7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys
.
[7] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\asyncmac.sys
[7] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\drivers\asyncmac.sys
[7] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\asyncmac.sys
.
[7] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys
[7] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys
.
[7] 2008-04-13 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\kbdclass.sys
[7] 2008-04-13 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\system32\drivers\kbdclass.sys
[7] 2008-04-13 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\system32\ReinstallBackups\0003\DriverFiles\i386\kbdclass.sys
[7] 2008-04-13 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\kbdclass.sys
[7] 2004-08-04 . EBDEE8A2EE5393890A1ACEE971C4C246 . 24576 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\kbdclass.sys
.
[7] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ndis.sys
[7] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ndis.sys
[7] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ndis.sys
.
[7] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntfs.sys
[7] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ntfs.sys
[-] 2007-02-09 . 05AB81909514BFD69CBB1F2C147CF6B9 . 574976 . . [5.1.2600.3081] . . c:\windows\$hf_mig$\KB930916\SP2QFE\ntfs.sys
[-] 2007-02-09 . 19A811EF5F1ED5C926A028CE107FF1AF . 574464 . . [5.1.2600.3081] . . c:\windows\$NtServicePackUninstall$\ntfs.sys
.
[7] 2004-08-04 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys
[7] 2004-08-04 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys
.
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\tcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
[7] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[-] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
.
[7] 2008-04-14 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\browser.dll
[7] 2008-04-14 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\system32\browser.dll
[7] 2004-08-04 . E3CFCCDDA4EDD1D0DC9168B2E18F27B8 . 77312 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\browser.dll
.
[7] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\lsass.exe
[7] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\lsass.exe
[7] 2004-08-04 . 84885F9B82F4D55C6146EBF6065D75D2 . 13312 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\lsass.exe
.
[7] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\netman.dll
[7] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\netman.dll
[-] 2005-08-22 . 36739B39267914BA69AD0610A0299732 . 197632 . . [5.1.2600.2743] . . c:\windows\$NtServicePackUninstall$\netman.dll
[-] 2005-08-22 . 3516D8A18B36784B1005B950B84232E1 . 197632 . . [5.1.2600.2743] . . c:\windows\$hf_mig$\KB905414\SP2QFE\netman.dll
.
[7] 2008-04-14 00:11 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\ServicePackFiles\i386\comres.dll
[7] 2008-04-14 00:11 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll
[7] 2004-08-04 12:00 . 6728270CB7DBB776ED086F5AC4C82310 . 792064 . . [2001.12.4414.258] . . c:\windows\$NtServicePackUninstall$\comres.dll
.
[7] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\ServicePackFiles\i386\qmgr.dll
[7] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\qmgr.dll
[7] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\bits\qmgr.dll
[7] 2004-08-04 . 2C69EC7E5A311334D10DD95F338FCCEA . 382464 . . [6.6.2600.2180] . . c:\windows\$NtServicePackUninstall$\qmgr.dll
.
[7] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\rpcss.dll
[7] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\rpcss.dll
[7] 2009-02-09 . 9222562D44021B988B9F9F62207FB6F2 . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll
[7] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\rpcss.dll
[7] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\rpcss.dll
[-] 2005-07-26 . CE94A2BD25E3E9F4D46A7373FF455C6D . 397824 . . [5.1.2600.2726] . . c:\windows\$NtServicePackUninstall$\rpcss.dll
[-] 2005-07-26 . C369DF215D352B6F3A0B8C3469AA34F8 . 398336 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\rpcss.dll
[-] 2005-04-28 . DA383FB39A6F1C445F3AFC94B3EB1248 . 396288 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\rpcss.dll
.
[7] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\services.exe
[7] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\services.exe
[7] 2009-02-06 . 020CEAAEDC8EB655B6506B8C70D53BB6 . 110592 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
[7] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\services.exe
[7] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\services.exe
[7] 2004-08-04 . C6CE6EEC82F187615D1002BB3BB50ED4 . 108032 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\services.exe
.
[7] 2010-08-17 . 258DD5D4283FD9F9A7166BE9AE45CE73 . 58880 . . [5.1.2600.6024] . . c:\windows\$hf_mig$\KB2347290\SP3QFE\spoolsv.exe
[7] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\spoolsv.exe
[7] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\dllcache\spoolsv.exe
[7] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB2347290$\spoolsv.exe
[7] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2005-06-11 . AD3D9D191AEA7B5445FE1D82FFBB4788 . 57856 . . [5.1.2600.2696] . . c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\$NtServicePackUninstall$\spoolsv.exe
.
[7] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\winlogon.exe
[7] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
[7] 2004-08-04 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\winlogon.exe
.
.
[7] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll
[7] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll
[7] 2010-08-23 . 736B12B725AEB2B07F0241A9F680CB10 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
[7] 2008-04-14 . BD38D1EBE24A46BD3EDA059560AFBA12 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
[7] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\$NtUninstallKB2296011$\comctl32.dll
[7] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\ServicePackFiles\i386\comctl32.dll
[-] 2006-08-25 . B0124CB21D28B1C9F678B566B6B57D92 . 617472 . . [5.82] . . c:\windows\$NtServicePackUninstall$\comctl32.dll
[-] 2006-08-25 . C4E80875C1CF1222FC5EFD0314AE5C01 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
[7] 2004-08-04 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
[7] 2004-08-04 . 5AF68A5E44734A082442668E9C787743 . 1050624 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
.
[7] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\cryptsvc.dll
[7] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\cryptsvc.dll
[7] 2004-08-04 . 10654F9DDCEA9C46CFB77554231BE73B . 60416 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\cryptsvc.dll
.
[7] 2008-07-07 20:32 . 60D1A6342238378BFB7545C81EE3606C . 253952 . . [2001.12.4414.320] . . c:\windows\$NtServicePackUninstall$\es.dll
[7] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3GDR\es.dll
[7] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\es.dll
[7] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\dllcache\es.dll
[7] 2008-07-07 20:23 . F17F6226BDC0CD5F0BEF0DAF84D29BEC . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll
[7] 2008-07-07 20:06 . A4AB3DCA4A383F0DF4988ABDEB84F9A4 . 253952 . . [2001.12.4414.320] . . c:\windows\$hf_mig$\KB950974\SP2QFE\es.dll
[7] 2008-04-14 00:11 . 19A799805B24990867B00C120D300C3A . 246272 . . [2001.12.4414.701] . . c:\windows\ServicePackFiles\i386\es.dll
[-] 2005-07-26 04:20 . 95F5FEA4C6DE2C3F28784D0DCC8F0DD3 . 243200 . . [2001.12.4414.308] . . c:\windows\$hf_mig$\KB902400\SP2QFE\es.dll
.
[7] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\imm32.dll
[7] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\imm32.dll
[7] 2004-08-04 . 87CA7CE6469577F059297B9D6556D66D . 110080 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\imm32.dll
.
[7] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\system32\kernel32.dll
[7] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\system32\dllcache\kernel32.dll
[7] 2009-03-21 . DA11D9D6ECBDF0F93436A4B7C13F7BEC . 991744 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
[7] 2008-04-14 . C24B983D211C34DA8FCC1AC38477971D . 989696 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB959426$\kernel32.dll
[7] 2008-04-14 . C24B983D211C34DA8FCC1AC38477971D . 989696 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\kernel32.dll
[-] 2007-04-16 . 09F7CB3687F86EDAA4CA081F7AB66C03 . 986112 . . [5.1.2600.3119] . . c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
[-] 2007-04-16 . A01F9CA902A88F7CED06884174D6419D . 984576 . . [5.1.2600.3119] . . c:\windows\$NtServicePackUninstall$\kernel32.dll
[-] 2006-07-05 . 0FDD84928A5DDE2510761B7EC76CCEC9 . 985088 . . [5.1.2600.2945] . . c:\windows\$hf_mig$\KB917422\SP2QFE\kernel32.dll
.
[7] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\linkinfo.dll
[7] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\linkinfo.dll
[-] 2005-09-01 . 648BF0B4DDE4F7A1156DAE7174D36EFA . 19968 . . [5.1.2600.2751] . . c:\windows\$hf_mig$\KB900725\SP2QFE\linkinfo.dll
[-] 2005-09-01 . A1A688EE56CF3BBD24EDEB815D48E9BA . 19968 . . [5.1.2600.2751] . . c:\windows\$NtServicePackUninstall$\linkinfo.dll
.
[7] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\lpk.dll
[7] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\lpk.dll
[7] 2004-08-04 . 74D66B3DE265E8789153414E75175F26 . 22016 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\lpk.dll
.
[7] 2011-10-03 . 4963CB503600FC3BCBDBFBA51FBA1FAC . 5971456 . . [8.00.6001.19154] . . c:\windows\system32\mshtml.dll
[7] 2011-10-03 . 4963CB503600FC3BCBDBFBA51FBA1FAC . 5971456 . . [8.00.6001.19154] . . c:\windows\system32\dllcache\mshtml.dll
[7] 2011-10-03 . 1240A6B7B470BED0AA6C9FEC7AB0EA26 . 5972992 . . [8.00.6001.23250] . . c:\windows\$hf_mig$\KB2586448-IE8\SP3QFE\mshtml.dll
[7] 2011-07-25 . 23B3C8E9F3F280180573569253CE98AB . 5969920 . . [8.00.6001.19120] . . c:\windows\ie8updates\KB2586448-IE8\mshtml.dll
[7] 2011-07-25 . BCE7CCEBAD6C8955D2B4C3B246BD0E57 . 5971456 . . [8.00.6001.23216] . . c:\windows\$hf_mig$\KB2559049-IE8\SP3QFE\mshtml.dll
[7] 2011-05-30 . 22BA5235EA846EDA87F68A1DCC2BFCF9 . 5964800 . . [8.00.6001.19088] . . c:\windows\ie8updates\KB2559049-IE8\mshtml.dll
[7] 2011-05-30 . D0B1DB576941CB0B6669B8752FFAC79A . 5967360 . . [8.00.6001.23181] . . c:\windows\$hf_mig$\KB2530548-IE8\SP3QFE\mshtml.dll
[7] 2011-02-22 . 3422847AA07E37076A87D0B7D5044DC6 . 5964800 . . [8.00.6001.23141] . . c:\windows\$hf_mig$\KB2497640-IE8\SP3QFE\mshtml.dll
[7] 2011-02-22 . C2EF2335F1B6C2BE20A67D9098F6C9A1 . 5962240 . . [8.00.6001.19046] . . c:\windows\ie8updates\KB2530548-IE8\mshtml.dll
[7] 2010-12-20 . 1EDCEC5D649DBAC37ED9FFB5A14CEB0C . 5961216 . . [8.00.6001.19019] . . c:\windows\ie8updates\KB2497640-IE8\mshtml.dll
[7] 2010-12-20 . 2A2C070EC691CE410533A1DA7AA3CD86 . 5962240 . . [8.00.6001.23111] . . c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\mshtml.dll
[7] 2010-11-06 . 864E69F32656A7121444BA0193D7B64B . 5960704 . . [8.00.6001.23091] . . c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\mshtml.dll
[7] 2010-11-06 . D7CCA87057901C87ED8CC40DDCC7FA1B . 5959168 . . [8.00.6001.18999] . . c:\windows\ie8updates\KB2482017-IE8\mshtml.dll
[7] 2010-09-10 . DE41132DA8E5A3CD57201C6F2175EC05 . 5957120 . . [8.00.6001.18975] . . c:\windows\ie8updates\KB2416400-IE8\mshtml.dll
[7] 2010-09-10 . 8A03CC037E6B7D1796192815231B0C3F . 5958656 . . [8.00.6001.23067] . . c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\mshtml.dll
[7] 2010-06-24 . 94DC7E938C57F3C3D1BC4A0F68FC5830 . 5954560 . . [8.00.6001.23037] . . c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\mshtml.dll
[7] 2010-06-24 . 4D7EF94795384CD2BBAAB078B7929FEA . 5951488 . . [8.00.6001.18939] . . c:\windows\ie8updates\KB2360131-IE8\mshtml.dll
[7] 2010-05-06 . C7B7A88CC7D7ABA5C395145BF92F46F7 . 5950976 . . [8.00.6001.18928] . . c:\windows\ie8updates\KB2183461-IE8\mshtml.dll
[7] 2010-05-06 . 9BE28F749A7FE7F8F177C6AA2E9DA609 . 5953024 . . [8.00.6001.23019] . . c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\mshtml.dll
[7] 2010-02-25 . 7054F6ADC9B670887659F1561603B0D0 . 5944832 . . [8.00.6001.18904] . . c:\windows\ie8updates\KB982381-IE8\mshtml.dll
[7] 2010-02-25 . 974772C74DA7C7A8E7C813A9908A845F . 5946880 . . [8.00.6001.22995] . . c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\mshtml.dll
[7] 2009-12-21 . BE6EEBEF636773A8E7A82214E81C563A . 5942784 . . [8.00.6001.18876] . . c:\windows\ie8updates\KB980182-IE8\mshtml.dll
[7] 2009-12-21 . E6B64C6C729BBC38AB7CC92CE33F97A5 . 5945856 . . [8.00.6001.22967] . . c:\windows\$hf_mig$\KB978207-IE8\SP3QFE\mshtml.dll
[7] 2009-10-29 . 89A9658515A18E673034369E043FAB01 . 3598336 . . [7.00.6000.16945] . . c:\windows\ie8\mshtml.dll
[7] 2009-10-29 . 8B48737260C273C9B0DACA84EA1CCDBD . 3602432 . . [7.00.6000.21148] . . c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\mshtml.dll
[7] 2009-10-29 . C0F9AC6FAB2C788FFEE3E69585A0E93F . 5944320 . . [8.00.6001.22945] . . c:\windows\$hf_mig$\KB976325-IE8\SP3QFE\mshtml.dll
[7] 2009-10-29 . CBB1EF54B86EDB78649909DD1699E5CA . 5940736 . . [8.00.6001.18854] . . c:\windows\ie8updates\KB978207-IE8\mshtml.dll
[7] 2009-10-21 . 36145D2D908FB8A24772F04842366918 . 3598336 . . [7.00.6000.16939] . . c:\windows\ie7updates\KB976325-IE7\mshtml.dll
[7] 2009-10-21 . E6453EE08B283419171889786D057A75 . 3602432 . . [7.00.6000.21142] . . c:\windows\$hf_mig$\KB976749-IE7\SP3QFE\mshtml.dll
[7] 2009-08-29 . E52A845DCE011D56B12B8F3F4606F956 . 3598336 . . [7.00.6000.16915] . . c:\windows\ie7updates\KB976749-IE7\mshtml.dll
[7] 2009-08-29 . EDAD55105DDD067AE3906011F297267C . 3600384 . . [7.00.6000.21115] . . c:\windows\$hf_mig$\KB974455-IE7\SP3QFE\mshtml.dll
[7] 2009-07-19 . 758C8BEDAB7CE5F9070C85E2E57CBD80 . 3597824 . . [7.00.6000.16890] . . c:\windows\ie7updates\KB974455-IE7\mshtml.dll
[7] 2009-07-19 . F6098CC1B1C3858D53F20F3CB5774F3B . 3600384 . . [7.00.6000.21089] . . c:\windows\$hf_mig$\KB972260-IE7\SP3QFE\mshtml.dll
[7] 2009-04-29 . 2B4315EC9E3124408A2A5074C4B97700 . 3596288 . . [7.00.6000.16850] . . c:\windows\ie7updates\KB972260-IE7\mshtml.dll
[7] 2009-04-29 . C6FD770D518FB024245A0EE217D72BC1 . 3598336 . . [7.00.6000.21045] . . c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\mshtml.dll
[7] 2009-03-08 . D469A0EBA2EF5C6BEE8065B7E3196E5E . 5937152 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB976325-IE8\mshtml.dll
[7] 2009-02-21 . 1BB754AB47B327DE8DBF2FA18C36357C . 3596800 . . [7.00.6000.21015] . . c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\mshtml.dll
[7] 2009-02-20 . C7C3E41CC2F6EB4A629FE2184136C098 . 3595264 . . [7.00.6000.16825] . . c:\windows\ie7updates\KB969897-IE7\mshtml.dll
[7] 2009-01-17 . 3B413267DA8AE71C20E5EF3E54F74728 . 3594752 . . [7.00.6000.16809] . . c:\windows\ie7updates\KB963027-IE7\mshtml.dll
[7] 2009-01-16 . CC9D001B7370B292C35B366CA05B12B4 . 3596288 . . [7.00.6000.20996] . . c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\mshtml.dll
[7] 2008-12-13 . 121EC39A64D64205A88C2C45B034B455 . 3593216 . . [7.00.6000.16788] . . c:\windows\ie7updates\KB961260-IE7\mshtml.dll
[7] 2008-12-13 . C79FAD61CD4A26ED5AA8C16D991C6FBD . 3594752 . . [7.00.6000.20973] . . c:\windows\$hf_mig$\KB960714-IE7\SP2QFE\mshtml.dll
[7] 2008-10-17 . EACAEDEF6FA2A969DE5B36190D45396F . 3593216 . . [7.00.6000.16762] . . c:\windows\ie7updates\KB960714-IE7\mshtml.dll
[7] 2008-10-16 . B74F31A4BD83797D7A083F922169287D . 3595264 . . [7.00.6000.20935] . . c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\mshtml.dll
[7] 2008-08-27 . 1AD035E04A7068EC2820B055A3131ED8 . 3593216 . . [7.00.6000.16735] . . c:\windows\ie7updates\KB958215-IE7\mshtml.dll
[7] 2008-08-26 . 25CC085720EE3617FD1F8AB9E2F7CAB2 . 3594752 . . [7.00.6000.20900] . . c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\mshtml.dll
[7] 2008-06-24 . EC936148284F557F19C333178768109B . 3592192 . . [7.00.6000.16705] . . c:\windows\ie7updates\KB956390-IE7\mshtml.dll
[7] 2008-06-23 . 28B8231CA8D55FC85E027A57C90F5C88 . 3594240 . . [7.00.6000.20861] . . c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\mshtml.dll
[7] 2008-04-24 . 8976CAB317105F7431B08EA32AB73C65 . 3591680 . . [7.00.6000.16674] . . c:\windows\ie7updates\KB953838-IE7\mshtml.dll
[7] 2008-04-23 . 4D612FF5D3B7EEF200595AE6F95D5E68 . 3593728 . . [7.00.6000.20815] . . c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\mshtml.dll
[7] 2008-04-14 . A706E122B398FE1AB85CB9B75D044223 . 3066880 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\mshtml.dll
[7] 2008-03-02 . AB2C88167D78D71D93558ACECB24CC7A . 3591680 . . [7.00.6000.16640] . . c:\windows\ie7updates\KB950759-IE7\mshtml.dll
[7] 2008-03-01 . 4EE273E2B09317C1217EF0DB91F93534 . 3593216 . . [7.00.6000.20772] . . c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\mshtml.dll
[7] 2007-12-08 . A097C36412455F0C7E42377FAF8809B7 . 3592192 . . [7.00.6000.16608] . . c:\windows\ie7updates\KB947864-IE7\mshtml.dll
[7] 2007-12-07 . 976C46ED4A75FC66D9C596778898CE1E . 3593216 . . [7.00.6000.20733] . . c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\mshtml.dll
[7] 2007-10-30 . 54D8B404F17AA74C666F7F3AEF2AE459 . 3593216 . . [7.00.6000.20710] . . c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\mshtml.dll
[7] 2007-10-30 . 8AB7ECF59D6EBBE986277B65ED4A40A1 . 3590656 . . [7.00.6000.16587] . . c:\windows\ie7updates\KB944533-IE7\mshtml.dll
[7] 2007-08-20 . E267EE248CDA7667C19001C069DE867B . 3584512 . . [7.00.6000.16544] . . c:\windows\ie7updates\KB942615-IE7\mshtml.dll
[7] 2007-08-20 . AA8A4BD78D24FCDB96DDAEE3756AA372 . 3592192 . . [7.00.6000.20661] . . c:\windows\$hf_mig$\KB939653-IE7\SP2QFE\mshtml.dll
[7] 2007-07-19 . BD609A26B683332A0E0E1445C5724851 . 3583488 . . [7.00.6000.16525] . . c:\windows\ie7updates\KB939653-IE7\mshtml.dll
[7] 2007-07-18 . 7CE243CFD47AD0DC431586CB8C542A11 . 3584000 . . [7.00.6000.20641] . . c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\mshtml.dll
[7] 2007-05-08 . 1D4E3B86C601A2497C99790CC4D7DF26 . 3584000 . . [7.00.6000.20591] . . c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\mshtml.dll
[7] 2007-05-08 . 5D90A7200F72DACE663EE78DE234FCC7 . 3583488 . . [7.00.6000.16481] . . c:\windows\ie7updates\KB937143-IE7\mshtml.dll
[7] 2007-01-12 . 5D45318804A30CE9D6EA83066E84B4A7 . 3580416 . . [7.00.6000.16414] . . c:\windows\ie7updates\KB933566-IE7\mshtml.dll
[-] 2006-11-08 . CBF04597F9CF7739E572276A2698FDD3 . 3577856 . . [7.00.5730.11] . . c:\windows\ie7updates\KB928090-IE7\mshtml.dll
[-] 2006-09-14 . CEFEA1C301139A817931BE132F0359FE . 3058688 . . [6.00.2900.2995] . . c:\windows\ie7\mshtml.dll
[-] 2006-07-28 . D251679BD9EF0250201FB899EC40FD32 . 3058176 . . [6.00.2900.2963] . . c:\windows\$hf_mig$\KB918899\SP2QFE\mshtml.dll
.
[7] 2008-04-14 . D7075E95AA599EE77B7A89D39296BD3D . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll
[7] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\ServicePackFiles\i386\msvcrt.dll
[7] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\msvcrt.dll
[7] 2004-08-04 . B0FEFA816D61EC66AA765DDF534EAB5E . 343040 . . [7.0.2600.2180] . . c:\windows\$NtServicePackUninstall$\msvcrt.dll
[7] 2004-08-04 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll
[7] 2004-08-04 . 98EC447E00229AFD88D5161A25D065DA . 343040 . . [7.0.2600.2180] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll
.
[7] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\mswsock.dll
[7] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\$NtUninstallKB2509553$\mswsock.dll
[7] 2008-06-20 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\mswsock.dll
[7] 2008-06-20 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll
[7] 2008-06-20 . 097722F235A1FB698BF9234E01B52637 . 245248 . . [5.1.2600.3394] . . c:\windows\$NtServicePackUninstall$\mswsock.dll
[7] 2008-06-20 . 1DFCA7713EA5A70D5D93B436AEA0317A . 245248 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\mswsock.dll
[7] 2008-06-20 . 943337D786A56729263071623BBB9DE5 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\mswsock.dll
[7] 2008-06-20 . 943337D786A56729263071623BBB9DE5 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\mswsock.dll
[7] 2008-04-14 . B4138E99236F0F57D4CF49BAE98A0746 . 245248 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\mswsock.dll
.
[7] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\netlogon.dll
[7] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\netlogon.dll
[7] 2004-08-04 . 96353FCECBA774BB8DA74A1C6507015A . 407040 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\netlogon.dll
.
[7] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\powrprof.dll
[7] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll
[7] 2004-08-04 . 1B5F6923ABB450692E9FE0672C897AED . 17408 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\powrprof.dll
.
[7] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\scecli.dll
[7] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\scecli.dll
[7] 2004-08-04 . 0F78E27F563F2AAF74B91A49E2ABF19A . 180224 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\scecli.dll
.
[7] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\sfc.dll
[7] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\sfc.dll
[7] 2004-08-04 . E8A12A12EA9088B4327D49EDCA3ADD3E . 5120 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\sfc.dll
.
[7] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\svchost.exe
[7] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\svchost.exe
[7] 2004-08-04 . 8F078AE4ED187AAABC0A305146DE6716 . 14336 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\svchost.exe
.
[7] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tapisrv.dll
[7] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\tapisrv.dll
[-] 2005-07-08 . 1418A3A6E76E5A2E3F5E43866E793A8B . 249344 . . [5.1.2600.2716] . . c:\windows\$hf_mig$\KB893756\SP2QFE\tapisrv.dll
[-] 2005-07-08 . FB78839B36025AA286A51289ED28B73E . 249344 . . [5.1.2600.2716] . . c:\windows\$NtServicePackUninstall$\tapisrv.dll
.
[7] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\user32.dll
[7] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
[-] 2007-03-08 . 7AA4F6C00405DFC4B70ED4214E7D687B . 578048 . . [5.1.2600.3099] . . c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2007-03-08 . B409909F6E2E8A7067076ED748ABF1E7 . 577536 . . [5.1.2600.3099] . . c:\windows\$NtServicePackUninstall$\user32.dll
[-] 2005-03-02 . 1800F293BCCC8EDE8A70E12B88D80036 . 577024 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
.
[7] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\userinit.exe
[7] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe
[7] 2004-08-04 . 39B1FFB03C2296323832ACBAE50D2AFF . 24576 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\userinit.exe
.
[7] 2011-08-22 . 1A377838B4B468E37C3EEB5BAA24F925 . 916480 . . [8.00.6001.19131] . . c:\windows\system32\wininet.dll
[7] 2011-08-22 . 1A377838B4B468E37C3EEB5BAA24F925 . 916480 . . [8.00.6001.19131] . . c:\windows\system32\dllcache\wininet.dll
[7] 2011-08-22 . 19630AEBBFAEB06984CAB91848270AAF . 919552 . . [8.00.6001.23227] . . c:\windows\$hf_mig$\KB2586448-IE8\SP3QFE\wininet.dll
[7] 2011-06-23 . AF4EDDC6C0446FCE5681B5DED52B8F0E . 916480 . . [8.00.6001.19098] . . c:\windows\ie8updates\KB2586448-IE8\wininet.dll
[7] 2011-06-23 . 509CF67AE762A38E23A5455A0053853C . 919552 . . [8.00.6001.23192] . . c:\windows\$hf_mig$\KB2559049-IE8\SP3QFE\wininet.dll
[7] 2011-04-25 . CC951C2212A200475A587A440E0AA804 . 916480 . . [8.00.6001.19072] . . c:\windows\ie8updates\KB2559049-IE8\wininet.dll
[7] 2011-04-25 . 7F4F1697001B9E9A7924D219DC215903 . 919552 . . [8.00.6001.23165] . . c:\windows\$hf_mig$\KB2530548-IE8\SP3QFE\wininet.dll
[7] 2011-02-22 . A9FA95F0D7F511959AC721E4843E5967 . 919552 . . [8.00.6001.23139] . . c:\windows\$hf_mig$\KB2497640-IE8\SP3QFE\wininet.dll
[7] 2011-02-22 . F192D49EEFE297FA858B2C774BA2291D . 916480 . . [8.00.6001.19044] . . c:\windows\ie8updates\KB2530548-IE8\wininet.dll
[7] 2010-12-20 . 88014D62B5E3CDB0AC67948D86C926C8 . 916480 . . [8.00.6001.19019] . . c:\windows\ie8updates\KB2497640-IE8\wininet.dll
[7] 2010-12-20 . 5504B4ECCE892EB82CD2C5FA71940AC1 . 919552 . . [8.00.6001.23111] . . c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\wininet.dll
[7] 2010-11-06 . 9357C4249F4810FB0E49C13387A8A77C . 919552 . . [8.00.6001.23084] . . c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\wininet.dll
[7] 2010-11-06 . 306A2B05EA9846278113964DC6E2C940 . 916480 . . [8.00.6001.18992] . . c:\windows\ie8updates\KB2482017-IE8\wininet.dll
[7] 2010-09-10 . 36FE8ABC59AAFBE20CBE54BC372F9429 . 916480 . . [8.00.6001.18968] . . c:\windows\ie8updates\KB2416400-IE8\wininet.dll
[7] 2010-09-10 . 0555E190DCD06B8998E6DDCA42DAEB82 . 919552 . . [8.00.6001.23060] . . c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\wininet.dll
[7] 2010-06-24 . 60237E50D575FBA9BEC9BC043F157149 . 919040 . . [8.00.6001.23037] . . c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\wininet.dll
[7] 2010-06-24 . D3DEB6B2B424AC93DE3801EAEB21A9A5 . 916480 . . [8.00.6001.18939] . . c:\windows\ie8updates\KB2360131-IE8\wininet.dll
[7] 2010-05-06 . 2D9C7B010409372C34F725DA5CCED083 . 916480 . . [8.00.6001.18923] . . c:\windows\ie8updates\KB2183461-IE8\wininet.dll
[7] 2010-05-06 . C1490F68B44AF8B781F52F12F564625D . 919040 . . [8.00.6001.23014] . . c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\wininet.dll
[7] 2010-02-25 . 7A42CFED96CDA7F2FB1A26D1F9F65775 . 916480 . . [8.00.6001.18904] . . c:\windows\ie8updates\KB982381-IE8\wininet.dll
[7] 2010-02-25 . 4458D59F2B0369F4D3B137541D284041 . 919040 . . [8.00.6001.22995] . . c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\wininet.dll
[7] 2009-12-21 . FF4241C74E0C0A5AFFFE05F584213ECB . 916480 . . [8.00.6001.18876] . . c:\windows\ie8updates\KB980182-IE8\wininet.dll
[7] 2009-12-21 . 5E1F666B8955FD77E65D65C4C4D882A3 . 916480 . . [8.00.6001.22967] . . c:\windows\$hf_mig$\KB978207-IE8\SP3QFE\wininet.dll
[7] 2009-10-29 . 7C599DEC022BEF6E3C9F4DB4FC164E8B . 832512 . . [7.00.6000.16945] . . c:\windows\ie8\wininet.dll
[7] 2009-10-29 . 6AF52998B90F72FF2325D84D90EDA1CC . 916480 . . [8.00.6001.22945] . . c:\windows\$hf_mig$\KB976325-IE8\SP3QFE\wininet.dll
[7] 2009-10-29 . CA5CB4F174592090FBECFEAD9B51BB90 . 841216 . . [7.00.6000.21148] . . c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\wininet.dll
[7] 2009-10-29 . 75240F6EDBCE7B85DF66874407D38A4F . 916480 . . [8.00.6001.18854] . . c:\windows\ie8updates\KB978207-IE8\wininet.dll
[7] 2009-08-29 . DB111200015F08DDDB8857E11C6A80E3 . 832512 . . [7.00.6000.16915] . . c:\windows\ie7updates\KB976325-IE7\wininet.dll
[7] 2009-08-29 . A5885AF9BFBD942B828E6020AD326517 . 840704 . . [7.00.6000.21115] . . c:\windows\$hf_mig$\KB974455-IE7\SP3QFE\wininet.dll
[7] 2009-06-29 . 4C6B4138165A4C53FE8A5B1D809526C3 . 828928 . . [7.00.6000.21073] . . c:\windows\$hf_mig$\KB972260-IE7\SP3QFE\wininet.dll
[7] 2009-06-29 . A39B7BA7AB9B1CC2A0009F59772DB83C . 827392 . . [7.00.6000.16876] . . c:\windows\ie7updates\KB974455-IE7\wininet.dll
[7] 2009-04-29 . 8E2D471157B0DF329D8D0EA5D83B0DDB . 827392 . . [7.00.6000.16850] . . c:\windows\ie7updates\KB972260-IE7\wininet.dll
[7] 2009-04-29 . 62CCA075F44015147B8971DAFFBCFF76 . 828928 . . [7.00.6000.21045] . . c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\wininet.dll
[7] 2009-03-08 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB976325-IE8\wininet.dll
[7] 2009-03-03 . 28775945CCD53DEE280EF58DEA1A94C4 . 826368 . . [7.00.6000.16827] . . c:\windows\ie7updates\KB969897-IE7\wininet.dll
[7] 2009-03-03 . C8667854873938CA13C986F16B0CD183 . 828416 . . [7.00.6000.21020] . . c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\wininet.dll
[7] 2008-12-20 . 044E0A4E9FE97C0FB9AFE9C89E2A82E6 . 827904 . . [7.00.6000.20978] . . c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll
[7] 2008-12-20 . A82935D32D0672E8FF4E91AE398E901C . 826368 . . [7.00.6000.16791] . . c:\windows\ie7updates\KB963027-IE7\wininet.dll
[7] 2008-10-16 . 6741EAF7B7F110E803A6E38F6E5FA6B0 . 826368 . . [7.00.6000.16762] . . c:\windows\ie7updates\KB961260-IE7\wininet.dll
[7] 2008-10-16 . 0D5B75171FF51775B630A431B6C667E8 . 827904 . . [7.00.6000.20935] . . c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll
[7] 2008-08-26 . 77C192FE56A70D7FA0247BA0A6201C32 . 827904 . . [7.00.6000.20900] . . c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\wininet.dll
[7] 2008-08-26 . EF8EBA98145BFA44E80D17A3B3453300 . 826368 . . [7.00.6000.16735] . . c:\windows\ie7updates\KB958215-IE7\wininet.dll
[7] 2008-06-23 . 8C13D4A7479FA0A026EDA8ABCE82C0ED . 826368 . . [7.00.6000.16705] . . c:\windows\ie7updates\KB956390-IE7\wininet.dll
[7] 2008-06-23 . C66402A06B83B036C195242C0C8CF83C . 827904 . . [7.00.6000.20861] . . c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
[7] 2008-04-23 . F6589BE784647CFDBC22EA51CCB1A57A . 826368 . . [7.00.6000.16674] . . c:\windows\ie7updates\KB953838-IE7\wininet.dll
[7] 2008-04-23 . 41546B396A526918DA7995A02EA04E51 . 827392 . . [7.00.6000.20815] . . c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
[7] 2008-04-14 . 7A4F775ABB2F1C97DEF3E73AFA2FAEDD . 666112 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\wininet.dll
[7] 2008-03-01 . AD21461AEF8244EDEC2EF18E55E1DCF3 . 826368 . . [7.00.6000.16640] . . c:\windows\ie7updates\KB950759-IE7\wininet.dll
[7] 2008-03-01 . 6316C2F0C61271C8ABDFF7429174879E . 827392 . . [7.00.6000.20772] . . c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
[7] 2007-12-07 . 806D274C9A6C3AAEA5EAE8E4AF841E04 . 824832 . . [7.00.6000.16608] . . c:\windows\ie7updates\KB947864-IE7\wininet.dll
[7] 2007-12-07 . B5B411BB229AE6EAD7652A32ED47BFB9 . 825344 . . [7.00.6000.20733] . . c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
[7] 2007-10-10 . 30C1E0F34AD2972C72A01DB5C74AB065 . 824832 . . [7.00.6000.16574] . . c:\windows\ie7updates\KB944533-IE7\wininet.dll
[7] 2007-10-10 . 0E5D918F87EFA7D2424D66B499C7EB04 . 825344 . . [7.00.6000.20696] . . c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
[7] 2007-08-20 . 774435E499D8E9643EC961A6103C361F . 824832 . . [7.00.6000.16544] . . c:\windows\ie7updates\KB942615-IE7\wininet.dll
[7] 2007-08-20 . 357D54BF94FE9D6D8505A96B5C2A3BCA . 825344 . . [7.00.6000.20661] . . c:\windows\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll
[7] 2007-06-27 . D6ED5E042C5207553E7F5E842918137F . 824320 . . [7.00.6000.20627] . . c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\wininet.dll
[7] 2007-06-27 . 8068CBB58FE60CC95AEB2CFF70178208 . 823808 . . [7.00.6000.16512] . . c:\windows\ie7updates\KB939653-IE7\wininet.dll
[7] 2007-04-25 . 431DEFBB4A3D7B0DC062C1B064623A2F . 823808 . . [7.00.6000.20583] . . c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\wininet.dll
[7] 2007-04-25 . 0586A7F0B2FDB94D624F399D4728E7C8 . 822784 . . [7.00.6000.16473] . . c:\windows\ie7updates\KB937143-IE7\wininet.dll
[7] 2007-01-12 . BE43D00D802C92F01C8CC952C6F483F8 . 822784 . . [7.00.6000.16414] . . c:\windows\ie7updates\KB933566-IE7\wininet.dll
[-] 2006-11-08 . 92995334F993E6E49C25C6D02EC04401 . 818688 . . [7.00.5730.11] . . c:\windows\ie7updates\KB928090-IE7\wininet.dll
[-] 2006-09-14 . D207370287CF769AEBEBF03837784963 . 664576 . . [6.00.2900.2995] . . c:\windows\ie7\wininet.dll
[-] 2006-06-23 . 64CE26DB72810B30F7855EA51E1DF836 . 664576 . . [6.00.2900.2937] . . c:\windows\$hf_mig$\KB918899\SP2QFE\wininet.dll
.
[7] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ws2_32.dll
[7] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll
[7] 2004-08-04 . 2ED0B7F12A60F90092081C50FA0EC2B2 . 82944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ws2_32.dll
.
[7] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ws2help.dll
[7] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\ws2help.dll
[7] 2004-08-04 . 9BEACB911CA61E5881102188AB7FB431 . 19968 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ws2help.dll
.
[7] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[7] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2007-06-13 . 7712DF0CDDE3A5AC89843E61CD5B3658 . 1033216 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2007-06-13 . 97BD6515465659FF8F3B7BE375B2EA87 . 1033216 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe
.
[7] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\regedit.exe
[7] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regedit.exe
[7] 2004-08-04 . 783AFC80383C176B22DBF8333343992D . 146432 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regedit.exe
.
[7] 2010-07-16 . 7A6A7900B5E322763430BA6FD9A31224 . 1288192 . . [5.1.2600.6010] . . c:\windows\system32\ole32.dll
[7] 2010-07-16 . 7A6A7900B5E322763430BA6FD9A31224 . 1288192 . . [5.1.2600.6010] . . c:\windows\system32\dllcache\ole32.dll
[7] 2010-07-16 . 8D51FB47062F2A1A9EFECCEF338A4C46 . 1289216 . . [5.1.2600.6010] . . c:\windows\$hf_mig$\KB979687\SP3QFE\ole32.dll
[7] 2008-04-14 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB979687$\ole32.dll
[7] 2008-04-14 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ole32.dll
[-] 2005-07-26 . AB8231D13692AC5088EB9C226B0C0576 . 1285120 . . [5.1.2600.2726] . . c:\windows\$NtServicePackUninstall$\ole32.dll
[-] 2005-07-26 . A2F755E237FA2CDD748A80BFBE6657F3 . 1285632 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\ole32.dll
[-] 2005-04-28 . 7440D29F257B7E44329343F944F2142C . 1286144 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\ole32.dll
.
[7] 2010-04-16 . 9E03DC5AB51CFD0190541CE2038D819D . 406016 . . [1.0420.2600.5969] . . c:\windows\system32\usp10.dll
[7] 2010-04-16 . 9E03DC5AB51CFD0190541CE2038D819D . 406016 . . [1.0420.2600.5969] . . c:\windows\system32\dllcache\usp10.dll
[7] 2010-04-16 . F8894BCC961D461674002B4BAE7AECC1 . 406016 . . [1.0420.2600.5969] . . c:\windows\$hf_mig$\KB981322\SP3QFE\usp10.dll
[7] 2008-04-14 . 7D7D8501F3CB45D0408CDEFA08CDAEFF . 406016 . . [1.0420.2600.5512] . . c:\windows\$NtUninstallKB981322$\usp10.dll
[7] 2008-04-14 . 7D7D8501F3CB45D0408CDEFA08CDAEFF . 406016 . . [1.0420.2600.5512] . . c:\windows\ServicePackFiles\i386\usp10.dll
[7] 2004-08-04 . 2EB58F9DCD6AB320B46744A4EA48B2D2 . 406528 . . [1.0420.2600.2180] . . c:\windows\$NtServicePackUninstall$\usp10.dll
.
[7] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\ServicePackFiles\i386\ksuser.dll
[7] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\ksuser.dll
[7] 2004-08-04 . CBCD254547689BFF80C9F547B20911E9 . 4096 . . [5.3.2600.2180] . . c:\windows\$NtServicePackUninstall$\ksuser.dll
[7] 2004-08-04 . CBCD254547689BFF80C9F547B20911E9 . 4096 . . [5.3.2600.2180] . . c:\windows\system32\ReinstallBackups\0004\DriverFiles\i386\ksuser.dll
[7] 2004-08-04 . CBCD254547689BFF80C9F547B20911E9 . 4096 . . [5.3.2600.2180] . . c:\windows\system32\ReinstallBackups\0010\DriverFiles\i386\ksuser.dll
[7] 2004-08-04 . CBCD254547689BFF80C9F547B20911E9 . 4096 . . [5.3.2600.2180] . . c:\windows\system32\ReinstallBackups\0014\DriverFiles\i386\ksuser.dll
[7] 2004-08-04 . CBCD254547689BFF80C9F547B20911E9 . 4096 . . [5.3.2600.2180] . . c:\windows\system32\ReinstallBackups\0015\DriverFiles\i386\ksuser.dll
[7] 2004-08-04 . CBCD254547689BFF80C9F547B20911E9 . 4096 . . [5.3.2600.2180] . . c:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\ksuser.dll
[7] 2004-08-04 . CBCD254547689BFF80C9F547B20911E9 . 4096 . . [5.3.2600.2180] . . c:\windows\system32\ReinstallBackups\0017\DriverFiles\i386\ksuser.dll
.
[7] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ctfmon.exe
[7] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
[7] 2004-08-04 . 24232996A38C0B0CF151C2140AE29FC8 . 15360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ctfmon.exe
.
[7] 2009-07-27 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853] . . c:\windows\system32\shsvcs.dll
[7] 2009-07-27 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853] . . c:\windows\system32\dllcache\shsvcs.dll
[7] 2009-07-27 . 888CD7B39C37E13A2419BECFAAF0A28C . 135168 . . [6.00.2900.5853] . . c:\windows\$hf_mig$\KB971029\SP3QFE\shsvcs.dll
[7] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\$NtUninstallKB971029$\shsvcs.dll
[7] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\shsvcs.dll
[-] 2006-12-19 . 6815DEF9B810AEFAC107EEAF72DA6F82 . 134656 . . [6.00.2900.3051] . . c:\windows\$NtServicePackUninstall$\shsvcs.dll
[-] 2006-12-19 . 53D9184A21C5CBF600D918E51EF3A7E5 . 135168 . . [6.00.2900.3051] . . c:\windows\$hf_mig$\KB928255\SP2QFE\shsvcs.dll
.
[7] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\srsvc.dll
[7] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
[7] 2004-08-04 . 92BDF74F12D6CBEC43C94D4B7F804838 . 170496 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\srsvc.dll
.
[7] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wscntfy.exe
[7] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe
[7] 2004-08-04 . 49911DD39E023BB6C45E4E436CFBD297 . 13824 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wscntfy.exe
.
[7] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\xmlprov.dll
[7] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\xmlprov.dll
[7] 2004-08-04 . EEF46DAB68229A14DA3D8E73C99E2959 . 129536 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\xmlprov.dll
.
[7] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\eventlog.dll
[7] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\eventlog.dll
[7] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\eventlog.dll
.
[7] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\sfcfiles.dll
[7] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
[7] 2004-08-04 . 30A609E00BD1D4FFC49D6B5A432BE7F2 . 1580544 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\sfcfiles.dll
.
[7] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regsvc.dll
[7] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\regsvc.dll
[7] 2004-08-04 . 3151427DB7D87107D1C5BE58FAC53960 . 59904 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regsvc.dll
.
[7] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\schedsvc.dll
[7] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\schedsvc.dll
[7] 2004-08-04 . 92360854316611F6CC471612213C3D92 . 190976 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\schedsvc.dll
.


----------



## kona

LAST HALF OF COMBOFIX LOG

[7] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ssdpsrv.dll
[7] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\ssdpsrv.dll
[7] 2004-08-04 . 4B8D61792F7175BED48859CC18CE4E38 . 71680 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ssdpsrv.dll
.
[7] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\termsrv.dll
[7] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\termsrv.dll
[7] 2004-08-04 . B60C877D16D9C880B952FDA04ADF16E6 . 295424 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\termsrv.dll
.
[7] 2008-04-14 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\hnetcfg.dll
[7] 2008-04-14 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll
[7] 2004-08-04 . 765B30C776A1780B46B479FE614F707C . 344064 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\hnetcfg.dll
.
[7] 2004-08-04 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys
.
[7] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\ServicePackFiles\i386\aec.sys
[7] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\drivers\aec.sys
[-] 2006-02-15 00:30 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\$hf_mig$\KB900485\SP2QFE\aec.sys
[-] 2006-02-15 00:22 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\$NtServicePackUninstall$\aec.sys
.
[7] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\agp440.sys
[7] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\system32\drivers\agp440.sys
.
[7] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ip6fw.sys
[7] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ip6fw.sys
[7] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ip6fw.sys
.
[7] 2010-09-18 07:18 . 842900DEDBC8E3E8DBCCCB298FD88F65 . 953856 . . [4.1.6151] . . c:\windows\$hf_mig$\KB2387149\SP3QFE\mfc40u.dll
[7] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\mfc40u.dll
[7] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\dllcache\mfc40u.dll
[7] 2008-04-14 00:11 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\$NtUninstallKB2387149$\mfc40u.dll
[7] 2008-04-14 00:11 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\ServicePackFiles\i386\mfc40u.dll
[-] 2006-11-01 19:17 . 925F8B61ED301A317BA850EBEECBDAA0 . 927504 . . [4.1.0.61] . . c:\windows\$NtServicePackUninstall$\mfc40u.dll
.
[7] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\msgsvc.dll
[7] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\msgsvc.dll
[7] 2004-08-04 . 95FD808E4AC22ABA025A7B3EAC0375D2 . 33792 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\msgsvc.dll
.
[7] 2006-10-19 05:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll
[7] 2006-10-19 05:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\dllcache\mspmsnsv.dll
[7] 2005-01-28 20:44 . 140EF97B64F560FD78643CAE2CDAD838 . 25088 . . [10.0.3790.3802] . . c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll
[7] 2005-01-28 20:44 . 140EF97B64F560FD78643CAE2CDAD838 . 25088 . . [10.0.3790.3802] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
[7] 2004-08-04 12:00 . C086483E3DBA8C1C0A687EC8D5B3D4C1 . 52224 . . [9.0.1.56] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll
.
[7] 2010-12-10 . F67CD97282E0ABFAF91A9A1359B16F2D . 2069376 . . [5.1.2600.6055] . . c:\windows\$hf_mig$\KB2393802\SP3QFE\ntkrnlpa.exe
[7] 2010-12-09 . 9ED77E2307F6EC6F174C063C15AA3B8C . 2027008 . . [5.1.2600.6055] . . c:\windows\system32\ntkrnlpa.exe
[7] 2010-12-09 . 84FF488E249DBD2050EB39EA81C6F5C2 . 2069376 . . [5.1.2600.6055] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe
[7] 2010-12-09 . 84FF488E249DBD2050EB39EA81C6F5C2 . 2069376 . . [5.1.2600.6055] . . c:\windows\system32\dllcache\ntkrnlpa.exe
[7] 2010-04-28 . 756362706DE8BC92F11E197C98A73844 . 2066944 . . [5.1.2600.5973] . . c:\windows\$hf_mig$\KB981852\SP3QFE\ntkrnlpa.exe
[7] 2010-04-27 . 49E936E1398D1A536E84CD5D068F0F09 . 2024448 . . [5.1.2600.5973] . . c:\windows\$NtUninstallKB2393802$\ntkrnlpa.exe
[7] 2010-02-16 . E8B8801DE921912EBDEEFC76662F7EAD . 2024448 . . [5.1.2600.5938] . . c:\windows\$NtUninstallKB981852$\ntkrnlpa.exe
[7] 2010-02-16 . DED8B5A89B085284634502E9D75AC78C . 2066944 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntkrnlpa.exe
[7] 2009-12-09 . FFDCE1EEA79C678C40237D4E031E5B51 . 2066176 . . [5.1.2600.5913] . . c:\windows\$hf_mig$\KB977165\SP3QFE\ntkrnlpa.exe
[7] 2009-12-08 . 089F1E207B067A4DDEB2EEC37BBB1AA7 . 2023936 . . [5.1.2600.5913] . . c:\windows\$NtUninstallKB979683$\ntkrnlpa.exe
[7] 2009-08-05 . 363B2BBEE0AEDC9E5433616D0AD0236A . 2066176 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3QFE\ntkrnlpa.exe
[7] 2009-08-04 . 32B1A971183EC22DD91EEDA61C499E7C . 2023936 . . [5.1.2600.5857] . . c:\windows\$NtUninstallKB977165$\ntkrnlpa.exe
[7] 2009-02-06 . 65D4220799E6FC2CB079070A6393CC0E . 2023936 . . [5.1.2600.5755] . . c:\windows\$NtUninstallKB971486$\ntkrnlpa.exe
[7] 2009-02-06 . 607352B9CB3D708C67F6039097801B5A . 2066176 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[7] 2008-08-14 . A25E9B86EFFB2AF33BF51E676B68BFB0 . 2066048 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
[7] 2008-08-14 . 8206B5F94A6A9450E934029420C1693F . 2023936 . . [5.1.2600.5657] . . c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe
[7] 2008-04-13 . 109F8E3E3C82E337BB71B6BC9B895D61 . 2065792 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntkrnlpa.exe
[-] 2007-02-28 . 4D3DBDCCBF97F5BA1E74F322B155C3BA . 2059392 . . [5.1.2600.3093] . . c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
[-] 2007-02-28 . A58AC1C6199EF34228ABEE7FC057AE09 . 2015744 . . [5.1.2600.3093] . . c:\windows\$NtServicePackUninstall$\ntkrnlpa.exe
[-] 2005-03-02 . D8ABA3EAB509627E707A3B14F00FBB6B . 2056832 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
.
[7] 2008-04-14 00:12 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\ServicePackFiles\i386\ntmssvc.dll
[7] 2008-04-14 00:12 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\ntmssvc.dll
[7] 2004-08-04 12:00 . B62F29C00AC55A761B2E45877D85EA0F . 435200 . . [5.1.2400.2180] . . c:\windows\$NtServicePackUninstall$\ntmssvc.dll
.
[7] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\upnphost.dll
[7] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\upnphost.dll
[-] 2007-02-05 . 36ACA6CDC19C95FF468A1426EB7F32F0 . 185344 . . [5.1.2600.3077] . . c:\windows\$hf_mig$\KB931261\SP2QFE\upnphost.dll
[-] 2007-02-05 . ACA5D98663D879C6BAAFCEA7E2F1B710 . 185344 . . [5.1.2600.3077] . . c:\windows\$NtServicePackUninstall$\upnphost.dll
.
[7] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\ServicePackFiles\i386\dsound.dll
[7] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dsound.dll
[7] 2004-08-04 . 55E148C01296696588EAFA425782C3E8 . 367616 . . [5.3.2600.2180] . . c:\windows\$NtServicePackUninstall$\dsound.dll
.
[7] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\ServicePackFiles\i386\d3d9.dll
[7] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\d3d9.dll
[7] 2004-08-04 . D67BDBBDA86CC9AEEBBAF3217C1717D8 . 1689088 . . [5.03.2600.2180] . . c:\windows\$NtServicePackUninstall$\d3d9.dll
.
[7] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\ServicePackFiles\i386\ddraw.dll
[7] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\ddraw.dll
[7] 2004-08-04 . 7ED462F353B3D915A418A689FA881F96 . 266240 . . [5.03.2600.2180] . . c:\windows\$NtServicePackUninstall$\ddraw.dll
.
[7] 2008-04-14 00:12 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\olepro32.dll
[7] 2008-04-14 00:12 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\olepro32.dll
[7] 2004-08-04 12:00 . B48D3193DD1474DCBCC32BF4779AC698 . 83456 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\olepro32.dll
.
[7] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\perfctrs.dll
[7] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\perfctrs.dll
[7] 2004-08-04 . 96492C721C6EA517E2BFD5381FEF55E3 . 39936 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\perfctrs.dll
.
[7] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\version.dll
[7] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\version.dll
[7] 2004-08-04 . D38408967BE738D0C1B47005BCE8CEEB . 18944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\version.dll
.
[7] 2009-10-28 . 80675329E0FD54F016C4F8A83C616349 . 634632 . . [7.00.6000.21148] . . c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\iexplore.exe
[7] 2009-10-28 . 4F9B04D546C23A295F3F0AE015BE51DB . 634632 . . [7.00.6000.16945] . . c:\windows\ie8\iexplore.exe
[7] 2009-08-27 . F232BA9F39BC0F722672C7E79E68EBEA . 634648 . . [7.00.6000.16915] . . c:\windows\ie7updates\KB976325-IE7\iexplore.exe
[7] 2009-08-27 . 332EC7562F3AA7364F2D4231C56DA986 . 634648 . . [7.00.6000.21115] . . c:\windows\$hf_mig$\KB974455-IE7\SP3QFE\iexplore.exe
[7] 2009-06-29 . 3CFC56F73D494FC1AA2B6E981DF15ACD . 634632 . . [7.00.6000.16876] . . c:\windows\ie7updates\KB974455-IE7\iexplore.exe
[7] 2009-06-29 . 02E2754D3E566C11A4934825920C47DD . 634632 . . [7.00.6000.21073] . . c:\windows\$hf_mig$\KB972260-IE7\SP3QFE\iexplore.exe
[7] 2009-04-25 . 092A7F2B49A19ECCE5369D3CB2276148 . 636088 . . [7.00.6000.16850] . . c:\windows\ie7updates\KB972260-IE7\iexplore.exe
[7] 2009-04-25 . C0503FD8D163652735C1EE900672A75C . 636088 . . [7.00.6000.21045] . . c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\iexplore.exe
[7] 2009-03-08 . B60DDDD2D63CE41CB8C487FCFBB6419E . 638816 . . [8.00.6001.18702] . . c:\windows\system32\dllcache\iexplore.exe
[7] 2009-02-28 . BCD8E48709BE4A79606F0B6E8E9A6162 . 636088 . . [7.00.6000.21020] . . c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\iexplore.exe
[7] 2009-02-28 . A251068640DDB69FD7805B57D89D7FF7 . 636072 . . [7.00.6000.16827] . . c:\windows\ie7updates\KB969897-IE7\iexplore.exe
[7] 2008-12-19 . 15E8A89499741D5CF59A9CF6463A4339 . 634024 . . [7.00.6000.20978] . . c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\iexplore.exe
[7] 2008-12-19 . 030D78FE84A086ED376EFCBD2D72C522 . 634024 . . [7.00.6000.16791] . . c:\windows\ie7updates\KB963027-IE7\iexplore.exe
[7] 2008-10-15 . 9D3DB9ADFABD2F0BC778EC03250A3ABB . 633632 . . [7.00.6000.16762] . . c:\windows\ie7updates\KB961260-IE7\iexplore.exe
[7] 2008-10-15 . 056C927CF7207857E8B34F7A8FFD9B9E . 633632 . . [7.00.6000.20935] . . c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\iexplore.exe
[7] 2008-08-23 . E8305C30D35E85D6657ED3E9934CB302 . 635848 . . [7.00.6000.20900] . . c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\iexplore.exe
[7] 2008-08-23 . 1F03216084447F990AE797317D0A6E70 . 635848 . . [7.00.6000.16735] . . c:\windows\ie7updates\KB958215-IE7\iexplore.exe
[7] 2008-06-23 . 64E376A47763DAEABCDA14BD5B6EA286 . 625664 . . [7.00.6000.16705] . . c:\windows\ie7updates\KB956390-IE7\iexplore.exe
[7] 2008-06-23 . C52A9EF571E91535EB78DB4B8B95EA07 . 625664 . . [7.00.6000.20861] . . c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\iexplore.exe
[7] 2008-04-22 . 197B7E4030CFBD8D2979D375E1787AA2 . 625664 . . [7.00.6000.20815] . . c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\iexplore.exe
[7] 2008-04-22 . 232B22817B90AE0AFF2D189E3E3735AC . 625664 . . [7.00.6000.16674] . . c:\windows\ie7updates\KB953838-IE7\iexplore.exe
[7] 2008-04-14 . 55794B97A7FAABD2910873C85274F409 . 93184 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\iexplore.exe
[7] 2008-02-29 . 2D0E5592AB5A46C27DAF7CCAFF4F5B59 . 625664 . . [7.00.6000.16640] . . c:\windows\ie7updates\KB950759-IE7\iexplore.exe
[7] 2008-02-22 . 6E0888626E0CAC79F57149814E22DB4D . 625664 . . [7.00.6000.20772] . . c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\iexplore.exe
[7] 2007-12-06 . 2703D940A62B731AA220529DD7331A78 . 625664 . . [7.00.6000.16608] . . c:\windows\ie7updates\KB947864-IE7\iexplore.exe
[7] 2007-12-06 . 809D17D8FA0FDAEE07778CD821CAFFDE . 625664 . . [7.00.6000.20733] . . c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\iexplore.exe
[7] 2007-10-10 . E854D02E4231F704D9BE782A424E6D8B . 625152 . . [7.00.6000.16574] . . c:\windows\ie7updates\KB944533-IE7\iexplore.exe
[7] 2007-10-10 . 632BDE0179847234433CA50945442ACB . 625664 . . [7.00.6000.20696] . . c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\iexplore.exe
[7] 2007-08-17 . 3AC2BC667DA0AF2C968E96E1630F5AB5 . 625152 . . [7.00.6000.16544] . . c:\windows\ie7updates\KB942615-IE7\iexplore.exe
[7] 2007-08-17 . 5577D0E3AC2F9F035ACD81B44AF5F511 . 625152 . . [7.00.6000.20661] . . c:\windows\$hf_mig$\KB939653-IE7\SP2QFE\iexplore.exe
[7] 2007-06-27 . BD8502DFD53FC24FB8D6929DC46B8C2C . 625152 . . [7.00.6000.20627] . . c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\iexplore.exe
[7] 2007-06-27 . 275CEE268B9E5D82474C43D5D249D111 . 625152 . . [7.00.6000.16512] . . c:\windows\ie7updates\KB939653-IE7\iexplore.exe
[7] 2007-04-24 . 10BDB55982586A432A3951EB19A26009 . 625152 . . [7.00.6000.16473] . . c:\windows\ie7updates\KB937143-IE7\iexplore.exe
[7] 2007-04-24 . 9B3516C1F30DA17ADD3818573047D63C . 625152 . . [7.00.6000.20583] . . c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\iexplore.exe
[7] 2007-01-09 . 93A6A4F5293AE19E3B37021AABCF0902 . 623616 . . [7.00.6000.16414] . . c:\windows\ie7updates\KB933566-IE7\iexplore.exe
[-] 2006-10-17 . 5334D4461AA92A7B008755FE6D13C5F2 . 622080 . . [7.00.5730.11] . . c:\windows\ie7updates\KB928090-IE7\iexplore.exe
[7] 2004-08-04 . E7484514C0464642BE7B4DC2689354C8 . 93184 . . [6.00.2900.2180] . . c:\windows\ie7\iexplore.exe
.
.
[7] 2010-12-09 . A531BBD3DE13121C1380ED7DC99082DB . 2192768 . . [5.1.2600.6055] . . c:\windows\$hf_mig$\KB2393802\SP3QFE\ntoskrnl.exe
[7] 2010-12-09 . 60E16152D847D7A7B7D3DA4C4B8E2120 . 2148864 . . [5.1.2600.6055] . . c:\windows\system32\ntoskrnl.exe
[7] 2010-12-09 . 64C1ADF6DF629F340C5A439FE0EF8ED1 . 2192768 . . [5.1.2600.6055] . . c:\windows\Driver Cache\i386\ntoskrnl.exe
[7] 2010-12-09 . 64C1ADF6DF629F340C5A439FE0EF8ED1 . 2192768 . . [5.1.2600.6055] . . c:\windows\system32\dllcache\ntoskrnl.exe
[7] 2010-04-27 . 466A3E1239F4A9428797730E81A7A865 . 2146304 . . [5.1.2600.5973] . . c:\windows\$NtUninstallKB2393802$\ntoskrnl.exe
[7] 2010-04-27 . A2ABBEC40CDB57454645D06B7EBD22F5 . 2190080 . . [5.1.2600.5973] . . c:\windows\$hf_mig$\KB981852\SP3QFE\ntoskrnl.exe
[7] 2010-02-16 . 048DB3459FAB4CA741DCC84E1F374D65 . 2146304 . . [5.1.2600.5938] . . c:\windows\$NtUninstallKB981852$\ntoskrnl.exe
[7] 2010-02-16 . E1F653A542449D54FA2D27463D99B6B6 . 2190080 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntoskrnl.exe
[7] 2009-12-09 . 05BE3D9A71972223AFF6A3C823BA51B1 . 2189312 . . [5.1.2600.5913] . . c:\windows\$hf_mig$\KB977165\SP3QFE\ntoskrnl.exe
[7] 2009-12-08 . 9696C553F994340CD6AA5C5A724C3A19 . 2145280 . . [5.1.2600.5913] . . c:\windows\$NtUninstallKB979683$\ntoskrnl.exe
[7] 2009-08-04 . 78FCC97CD878D4CF5B5D2158A5A7CF92 . 2145280 . . [5.1.2600.5857] . . c:\windows\$NtUninstallKB977165$\ntoskrnl.exe
[7] 2009-08-04 . FDE779EA1A564EBFE16F4E0F82B61BAD . 2189312 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3QFE\ntoskrnl.exe
[7] 2009-02-08 . EFE8EACE83EAAD5849A7A548FB75B584 . 2189184 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[7] 2009-02-06 . 0CBA44D0938D57F334C0862424148B70 . 2145280 . . [5.1.2600.5755] . . c:\windows\$NtUninstallKB971486$\ntoskrnl.exe
[7] 2008-08-14 . 31914172342BFF330063F343AC6958FE . 2189184 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
[7] 2008-08-14 . F6F8245B3A2E9CA834DD318E7AE0C6D0 . 2145280 . . [5.1.2600.5657] . . c:\windows\$NtUninstallKB956572$\ntoskrnl.exe
[7] 2008-04-13 . 0C89243C7C3EE199B96FCC16990E0679 . 2188928 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntoskrnl.exe
[-] 2007-02-28 . 5A5C8DB4AA962C714C8371FBDF189FC9 . 2182144 . . [5.1.2600.3093] . . c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
[-] 2007-02-28 . 1220FAF071DEA8653EE21DE7DCDA8BFD . 2136064 . . [5.1.2600.3093] . . c:\windows\$NtServicePackUninstall$\ntoskrnl.exe
[-] 2005-03-02 . 28187802B7C368C0D3AEF7D4C382AABB . 2179456 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
.
[7] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\srsvc.dll
[7] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
[7] 2004-08-04 . 92BDF74F12D6CBEC43C94D4B7F804838 . 170496 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\srsvc.dll
.
[7] 2008-04-14 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\w32time.dll
[7] 2008-04-14 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\system32\w32time.dll
[7] 2004-08-04 . 2B281958F5D0CF99ED626E3EF39D5C8D . 174592 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\w32time.dll
.
[7] 2008-04-14 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wiaservc.dll
[7] 2008-04-14 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\system32\wiaservc.dll
[-] 2006-12-19 . D9F097AA3B97034D3358A01B43E635B2 . 333824 . . [5.1.2600.3051] . . c:\windows\$hf_mig$\KB927802\SP2QFE\wiaservc.dll
[-] 2006-12-19 . B6763F8534AC547CF1AF98AFDFF2EDC8 . 333824 . . [5.1.2600.3051] . . c:\windows\$NtServicePackUninstall$\wiaservc.dll
.
[7] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\midimap.dll
[7] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\midimap.dll
[7] 2004-08-04 . 3B4702155BB2AE9DC00C06A68834BDFA . 18944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\midimap.dll
.
[7] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\rasadhlp.dll
[7] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\rasadhlp.dll
[-] 2006-06-26 . B5D08C96B2DADAF5171FB69E341B272B . 7680 . . [5.1.2600.2938] . . c:\windows\$hf_mig$\KB920683\SP2QFE\rasadhlp.dll
[-] 2006-06-26 . 5F098BD2AE6B03044B085DECFFDF91EC . 8192 . . [5.1.2600.2938] . . c:\windows\$NtServicePackUninstall$\rasadhlp.dll
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-06-03 1957888]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sunkist2k"="c:\program files\Multimedia Card Reader\shwicon2k.exe" [2004-08-07 135168]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"WD Button Manager"="WDBtnMgr.exe" [2007-12-26 364544]
"nwiz"="nwiz.exe" [2006-08-08 1519616]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2005-07-08 1397760]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 32768]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-23 202256]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-06 421888]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-10-10 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-09-01 449608]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
WD Backup Monitor.lnk - c:\program files\My Book\WD Backup\uBBMonitor.exe [2007-12-26 98304]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^MSI^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\MSI\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58	37296	----a-w-	c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-04 01:43	69632	----a-w-	c:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDog303]
2005-10-25 20:56	61440	----a-w-	c:\windows\VM303_STI.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
2003-08-20 21:57	221184	----a-w-	c:\program files\HP\hpcoretech\hpcmpmgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2003-06-25 18:24	49152	----a-w-	c:\program files\Hewlett-Packard\HP Software Update\hpwuSchd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2003-07-25 14:14	188416	----a-w-	c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
2003-08-20 21:15	483328	----a-r-	c:\windows\system32\hphmon05.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD05]
2003-08-20 21:23	49152	----a-r-	c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-10-10 01:06	421736	----a-w-	c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
2002-11-08 10:50	19968	------w-	c:\windows\LOGI_MWX.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2000-08-08 20:00	311350	----a-w-	c:\program files\Microsoft Works\wkssb.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2000-08-08 20:00	28739	----a-w-	c:\program files\Microsoft Works\WkDetect.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2006-08-11 13:43	7630848	----a-r-	c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2006-08-11 13:43	86016	----a-r-	c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2006-08-08 21:54	1519616	----a-w-	c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2007-02-04 20:02	79400	----a-w-	c:\program files\ScanSoft\OmniPageSE4\OpWareSE4.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-07-06 01:36	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-11-15 00:21	16270848	----a-w-	c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-17 01:04	2879488	----a-w-	c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 17:03	210472	----a-w-	c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX3000]
2006-10-14 01:04	707376	----a-w-	c:\windows\vVX3000.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule]
2006-07-08 00:15	348160	----a-w-	c:\program files\WinFast\WFTVFM\WFWIZ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2000-08-08 20:00	24576	----a-w-	c:\program files\Microsoft Works\wkfud.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
2003-04-07 10:16	631364	----a-w-	c:\program files\Logitech\iTouch\iTouch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"UleadBurningHelper"=2 (0x2)
"NVSvc"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"gusvc"=3 (0x3)
"FSMA"=2 (0x2)
"FSDFWD"=3 (0x3)
"FSAUA"=3 (0x3)
"F-Secure Gatekeeper Handler Starter"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"iPod Service"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"Pml Driver HPZ12"=3 (0x3)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Photo Story 3 for Windows\\PhotoStory3.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDPHCP Discovery Service
.
R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [7/14/2009 1:06 PM 101120]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/25/2008 1:09 PM 717296]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11/6/2011 6:55 PM 366152]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/6/2011 6:54 PM 22216]
S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2/28/2011 5:44 PM 183560]
S3 cpuz134;cpuz134;\??\c:\docume~1\MSI\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys --> c:\docume~1\MSI\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys [?]
S3 HwIOctl;HwIOctl; [x]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [5/6/2009 5:36 PM 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [5/6/2009 5:36 PM 8320]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [5/6/2009 5:36 PM 23680]
S3 SunkFilt6;Alcor Micro Corp - 6360; [x]
S3 SunkFilt62;Alcor Micro Corp - 6362;c:\windows\system32\drivers\sunkfilt62.sys [7/23/2004 1:55 PM 46536]
S3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [11/9/2007 11:24 PM 9446]
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]
.
2011-10-19 c:\windows\Tasks\HP DArC Task 2003-08-20 09:23ewlett-Packard-6002003-08-20 21:57Y35J1235G7I.job
- c:\program files\HP\hpcoretech\comp\hpdarc.exe [2003-08-20 21:57]
.
2011-11-07 c:\windows\Tasks\HP Usg Daily.job
- c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\pexpress\hphped05.exe [2008-07-19 21:23]
.
2011-11-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-18.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1935655697-1482476501-839522115-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1935655697-1482476501-839522115-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-06 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-18.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1935655697-1482476501-839522115-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-10-25 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1935655697-1482476501-839522115-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: Translate this web page with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
Trusted Zone: com.tw\www.msi
TCP: DhcpNameServer = 192.168.0.1
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab
FF - ProfilePath - c:\documents and settings\MSI\Application Data\Mozilla\Firefox\Profiles\83u7yg77.default\
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FF - prefs.js: browser.startup.homepage - hxxp://search.babylon.com/home?AF=100581
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=adbartrp&AF=100581&q=
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
FF - Ext: Babylon: ffxtlbr@babylon.com - %profile%\extensions\ffxtlbr@babylon.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{7B13EC3E-999A-4B70-B9CB-2617B8323822} - (no file)
SafeBoot-57283306.sys
MSConfigStartUp-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
MSConfigStartUp-DAEMON Tools Lite - c:\program files\DAEMON Tools Lite\daemon.exe
MSConfigStartUp-F-Secure Manager - c:\program files\Shaw Secure\Common\FSM32.EXE
MSConfigStartUp-F-Secure TNB - c:\program files\Shaw Secure\FSGUI\TNBUtil.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-07 18:20
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...  
.
scanning hidden autostart entries ... 
.
scanning hidden files ...  
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,31,80,80,66,53,57,d0,44,95,13,fe,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,31,80,80,66,53,57,d0,44,95,13,fe,\
.
[HKEY_USERS\S-1-5-21-1935655697-1482476501-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1668)
c:\windows\system32\WININET.dll
c:\windows\system32\nview.dll
c:\windows\system32\nvwddi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Ahead\InCD\InCDsrv.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\BingBar\SeaPort.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\WDBtnMgr.exe
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2011-11-07  18:29:53 - machine was rebooted
ComboFix-quarantined-files.txt  2011-11-08 02:29
ComboFix2.txt  2007-12-13 09:49
.
Pre-Run: 284,474,368,000 bytes free
Post-Run: 286,028,894,208 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /usepmtimer /NoExecute=OptIn
.
- - End Of File - - 260E3F1C33BBAE084DA9C3C66BEEBFEB


----------



## kona

John
Man - that is a lot of stuff to sift through !!!

*I don't think I downloaded HiJackThis to begin with...........I'll have to go back and see.*

If not - and I do have to download it to past a log here - is it safe to go download it (hiJackThis) without an antivirus software on my pc?

Should I get Avast ......and I do have the Malwarebytes that I can reactivate right?


----------



## johnb35

You can download hijackthis without antivirus installed.  Just follow the link I gave you.  I would either recommend avast or Microsoft Security Essentials.


----------



## kona

Thanks John I see it - the HijackThis link.

Just wondering.......when I click on a link lately....and right now on the HijackThis link I get Search the web (Babylon) in my search window in the upper right of my screen. 


 And I also get this message:
"To help protect your security Internet Explorer blocked this file from downloading on your computer.  Click here for options"

I click on Download File
And then I get a blank screen with about:blank in the browser and search the web (Babalon) in the smaller search space to the right (the smaller Windows search place in the upper right)
It seems like nothing is happening - the file is not opening.  Should I just do a search on the web and find it that way?

Oh sh*t........I posted this and now I see the run file box of the program hiJackThis sitting on my desktop...........dohh!


----------



## johnb35

Using IE as your browser?  You may need to right click on that link and click on open in new window.  You have some crapware installed and I was gonna have you post a log for me to go through that combofix creates for us.

Please navigate to C:\qoobox in that folder will be a file named "add-remove programs.txt"  Please open that log and copy and paste the contents back here.


----------



## kona

*The hijackthis log*

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:42:19 PM, on 11/7/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\My Book\WD Backup\uBBMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Babylon IE plugin - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (file missing)
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: WD Backup Monitor.lnk = C:\Program Files\My Book\WD Backup\uBBMonitor.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
O8 - Extra context menu item: Translate this web page with Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
O8 - Extra context menu item: Translate with Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (file missing)
O9 - Extra 'Tools' menuitem: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aolsvc.aol.com/onlinegames/bejeweled2/popcaploader_v10.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O18 - Protocol: intu-qt2008 - {05E53CE9-66C8-4A9E-A99F-FDB7A8E7B596} - C:\Program Files\QuickTax 2008\ic2008pp.dll
O18 - Protocol: intu-qt2009 - {03947252-2355-4E9B-B446-8CCC75C43370} - C:\Program Files\QuickTax 2009\ic2009pp.dll
O18 - Protocol: intu-tt2010 - {97A0575E-2309-4E75-8509-B1F9390C4DE7} - C:\Program Files\TurboTax 2010\ic2010pp.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/MSI/LOCALS~1/Temp/msohtmlclip1/01/clip_image002.jpg

--
End of file - 10740 bytes


----------



## kona

johnb35 said:


> Using IE as your browser?  You may need to right click on that link and click on open in new window.  You have some crapware installed and I was gonna have you post a log for me to go through that combofix creates for us.
> 
> Please navigate to *C:\qoobox *in that folder will be a file named "add-remove programs.txt"  Please open that log and copy and paste the contents back here.



John - I can't find a file (or place) called goobox in the C: drive - I even did a search..........nothing came up.


----------



## johnb35

It's Qoobox not goobox.

please rerun hijackthis and place checks next to the following entries.

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrow serrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Babylon IE plugin - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (file missing)
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O15 - Trusted Zone: http://www.msi.com.tw

Then click on fix checked at the bottom.


----------



## kona

Haha - sorry - ya qoobox...here it is..


AAC Decoder
ACDSee for PENTAX 3.0
ACE Mega CoDecS Pack
Acrobat.com
Adobe Acrobat 5.0
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Flash Player 11 ActiveX
Adobe Reader 9.4.6
Adobe Shockwave Player 11.6
Any Video Converter 2.6.7
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AutoUpdate
Avanquest update
Bing Bar
Canon Camera Access Library
Canon Camera Support Core Library
Canon G.726 WMP-Decoder
Canon MovieEdit Task for ZoomBrowser EX
Canon MP Navigator EX 1.0
Canon MP210 series
Canon My Printer
Canon RAW Image Task for ZoomBrowser EX
Canon Utilities CameraWindow
Canon Utilities CameraWindow DC
Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
Canon Utilities Easy-PhotoPrint EX
Canon Utilities EOS Utility
Canon Utilities MyCamera
Canon Utilities MyCamera DC
Canon Utilities PhotoStitch
Canon Utilities RemoteCapture DC
Canon Utilities RemoteCapture Task for ZoomBrowser EX
Canon Utilities ZoomBrowser EX
Canon ZoomBrowser EX Memory Card Utility
CCleaner (remove only)
Citrix XenApp Web Plugin
Critical Update for Windows Media Player 11 (KB959772)
DigitImg
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Plus Web Player
DivX Version Checker
DVD Shrink 3.2
DVD Solution
Express Burn
Express Rip
ffdshow (remove only)
Golden Records Vinyl to CD Converter
Google Earth
H.264 Decoder
High Definition Audio Driver Package - KB888111
Highlight Viewer (Windows Live Toolbar)
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP Memories Disc
HP Software Update
HTML Slideshow Powertoy for Windows XP
IBM OnDemand AFP Web Viewer
Image Resizer Powertoy for Windows XP
ImagXpress
InCD
iTunes
Java Auto Updater
Java(TM) 6 Update 29
Java(TM) 6 Update 7
Junk Mail filter update
Logitech Harmony Remote Software 7
Logitech iTouch Software
Logitech MouseWare 9.75 
Malwarebytes' Anti-Malware version 1.51.2.1300
Map Button (Windows Live Toolbar)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2572067)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office Live Add-in 1.3
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Picture It! Publishing 2001
Microsoft Silverlight
Microsoft Software Update for Web Folders  (English) 12
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works 2001 Setup Launcher
Microsoft Works 6.0
Microsoft Works Suite Add-in for Microsoft Word
MKV Splitter
Motorola Driver Installation 3.7.0
Motorola Phone Tools
Motorola Software Update
Mozilla Firefox (3.6.15)
MSN
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB933579)
Multimedia Card Reader
Multimedia Launcher
Nero OEM
neroxml
NVIDIA Drivers
OLYMPUS CAMEDIA Master 4.1
OpenOffice.org Installer 1.0
Photo Story 3 for Windows
Photosmart 140,240,7200,7600,7700,7900 Series
Picasa 3
PIXMA Extended Survey Program
PowerDVD
PowerProducer
Prism Video Converter
Product Key Explorer 1.9.2
PS7600
PSShortcuts
PSUsage
QuickTax 2008
QuickTax 2009
QuickTime
RAD Video Tools
RealNetworks - Microsoft Visual C++ 2005 Runtime
RealPlayer
Realtek High Definition Audio Driver
RealUpgrade 1.0
Remote Control USB Driver
Rhapsody Player Engine
ScanSoft OmniPage SE 4
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2553074)
Security Update for 2007 Microsoft Office System (KB2553089)
Security Update for 2007 Microsoft Office System (KB2553090)
Security Update for 2007 Microsoft Office System (KB2584063)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft Office Excel 2007 (KB2553073)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Segoe UI
ShareIns
Shockwave
Simply Accounting 2005 Basic
Smart Menus (Windows Live Toolbar)
SoundTap Streaming Audio Recorder
SpiralFrog Download Manager 0.8.24
Switch Sound File Converter
swMSM
T4 Internet - T4 par Internet 9.0
TurboTax 2010
Ulead COOL 3D 3.0
Ulead DVD MovieFactory 3 SE
Ulead VideoStudio 8.0 SE DVD
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 8 (KB975364)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
URGE
USB PC Camera H
VC80CRTRedist - 8.0.50727.4053
VLC media player 1.0.0
WavePad Sound Editor
WD Backup
WD Diagnostics
WD Firewire HID Driver
WebFldrs XP
Windows Driver Package - Advanced Micro Devices (AmdK8) Processor  (05/27/2006 1.3.2.0)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Favorites for Windows Live Toolbar
Windows Live ID Sign-in Assistant
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sync
Windows Live Toolbar Extension (Windows Live Toolbar)
Windows Live Upload Tool
Windows Live Writer
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Presentation Foundation
Windows Rights Management Client Backwards Compatibility SP2
Windows Rights Management Client with Service Pack 2
Windows XP Service Pack 3
WinFast Entertainment Center
WinFast PVR
WinFast(R) Display Driver
Works Suite OS Pack
Works Synchronization
XML Paper Specification Shared Components Pack 1.0


----------



## kona

John - I printed this and went through and made sure I checked all that you listed here and clicked on "fix checked" at the bottom.  I got a message to close all browser openings for bes tresults but I had the window open to cover the this internt program...the Forum.  I clicked okay in the box and quickly closed this site out.  I guess it worked.

Should I run it again?




johnb35 said:


> It's Qoobox not goobox.
> 
> please rerun hijackthis and place checks next to the following entries.
> 
> O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrow serrecordplugin.dll
> O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
> O2 - BHO: Babylon IE plugin - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (file missing)
> O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
> O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
> O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
> O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
> O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
> O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
> O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
> O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
> O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
> O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
> O15 - Trusted Zone: http://www.msi.com.tw
> 
> Then click on fix checked at the bottom.



I've used Avast in the Past.....I liked it but only switched to f-Secure because it was supported by my service provider Shaw Internet.  I will go back to Avast.

Do you have a preferred "Link" to the Avast download or any particular site to go to?

Should I wait until your analysis is complete before downloading and installing Avast?

Just a note.....while I'm on this page I'm getting an orange sheild with an exclamation mark in it in an address bar near the top of my screen that says 
An add-on for this website failed to run. Check the security settings in Internet Options for potential conflicts.

Mentioning only because we're doing this right now and thought it may be significant.....


----------



## johnb35

I went to bed last night, thats why I haven't responded until now.

Please uninstall the following programs.

Adobe Acrobat 5.0
Java(TM) 6 Update 7
RealUpgrade


Open firefox and uninstall babylon from your addons.

Get avast from here.

http://download.cnet.com/Avast-Free-Antivirus/3000-2239_4-10019223.html



1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box



		Code:
	

Killall::

File::

c:\windows\system32\roboot.exe

Dirlook::
c:\documents and settings\MSI\Local Settings\Application Data\12eba47c


Folder:

c:\documents and settings\MSI\Application Data\Systweak
c:\documents and settings\MSI\Application Data\BabylonToolbar
c:\program files\Babylon


3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!







ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.


I also want you to run an online eset scan.

Please download and run the ESET Online Scanner
Disable any antivirus/security programs.
IMPORTANT! UN-check Remove found threats 
Accept any security warnings from your browser. 
Check Scan archives 
Click Start 
ESET will then download updates, install and then start scanning your system. 
When the scan is done, push list of found threats 
Click on Export to text file , and save the file to your desktop using a file name, such as ESETlog. Include the contents of this report in your next reply. 
If no threats are found then it won't produce a log.


----------



## kona

Firefox opens in safe mode.
I can only delete ALL add-ons from this safe mode.

I don't use Fire Fox.  Should I just uninstall it?

YES - YOU NEED SLEEP - I forgot ...........just kidding.


----------



## johnb35

If you don't use it, uninstall it yes.


----------



## kona

I already have Avast running fine - I downloaded it last night - seems to be okay

Fire Fox and all add-ons and cookies etc are now removed (uninstalled)

I still get that search the web (Babylon) in my upper right small browzer box??

John - if I can do what you ask  in your post of 05:44 hrs above within the next twenty minutes I will do it - if not I will have to do it after work. It's 07:13 here and I have to leave for work in 20 minutes from now. Should I leave it until after work???


----------



## johnb35

I can have you reset internet explorer's settings.  Do this.  Go into internet options either by opening IE and click on tools then internet options or you can click on it in control panel.  Then click on advanced tab.  Then click on restore advanced settings and the reset button.  Make sure when it asks you if you want to delete personal settings, you click on yes.


----------



## kona

Okay - I did that. Now my internet settings are turned off (orange shield message in a bar above) - should I click for options?

And I got a pop up wanting me to download IE 8.............I said ask me later ---should I install it??


----------



## johnb35

With internet explorer open, click on the help menu, click on about.  Tell me which version it says.  Should already be 8.  I believe what you are seeing is setting up settings and stuff.  That happens when you reset IE settings.  Go ahead and go through it.


----------



## kona

Now I get "Bing.com" when I'm doing a web search????  Is that just a WIndows search engine?


----------



## kona

It says IE 8 - yes I already have it

I see you're multi tasking John.........

I have to go to work now - this is looking good right? 

I will continue at around 530-6pm or so.

Thanks,

Gary




johnb35 said:


> With internet explorer open, click on the help menu, click on about.  Tell me which version it says.  Should already be 8.  I believe what you are seeing is setting up settings and stuff.  That happens when you reset IE settings.  Go ahead and go through it.


----------



## johnb35

Yes thats the default search engine.  You can change by clicking on the down arrow to the right of the magnifying glass up top, click on manage search providers.


----------



## kona

I searched google.com and when I got there I went to options and clicked use current and applied.  I think Google.com is my search engine now right?

Oh sh*t I'm late for work - gotta go - thanks!


----------



## kona

I tried to run combofix when I drug the cfscript txt file into it.  It started and then asked me if I wanted to update Combofix as there was an update available.  I said no.  Then I had trouble with Avast interfering and the combofix software kept giving me messages that I didn't know how to deal with.  I went away for a few minutes because it said it would take 10 mins or more to run.  When I came back I was at the login for my desktop window.  I clicked to log in and there was nothing but my desktop......no log.  I disabled Avast and droped the cfscript file into combofix again.  It got to the second stage of completion and just hung there.........for more than 20 mins - no light blinking on my pc to say there was something running.  The blue light (the power light) was on - that's it.  I got impatiant because I'm sure nothing was happening.......I tried to reboot........nothing happened.  Then I tried to shut the pc down - nothing again.  I finally physically pushed the restart button on the tower and posted this.


----------



## kona

Can't seem to get the combofix software to run properly.  Am I suppose to disconnect Avast before running it?  I'm getting all kinds of questions from the Avast software when I try running combofix.  The main theme for the questions is "you are opening an application that my be potentially unsafe we strongly recommend to open the file(s) in Virtual environment of the Avast.Sandbox to avoid rist to your Computer"  Not in these exact words..........because it would not let me click on the message to copy it to show you ........but the above is pretty close to what was(is) in the box.  When I click to continue another box with another "potentially harmful" file is displayed - with the same AVast.Sandbox suggestion.


----------



## voyagerfan99

Yes, disable avast and delete the current copy of Combofix on your desktop. Go back to the Combofix download link and download a new, updated copy. Then drag the script over Combofix.


----------



## johnb35

To disable avast right click on the icon in the system tray and click on "avast shields control" and then click on "until computer is restarted"

Also I disable the sandbox setting. open avast, click on additional protection, click on autosandbox, Click on settings, uncheck the box.


----------



## kona

I've had trouble getting back on the internet a few time tonight.
no connection message..........then after rebooting a few times - got here.

Can't get past "Completed Stage 2" of the Combofix.

I deleted the copy of combofix I had.......went back here and downloaded it again.......copied the killall file box you told me to do - ran notepad pasted the killall file there - saved it as CFScript.txt as instructed.  Then I drug it to the newly downloaded Combofix Icon and everything looked good (yes I disabled Avast until next startup).  But..........I only get to the stage 2 and everything seems to stop.....no little activity light blinking on my tower.  I left it alone for a good 40 minutes or so....just to see..........but nothing.  So I tried to shut down but couldn't......had to push the restart button .....again.  Should I just go ahead and download the ESET online scanner and go from there?????


----------



## johnb35

Yes, do the online scan and hold off on combofix for the time being.


----------



## kona

*POSTING ESETlog txt file*

C:\Documents and Settings\MSI\Application Data\Sun\Java\Deployment\cache\6.0\16\3f154490-1b452189	multiple threats
C:\Documents and Settings\MSI\Application Data\Sun\Java\Deployment\cache\6.0\47\1f21f96f-11b3f1f2	Java/Agent.DU trojan
C:\Documents and Settings\MSI\Application Data\Sun\Java\Deployment\cache\6.0\62\23146dfe-5a21eb55	a variant of Java/TrojanDownloader.OpenStream.NBF trojan
C:\Documents and Settings\MSI\Local Settings\temp\Av-test.txt	Eicar test file
C:\Documents and Settings\ROSEMARY\Application Data\Mozilla\Firefox\Profiles\zv8tm84t.default\extensions\textlinks@playsushi.com\components\PlaySushiFF.dll	probably a variant of Win32/Adware.Gamevance.AG application
C:\qoobox\Quarantine\C\Documents and Settings\MSI\Local Settings\Application Data\12eba47c\U\800000cf.@.vir	probably a variant of Win32/Kryptik.JDI trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0370980.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0371003.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0372003.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0372089.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0372094.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0372105.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0372106.ini	a variant of Win32/Sirefef.CH trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0372110.exe	Win32/Patched.HN trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0373105.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0373106.ini	a variant of Win32/Sirefef.CH trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0373112.exe	Win32/Patched.HN trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0373115.exe	Win32/Patched.HN trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0374105.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0374106.ini	a variant of Win32/Sirefef.CH trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0374110.exe	Win32/Patched.HN trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0375105.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0375106.ini	a variant of Win32/Sirefef.CH trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0375110.exe	Win32/Patched.HN trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0375129.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0375130.ini	a variant of Win32/Sirefef.CH trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0376128.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0376129.ini	a variant of Win32/Sirefef.CH trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0376133.exe	Win32/Patched.HN trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0376138.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0376139.ini	a variant of Win32/Sirefef.CH trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0377141.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0377142.ini	a variant of Win32/Sirefef.CH trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0378141.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0378142.ini	a variant of Win32/Sirefef.CH trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0378146.exe	Win32/Patched.HN trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0379141.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0379142.ini	a variant of Win32/Sirefef.CH trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0379146.exe	Win32/Patched.HN trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0379159.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0379160.ini	a variant of Win32/Sirefef.CH trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0380159.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0380160.ini	a variant of Win32/Sirefef.CH trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0380163.exe	Win32/Patched.HN trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0380164.exe	Win32/Patched.HN trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0381159.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0381160.ini	a variant of Win32/Sirefef.CH trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1605\A0381165.exe	Win32/Patched.HN trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1606\A0381208.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1606\A0381209.ini	a variant of Win32/Sirefef.CH trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1606\A0381212.exe	Win32/Patched.HN trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1606\A0382208.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1606\A0382209.ini	a variant of Win32/Sirefef.CH trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1606\A0382213.exe	Win32/Patched.HN trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1606\A0383208.sys	Win32/Rootkit.Agent.NUT trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1606\A0383209.ini	a variant of Win32/Sirefef.CH trojan
C:\System Volume Information\_restore{F5CEBD4F-577E-4B5C-8DC3-14A76DB1F8A9}\RP1606\A0384277.ini	a variant of Win32/Sirefef.CH trojan


----------



## kona

It looks like I have more than ONE Trogan


----------



## johnb35

Ok, not bad, simple to get rid of.

1.

Follow the instructions on this page to delete your java cache.

http://www.java.com/en/download/help/plugin_cache.xml

2.

We need to turn system restore off and then turn it back on again.

Right click on "my computer" click on properties, click on the system restore tab, check the box to turn off system restore, click apply, click ok. Then go back into it and uncheck the box to turn system restore back on.  This will delete those and all restore points you have on your system.

3.

Manually delete this file.  You will need to change the options to show hidden files and folders though.

C:\Documents and Settings\MSI\Local Settings\temp\Av-test.txt

4.

If you haven't done so already please download and run ccleaner.

http://download.cnet.com/ccleaner/

Download, install and open program, don't change any options, click on run cleaner then can you try running combofix again for me?


----------



## kona

I've gotten down to manually delete this file:

and even though I go to MSI and change and apply and okay I can't see the "Locl Settings" file.

How do I get to 
C:\documents and settings\msi\local settings\temp\av-test.txt  ????


----------



## kona

okay - I did a search in C drive and found the file and deleted it.....is that the right thing to do here?


----------



## kona

Do I turn off Avast when I use C Cleaner??


----------



## johnb35

No need to turn avast off.  just run it.


----------



## kona

When I ran c cleaner I didn't want all the "extra" add-ons and new software alerts they wanted to give to me so I unchecked all their adds and just ran the c cleaner -  is that right?
It found a lot of files that were deleted but I could not copy the list (I tried to hilight it).

I have to go to work again so I will try to run combofix at 6 tonight PST.  I have to work overtime tonight 730- midnight or later so that sucks for getting this done.  I'll do what I can tonight.....thanks!
Gary


----------



## johnb35

You can't post what ccleaner deletes.  Hopefully combofix will run.


----------



## kona

Sorry - I guess the cleaner may not have deleted what it found - is that right?  I'm at work right now so I don't have access to my computer.  
I meant I was trying to copy the list that the ccleaner posted and I couldn't access the list - I tried to click onto it and nothing happend.  I was trying to copy it to show you - that's all.
Ya - I hope I will be able to run Combofix tonight.
I will remember to go in and disable the sandbox feature in Avast and I will disable Avast - to enable again upon reboot - before I run Combofix.

Should I delete the Combofix on my desktop now - the one I downloaded yesterday - and go here and download it again....tonight??



johnb35 said:


> You can't post what ccleaner deletes.  Hopefully combofix will run.


----------



## johnb35

Providing you clicked on run cleaner and not Ln analyze then it deleted whatever it found automatically.  It may help to delete the existing combofix and download a new copy.


----------



## kona

It took me forever to get back onto the internet tonight.....I keep getting two internet connections whenever I click onto IE.  And, my Favorites were all reorganized....?  I couldn't find this website - it took me a while to hunt it down - I kept getting other ComputerForums.   Ho well - I'm here now - ready to get started .....again


----------



## kona

John - I deleted the copy of combofix that was on my desktop and I downloaded a new one.  I disabled malware and avast - sandbox within avast was disabled as well.  I ran it - and got the same problem.  It gets to the completion of Stage 2 and then my pc seems to hangup.........no activity light blinking.....nothing.  I went downstairs and played my drums for 1/2 hr and came back....still just nothing.  So I xed out of the program.  There is no way I could get an internet connection....even after I engaged avast and malware.  I rebooted and then I got back on here.
What's next?  This is so frustrating.............don't get me wrong - I really appreciate the help and hope this pc will get well with your help.  I'm working double shift today - go back to work in an hour or so...............the poachers never rest at this time of the year.


----------



## johnb35

Try running combofix in safe mode.


----------



## kona

*It seemed to work in safe mode - all 50 + stages & log*

ComboFix 11-11-09.02 - MSI 11/09/2011  18:22:38.6.2 - x86 MINIMAL
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.3071.2646 [GMT -8:00]
Running from: c:\documents and settings\MSI\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
(((((((((((((((((((((((((   Files Created from 2011-10-10 to 2011-11-10  )))))))))))))))))))))))))))))))
.
.
2011-11-09 05:08 . 2011-11-09 05:08	--------	d-----w-	c:\program files\ESET
2011-11-09 01:42 . 2011-11-09 01:51	--------	d-----w-	C:\## aswSnx private storage
2011-11-08 05:27 . 2011-09-06 21:37	320856	----a-w-	c:\windows\system32\drivers\aswSP.sys
2011-11-08 05:27 . 2011-09-06 21:36	20568	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2011-11-08 05:27 . 2011-09-06 21:38	442200	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2011-11-08 05:27 . 2011-09-06 21:36	34392	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2011-11-08 05:27 . 2011-09-06 21:36	52568	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2011-11-08 05:27 . 2011-09-06 21:36	110552	----a-w-	c:\windows\system32\drivers\aswmon2.sys
2011-11-08 05:27 . 2011-09-06 21:36	104536	----a-w-	c:\windows\system32\drivers\aswmon.sys
2011-11-08 05:27 . 2011-09-06 21:33	30808	----a-w-	c:\windows\system32\drivers\aavmker4.sys
2011-11-08 05:27 . 2011-09-06 21:45	41184	----a-w-	c:\windows\avastSS.scr
2011-11-08 05:27 . 2011-09-06 21:45	199304	----a-w-	c:\windows\system32\aswBoot.exe
2011-11-08 05:26 . 2011-11-08 05:26	--------	d-----w-	c:\program files\AVAST Software
2011-11-08 05:26 . 2011-11-08 05:26	--------	d-----w-	c:\documents and settings\All Users\Application Data\AVAST Software
2011-11-08 03:41 . 2011-11-08 03:41	388096	----a-w-	c:\documents and settings\MSI\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-11-07 02:54 . 2011-09-01 01:00	22216	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-11-07 02:54 . 2011-11-07 03:09	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-11-07 02:14 . 2011-11-07 02:14	--------	d-----w-	c:\documents and settings\MSI\Application Data\BabylonToolbar
2011-11-07 02:13 . 2011-11-07 02:13	--------	d-----w-	c:\program files\Babylon
2011-11-07 02:12 . 2011-11-07 02:47	--------	d-----w-	c:\documents and settings\MSI\Application Data\Systweak
2011-11-07 02:12 . 2011-09-30 23:37	17280	----a-w-	c:\windows\system32\roboot.exe
2011-11-06 20:05 . 2011-11-06 20:05	--------	d-sh--w-	c:\windows\system32\config\systemprofile\PrivacIE
2011-11-06 20:05 . 2011-11-06 20:05	--------	d-sh--w-	c:\windows\system32\config\systemprofile\IETldCache
2011-11-06 18:48 . 2011-11-08 02:15	--------	d-sh--w-	c:\documents and settings\MSI\Local Settings\Application Data\12eba47c
2011-10-13 05:58 . 2011-10-13 05:58	--------	d-----w-	c:\program files\iPod
2011-10-13 05:58 . 2011-10-13 05:59	--------	d-----w-	c:\program files\iTunes
2011-10-13 05:55 . 2011-10-13 05:55	--------	d-----w-	c:\documents and settings\LocalService\Application Data\Apple Computer
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-08 01:13 . 2004-08-04 12:00	64512	----a-w-	c:\windows\system32\drivers\serial.sys
2011-10-13 14:06 . 2011-05-17 00:32	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-10 14:22 . 2006-09-16 21:05	692736	----a-w-	c:\windows\system32\inetcomm.dll
2011-10-03 12:06 . 2010-05-08 17:33	472808	----a-w-	c:\windows\system32\deployJava1.dll
2011-10-03 09:37 . 2007-06-18 18:56	73728	----a-w-	c:\windows\system32\javacpl.cpl
2011-09-26 18:41 . 2007-10-09 21:03	611328	----a-w-	c:\windows\system32\uiautomationcore.dll
2011-09-26 18:41 . 2004-08-04 12:00	220160	----a-w-	c:\windows\system32\oleacc.dll
2011-09-26 18:41 . 2004-08-04 12:00	20480	----a-w-	c:\windows\system32\oleaccrc.dll
2011-09-09 09:12 . 2004-08-04 12:00	599040	----a-w-	c:\windows\system32\crypt32.dll
2011-09-06 13:20 . 2004-08-04 12:00	1858944	----a-w-	c:\windows\system32\win32k.sys
2011-08-22 23:48 . 2004-08-04 12:00	916480	----a-w-	c:\windows\system32\wininet.dll
2011-08-22 23:48 . 2004-08-04 12:00	43520	----a-w-	c:\windows\system32\licmgr10.dll
2011-08-22 23:48 . 2004-08-04 12:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2011-08-22 11:56 . 2004-08-04 12:00	385024	----a-w-	c:\windows\system32\html.iec
2011-08-17 13:49 . 2004-08-04 12:00	138496	----a-w-	c:\windows\system32\drivers\afd.sys
2010-06-02 15:15 . 2010-06-02 15:15	436	----a-w-	c:\program files\060220108152078.bat
2010-06-02 15:09 . 2010-06-02 15:09	445	----a-w-	c:\program files\060220108094678.bat
2004-10-01 22:00 . 2006-09-16 22:42	40960	----a-w-	c:\program files\Uninstall_CDS.exe
2009-05-01 21:02 . 2009-05-01 21:02	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
2007-12-26 21:06 . 2007-12-26 21:06	133120	----a-w-	c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
((((((((((((((((((((((((((((((((((((((((((((   Look   )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\documents and settings\MSI\Local Settings\Application Data\12eba47c ----
.
2011-11-06 18:48 . 2011-11-06 18:48	2048	--sha-w-	c:\documents and settings\MSI\Local Settings\Application Data\12eba47c\@
.
.
(((((((((((((((((((((((((((((   SnapShot@2011-11-08_02.20.35   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-12 08:02 . 2009-07-12 08:02	51008              c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
+ 2008-08-15 02:13 . 2011-10-10 14:22	692736              c:\windows\system32\dllcache\inetcomm.dll
- 2008-08-15 02:13 . 2011-05-02 15:31	692736              c:\windows\system32\dllcache\inetcomm.dll
+ 2011-11-08 05:27 . 2011-11-08 05:27	219648              c:\windows\Installer\ac13cd.msi
+ 2011-11-08 03:41 . 2011-11-08 03:41	1094656              c:\windows\Installer\4b9948.msi
+ 2006-09-16 21:59 . 2011-11-10 00:59	50295240              c:\windows\system32\MRT.exe
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 21:45	122512	----a-w-	c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sunkist2k"="c:\program files\Multimedia Card Reader\shwicon2k.exe" [2004-08-07 135168]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"WD Button Manager"="WDBtnMgr.exe" [2007-12-26 364544]
"nwiz"="nwiz.exe" [2006-08-08 1519616]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-10-10 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-09-01 449608]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
WD Backup Monitor.lnk - c:\program files\My Book\WD Backup\uBBMonitor.exe [2007-12-26 98304]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^MSI^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\MSI\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58	37296	----a-w-	c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-04 01:43	69632	----a-w-	c:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDog303]
2005-10-25 20:56	61440	----a-w-	c:\windows\VM303_STI.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
2003-08-20 21:57	221184	----a-w-	c:\program files\HP\hpcoretech\hpcmpmgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2003-06-25 18:24	49152	----a-w-	c:\program files\Hewlett-Packard\HP Software Update\hpwuSchd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2003-07-25 14:14	188416	----a-w-	c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
2003-08-20 21:15	483328	----a-r-	c:\windows\system32\hphmon05.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD05]
2003-08-20 21:23	49152	----a-r-	c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-10-10 01:06	421736	----a-w-	c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
2002-11-08 10:50	19968	------w-	c:\windows\LOGI_MWX.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2000-08-08 20:00	311350	----a-w-	c:\program files\Microsoft Works\wkssb.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2000-08-08 20:00	28739	----a-w-	c:\program files\Microsoft Works\WkDetect.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2006-08-11 13:43	7630848	----a-r-	c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2006-08-11 13:43	86016	----a-r-	c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2006-08-08 21:54	1519616	----a-w-	c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2007-02-04 20:02	79400	----a-w-	c:\program files\ScanSoft\OmniPageSE4\OpWareSE4.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-07-06 01:36	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-11-15 00:21	16270848	----a-w-	c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-17 01:04	2879488	----a-w-	c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 17:03	210472	----a-w-	c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX3000]
2006-10-14 01:04	707376	----a-w-	c:\windows\vVX3000.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule]
2006-07-08 00:15	348160	----a-w-	c:\program files\WinFast\WFTVFM\WFWIZ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2000-08-08 20:00	24576	----a-w-	c:\program files\Microsoft Works\wkfud.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
2003-04-07 10:16	631364	----a-w-	c:\program files\Logitech\iTouch\iTouch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"UleadBurningHelper"=2 (0x2)
"NVSvc"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"gusvc"=3 (0x3)
"FSMA"=2 (0x2)
"FSDFWD"=3 (0x3)
"FSAUA"=3 (0x3)
"F-Secure Gatekeeper Handler Starter"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"iPod Service"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"Pml Driver HPZ12"=3 (0x3)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Photo Story 3 for Windows\\PhotoStory3.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDPHCP Discovery Service
.
R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [7/14/2009 1:06 PM 101120]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/25/2008 1:09 PM 717296]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [11/7/2011 9:27 PM 442200]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [11/7/2011 9:27 PM 320856]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/7/2011 9:27 PM 20568]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11/6/2011 6:55 PM 366152]
S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2/28/2011 5:44 PM 183560]
S3 cpuz134;cpuz134;\??\c:\docume~1\MSI\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys --> c:\docume~1\MSI\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys [?]
S3 HwIOctl;HwIOctl; [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/6/2011 6:54 PM 22216]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [5/6/2009 5:36 PM 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [5/6/2009 5:36 PM 8320]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [5/6/2009 5:36 PM 23680]
S3 SunkFilt6;Alcor Micro Corp - 6360; [x]
S3 SunkFilt62;Alcor Micro Corp - 6362;c:\windows\system32\drivers\sunkfilt62.sys [7/23/2004 1:55 PM 46536]
S3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [11/9/2007 11:24 PM 9446]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - CXTUNE
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]
.
2011-10-19 c:\windows\Tasks\HP DArC Task 2003-08-20 09:23ewlett-Packard-6002003-08-20 21:57Y35J1235G7I.job
- c:\program files\HP\hpcoretech\comp\hpdarc.exe [2003-08-20 21:57]
.
2011-11-09 c:\windows\Tasks\HP Usg Daily.job
- c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\pexpress\hphped05.exe [2008-07-19 21:23]
.
2011-11-10 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-18.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-10 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1935655697-1482476501-839522115-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-10 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1935655697-1482476501-839522115-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-06 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-18.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1935655697-1482476501-839522115-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-10-25 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1935655697-1482476501-839522115-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
.
------- Supplementary Scan -------
.
TCP: DhcpNameServer = 192.168.0.1
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-09 18:30
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...  
.
scanning hidden autostart entries ... 
.
scanning hidden files ...  
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,31,80,80,66,53,57,d0,44,95,13,fe,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,31,80,80,66,53,57,d0,44,95,13,fe,\
.
[HKEY_USERS\S-1-5-21-1935655697-1482476501-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1968)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
.
Completion time: 2011-11-09  18:31:21
ComboFix-quarantined-files.txt  2011-11-10 02:31
ComboFix2.txt  2011-11-08 02:29
ComboFix3.txt  2007-12-13 09:49
.
Pre-Run: 292,400,230,400 bytes free
Post-Run: 292,389,015,552 bytes free
.
- - End Of File - - 10CDDCDC9B99E9ABA821C54F4BC1B56F


----------



## danthrax

Do you really think that is how you spell trogen???


----------



## kona

I have more serious problems here than my spelling error when I was in a hurry - no - I know it is spelled Trojan..........but thanks for pointing that out Dan.


----------



## johnb35

It's actually spelled Trojan, but who cares....


Please do the following again in safe mode.

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box



		Code:
	

Killall::

File::

c:\windows\system32\roboot.exe
c:\program files\060220108152078.bat
c:\program files\060220108094678.bat


Folder:

c:\documents and settings\MSI\Application Data\Systweak
c:\documents and settings\MSI\Application Data\BabylonToolbar
c:\program files\Babylon
c:\documents and settings\MSI\Local Settings\Application Data\12eba47c


3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!







ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.


----------



## kona

Do you want me to do this in SAFE MODE?




johnb35 said:


> It's actually spelled Trojan, but who cares....
> 
> 
> Please do the following again in safe mode.
> 
> 1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
> It must be Notepad, not Wordpad.
> 2. Copy the text in the below code box
> 
> 
> 
> Code:
> 
> 
> Killall::
> 
> File::
> 
> c:\windows\system32\roboot.exe
> c:\program files\060220108152078.bat
> c:\program files\060220108094678.bat
> 
> 
> Folder:
> 
> c:\documents and settings\MSI\Application Data\Systweak
> c:\documents and settings\MSI\Application Data\BabylonToolbar
> c:\program files\Babylon
> c:\documents and settings\MSI\Local Settings\Application Data\12eba47c
> 
> 
> 3. Go to the Notepad window and click Edit > Paste
> 4. Then click File > Save
> 5. Name the file CFScript.txt - Save the file to your Desktop
> 6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!
> 
> 
> 
> 
> 
> 
> 
> ComboFix will begin to execute, just follow the prompts.
> After reboot (in case it asks to reboot), it will produce a log for you.
> Post that log (Combofix.txt) in your next reply.


----------



## kona

*Got to go to work now - again.....*

I will work at this again tomorrow morning.
Thanks a bunch !


----------



## johnb35

kona said:


> Do you want me to do this in SAFE MODE?





> Please do the following again in *safe mode*.



Yes, I believe I stated that in my post.


----------



## kona

Good morning
I'm at work right now so do not have access to my home pc.  When I copied the combofix file - that was all that was in there .........unless I made some kind of an error......I will check the log when I get home tonight after 5pm (PST).

Sorry about the multiple posts - I just thought you would want it like that - I didn't know the 'drill' but I will 'edit' from now on.

If I do find I made a mistake and posted only part of the ComboFix log do you want me to post the complete log in a new Post or just go here and post the part I didn't post (add it to what's here below)?



Gary


ComboFix 11-11-09.02 - MSI 11/10/2011   0:03:54.7.2 - x86 MINIMAL
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.3071.2761 [GMT -8:00]
Running from: C:\Documents and Settings\MSI\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\MSI\Desktop\CFScript.txt
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\program files\060220108094678.bat"
"c:\program files\060220108152078.bat"
"c:\windows\system32\roboot.exe"


(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))


c:\program files\060220108094678.bat
c:\program files\060220108152078.bat
c:\windows\system32\roboot.exe

I disabled Avast and Malware before running combofix but when it started to run I got three or four beeping alarms that said a real time scanner in Avast was working and warned me to shut it down.  I just kept xing out of them (three or four of the prompts one after the other) and finally Combofix ran.  
The Avast icon with a line through it (disabled) was in the bottom right of my screen the whole time.

My pc seems to boot up fast enough but it still 'hangs' there a bit when I click onto IE to go onto 'the lines.'  Is that just Avast cheching/updating?

Are there more 'cleaning-type' tests for me to run to get rid of the 55 or so Trojans I have/had on my pc?


----------



## johnb35

I needed you to post the whole combofix log not just the first part.  

And for your information, there is an edit button next to your posts so you can edit them instead of making another one when no one has posted after you.  I have gone back and merged most of them together.  So from now on, start editing them please.


----------



## Quickpaw

I thought OP wanted to just format and reinstall windows?


----------



## kona

Who's OP ?



Quickpaw said:


> I thought OP wanted to just format and reinstall windows?


----------



## johnb35

Quickpaw said:


> I thought OP wanted to just format and reinstall windows?



Why reinstall windows when you can usually clean up the machine?  And I don't think he has the reinstall cd anyway.



kona said:


> Who's OP ?



Original poster = OP  Which means you, the one that started the thread.


----------



## kona

Yes - John - it would be better if I could just clean my pc.
A local pc retailer built my computer for me and they're very good.  I do remember getting a lot of stuff from them and an "Image" disc....I may have a reinstall cd there somewhere.........but as you say..."why reinstall Windows."

I'll continue here with your "fixing" instructions John......thanks.

OP - ya....thanks....not up on the pc talk as you can tell.
I did however try to create a little humour with my quote "on the lines" rather than just saying "on-line."  I tease my adult children with that........they get a kick out of my 'old-timer speak' haha........I'm only 62



johnb35 said:


> Why reinstall windows when you can usually clean up the machine?  And I don't think he has the reinstall cd anyway.
> 
> 
> 
> Original poster = OP  Which means you, the one that started the thread.


----------



## johnb35

I'm still waiting to see the full combofix log.  Then we'll see about the IE issue.


----------



## kona

Yes - I will look at the Combofix Log after work.  I'm looking forward to it.  This is time consuming but not as much as restoring a vintage drum (my hobby).......and .....I'm really looking forward to not having a sick pc.  Have to keep my kids off it.



johnb35 said:


> I'm still waiting to see the full combofix log.  Then we'll see about the IE issue.



*HERE IS THE BIGGEST COMBOFIX FILE I RAN - THE ONE I POSTED ABOVE WAS WHAT WAS THERE YESTERDAY AFTER I FINISHED.*

ComboFix 11-11-09.02 - MSI 11/09/2011  18:22:38.6.2 - x86 MINIMAL
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.3071.2646 [GMT -8:00]
Running from: c:\documents and settings\MSI\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
(((((((((((((((((((((((((   Files Created from 2011-10-10 to 2011-11-10  )))))))))))))))))))))))))))))))
.
.
2011-11-09 05:08 . 2011-11-09 05:08	--------	d-----w-	c:\program files\ESET
2011-11-09 01:42 . 2011-11-09 01:51	--------	d-----w-	C:\## aswSnx private storage
2011-11-08 05:27 . 2011-09-06 21:37	320856	----a-w-	c:\windows\system32\drivers\aswSP.sys
2011-11-08 05:27 . 2011-09-06 21:36	20568	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2011-11-08 05:27 . 2011-09-06 21:38	442200	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2011-11-08 05:27 . 2011-09-06 21:36	34392	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2011-11-08 05:27 . 2011-09-06 21:36	52568	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2011-11-08 05:27 . 2011-09-06 21:36	110552	----a-w-	c:\windows\system32\drivers\aswmon2.sys
2011-11-08 05:27 . 2011-09-06 21:36	104536	----a-w-	c:\windows\system32\drivers\aswmon.sys
2011-11-08 05:27 . 2011-09-06 21:33	30808	----a-w-	c:\windows\system32\drivers\aavmker4.sys
2011-11-08 05:27 . 2011-09-06 21:45	41184	----a-w-	c:\windows\avastSS.scr
2011-11-08 05:27 . 2011-09-06 21:45	199304	----a-w-	c:\windows\system32\aswBoot.exe
2011-11-08 05:26 . 2011-11-08 05:26	--------	d-----w-	c:\program files\AVAST Software
2011-11-08 05:26 . 2011-11-08 05:26	--------	d-----w-	c:\documents and settings\All Users\Application Data\AVAST Software
2011-11-08 03:41 . 2011-11-08 03:41	388096	----a-w-	c:\documents and settings\MSI\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-11-07 02:54 . 2011-09-01 01:00	22216	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-11-07 02:54 . 2011-11-07 03:09	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-11-07 02:14 . 2011-11-07 02:14	--------	d-----w-	c:\documents and settings\MSI\Application Data\BabylonToolbar
2011-11-07 02:13 . 2011-11-07 02:13	--------	d-----w-	c:\program files\Babylon
2011-11-07 02:12 . 2011-11-07 02:47	--------	d-----w-	c:\documents and settings\MSI\Application Data\Systweak
2011-11-07 02:12 . 2011-09-30 23:37	17280	----a-w-	c:\windows\system32\roboot.exe
2011-11-06 20:05 . 2011-11-06 20:05	--------	d-sh--w-	c:\windows\system32\config\systemprofile\PrivacIE
2011-11-06 20:05 . 2011-11-06 20:05	--------	d-sh--w-	c:\windows\system32\config\systemprofile\IETldCache
2011-11-06 18:48 . 2011-11-08 02:15	--------	d-sh--w-	c:\documents and settings\MSI\Local Settings\Application Data\12eba47c
2011-10-13 05:58 . 2011-10-13 05:58	--------	d-----w-	c:\program files\iPod
2011-10-13 05:58 . 2011-10-13 05:59	--------	d-----w-	c:\program files\iTunes
2011-10-13 05:55 . 2011-10-13 05:55	--------	d-----w-	c:\documents and settings\LocalService\Application Data\Apple Computer
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-08 01:13 . 2004-08-04 12:00	64512	----a-w-	c:\windows\system32\drivers\serial.sys
2011-10-13 14:06 . 2011-05-17 00:32	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-10 14:22 . 2006-09-16 21:05	692736	----a-w-	c:\windows\system32\inetcomm.dll
2011-10-03 12:06 . 2010-05-08 17:33	472808	----a-w-	c:\windows\system32\deployJava1.dll
2011-10-03 09:37 . 2007-06-18 18:56	73728	----a-w-	c:\windows\system32\javacpl.cpl
2011-09-26 18:41 . 2007-10-09 21:03	611328	----a-w-	c:\windows\system32\uiautomationcore.dll
2011-09-26 18:41 . 2004-08-04 12:00	220160	----a-w-	c:\windows\system32\oleacc.dll
2011-09-26 18:41 . 2004-08-04 12:00	20480	----a-w-	c:\windows\system32\oleaccrc.dll
2011-09-09 09:12 . 2004-08-04 12:00	599040	----a-w-	c:\windows\system32\crypt32.dll
2011-09-06 13:20 . 2004-08-04 12:00	1858944	----a-w-	c:\windows\system32\win32k.sys
2011-08-22 23:48 . 2004-08-04 12:00	916480	----a-w-	c:\windows\system32\wininet.dll
2011-08-22 23:48 . 2004-08-04 12:00	43520	----a-w-	c:\windows\system32\licmgr10.dll
2011-08-22 23:48 . 2004-08-04 12:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2011-08-22 11:56 . 2004-08-04 12:00	385024	----a-w-	c:\windows\system32\html.iec
2011-08-17 13:49 . 2004-08-04 12:00	138496	----a-w-	c:\windows\system32\drivers\afd.sys
2010-06-02 15:15 . 2010-06-02 15:15	436	----a-w-	c:\program files\060220108152078.bat
2010-06-02 15:09 . 2010-06-02 15:09	445	----a-w-	c:\program files\060220108094678.bat
2004-10-01 22:00 . 2006-09-16 22:42	40960	----a-w-	c:\program files\Uninstall_CDS.exe
2009-05-01 21:02 . 2009-05-01 21:02	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
2007-12-26 21:06 . 2007-12-26 21:06	133120	----a-w-	c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
((((((((((((((((((((((((((((((((((((((((((((   Look   )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\documents and settings\MSI\Local Settings\Application Data\12eba47c ----
.
2011-11-06 18:48 . 2011-11-06 18:48	2048	--sha-w-	c:\documents and settings\MSI\Local Settings\Application Data\12eba47c\@
.
.
(((((((((((((((((((((((((((((   SnapShot@2011-11-08_02.20.35   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-12 08:02 . 2009-07-12 08:02	51008              c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
+ 2008-08-15 02:13 . 2011-10-10 14:22	692736              c:\windows\system32\dllcache\inetcomm.dll
- 2008-08-15 02:13 . 2011-05-02 15:31	692736              c:\windows\system32\dllcache\inetcomm.dll
+ 2011-11-08 05:27 . 2011-11-08 05:27	219648              c:\windows\Installer\ac13cd.msi
+ 2011-11-08 03:41 . 2011-11-08 03:41	1094656              c:\windows\Installer\4b9948.msi
+ 2006-09-16 21:59 . 2011-11-10 00:59	50295240              c:\windows\system32\MRT.exe
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 21:45	122512	----a-w-	c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sunkist2k"="c:\program files\Multimedia Card Reader\shwicon2k.exe" [2004-08-07 135168]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"WD Button Manager"="WDBtnMgr.exe" [2007-12-26 364544]
"nwiz"="nwiz.exe" [2006-08-08 1519616]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-10-10 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-09-01 449608]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
WD Backup Monitor.lnk - c:\program files\My Book\WD Backup\uBBMonitor.exe [2007-12-26 98304]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^MSI^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\MSI\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58	37296	----a-w-	c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-04 01:43	69632	----a-w-	c:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDog303]
2005-10-25 20:56	61440	----a-w-	c:\windows\VM303_STI.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
2003-08-20 21:57	221184	----a-w-	c:\program files\HP\hpcoretech\hpcmpmgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2003-06-25 18:24	49152	----a-w-	c:\program files\Hewlett-Packard\HP Software Update\hpwuSchd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2003-07-25 14:14	188416	----a-w-	c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
2003-08-20 21:15	483328	----a-r-	c:\windows\system32\hphmon05.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD05]
2003-08-20 21:23	49152	----a-r-	c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-10-10 01:06	421736	----a-w-	c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
2002-11-08 10:50	19968	------w-	c:\windows\LOGI_MWX.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2000-08-08 20:00	311350	----a-w-	c:\program files\Microsoft Works\wkssb.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2000-08-08 20:00	28739	----a-w-	c:\program files\Microsoft Works\WkDetect.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2006-08-11 13:43	7630848	----a-r-	c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2006-08-11 13:43	86016	----a-r-	c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2006-08-08 21:54	1519616	----a-w-	c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2007-02-04 20:02	79400	----a-w-	c:\program files\ScanSoft\OmniPageSE4\OpWareSE4.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-07-06 01:36	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-11-15 00:21	16270848	----a-w-	c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-17 01:04	2879488	----a-w-	c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 17:03	210472	----a-w-	c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX3000]
2006-10-14 01:04	707376	----a-w-	c:\windows\vVX3000.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule]
2006-07-08 00:15	348160	----a-w-	c:\program files\WinFast\WFTVFM\WFWIZ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2000-08-08 20:00	24576	----a-w-	c:\program files\Microsoft Works\wkfud.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
2003-04-07 10:16	631364	----a-w-	c:\program files\Logitech\iTouch\iTouch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"UleadBurningHelper"=2 (0x2)
"NVSvc"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"gusvc"=3 (0x3)
"FSMA"=2 (0x2)
"FSDFWD"=3 (0x3)
"FSAUA"=3 (0x3)
"F-Secure Gatekeeper Handler Starter"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"iPod Service"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"Pml Driver HPZ12"=3 (0x3)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Photo Story 3 for Windows\\PhotoStory3.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDPHCP Discovery Service
.
R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [7/14/2009 1:06 PM 101120]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/25/2008 1:09 PM 717296]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [11/7/2011 9:27 PM 442200]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [11/7/2011 9:27 PM 320856]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/7/2011 9:27 PM 20568]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11/6/2011 6:55 PM 366152]
S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2/28/2011 5:44 PM 183560]
S3 cpuz134;cpuz134;\??\c:\docume~1\MSI\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys --> c:\docume~1\MSI\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys [?]
S3 HwIOctl;HwIOctl; [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/6/2011 6:54 PM 22216]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [5/6/2009 5:36 PM 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [5/6/2009 5:36 PM 8320]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [5/6/2009 5:36 PM 23680]
S3 SunkFilt6;Alcor Micro Corp - 6360; [x]
S3 SunkFilt62;Alcor Micro Corp - 6362;c:\windows\system32\drivers\sunkfilt62.sys [7/23/2004 1:55 PM 46536]
S3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [11/9/2007 11:24 PM 9446]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - CXTUNE
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]
.
2011-10-19 c:\windows\Tasks\HP DArC Task 2003-08-20 09:23ewlett-Packard-6002003-08-20 21:57Y35J1235G7I.job
- c:\program files\HP\hpcoretech\comp\hpdarc.exe [2003-08-20 21:57]
.
2011-11-09 c:\windows\Tasks\HP Usg Daily.job
- c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\pexpress\hphped05.exe [2008-07-19 21:23]
.
2011-11-10 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-18.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-10 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1935655697-1482476501-839522115-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-10 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1935655697-1482476501-839522115-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-06 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-18.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1935655697-1482476501-839522115-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-10-25 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1935655697-1482476501-839522115-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
.
------- Supplementary Scan -------
.
TCP: DhcpNameServer = 192.168.0.1
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-09 18:30
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...  
.
scanning hidden autostart entries ... 
.
scanning hidden files ...  
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,31,80,80,66,53,57,d0,44,95,13,fe,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,31,80,80,66,53,57,d0,44,95,13,fe,\
.
[HKEY_USERS\S-1-5-21-1935655697-1482476501-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1968)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
.
Completion time: 2011-11-09  18:31:21
ComboFix-quarantined-files.txt  2011-11-10 02:31
ComboFix2.txt  2011-11-08 02:29
ComboFix3.txt  2007-12-13 09:49
.
Pre-Run: 292,400,230,400 bytes free
Post-Run: 292,389,015,552 bytes free
.
- - End Of File - - 10CDDCDC9B99E9ABA821C54F4BC1B56F


----------



## Quickpaw

I just figured since OP has all their data backed up and has an image disc it would be easier than running all these utilities and posting all the logs and waiting for help on here. Youre doing a great job john dont get me wrong, it just seemed a faster, simpler solution that would not only rid the infection from the machine, but may also help it run better since itd be fresh. 

But seeing as youre so far in ill leave you to it.


----------



## kona

*i just ran combofix in safe mode - here's the log file*

ComboFix 11-11-09.02 - MSI 11/10/2011  17:25:05.8.2 - x86 MINIMAL
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.3071.2653 [GMT -8:00]
Running from: c:\documents and settings\MSI\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\MSI\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
FILE ::
"c:\program files\060220108094678.bat"
"c:\program files\060220108152078.bat"
"c:\windows\system32\roboot.exe"
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\program files\060220108094678.bat
c:\program files\060220108152078.bat
c:\windows\system32\roboot.exe
.
.
(((((((((((((((((((((((((   Files Created from 2011-10-11 to 2011-11-11  )))))))))))))))))))))))))))))))
.
.
2011-11-11 01:35 . 2011-11-11 01:35	9310	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXTBOX.JS
2011-11-11 01:35 . 2011-11-11 01:35	8646	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TILEBOX.JS
2011-11-11 01:35 . 2011-11-11 01:35	8613	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\SAVEDUSER.JS
2011-11-11 01:35 . 2011-11-11 01:35	6910	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\NEWUSERCOMM.JS
2011-11-11 01:35 . 2011-11-11 01:35	6429	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UICORE.JS
2011-11-09 05:08 . 2011-11-09 05:08	--------	d-----w-	c:\program files\ESET
2011-11-08 05:27 . 2011-09-06 21:37	320856	----a-w-	c:\windows\system32\drivers\aswSP.sys
2011-11-08 05:27 . 2011-09-06 21:36	20568	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2011-11-08 05:27 . 2011-09-06 21:38	442200	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2011-11-08 05:27 . 2011-09-06 21:36	34392	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2011-11-08 05:27 . 2011-09-06 21:36	52568	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2011-11-08 05:27 . 2011-09-06 21:36	110552	----a-w-	c:\windows\system32\drivers\aswmon2.sys
2011-11-08 05:27 . 2011-09-06 21:36	104536	----a-w-	c:\windows\system32\drivers\aswmon.sys
2011-11-08 05:27 . 2011-09-06 21:33	30808	----a-w-	c:\windows\system32\drivers\aavmker4.sys
2011-11-08 05:27 . 2011-09-06 21:45	41184	----a-w-	c:\windows\avastSS.scr
2011-11-08 05:27 . 2011-09-06 21:45	199304	----a-w-	c:\windows\system32\aswBoot.exe
2011-11-08 05:26 . 2011-11-08 05:26	--------	d-----w-	c:\program files\AVAST Software
2011-11-08 05:26 . 2011-11-08 05:26	--------	d-----w-	c:\documents and settings\All Users\Application Data\AVAST Software
2011-11-08 03:41 . 2011-11-08 03:41	388096	----a-w-	c:\documents and settings\MSI\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-11-07 02:54 . 2011-09-01 01:00	22216	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-11-07 02:54 . 2011-11-07 03:09	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-11-07 02:14 . 2011-11-07 02:14	--------	d-----w-	c:\documents and settings\MSI\Application Data\BabylonToolbar
2011-11-07 02:13 . 2011-11-07 02:13	--------	d-----w-	c:\program files\Babylon
2011-11-07 02:12 . 2011-11-07 02:47	--------	d-----w-	c:\documents and settings\MSI\Application Data\Systweak
2011-11-06 20:05 . 2011-11-06 20:05	--------	d-sh--w-	c:\windows\system32\config\systemprofile\PrivacIE
2011-11-06 20:05 . 2011-11-06 20:05	--------	d-sh--w-	c:\windows\system32\config\systemprofile\IETldCache
2011-11-06 18:48 . 2011-11-08 02:15	--------	d-sh--w-	c:\documents and settings\MSI\Local Settings\Application Data\12eba47c
2011-10-13 05:58 . 2011-10-13 05:58	--------	d-----w-	c:\program files\iPod
2011-10-13 05:58 . 2011-10-13 05:59	--------	d-----w-	c:\program files\iTunes
2011-10-13 05:55 . 2011-10-13 05:55	--------	d-----w-	c:\documents and settings\LocalService\Application Data\Apple Computer
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-08 01:13 . 2004-08-04 12:00	64512	----a-w-	c:\windows\system32\drivers\serial.sys
2011-10-13 14:06 . 2011-05-17 00:32	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-10 14:22 . 2006-09-16 21:05	692736	----a-w-	c:\windows\system32\inetcomm.dll
2011-10-03 12:06 . 2010-05-08 17:33	472808	----a-w-	c:\windows\system32\deployJava1.dll
2011-10-03 09:37 . 2007-06-18 18:56	73728	----a-w-	c:\windows\system32\javacpl.cpl
2011-09-26 18:41 . 2007-10-09 21:03	611328	----a-w-	c:\windows\system32\uiautomationcore.dll
2011-09-26 18:41 . 2004-08-04 12:00	220160	----a-w-	c:\windows\system32\oleacc.dll
2011-09-26 18:41 . 2004-08-04 12:00	20480	----a-w-	c:\windows\system32\oleaccrc.dll
2011-09-09 09:12 . 2004-08-04 12:00	599040	----a-w-	c:\windows\system32\crypt32.dll
2011-09-06 13:20 . 2004-08-04 12:00	1858944	----a-w-	c:\windows\system32\win32k.sys
2011-08-22 23:48 . 2004-08-04 12:00	916480	----a-w-	c:\windows\system32\wininet.dll
2011-08-22 23:48 . 2004-08-04 12:00	43520	----a-w-	c:\windows\system32\licmgr10.dll
2011-08-22 23:48 . 2004-08-04 12:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2011-08-22 11:56 . 2004-08-04 12:00	385024	----a-w-	c:\windows\system32\html.iec
2011-08-17 13:49 . 2004-08-04 12:00	138496	----a-w-	c:\windows\system32\drivers\afd.sys
2004-10-01 22:00 . 2006-09-16 22:42	40960	----a-w-	c:\program files\Uninstall_CDS.exe
2009-05-01 21:02 . 2009-05-01 21:02	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
2007-12-26 21:06 . 2007-12-26 21:06	133120	----a-w-	c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
(((((((((((((((((((((((((((((   SnapShot@2011-11-08_02.20.35   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-12 08:02 . 2009-07-12 08:02	51008              c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
+ 2011-11-11 01:34 . 2011-11-11 01:34	16384              c:\windows\temp\Perflib_Perfdata_244.dat
+ 2008-08-15 02:13 . 2011-10-10 14:22	692736              c:\windows\system32\dllcache\inetcomm.dll
- 2008-08-15 02:13 . 2011-05-02 15:31	692736              c:\windows\system32\dllcache\inetcomm.dll
+ 2011-11-08 05:27 . 2011-11-08 05:27	219648              c:\windows\Installer\ac13cd.msi
+ 2011-11-08 03:41 . 2011-11-08 03:41	1094656              c:\windows\Installer\4b9948.msi
+ 2006-09-16 21:59 . 2011-11-10 00:59	50295240              c:\windows\system32\MRT.exe
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 21:45	122512	----a-w-	c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sunkist2k"="c:\program files\Multimedia Card Reader\shwicon2k.exe" [2004-08-07 135168]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"WD Button Manager"="WDBtnMgr.exe" [2007-12-26 364544]
"nwiz"="nwiz.exe" [2006-08-08 1519616]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-10-10 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-09-01 449608]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
WD Backup Monitor.lnk - c:\program files\My Book\WD Backup\uBBMonitor.exe [2007-12-26 98304]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^MSI^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\MSI\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58	37296	----a-w-	c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-04 01:43	69632	----a-w-	c:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDog303]
2005-10-25 20:56	61440	----a-w-	c:\windows\VM303_STI.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
2003-08-20 21:57	221184	----a-w-	c:\program files\HP\hpcoretech\hpcmpmgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2003-06-25 18:24	49152	----a-w-	c:\program files\Hewlett-Packard\HP Software Update\hpwuSchd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2003-07-25 14:14	188416	----a-w-	c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
2003-08-20 21:15	483328	----a-r-	c:\windows\system32\hphmon05.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD05]
2003-08-20 21:23	49152	----a-r-	c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-10-10 01:06	421736	----a-w-	c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
2002-11-08 10:50	19968	------w-	c:\windows\LOGI_MWX.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2000-08-08 20:00	311350	----a-w-	c:\program files\Microsoft Works\wkssb.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2000-08-08 20:00	28739	----a-w-	c:\program files\Microsoft Works\WkDetect.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2006-08-11 13:43	7630848	----a-r-	c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2006-08-11 13:43	86016	----a-r-	c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2006-08-08 21:54	1519616	----a-w-	c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2007-02-04 20:02	79400	----a-w-	c:\program files\ScanSoft\OmniPageSE4\OpWareSE4.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-07-06 01:36	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-11-15 00:21	16270848	----a-w-	c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-17 01:04	2879488	----a-w-	c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 17:03	210472	----a-w-	c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX3000]
2006-10-14 01:04	707376	----a-w-	c:\windows\vVX3000.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule]
2006-07-08 00:15	348160	----a-w-	c:\program files\WinFast\WFTVFM\WFWIZ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2000-08-08 20:00	24576	----a-w-	c:\program files\Microsoft Works\wkfud.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
2003-04-07 10:16	631364	----a-w-	c:\program files\Logitech\iTouch\iTouch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"UleadBurningHelper"=2 (0x2)
"NVSvc"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"gusvc"=3 (0x3)
"FSMA"=2 (0x2)
"FSDFWD"=3 (0x3)
"FSAUA"=3 (0x3)
"F-Secure Gatekeeper Handler Starter"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"iPod Service"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"Pml Driver HPZ12"=3 (0x3)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Photo Story 3 for Windows\\PhotoStory3.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDPHCP Discovery Service
.
R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [7/14/2009 1:06 PM 101120]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/25/2008 1:09 PM 717296]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [11/7/2011 9:27 PM 442200]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [11/7/2011 9:27 PM 320856]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/7/2011 9:27 PM 20568]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11/6/2011 6:55 PM 366152]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/6/2011 6:54 PM 22216]
S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2/28/2011 5:44 PM 183560]
S3 cpuz134;cpuz134;\??\c:\docume~1\MSI\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys --> c:\docume~1\MSI\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys [?]
S3 HwIOctl;HwIOctl; [x]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [5/6/2009 5:36 PM 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [5/6/2009 5:36 PM 8320]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [5/6/2009 5:36 PM 23680]
S3 SunkFilt6;Alcor Micro Corp - 6360; [x]
S3 SunkFilt62;Alcor Micro Corp - 6362;c:\windows\system32\drivers\sunkfilt62.sys [7/23/2004 1:55 PM 46536]
S3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [11/9/2007 11:24 PM 9446]
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]
.
2011-10-19 c:\windows\Tasks\HP DArC Task 2003-08-20 09:23ewlett-Packard-6002003-08-20 21:57Y35J1235G7I.job
- c:\program files\HP\hpcoretech\comp\hpdarc.exe [2003-08-20 21:57]
.
2011-11-10 c:\windows\Tasks\HP Usg Daily.job
- c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\pexpress\hphped05.exe [2008-07-19 21:23]
.
2011-11-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-18.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1935655697-1482476501-839522115-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1935655697-1482476501-839522115-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-06 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-18.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1935655697-1482476501-839522115-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-10-25 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1935655697-1482476501-839522115-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
TCP: DhcpNameServer = 192.168.0.1
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-10 17:35
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...  
.
scanning hidden autostart entries ... 
.
scanning hidden files ...  
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,31,80,80,66,53,57,d0,44,95,13,fe,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,31,80,80,66,53,57,d0,44,95,13,fe,\
.
[HKEY_USERS\S-1-5-21-1935655697-1482476501-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2820)
c:\windows\system32\WININET.dll
c:\windows\system32\nview.dll
c:\windows\system32\nvwddi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Ahead\InCD\InCDsrv.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\BingBar\SeaPort.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\WDBtnMgr.exe
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2011-11-10  17:42:04 - machine was rebooted
ComboFix-quarantined-files.txt  2011-11-11 01:41
ComboFix2.txt  2011-11-10 02:31
ComboFix3.txt  2011-11-08 02:29
ComboFix4.txt  2007-12-13 09:49
.
Pre-Run: 292,216,111,104 bytes free
Post-Run: 292,204,433,408 bytes free
.
- - End Of File - - 308A10877615D984B140A3A2EDA26778


----------



## johnb35

Ok, Looks like I omitted a colon, wondering why some things didn't get deleted.  Please do the following again in safe mode.

Please do the following again in safe mode.

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box



		Code:
	

Killall::

Folder::

c:\documents and settings\MSI\Application Data\Systweak
c:\documents and settings\MSI\Application Data\BabylonToolbar
c:\program files\Babylon
c:\documents and settings\MSI\Local Settings\Application Data\12eba47c


3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!







ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.[/QUOTE]


Sorry about that.


----------



## kona

*Here's the latest - just finished - combofix log*

ComboFix 11-11-09.02 - MSI 11/10/2011  19:02:29.9.2 - x86 MINIMAL
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.3071.2768 [GMT -8:00]
Running from: c:\documents and settings\MSI\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\MSI\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\MSI\Application Data\BabylonToolbar
c:\documents and settings\MSI\Application Data\Systweak
c:\documents and settings\MSI\Local Settings\Application Data\12eba47c
c:\documents and settings\MSI\Local Settings\Application Data\12eba47c\@
c:\program files\Babylon
.
.
(((((((((((((((((((((((((   Files Created from 2011-10-11 to 2011-11-11  )))))))))))))))))))))))))))))))
.
.
2011-11-09 05:08 . 2011-11-09 05:08	--------	d-----w-	c:\program files\ESET
2011-11-08 05:27 . 2011-09-06 21:37	320856	----a-w-	c:\windows\system32\drivers\aswSP.sys
2011-11-08 05:27 . 2011-09-06 21:36	20568	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2011-11-08 05:27 . 2011-09-06 21:38	442200	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2011-11-08 05:27 . 2011-09-06 21:36	34392	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2011-11-08 05:27 . 2011-09-06 21:36	52568	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2011-11-08 05:27 . 2011-09-06 21:36	110552	----a-w-	c:\windows\system32\drivers\aswmon2.sys
2011-11-08 05:27 . 2011-09-06 21:36	104536	----a-w-	c:\windows\system32\drivers\aswmon.sys
2011-11-08 05:27 . 2011-09-06 21:33	30808	----a-w-	c:\windows\system32\drivers\aavmker4.sys
2011-11-08 05:27 . 2011-09-06 21:45	41184	----a-w-	c:\windows\avastSS.scr
2011-11-08 05:27 . 2011-09-06 21:45	199304	----a-w-	c:\windows\system32\aswBoot.exe
2011-11-08 05:26 . 2011-11-08 05:26	--------	d-----w-	c:\program files\AVAST Software
2011-11-08 05:26 . 2011-11-08 05:26	--------	d-----w-	c:\documents and settings\All Users\Application Data\AVAST Software
2011-11-08 03:41 . 2011-11-08 03:41	388096	----a-w-	c:\documents and settings\MSI\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-11-07 02:54 . 2011-09-01 01:00	22216	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-11-07 02:54 . 2011-11-07 03:09	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-11-06 20:05 . 2011-11-06 20:05	--------	d-sh--w-	c:\windows\system32\config\systemprofile\PrivacIE
2011-11-06 20:05 . 2011-11-06 20:05	--------	d-sh--w-	c:\windows\system32\config\systemprofile\IETldCache
2011-10-13 05:58 . 2011-10-13 05:58	--------	d-----w-	c:\program files\iPod
2011-10-13 05:58 . 2011-10-13 05:59	--------	d-----w-	c:\program files\iTunes
2011-10-13 05:55 . 2011-10-13 05:55	--------	d-----w-	c:\documents and settings\LocalService\Application Data\Apple Computer
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-08 01:13 . 2004-08-04 12:00	64512	----a-w-	c:\windows\system32\drivers\serial.sys
2011-10-13 14:06 . 2011-05-17 00:32	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-10 14:22 . 2006-09-16 21:05	692736	----a-w-	c:\windows\system32\inetcomm.dll
2011-10-03 12:06 . 2010-05-08 17:33	472808	----a-w-	c:\windows\system32\deployJava1.dll
2011-10-03 09:37 . 2007-06-18 18:56	73728	----a-w-	c:\windows\system32\javacpl.cpl
2011-09-26 18:41 . 2007-10-09 21:03	611328	----a-w-	c:\windows\system32\uiautomationcore.dll
2011-09-26 18:41 . 2004-08-04 12:00	220160	----a-w-	c:\windows\system32\oleacc.dll
2011-09-26 18:41 . 2004-08-04 12:00	20480	----a-w-	c:\windows\system32\oleaccrc.dll
2011-09-09 09:12 . 2004-08-04 12:00	599040	----a-w-	c:\windows\system32\crypt32.dll
2011-09-06 13:20 . 2004-08-04 12:00	1858944	----a-w-	c:\windows\system32\win32k.sys
2011-08-22 23:48 . 2004-08-04 12:00	916480	----a-w-	c:\windows\system32\wininet.dll
2011-08-22 23:48 . 2004-08-04 12:00	43520	----a-w-	c:\windows\system32\licmgr10.dll
2011-08-22 23:48 . 2004-08-04 12:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2011-08-22 11:56 . 2004-08-04 12:00	385024	----a-w-	c:\windows\system32\html.iec
2011-08-17 13:49 . 2004-08-04 12:00	138496	----a-w-	c:\windows\system32\drivers\afd.sys
2004-10-01 22:00 . 2006-09-16 22:42	40960	----a-w-	c:\program files\Uninstall_CDS.exe
2009-05-01 21:02 . 2009-05-01 21:02	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
2007-12-26 21:06 . 2007-12-26 21:06	133120	----a-w-	c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
(((((((((((((((((((((((((((((   SnapShot@2011-11-08_02.20.35   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-12 08:02 . 2009-07-12 08:02	51008              c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
+ 2011-11-11 03:12 . 2011-11-11 03:12	16384              c:\windows\temp\Perflib_Perfdata_7fc.dat
+ 2008-08-15 02:13 . 2011-10-10 14:22	692736              c:\windows\system32\dllcache\inetcomm.dll
- 2008-08-15 02:13 . 2011-05-02 15:31	692736              c:\windows\system32\dllcache\inetcomm.dll
+ 2011-11-08 05:27 . 2011-11-08 05:27	219648              c:\windows\Installer\ac13cd.msi
+ 2011-11-08 03:41 . 2011-11-08 03:41	1094656              c:\windows\Installer\4b9948.msi
+ 2006-09-16 21:59 . 2011-11-10 00:59	50295240              c:\windows\system32\MRT.exe
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 21:45	122512	----a-w-	c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sunkist2k"="c:\program files\Multimedia Card Reader\shwicon2k.exe" [2004-08-07 135168]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"WD Button Manager"="WDBtnMgr.exe" [2007-12-26 364544]
"nwiz"="nwiz.exe" [2006-08-08 1519616]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-10-10 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-09-01 449608]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
WD Backup Monitor.lnk - c:\program files\My Book\WD Backup\uBBMonitor.exe [2007-12-26 98304]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^MSI^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\MSI\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58	37296	----a-w-	c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-04 01:43	69632	----a-w-	c:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDog303]
2005-10-25 20:56	61440	----a-w-	c:\windows\VM303_STI.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
2003-08-20 21:57	221184	----a-w-	c:\program files\HP\hpcoretech\hpcmpmgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2003-06-25 18:24	49152	----a-w-	c:\program files\Hewlett-Packard\HP Software Update\hpwuSchd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2003-07-25 14:14	188416	----a-w-	c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
2003-08-20 21:15	483328	----a-r-	c:\windows\system32\hphmon05.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD05]
2003-08-20 21:23	49152	----a-r-	c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-10-10 01:06	421736	----a-w-	c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
2002-11-08 10:50	19968	------w-	c:\windows\LOGI_MWX.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2000-08-08 20:00	311350	----a-w-	c:\program files\Microsoft Works\wkssb.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2000-08-08 20:00	28739	----a-w-	c:\program files\Microsoft Works\WkDetect.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2006-08-11 13:43	7630848	----a-r-	c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2006-08-11 13:43	86016	----a-r-	c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2006-08-08 21:54	1519616	----a-w-	c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2007-02-04 20:02	79400	----a-w-	c:\program files\ScanSoft\OmniPageSE4\OpWareSE4.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-07-06 01:36	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-11-15 00:21	16270848	----a-w-	c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-17 01:04	2879488	----a-w-	c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 17:03	210472	----a-w-	c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX3000]
2006-10-14 01:04	707376	----a-w-	c:\windows\vVX3000.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule]
2006-07-08 00:15	348160	----a-w-	c:\program files\WinFast\WFTVFM\WFWIZ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2000-08-08 20:00	24576	----a-w-	c:\program files\Microsoft Works\wkfud.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
2003-04-07 10:16	631364	----a-w-	c:\program files\Logitech\iTouch\iTouch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"UleadBurningHelper"=2 (0x2)
"NVSvc"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"gusvc"=3 (0x3)
"FSMA"=2 (0x2)
"FSDFWD"=3 (0x3)
"FSAUA"=3 (0x3)
"F-Secure Gatekeeper Handler Starter"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"iPod Service"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"Pml Driver HPZ12"=3 (0x3)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Photo Story 3 for Windows\\PhotoStory3.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDPHCP Discovery Service
.
R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [7/14/2009 1:06 PM 101120]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/25/2008 1:09 PM 717296]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [11/7/2011 9:27 PM 442200]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [11/7/2011 9:27 PM 320856]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/7/2011 9:27 PM 20568]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11/6/2011 6:55 PM 366152]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/6/2011 6:54 PM 22216]
S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2/28/2011 5:44 PM 183560]
S3 cpuz134;cpuz134;\??\c:\docume~1\MSI\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys --> c:\docume~1\MSI\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys [?]
S3 HwIOctl;HwIOctl; [x]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [5/6/2009 5:36 PM 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [5/6/2009 5:36 PM 8320]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [5/6/2009 5:36 PM 23680]
S3 SunkFilt6;Alcor Micro Corp - 6360; [x]
S3 SunkFilt62;Alcor Micro Corp - 6362;c:\windows\system32\drivers\sunkfilt62.sys [7/23/2004 1:55 PM 46536]
S3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFTVFM\WFIOCTL.sys [11/9/2007 11:24 PM 9446]
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]
.
2011-10-19 c:\windows\Tasks\HP DArC Task 2003-08-20 09:23ewlett-Packard-6002003-08-20 21:57Y35J1235G7I.job
- c:\program files\HP\hpcoretech\comp\hpdarc.exe [2003-08-20 21:57]
.
2011-11-10 c:\windows\Tasks\HP Usg Daily.job
- c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\pexpress\hphped05.exe [2008-07-19 21:23]
.
2011-11-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-18.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1935655697-1482476501-839522115-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1935655697-1482476501-839522115-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-06 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-18.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-11-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1935655697-1482476501-839522115-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
2011-10-25 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1935655697-1482476501-839522115-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
TCP: DhcpNameServer = 192.168.0.1
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-10 19:16
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...  
.
scanning hidden autostart entries ... 
.
scanning hidden files ...  
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,31,80,80,66,53,57,d0,44,95,13,fe,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,31,80,80,66,53,57,d0,44,95,13,fe,\
.
[HKEY_USERS\S-1-5-21-1935655697-1482476501-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2640)
c:\windows\system32\WININET.dll
c:\windows\system32\nview.dll
c:\windows\system32\nvwddi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Ahead\InCD\InCDsrv.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\BingBar\SeaPort.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\WDBtnMgr.exe
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2011-11-10  19:22:41 - machine was rebooted
ComboFix-quarantined-files.txt  2011-11-11 03:22
ComboFix2.txt  2011-11-11 01:42
ComboFix3.txt  2011-11-10 02:31
ComboFix4.txt  2011-11-08 02:29
ComboFix5.txt  2011-11-11 03:01
.
Pre-Run: 292,155,490,304 bytes free
Post-Run: 292,153,610,240 bytes free
.
- - End Of File - - B7398A98B09D4A4D98935438867BBB29


----------



## kona

John - can I use my computer in the meantime?   Or is it better to wait until all the viruses are removed?  I'm checking email - eBay and some Vintage Drum Forums - that's all.   But, if it's better not to do that for now please let me know.

AN ASIDE:
Is it normal for IE to take from 26-44 seconds to open up every time I click on it?  Or - is my pc still very sick and having some conflict there?  Maybe Avast is helping with the opening of IE and protecting my pc.......?  Just thoughts as I click on to get to the Forum here.


----------



## Quickpaw

This is kinda why I was thinking just format it. Because theres so much back and forth the process is drawn out and there may always be issues with windows now. ex)ie taking a long time to open.

If you have a system image disc and you understand using it will erase everything on your hard drive, I'd say use it.


----------



## kona

*Restore.........maybey...ya*

When I had the pc built in august of 07 the builder made me a disk labelled 
"restore image 08/22/07"
I also have a Drivers & Utilities disk and a floppy disk G72-MNPR009-J10 MCP55 chipset SATA Raid version: 5.10.2600.0654 For Win2k/XP only Disk 1 of 1

Are these some of what I need to proceed with after/when I Format the hard drive?




Quickpaw said:


> This is kinda why I was thinking just format it. Because theres so much back and forth the process is drawn out and there may always be issues with windows now. ex)ie taking a long time to open.
> 
> If you have a system image disc and you understand using it will erase everything on your hard drive, I'd say use it.


----------



## johnb35

As far as I can tell, everything as been removed now.  I need you to do one more thing to make sure there are no bad addons in IE, as they usually cause loading problems.  Open IE, click on tools menu, click on manage addons, click on search providers on the left and tell me what is listed on the right.


----------



## kona

Google is listed as 1 (my default provider) and it's disbled.....hmmm

Live Search is listed as 2.........and it's enabled.

I want Google as my default search engine and that's what I thought I went into change it to that a few days ago.  I guess I didn't set it properly.   

Google does come up .........eventually....about 20+ seconds most of the time to connect after I click onto it.

Is that why it's slow to open....because it's my default search engine but it's disabled?

EDITING:
I went in there and removed Live Search so Google is my Search Engine now.  I also checked the box on the left at the bottom that "prevent programs from suggesting changes to my default search provider.

I restarted and it still took close to 40 seconds for the search provider to open.

ANOTHER SUBJECT WHILE I'M HERE:
I checked eBay and everytime now when I click onto a photo a seller has posted an 'about:blank' (I think that's what the tile is) screen opens and just 'hangs' there without opening the photo.  Is that because I may have to reload Java or some program that may have been erased?




johnb35 said:


> As far as I can tell, everything as been removed now.  I need you to do one more thing to make sure there are no bad addons in IE, as they usually cause loading problems.  Open IE, click on tools menu, click on manage addons, click on search providers on the left and tell me what is listed on the right.


----------



## johnb35

Now that we have removed all the infections, lets try resetting IE again.  Go back into internet options in control panel, click on the advanced tab and click on both restore advanced settings and the reset buttons at the bottom.  Then try loading IE up.   What do you have loaded as your homepage?


----------



## kona

I reset IE and restarted it.  It still took about 30 secs or so to get to my Google home page.........

*Google is the defaut homepage* (search provider). 

 I went in and looked and it's still the only one there.....as I removed Live Search earlier today.
I have Internet Explorer 8 (version 8.0.6001.18702).  When I open IE and my Google Home Page comes up I get a pop up Welcoming me to IE 8.0 and asking me to Setup Windows IE 8 or click a box that says ask later.  I just have been xing out of that box so far.

I am still getting the orange sheild with exclaimation mark address bar that reads...."InTRanet settings are now turned off by default.  Intranet settings are less secure than InTERnet settings. Click for options..."
(I've added the capital letters)




johnb35 said:


> Now that we have removed all the infections, lets try resetting IE again.  Go back into internet options in control panel, click on the advanced tab and click on both restore advanced settings and the reset buttons at the bottom.  Then try loading IE up.   What do you have loaded as your homepage?


----------



## kona

*THANKS JOHN*
I'm not getting Virus messages.  

IE is very slow to open and search but at least my pc is working now.
I would to donate some cash to you folks so I'll look into doing that.

You guys are pretty terrific..........you provide a very good service.

Thanks tons!
Gary


----------



## kona

*John - I deleted your email by mistake*

John - I posted an edited post yesterday regarding deleting your email by mistake - see my thread in General Computer Chat

Gary


----------



## kona

JohnB35 has sorted everything out for me.........no more virus problems and my IE is working great.   Thanks!


----------

