Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Installers disabled, browser redirect, unknown infection [Solved]

Started by rrush , Feb 12 2009 10:18 PM

This topic is locked

#1
rrush

Posted 12 February 2009 - 10:18 PM

Member

Member
66 posts

I'm trying to help a friend whose laptop is infected. OS is xp home, sp3. Noticeable symptoms include:

Links to anti-malware tools in Google search open separate window to various search sites (DealsGalaxy.com, Fastsecurescan.com, info.com, abcjmp.com, horizon-ocean.info just to name a few)

Installers for HijackThis, Malwarebytes, Google Chrome will not run. Got Malwarebytes to run by renaming, but install would not finish and app will not run.

SuperAntiSpyware will run scan but appears to avoid finding anything but cookies

McAfee Security Suite will not update definitions.

On reboot, machine will often fail to finish starting or will lock up once desktop appears. (Regular and Safe Modes)

Hijackthis was previously installed and will run, but some entries will not allow themselves to be fixed.

I have tried to follow instructions on things to do before posting, but most either will not install or will not run.

I'm posting Thursday night. Will not be back to work on this machine until Monday or Tuesday, so take your time.

HijackThis Log posted below. Thanks in advance for any suggestions.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:23:52 PM, on 2/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
D:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft....k/?LinkId=74005
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twext.exe,
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1213326445515
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

--
End of file - 6599 bytes

#2
handhfan

Posted 12 February 2009 - 10:53 PM

Trusted Helper

Expert
13,659 posts

Hello, rrush, and welcome to GeeksToGo!

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  
  -----------------------------------------------------------
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
-----------------------------------------------------------
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

#3
rrush

Posted 16 February 2009 - 10:52 PM

Member

Topic Starter
Member
66 posts

It's worse than I thought. Combofix will not run either. (Tried in regular and in safe mode.) Attempts to reach Geekstogo.com on that machine are blocked also. (Hosts file is OK)

Next step?

#4
handhfan

Posted 16 February 2009 - 10:56 PM

Trusted Helper

Expert
13,659 posts

Looks like you may have a nasty version of the TDSS rootkit. No worries, this should work, and if not, we have other options available.

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
- Tools->Options->Main tab
- Set to "Always ask me where to Save the files".
During the download, rename Combofix to Combo-Fix as follows:
It is important you rename Combofix during the download, but not after.
Please do not rename Combofix to other names, but only to the one indicated.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  
  -----------------------------------------------------------
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
-----------------------------------------------------------
Double click on combo-Fix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

#5
rrush

Posted 17 February 2009 - 06:07 PM

Member

Topic Starter
Member
66 posts

Log posted below:

ComboFix 09-02-15.01 - Tech 2009-02-17 6:12:33.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2038.1681 [GMT -5:00]
Running from: c:\documents and settings\Tech\Desktop\Combo-Fix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated)
FW: McAfee Personal Firewall *disabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\CMMGR32.EXE
c:\windows\system32\twain_32
c:\windows\system32\twain_32\local.ds
c:\windows\system32\twain_32\local.ds.cla
c:\windows\system32\twain_32\user.ds
c:\windows\system32\twain_32\user.ds.cla
c:\windows\system32\twext.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSSERV.SYS
-------\Legacy_TDSSSERV.SYS

((((((((((((((((((((((((( Files Created from 2009-01-17 to 2009-02-17 )))))))))))))))))))))))))))))))
.

2009-02-12 22:41 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-12 22:41 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-12 21:25 . 2009-02-12 21:26 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-02-11 22:43 . 2009-02-11 22:48 <DIR> d-------- C:\fixwareout
2009-02-10 21:39 . 2009-02-10 21:39 <DIR> d-------- c:\documents and settings\Tech\Application Data\SUPERAntiSpyware.com
2009-02-10 21:13 . 2009-02-10 21:13 <DIR> d-------- c:\documents and settings\Tech\Application Data\Systweak
2009-02-10 21:08 . 2009-02-10 21:08 <DIR> d-------- c:\documents and settings\Tech
2009-02-05 21:37 . 2009-02-05 21:37 <DIR> d-------- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-02-04 00:10 . 2008-08-14 05:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2009-02-04 00:10 . 2008-08-14 05:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-02-04 00:10 . 2008-08-14 04:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-02-04 00:10 . 2008-08-14 04:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2009-02-04 00:10 . 2008-09-15 07:12 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys
2009-02-04 00:10 . 2008-10-24 06:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2009-02-04 00:10 . 2008-10-15 11:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2009-02-04 00:10 . 2008-12-11 05:57 333,952 -----c--- c:\windows\system32\dllcache\srv.sys
2009-02-03 23:39 . 2009-02-03 23:39 <DIR> d-------- c:\windows\system32\scripting
2009-02-03 23:39 . 2009-02-03 23:39 <DIR> d-------- c:\windows\system32\en
2009-02-03 23:39 . 2009-02-03 23:39 <DIR> d-------- c:\windows\system32\bits
2009-02-03 23:39 . 2009-02-03 23:39 <DIR> d-------- c:\windows\l2schemas
2009-02-03 23:38 . 2009-02-03 23:38 <DIR> d-------- c:\windows\ServicePackFiles
2009-02-03 23:35 . 2009-02-03 23:35 <DIR> d-------- c:\windows\EHome
2009-02-03 23:24 . 2009-02-03 23:23 410,984 --a------ c:\windows\system32\deploytk.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-13 03:52 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-02-12 04:20 --------- d-----w c:\program files\SUPERAntiSpyware
2009-02-11 02:34 --------- d-----w c:\program files\Windows Media Connect 2
2009-02-11 02:13 --------- d-----w c:\program files\Advanced System Optimizer
2009-02-06 10:24 --------- d-----w c:\program files\Norton Security Scan
2009-02-04 04:23 --------- d-----w c:\program files\Java
2009-01-14 23:00 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-25 15:36 --------- d-----w c:\documents and settings\Rhock\Application Data\Apple Computer
2008-12-25 15:33 --------- d-----w c:\program files\QuickTime
2008-12-25 15:33 --------- d-----w c:\program files\iTunes
2008-12-25 15:33 --------- d-----w c:\program files\iPod
2008-12-25 15:33 --------- d-----w c:\program files\Common Files\Apple
2008-12-25 15:33 --------- d-----w c:\program files\Bonjour
2008-12-25 15:33 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-25 15:32 --------- d-----w c:\program files\Apple Software Update
2008-12-25 15:32 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-25 15:32 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2008-12-20 23:15 826,368 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( snapshot@2008-06-25_20.00.39.06 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-11-17 17:31:32 347,136 ----a-w c:\windows\$hf_mig$\KB873339\SP2QFE\hypertrm.dll
+ 2004-10-14 14:34:52 7,168 ----a-w c:\windows\$hf_mig$\KB873339\spmsg.dll
+ 2004-10-14 14:36:18 169,984 ----a-w c:\windows\$hf_mig$\KB873339\spuninst.exe
+ 2004-10-14 14:36:16 21,504 ----a-w c:\windows\$hf_mig$\KB873339\update\spcustom.dll
+ 2004-10-14 14:34:54 654,848 ----a-w c:\windows\$hf_mig$\KB873339\update\update.exe
+ 2004-10-28 01:28:18 721,920 ----a-w c:\windows\$hf_mig$\KB885835\SP2QFE\lsasrv.dll
+ 2004-10-28 01:15:16 448,128 ----a-w c:\windows\$hf_mig$\KB885835\SP2QFE\mrxsmb.sys
+ 2004-10-28 01:14:56 174,592 ----a-w c:\windows\$hf_mig$\KB885835\SP2QFE\rdbss.sys
+ 2004-10-14 15:34:52 7,168 ----a-w c:\windows\$hf_mig$\KB885835\spmsg.dll
+ 2004-10-14 15:36:18 169,984 ----a-w c:\windows\$hf_mig$\KB885835\spuninst.exe
+ 2004-10-14 15:36:16 21,504 ----a-w c:\windows\$hf_mig$\KB885835\update\spcustom.dll
+ 2004-10-14 15:34:54 654,848 ----a-w c:\windows\$hf_mig$\KB885835\update\update.exe
+ 2004-10-14 15:34:52 7,168 ----a-w c:\windows\$hf_mig$\KB885836\spmsg.dll
+ 2004-10-14 15:36:18 169,984 ----a-w c:\windows\$hf_mig$\KB885836\spuninst.exe
+ 2004-10-14 15:36:16 21,504 ----a-w c:\windows\$hf_mig$\KB885836\update\spcustom.dll
+ 2004-10-14 15:34:54 654,848 ----a-w c:\windows\$hf_mig$\KB885836\update\update.exe
+ 2004-09-29 22:31:17 134,912 ----a-w c:\windows\$hf_mig$\KB886185\SP2QFE\ipnat.sys
+ 2004-10-14 18:34:51 7,168 ----a-w c:\windows\$hf_mig$\KB886185\spmsg.dll
+ 2004-10-14 18:36:16 169,984 ----a-w c:\windows\$hf_mig$\KB886185\spuninst.exe
+ 2004-10-14 18:36:15 21,504 ----a-w c:\windows\$hf_mig$\KB886185\update\spcustom.dll
+ 2004-10-14 18:34:52 654,848 ----a-w c:\windows\$hf_mig$\KB886185\update\update.exe
+ 2004-10-13 16:21:24 1,694,208 ----a-w c:\windows\$hf_mig$\KB887472\SP2QFE\msmsgs.exe
+ 2004-10-14 15:34:52 7,168 ----a-w c:\windows\$hf_mig$\KB887472\spmsg.dll
+ 2004-10-14 15:36:18 169,984 ----a-w c:\windows\$hf_mig$\KB887472\spuninst.exe
+ 2004-10-14 15:36:16 21,504 ----a-w c:\windows\$hf_mig$\KB887472\update\spcustom.dll
+ 2004-10-14 15:34:54 654,848 ----a-w c:\windows\$hf_mig$\KB887472\update\update.exe
+ 2004-12-07 19:29:19 96,768 ----a-w c:\windows\$hf_mig$\KB888302\SP2QFE\srvsvc.dll
+ 2004-11-30 18:46:38 7,168 ----a-w c:\windows\$hf_mig$\KB888302\spmsg.dll
+ 2004-12-01 00:22:42 169,984 ----a-w c:\windows\$hf_mig$\KB888302\spuninst.exe
+ 2004-12-01 00:22:40 21,504 ----a-w c:\windows\$hf_mig$\KB888302\update\spcustom.dll
+ 2004-11-30 18:46:40 654,848 ----a-w c:\windows\$hf_mig$\KB888302\update\update.exe
+ 2005-04-22 05:18:52 57,344 ----a-w c:\windows\$hf_mig$\KB890046\SP2QFE\agentdpv.dll
+ 2005-05-17 00:26:30 17,920 ----a-w c:\windows\$hf_mig$\KB890046\SP2QFE\xpsp3res.dll
+ 2005-02-25 00:35:06 14,048 ----a-w c:\windows\$hf_mig$\KB890046\spmsg.dll
+ 2005-02-25 00:35:06 209,632 ----a-w c:\windows\$hf_mig$\KB890046\spuninst.exe
+ 2005-02-25 00:35:06 22,240 ----a-w c:\windows\$hf_mig$\KB890046\update\spcustom.dll
+ 2005-02-25 00:35:06 718,048 ----a-w c:\windows\$hf_mig$\KB890046\update\update.exe
+ 2005-02-25 00:35:08 371,936 ----a-w c:\windows\$hf_mig$\KB890046\update\updspapi.dll
+ 2005-03-02 18:19:56 62,464 ----a-w c:\windows\$hf_mig$\KB890859\SP2QFE\authz.dll
+ 2005-03-02 01:02:13 2,135,552 ----a-w c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlmp.exe
+ 2005-03-02 00:36:40 2,056,832 ----a-w c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
+ 2005-03-02 00:36:41 2,015,232 ----a-w c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrpamp.exe
+ 2005-03-02 01:04:22 2,179,456 ----a-w c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
+ 2005-03-02 18:19:56 577,024 ----a-w c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
+ 2005-03-02 01:11:25 1,836,160 ----a-w c:\windows\$hf_mig$\KB890859\SP2QFE\win32k.sys
+ 2005-03-02 18:19:56 291,328 ----a-w c:\windows\$hf_mig$\KB890859\SP2QFE\winsrv.dll
+ 2005-02-24 23:35:06 14,048 ----a-w c:\windows\$hf_mig$\KB890859\spmsg.dll
+ 2005-02-24 23:35:06 209,632 ----a-w c:\windows\$hf_mig$\KB890859\spuninst.exe
+ 2005-02-24 23:35:06 22,240 ----a-w c:\windows\$hf_mig$\KB890859\update\spcustom.dll
+ 2005-02-24 23:35:06 718,048 ----a-w c:\windows\$hf_mig$\KB890859\update\update.exe
+ 2005-02-24 23:35:08 371,936 ----a-w c:\windows\$hf_mig$\KB890859\update\updspapi.dll
+ 2004-11-30 18:46:38 7,168 ----a-w c:\windows\$hf_mig$\KB891781\spmsg.dll
+ 2004-12-01 00:22:42 169,984 ----a-w c:\windows\$hf_mig$\KB891781\spuninst.exe
+ 2004-12-01 00:22:40 21,504 ----a-w c:\windows\$hf_mig$\KB891781\update\spcustom.dll
+ 2004-11-30 18:46:40 654,848 ----a-w c:\windows\$hf_mig$\KB891781\update\update.exe
+ 2005-07-08 16:28:58 249,344 ----a-w c:\windows\$hf_mig$\KB893756\SP2QFE\tapisrv.dll
+ 2005-02-25 00:35:06 14,048 ----a-w c:\windows\$hf_mig$\KB893756\spmsg.dll
+ 2005-02-25 00:35:06 209,632 ----a-w c:\windows\$hf_mig$\KB893756\spuninst.exe
+ 2005-07-07 23:27:08 30,720 ----a-w c:\windows\$hf_mig$\KB893756\update\arpidfix.exe
+ 2005-02-25 00:35:06 22,240 ----a-w c:\windows\$hf_mig$\KB893756\update\spcustom.dll
+ 2005-02-25 00:35:06 718,048 ----a-w c:\windows\$hf_mig$\KB893756\update\update.exe
+ 2005-02-25 00:35:08 371,936 ----a-w c:\windows\$hf_mig$\KB893756\update\updspapi.dll
+ 2005-04-28 19:35:02 1,286,144 ----a-w c:\windows\$hf_mig$\KB894391\SP2QFE\ole32.dll
+ 2005-04-28 19:35:01 74,752 ----a-w c:\windows\$hf_mig$\KB894391\SP2QFE\olecli32.dll
+ 2005-04-28 19:35:01 37,376 ----a-w c:\windows\$hf_mig$\KB894391\SP2QFE\olecnv32.dll
+ 2005-04-28 19:35:01 396,288 ----a-w c:\windows\$hf_mig$\KB894391\SP2QFE\rpcss.dll
+ 2005-02-25 00:35:06 14,048 ----a-w c:\windows\$hf_mig$\KB894391\spmsg.dll
+ 2005-02-25 00:35:06 209,632 ----a-w c:\windows\$hf_mig$\KB894391\spuninst.exe
+ 2005-02-25 00:35:06 22,240 ----a-w c:\windows\$hf_mig$\KB894391\update\spcustom.dll
+ 2005-02-25 00:35:06 718,048 ----a-w c:\windows\$hf_mig$\KB894391\update\update.exe
+ 2005-02-25 00:35:08 371,936 ----a-w c:\windows\$hf_mig$\KB894391\update\updspapi.dll
+ 2005-05-26 23:26:50 10,752 ----a-w c:\windows\$hf_mig$\KB896358\SP2QFE\hh.exe
+ 2005-05-27 02:08:59 41,472 ----a-w c:\windows\$hf_mig$\KB896358\SP2QFE\hhsetup.dll
+ 2005-05-27 02:08:59 155,136 ----a-w c:\windows\$hf_mig$\KB896358\SP2QFE\itircl.dll
+ 2005-05-27 02:08:59 137,216 ----a-w c:\windows\$hf_mig$\KB896358\SP2QFE\itss.dll
+ 2005-02-25 00:35:06 14,048 ----a-w c:\windows\$hf_mig$\KB896358\spmsg.dll
+ 2005-02-25 00:35:06 209,632 ----a-w c:\windows\$hf_mig$\KB896358\spuninst.exe
+ 2005-02-25 00:35:06 22,240 ----a-w c:\windows\$hf_mig$\KB896358\update\spcustom.dll
+ 2005-02-25 00:35:06 718,048 ----a-w c:\windows\$hf_mig$\KB896358\update\update.exe
+ 2005-02-25 00:35:08 371,936 ----a-w c:\windows\$hf_mig$\KB896358\update\updspapi.dll
+ 2005-06-11 00:17:13 57,856 ----a-w c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
+ 2005-02-25 00:35:06 14,048 ----a-w c:\windows\$hf_mig$\KB896423\spmsg.dll
+ 2005-02-25 00:35:06 209,632 ----a-w c:\windows\$hf_mig$\KB896423\spuninst.exe
+ 2005-06-29 20:54:32 30,720 ----a-w c:\windows\$hf_mig$\KB896423\update\arpidfix.exe
+ 2005-02-25 00:35:06 22,240 ----a-w c:\windows\$hf_mig$\KB896423\update\spcustom.dll
+ 2005-02-25 00:35:06 718,048 ----a-w c:\windows\$hf_mig$\KB896423\update\update.exe
+ 2005-02-25 00:35:08 371,936 ----a-w c:\windows\$hf_mig$\KB896423\update\updspapi.dll
+ 2005-05-10 23:51:10 75,776 ----a-w c:\windows\$hf_mig$\KB896428\SP2QFE\telnet.exe
+ 2005-02-25 00:35:06 14,048 ----a-w c:\windows\$hf_mig$\KB896428\spmsg.dll
+ 2005-02-25 00:35:06 209,632 ----a-w c:\windows\$hf_mig$\KB896428\spuninst.exe
+ 2005-02-25 00:35:06 22,240 ----a-w c:\windows\$hf_mig$\KB896428\update\spcustom.dll
+ 2005-02-25 00:35:06 718,048 ----a-w c:\windows\$hf_mig$\KB896428\update\update.exe
+ 2005-02-25 00:35:08 371,936 ----a-w c:\windows\$hf_mig$\KB896428\update\updspapi.dll
+ 2005-02-25 03:35:05 14,048 ----a-w c:\windows\$hf_mig$\KB898461\spmsg.dll
+ 2005-02-25 03:35:05 209,632 ----a-w c:\windows\$hf_mig$\KB898461\spuninst.exe
+ 2005-02-25 03:35:05 22,752 ----a-w c:\windows\$hf_mig$\KB898461\spupdsvc.exe
+ 2005-02-25 03:35:05 22,240 ----a-w c:\windows\$hf_mig$\KB898461\update\spcustom.dll
+ 2005-02-25 03:35:05 718,048 ----a-w c:\windows\$hf_mig$\KB898461\update\update.exe
+ 2005-02-25 03:35:06 371,936 ----a-w c:\windows\$hf_mig$\KB898461\update\updspapi.dll
+ 2005-06-15 17:42:35 297,984 ----a-w c:\windows\$hf_mig$\KB899587\SP2QFE\kerberos.dll
+ 2005-02-25 00:35:06 14,048 ----a-w c:\windows\$hf_mig$\KB899587\spmsg.dll
+ 2005-02-25 00:35:06 209,632 ----a-w c:\windows\$hf_mig$\KB899587\spuninst.exe
+ 2005-06-29 20:54:32 30,720 ----a-w c:\windows\$hf_mig$\KB899587\update\arpidfix.exe
+ 2005-02-25 00:35:06 22,240 ----a-w c:\windows\$hf_mig$\KB899587\update\spcustom.dll
+ 2005-02-25 00:35:06 718,048 ----a-w c:\windows\$hf_mig$\KB899587\update\update.exe
+ 2005-02-25 00:35:08 371,936 ----a-w c:\windows\$hf_mig$\KB899587\update\updspapi.dll
+ 2005-06-10 04:06:01 139,528 ----a-w c:\windows\$hf_mig$\KB899591\SP2QFE\rdpwd.sys
+ 2005-02-25 00:35:06 14,048 ----a-w c:\windows\$hf_mig$\KB899591\spmsg.dll
+ 2005-02-25 00:35:06 209,632 ----a-w c:\windows\$hf_mig$\KB899591\spuninst.exe
+ 2005-06-29 20:54:32 30,720 ----a-w c:\windows\$hf_mig$\KB899591\update\arpidfix.exe
+ 2005-02-25 00:35:06 22,240 ----a-w c:\windows\$hf_mig$\KB899591\update\spcustom.dll
+ 2005-02-25 00:35:06 718,048 ----a-w c:\windows\$hf_mig$\KB899591\update\update.exe
+ 2005-02-25 00:35:08 371,936 ----a-w c:\windows\$hf_mig$\KB899591\update\updspapi.dll
+ 2006-02-15 00:30:07 142,464 ----a-w c:\windows\$hf_mig$\KB900485\SP2QFE\aec.sys
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB900485\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB900485\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB900485\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB900485\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB900485\update\updspapi.dll
+ 2005-09-01 01:44:04 19,968 ----a-w c:\windows\$hf_mig$\KB900725\SP2QFE\linkinfo.dll
+ 2005-09-23 03:18:20 8,452,608 ----a-w c:\windows\$hf_mig$\KB900725\SP2QFE\shell32.dll
+ 2005-09-02 23:53:41 474,112 ----a-w c:\windows\$hf_mig$\KB900725\SP2QFE\shlwapi.dll
+ 2005-09-01 01:44:05 291,840 ----a-w c:\windows\$hf_mig$\KB900725\SP2QFE\winsrv.dll
+ 2005-09-27 00:29:45 21,504 ----a-w c:\windows\$hf_mig$\KB900725\SP2QFE\xpsp3res.dll
+ 2005-02-25 00:35:06 14,048 ----a-w c:\windows\$hf_mig$\KB900725\spmsg.dll
+ 2005-02-25 00:35:06 209,632 ----a-w c:\windows\$hf_mig$\KB900725\spuninst.exe
+ 2005-09-26 21:36:24 30,720 ----a-w c:\windows\$hf_mig$\KB900725\update\arpidfix.exe
+ 2005-02-25 00:35:06 22,240 ----a-w c:\windows\$hf_mig$\KB900725\update\spcustom.dll
+ 2005-02-25 00:35:06 718,048 ----a-w c:\windows\$hf_mig$\KB900725\update\update.exe
+ 2005-02-25 00:35:08 371,936 ----a-w c:\windows\$hf_mig$\KB900725\update\updspapi.dll
+ 2005-09-10 01:48:47 2,068,480 ----a-w c:\windows\$hf_mig$\KB901017\SP2QFE\cdosys.dll
+ 2005-02-25 00:35:06 14,048 ----a-w c:\windows\$hf_mig$\KB901017\spmsg.dll
+ 2005-02-25 00:35:06 209,632 ----a-w c:\windows\$hf_mig$\KB901017\spuninst.exe
+ 2005-09-09 20:26:26 30,720 ----a-w c:\windows\$hf_mig$\KB901017\update\arpidfix.exe
+ 2005-02-25 00:35:06 22,240 ----a-w c:\windows\$hf_mig$\KB901017\update\spcustom.dll
+ 2005-02-25 00:35:06 718,048 ----a-w c:\windows\$hf_mig$\KB901017\update\update.exe
+ 2005-02-25 00:35:08 371,936 ----a-w c:\windows\$hf_mig$\KB901017\update\updspapi.dll
+ 2005-06-29 01:49:55 254,976 ----a-w c:\windows\$hf_mig$\KB901214\SP2QFE\icm32.dll
+ 2005-06-29 01:49:55 73,728 ----a-w c:\windows\$hf_mig$\KB901214\SP2QFE\mscms.dll
+ 2005-02-25 00:35:06 14,048 ----a-w c:\windows\$hf_mig$\KB901214\spmsg.dll
+ 2005-02-25 00:35:06 209,632 ----a-w c:\windows\$hf_mig$\KB901214\spuninst.exe
+ 2005-02-25 00:35:06 22,240 ----a-w c:\windows\$hf_mig$\KB901214\update\spcustom.dll
+ 2005-02-25 00:35:06 718,048 ----a-w c:\windows\$hf_mig$\KB901214\update\update.exe
+ 2005-02-25 00:35:08 371,936 ----a-w c:\windows\$hf_mig$\KB901214\update\updspapi.dll
+ 2005-07-26 04:20:23 225,792 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\catsrv.dll
+ 2005-07-26 04:20:23 625,152 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\catsrvut.dll
+ 2005-07-26 04:20:23 110,080 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\clbcatex.dll
+ 2005-07-26 04:20:24 498,688 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\clbcatq.dll
+ 2005-07-26 04:20:24 60,416 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\colbact.dll
+ 2005-07-26 04:20:24 195,072 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\comadmin.dll
+ 2005-07-26 04:20:25 97,792 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\comrepl.dll
+ 2005-07-26 04:20:27 1,267,200 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\comsvcs.dll
+ 2005-07-26 04:20:28 540,160 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\comuid.dll
+ 2005-07-26 04:20:28 243,200 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\es.dll
+ 2005-07-25 23:42:35 8,704 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\migregdb.exe
+ 2005-07-26 04:20:29 425,472 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\msdtcprx.dll
+ 2005-07-26 04:20:31 945,152 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\msdtctm.dll
+ 2005-07-26 04:20:31 161,280 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\msdtcuiu.dll
+ 2005-07-26 04:20:39 66,560 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\mtxclu.dll
+ 2005-07-26 04:20:40 91,136 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\mtxoci.dll
+ 2005-07-26 04:20:40 1,285,632 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\ole32.dll
+ 2005-07-26 04:20:40 74,752 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\olecli32.dll
+ 2005-07-26 04:20:40 37,376 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\olecnv32.dll
+ 2005-07-26 04:20:40 398,336 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\rpcss.dll
+ 2005-07-26 04:20:40 101,376 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\txflog.dll
+ 2005-07-26 04:20:40 11,776 ----a-w c:\windows\$hf_mig$\KB902400\SP2QFE\xolehlp.dll
+ 2005-02-25 00:35:06 14,048 ----a-w c:\windows\$hf_mig$\KB902400\spmsg.dll
+ 2005-02-25 00:35:06 209,632 ----a-w c:\windows\$hf_mig$\KB902400\spuninst.exe
+ 2005-07-25 23:21:18 30,720 ----a-w c:\windows\$hf_mig$\KB902400\update\arpidfix.exe
+ 2005-02-25 00:35:06 22,240 ----a-w c:\windows\$hf_mig$\KB902400\update\spcustom.dll
+ 2005-02-25 00:35:06 718,048 ----a-w c:\windows\$hf_mig$\KB902400\update\update.exe
+ 2005-02-25 00:35:08 371,936 ----a-w c:\windows\$hf_mig$\KB902400\update\updspapi.dll
+ 2005-08-22 18:24:55 197,632 ----a-w c:\windows\$hf_mig$\KB905414\SP2QFE\netman.dll
+ 2005-02-25 03:35:05 14,048 ----a-w c:\windows\$hf_mig$\KB905414\spmsg.dll
+ 2005-02-25 03:35:05 209,632 ----a-w c:\windows\$hf_mig$\KB905414\spuninst.exe
+ 2005-08-19 23:50:31 30,720 ----a-w c:\windows\$hf_mig$\KB905414\update\arpidfix.exe
+ 2005-02-25 03:35:05 22,240 ----a-w c:\windows\$hf_mig$\KB905414\update\spcustom.dll
+ 2005-02-25 03:35:05 718,048 ----a-w c:\windows\$hf_mig$\KB905414\update\update.exe
+ 2005-02-25 03:35:06 371,936 ----a-w c:\windows\$hf_mig$\KB905414\update\updspapi.dll
+ 2005-08-23 03:39:54 123,392 ----a-w c:\windows\$hf_mig$\KB905749\SP2QFE\umpnpmgr.dll
+ 2005-02-25 00:35:06 14,048 ----a-w c:\windows\$hf_mig$\KB905749\spmsg.dll
+ 2005-02-25 00:35:06 209,632 ----a-w c:\windows\$hf_mig$\KB905749\spuninst.exe
+ 2005-08-22 22:01:30 30,720 ----a-w c:\windows\$hf_mig$\KB905749\update\arpidfix.exe
+ 2005-02-25 00:35:06 22,240 ----a-w c:\windows\$hf_mig$\KB905749\update\spcustom.dll
+ 2005-02-25 00:35:06 718,048 ----a-w c:\windows\$hf_mig$\KB905749\update\update.exe
+ 2005-02-25 00:35:08 371,936 ----a-w c:\windows\$hf_mig$\KB905749\update\updspapi.dll
+ 2005-10-17 21:21:19 80,896 ----a-w c:\windows\$hf_mig$\KB908519\SP2QFE\fontsub.dll
+ 2005-10-17 21:21:19 117,760 ----a-w c:\windows\$hf_mig$\KB908519\SP2QFE\t2embed.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB908519\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB908519\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB908519\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB908519\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB908519\update\updspapi.dll
+ 2006-03-17 04:46:31 8,454,656 ----a-w c:\windows\$hf_mig$\KB908531\SP2QFE\shell32.dll
+ 2006-03-17 01:05:35 28,672 ----a-w c:\windows\$hf_mig$\KB908531\SP2QFE\verclsid.exe
+ 2006-03-22 01:29:43 23,040 ----a-w c:\windows\$hf_mig$\KB908531\SP2QFE\xpsp3res.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB908531\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB908531\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB908531\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB908531\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB908531\update\updspapi.dll
+ 2005-10-20 22:26:39 1,082,368 ----a-w c:\windows\$hf_mig$\KB910437\SP2QFE\esent.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB910437\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB910437\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB910437\update\spcustom.dll
+ 2005-10-12 23:12:28 716,000 ----a-w c:\windows\$hf_mig$\KB910437\update\update.exe
+ 2005-10-12 23:12:33 371,424 ----a-w c:\windows\$hf_mig$\KB910437\update\updspapi.dll
+ 2006-06-22 10:36:52 180,736 ----a-w c:\windows\$hf_mig$\KB911280\SP2QFE\rasmans.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB911280\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB911280\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB911280\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB911280\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB911280\update\updspapi.dll
+ 2006-03-23 05:53:08 143,360 ----a-w c:\windows\$hf_mig$\KB911562\SP2QFE\msadco.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB911562\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB911562\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB911562\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB911562\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB911562\update\updspapi.dll
+ 2006-01-04 04:18:34 68,096 ----a-w c:\windows\$hf_mig$\KB911927\SP2QFE\webclnt.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB911927\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB911927\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB911927\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB911927\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB911927\update\updspapi.dll
+ 2006-03-01 19:34:20 426,496 ----a-w c:\windows\$hf_mig$\KB913580\SP2QFE\msdtcprx.dll
+ 2006-03-01 19:34:20 956,416 ----a-w c:\windows\$hf_mig$\KB913580\SP2QFE\msdtctm.dll
+ 2006-03-01 19:34:20 161,280 ----a-w c:\windows\$hf_mig$\KB913580\SP2QFE\msdtcuiu.dll
+ 2006-03-01 19:34:20 66,560 ----a-w c:\windows\$hf_mig$\KB913580\SP2QFE\mtxclu.dll
+ 2006-03-01 19:34:20 91,136 ----a-w c:\windows\$hf_mig$\KB913580\SP2QFE\mtxoci.dll
+ 2006-03-01 19:34:20 11,776 ----a-w c:\windows\$hf_mig$\KB913580\SP2QFE\xolehlp.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB913580\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB913580\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB913580\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB913580\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB913580\update\updspapi.dll
+ 2006-05-19 13:46:40 112,128 ----a-w c:\windows\$hf_mig$\KB914388\SP2QFE\dhcpcsvc.dll
+ 2006-05-19 13:46:40 147,456 ----a-w c:\windows\$hf_mig$\KB914388\SP2QFE\dnsapi.dll
+ 2006-05-19 13:46:40 94,720 ----a-w c:\windows\$hf_mig$\KB914388\SP2QFE\iphlpapi.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB914388\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB914388\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB914388\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB914388\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB914388\update\updspapi.dll
+ 2006-05-05 10:16:39 454,400 ----a-w c:\windows\$hf_mig$\KB914389\SP2QFE\mrxsmb.sys
+ 2006-05-05 10:22:52 174,592 ----a-w c:\windows\$hf_mig$\KB914389\SP2QFE\rdbss.sys
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB914389\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB914389\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB914389\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB914389\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB914389\update\updspapi.dll
+ 2006-03-17 01:08:10 262,656 ----a-w c:\windows\$hf_mig$\KB916595\SP2QFE\http.sys
+ 2005-10-12 23:16:49 14,048 ----a-w c:\windows\$hf_mig$\KB916595\spmsg.dll
+ 2005-10-12 23:16:49 213,216 ----a-w c:\windows\$hf_mig$\KB916595\spuninst.exe
+ 2005-10-12 23:16:49 22,752 ----a-w c:\windows\$hf_mig$\KB916595\update\spcustom.dll
+ 2005-10-12 23:16:51 716,000 ----a-w c:\windows\$hf_mig$\KB916595\update\update.exe
+ 2005-10-12 23:16:56 371,424 ----a-w c:\windows\$hf_mig$\KB916595\update\updspapi.dll
+ 2006-11-27 15:17:10 539,136 ----a-w c:\windows\$hf_mig$\KB918118\SP2QFE\msftedit.dll
+ 2006-11-27 15:17:10 433,664 ----a-w c:\windows\$hf_mig$\KB918118\SP2QFE\riched20.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB918118\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB918118\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB918118\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB918118\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB918118\update\updspapi.dll
+ 2006-06-01 19:39:42 163,840 ----a-w c:\windows\$hf_mig$\KB918439\SP2QFE\jgdw400.dll
+ 2006-06-01 19:39:42 27,648 ----a-w c:\windows\$hf_mig$\KB918439\SP2QFE\jgpl400.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB918439\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB918439\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB918439\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB918439\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB918439\update\updspapi.dll
+ 2006-10-12 13:54:18 42,496 ----a-w c:\windows\$hf_mig$\KB920213\SP2QFE\agentdp2.dll
+ 2006-10-12 13:54:18 57,344 ----a-w c:\windows\$hf_mig$\KB920213\SP2QFE\agentdpv.dll
+ 2006-10-12 11:54:07 256,512 ----a-w c:\windows\$hf_mig$\KB920213\SP2QFE\agentsvr.exe
+ 2006-10-16 10:29:15 248,320 ----a-w c:\windows\$hf_mig$\KB920213\SP2QFE\xpsp3res.dll
+ 2005-10-12 23:16:49 14,048 ----a-w c:\windows\$hf_mig$\KB920213\spmsg.dll
+ 2005-10-12 23:16:49 213,216 ----a-w c:\windows\$hf_mig$\KB920213\spuninst.exe
+ 2005-10-12 23:16:49 22,752 ----a-w c:\windows\$hf_mig$\KB920213\update\spcustom.dll
+ 2005-10-12 23:16:51 716,000 ----a-w c:\windows\$hf_mig$\KB920213\update\update.exe
+ 2005-10-12 23:16:56 371,424 ----a-w c:\windows\$hf_mig$\KB920213\update\updspapi.dll
+ 2006-07-21 08:26:49 72,704 ----a-w c:\windows\$hf_mig$\KB920670\SP2QFE\hlink.dll
+ 2005-10-12 23:16:49 14,048 ----a-w c:\windows\$hf_mig$\KB920670\spmsg.dll
+ 2005-10-12 23:16:49 213,216 ----a-w c:\windows\$hf_mig$\KB920670\spuninst.exe
+ 2005-10-12 23:16:49 22,752 ----a-w c:\windows\$hf_mig$\KB920670\update\spcustom.dll
+ 2005-10-12 23:16:51 716,000 ----a-w c:\windows\$hf_mig$\KB920670\update\update.exe
+ 2005-10-12 23:16:56 371,424 ----a-w c:\windows\$hf_mig$\KB920670\update\updspapi.dll
+ 2006-06-26 17:45:19 147,456 ----a-w c:\windows\$hf_mig$\KB920683\SP2QFE\dnsapi.dll
+ 2006-06-26 17:45:19 7,680 ----a-w c:\windows\$hf_mig$\KB920683\SP2QFE\rasadhlp.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB920683\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB920683\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB920683\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB920683\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB920683\update\updspapi.dll
+ 2006-06-22 05:22:04 69,120 ----a-w c:\windows\$hf_mig$\KB920685\SP2QFE\ciodm.dll
+ 2006-06-22 05:22:05 1,435,648 ----a-w c:\windows\$hf_mig$\KB920685\SP2QFE\query.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB920685\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB920685\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB920685\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB920685\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB920685\update\updspapi.dll
+ 2006-06-14 08:50:19 172,416 ----a-w c:\windows\$hf_mig$\KB920872\SP2QFE\kmixer.sys
+ 2006-06-14 08:50:19 6,272 ----a-w c:\windows\$hf_mig$\KB920872\SP2QFE\splitter.sys
+ 2006-06-14 09:17:04 82,944 ----a-w c:\windows\$hf_mig$\KB920872\SP2QFE\wdmaud.sys
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB920872\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB920872\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB920872\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB920872\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB920872\update\updspapi.dll
+ 2006-08-21 12:26:44 16,896 ----a-w c:\windows\$hf_mig$\KB922582\SP2QFE\fltlib.dll
+ 2006-08-21 09:43:32 23,040 ----a-w c:\windows\$hf_mig$\KB922582\SP2QFE\fltmc.exe
+ 2006-08-21 09:43:32 128,768 ----a-w c:\windows\$hf_mig$\KB922582\SP2QFE\fltmgr.sys
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB922582\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB922582\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB922582\update\spcustom.dll
+ 2005-10-12 23:12:28 716,000 ----a-w c:\windows\$hf_mig$\KB922582\update\update.exe
+ 2005-10-12 23:12:33 371,424 ----a-w c:\windows\$hf_mig$\KB922582\update\updspapi.dll
+ 2006-08-16 12:08:32 100,352 ----a-w c:\windows\$hf_mig$\KB922819\SP2QFE\6to4svc.dll
+ 2006-08-16 10:13:39 225,664 ----a-w c:\windows\$hf_mig$\KB922819\SP2QFE\tcpip6.sys
+ 2005-10-12 23:16:49 14,048 ----a-w c:\windows\$hf_mig$\KB922819\spmsg.dll
+ 2005-10-12 23:16:49 213,216 ----a-w c:\windows\$hf_mig$\KB922819\spuninst.exe
+ 2005-10-12 23:16:49 22,752 ----a-w c:\windows\$hf_mig$\KB922819\update\spcustom.dll
+ 2005-10-12 23:16:51 716,000 ----a-w c:\windows\$hf_mig$\KB922819\update\update.exe
+ 2005-10-12 23:16:56 371,424 ----a-w c:\windows\$hf_mig$\KB922819\update\updspapi.dll
+ 2006-08-14 12:00:42 332,928 ----a-w c:\windows\$hf_mig$\KB923414\SP2QFE\srv.sys
+ 2005-10-12 23:16:49 14,048 ----a-w c:\windows\$hf_mig$\KB923414\spmsg.dll
+ 2005-10-12 23:16:49 213,216 ----a-w c:\windows\$hf_mig$\KB923414\spuninst.exe
+ 2005-10-12 23:16:49 22,752 ----a-w c:\windows\$hf_mig$\KB923414\update\spcustom.dll
+ 2005-10-12 23:16:51 716,000 ----a-w c:\windows\$hf_mig$\KB923414\update\update.exe
+ 2005-10-12 23:16:56 371,424 ----a-w c:\windows\$hf_mig$\KB923414\update\updspapi.dll
+ 2006-10-13 12:41:38 64,000 ----a-w c:\windows\$hf_mig$\KB923980\SP2QFE\nwapi32.dll
+ 2006-10-13 12:41:38 142,336 ----a-w c:\windows\$hf_mig$\KB923980\SP2QFE\nwprovau.dll
+ 2006-10-13 10:39:12 163,456 ----a-w c:\windows\$hf_mig$\KB923980\SP2QFE\nwrdr.sys
+ 2006-10-13 12:41:38 65,536 ----a-w c:\windows\$hf_mig$\KB923980\SP2QFE\nwwks.dll
+ 2005-10-12 23:16:49 14,048 ----a-w c:\windows\$hf_mig$\KB923980\spmsg.dll
+ 2005-10-12 23:16:49 213,216 ----a-w c:\windows\$hf_mig$\KB923980\spuninst.exe
+ 2005-10-12 23:16:49 22,752 ----a-w c:\windows\$hf_mig$\KB923980\update\spcustom.dll
+ 2005-10-12 23:16:51 716,000 ----a-w c:\windows\$hf_mig$\KB923980\update\update.exe
+ 2005-10-12 23:16:56 371,424 ----a-w c:\windows\$hf_mig$\KB923980\update\updspapi.dll
+ 2006-08-17 12:37:49 726,528 ----a-w c:\windows\$hf_mig$\KB924270\SP2QFE\lsasrv.dll
+ 2006-08-17 12:37:49 337,408 ----a-w c:\windows\$hf_mig$\KB924270\SP2QFE\netapi32.dll
+ 2006-08-17 12:37:49 132,096 ----a-w c:\windows\$hf_mig$\KB924270\SP2QFE\wkssvc.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB924270\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB924270\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB924270\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB924270\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB924270\update\updspapi.dll
+ 2007-03-08 15:48:36 282,112 ----a-w c:\windows\$hf_mig$\KB925902\SP2QFE\gdi32.dll
+ 2007-03-08 15:48:36 40,960 ----a-w c:\windows\$hf_mig$\KB925902\SP2QFE\mf3216.dll
+ 2007-03-08 15:48:36 578,048 ----a-w c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
+ 2007-03-08 13:49:49 1,843,968 ----a-w c:\windows\$hf_mig$\KB925902\SP2QFE\win32k.sys
+ 2006-01-19 19:29:19 14,048 ----a-w c:\windows\$hf_mig$\KB925902\spmsg.dll
+ 2006-01-19 19:29:19 213,216 ----a-w c:\windows\$hf_mig$\KB925902\spuninst.exe
+ 2006-01-19 19:29:19 22,752 ----a-w c:\windows\$hf_mig$\KB925902\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 ----a-w c:\windows\$hf_mig$\KB925902\update\update.exe
+ 2006-01-19 19:29:19 371,424 ----a-w c:\windows\$hf_mig$\KB925902\update\updspapi.dll
+ 2006-10-19 13:59:58 713,216 ----a-w c:\windows\$hf_mig$\KB926255\SP2QFE\sxs.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB926255\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB926255\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB926255\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB926255\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB926255\update\updspapi.dll
+ 2006-10-16 17:14:17 122,880 ----a-w c:\windows\$hf_mig$\KB926436\SP2QFE\oledlg.dll
+ 2005-10-12 23:16:49 14,048 ----a-w c:\windows\$hf_mig$\KB926436\spmsg.dll
+ 2005-10-12 23:16:49 213,216 ----a-w c:\windows\$hf_mig$\KB926436\spuninst.exe
+ 2005-10-12 23:16:49 22,752 ----a-w c:\windows\$hf_mig$\KB926436\update\spcustom.dll
+ 2005-10-12 23:16:51 716,000 ----a-w c:\windows\$hf_mig$\KB926436\update\update.exe
+ 2005-10-12 23:16:56 371,424 ----a-w c:\windows\$hf_mig$\KB926436\update\updspapi.dll
+ 2006-12-26 13:18:55 536,576 ----a-w c:\windows\$hf_mig$\KB927779\SP2QFE\msado15.dll
+ 2006-12-26 13:18:55 180,224 ----a-w c:\windows\$hf_mig$\KB927779\SP2QFE\msadomd.dll
+ 2006-12-26 13:18:55 200,704 ----a-w c:\windows\$hf_mig$\KB927779\SP2QFE\msadox.dll
+ 2006-12-26 13:18:55 102,400 ----a-w c:\windows\$hf_mig$\KB927779\SP2QFE\msjro.dll
+ 2006-01-19 19:29:19 14,048 ----a-w c:\windows\$hf_mig$\KB927779\spmsg.dll
+ 2006-01-19 19:29:19 213,216 ----a-w c:\windows\$hf_mig$\KB927779\spuninst.exe
+ 2006-01-19 19:29:19 22,752 ----a-w c:\windows\$hf_mig$\KB927779\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 ----a-w c:\windows\$hf_mig$\KB927779\update\update.exe
+ 2006-01-19 19:29:19 371,424 ----a-w c:\windows\$hf_mig$\KB927779\update\updspapi.dll
+ 2006-12-19 18:47:14 333,824 ----a-w c:\windows\$hf_mig$\KB927802\SP2QFE\wiaservc.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB927802\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB927802\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB927802\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB927802\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB927802\update\updspapi.dll
+ 2007-04-18 16:14:43 2,854,400 ----a-w c:\windows\$hf_mig$\KB927891\SP2QFE\msi31.dll
+ 2006-01-19 19:29:19 14,048 ----a-w c:\windows\$hf_mig$\KB927891\spmsg.dll
+ 2006-01-19 19:29:19 213,216 ----a-w c:\windows\$hf_mig$\KB927891\spuninst.exe
+ 2006-01-19 19:29:19 22,752 ----a-w c:\windows\$hf_mig$\KB927891\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 ----a-w c:\windows\$hf_mig$\KB927891\update\update.exe
+ 2006-01-19 19:29:19 371,424 ----a-w c:\windows\$hf_mig$\KB927891\update\updspapi.dll
+ 2006-12-19 21:50:10 8,458,752 ----a-w c:\windows\$hf_mig$\KB928255\SP2QFE\shell32.dll
+ 2006-12-19 21:50:10 135,168 ----a-w c:\windows\$hf_mig$\KB928255\SP2QFE\shsvcs.dll
+ 2006-12-19 16:10:56 248,320 ----a-w c:\windows\$hf_mig$\KB928255\SP2QFE\xpsp3res.dll
+ 2006-01-19 19:29:19 14,048 ----a-w c:\windows\$hf_mig$\KB928255\spmsg.dll
+ 2006-01-19 19:29:19 213,216 ----a-w c:\windows\$hf_mig$\KB928255\spuninst.exe
+ 2006-01-19 19:29:19 22,752 ----a-w c:\windows\$hf_mig$\KB928255\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 ----a-w c:\windows\$hf_mig$\KB928255\update\update.exe
+ 2006-01-19 19:29:19 371,424 ----a-w c:\windows\$hf_mig$\KB928255\update\updspapi.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB928843\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB928843\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB928843\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB928843\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB928843\update\updspapi.dll
+ 2007-05-16 15:32:55 86,528 ----a-w c:\windows\$hf_mig$\KB929123\SP2QFE\directdb.dll
+ 2007-05-16 15:32:55 683,520 ----a-w c:\windows\$hf_mig$\KB929123\SP2QFE\inetcomm.dll
+ 2007-05-16 15:32:56 1,314,816 ----a-w c:\windows\$hf_mig$\KB929123\SP2QFE\msoe.dll
+ 2007-05-16 15:32:56 510,976 ----a-w c:\windows\$hf_mig$\KB929123\SP2QFE\wab32.dll
+ 2007-05-16 15:32:56 85,504 ----a-w c:\windows\$hf_mig$\KB929123\SP2QFE\wabimp.dll
+ 2006-01-19 19:29:19 14,048 ----a-w c:\windows\$hf_mig$\KB929123\spmsg.dll
+ 2006-01-19 19:29:19 213,216 ----a-w c:\windows\$hf_mig$\KB929123\spuninst.exe
+ 2006-01-19 19:29:19 22,752 ----a-w c:\windows\$hf_mig$\KB929123\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 ----a-w c:\windows\$hf_mig$\KB929123\update\update.exe
+ 2006-01-19 19:29:19 371,424 ----a-w c:\windows\$hf_mig$\KB929123\update\updspapi.dll
+ 2007-03-17 13:45:03 292,864 ----a-w c:\windows\$hf_mig$\KB930178\SP2QFE\winsrv.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB930178\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB930178\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB930178\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB930178\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB930178\update\updspapi.dll
+ 2007-02-09 11:23:36 574,976 ----a-w c:\windows\$hf_mig$\KB930916\SP2QFE\ntfs.sys
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB930916\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB930916\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB930916\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB930916\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB930916\update\updspapi.dll
+ 2007-02-05 20:19:14 185,344 ----a-w c:\windows\$hf_mig$\KB931261\SP2QFE\upnphost.dll
+ 2006-01-19 19:29:19 14,048 ----a-w c:\windows\$hf_mig$\KB931261\spmsg.dll
+ 2006-01-19 19:29:19 213,216 ----a-w c:\windows\$hf_mig$\KB931261\spuninst.exe
+ 2006-01-19 19:29:19 22,752 ----a-w c:\windows\$hf_mig$\KB931261\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 ----a-w c:\windows\$hf_mig$\KB931261\update\update.exe
+ 2006-01-19 19:29:19 371,424 ----a-w c:\windows\$hf_mig$\KB931261\update\updspapi.dll
+ 2007-03-09 13:58:57 57,344 ----a-w c:\windows\$hf_mig$\KB932168\SP2QFE\agentdpv.dll
+ 2007-03-09 11:28:00 248,320 ----a-w c:\windows\$hf_mig$\KB932168\SP2QFE\xpsp3res.dll
+ 2006-01-19 19:29:19 14,048 ----a-w c:\windows\$hf_mig$\KB932168\spmsg.dll
+ 2006-01-19 19:29:19 213,216 ----a-w c:\windows\$hf_mig$\KB932168\spuninst.exe
+ 2006-01-19 19:29:19 22,752 ----a-w c:\windows\$hf_mig$\KB932168\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 ----a-w c:\windows\$hf_mig$\KB932168\update\update.exe
+ 2006-01-19 19:29:19 371,424 ----a-w c:\windows\$hf_mig$\KB932168\update\updspapi.dll
+ 2008-02-26 11:48:44 297,984 ----a-w c:\windows\$hf_mig$\KB932823-v3\SP2QFE\msctf.dll
+ 2007-03-06 01:22:36 14,048 ----a-w c:\windows\$hf_mig$\KB932823-v3\spmsg.dll
+ 2007-03-06 01:22:41 213,216 ----a-w c:\windows\$hf_mig$\KB932823-v3\spuninst.exe
+ 2007-03-06 01:22:34 22,752 ----a-w c:\windows\$hf_mig$\KB932823-v3\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 ----a-w c:\windows\$hf_mig$\KB932823-v3\update\update.exe
+ 2007-03-06 01:23:51 371,424 ----a-w c:\windows\$hf_mig$\KB932823-v3\update\updspapi.dll
+ 2007-07-09 13:16:16 582,656 ----a-w c:\windows\$hf_mig$\KB933729\SP2QFE\rpcrt4.dll
+ 2007-06-19 07:24:36 350,720 ----a-w c:\windows\$hf_mig$\KB933729\SP2QFE\xpsp3res.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB933729\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB933729\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB933729\update\spcustom.dll
+ 2005-10-12 23:12:28 716,000 ----a-w c:\windows\$hf_mig$\KB933729\update\update.exe
+ 2005-10-12 23:12:33 371,424 ----a-w c:\windows\$hf_mig$\KB933729\update\updspapi.dll
+ 2007-04-16 16:07:27 986,112 ----a-w c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB935839\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB935839\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB935839\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB935839\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB935839\update\updspapi.dll
+ 2007-04-25 20:32:22 144,896 ----a-w c:\windows\$hf_mig$\KB935840\SP2QFE\schannel.dll
+ 2006-01-19 19:29:19 14,048 ----a-w c:\windows\$hf_mig$\KB935840\spmsg.dll
+ 2006-01-19 19:29:19 213,216 ----a-w c:\windows\$hf_mig$\KB935840\spuninst.exe
+ 2006-01-19 19:29:19 22,752 ----a-w c:\windows\$hf_mig$\KB935840\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 ----a-w c:\windows\$hf_mig$\KB935840\update\update.exe
+ 2006-01-19 19:29:19 371,424 ----a-w c:\windows\$hf_mig$\KB935840\update\updspapi.dll
+ 2007-06-26 06:06:12 1,104,896 ----a-w c:\windows\$hf_mig$\KB936021\SP2QFE\msxml3.dll
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB936021\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB936021\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\windows\$hf_mig$\KB936021\update\spcustom.dll
+ 2005-10-12 23:12:29 716,000 ----a-w c:\windows\$hf_mig$\KB936021\update\update.exe
+ 2005-10-12 23:12:34 371,424 ----a-w c:\windows\$hf_mig$\KB936021\update\updspapi.dll
+ 2007-04-23 10:14:23 364,160 ----a-w c:\windows\$hf_mig$\KB936357\SP2QFE\update.sys
+ 2006-01-19 19:29:19 14,048 ----a-w c:\windows\$hf_mig$\KB936357\spmsg.dll
+ 2006-01-19 19:29:19 213,216 ----a-w c:\windows\$hf_mig$\KB936357\spuninst.exe
+ 2006-01-19 19:29:19 22,752 ----a-w c:\windows\$hf_mig$\KB936357\update\spcustom.dll
+ 2006-01-19 19:29:19 716,000 ----a-w c:\windows\$hf_mig$\KB936357\update\update.exe
+ 2006-01-19 19:29:19 371,424 ----a-w c:\windows\$hf_mig$\KB936357\update\updspapi.dll
+ 2007-07-12 23:28:55 765,952 ----a-w c:\windows\$hf_mig$\KB938127-IE7\SP2QFE\vgx.dll
+ 2007-03-06 01:22:36 14,048 ----a-w c:\windows\$hf_mig$\KB938127-IE7\spmsg.dll
+ 2007-03-06 01:22:41 213,216 ----a-w c:\windows\$hf_mig$\KB938127-IE7\spuninst.exe
+ 2007-03-06 01:22:34 22,752 ----a-w c:\windows\$hf_mig$\KB938127-IE7\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 ----a-w c:\windows\$hf_mig$\KB938127-IE7\update\update.exe
+ 2007-03-06 01:23:51 371,424 ----a-w c:\windows\$hf_mig$\KB938127-IE7\update\updspapi.dll
+ 2007-11-30 12:39:22 17,272 ----a-w c:\windows\$hf_mig$\KB938464\spmsg.dll
+ 2007-11-30 12:39:22 231,288 ----a-w c:\windows\$hf_mig$\KB938464\spuninst.exe
+ 2007-11-30 12:39:22 26,488 ----a-w c:\windows\$hf_mig$\KB938464\update\spcustom.dll
+ 2007-11-30 11:20:44 755,576 ----a-w c:\windows\$hf_mig$\KB938464\update\update.exe
+ 2007-11-30 12:39:22 382,840 ----a-w c:\windows\$hf_mig$\KB938464\update\updspapi.dll
+ 2007-06-13 11:26:03 1,033,216 ----a-w c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
+ 2005-10-12 23:12:25 14,048 ----a-w c:\windows\$hf_mig$\KB938828\spmsg.dll
+ 2005-10-12 23:12:26 213,216 ----a-w c:\windows\$hf_mig$\KB938828\spuninst.exe
+ 2005-10-12 23:12:25 22,752 ----a-w c:\w

#6
rrush

Posted 17 February 2009 - 06:15 PM

Member

Topic Starter
Member
66 posts

Looks like the logs didn't completely make it. Attached are the files

Attached Files

combofixlog.txt 486.71KB 206 downloads
hijackthis.txt 5.44KB 157 downloads

#7
handhfan

Posted 17 February 2009 - 10:24 PM

Trusted Helper

Expert
13,659 posts

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

RegLock::
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]

Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]

File::
C:\WINDOWS\system32\drivers\TDSSmqlt.sys

Reboot::

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

#8
rrush

Posted 18 February 2009 - 05:17 AM

Member

Topic Starter
Member
66 posts

Logs:

ComboFix 09-02-15.01 - Tech 2009-02-18 6:06:36.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2038.1682 [GMT -5:00]
Running from: c:\documents and settings\Tech\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Tech\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Outdated)
FW: McAfee Personal Firewall *disabled*
* Created a new restore point

FILE ::
c:\windows\system32\drivers\TDSSmqlt.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Drivers\TDSSmhxt.sys
c:\windows\system32\drivers\TDSSmqlt.sys
c:\windows\system32\TDSScfum.dll
c:\windows\system32\TDSSfxmp.dll
c:\windows\system32\TDSSnrsr.dll
c:\windows\system32\TDSSofxh.dll
c:\windows\system32\TDSSoiqh.dll
c:\windows\system32\TDSSosvd.dat
c:\windows\system32\TDSSriqp.dll
c:\windows\system32\TDSStkdv.log

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSSERV.SYS

((((((((((((((((((((((((( Files Created from 2009-01-18 to 2009-02-18 )))))))))))))))))))))))))))))))
.

2009-02-12 22:41 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-12 22:41 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-12 21:25 . 2009-02-12 21:26 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-02-11 22:43 . 2009-02-11 22:48 <DIR> d-------- C:\fixwareout
2009-02-10 21:39 . 2009-02-10 21:39 <DIR> d-------- c:\documents and settings\Tech\Application Data\SUPERAntiSpyware.com
2009-02-10 21:13 . 2009-02-10 21:13 <DIR> d-------- c:\documents and settings\Tech\Application Data\Systweak
2009-02-10 21:08 . 2009-02-10 21:08 <DIR> d-------- c:\documents and settings\Tech
2009-02-05 21:37 . 2009-02-05 21:37 <DIR> d-------- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-02-04 00:10 . 2008-08-14 05:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2009-02-04 00:10 . 2008-08-14 05:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-02-04 00:10 . 2008-08-14 04:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-02-04 00:10 . 2008-08-14 04:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2009-02-04 00:10 . 2008-09-15 07:12 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys
2009-02-04 00:10 . 2008-10-24 06:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2009-02-04 00:10 . 2008-10-15 11:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2009-02-04 00:10 . 2008-12-11 05:57 333,952 -----c--- c:\windows\system32\dllcache\srv.sys
2009-02-03 23:39 . 2009-02-03 23:39 <DIR> d-------- c:\windows\system32\scripting
2009-02-03 23:39 . 2009-02-03 23:39 <DIR> d-------- c:\windows\system32\en
2009-02-03 23:39 . 2009-02-03 23:39 <DIR> d-------- c:\windows\system32\bits
2009-02-03 23:39 . 2009-02-03 23:39 <DIR> d-------- c:\windows\l2schemas
2009-02-03 23:38 . 2009-02-03 23:38 <DIR> d-------- c:\windows\ServicePackFiles
2009-02-03 23:35 . 2009-02-03 23:35 <DIR> d-------- c:\windows\EHome
2009-02-03 23:24 . 2009-02-03 23:23 410,984 --a------ c:\windows\system32\deploytk.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-13 03:52 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-02-12 04:20 --------- d-----w c:\program files\SUPERAntiSpyware
2009-02-11 02:34 --------- d-----w c:\program files\Windows Media Connect 2
2009-02-11 02:13 --------- d-----w c:\program files\Advanced System Optimizer
2009-02-06 10:24 --------- d-----w c:\program files\Norton Security Scan
2009-02-04 04:23 --------- d-----w c:\program files\Java
2009-01-14 23:00 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-25 15:36 --------- d-----w c:\documents and settings\Rhock\Application Data\Apple Computer
2008-12-25 15:33 --------- d-----w c:\program files\QuickTime
2008-12-25 15:33 --------- d-----w c:\program files\iTunes
2008-12-25 15:33 --------- d-----w c:\program files\iPod
2008-12-25 15:33 --------- d-----w c:\program files\Common Files\Apple
2008-12-25 15:33 --------- d-----w c:\program files\Bonjour
2008-12-25 15:33 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-25 15:32 --------- d-----w c:\program files\Apple Software Update
2008-12-25 15:32 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-25 15:32 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
.

((((((((((((((((((((((((((((( SnapShot_2009-02-17_ 6.14.54.76 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-02-17 11:11:39 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-02-18 00:18:37 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-02-17 11:11:39 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-02-18 00:18:37 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-02-17 11:01:40 40,394 ----a-w c:\windows\system32\perfc009.dat
+ 2009-02-17 11:16:06 40,394 ----a-w c:\windows\system32\perfc009.dat
- 2009-02-17 11:01:40 312,172 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-17 11:16:06 312,172 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-18 11:09:26 16,384 ----atw c:\windows\TEMP\Perflib_Perfdata_76c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-09-05 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-09-05 114688]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-09-05 94208]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-14 102400]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-03 136600]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-06-26 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-06-26 20:43 294912 c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-13 19:12 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2005-02-16 23:11 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--a------ 2006-07-26 22:44 61952 c:\windows\system32\CHDAudPropShortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\SUPERAntiSpyware\\SUPERANTISPYWARE.EXE"=

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2006-10-10 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2007-02-27 55024]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2006-02-16 4096]
S4 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" --> c:\program files\Viewpoint\Common\ViewpointService.exe [?]
.
Contents of the 'Scheduled Tasks' folder

2008-12-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-01-17 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

2008-06-27 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]
.
.
------- Supplementary Scan -------
.
uStart Page = www.google.com
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-18 06:09:42
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(916)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\McAfee\MPF\MpfSrv.exe
c:\windows\system32\msiexec.exe
c:\program files\Synaptics\SynTP\SynTPEnh.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\McAfee\MSC\mcuimgr.exe
.
**************************************************************************
.
Completion time: 2009-02-18 6:11:54 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-18 11:11:51
ComboFix2.txt 2009-02-17 11:15:26
ComboFix3.txt 2008-06-26 00:00:57

Pre-Run: 110,066,601,984 bytes free
Post-Run: 110,056,587,264 bytes free

188 --- E O F --- 2009-02-11 04:03:14

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:14:45 AM, on 2/18/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft....k/?LinkId=74005
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1213326445515
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

--
End of file - 5948 bytes

#9
handhfan

Posted 18 February 2009 - 10:12 AM

Trusted Helper

Expert
13,659 posts

Open HijackThis, click Config, click Misc Tools
Click "Open Uninstall Manager"
Click "Save List" (generates uninstall_list.txt)
Click Save, copy and paste the results in your next post.

#10
rrush

Posted 18 February 2009 - 05:07 PM

Member

Topic Starter
Member
66 posts

Uninstall list as requested. It appears you're making good progress.

Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player ActiveX
Apple Mobile Device Support
Apple Software Update
Bonjour
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
iTunes
Java™ 6 Update 11
Java™ 6 Update 6
Malwarebytes' Anti-Malware
McAfee SecurityCenter
Norton Security Scan (Symantec Corporation)
Panda ActiveScan 2.0
QuickTime
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB960715)
Spybot - Search & Destroy
SUPERAntiSpyware Free Edition
Update for Windows XP (KB942763)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB955839)
Windows XP Service Pack 3

#11
handhfan

Posted 19 February 2009 - 12:14 AM

Trusted Helper

Expert
13,659 posts

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systems

Upgrading Java:

Download the latest version of Java SE Runtime Environment (JRE) JRE 6 Update 12.
Click the "Download" button to the right.
Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
Click on Continue.
Click on the link to download Windows Offline Installation (jre-6u12-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u12-windows-i586-p.exe and select "Run as an Administrator.")

Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present):

Java™ 6 Update 11
Java™ 6 Update 6

Please do an online scan with Kaspersky WebScanner

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure the following is checked.
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply, along with a new HijackThis log.

Edited by handhfan, 19 February 2009 - 12:14 AM.

#12
rrush

Posted 19 February 2009 - 05:54 PM

Member

Topic Starter
Member
66 posts

Logs:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, February 19, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, February 19, 2009 10:31:52
Records in database: 1815409
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
E:\

Scan statistics:
Files scanned: 33188
Threat name: 1
Infected objects: 1
Suspicious objects: 0
Duration of the scan: 00:44:12

File name / Threat name / Threats count
C:\Documents and Settings\Rhock\My Documents\My Music\setup_243_3777_.exe Infected: not-a-virus:FraudTool.Win32.ProAntiSpyware.d 1

The selected area was scanned.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:51:27 PM, on 2/19/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Java\jre6\bin\java.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft....k/?LinkId=74005
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1213326445515
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

--
End of file - 5921 bytes

Thanks

#13
handhfan

Posted 19 February 2009 - 06:16 PM

Trusted Helper

Expert
13,659 posts

Please download the OTMoveIt3 by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Files
C:\Documents and Settings\Rhock\My Documents\My Music\setup_243_3777_.exe

:Commands
[emptytemp]
[start explorer]
[Reboot]

Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post, along with a new HijackThis log.

Is your computer running better now?

#14
rrush

Posted 19 February 2009 - 07:35 PM

Member

Topic Starter
Member
66 posts

Logs below. Computer is running much, much better! You have done an excellent job with this one.

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\Documents and Settings\Rhock\My Documents\My Music\setup_243_3777_.exe moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\Arj.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\avlib.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\Avp1.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\AvpMgr.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\btimages.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\CAB.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\dmap.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\dtreg.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\FsDrvPlg.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\FSSync.dll scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\HashCont.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\HashMD5.PPL scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\HCCMP.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\ichk2.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\iChkSA.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\Inflate.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\IWGen.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\kave.dll scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\kosglue-7.0.25.0.dll scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\lha.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\L_llio.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\mdb.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\MDMAP.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\MemModSc.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\MemScan.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\minizip.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\MKavIO.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\msoe.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\nfio.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\NTFSstrm.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\prKernel.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\prLoader.dll scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\prseqio.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\PrUtil.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\rar.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\ScanningProcess.exe scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\sfdb.PPL scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\TempFile.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\thpimpl.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\UniArc.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\UnLZX.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\UnStored.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\WDiskIO.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\hsperfdata_Tech\3812 scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\hsperfdata_Tech\684 scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\~DF8314.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Tech\LOCALS~1\Temp\~DF8322.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\mcafee_4R2Gc1iU5YvKMij scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_eaB6PLAtPnApv3o scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_IxBLTeSW0M5i8X7 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_ND6T1bG9WhVxzDt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_UetlzAr3b2w8XD0 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_2c8.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_c50.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\WFV1C2.tmp scheduled to be deleted on reboot.
Windows Temp folder emptied.
File delete failed. C:\Documents and Settings\Tech\Application Data\Sun\Java\Deployment\cache\6.0\14\757e808e-3321d781 scheduled to be deleted on reboot.
Java cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02192009_194332

Files moved on Reboot...
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\Arj.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\avlib.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\Avp1.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\AvpMgr.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\btimages.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\CAB.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\dmap.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\dtreg.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\FsDrvPlg.ppl moved successfully.
DllUnregisterServer procedure not found in C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\FSSync.dll
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\FSSync.dll NOT unregistered.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\FSSync.dll moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\HashCont.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\HashMD5.PPL moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\HCCMP.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\ichk2.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\iChkSA.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\Inflate.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\IWGen.ppl moved successfully.
DllUnregisterServer procedure not found in C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\kave.dll
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\kave.dll NOT unregistered.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\kave.dll moved successfully.
DllUnregisterServer procedure not found in C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\kosglue-7.0.25.0.dll
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\kosglue-7.0.25.0.dll NOT unregistered.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\kosglue-7.0.25.0.dll moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\lha.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\L_llio.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\mdb.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\MDMAP.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\MemModSc.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\MemScan.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\minizip.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\MKavIO.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\msoe.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\nfio.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\NTFSstrm.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\prKernel.ppl moved successfully.
DllUnregisterServer procedure not found in C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\prLoader.dll
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\prLoader.dll NOT unregistered.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\prLoader.dll moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\prseqio.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\PrUtil.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\rar.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\ScanningProcess.exe moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\sfdb.PPL moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\TempFile.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\thpimpl.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\UniArc.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\UnLZX.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\UnStored.ppl moved successfully.
C:\DOCUME~1\Tech\LOCALS~1\Temp\jkos-Tech\binaries\WDiskIO.ppl moved successfully.
File C:\DOCUME~1\Tech\LOCALS~1\Temp\hsperfdata_Tech\3812 not found!
File C:\DOCUME~1\Tech\LOCALS~1\Temp\hsperfdata_Tech\684 not found!
File C:\DOCUME~1\Tech\LOCALS~1\Temp\~DF8314.tmp not found!
File C:\DOCUME~1\Tech\LOCALS~1\Temp\~DF8322.tmp not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\mcafee_4R2Gc1iU5YvKMij not found!
C:\WINDOWS\temp\mcmsc_eaB6PLAtPnApv3o moved successfully.
File C:\WINDOWS\temp\mcmsc_IxBLTeSW0M5i8X7 not found!
File C:\WINDOWS\temp\mcmsc_ND6T1bG9WhVxzDt not found!
File C:\WINDOWS\temp\mcmsc_UetlzAr3b2w8XD0 not found!
File C:\WINDOWS\temp\Perflib_Perfdata_2c8.dat not found!
File C:\WINDOWS\temp\Perflib_Perfdata_c50.dat not found!
File C:\WINDOWS\temp\WFV1C2.tmp not found!
C:\Documents and Settings\Tech\Application Data\Sun\Java\Deployment\cache\6.0\14\757e808e-3321d781 moved successfully.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:30:19 PM, on 2/19/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\svchost.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft....k/?LinkId=74005
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1213326445515
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

--
End of file - 5805 bytes

McAfee is updating and running properly again. Other apps all seem to respond as they should. Will wait for your word on whether it's all better now.

Thank You again!!

#15
handhfan

Posted 19 February 2009 - 10:10 PM

Trusted Helper

Expert
13,659 posts

Your logs look clean. There is only a bit of cleanup that we will deal with in this post, as well as prevention from future infections. If you have any questions or other problems, please let me know. Other than that, and the steps below, you should be all set.

Follow these steps to uninstall Combofix and tools used in the removal of malware

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.

Make sure you have an Internet Connection.
Download OTCleanIt to your desktop and run it
A list of tool components used in the Cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OTCleanUp to reach the Internet, please allow the application to do so.
Click Yes to beging the Cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

Please update Adobe Reader, by downloading and installing Adobe Reader 9.

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

SpywareBlaster to help prevent spyware from installing in the first place.
SpywareGuard gives you realtime protection from spyware.
Super Antispyware OR Malwarebytes' Anti-Malware to help remove any spyware that may have gotten on your computer.
MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed.
Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see this article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.

To keep your operating system up to date visit Microsoft Windows Update monthly. Remember to be aware of what emails you open and websites you visit.

Have a safe and happy computing day!