Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Rootkit, Kobcka


  • Please log in to reply

#1
uoa94

uoa94

    New Member

  • Member
  • Pip
  • 1 posts
I am having all kinds of problems: unusual beeping, popups, slow processing, etc. I've gone through the cleaning guide, but the problems are not going away. Malwarebytes continues to bring up Rootkit.Agent, Malware Trace, Trojan.Agent, etc. which recur after deleting and rebooting. Please help.



Microsoft Windows XP Professional (5.1.2600) Service Pack 2

C:\ [Fixed] - NTFS - (Total:57231 Mo/Free:1821 Mo)
D:\ [CD-Rom] (Total:0 Mo/Free:0 Mo)
Z:\ [Network] (Total:0 Mo/Free:0 Mo)

Sun 04/19/2009|17:57

----------------------\\ Processes..

--Locked-- [System Process]
---------- System
---------- \SystemRoot\System32\smss.exe
---------- \??\C:\WINDOWS\system32\csrss.exe
---------- \??\C:\WINDOWS\system32\winlogon.exe
---------- C:\WINDOWS\system32\services.exe
---------- C:\WINDOWS\system32\lsass.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\Program Files\Windows Defender\MsMpEng.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
---------- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
---------- C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\System32\SCardSvr.exe
---------- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
---------- C:\WINDOWS\dhcp\svchost.exe
---------- C:\WINDOWS\SYSTEM32\DWRCS.EXE
---------- C:\WINDOWS\system32\inetsrv\inetinfo.exe
---------- C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
---------- C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
---------- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
---------- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
---------- C:\WINDOWS\system32\wdfmgr.exe
---------- C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
---------- C:\WINDOWS\Explorer.EXE
---------- C:\WINDOWS\SYSTEM32\DWRCST.exe
---------- C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
---------- C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
---------- C:\WINDOWS\system32\hkcmd.exe
---------- C:\WINDOWS\system32\igfxpers.exe
---------- C:\Program Files\Apoint\Apoint.exe
---------- C:\WINDOWS\stsystra.exe
---------- C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
---------- C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
---------- C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
---------- C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
---------- C:\Program Files\Windows Defender\MSASCui.exe
---------- C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
---------- C:\WINDOWS\System32\alg.exe
---------- C:\Program Files\Apoint\HidFind.exe
---------- C:\Program Files\Apoint\Apntex.exe
---------- C:\WINDOWS\system32\ctfmon.exe
---------- C:\Program Files\Messenger\msmsgs.exe
---------- C:\Documents and Settings\wcobb\Application Data\pidle\pidle.exe
---------- C:\Program Files\WinZip\WZQKPICK.EXE
---------- C:\Program Files\Internet Explorer\iexplore.exe
----------
----------
----------
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\Program Files\Internet Explorer\iexplore.exe
---------- C:\WINDOWS\system32\cmd.exe
---------- C:\Rooter$\RK.exe

----------------------\\ Search..

----------------------\\ ROOTKIT !!



1 - "C:\Rooter$\Rooter_1.txt" - Sun 04/19/2009|15:29
2 - "C:\Rooter$\Rooter_2.txt" - Sun 04/19/2009|17:04
3 - "C:\Rooter$\Rooter_3.txt" - Sun 04/19/2009|17:58

----------------------\\ Scan completed at 17:58

OTListIt logfile created on: 4/19/2009 5:58:46 PM - Run 1
OTListIt2 by OldTimer - Version 2.0.14.0 Folder = C:\Documents and Settings\wcobb\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.49 Gb Total Physical Memory | 0.41 Gb Available Physical Memory | 27.58% Memory free
2.83 Gb Paging File | 1.75 Gb Available in Paging File | 61.79% Paging File free
Paging file location(s): C:\pagefile.sys 0 0;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.89 Gb Total Space | 41.78 Gb Free Space | 74.75% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MICHLT32
Current User Name: WCobb
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
PRC - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe (Intel® Corporation)
PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\WINDOWS\dhcp\svchost.exe ()
PRC - C:\WINDOWS\SYSTEM32\DWRCS.EXE (DameWare Development LLC)
PRC - C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
PRC - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe (Network Associates, Inc.)
PRC - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe (Network Associates, Inc.)
PRC - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\wdfmgr.exe (Microsoft Corporation)
PRC - C:\Program Files\Network Associates\Common Framework\naPrdMgr.exe (Network Associates, Inc.)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\SYSTEM32\DWRCST.exe (DameWare Development)
PRC - C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\igfxpers.exe (Intel Corporation)
PRC - C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE (Network Associates, Inc.)
PRC - C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe (Network Associates, Inc.)
PRC - C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe (Network Associates, Inc.)
PRC - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Apoint\HidFind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\Apntex.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\wcobb\Application Data\pidle\pidle.exe ()
PRC - C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, Inc.)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\wcobb\Desktop\OTListIt2.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (24x7 Scheduler [Auto | Stopped]) -- File not found
SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation)
SRV - (CVPND [Auto | Running]) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (dhcpsrv [Auto | Running]) -- C:\WINDOWS\dhcp\svchost.exe ()
SRV - (DWMRCS [Auto | Running]) -- C:\WINDOWS\SYSTEM32\DWRCS.EXE (DameWare Development LLC)
SRV - (EvtEng [Auto | Running]) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (IDriverT [On_Demand | Stopped]) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (IISADMIN [Auto | Running]) -- C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (McAfeeFramework [Auto | Running]) -- C:\Program Files\Network Associates\Common Framework\FrameworkService.exe (Network Associates, Inc.)
SRV - (McTaskManager [Auto | Running]) -- C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe (Network Associates, Inc.)
SRV - (MDM [Auto | Running]) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (RegSrvc [Auto | Running]) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (RoxLiveShare9 [Auto | Stopped]) -- File not found
SRV - (S24EventMonitor [Auto | Running]) -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
SRV - (SMTPSVC [Auto | Running]) -- C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (UMWdf [Auto | Running]) -- C:\WINDOWS\system32\wdfmgr.exe (Microsoft Corporation)
SRV - (W3SVC [Auto | Running]) -- C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (WinDefend [Auto | Running]) -- C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (WLANKEEPER [Auto | Running]) -- C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe (Intel® Corporation)

========== Driver Services (SafeList) ==========

DRV - (AegisP [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\AegisP.sys (Meetinghouse Data Communications)
DRV - (ApfiltrService [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (b57w2k [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\b57xp32.sys (Broadcom Corporation)
DRV - (cercsr6 [Boot | Stopped]) -- C:\WINDOWS\System32\drivers\cercsr6.sys (Adaptec, Inc.)
DRV - (CVirtA [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\CVirtA.sys (Cisco Systems, Inc.)
DRV - (CVPNDRVA [Auto | Running]) -- C:\WINDOWS\system32\Drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (DNE [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\dne2000.sys (Deterministic Networks, Inc.)
DRV - (entdrv51 [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\EntDrv51.sys (Network Associates, Inc)
DRV - (HDAudBus [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (HPFXBULK [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\hpfxbulk.sys (Hewlett Packard)
DRV - (HSF_DPV [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWAZL [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys (Conexant Systems, Inc.)
DRV - (ialm [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (mdmxsdk [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys (Conexant)
DRV - (NaiAvFilter1 [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\naiavf5x.sys (Network Associates, Inc.)
DRV - (NaiAvTdi1 [System | Running]) -- C:\WINDOWS\system32\drivers\mvstdi5x.sys (Network Associates, Inc.)
DRV - (NETw3x32 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\NETw3x32.sys (Intel® Corporation)
DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (restore [Unknown | Stopped]) -- C:\WINDOWS\System32\Restore [2007/02/07 18:09:39 | 00,000,000 | ---D | M]
DRV - (RimSerPort [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\RimSerial.sys (Research in Motion Ltd)
DRV - (RimVSerPort [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\RimSerial.sys (Research in Motion Ltd)
DRV - (ROOTMODEM [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\RootMdm.sys (Microsoft Corporation)
DRV - (s24trans [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\s24trans.sys (Intel Corporation)
DRV - (STHDA [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (USBCCID [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\usbccid.sys (Microsoft Corporation)
DRV - (vsdatant [On_Demand | Stopped]) -- C:\WINDOWS\system32\vsdatant.sys (Zone Labs LLC)
DRV - (winachsf [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HSX_CNXT.sys (Conexant Systems, Inc.)

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft...amp;ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...amp;ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft...p...ER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>



O1 HOSTS File: (28 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 jL.chura.pl
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" (Intel Corporation)
O4 - HKLM..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey (Network Associates, Inc.)
O4 - HKLM..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" (Network Associates, Inc.)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE (Network Associates, Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [ToolBoxFX] "C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /systrayIcon:on File not found
O4 - HKLM..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide (Microsoft Corporation)
O4 - HKCU..\Run: [] C:\DOCUME~1\wcobb\LOCALS~1\Temp\jssgl.exe File not found
O4 - HKCU..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation)
O4 - HKCU..\Run: [pidle] "C:\Documents and Settings\wcobb\Application Data\pidle\pidle.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139 ()
O4 - HKCU..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 (Adobe Systems Incorporated)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe (Cisco Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFolderOptions = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: wal-mart.com ([retaillink] https in Trusted sites)
O15 - HKCU\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft....k/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6414512b-b978-451d-a0d8-fcfdf33e833c} http://update.micros...b?1240180369765 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA} https://eetime17.adp...dows-i586-p.exe (Java Plug-in)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_09)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = luiginos.com
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\saphtmlp {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\FrontEnd\SapGui\SAPHTMLP.DLL (SAP AG, Walldorf)
O18 - Protocol\Handler\sapr3 {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\FrontEnd\SapGui\SAPHTMLP.DLL (SAP AG, Walldorf)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\progra~1\ThunMail\testabd.dll) - c:\progra~1\ThunMail\testabd.dll File not found
O20 - AppInit_DLLs: (c:\windows\system32\jimiwemo.dll) - c:\windows\system32\jimiwemo.dll File not found
O20 - AppInit_DLLs: (C:\WINDOWS\system32\pofokago.dll) - C:\WINDOWS\system32\pofokago.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\ntos.exe) - C:\WINDOWS\system32\ntos.exe [FILE handle not seen by OS]
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
O22 - SharedTaskScheduler: {A5AF42A3-94F3-42BD-F634-0604832C897D} - as3iur98wajkef3wgf3 - C:\WINDOWS\system32\yaubfh983ind.dll File not found
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[56 C:\*.tmp files]
[4 C:\WINDOWS\System32\*.tmp files]
[7 C:\WINDOWS\*.tmp files]
[2009/04/19 17:52:49 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\qxvhztg.sys
[2009/04/19 17:37:19 | 00,036,352 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\reader_s.ex_
[2009/04/19 17:37:17 | 00,019,420 | ---- | C] () -- C:\WINDOWS\System32\27.tm_
[2009/04/19 17:37:12 | 00,015,000 | ---- | C] () -- C:\WINDOWS\System32\yaubfh983ind.dl_
[2009/04/19 17:32:55 | 00,000,000 | ---D | C] -- C:\WINDOWS\LastGood.Tmp
[2009/04/19 16:47:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\wcobb\Application Data\Malwarebytes
[2009/04/19 16:46:27 | 00,000,696 | ---- | C] () -- C:\DOCUME~1\ALLUSE~1\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/04/19 16:46:17 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/04/19 16:46:14 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/04/19 16:46:12 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/04/19 16:46:11 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/04/19 16:45:16 | 02,967,800 | ---- | C] (Malwarebytes Corporation ) -- C:\DOCUME~1\wcobb\Desktop\mbam-setup.exe
[2009/04/19 16:17:34 | 00,000,000 | ---D | C] -- C:\Qoobox
[2009/04/19 16:06:03 | 00,019,420 | ---- | C] () -- C:\WINDOWS\System32\26.tm_
[2009/04/19 15:30:12 | 00,523,264 | ---- | C] (OldTimer Tools) -- C:\DOCUME~1\wcobb\Desktop\OTListIt2.exe
[2009/04/19 15:28:19 | 00,000,000 | ---D | C] -- C:\Rooter$
[2009/04/19 15:28:08 | 00,267,612 | ---- | C] () -- C:\DOCUME~1\wcobb\Desktop\Rooter.exe
[2009/04/19 15:03:18 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/04/19 15:02:52 | 00,000,611 | ---- | C] () -- C:\DOCUME~1\wcobb\Desktop\NTREGOPT.lnk
[2009/04/19 15:02:52 | 00,000,592 | ---- | C] () -- C:\DOCUME~1\wcobb\Desktop\ERUNT.lnk
[2009/04/19 15:02:52 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/04/19 14:25:39 | 00,000,121 | -HS- | C] () -- C:\WINDOWS\System32\ipayojok.ini
[2009/04/19 14:25:10 | 00,000,000 | ---D | C] -- C:\WINDOWS\A59B2974739E4E5585E160FF279EB3DD.TMP
[2009/04/19 11:31:35 | 00,000,003 | ---- | C] () -- C:\WINDOWS\System32\bversion.dll
[2009/04/19 11:31:18 | 00,735,232 | ---- | C] (???? http://www.lunchsoft.com/yzm) -- C:\WINDOWS\System32\AdvOcr.dll
[2009/04/19 11:31:16 | 00,094,208 | ---- | C] (Transym Computer Services Ltd) -- C:\WINDOWS\System32\TRSOCR.dll
[2009/04/19 11:31:15 | 00,001,308 | ---- | C] () -- C:\WINDOWS\System32\TRSOCR.ini
[2009/04/19 11:31:15 | 00,001,308 | ---- | C] () -- C:\WINDOWS\System32\TRSOCR.dat
[2009/04/19 11:11:42 | 00,058,368 | ---- | C] () -- C:\WINDOWS\System32\ak1.exe
[2009/04/19 11:08:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\wcobb\Application Data\Twain
[2009/04/19 11:07:36 | 00,000,000 | ---D | C] -- C:\Program Files\LanqiEngine
[2009/04/19 11:06:42 | 00,565,248 | ---- | C] () -- C:\WINDOWS\System32\IPHACTION.dll
[2009/04/19 11:00:40 | 00,000,000 | ---- | C] () -- C:\WINDOWS\mqcd.dbt
[2009/04/19 10:56:02 | 00,000,025 | ---- | C] () -- C:\WINDOWS\System32\tcpd.dll
[2009/04/19 10:55:46 | 00,079,360 | ---- | C] () -- C:\WINDOWS\System32\ashl.nq
[2009/04/19 10:55:43 | 00,262,144 | ---- | C] () -- C:\WINDOWS\System32\nvrsk.dll
[2009/04/19 10:51:54 | 00,043,520 | ---- | C] () -- C:\ptrf.exe
[2009/04/19 10:51:34 | 00,290,304 | ---- | C] () -- C:\wcfgayg.exe
[2009/04/19 10:50:41 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\IpSvchostF.dll
[2009/04/18 15:19:00 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\tcpd.exe
[2009/04/18 15:18:58 | 00,984,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kernel32_check.dll
[2009/04/18 15:18:57 | 00,172,032 | ---- | C] () -- C:\WINDOWS\System32\tcpcon.dll
[2009/04/18 15:18:57 | 00,000,009 | ---- | C] () -- C:\WINDOWS\System32\riphy.dll
[2009/04/18 15:18:57 | 00,000,009 | ---- | C] () -- C:\WINDOWS\System32\iphy.dll
[2009/04/18 15:18:57 | 00,000,003 | ---- | C] () -- C:\WINDOWS\System32\fhpatch.dll
[2009/04/18 15:17:37 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\3361
[2009/04/18 15:17:36 | 00,108,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSWINSCK.OCX
[2009/04/18 15:17:33 | 00,000,000 | ---D | C] -- C:\WINDOWS\dhcp
[2009/04/18 15:16:58 | 00,000,000 | RHSD | C] -- C:\Program Files\ThunMail
[2009/04/18 15:16:52 | 00,083,822 | ---- | C] () -- C:\WINDOWS\System32\drivers\a3766af0.sys
[2009/04/18 15:16:45 | 00,043,520 | ---- | C] () -- C:\mxntwq.exe
[2009/04/18 15:16:43 | 00,000,000 | ---D | C] -- C:\Documents and Settings\wcobb\Application Data\pidle
[2009/04/18 15:16:37 | 00,000,002 | ---- | C] () -- C:\1821674558
[2009/04/18 15:16:24 | 00,290,304 | ---- | C] () -- C:\yxly.exe
[2009/04/07 08:10:38 | 39,138,393 | ---- | C] () -- C:\DOCUME~1\wcobb\Desktop\FullCube.cub
[2009/03/25 12:43:23 | 00,045,355 | ---- | C] () -- C:\DOCUME~1\wcobb\My Documents\SKMBT_C35209032611220.pdf
[2009/01/19 10:55:28 | 00,050,176 | -HS- | C] () -- C:\WINDOWS\System32\muwumadu.dll
[2009/01/19 10:51:24 | 00,050,176 | -HS- | C] () -- C:\WINDOWS\System32\tajokigu.dll
[2008/08/15 11:39:49 | 00,002,897 | ---- | C] () -- C:\WINDOWS\saplogon.ini
[2007/05/25 16:37:51 | 00,000,000 | ---- | C] () -- C:\WINDOWS\rfccom.INI
[2007/04/09 11:39:33 | 00,000,462 | ---- | C] () -- C:\WINDOWS\hpbvspst.ini
[2007/04/09 11:39:22 | 00,001,359 | ---- | C] () -- C:\WINDOWS\hpbvnstp.ini
[2007/02/08 08:57:35 | 00,000,466 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007/02/08 08:42:41 | 00,002,915 | ---- | C] () -- C:\WINDOWS\System32\DWRCS.ini
[2007/02/07 21:56:33 | 01,064,960 | ---- | C] () -- C:\WINDOWS\System32\h5krnl32.dll
[2007/02/07 21:56:33 | 00,188,928 | ---- | C] () -- C:\WINDOWS\System32\h5icon32.dll
[2007/02/07 21:56:33 | 00,175,616 | ---- | C] () -- C:\WINDOWS\System32\h5menu32.dll
[2007/02/07 21:56:33 | 00,095,744 | ---- | C] () -- C:\WINDOWS\System32\h5rtf32.dll
[2007/02/07 21:56:33 | 00,051,200 | ---- | C] () -- C:\WINDOWS\System32\h5tool32.dll
[2007/02/07 21:56:30 | 00,015,872 | ---- | C] () -- C:\WINDOWS\System32\vtssm32.dll
[2007/02/07 21:33:02 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\JAWTAccessBridge.dll
[2007/02/07 21:07:46 | 00,029,752 | ---- | C] () -- C:\WINDOWS\System32\InstHelper.dll
[2007/02/07 21:07:15 | 00,197,680 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2007/02/07 21:07:13 | 00,193,584 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2007/02/07 18:13:59 | 00,000,000 | ---- | C] () -- C:\WINDOWS\frontpg.ini
[2007/02/07 18:13:08 | 00,021,791 | ---- | C] () -- C:\WINDOWS\System32\smtpctrs.ini
[2007/02/07 18:13:08 | 00,001,037 | ---- | C] () -- C:\WINDOWS\System32\ntfsdrct.ini
[2007/02/07 18:13:03 | 00,038,576 | ---- | C] () -- C:\WINDOWS\System32\w3ctrs.ini
[2007/02/07 18:13:03 | 00,010,225 | ---- | C] () -- C:\WINDOWS\System32\axperf.ini
[2007/02/07 18:13:01 | 00,011,435 | ---- | C] () -- C:\WINDOWS\System32\infoctrs.ini
[2006/04/04 16:40:00 | 00,040,960 | ---- | C] ( ) -- C:\WINDOWS\System32\DMEBuilderLoader.dll
[2005/12/01 06:33:55 | 00,237,568 | ---- | C] () -- C:\WINDOWS\System32\hppapr02.DLL
[2005/01/21 12:02:28 | 00,013,312 | ---- | C] () -- C:\WINDOWS\System32\RMDevice.dll
[2004/08/04 05:00:00 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2004/08/04 05:00:00 | 00,000,573 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/08/04 05:00:00 | 00,000,231 | ---- | C] () -- C:\WINDOWS\system.ini
[2004/03/26 12:49:00 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\DMEBurstSort.dll
[2003/01/07 15:05:08 | 00,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/07/06 15:30:00 | 00,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini
[1998/08/12 09:49:34 | 00,000,200 | ---- | C] () -- C:\WINDOWS\cfxatb.ini

========== Files - Modified Within 30 Days ==========

[56 C:\*.tmp files]
[4 C:\WINDOWS\System32\*.tmp files]
[7 C:\WINDOWS\*.tmp files]
[2009/04/19 18:00:10 | 00,083,822 | ---- | M] () -- C:\WINDOWS\System32\drivers\a3766af0.sys
[2009/04/19 17:54:50 | 00,000,512 | ---- | M] () -- C:\WINDOWS\randseed.rnd
[2009/04/19 17:52:49 | 00,061,440 | ---- | M] () -- C:\WINDOWS\System32\drivers\qxvhztg.sys
[2009/04/19 17:46:18 | 00,511,096 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009/04/19 17:46:18 | 00,432,538 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/04/19 17:46:18 | 00,070,836 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009/04/19 17:44:44 | 00,000,330 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2009/04/19 17:42:44 | 00,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009/04/19 17:41:44 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/04/19 17:41:37 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/04/19 17:37:19 | 00,036,352 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\reader_s.ex_
[2009/04/19 17:37:18 | 00,019,420 | ---- | M] () -- C:\WINDOWS\System32\27.tm_
[2009/04/19 17:37:12 | 00,015,000 | ---- | M] () -- C:\WINDOWS\System32\yaubfh983ind.dl_
[2009/04/19 16:57:31 | 00,011,168 | -H-- | M] () -- C:\WINDOWS\System32\kusufavi
[2009/04/19 16:46:27 | 00,000,696 | ---- | M] () -- C:\DOCUME~1\ALLUSE~1\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/04/19 16:45:49 | 02,967,800 | ---- | M] (Malwarebytes Corporation ) -- C:\DOCUME~1\wcobb\Desktop\mbam-setup.exe
[2009/04/19 16:06:05 | 00,019,420 | ---- | M] () -- C:\WINDOWS\System32\26.tm_
[2009/04/19 15:30:29 | 00,523,264 | ---- | M] (OldTimer Tools) -- C:\DOCUME~1\wcobb\Desktop\OTListIt2.exe
[2009/04/19 15:28:18 | 00,267,612 | ---- | M] () -- C:\DOCUME~1\wcobb\Desktop\Rooter.exe
[2009/04/19 15:02:52 | 00,000,611 | ---- | M] () -- C:\DOCUME~1\wcobb\Desktop\NTREGOPT.lnk
[2009/04/19 15:02:52 | 00,000,592 | ---- | M] () -- C:\DOCUME~1\wcobb\Desktop\ERUNT.lnk
[2009/04/19 14:25:39 | 00,000,121 | -HS- | M] () -- C:\WINDOWS\System32\ipayojok.ini
[2009/04/19 11:31:35 | 00,735,232 | ---- | M] (???? http://www.lunchsoft.com/yzm) -- C:\WINDOWS\System32\AdvOcr.dll
[2009/04/19 11:31:35 | 00,000,003 | ---- | M] () -- C:\WINDOWS\System32\bversion.dll
[2009/04/19 11:31:18 | 00,094,208 | ---- | M] (Transym Computer Services Ltd) -- C:\WINDOWS\System32\TRSOCR.dll
[2009/04/19 11:31:15 | 00,001,308 | ---- | M] () -- C:\WINDOWS\System32\TRSOCR.ini
[2009/04/19 11:31:15 | 00,001,308 | ---- | M] () -- C:\WINDOWS\System32\TRSOCR.dat
[2009/04/19 11:11:42 | 00,058,368 | ---- | M] () -- C:\WINDOWS\System32\ak1.exe
[2009/04/19 11:07:07 | 00,565,248 | ---- | M] () -- C:\WINDOWS\System32\IPHACTION.dll
[2009/04/19 11:00:40 | 00,000,000 | ---- | M] () -- C:\WINDOWS\mqcd.dbt
[2009/04/19 11:00:15 | 00,182,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\ndis.sys
[2009/04/19 11:00:15 | 00,182,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndis.sys
[2009/04/19 10:56:02 | 00,984,064 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\kernel32.dll
[2009/04/19 10:56:02 | 00,061,440 | ---- | M] () -- C:\WINDOWS\System32\tcpd.exe
[2009/04/19 10:56:02 | 00,000,025 | ---- | M] () -- C:\WINDOWS\System32\tcpd.dll
[2009/04/19 10:56:02 | 00,000,009 | ---- | M] () -- C:\WINDOWS\System32\iphy.dll
[2009/04/19 10:56:02 | 00,000,003 | ---- | M] () -- C:\WINDOWS\System32\fhpatch.dll
[2009/04/19 10:55:46 | 00,079,360 | ---- | M] () -- C:\WINDOWS\System32\ashl.nq
[2009/04/19 10:55:43 | 00,577,536 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\user32.DLL
[2009/04/19 10:55:43 | 00,577,536 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\user32.dll
[2009/04/19 10:55:43 | 00,262,144 | ---- | M] () -- C:\WINDOWS\System32\nvrsk.dll
[2009/04/19 10:51:56 | 00,050,176 | -HS- | M] () -- C:\WINDOWS\System32\tajokigu.dll
[2009/04/19 10:51:55 | 00,043,520 | ---- | M] () -- C:\ptrf.exe
[2009/04/19 10:51:45 | 00,000,002 | ---- | M] () -- C:\1821674558
[2009/04/19 10:51:38 | 00,290,304 | ---- | M] () -- C:\wcfgayg.exe
[2009/04/19 10:51:22 | 00,075,776 | -HS- | M] () -- C:\WINDOWS\System32\giwasabu.exe
[2009/04/19 10:50:41 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\IpSvchostF.dll
[2009/04/18 15:21:47 | 00,075,776 | -HS- | M] () -- C:\WINDOWS\System32\vaveseyi.exe
[2009/04/18 15:18:58 | 00,984,064 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\kernel32_check.dll
[2009/04/18 15:18:57 | 00,172,032 | ---- | M] () -- C:\WINDOWS\System32\tcpcon.dll
[2009/04/18 15:18:57 | 00,000,009 | ---- | M] () -- C:\WINDOWS\System32\riphy.dll
[2009/04/18 15:17:36 | 00,108,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MSWINSCK.OCX
[2009/04/18 15:16:47 | 00,043,520 | ---- | M] () -- C:\mxntwq.exe
[2009/04/18 15:16:32 | 00,290,304 | ---- | M] () -- C:\yxly.exe
[2009/04/17 08:24:51 | 00,002,521 | ---- | M] () -- C:\DOCUME~1\wcobb\Desktop\Microsoft Office Outlook 2003.lnk
[2009/04/15 16:19:27 | 00,000,200 | ---- | M] () -- C:\WINDOWS\cfxatb.ini
[2009/04/13 15:33:16 | 00,000,770 | ---- | M] () -- C:\DOCUME~1\wcobb\Desktop\FullCube.lnk
[2009/04/07 08:10:38 | 39,138,393 | ---- | M] () -- C:\DOCUME~1\wcobb\Desktop\FullCube.cub
[2009/04/06 15:32:54 | 00,038,496 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/04/06 15:32:46 | 00,015,504 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/03/25 12:43:23 | 00,045,355 | ---- | M] () -- C:\DOCUME~1\wcobb\My Documents\SKMBT_C35209032611220.pdf
< End of report >
  • 0

Advertisements







Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP