Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

HELP ME! I HAVE A WHOLE BUNCH OF SPYWARE STUFF [RESOLVED]

Started by helpme? , Aug 25 2008 05:17 AM

This topic is locked

#1
helpme?

Posted 25 August 2008 - 05:17 AM

Member

Member
46 posts

i have a red screen that says privacy in danger and i have a blue screen tellin gme to get spyware protection and a anti virus software and if i leave my computer alone for a whiole a blue screen comes up tellin gme to shut down my computer and i have like 2008 antivirus programs comming from no where telling me i have viruses and now they are installed on my computer please help me

#2
fenzodahl512

Posted 25 August 2008 - 04:43 PM

Malware Removal
9,863 posts

Hello, my name is fenzodahl512 and welcome to Geekstogo..

Please have a read at this topic and do all the preliminary steps given.

If you are using Windows Vista, or if you are using XP and already have Service Pack 1a or later, please ignore Step Three: Windows Updates and continue with Step Four: Reboot - Test

It should handle about 70% of your malware problem.. Should the problem still exist, please post a fresh HijackThis log here as shown in the Step Five: Posting a Hijack This Log.. Thank you

Regards
fenzodahl512

#3
helpme?

Posted 25 August 2008 - 11:25 PM

Member

Topic Starter
Member
46 posts

Malwarebytes Anti-Malware (quick scan) LOG:

************************

Malwarebytes' Anti-Malware 1.11
Database version: 683

Scan type: Quick Scan
Objects scanned: 34889
Time elapsed: 20 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\WINDOWS\privacy_danger (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\privacy_danger\index.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\capt.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\danger.jpg (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\down.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\spacer.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.

********************************************************************************
************

HIGHJACKTHIS LOG:

****************************

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:23:14 PM, on 8/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Documents and Settings\Acount Of Death\css.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Program Files\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [SpiralFrog] C:\Program Files\SpiralFrog\Spiralfrog.exe
O4 - HKLM\..\Run: [Sccs] C:\Documents and Settings\Acount Of Death\sccs.ex
O4 - HKLM\..\Run: [Css] C:\Documents and Settings\Acount Of Death\css.exe
O4 - HKLM\..\Run: [ppxcs] C:\Documents and Settings\Acount Of Death\ppxcs.e
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O21 - SSODL: tfnslopk - {1AEF7AE8-C7C5-4505-B34B-6EB8BA08502D} - C:\WINDOWS\tfnslopk.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Unknown owner - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe

--
End of file - 5717 bytes

********************************************************************************
*************

i have avast anti virus scanning and ill add that when its done

#4
fenzodahl512

Posted 26 August 2008 - 12:55 AM

Malware Removal
9,863 posts

Please visit below webpage for instructions for downloading and running ComboFix

http://www.bleepingc...to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. DO NOT select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix (located in C:\combofix.txt) when you've accomplished that, along with a new HijackThis log.

#5
helpme?

Posted 26 August 2008 - 01:58 AM

Member

Topic Starter
Member
46 posts

Combofix Log:
*****************************
ComboFix 08-08-24.03 - Acount Of Death 2008-08-26 0:10:28.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.761 [GMT -7:00]
Running from: C:\Documents and Settings\Acount Of Death\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Acount Of Death\Application Data\macromedia\Flash Player\#SharedObjects\9KXD4MAE\interclick.com
C:\Documents and Settings\Acount Of Death\Application Data\macromedia\Flash Player\#SharedObjects\9KXD4MAE\interclick.com\ud.sol
C:\Documents and Settings\Acount Of Death\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Acount Of Death\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Acount Of Death\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk
C:\Documents and Settings\Acount Of Death\Application Data\rhc90qj0eeb3
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\All Users\Application Data\Secure Solutions
C:\Documents and Settings\All Users\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080807235238737.log
C:\Documents and Settings\All Users\Desktop\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\License Agreement.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Uninstall.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\PCPrivacyCleaner
C:\Documents and Settings\All Users\Start Menu\Programs\PCPrivacyCleaner\PCPrivacyCleaner.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\PCPrivacyCleaner\Uninstall PCPrivacyCleaner.lnk
C:\Program Files\PCHealthCenter
C:\Program Files\PCHealthCenter\0.exe
C:\Program Files\PCHealthCenter\0.gif
C:\Program Files\PCHealthCenter\1.exe
C:\Program Files\PCHealthCenter\1.gif
C:\Program Files\PCHealthCenter\1.ico
C:\Program Files\PCHealthCenter\2.exe
C:\Program Files\PCHealthCenter\2.gif
C:\Program Files\PCHealthCenter\2.ico
C:\Program Files\PCHealthCenter\3.exe
C:\Program Files\PCHealthCenter\3.gif
C:\Program Files\PCHealthCenter\4.exe
C:\Program Files\PCHealthCenter\5.exe
C:\Program Files\PCHealthCenter\7.exe
C:\Program Files\PCPrivacyCleaner
C:\Program Files\rhc90qj0eeb3
C:\Program Files\VirusRemover2008
C:\Program Files\VirusRemover2008\Viruses.bdt
C:\WINDOWS\BM078481a4.txt
C:\WINDOWS\BM078481a4.xml
C:\WINDOWS\eqbn.exe
C:\WINDOWS\lnvegaow.exe
C:\WINDOWS\system32\5.tmp
C:\WINDOWS\system32\6.tmp
C:\WINDOWS\system32\7.tmp
C:\WINDOWS\system32\9.tmp
C:\WINDOWS\system32\a.exe
C:\WINDOWS\system32\A.tmp
C:\WINDOWS\system32\abfetgws.ini
C:\WINDOWS\system32\akdharta.ini
C:\WINDOWS\system32\akfcfucl.ini
C:\WINDOWS\system32\bmkqlwym.ini
C:\WINDOWS\system32\C.tmp
C:\WINDOWS\system32\D.tmp
C:\WINDOWS\system32\dcqqdhud.ini
C:\WINDOWS\system32\dklflrby.ini
C:\WINDOWS\system32\F.tmp
C:\WINDOWS\system32\fdejqeuk.ini
C:\WINDOWS\system32\gevksqir.ini
C:\WINDOWS\system32\grskrxky.ini
C:\WINDOWS\system32\hsvhynpm.ini
C:\WINDOWS\system32\imxakkrj.ini
C:\WINDOWS\system32\knpaolwf.ini
C:\WINDOWS\system32\kubxntao.ini
C:\WINDOWS\system32\luybvfvi.ini
C:\WINDOWS\system32\mpdchree.ini
C:\WINDOWS\system32\ndsptukr.ini
C:\WINDOWS\system32\nqjmcbxw.ini
C:\WINDOWS\system32\oqfpwamc.ini
C:\WINDOWS\system32\pphcc0qj0eeb3.exe
C:\WINDOWS\system32\qdktaqnj.ini
C:\WINDOWS\system32\qhcsmrlr.ini
C:\WINDOWS\system32\rfeabrie.ini
C:\WINDOWS\system32\rwxvqsvx.ini
C:\WINDOWS\system32\rxphfcrs.ini
C:\WINDOWS\system32\sjqblcrc.ini
C:\WINDOWS\system32\tdssinit.dll
C:\WINDOWS\system32\tdssl.dll
C:\WINDOWS\system32\tdsslog.dll
C:\WINDOWS\system32\tdssmain.dll
C:\WINDOWS\system32\tdssservers.dat
C:\WINDOWS\system32\tjipnyxo.ini
C:\WINDOWS\system32\ufltmtoc.ini
C:\WINDOWS\system32\uidccwrq.ini
C:\WINDOWS\system32\upcvgsfh.ini
C:\WINDOWS\system32\uvounqww.ini
C:\WINDOWS\system32\vydxujbr.ini
C:\WINDOWS\system32\wwbslixf.ini
C:\WINDOWS\tfnslopk.dll

----- BITS: Possible infected sites -----

http://www.spiralfrog.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TDSSSERV
-------\Service_tdssserv

((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 )))))))))))))))))))))))))))))))
.

2008-08-25 22:20 . 2008-08-25 22:20 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-25 21:45 . 2008-08-25 21:45 <DIR> d-------- C:\Program Files\ERUNT
2008-08-25 03:30 . 2008-08-25 03:30 268 --ah----- C:\sqmdata10.sqm
2008-08-25 03:30 . 2008-08-25 03:30 244 --ah----- C:\sqmnoopt10.sqm
2008-08-24 23:11 . 2008-08-24 23:13 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-08-24 21:46 . 2008-08-24 21:46 147,456 ---hs---- C:\Documents and Settings\Acount Of Death\ppxcs.exe
2008-08-24 21:46 . 2008-08-24 21:46 134,144 ---hs---- C:\Documents and Settings\Acount Of Death\intelOP.exe
2008-08-24 21:46 . 2008-08-24 21:46 103,936 ---hs---- C:\Documents and Settings\Acount Of Death\sccs.exe
2008-08-24 21:46 . 2008-08-24 21:46 103,424 ---hs---- C:\Documents and Settings\Acount Of Death\css.exe
2008-08-24 21:46 . 2008-08-24 21:46 69,632 ---hs---- C:\Documents and Settings\Acount Of Death\MediaTubeCodec_ver1.1463.0.exe
2008-08-19 00:46 . 2008-08-22 22:27 <DIR> d-------- C:\Program Files\the new magix one that works
2008-08-18 05:59 . 2008-08-18 05:59 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-08-18 05:59 . 2008-08-18 05:59 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-08-18 05:58 . 2008-08-18 05:58 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-08-18 05:58 . 2008-08-18 05:58 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-08-18 05:04 . 2008-08-19 14:13 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-08-15 16:08 . 2008-08-18 03:06 94,208 --a------ C:\WINDOWS\system32\13.tmp
2008-08-15 16:08 . 2008-08-18 03:06 94,208 --a------ C:\WINDOWS\system32\12.tmp
2008-08-15 16:08 . 2008-08-18 03:06 94,208 --a------ C:\WINDOWS\system32\10.tmp
2008-08-14 19:15 . 2008-08-18 22:13 <DIR> d-------- C:\Program Files\Acoustica Shared Effects
2008-08-14 19:15 . 2008-08-18 20:44 <DIR> d-------- C:\Program Files\Acoustica Beatcraft
2008-08-14 15:52 . 2008-08-14 15:52 <DIR> d-------- C:\New Folder 1
2008-08-14 15:41 . 2008-08-18 03:18 <DIR> d-------- C:\Program Files\DivX
2008-08-14 15:27 . 2005-06-21 16:43 163,840 --a------ C:\WINDOWS\system32\igfxres.dll
2008-08-08 03:46 . 2008-08-08 03:46 268 --ah----- C:\sqmdata09.sqm
2008-08-08 03:46 . 2008-08-08 03:46 244 --ah----- C:\sqmnoopt09.sqm
2008-08-08 02:33 . 2008-08-08 02:33 <DIR> d-------- C:\Program Files\Lavasoft
2008-08-08 01:42 . 2008-08-08 01:42 268 --ah----- C:\sqmdata08.sqm
2008-08-08 01:42 . 2008-08-08 01:42 244 --ah----- C:\sqmnoopt08.sqm
2008-08-08 00:47 . 2008-08-08 00:47 268 --ah----- C:\sqmdata07.sqm
2008-08-08 00:47 . 2008-08-08 00:47 244 --ah----- C:\sqmnoopt07.sqm
2008-08-07 23:52 . 2008-08-07 23:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\services
2008-08-05 22:54 . 2008-08-05 22:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2008-08-05 22:46 . 2008-08-05 22:55 <DIR> d-------- C:\Program Files\Common Files\AVSMedia
2008-08-05 22:46 . 2008-08-05 22:55 <DIR> d-------- C:\Program Files\AVS4YOU
2008-08-05 22:46 . 2002-01-05 16:48 974,848 --a------ C:\WINDOWS\system32\mfc70.dll
2008-08-05 22:46 . 2007-09-27 15:22 524,288 --a------ C:\WINDOWS\system32\xvidcore.dll
2008-08-05 22:46 . 2003-05-22 00:50 156,910 --a------ C:\WINDOWS\WMSysPr8.prx
2008-08-05 22:46 . 2007-09-27 15:22 139,264 --a------ C:\WINDOWS\system32\xvidvfw.dll
2008-08-05 22:46 . 2003-05-22 00:50 82,944 --a------ C:\WINDOWS\system32\vct3216.acm
2008-08-05 22:46 . 2004-02-04 22:11 81,920 --a------ C:\WINDOWS\system32\AC3ACM.acm
2008-08-05 22:46 . 2004-09-06 17:06 53,248 --a------ C:\WINDOWS\system32\xvid.ax
2008-08-05 22:46 . 2003-05-22 00:50 38,912 --a------ C:\WINDOWS\system32\alf2cd.acm
2008-08-05 22:46 . 2003-05-21 13:50 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-08-05 22:46 . 2000-03-14 21:55 13,239 --a------ C:\WINDOWS\system32\Scg726.acm
2008-08-05 14:58 . 2008-08-05 14:58 161,096 --a--c--- C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-08-03 21:23 . 2008-08-03 21:23 <DIR> d-------- C:\Program Files\bluesforpeace
2008-07-29 00:42 . 2008-07-29 00:42 0 --a------ C:\WINDOWS\nsreg.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-25 21:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-08-25 11:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\SITEguard
2008-08-25 06:20 --------- d-----w C:\Program Files\DNA
2008-08-25 06:19 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-23 05:28 --------- d-----w C:\Program Files\MAGIX
2008-08-23 05:28 --------- d-----w C:\Program Files\Acoustica Mixcraft 4
2008-08-19 08:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\MAGIX
2008-08-19 08:06 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\MAGIX
2008-08-18 13:05 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-08 09:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-29 07:11 --------- d-----w C:\Program Files\Opera
2008-07-22 03:51 --------- d-----w C:\Program Files\EA GAMES
2008-07-21 12:41 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\SystemRequirementsLab
2008-07-02 23:54 --------- d-----w C:\Program Files\Common Files\MAGIX Shared
2008-07-01 21:47 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Propellerhead Software
2008-07-01 21:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Propellerhead Software
2008-06-30 02:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-30 02:16 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Sierra Entertainment
2008-06-30 01:04 --------- d--h--r C:\Documents and Settings\Acount Of Death\Application Data\SecuROM
2008-06-29 23:56 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-29 23:55 --------- d-----w C:\Program Files\Google
2008-06-29 23:53 --------- d-----w C:\Program Files\Yahoo!
2008-06-29 23:52 --------- d-----w C:\Program Files\BitComet
2008-06-29 09:58 --------- d-----w C:\Program Files\Essentials Codec Pack
2008-06-29 09:53 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Any Video Converter
2008-06-29 07:49 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\DivX
2008-06-29 06:26 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Xilisoft Corporation
2008-06-29 05:26 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Yahoo!
2008-06-26 08:07 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Acoustica
2001-11-30 19:09 49,152 -c--a-r C:\Program Files\Common Files\HDvAvi.dll
.

((((((((((((((((((((((((((((( snapshot@2008-04-24_13.47.28.32 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-23 04:56:21 554,008 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\dao360.dll
+ 2007-12-10 12:41:11 518,944 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msexch40.dll
+ 2007-12-10 12:41:11 326,432 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msexcl40.dll
+ 2007-12-10 12:41:11 1,516,568 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjet40.dll
+ 2007-12-10 12:41:11 355,112 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjetol1.dll
+ 2008-03-27 07:39:13 151,583 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjint40.dll
+ 2007-12-10 12:41:12 60,192 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjter40.dll
+ 2007-12-10 12:41:12 248,608 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjtes40.dll
+ 2007-12-10 12:41:12 219,936 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msltus40.dll
+ 2007-12-10 12:41:12 355,104 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mspbde40.dll
+ 2007-12-10 12:41:13 432,928 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrd2x40.dll
+ 2007-12-10 12:41:13 322,336 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrd3x40.dll
+ 2007-12-10 12:41:13 559,904 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrepl40.dll
+ 2007-12-10 12:41:13 264,992 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mstext40.dll
+ 2007-12-10 12:41:13 838,432 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mswdat10.dll
+ 2007-12-10 12:41:14 621,344 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mswstr10.dll
+ 2007-12-10 12:41:14 355,104 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msxbde40.dll
+ 2007-03-06 01:22:36 14,048 ----a-w C:\WINDOWS\$hf_mig$\KB950749\spmsg.dll
+ 2007-03-06 01:22:41 213,216 ----a-w C:\WINDOWS\$hf_mig$\KB950749\spuninst.exe
+ 2007-03-06 01:22:34 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB950749\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 ----a-w C:\WINDOWS\$hf_mig$\KB950749\update\update.exe
+ 2007-03-06 01:23:51 371,424 ----a-w C:\WINDOWS\$hf_mig$\KB950749\update\updspapi.dll
+ 2008-04-21 06:56:54 1,024,000 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\browseui.dll
+ 2008-04-21 06:56:54 151,040 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\cdfview.dll
+ 2008-04-21 06:56:55 1,054,208 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\danim.dll
+ 2008-04-21 06:56:55 357,888 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\dxtmsft.dll
+ 2008-04-21 06:56:55 205,312 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\dxtrans.dll
+ 2008-04-21 06:56:55 55,808 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\extmgr.dll
+ 2008-04-17 10:46:59 18,432 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\iedw.exe
+ 2008-04-21 06:56:56 251,904 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\iepeers.dll
+ 2008-04-21 06:56:56 96,256 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\inseng.dll
+ 2008-04-21 06:56:56 16,384 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\jsproxy.dll
+ 2008-04-21 06:56:57 3,066,880 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\mshtml.dll
+ 2008-04-21 06:56:57 449,024 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\mshtmled.dll
+ 2008-04-21 06:56:57 146,432 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\msrating.dll
+ 2008-04-21 06:56:58 532,480 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\mstime.dll
+ 2008-04-21 06:56:58 39,424 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\pngfilt.dll
+ 2008-04-21 06:56:58 1,499,136 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\shdocvw.dll
+ 2008-04-21 06:56:58 474,112 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\shlwapi.dll
+ 2008-04-21 06:56:58 618,496 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\urlmon.dll
+ 2008-04-21 06:56:59 666,624 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\wininet.dll
+ 2008-04-17 10:37:04 351,744 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\xpsp3res.dll
+ 2008-04-21 06:44:29 3,066,880 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP3GDR\mshtml.dll
+ 2008-04-21 06:44:29 666,112 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP3GDR\wininet.dll
+ 2008-04-21 06:24:01 3,067,392 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP3QFE\mshtml.dll
+ 2008-04-21 06:24:02 666,624 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP3QFE\wininet.dll
+ 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB950759\spmsg.dll
+ 2007-11-30 12:39:22 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB950759\spuninst.exe
+ 2007-11-30 12:39:22 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB950759\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB950759\update\update.exe
+ 2007-11-30 12:39:22 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB950759\update\updspapi.dll
+ 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB950760\spmsg.dll
+ 2007-11-30 12:39:22 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB950760\spuninst.exe
+ 2007-11-30 12:39:22 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB950760\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB950760\update\update.exe
+ 2007-11-30 12:39:22 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB950760\update\updspapi.dll
+ 2008-05-08 12:14:51 203,008 ----a-w C:\WINDOWS\$hf_mig$\KB950762\SP2QFE\rmcast.sys
+ 2008-05-08 14:02:52 203,136 ----a-w C:\WINDOWS\$hf_mig$\KB950762\SP3GDR\rmcast.sys
+ 2008-05-08 13:58:17 203,136 ----a-w C:\WINDOWS\$hf_mig$\KB950762\SP3QFE\rmcast.sys
+ 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB950762\spmsg.dll
+ 2007-11-30 12:39:22 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB950762\spuninst.exe
+ 2007-11-30 12:39:22 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB950762\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB950762\update\update.exe
+ 2007-11-30 12:39:22 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB950762\update\updspapi.dll
+ 2008-07-07 20:06:43 253,952 ----a-w C:\WINDOWS\$hf_mig$\KB950974\SP2QFE\es.dll
+ 2008-07-07 20:26:58 253,952 ----a-w C:\WINDOWS\$hf_mig$\KB950974\SP3GDR\es.dll
+ 2008-07-07 20:23:18 253,952 ----a-w C:\WINDOWS\$hf_mig$\KB950974\SP3QFE\es.dll
+ 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB950974\spmsg.dll
+ 2007-11-30 12:39:22 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB950974\spuninst.exe
+ 2007-11-30 12:39:22 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB950974\update\spcustom.dll
+ 2007-11-30 12:39:18 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB950974\update\update.exe
+ 2007-11-30 12:39:19 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB950974\update\updspapi.dll
+ 2008-07-14 11:03:00 62,976 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\SP2QFE\tzchange.exe
+ 2008-07-11 12:42:28 62,976 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\SP3GDR\tzchange.exe
+ 2008-07-11 12:51:51 62,976 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\SP3QFE\tzchange.exe
+ 2007-11-30 11:18:51 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\spmsg.dll
+ 2007-11-30 11:18:51 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\spuninst.exe
+ 2007-11-30 11:18:51 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\update\update.exe
+ 2007-11-30 12:39:22 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\update\updspapi.dll
+ 2008-06-13 09:52:16 272,128 ----a-w C:\WINDOWS\$hf_mig$\KB951376-v2\SP2QFE\bthport.sys
+ 2008-06-13 11:05:51 272,128 ----a-w C:\WINDOWS\$hf_mig$\KB951376-v2\SP3GDR\bthport.sys
+ 2008-06-13 11:27:43 272,128 ----a-w C:\WINDOWS\$hf_mig$\KB951376-v2\SP3QFE\bthport.sys
+ 2007-11-30 11:18:51 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB951376-v2\spmsg.dll
+ 2007-11-30 11:18:51 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB951376-v2\spuninst.exe
+ 2007-11-30 11:18:51 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB951376-v2\update\spcustom.dll
+ 2007-11-30 11:18:51 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB951376-v2\update\update.exe
+ 2007-11-30 11:18:51 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB951376-v2\update\updspapi.dll
+ 2008-05-07 04:55:40 1,288,192 ----a-w C:\WINDOWS\$hf_mig$\KB951698\SP2QFE\quartz.dll
+ 2008-05-07 05:12:40 1,288,192 ----a-w C:\WINDOWS\$hf_mig$\KB951698\SP3GDR\quartz.dll
+ 2008-05-07 05:04:15 1,288,192 ----a-w C:\WINDOWS\$hf_mig$\KB951698\SP3QFE\quartz.dll
+ 2007-11-30 11:18:51 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB951698\spmsg.dll
+ 2007-11-30 11:18:51 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB951698\spuninst.exe
+ 2007-11-30 11:18:51 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB951698\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB951698\update\update.exe
+ 2007-11-30 12:39:22 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB951698\update\updspapi.dll
+ 2006-08-16 12:08:32 100,352 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\6to4svc.dll
+ 2008-06-20 10:44:08 138,368 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\afd.sys
+ 2008-06-20 17:36:11 147,968 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\dnsapi.dll
+ 2008-06-20 17:36:11 245,248 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\mswsock.dll
+ 2008-06-20 10:44:42 360,960 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
+ 2008-06-20 09:32:39 225,920 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip6.sys
+ 2008-06-20 11:40:08 138,496 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\afd.sys
+ 2008-06-20 17:46:57 147,968 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\dnsapi.dll
+ 2008-06-20 17:46:57 245,248 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\mswsock.dll
+ 2008-06-20 11:51:12 361,600 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
+ 2008-06-20 11:08:27 225,856 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip6.sys
+ 2008-06-20 11:48:03 138,496 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\afd.sys
+ 2008-06-20 17:43:05 147,968 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\dnsapi.dll
+ 2008-06-20 17:43:05 245,248 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\mswsock.dll
+ 2008-06-20 11:59:02 361,600 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
+ 2008-06-20 11:16:44 225,856 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip6.sys
+ 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB951748\spmsg.dll
+ 2007-11-30 12:39:22 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB951748\spuninst.exe
+ 2007-11-30 12:39:22 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB951748\update\spcustom.dll
+ 2007-11-30 12:39:18 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB951748\update\update.exe
+ 2007-11-30 12:39:19 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB951748\update\updspapi.dll
+ 2008-06-24 16:28:00 74,240 ----a-w C:\WINDOWS\$hf_mig$\KB952954\SP2QFE\mscms.dll
+ 2008-06-24 16:43:16 74,240 ----a-w C:\WINDOWS\$hf_mig$\KB952954\SP3GDR\mscms.dll
+ 2008-06-24 16:53:10 74,240 ----a-w C:\WINDOWS\$hf_mig$\KB952954\SP3QFE\mscms.dll
+ 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB952954\spmsg.dll
+ 2007-11-30 12:39:22 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB952954\spuninst.exe
+ 2007-11-30 12:39:22 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB952954\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB952954\update\update.exe
+ 2007-11-30 12:39:22 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB952954\update\updspapi.dll
+ 2008-06-23 16:11:40 1,024,000 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\browseui.dll
+ 2008-06-23 16:11:40 151,040 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\cdfview.dll
+ 2008-06-23 16:11:42 1,054,208 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\danim.dll
+ 2008-06-23 16:11:43 357,888 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\dxtmsft.dll
+ 2008-06-23 16:11:43 205,312 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\dxtrans.dll
+ 2008-06-23 16:11:43 55,808 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\extmgr.dll
+ 2008-06-23 09:53:58 18,432 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\iedw.exe
+ 2008-06-23 16:11:52 251,904 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\iepeers.dll
+ 2008-06-23 16:11:52 96,256 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\inseng.dll
+ 2008-06-23 16:11:52 16,384 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\jsproxy.dll
+ 2008-06-23 16:11:58 3,067,392 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\mshtml.dll
+ 2008-06-23 16:12:00 449,024 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\mshtmled.dll
+ 2008-06-23 16:12:02 146,432 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\msrating.dll
+ 2008-06-23 16:12:02 532,480 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\mstime.dll
+ 2008-06-23 16:12:02 39,424 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\pngfilt.dll
+ 2008-06-23 16:12:05 1,499,136 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\shdocvw.dll
+ 2008-06-23 16:12:05 474,112 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\shlwapi.dll
+ 2008-06-23 16:12:06 618,496 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\urlmon.dll
+ 2008-06-23 16:12:08 667,136 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\wininet.dll
+ 2008-07-03 09:14:02 351,744 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\xpsp3res.dll
+ 2008-06-23 15:09:27 3,067,392 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP3GDR\mshtml.dll
+ 2008-06-26 08:15:29 1,499,136 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP3GDR\shdocvw.dll
+ 2008-06-26 08:15:30 619,520 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP3GDR\urlmon.dll
+ 2008-06-23 15:09:27 666,112 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP3GDR\wininet.dll
+ 2008-06-25 04:24:48 3,067,904 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP3QFE\mshtml.dll
+ 2008-06-26 08:00:52 1,499,136 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP3QFE\shdocvw.dll
+ 2008-06-26 08:00:52 619,520 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP3QFE\urlmon.dll
+ 2008-06-23 14:54:47 666,624 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP3QFE\wininet.dll
+ 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB953838\spmsg.dll
+ 2007-11-30 12:39:22 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB953838\spuninst.exe
+ 2007-11-30 12:39:22 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB953838\update\spcustom.dll
+ 2007-11-30 12:39:18 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB953838\update\update.exe
+ 2007-11-30 12:39:19 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB953838\update\updspapi.dll
+ 2004-08-04 12:00:00 561,179 -c----w C:\WINDOWS\$NtUninstallKB950749$\dao360.dll
+ 2004-08-04 12:00:00 512,029 -c----w C:\WINDOWS\$NtUninstallKB950749$\msexch40.dll
+ 2004-08-04 12:00:00 319,517 -c----w C:\WINDOWS\$NtUninstallKB950749$\msexcl40.dll
+ 2004-08-04 12:00:00 1,507,356 -c----w C:\WINDOWS\$NtUninstallKB950749$\msjet40.dll
+ 2004-08-04 12:00:00 358,976 -c----w C:\WINDOWS\$NtUninstallKB950749$\msjetol1.dll
+ 2004-08-04 12:00:00 358,976 -c----w C:\WINDOWS\$NtUninstallKB950749$\msjetoledb40.dll
+ 2004-08-04 12:00:00 151,583 -c----w C:\WINDOWS\$NtUninstallKB950749$\msjint40.dll
+ 2004-08-04 12:00:00 53,279 -c----w C:\WINDOWS\$NtUninstallKB950749$\msjter40.dll
+ 2004-08-04 12:00:00 241,693 -c----w C:\WINDOWS\$NtUninstallKB950749$\msjtes40.dll
+ 2004-08-04 12:00:00 213,023 -c----w C:\WINDOWS\$NtUninstallKB950749$\msltus40.dll
+ 2004-08-04 12:00:00 348,189 -c----w C:\WINDOWS\$NtUninstallKB950749$\mspbde40.dll
+ 2004-08-04 12:00:00 421,919 -c----w C:\WINDOWS\$NtUninstallKB950749$\msrd2x40.dll
+ 2004-08-04 12:00:00 315,423 -c----w C:\WINDOWS\$NtUninstallKB950749$\msrd3x40.dll
+ 2004-08-04 12:00:00 552,989 -c----w C:\WINDOWS\$NtUninstallKB950749$\msrepl40.dll
+ 2004-08-04 12:00:00 258,077 -c----w C:\WINDOWS\$NtUninstallKB950749$\mstext40.dll
+ 2004-08-04 12:00:00 831,519 -c----w C:\WINDOWS\$NtUninstallKB950749$\mswdat10.dll
+ 2004-08-04 12:00:00 614,429 -c----w C:\WINDOWS\$NtUninstallKB950749$\mswstr10.dll
+ 2004-08-04 12:00:00 348,189 -c----w C:\WINDOWS\$NtUninstallKB950749$\msxbde40.dll
+ 2007-03-06 01:22:41 213,216 -c----w C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c----w C:\WINDOWS\$NtUninstallKB950749$\spuninst\updspapi.dll
+ 2008-02-16 08:59:34 1,023,488 -c----w C:\WINDOWS\$NtUninstallKB950759$\browseui.dll
+ 2008-02-16 08:59:35 151,040 -c----w C:\WINDOWS\$NtUninstallKB950759$\cdfview.dll
+ 2008-02-16 08:59:35 1,054,208 -c----w C:\WINDOWS\$NtUninstallKB950759$\danim.dll
+ 2008-02-16 08:59:35 357,888 -c----w C:\WINDOWS\$NtUninstallKB950759$\dxtmsft.dll
+ 2008-02-16 08:59:35 205,312 -c----w C:\WINDOWS\$NtUninstallKB950759$\dxtrans.dll
+ 2008-02-16 08:59:35 55,808 -c----w C:\WINDOWS\$NtUninstallKB950759$\extmgr.dll
+ 2008-02-15 09:23:37 18,432 -c----w C:\WINDOWS\$NtUninstallKB950759$\iedw.exe
+ 2008-02-16 08:59:35 251,392 -c----w C:\WINDOWS\$NtUninstallKB950759$\iepeers.dll
+ 2008-02-16 08:59:35 96,256 -c----w C:\WINDOWS\$NtUninstallKB950759$\inseng.dll
+ 2008-02-16 08:59:35 16,384 -c----w C:\WINDOWS\$NtUninstallKB950759$\jsproxy.dll
+ 2008-02-16 22:29:38 3,059,712 -c----w C:\WINDOWS\$NtUninstallKB950759$\mshtml.dll
+ 2008-02-16 08:59:37 449,024 -c----w C:\WINDOWS\$NtUninstallKB950759$\mshtmled.dll
+ 2008-02-16 08:59:37 146,432 -c----w C:\WINDOWS\$NtUninstallKB950759$\msrating.dll
+ 2008-02-16 08:59:37 532,480 -c----w C:\WINDOWS\$NtUninstallKB950759$\mstime.dll
+ 2008-02-16 08:59:37 39,424 -c----w C:\WINDOWS\$NtUninstallKB950759$\pngfilt.dll
+ 2008-02-16 08:59:38 1,494,528 -c----w C:\WINDOWS\$NtUninstallKB950759$\shdocvw.dll
+ 2008-02-16 08:59:38 474,112 -c----w C:\WINDOWS\$NtUninstallKB950759$\shlwapi.dll
+ 2007-11-30 12:39:22 231,288 -c----w C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe
+ 2007-11-30 12:39:22 382,840 -c----w C:\WINDOWS\$NtUninstallKB950759$\spuninst\updspapi.dll
+ 2008-02-16 08:59:38 615,936 -c----w C:\WINDOWS\$NtUninstallKB950759$\urlmon.dll
+ 2008-02-16 08:59:39 659,456 -c----w C:\WINDOWS\$NtUninstallKB950759$\wininet.dll
+ 2008-02-15 09:06:21 351,744 -c----w C:\WINDOWS\$NtUninstallKB950759$\xpsp3res.dll
+ 2007-11-30 12:39:22 231,288 -c----w C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe
+ 2007-11-30 12:39:22 382,840 -c----w C:\WINDOWS\$NtUninstallKB950760$\spuninst\updspapi.dll
+ 2006-07-13 08:48:58 202,240 -c----w C:\WINDOWS\$NtUninstallKB950762$\rmcast.sys
+ 2007-11-30 12:39:22 231,288 -c----w C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe
+ 2007-11-30 12:39:22 382,840 -c----w C:\WINDOWS\$NtUninstallKB950762$\spuninst\updspapi.dll
+ 2007-11-30 11:18:51 231,288 -c----w C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe
+ 2007-11-30 11:18:51 382,840 -c----w C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\updspapi.dll
+ 2007-10-29 22:43:03 1,287,680 -c----w C:\WINDOWS\$NtUninstallKB951698$\quartz.dll
+ 2007-11-30 11:18:51 231,288 -c----w C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe
+ 2007-11-30 12:39:22 382,840 -c----w C:\WINDOWS\$NtUninstallKB951698$\spuninst\updspapi.dll
+ 2004-08-04 12:00:00 138,496 -c----w C:\WINDOWS\$NtUninstallKB951748$\afd.sys
+ 2008-02-20 05:32:43 148,992 -c----w C:\WINDOWS\$NtUninstallKB951748$\dnsapi.dll
+ 2004-08-04 12:00:00 245,248 -c----w C:\WINDOWS\$NtUninstallKB951748$\mswsock.dll
+ 2007-11-30 12:39:22 231,288 -c----w C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe
+ 2007-11-30 12:39:19 382,840 -c----w C:\WINDOWS\$NtUninstallKB951748$\spuninst\updspapi.dll
+ 2007-10-30 17:20:55 360,064 -c----w C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
+ 2006-08-16 09:37:30 225,664 -c----w C:\WINDOWS\$NtUninstallKB951748$\tcpip6.sys
- 2008-02-26 07:11:22 53,248 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2008-06-30 00:26:26 53,248 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
- 2008-02-26 07:11:22 12,800 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
+ 2008-06-30 00:26:26 12,800 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
- 2008-02-26 07:11:22 473,600 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
+ 2008-06-30 00:26:27 473,600 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
- 2008-02-26 07:09:31 2,676,224 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-30 00:26:14 2,676,224 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-02-26 07:09:44 2,846,720 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-30 00:26:16 2,846,720 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-02-26 07:09:54 563,712 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-30 00:26:18 563,712 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-02-26 07:10:04 567,296 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-30 00:26:19 567,296 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-02-26 07:10:05 576,000 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-30 00:26:20 576,000 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-02-26 07:10:14 577,024 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-30 00:26:21 577,024 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-02-26 07:10:22 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-30 00:26:22 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-02-26 07:10:31 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-30 00:26:23 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-02-26 07:10:41 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-30 00:26:23 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-02-26 07:11:23 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-30 00:26:28 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-02-26 07:11:28 145,920 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
+ 2008-06-30 00:26:29 145,920 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
- 2008-02-26 07:11:28 159,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
+ 2008-06-30 00:26:29 159,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
- 2008-02-26 07:11:29 364,544 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
+ 2008-06-30 00:26:30 364,544 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
- 2008-02-26 07:11:29 178,176 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
+ 2008-06-30 00:26:30 178,176 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
- 2008-02-26 07:11:21 223,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
+ 2008-06-30 00:26:25 223,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
+ 2008-06-06 05:39:36 68,608 ----a-w C:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2008-06-06 05:39:47 72,192 ----a-w C:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2008-06-06 05:39:48 4,308,992 ----a-w C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2008-06-06 05:39:49 482,304 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2008-06-06 05:39:44 2,878,976 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2008-06-06 05:39:29 258,048 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2008-06-06 05:39:29 114,176 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2008-06-06 05:39:56 260,096 ----a-w C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2008-06-06 05:39:39 5,025,792 ----a-w C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2008-06-06 05:39:34 10,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2008-06-06 05:39:28 503,808 ----a-w C:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2008-06-06 05:39:30 13,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2008-06-06 05:39:46 8,192 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2008-06-06 05:39:46 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2008-06-06 05:39:47 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2008-06-06 05:39:31 413,696 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2008-06-06 05:39:32 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2008-06-06 05:39:33 647,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2008-06-06 05:39:34 73,728 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2008-06-06 05:39:31 745,472 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2008-06-06 05:39:58 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2008-06-06 05:39:58 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
+ 2008-06-06 05:39:26 28,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2008-06-06 05:39:57 667,648 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2008-06-06 05:39:59 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2008-06-06 05:39:28 12,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2008-06-06 05:39:27 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2008-06-06 05:39:27 7,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2008-06-06 05:39:52 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2008-06-06 05:39:36 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2008-06-06 05:39:53 389,120 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2008-06-06 05:39:50 716,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2008-06-06 05:39:30 884,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2008-06-06 05:39:45 5,050,368 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2008-06-06 05:39:37 188,416 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2008-06-06 05:39:37 397,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2008-06-06 05:39:38 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2008-06-06 05:39:54 700,416 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2008-06-06 05:39:51 368,640 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2008-06-06 05:39:55 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2008-06-06 05:39:51 299,008 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2008-06-06 05:39:52 131,072 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2008-06-06 05:39:35 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2008-06-06 05:39:38 114,688 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2008-06-06 05:39:56 835,584 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2008-06-06 05:39:40 86,016 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2008-06-06 05:39:41 823,296 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2008-06-06 05:39:42 5,316,608 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2008-06-06 05:39:43 2,035,712 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2008-06-06 05:39:54 3,018,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2008-06-06 05:46:05 26,624 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\6b66089bb3dcf845a047a319cbabb5a0\Accessibility.ni.dll
+ 2008-06-06 06:57:17 860,160 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\42d8cb93cd76784ab4c5594123143341\AspNetMMCExt.ni.dll
+ 2008-06-06 06:57:20 237,568 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\3a67fa78a140e14a8819e7a35c9de7b1\CustomMarshalers.ni.dll
+ 2008-06-06 06:57:19 15,360 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\dfsvc\4c4530da94b2d94c885eca2f84d75c89\dfsvc.ni.exe
+ 2008-06-06 05:48:09 58,880 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\DriversHQ.DriverDet#\20fa10a6ea4c654db2a1baac2d1c2613\DriversHQ.DriverDetective.ExceptionLogging.ni.dll
+ 2008-06-06 05:45:45 2,232,320 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\DriversHQ.DriverDet#\65217fd619dfb945bfb0d0168af8a7ce\DriversHQ.DriverDetective.Client.ni.exe
+ 2008-06-06 05:46:17 225,280 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\DriversHQ.DriverDet#\8b047b28980aca41a128780f99045e58\DriversHQ.DriverDetective.Client.Communication.ni.dll
+ 2008-06-06 05:48:08 188,416 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\DriversHQ.DriverDet#\c572eeeb1353b5428edd67d04d69efd0\DriversHQ.DriverDetective.Common.ni.dll
+ 2008-06-06 05:48:10 253,952 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\3877c23eed2f544dbc7ad52d3a03b901\Microsoft.ApplicationBlocks.Updater.ni.dll
+ 2008-06-06 06:57:23 880,640 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\44d3900106de5c49bd805f0bd423c931\Microsoft.Build.Engine.ni.dll
+ 2008-06-06 06:57:24 81,920 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\92e5d100c79cc24c8897e997998870b7\Microsoft.Build.Framework.ni.dll
+ 2008-06-06 06:57:31 1,691,648 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\1bc177fb9c88974983de689e097f915a\Microsoft.Build.Tasks.ni.dll
+ 2008-06-06 06:57:33 163,840 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\105830a51a694b408702ce504dd2b6e9\Microsoft.Build.Utilities.ni.dll
+ 2008-06-06 05:48:25 2,441,216 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\46c2849400682a40beeec7377cffeee9\Microsoft.JScript.ni.dll
+ 2008-06-06 05:48:12 368,640 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Practices#\55e9f3325f28e34f848e66d15dc1d052\Microsoft.Practices.EnterpriseLibrary.Common.ni.dll
+ 2008-06-06 05:48:28 356,352 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Practices#\84509a39d71286438e1d5329321afe87\Microsoft.Practices.ObjectBuilder.ni.dll
+ 2008-06-06 05:48:29 167,936 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Practices#\c9629647bc23fe41b8bec1853c96ed2f\Microsoft.Practices.EnterpriseLibrary.Security.Cryptography.ni.dll
+ 2008-06-06 06:57:39 1,724,416 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\94f7f31533c2ea4599d4ebe284727bd2\Microsoft.VisualBasic.ni.dll
+ 2008-06-06 05:47:41 17,920 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\39f52f06dabfbd4a803f914354a222c7\Microsoft.VisualC.ni.dll
+ 2008-06-06 05:48:26 77,824 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\86fdd6b39979604a83748263391a1ef0\Microsoft.Vsa.ni.dll
+ 2008-06-06 05:41:06 11,411,456 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\48e017e34fd8804ea441d798a3ab550d\mscorlib.ni.dll
+ 2008-06-06 05:46:14 167,936 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\258857134d42f846b4591eea085e3524\System.Configuration.Install.ni.dll
+ 2008-06-06 05:45:49 962,560 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\c52790b38785b74d8d48c05f4f5078ef\System.Configuration.ni.dll
+ 2008-06-06 05:48:05 1,179,648 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\868698a584511247a12e520ca0d10ecc\System.Data.OracleClient.ni.dll
+ 2008-06-06 05:46:01 2,703,360 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\5eb35acb9e1e0e4a9dfe45f28073dcc3\System.Data.SqlXml.ni.dll
+ 2008-06-06 05:43:39 6,688,768 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\46d3958c6635a44ebef60a5ce64eeb3e\System.Data.ni.dll
+ 2008-06-06 05:46:12 1,712,128 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Deployment\ad5747e2661dc6438a6b36ba4a8f773b\System.Deployment.ni.dll
+ 2008-06-06 05:44:27 10,723,328 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Design\669e1744e8a44b4aa979a8f5492f3987\System.Design.ni.dll
+ 2008-06-06 05:47:52 1,220,608 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\2f828eb8dd34724caad8697f3b49b1a7\System.DirectoryServices.ni.dll
+ 2008-06-06 05:48:00 512,000 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\bf26f790e3c7e54696eb5dcfc9306277\System.DirectoryServices.Protocols.ni.dll
+ 2008-06-06 05:41:55 229,376 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\97b9b5231f2cd14b9427462fbc1e2d5e\System.Drawing.Design.ni.dll
+ 2008-06-06 05:42:04 1,626,112 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\2a6933162a21b541a4b01a852dc439c6\System.Drawing.ni.dll
+ 2008-06-06 05:47:47 659,456 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\1eaad28e9d7f70438f2fcbb86e353673\System.EnterpriseServices.ni.dll
+ 2008-06-06 05:47:47 294,912 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\1eaad28e9d7f70438f2fcbb86e353673\System.EnterpriseServices.Wrapper.dll
+ 2008-06-06 05:48:16 1,060,864 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\0334f42222b8e04d8c80abf863fb9284\System.Management.ni.dll
+ 2008-06-06 05:47:58 815,104 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\a1e539cbd1c2c040a4d692ac7fb4f8e0\System.Runtime.Remoting.ni.dll
+ 2008-06-06 05:46:06 339,968 ----a-w C:\W

#6
fenzodahl512

Posted 26 August 2008 - 02:42 AM

Malware Removal
9,863 posts

Installing Recovery Console:

It appears your computer has no Recovery Console installed. We need to install Recovery Console first before proceed to our next fix. Please do the following..

Please go to Microsoft's website => HERE
Select the download that's appropriate for your Operating System Windows XP Home Edition Service Pack 2 (SP2)

Posted Image

Download the file & save it as it's originally named, next to ComboFix.exe.

Posted Image

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.

After successfully install Recovery Console, a pop-on will appear asking to run ComboFix, please select NO.

NEXT

1. Please open Notepad

Click Start, then Run
Type notepad.exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

File::
C:\WINDOWS\system32\13.tmp
C:\WINDOWS\system32\12.tmp
C:\WINDOWS\system32\10.tmp
C:\Documents and Settings\Acount Of Death\MediaTubeCodec_ver1.1463.0.exe
C:\Documents and Settings\Acount Of Death\css.exe
C:\Documents and Settings\Acount Of Death\sccs.exe
C:\Documents and Settings\Acount Of Death\intelOP.exe
C:\Documents and Settings\Acount Of Death\ppxcs.exe

3. Save the above as CFScript.txt in your Desktop.

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

Regards
fenzodahl512

#7
helpme?

Posted 26 August 2008 - 03:14 AM

Member

Topic Starter
Member
46 posts

COMBOFIX LOG:
********************
ComboFix 08-08-24.03 - Acount Of Death 2008-08-26 1:58:13.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.926 [GMT -7:00]
Running from: C:\Documents and Settings\Acount Of Death\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Acount Of Death\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\Documents and Settings\Acount Of Death\css.exe
C:\Documents and Settings\Acount Of Death\intelOP.exe
C:\Documents and Settings\Acount Of Death\MediaTubeCodec_ver1.1463.0.exe
C:\Documents and Settings\Acount Of Death\ppxcs.exe
C:\Documents and Settings\Acount Of Death\sccs.exe
C:\WINDOWS\system32\10.tmp
C:\WINDOWS\system32\12.tmp
C:\WINDOWS\system32\13.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Acount Of Death\css.exe
C:\Documents and Settings\Acount Of Death\intelOP.exe
C:\Documents and Settings\Acount Of Death\MediaTubeCodec_ver1.1463.0.exe
C:\Documents and Settings\Acount Of Death\ppxcs.exe
C:\Documents and Settings\Acount Of Death\sccs.exe
C:\WINDOWS\system32\10.tmp
C:\WINDOWS\system32\12.tmp
C:\WINDOWS\system32\13.tmp

.
((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 )))))))))))))))))))))))))))))))
.

2008-08-25 22:20 . 2008-08-25 22:20 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-25 21:45 . 2008-08-25 21:45 <DIR> d-------- C:\Program Files\ERUNT
2008-08-25 03:30 . 2008-08-25 03:30 268 --ah----- C:\sqmdata10.sqm
2008-08-25 03:30 . 2008-08-25 03:30 244 --ah----- C:\sqmnoopt10.sqm
2008-08-24 23:11 . 2008-08-24 23:13 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-08-19 00:46 . 2008-08-22 22:27 <DIR> d-------- C:\Program Files\the new magix one that works
2008-08-18 05:59 . 2008-08-18 05:59 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-08-18 05:59 . 2008-08-18 05:59 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-08-18 05:58 . 2008-08-18 05:58 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-08-18 05:58 . 2008-08-18 05:58 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-08-18 05:04 . 2008-08-19 14:13 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-08-14 19:15 . 2008-08-18 22:13 <DIR> d-------- C:\Program Files\Acoustica Shared Effects
2008-08-14 19:15 . 2008-08-18 20:44 <DIR> d-------- C:\Program Files\Acoustica Beatcraft
2008-08-14 15:52 . 2008-08-14 15:52 <DIR> d-------- C:\New Folder 1
2008-08-14 15:41 . 2008-08-18 03:18 <DIR> d-------- C:\Program Files\DivX
2008-08-14 15:27 . 2005-06-21 16:43 163,840 --a------ C:\WINDOWS\system32\igfxres.dll
2008-08-08 03:46 . 2008-08-08 03:46 268 --ah----- C:\sqmdata09.sqm
2008-08-08 03:46 . 2008-08-08 03:46 244 --ah----- C:\sqmnoopt09.sqm
2008-08-08 02:33 . 2008-08-08 02:33 <DIR> d-------- C:\Program Files\Lavasoft
2008-08-08 01:42 . 2008-08-08 01:42 268 --ah----- C:\sqmdata08.sqm
2008-08-08 01:42 . 2008-08-08 01:42 244 --ah----- C:\sqmnoopt08.sqm
2008-08-08 00:47 . 2008-08-08 00:47 268 --ah----- C:\sqmdata07.sqm
2008-08-08 00:47 . 2008-08-08 00:47 244 --ah----- C:\sqmnoopt07.sqm
2008-08-07 23:52 . 2008-08-07 23:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\services
2008-08-05 22:54 . 2008-08-05 22:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2008-08-05 22:46 . 2008-08-05 22:55 <DIR> d-------- C:\Program Files\Common Files\AVSMedia
2008-08-05 22:46 . 2008-08-05 22:55 <DIR> d-------- C:\Program Files\AVS4YOU
2008-08-05 22:46 . 2002-01-05 16:48 974,848 --a------ C:\WINDOWS\system32\mfc70.dll
2008-08-05 22:46 . 2007-09-27 15:22 524,288 --a------ C:\WINDOWS\system32\xvidcore.dll
2008-08-05 22:46 . 2003-05-22 00:50 156,910 --a------ C:\WINDOWS\WMSysPr8.prx
2008-08-05 22:46 . 2007-09-27 15:22 139,264 --a------ C:\WINDOWS\system32\xvidvfw.dll
2008-08-05 22:46 . 2003-05-22 00:50 82,944 --a------ C:\WINDOWS\system32\vct3216.acm
2008-08-05 22:46 . 2004-02-04 22:11 81,920 --a------ C:\WINDOWS\system32\AC3ACM.acm
2008-08-05 22:46 . 2004-09-06 17:06 53,248 --a------ C:\WINDOWS\system32\xvid.ax
2008-08-05 22:46 . 2003-05-22 00:50 38,912 --a------ C:\WINDOWS\system32\alf2cd.acm
2008-08-05 22:46 . 2003-05-21 13:50 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-08-05 22:46 . 2000-03-14 21:55 13,239 --a------ C:\WINDOWS\system32\Scg726.acm
2008-08-05 14:58 . 2008-08-05 14:58 161,096 --a--c--- C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-08-03 21:23 . 2008-08-03 21:23 <DIR> d-------- C:\Program Files\bluesforpeace
2008-07-29 00:42 . 2008-07-29 00:42 0 --a------ C:\WINDOWS\nsreg.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-25 21:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-08-25 11:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\SITEguard
2008-08-25 06:20 --------- d-----w C:\Program Files\DNA
2008-08-25 06:19 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-23 05:28 --------- d-----w C:\Program Files\MAGIX
2008-08-23 05:28 --------- d-----w C:\Program Files\Acoustica Mixcraft 4
2008-08-19 08:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\MAGIX
2008-08-19 08:06 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\MAGIX
2008-08-18 13:05 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-08 09:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-29 07:11 --------- d-----w C:\Program Files\Opera
2008-07-22 03:51 --------- d-----w C:\Program Files\EA GAMES
2008-07-21 12:41 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\SystemRequirementsLab
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-02 23:54 --------- d-----w C:\Program Files\Common Files\MAGIX Shared
2008-07-01 21:47 368,640 ----a-w C:\WINDOWS\system32\ReWire.dll
2008-07-01 21:47 233,472 ----a-w C:\WINDOWS\system32\REX Shared Library.dll
2008-07-01 21:47 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Propellerhead Software
2008-07-01 21:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Propellerhead Software
2008-06-30 02:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-30 02:16 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Sierra Entertainment
2008-06-30 01:04 --------- d--h--r C:\Documents and Settings\Acount Of Death\Application Data\SecuROM
2008-06-29 23:56 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-29 23:55 --------- d-----w C:\Program Files\Google
2008-06-29 23:53 --------- d-----w C:\Program Files\Yahoo!
2008-06-29 23:52 --------- d-----w C:\Program Files\BitComet
2008-06-29 09:58 --------- d-----w C:\Program Files\Essentials Codec Pack
2008-06-29 09:53 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Any Video Converter
2008-06-29 07:49 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\DivX
2008-06-29 06:26 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Xilisoft Corporation
2008-06-29 05:26 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Yahoo!
2008-06-26 08:07 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Acoustica
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 15:38 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-06 03:43 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2001-11-30 19:09 49,152 -c--a-r C:\Program Files\Common Files\HDvAvi.dll
.

((((((((((((((((((((((((((((( snapshot_2008-08-26_ 0.25.31.06 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-26 09:02:18 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_64c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sccs"="C:\Documents and Settings\Acount Of Death\sccs.ex" [X]
"ppxcs"="C:\Documents and Settings\Acount Of Death\ppxcs.e" [X]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-21 16:48 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-21 16:44 126976]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 15:42 1404928]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-09-18 13:25 7630848]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-09-18 13:25 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Dell AIO Printer A920"="C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe" [2003-05-12 15:02 270336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.3IV2"= 3ivxVfWCodec_dec.dll
"msacm.ivimp3en"= ivimp3en.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Opera\\opera.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\WINDOWS\\system32\\mmc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"16222:TCP"= 16222:TCP:*:Disabled:BitComet 16222 TCP
"16222:UDP"= 16222:UDP:*:Disabled:BitComet 16222 UDP

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 11:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 11:35]
S2 MKEMUSB;Panasonic Digital Palmcorder;C:\WINDOWS\system32\Drivers\Mkemusb.sys [2001-08-08 19:52]
S3 cirrus;cirrus;C:\WINDOWS\system32\DRIVERS\cirrus.sys [2001-08-17 13:57]
S3 DCamUSBMke;USB Video Camera for Panasonic Digital Palmcorder;C:\WINDOWS\system32\Drivers\Mkeusbi.sys [2001-12-18 12:38]
S3 UPnPService;UPnPService;C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2006-12-14 16:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{365ac32b-b4ee-11dc-b5c9-00123fd353e5}]
\Shell\AutoRun\command - H:\system\viewer\FlipVideoforPC.exe
\Shell\Flip Video for PC\command - H:\system\viewer\FlipVideoforPC.exe
.
Contents of the 'Scheduled Tasks' folder

2008-08-26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe []
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Css - C:\Documents and Settings\Acount Of Death\css.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-26 02:03:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
.
**************************************************************************
.
Completion time: 2008-08-26 2:11:52 - machine was rebooted [Acount Of Death]
ComboFix-quarantined-files.txt 2008-08-26 09:11:19
ComboFix2.txt 2008-08-26 07:27:10
ComboFix3.txt 2008-04-24 20:48:03

Pre-Run: 4,370,178,048 bytes free
Post-Run: 4,355,301,376 bytes free

195 --- E O F --- 2008-08-19 10:05:21
********************************************************************************
****************

HIGHJACKTHIS LOG:
***************************
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:14:21 AM, on 8/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [Sccs] C:\Documents and Settings\Acount Of Death\sccs.ex
O4 - HKLM\..\Run: [ppxcs] C:\Documents and Settings\Acount Of Death\ppxcs.e
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Unknown owner - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe

--
End of file - 5101 bytes

#8
fenzodahl512

Posted 26 August 2008 - 03:26 AM

Malware Removal
9,863 posts

1. Please open Notepad

Click Start, then Run
Type notepad.exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

File::
C:\Documents and Settings\Acount Of Death\sccs.ex
C:\Documents and Settings\Acount Of Death\ppxcs.e

3. Save the above as CFScript.txt in your Desktop.

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image

5. After reboot, (in case it asks to reboot), please post the ComboFix log in your next reply..

NEXT

Please re-open HijackThis and click on Do a system scan only. Check the boxes next to all the entries listed below.

O4 - HKLM\..\Run: [Sccs] C:\Documents and Settings\Acount Of Death\sccs.ex
O4 - HKLM\..\Run: [ppxcs] C:\Documents and Settings\Acount Of Death\ppxcs.e

Now close all windows other than HijackThis, then click Fix checked. Close HijackThis.

NEXT

Please download Malwarebytes' Anti-Malware from HERE or HERE

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Full Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

Post these logs in your next reply.. Post each log in separate post
1. ComboFix
2. Malwarebytes'
3. A fresh HijackThis log (after Malwarebytes' step)
4. Tell me about your computer behaviour..

Regards
fenzodahl512

#9
helpme?

Posted 26 August 2008 - 03:47 AM

Member

Topic Starter
Member
46 posts

combofix didnt give me a log

#10
helpme?

Posted 26 August 2008 - 03:51 AM

Member

Topic Starter
Member
46 posts

HIGHJACKTHIS LOG:
***********************

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:50, on 2008-08-26
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Unknown owner - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe

--
End of file - 4965 bytes

#11
helpme?

Posted 26 August 2008 - 03:55 AM

Member

Topic Starter
Member
46 posts

Malware Log:
*******************
Malwarebytes' Anti-Malware 1.25
Database version: 1062
Windows 5.1.2600 Service Pack 2

02:54:50 2008-08-26
mbam-log-08-26-2008 (02-54-50).txt

Scan type: Quick Scan
Objects scanned: 41307
Time elapsed: 6 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\{5222008a-dd62-49c7-a735-7bd18ecc7350} (Rogue.VirusRemover) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\virusremover2008 (Rogue.VirusRemove) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\virusremover2008 (Rogue.VirusRemove) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bgrqfetx.bnkq (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\All Users\Start Menu\Programs\VirusRemover2008 (Rogue.VirusRemove) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\9GPG7VEH\SystemDefender_Installer[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\VirusRemover2008\VirusRemover2008.lnk (Rogue.VirusRemove) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\services\services.dll (Trojan.Agent) -> Quarantined and deleted successfully.

#12
fenzodahl512

Posted 26 August 2008 - 04:16 AM

Malware Removal
9,863 posts

Malwarebytes' Anti-Malware 1.25
Database version: 1062
Windows 5.1.2600 Service Pack 2

02:54:50 2008-08-26
mbam-log-08-26-2008 (02-54-50).txt

Scan type: Quick Scan
Objects scanned: 41307
Time elapsed: 6 minute(s), 54 second(s)

Hi.. Please run a Full Scan with Malwarebytes' and not a quick scan..

Then please run ComboFix again (just double-click it) and post the log here..

#13
helpme?

Posted 26 August 2008 - 07:14 AM

Member

Topic Starter
Member
46 posts

MALWARE LOG:
*******************
Malwarebytes' Anti-Malware 1.25
Database version: 1062
Windows 5.1.2600 Service Pack 2

02:54:50 2008-08-26
mbam-log-08-26-2008 (02-54-50).txt

Scan type: Quick Scan
Objects scanned: 41307
Time elapsed: 6 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\{5222008a-dd62-49c7-a735-7bd18ecc7350} (Rogue.VirusRemover) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\virusremover2008 (Rogue.VirusRemove) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\virusremover2008 (Rogue.VirusRemove) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bgrqfetx.bnkq (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\All Users\Start Menu\Programs\VirusRemover2008 (Rogue.VirusRemove) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\9GPG7VEH\SystemDefender_Installer[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\VirusRemover2008\VirusRemover2008.lnk (Rogue.VirusRemove) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\services\services.dll (Trojan.Agent) -> Quarantined and deleted successfully.

#14
helpme?

Posted 26 August 2008 - 07:26 AM

Member

Topic Starter
Member
46 posts

COMBOFIX LOG:
*******************
ComboFix 08-08-24.03 - Acount Of Death 2008-08-26 6:15:07.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.894 [GMT -7:00]
Running from: C:\Documents and Settings\Acount Of Death\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Acount Of Death\Application Data\macromedia\Flash Player\#SharedObjects\9KXD4MAE\interclick.com
C:\Documents and Settings\Acount Of Death\Application Data\macromedia\Flash Player\#SharedObjects\9KXD4MAE\interclick.com\ud.sol
C:\Documents and Settings\Acount Of Death\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Acount Of Death\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol

.
((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 )))))))))))))))))))))))))))))))
.

2008-08-26 02:45 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-26 02:45 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-25 22:20 . 2008-08-25 22:20 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-25 21:45 . 2008-08-25 21:45 <DIR> d-------- C:\Program Files\ERUNT
2008-08-25 03:30 . 2008-08-25 03:30 268 --ah----- C:\sqmdata10.sqm
2008-08-25 03:30 . 2008-08-25 03:30 244 --ah----- C:\sqmnoopt10.sqm
2008-08-24 23:11 . 2008-08-24 23:13 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-08-19 00:46 . 2008-08-22 22:27 <DIR> d-------- C:\Program Files\the new magix one that works
2008-08-18 05:59 . 2008-08-18 05:59 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-08-18 05:59 . 2008-08-18 05:59 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-08-18 05:58 . 2008-08-18 05:58 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-08-18 05:58 . 2008-08-18 05:58 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-08-18 05:04 . 2008-08-19 14:13 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-08-14 19:15 . 2008-08-18 22:13 <DIR> d-------- C:\Program Files\Acoustica Shared Effects
2008-08-14 19:15 . 2008-08-18 20:44 <DIR> d-------- C:\Program Files\Acoustica Beatcraft
2008-08-14 15:52 . 2008-08-14 15:52 <DIR> d-------- C:\New Folder 1
2008-08-14 15:41 . 2008-08-18 03:18 <DIR> d-------- C:\Program Files\DivX
2008-08-14 15:27 . 2005-06-21 16:43 163,840 --a------ C:\WINDOWS\system32\igfxres.dll
2008-08-08 03:46 . 2008-08-08 03:46 268 --ah----- C:\sqmdata09.sqm
2008-08-08 03:46 . 2008-08-08 03:46 244 --ah----- C:\sqmnoopt09.sqm
2008-08-08 02:33 . 2008-08-08 02:33 <DIR> d-------- C:\Program Files\Lavasoft
2008-08-08 01:42 . 2008-08-08 01:42 268 --ah----- C:\sqmdata08.sqm
2008-08-08 01:42 . 2008-08-08 01:42 244 --ah----- C:\sqmnoopt08.sqm
2008-08-08 00:47 . 2008-08-08 00:47 268 --ah----- C:\sqmdata07.sqm
2008-08-08 00:47 . 2008-08-08 00:47 244 --ah----- C:\sqmnoopt07.sqm
2008-08-07 23:52 . 2008-08-26 02:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\services
2008-08-05 22:54 . 2008-08-05 22:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2008-08-05 22:46 . 2008-08-05 22:55 <DIR> d-------- C:\Program Files\Common Files\AVSMedia
2008-08-05 22:46 . 2008-08-05 22:55 <DIR> d-------- C:\Program Files\AVS4YOU
2008-08-05 22:46 . 2002-01-05 16:48 974,848 --a------ C:\WINDOWS\system32\mfc70.dll
2008-08-05 22:46 . 2007-09-27 15:22 524,288 --a------ C:\WINDOWS\system32\xvidcore.dll
2008-08-05 22:46 . 2003-05-22 00:50 156,910 --a------ C:\WINDOWS\WMSysPr8.prx
2008-08-05 22:46 . 2007-09-27 15:22 139,264 --a------ C:\WINDOWS\system32\xvidvfw.dll
2008-08-05 22:46 . 2003-05-22 00:50 82,944 --a------ C:\WINDOWS\system32\vct3216.acm
2008-08-05 22:46 . 2004-02-04 22:11 81,920 --a------ C:\WINDOWS\system32\AC3ACM.acm
2008-08-05 22:46 . 2004-09-06 17:06 53,248 --a------ C:\WINDOWS\system32\xvid.ax
2008-08-05 22:46 . 2003-05-22 00:50 38,912 --a------ C:\WINDOWS\system32\alf2cd.acm
2008-08-05 22:46 . 2003-05-21 13:50 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-08-05 22:46 . 2000-03-14 21:55 13,239 --a------ C:\WINDOWS\system32\Scg726.acm
2008-08-05 14:58 . 2008-08-05 14:58 161,096 --a--c--- C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-08-03 21:23 . 2008-08-03 21:23 <DIR> d-------- C:\Program Files\bluesforpeace
2008-07-29 00:42 . 2008-07-29 00:42 0 --a------ C:\WINDOWS\nsreg.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-26 09:45 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-08-25 21:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-08-25 11:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\SITEguard
2008-08-25 06:20 --------- d-----w C:\Program Files\DNA
2008-08-25 06:19 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-23 05:28 --------- d-----w C:\Program Files\MAGIX
2008-08-23 05:28 --------- d-----w C:\Program Files\Acoustica Mixcraft 4
2008-08-19 08:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\MAGIX
2008-08-19 08:06 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\MAGIX
2008-08-18 13:05 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-08 09:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-29 07:11 --------- d-----w C:\Program Files\Opera
2008-07-22 03:51 --------- d-----w C:\Program Files\EA GAMES
2008-07-21 12:41 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\SystemRequirementsLab
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-02 23:54 --------- d-----w C:\Program Files\Common Files\MAGIX Shared
2008-07-01 21:47 368,640 ----a-w C:\WINDOWS\system32\ReWire.dll
2008-07-01 21:47 233,472 ----a-w C:\WINDOWS\system32\REX Shared Library.dll
2008-07-01 21:47 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Propellerhead Software
2008-07-01 21:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Propellerhead Software
2008-06-30 02:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-30 02:16 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Sierra Entertainment
2008-06-30 01:04 --------- d--h--r C:\Documents and Settings\Acount Of Death\Application Data\SecuROM
2008-06-29 23:56 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-29 23:55 --------- d-----w C:\Program Files\Google
2008-06-29 23:53 --------- d-----w C:\Program Files\Yahoo!
2008-06-29 23:52 --------- d-----w C:\Program Files\BitComet
2008-06-29 09:58 --------- d-----w C:\Program Files\Essentials Codec Pack
2008-06-29 09:53 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Any Video Converter
2008-06-29 07:49 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\DivX
2008-06-29 06:26 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Xilisoft Corporation
2008-06-29 05:26 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Yahoo!
2008-06-26 08:07 --------- d-----w C:\Documents and Settings\Acount Of Death\Application Data\Acoustica
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 15:38 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-06 03:43 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2001-11-30 19:09 49,152 -c--a-r C:\Program Files\Common Files\HDvAvi.dll
.

((((((((((((((((((((((((((((( snapshot_2008-08-26_ 0.25.31.06 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-26 13:11:24 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_644.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-21 16:48 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-21 16:44 126976]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 15:42 1404928]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-09-18 13:25 7630848]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-09-18 13:25 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Dell AIO Printer A920"="C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe" [2003-05-12 15:02 270336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.3IV2"= 3ivxVfWCodec_dec.dll
"msacm.ivimp3en"= ivimp3en.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Opera\\opera.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\WINDOWS\\system32\\mmc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"16222:TCP"= 16222:TCP:*:Disabled:BitComet 16222 TCP
"16222:UDP"= 16222:UDP:*:Disabled:BitComet 16222 UDP

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 11:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 11:35]
S2 MKEMUSB;Panasonic Digital Palmcorder;C:\WINDOWS\system32\Drivers\Mkemusb.sys [2001-08-08 19:52]
S3 cirrus;cirrus;C:\WINDOWS\system32\DRIVERS\cirrus.sys [2001-08-17 13:57]
S3 DCamUSBMke;USB Video Camera for Panasonic Digital Palmcorder;C:\WINDOWS\system32\Drivers\Mkeusbi.sys [2001-12-18 12:38]
S3 UPnPService;UPnPService;C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2006-12-14 16:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{365ac32b-b4ee-11dc-b5c9-00123fd353e5}]
\Shell\AutoRun\command - H:\system\viewer\FlipVideoforPC.exe
\Shell\Flip Video for PC\command - H:\system\viewer\FlipVideoforPC.exe
.
Contents of the 'Scheduled Tasks' folder

2008-08-26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe []
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Acount Of Death\Application Data\Mozilla\Firefox\Profiles\gsq9qw1j.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - myspace.com
FF -: plugin - C:\Program Files\DNA\plugins\npbtdna.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-26 06:18:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2008-08-26 6:22:16
ComboFix-quarantined-files.txt 2008-08-26 13:21:12
ComboFix2.txt 2008-08-26 09:11:53
ComboFix3.txt 2008-08-26 07:27:10
ComboFix4.txt 2008-04-24 20:48:03

Pre-Run: 4,495,020,032 bytes free
Post-Run: 4,480,995,328 bytes free

173 --- E O F --- 2008-08-19 10:05:21

#15
fenzodahl512

Posted 26 August 2008 - 09:46 AM

Malware Removal
9,863 posts

Your log looks good now.. One more scan and then you should be good to go..

Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan.

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic