CFScript.txt is done. Here is the log:
ComboFix 09-04-25.A3 - sspeal 04/26/2009 23:52.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2047.1479 [GMT -4:00]
Running from: c:\documents and settings\sspeal\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\sspeal\Desktop\CFScript.txt
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\tmp1C3.tmp
c:\documents and settings\sspeal\Application Data\pusmzbtf
c:\documents and settings\sspeal\Application Data\pusmzbtf\profiles.ini
c:\documents and settings\sspeal\Application Data\pusmzbtf\Profiles\h3egm6ex.default\cert8.db
c:\documents and settings\sspeal\Application Data\pusmzbtf\Profiles\h3egm6ex.default\compatibility.ini
c:\documents and settings\sspeal\Application Data\pusmzbtf\Profiles\h3egm6ex.default\compreg.dat
c:\documents and settings\sspeal\Application Data\pusmzbtf\Profiles\h3egm6ex.default\cookies.sqlite
c:\documents and settings\sspeal\Application Data\pusmzbtf\Profiles\h3egm6ex.default\formhistory.sqlite
c:\documents and settings\sspeal\Application Data\pusmzbtf\Profiles\h3egm6ex.default\key3.db
c:\documents and settings\sspeal\Application Data\pusmzbtf\Profiles\h3egm6ex.default\localstore.rdf
c:\documents and settings\sspeal\Application Data\pusmzbtf\Profiles\h3egm6ex.default\permissions.sqlite
c:\documents and settings\sspeal\Application Data\pusmzbtf\Profiles\h3egm6ex.default\places.sqlite-journal
c:\documents and settings\sspeal\Application Data\pusmzbtf\Profiles\h3egm6ex.default\places.sqlite
c:\documents and settings\sspeal\Application Data\pusmzbtf\Profiles\h3egm6ex.default\pluginreg.dat
c:\documents and settings\sspeal\Application Data\pusmzbtf\Profiles\h3egm6ex.default\prefs.js
c:\documents and settings\sspeal\Application Data\pusmzbtf\Profiles\h3egm6ex.default\secmod.db
c:\documents and settings\sspeal\Application Data\pusmzbtf\Profiles\h3egm6ex.default\webappsstore.sqlite
c:\documents and settings\sspeal\Application Data\pusmzbtf\Profiles\h3egm6ex.default\xpti.dat
c:\documents and settings\sspeal\Local Settings\Application Data\pusmzbtf
c:\documents and settings\sspeal\Local Settings\Application Data\pusmzbtf\Profiles\h3egm6ex.default\urlclassifier3.sqlite
c:\documents and settings\sspeal\Local Settings\Application Data\pusmzbtf\Profiles\h3egm6ex.default\XPC.mfl
c:\windows\system32\179223
c:\windows\system32\219198
c:\windows\t55ft2582f44.dat
c:\windows\t55ft2803f44.dat
c:\windows\t55ft3021f44.dat
c:\windows\t55ft3242f44.dat
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_WEBSRVX
-------\Service_websrvx
((((((((((((((((((((((((( Files Created from 2009-05-27 to 2009-4-27 )))))))))))))))))))))))))))))))
.
2009-04-26 14:30 . 2009-04-27 02:59 -------- d-----w c:\windows\system32\CatRoot_bak
2009-04-26 14:26 . 2009-03-06 14:44 283648 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-26 14:26 . 2005-07-26 04:39 60416 -c----w c:\windows\system32\dllcache\colbact.dll
2009-04-26 14:26 . 2009-02-09 10:20 399360 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-26 14:26 . 2009-02-09 10:20 616960 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-26 14:26 . 2009-02-09 10:20 473088 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-26 14:26 . 2009-02-09 10:20 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-26 14:26 . 2009-02-06 17:14 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-04-26 14:26 . 2009-02-06 16:39 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-26 14:26 . 2009-02-09 10:20 714752 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-26 14:20 . 2008-04-21 10:02 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-26 14:13 . 2008-10-16 18:06 27496 ----a-w c:\windows\system32\mucltui.dll.mui
2009-04-26 14:13 . 2008-10-16 18:06 268648 ----a-w c:\windows\system32\mucltui.dll
2009-04-26 02:54 . 2009-04-26 02:55 -------- d-----w c:\windows\ERUNT
2009-04-26 02:51 . 2009-04-26 02:51 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-26 02:44 . 2009-04-26 03:07 -------- d-----w C:\SDFix
2009-04-25 16:24 . 2009-04-25 16:24 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Identities
2009-04-24 22:57 . 2009-04-24 22:57 -------- d-----w c:\program files\Windows Defender
2009-04-22 17:12 . 2009-04-22 17:12 -------- d-----w c:\program files\Trend Micro
2009-04-22 13:34 . 2009-04-24 19:00 -------- d-----w c:\program files\Norton Security Scan
2009-04-20 20:43 . 2009-03-09 19:06 15688 ----a-w c:\windows\system32\lsdelete.exe
2009-04-20 20:08 . 2009-03-09 19:06 64160 ----a-w c:\windows\system32\drivers\Lbd.sys
2009-04-20 19:25 . 2009-04-20 19:25 -------- dc-h--w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-04-20 19:25 . 2009-04-20 20:08 -------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2009-04-20 19:25 . 2009-04-20 19:25 -------- d-----w c:\program files\Lavasoft
2009-04-20 16:22 . 2009-04-20 16:22 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-04-20 16:22 . 2009-04-22 13:15 -------- d-----w c:\documents and settings\sspeal\Application Data\SUPERAntiSpyware.com
2009-04-20 16:22 . 2009-04-22 13:15 -------- d-----w c:\program files\SUPERAntiSpyware
2009-04-20 14:16 . 2009-04-20 14:16 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-04-15 13:54 . 2009-04-15 13:54 -------- d-----w c:\documents and settings\All Users\Application Data\RiyazStudio
2009-03-30 03:17 . 2009-04-02 10:40 -------- d-----w c:\documents and settings\sspeal\Local Settings\Application Data\WMTools Downloaded Files
2009-03-30 02:59 . 2008-10-16 18:07 23576 ----a-w c:\windows\system32\wuapi.dll.mui
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-27 04:04 . 2007-08-17 21:00 16130 ----a-w c:\windows\system32\tablet.dat
2009-04-27 04:04 . 2009-04-20 20:47 4133 ----a-w C:\aaw7boot.log
2009-04-25 16:23 . 2009-04-25 16:23 -------- d-----w c:\documents and settings\Administrator\Application Data\Windows Desktop Search
2009-04-25 16:23 . 2009-04-25 16:23 782176 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-20 15:21 . 2007-12-10 21:57 -------- d-----w c:\documents and settings\sspeal\Application Data\MSN6
2009-04-20 05:19 . 2001-08-23 12:00 -------- d-----w c:\program files\Common Files\Mozilla Shared
2009-04-20 04:08 . 2007-07-30 21:44 -------- d-----w c:\program files\Yahoo!
2009-04-20 03:57 . 2001-08-23 12:00 213376 -c--a-w c:\windows\system32\drivers\ndis.sys
2009-03-30 04:36 . 2007-11-05 14:06 -------- d-----w c:\program files\Real
2009-03-18 18:14 . 2009-03-18 18:14 -------- d-----w c:\documents and settings\sspeal\Application Data\Yahoo!
2009-03-18 18:13 . 2007-07-30 21:46 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2009-03-18 18:10 . 2007-07-30 21:45 150 ----a-w C:\YServer.txt
2009-03-06 14:44 . 2001-08-23 12:00 283648 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2001-08-23 12:00 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-04 07:56 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-09 10:20 . 2007-07-27 21:53 399360 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:20 . 2001-08-23 12:00 723456 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:20 . 2001-08-23 12:00 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 10:20 . 2001-08-23 12:00 616960 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:19 . 2001-08-23 12:00 1846272 ----a-w c:\windows\system32\win32k.sys
2009-02-06 17:24 . 2001-08-23 12:00 2180480 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 17:14 . 2001-08-23 12:00 110592 ----a-w c:\windows\system32\services.exe
2009-02-06 16:54 . 2001-08-23 12:00 35328 ----a-w c:\windows\system32\sc.exe
2009-02-06 16:49 . 2001-08-17 13:48 2057728 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-03 20:08 . 2001-08-23 12:00 55808 ----a-w c:\windows\system32\secur32.dll
2008-03-27 19:18 . 2007-08-21 21:55 782176 -c--a-w c:\documents and settings\sspeal\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2007-12-05 21:05 . 2007-12-05 21:05 1188376 -c--a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
.
------- Sigcheck -------
[-] 2001-08-23 12:00 161536 3EFD4F59BA0A340DE0A3AB984001DBF7 c:\windows\$NtServicePackUninstall$\ndis.sys
[7] 2004-08-04 06:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\ServicePackFiles\i386\ndis.sys
[-] 2009-04-20 03:57 213376 29CB83D1A129D983B6B5135DA6A72EA5 c:\windows\system32\dllcache\ndis.sys
[-] 2009-04-20 03:57 213376 29CB83D1A129D983B6B5135DA6A72EA5 c:\windows\system32\drivers\ndis.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-04-26_03.19.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-30 20:45 . 2008-09-30 20:45 91656 c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll
+ 2009-04-27 04:06 . 2009-04-27 04:06 16384 c:\windows\Temp\Perflib_Perfdata_1110.dat
+ 2007-01-29 08:58 . 2008-10-22 09:47 62976 c:\windows\system32\tzchange.exe
+ 2007-07-30 13:02 . 2008-07-09 07:38 26488 c:\windows\system32\spupdsvc.exe
+ 2007-07-30 14:27 . 2007-11-30 11:18 17272 c:\windows\system32\spmsg.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 44544 c:\windows\system32\pngfilt.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 44544 c:\windows\system32\pngfilt.dll
- 2001-08-23 12:00 . 2009-04-22 13:31 79206 c:\windows\system32\perfc009.dat
+ 2001-08-23 12:00 . 2009-04-26 20:19 79206 c:\windows\system32\perfc009.dat
+ 2007-07-27 21:53 . 2008-06-12 14:16 91648 c:\windows\system32\mtxoci.dll
+ 2007-07-27 21:53 . 2008-06-12 14:16 66560 c:\windows\system32\mtxclu.dll
- 2007-07-27 21:53 . 2006-03-01 19:42 66560 c:\windows\system32\mtxclu.dll
+ 2006-11-08 02:03 . 2009-02-20 18:09 52224 c:\windows\system32\msfeedsbs.dll
- 2006-11-08 02:03 . 2008-03-01 13:06 52224 c:\windows\system32\msfeedsbs.dll
+ 2007-07-27 19:57 . 2008-06-12 14:16 58880 c:\windows\system32\msdtclog.dll
- 2007-07-27 19:57 . 2004-08-04 07:56 58880 c:\windows\system32\msdtclog.dll
+ 2001-08-23 12:00 . 2008-06-24 16:23 74240 c:\windows\system32\mscms.dll
- 2001-08-23 12:00 . 2005-06-29 01:46 74240 c:\windows\system32\mscms.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 27648 c:\windows\system32\jsproxy.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 27648 c:\windows\system32\jsproxy.dll
- 2006-11-07 08:26 . 2008-02-22 10:00 13824 c:\windows\system32\ieudinit.exe
+ 2006-11-07 08:26 . 2009-02-20 10:20 13824 c:\windows\system32\ieudinit.exe
+ 2001-08-23 12:00 . 2009-02-20 18:09 44544 c:\windows\system32\iernonce.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 44544 c:\windows\system32\iernonce.dll
- 2001-08-23 12:00 . 2008-02-29 08:55 70656 c:\windows\system32\ie4uinit.exe
+ 2001-08-23 12:00 . 2009-02-20 10:20 70656 c:\windows\system32\ie4uinit.exe
- 2006-10-17 16:58 . 2008-03-01 13:06 63488 c:\windows\system32\icardie.dll
+ 2006-10-17 16:58 . 2009-02-20 18:09 63488 c:\windows\system32\icardie.dll
+ 2009-02-03 20:08 . 2009-02-03 20:08 55808 c:\windows\system32\dllcache\secur32.dll
+ 2001-08-23 12:00 . 2009-02-06 16:54 35328 c:\windows\system32\dllcache\sc.exe
- 2006-10-17 16:58 . 2008-03-01 13:06 44544 c:\windows\system32\dllcache\pngfilt.dll
+ 2006-10-17 16:58 . 2009-02-20 18:09 44544 c:\windows\system32\dllcache\pngfilt.dll
+ 2007-07-27 21:53 . 2008-06-12 14:16 91648 c:\windows\system32\dllcache\mtxoci.dll
+ 2008-06-12 14:16 . 2008-06-12 14:16 66560 c:\windows\system32\dllcache\mtxclu.dll
+ 2007-04-25 08:41 . 2009-02-20 18:09 52224 c:\windows\system32\dllcache\msfeedsbs.dll
- 2007-04-25 08:41 . 2008-03-01 13:06 52224 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2007-07-27 19:57 . 2008-06-12 14:16 58880 c:\windows\system32\dllcache\msdtclog.dll
- 2007-07-27 19:57 . 2004-08-04 07:56 58880 c:\windows\system32\dllcache\msdtclog.dll
+ 2008-06-24 16:23 . 2008-06-24 16:23 74240 c:\windows\system32\dllcache\mscms.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 27648 c:\windows\system32\dllcache\jsproxy.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 27648 c:\windows\system32\dllcache\jsproxy.dll
- 2007-04-24 14:26 . 2008-02-22 10:00 13824 c:\windows\system32\dllcache\ieudinit.exe
+ 2007-04-24 14:26 . 2009-02-20 10:20 13824 c:\windows\system32\dllcache\ieudinit.exe
+ 2001-08-23 12:00 . 2009-02-20 18:09 44544 c:\windows\system32\dllcache\iernonce.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 44544 c:\windows\system32\dllcache\iernonce.dll
- 2004-08-04 07:56 . 2006-10-17 17:06 78336 c:\windows\system32\dllcache\ieencode.dll
+ 2004-08-04 07:56 . 2009-02-20 18:09 78336 c:\windows\system32\dllcache\ieencode.dll
- 2006-11-07 08:26 . 2008-02-29 08:55 70656 c:\windows\system32\dllcache\ie4uinit.exe
+ 2006-11-07 08:26 . 2009-02-20 10:20 70656 c:\windows\system32\dllcache\ie4uinit.exe
- 2007-10-10 10:29 . 2008-03-01 13:06 63488 c:\windows\system32\dllcache\icardie.dll
+ 2007-10-10 10:29 . 2009-02-20 18:09 63488 c:\windows\system32\dllcache\icardie.dll
+ 2007-07-30 15:35 . 2009-04-26 20:08 27136 c:\windows\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2007-07-30 15:35 . 2008-04-10 21:02 27136 c:\windows\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2007-07-30 15:35 . 2009-04-26 20:08 11264 c:\windows\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2007-07-30 15:35 . 2008-04-10 21:02 11264 c:\windows\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2007-07-30 15:35 . 2008-04-10 21:02 12288 c:\windows\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2007-07-30 15:35 . 2009-04-26 20:08 12288 c:\windows\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2009-04-26 20:01 . 2009-04-26 20:01 32768 c:\windows\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}\icon.exe
+ 2009-04-26 20:05 . 2008-03-01 13:06 44544 c:\windows\ie7updates\KB963027-IE7\pngfilt.dll
+ 2009-04-26 20:05 . 2008-03-01 13:06 52224 c:\windows\ie7updates\KB963027-IE7\msfeedsbs.dll
+ 2009-04-26 20:05 . 2008-03-01 13:06 27648 c:\windows\ie7updates\KB963027-IE7\jsproxy.dll
+ 2009-04-26 20:05 . 2008-02-22 10:00 13824 c:\windows\ie7updates\KB963027-IE7\ieudinit.exe
+ 2009-04-26 20:05 . 2008-03-01 13:06 44544 c:\windows\ie7updates\KB963027-IE7\iernonce.dll
+ 2009-04-26 20:05 . 2006-10-17 17:06 78336 c:\windows\ie7updates\KB963027-IE7\ieencode.dll
+ 2009-04-26 20:05 . 2008-02-29 08:55 70656 c:\windows\ie7updates\KB963027-IE7\ie4uinit.exe
+ 2009-04-26 20:05 . 2008-03-01 13:06 63488 c:\windows\ie7updates\KB963027-IE7\icardie.dll
+ 2007-07-30 15:35 . 2009-04-26 20:08 4096 c:\windows\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2007-07-30 15:35 . 2008-04-10 21:02 4096 c:\windows\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2007-07-30 13:39 . 2008-02-15 09:06 351744 c:\windows\system32\xpsp3res.dll
+ 2006-10-19 02:47 . 2008-06-24 22:12 295936 c:\windows\system32\wmpeffects.dll
- 2006-10-19 02:47 . 2006-10-19 02:47 295936 c:\windows\system32\wmpeffects.dll
+ 2001-08-23 12:00 . 2008-06-18 09:03 938496 c:\windows\system32\WMNetmgr.dll
+ 2007-07-27 21:43 . 2008-12-16 12:47 351232 c:\windows\system32\winhttp.dll
- 2007-07-27 21:43 . 2004-08-04 07:56 351232 c:\windows\system32\winhttp.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 233472 c:\windows\system32\webcheck.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 233472 c:\windows\system32\webcheck.dll
+ 2007-07-27 19:57 . 2009-02-06 16:39 227840 c:\windows\system32\wbem\wmiprvse.exe
+ 2007-07-27 19:57 . 2009-02-09 10:20 453120 c:\windows\system32\wbem\wmiprvsd.dll
+ 2007-07-27 19:57 . 2009-02-09 10:20 473088 c:\windows\system32\wbem\fastprox.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 105984 c:\windows\system32\url.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 105984 c:\windows\system32\url.dll
+ 2001-08-23 12:00 . 2008-10-03 10:15 247326 c:\windows\system32\strmdll.dll
- 2001-08-23 12:00 . 2007-04-25 14:21 144896 c:\windows\system32\schannel.dll
+ 2001-08-23 12:00 . 2008-12-05 07:12 144896 c:\windows\system32\schannel.dll
+ 2001-08-23 12:00 . 2009-04-26 20:19 465572 c:\windows\system32\perfh009.dat
- 2001-08-23 12:00 . 2009-04-22 13:31 465572 c:\windows\system32\perfh009.dat
- 2001-08-23 12:00 . 2008-03-01 13:06 102912 c:\windows\system32\occache.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 102912 c:\windows\system32\occache.dll
+ 2007-07-27 21:54 . 2008-10-15 16:57 332800 c:\windows\system32\netapi32.dll
+ 2001-08-23 12:00 . 2008-06-20 17:41 245248 c:\windows\system32\mswsock.dll
- 2001-08-23 12:00 . 2004-08-04 07:56 245248 c:\windows\system32\mswsock.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 671232 c:\windows\system32\mstime.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 671232 c:\windows\system32\mstime.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 193024 c:\windows\system32\msrating.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 193024 c:\windows\system32\msrating.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 477696 c:\windows\system32\mshtmled.dll
+ 2006-11-08 02:03 . 2009-02-20 18:09 459264 c:\windows\system32\msfeeds.dll
- 2006-11-08 02:03 . 2008-03-01 13:06 459264 c:\windows\system32\msfeeds.dll
+ 2007-07-27 21:53 . 2008-06-12 14:16 161792 c:\windows\system32\msdtcuiu.dll
+ 2007-07-27 21:53 . 2008-06-12 14:16 956928 c:\windows\system32\msdtctm.dll
+ 2007-07-27 21:53 . 2008-06-12 14:16 428032 c:\windows\system32\msdtcprx.dll
- 2001-08-23 12:00 . 2006-10-19 01:03 100864 c:\windows\system32\logagent.exe
+ 2001-08-23 12:00 . 2008-06-18 05:09 100864 c:\windows\system32\logagent.exe
+ 2001-08-23 12:00 . 2009-03-21 14:18 986112 c:\windows\system32\kernel32.dll
+ 2007-07-27 19:59 . 2008-04-11 18:50 683520 c:\windows\system32\inetcomm.dll
- 2007-07-27 19:59 . 2007-08-21 06:15 683520 c:\windows\system32\inetcomm.dll
+ 2006-10-17 16:57 . 2009-02-20 18:09 268288 c:\windows\system32\iertutil.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 385024 c:\windows\system32\iedkcs32.dll
+ 2006-10-17 16:27 . 2009-02-20 18:09 383488 c:\windows\system32\ieapfltr.dll
- 2006-10-17 16:27 . 2008-03-01 13:06 383488 c:\windows\system32\ieapfltr.dll
- 2001-08-23 12:00 . 2008-02-15 05:44 161792 c:\windows\system32\ieakui.dll
+ 2001-08-23 12:00 . 2009-02-20 05:14 161792 c:\windows\system32\ieakui.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 230400 c:\windows\system32\ieaksie.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 230400 c:\windows\system32\ieaksie.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 153088 c:\windows\system32\ieakeng.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 153088 c:\windows\system32\ieakeng.dll
+ 2001-08-23 12:00 . 2008-10-23 13:01 283648 c:\windows\system32\gdi32.dll
+ 2004-08-04 07:56 . 2009-02-20 18:09 133120 c:\windows\system32\extmgr.dll
- 2004-08-04 07:56 . 2008-03-01 13:06 133120 c:\windows\system32\extmgr.dll
+ 2007-07-27 21:53 . 2008-07-07 20:32 253952 c:\windows\system32\es.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 214528 c:\windows\system32\dxtrans.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 214528 c:\windows\system32\dxtrans.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 347136 c:\windows\system32\dxtmsft.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 347136 c:\windows\system32\dxtmsft.dll
+ 2001-08-23 12:00 . 2008-06-20 09:52 225920 c:\windows\system32\drivers\tcpip6.sys
+ 2001-08-23 12:00 . 2008-06-20 10:45 360320 c:\windows\system32\drivers\tcpip.sys
+ 2001-08-23 12:00 . 2008-12-11 11:57 333184 c:\windows\system32\drivers\srv.sys
+ 2001-08-23 12:00 . 2008-05-08 12:28 202752 c:\windows\system32\drivers\rmcast.sys
+ 2001-08-23 12:00 . 2008-10-24 11:10 453632 c:\windows\system32\drivers\mrxsmb.sys
+ 2004-08-04 06:10 . 2008-06-13 13:10 272128 c:\windows\system32\drivers\bthport.sys
+ 2001-08-23 12:00 . 2008-08-14 09:51 138368 c:\windows\system32\drivers\afd.sys
+ 2001-08-23 12:00 . 2008-06-20 17:41 148992 c:\windows\system32\dnsapi.dll
- 2001-08-23 12:00 . 2008-02-20 05:32 148992 c:\windows\system32\dnsapi.dll
+ 2001-08-23 12:00 . 2008-06-18 09:03 938496 c:\windows\system32\dllcache\WMNetmgr.dll
- 2006-11-08 02:03 . 2008-03-01 13:06 826368 c:\windows\system32\dllcache\wininet.dll
+ 2006-11-08 02:03 . 2009-03-03 00:18 826368 c:\windows\system32\dllcache\wininet.dll
+ 2008-12-16 12:47 . 2008-12-16 12:47 351232 c:\windows\system32\dllcache\winhttp.dll
+ 2006-11-08 02:03 . 2009-02-20 18:09 233472 c:\windows\system32\dllcache\webcheck.dll
- 2006-11-08 02:03 . 2008-03-01 13:06 233472 c:\windows\system32\dllcache\webcheck.dll
- 2006-10-17 17:05 . 2008-03-01 13:06 105984 c:\windows\system32\dllcache\url.dll
+ 2006-10-17 17:05 . 2009-02-20 18:09 105984 c:\windows\system32\dllcache\url.dll
+ 2001-08-23 12:00 . 2008-06-20 09:52 225920 c:\windows\system32\dllcache\tcpip6.sys
+ 2006-04-20 11:51 . 2008-06-20 10:45 360320 c:\windows\system32\dllcache\tcpip.sys
+ 2001-08-23 12:00 . 2008-10-03 10:15 247326 c:\windows\system32\dllcache\strmdll.dll
+ 2006-08-14 10:34 . 2008-12-11 11:57 333184 c:\windows\system32\dllcache\srv.sys
- 2007-04-25 14:21 . 2007-04-25 14:21 144896 c:\windows\system32\dllcache\schannel.dll
+ 2007-04-25 14:21 . 2008-12-05 07:12 144896 c:\windows\system32\dllcache\schannel.dll
+ 2001-08-23 12:00 . 2008-05-08 12:28 202752 c:\windows\system32\dllcache\rmcast.sys
+ 2006-10-17 17:04 . 2009-02-20 18:09 102912 c:\windows\system32\dllcache\occache.dll
- 2006-10-17 17:04 . 2008-03-01 13:06 102912 c:\windows\system32\dllcache\occache.dll
+ 2006-08-17 12:28 . 2008-10-15 16:57 332800 c:\windows\system32\dllcache\netapi32.dll
+ 2008-06-20 17:41 . 2008-06-20 17:41 245248 c:\windows\system32\dllcache\mswsock.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 671232 c:\windows\system32\dllcache\mstime.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 671232 c:\windows\system32\dllcache\mstime.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 193024 c:\windows\system32\dllcache\msrating.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 193024 c:\windows\system32\dllcache\msrating.dll
+ 2006-11-08 02:03 . 2009-02-20 18:09 477696 c:\windows\system32\dllcache\mshtmled.dll
- 2007-04-25 08:41 . 2008-03-01 13:06 459264 c:\windows\system32\dllcache\msfeeds.dll
+ 2007-04-25 08:41 . 2009-02-20 18:09 459264 c:\windows\system32\dllcache\msfeeds.dll
+ 2007-07-27 21:53 . 2008-06-12 14:16 161792 c:\windows\system32\dllcache\msdtcuiu.dll
+ 2007-07-27 21:53 . 2008-06-12 14:16 956928 c:\windows\system32\dllcache\msdtctm.dll
+ 2007-07-27 21:53 . 2008-06-12 14:16 428032 c:\windows\system32\dllcache\msdtcprx.dll
+ 2007-07-27 19:59 . 2008-05-01 14:30 331776 c:\windows\system32\dllcache\msadce.dll
- 2007-07-27 19:59 . 2004-08-04 07:56 331776 c:\windows\system32\dllcache\msadce.dll
+ 2006-05-05 09:41 . 2008-10-24 11:10 453632 c:\windows\system32\dllcache\mrxsmb.sys
+ 2006-08-17 12:28 . 2009-02-09 10:20 723456 c:\windows\system32\dllcache\lsasrv.dll
+ 2001-08-23 12:00 . 2008-06-18 05:09 100864 c:\windows\system32\dllcache\logagent.exe
- 2001-08-23 12:00 . 2006-10-19 01:03 100864 c:\windows\system32\dllcache\logagent.exe
+ 2007-04-16 15:52 . 2009-03-21 14:18 986112 c:\windows\system32\dllcache\kernel32.dll
+ 2007-05-16 15:12 . 2008-04-11 18:50 683520 c:\windows\system32\dllcache\inetcomm.dll
- 2007-05-16 15:12 . 2007-08-21 06:15 683520 c:\windows\system32\dllcache\inetcomm.dll
+ 2006-10-17 17:04 . 2009-02-28 04:54 636072 c:\windows\system32\dllcache\iexplore.exe
+ 2007-04-25 08:41 . 2009-02-20 18:09 268288 c:\windows\system32\dllcache\iertutil.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 385024 c:\windows\system32\dllcache\iedkcs32.dll
- 2007-04-25 08:41 . 2008-03-01 13:06 383488 c:\windows\system32\dllcache\ieapfltr.dll
+ 2007-04-25 08:41 . 2009-02-20 18:09 383488 c:\windows\system32\dllcache\ieapfltr.dll
- 2001-08-23 12:00 . 2008-02-15 05:44 161792 c:\windows\system32\dllcache\ieakui.dll
+ 2001-08-23 12:00 . 2009-02-20 05:14 161792 c:\windows\system32\dllcache\ieakui.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 230400 c:\windows\system32\dllcache\ieaksie.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 230400 c:\windows\system32\dllcache\ieaksie.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 153088 c:\windows\system32\dllcache\ieakeng.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 153088 c:\windows\system32\dllcache\ieakeng.dll
+ 2007-03-08 15:36 . 2008-10-23 13:01 283648 c:\windows\system32\dllcache\gdi32.dll
- 2004-08-04 07:56 . 2008-03-01 13:06 133120 c:\windows\system32\dllcache\extmgr.dll
+ 2004-08-04 07:56 . 2009-02-20 18:09 133120 c:\windows\system32\dllcache\extmgr.dll
+ 2008-07-07 20:32 . 2008-07-07 20:32 253952 c:\windows\system32\dllcache\es.dll
+ 2006-10-17 16:57 . 2009-02-20 18:09 214528 c:\windows\system32\dllcache\dxtrans.dll
- 2006-10-17 16:57 . 2008-03-01 13:06 214528 c:\windows\system32\dllcache\dxtrans.dll
+ 2006-10-17 16:58 . 2009-02-20 18:09 347136 c:\windows\system32\dllcache\dxtmsft.dll
- 2006-10-17 16:58 . 2008-03-01 13:06 347136 c:\windows\system32\dllcache\dxtmsft.dll
+ 2006-05-19 12:59 . 2008-06-20 17:41 148992 c:\windows\system32\dllcache\dnsapi.dll
- 2006-05-19 12:59 . 2008-02-20 05:32 148992 c:\windows\system32\dllcache\dnsapi.dll
+ 2004-08-04 06:10 . 2008-06-13 13:10 272128 c:\windows\system32\dllcache\bthport.sys
+ 2008-06-20 10:44 . 2008-08-14 09:51 138368 c:\windows\system32\dllcache\afd.sys
+ 2006-11-07 08:26 . 2009-02-20 18:09 124928 c:\windows\system32\dllcache\advpack.dll
- 2006-11-07 08:26 . 2008-03-01 13:06 124928 c:\windows\system32\dllcache\advpack.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 124928 c:\windows\system32\advpack.dll
- 2001-08-23 12:00 . 2008-03-01 13:06 124928 c:\windows\system32\advpack.dll
- 2007-07-30 15:35 . 2008-04-10 21:02 794624 c:\windows\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2007-07-30 15:35 . 2009-04-26 20:08 794624 c:\windows\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2007-07-30 15:35 . 2008-04-10 21:02 135168 c:\windows\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2007-07-30 15:35 . 2009-04-26 20:08 135168 c:\windows\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2009-04-26 20:05 . 2008-03-01 13:06 826368 c:\windows\ie7updates\KB963027-IE7\wininet.dll
+ 2009-04-26 20:05 . 2008-03-01 13:06 233472 c:\windows\ie7updates\KB963027-IE7\webcheck.dll
+ 2009-04-26 20:05 . 2008-03-01 13:06 105984 c:\windows\ie7updates\KB963027-IE7\url.dll
+ 2009-04-26 20:06 . 2008-07-09 07:38 382840 c:\windows\ie7updates\KB963027-IE7\spuninst\updspapi.dll
+ 2009-04-26 20:06 . 2008-07-08 13:02 231288 c:\windows\ie7updates\KB963027-IE7\spuninst\spuninst.exe
+ 2009-04-26 20:05 . 2008-03-01 13:06 102912 c:\windows\ie7updates\KB963027-IE7\occache.dll
+ 2009-04-26 20:05 . 2008-03-01 13:06 671232 c:\windows\ie7updates\KB963027-IE7\mstime.dll
+ 2009-04-26 20:05 . 2008-03-01 13:06 193024 c:\windows\ie7updates\KB963027-IE7\msrating.dll
+ 2009-04-26 20:05 . 2008-03-01 13:06 478208 c:\windows\ie7updates\KB963027-IE7\mshtmled.dll
+ 2009-04-26 20:05 . 2008-03-01 13:06 459264 c:\windows\ie7updates\KB963027-IE7\msfeeds.dll
+ 2009-04-26 20:05 . 2008-02-29 08:55 625664 c:\windows\ie7updates\KB963027-IE7\iexplore.exe
+ 2009-04-26 20:05 . 2008-03-01 13:06 267776 c:\windows\ie7updates\KB963027-IE7\iertutil.dll
+ 2009-04-26 20:05 . 2008-03-01 13:06 384512 c:\windows\ie7updates\KB963027-IE7\iedkcs32.dll
+ 2009-04-26 20:05 . 2008-03-01 13:06 383488 c:\windows\ie7updates\KB963027-IE7\ieapfltr.dll
+ 2009-04-26 20:05 . 2008-02-15 05:44 161792 c:\windows\ie7updates\KB963027-IE7\ieakui.dll
+ 2009-04-26 20:05 . 2008-03-01 13:06 230400 c:\windows\ie7updates\KB963027-IE7\ieaksie.dll
+ 2009-04-26 20:05 . 2008-03-01 13:06 153088 c:\windows\ie7updates\KB963027-IE7\ieakeng.dll
+ 2009-04-26 20:05 . 2008-03-01 13:06 133120 c:\windows\ie7updates\KB963027-IE7\extmgr.dll
+ 2009-04-26 20:05 . 2008-03-01 13:06 214528 c:\windows\ie7updates\KB963027-IE7\dxtrans.dll
+ 2009-04-26 20:05 . 2008-03-01 13:06 347136 c:\windows\ie7updates\KB963027-IE7\dxtmsft.dll
+ 2009-04-26 20:05 . 2008-03-01 13:06 124928 c:\windows\ie7updates\KB963027-IE7\advpack.dll
+ 2004-10-28 01:14 . 2008-10-24 11:10 453632 c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2009-04-26 14:27 . 2008-06-13 13:10 272128 c:\windows\Driver Cache\i386\bthport.sys
+ 2009-04-26 14:24 . 2008-04-15 17:54 1724416 c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll
+ 2008-09-30 20:42 . 2008-09-30 20:42 1286152 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll
+ 2001-08-23 12:00 . 2008-06-18 09:03 2458112 c:\windows\system32\WMVCore.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 1160192 c:\windows\system32\urlmon.dll
+ 2001-08-23 12:00 . 2008-07-03 13:03 8460800 c:\windows\system32\shell32.dll
- 2001-08-23 12:00 . 2007-10-29 22:43 1287680 c:\windows\system32\quartz.dll
+ 2001-08-23 12:00 . 2008-12-20 22:43 1287680 c:\windows\system32\quartz.dll
+ 2008-08-30 00:06 . 2008-08-30 00:06 1350664 c:\windows\system32\msxml6.dll
+ 2008-09-30 20:43 . 2008-09-30 20:43 1286152 c:\windows\system32\msxml4.dll
+ 2001-08-23 12:00 . 2008-09-04 16:42 1106944 c:\windows\system32\msxml3.dll
+ 2001-08-23 12:00 . 2009-02-20 18:09 3595264 c:\windows\system32\mshtml.dll
+ 2006-11-08 02:03 . 2009-02-20 18:09 6066176 c:\windows\system32\ieframe.dll
- 2006-11-08 02:03 . 2008-03-01 13:06 6066176 c:\windows\system32\ieframe.dll
+ 2006-09-06 04:01 . 2008-07-09 14:25 2455488 c:\windows\system32\ieapfltr.dat
- 2006-09-06 04:01 . 2007-04-17 09:28 2455488 c:\windows\system32\ieapfltr.dat
- 2007-07-27 13:38 . 2008-04-10 18:37 3160152 c:\windows\system32\FNTCACHE.DAT
+ 2007-07-27 13:38 . 2009-04-26 20:14 3160152 c:\windows\system32\FNTCACHE.DAT
+ 2001-08-23 12:00 . 2008-06-18 09:03 2458112 c:\windows\system32\dllcache\WMVCore.dll
+ 2007-03-08 13:47 . 2009-02-09 10:19 1846272 c:\windows\system32\dllcache\win32k.sys
+ 2006-11-08 02:03 . 2009-02-20 18:09 1160192 c:\windows\system32\dllcache\urlmon.dll
+ 2006-12-19 21:52 . 2008-07-03 13:03 8460800 c:\windows\system32\dllcache\shell32.dll
+ 2007-12-12 23:53 . 2008-12-20 22:43 1287680 c:\windows\system32\dllcache\quartz.dll
- 2007-12-12 23:53 . 2007-10-29 22:43 1287680 c:\windows\system32\dllcache\quartz.dll
+ 2007-02-28 09:10 . 2009-02-06 17:24 2180480 c:\windows\system32\dllcache\ntoskrnl.exe
- 2007-02-28 08:38 . 2007-02-28 08:38 2015744 c:\windows\system32\dllcache\ntkrpamp.exe
+ 2007-02-28 08:38 . 2009-02-06 16:49 2015744 c:\windows\system32\dllcache\ntkrpamp.exe
+ 2007-02-28 08:38 . 2009-02-06 16:49 2057728 c:\windows\system32\dllcache\ntkrnlpa.exe
- 2007-02-28 09:08 . 2007-02-28 09:08 2136064 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2007-02-28 09:08 . 2009-02-06 17:22 2136064 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2006-09-13 05:01 . 2008-09-04 16:42 1106944 c:\windows\system32\dllcache\msxml3.dll
+ 2006-11-08 02:03 . 2009-02-20 18:09 3595264 c:\windows\system32\dllcache\mshtml.dll
+ 2007-04-25 08:41 . 2009-02-20 18:09 6066176 c:\windows\system32\dllcache\ieframe.dll
- 2007-04-25 08:41 . 2008-03-01 13:06 6066176 c:\windows\system32\dllcache\ieframe.dll
+ 2007-04-17 09:28 . 2008-07-09 14:25 2455488 c:\windows\system32\dllcache\ieapfltr.dat
- 2007-04-17 09:28 . 2007-04-17 09:28 2455488 c:\windows\system32\dllcache\ieapfltr.dat
+ 2009-04-26 20:05 . 2008-03-01 13:06 1159680 c:\windows\ie7updates\KB963027-IE7\urlmon.dll
+ 2009-04-26 20:05 . 2008-03-01 23:36 3591680 c:\windows\ie7updates\KB963027-IE7\mshtml.dll
+ 2009-04-26 20:05 . 2008-03-01 13:06 6066176 c:\windows\ie7updates\KB963027-IE7\ieframe.dll
+ 2009-04-26 20:05 . 2007-04-17 09:28 2455488 c:\windows\ie7updates\KB963027-IE7\ieapfltr.dat
+ 2005-03-02 00:59 . 2009-02-06 17:24 2180480 c:\windows\Driver Cache\i386\ntoskrnl.exe
- 2005-03-02 00:34 . 2007-02-28 08:38 2015744 c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2005-03-02 00:34 . 2009-02-06 16:49 2015744 c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2005-03-02 00:34 . 2009-02-06 16:49 2057728 c:\windows\Driver Cache\i386\ntkrnlpa.exe
- 2005-03-02 00:57 . 2007-02-28 09:08 2136064 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2005-03-02 00:57 . 2009-02-06 17:22 2136064 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2004-08-04 07:56 . 2008-11-11 22:34 10838016 c:\windows\system32\wmp.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-02-20 4363504]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Client Access Service"="c:\program files\IBM\Client Access\cwbsvstr.exe" [2002-05-07 20530]
"Client Access Help Update"="c:\program files\IBM\Client Access\cwbinhlp.exe" [2002-05-07 24626]
"Client Access Check Version"="c:\program files\IBM\Client Access\cwbckver.exe" [2002-05-07 45056]
"Client Access Express Welcome"="c:\program files\IBM\Client Access\cwbwlwiz.exe" [2002-05-07 20530]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-11 39792]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2004-08-04 143360]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2004-03-13 57393]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2004-03-13 40960]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-10-20 286720]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2005-01-27 1381376]
"EPSON Stylus CX4200 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.EXE" [2005-03-08 98304]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-11-20 185872]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]
"ATIModeChange"="Ati2mdxx.exe" - c:\windows\system32\Ati2mdxx.exe [2002-03-26 28672]
c:\documents and settings\sspeal\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-7-30 110592]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-23 217194]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-7-30 110592]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2007-8-17 114688]
Windows Desktop Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2007-2-5 118784]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousUserGroupPolicy"= 1 (0x1)
"SynchronousMachineGroupPolicy"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisablePersonalDirChange"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=iamqvj.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1202660629-839522115-1106\Scripts\Logon\
0\
0]
"Script"=\\PADEAUCTION.INT\sysvol\PADEAUCTION.INT\scripts\map.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1292428093-1202660629-839522115-1269\Scripts\Logon\
0\
0]
"Script"=\\PADEAUCTION.INT\sysvol\PADEAUCTION.INT\scripts\map.bat
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
R3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-12-01 33752]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-03-09 64160]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
.
Contents of the 'Scheduled Tasks' folder
2009-04-20 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 19:06]
2009-04-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 19:57]
2009-04-27 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]
2009-04-24 c:\windows\Tasks\Norton Security Scan for sspeal.job
- c:\program files\Norton Security Scan\Nss.exe [2009-03-13 09:53]
2009-04-26 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-04-08 17:16]
2009-04-27 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-04-08 17:16]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.mail.yahoo.com
uInternet Settings,ProxyServer = http=localhost:7171
uInternet Settings,ProxyOverride = *.local;<local>
FF - ProfilePath - c:\documents and settings\sspeal\Application Data\Mozilla\Firefox\Profiles\tvo3k73m.default\
FF - prefs.js: browser.startup.homepage - www.mail.yahoo.com
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-04-27 00:05
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\æHõwæ*]
"DisplayName"="\
09"
"DeviceDesc"="\
09"
"ProviderName"=""
"MFG"="?"
"ReinstallString"="2002, 6.13.10.6052"
"DeviceInstanceIds"=multi:"\
00"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(4636)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Ahead\InCD\InCDsrv.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\Tablet.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Completion time: 2009-04-27 0:11 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-27 04:10
ComboFix2.txt 2009-04-26 03:25
Pre-Run: 63,136,886,784 bytes free
Post-Run: 63,106,359,296 bytes free
512 --- E O F --- 2009-04-26 20:08