Red X on C Drive + Processes repeat

Computing.Net > Forums > Security and Virus > Red X on C Drive + Processes repeat

Red X on C Drive + Processes repeat

Original Message

Name: TehCrazy
Date: January 27, 2008 at 13:39:20 Pacific
Subject: Red X on C Drive + Processes repeat
OS: Windows XP Home
CPU/Ram: 1GB
Model/Manufacturer: ASUS

Comment:

I had a virus previous to this which i still haven't fixed where one of my processes keeps running over and over.. still does it on my other user but not this one.. but also focusing on the Red X on my C Drive and the temp files i had i removed most of them following a previous post but i still have a red X , im kinda knew the the hijack this so if u need a log please instruct me on how to do that. Ty for your time ^^ btw i'm not sure if this is one virus or multiple..

Report Offensive Message For Removal

Response Number 1

Name: TehCrazy
Date: January 27, 2008 at 13:42:35 Pacific

Reply: (edit)

Trying the VundoFix but please share any additional thoughts

Report Offensive Follow Up For Removal

Response Number 2

Name: TehCrazy
Date: January 27, 2008 at 14:35:27 Pacific

Reply: (edit)

Ok so i did the vundofix found the nerocheck was infected, seems i still have a red X on my C: but i dont see any .tmp files erm, i didn't mention but i also had 2 icons on my desktop from storageprotector which i can now finally remove which i couldn't before (duplication), im on my usual user now and no mulitplying of one app. so far.. how do i know this won't happen again? shall i post a hijack this and how? and where is my system restore folder/how do i empty it. ty ^^

Report Offensive Follow Up For Removal

Response Number 3

Name: jabuck
Date: January 27, 2008 at 14:59:24 Pacific

Reply: (edit)

Please download and install the latest version of HijackThis v2.0.2:

Download the "HijackThis" Installer from this link:
Hijack This

1. Save " HJTInstall.exe" to your desktop.
2. Double click on HJTInstall.exe to run the program.
3. By default it will install to C:\Program Files\Trend Micro\HijackThis.
4. Accept the license agreement by clicking the "I Accept" button.
5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
6. Click "Save log" to save the log file and then the log will open in Notepad.
7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
8. Paste the log in your next reply.
9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

Report Offensive Follow Up For Removal

Response Number 4

Name: TehCrazy
Date: January 27, 2008 at 15:09:23 Pacific

Reply: (edit)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:07:10 PM, on 1/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Program Files\M-Audio\M-Audio Micro\MAUSBMRInst.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox 3 Beta 2\firefox.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Program Files\Xfire\xfire.exe
C:\Documents and Settings\Kenneth\Desktop\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://g.msn.com/0SEENUS/SAOS01?FOR...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://g.msn.com/0SEENUS/SAOS01?FOR...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://us.rd.yahoo.com/customize/ie...
/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://g.msn.com/0SEENUS/SAOS01?FOR...
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyServer = 72.52.163.100:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88}
- C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} -
C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
F3 - REG:win.ini: load=C:\WINDOWS\system32\awvvw.exe
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} -
C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}
- C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common
Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} -
C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: PopKill Class - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} -
C:\Program Files\Verizon\Verizon Internet Security Suite\pkR.dll
O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} -
C:\Program Files\iMesh Applications\iMesh MediaBar\iMeshIEHelper.dll (file
missing)
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} -
C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O2 - BHO: Yahoo! IE Services Button -
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program
Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} -
C:\Program Files\Dealio\kb124\Dealio.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -
C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: BndShell3 BHO Class - {8ABA9A9C-8791-4d61-8D5B-BCC9448EA573} -
C:\Program Files\ISM\BndDrive7.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper -
{9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common
Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} -
c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO -
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program
Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper -
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live
Toolbar\msntb.dll
O2 - BHO: Piolet Toolbar Helper - {EDDF3383-EC5F-49DF-A8B6-CEC2D8F6164C} -
C:\Program Files\Piolet Toolbar\v3.2.0.0\Piolet_Toolbar.dll
O2 - BHO: (no name) - {EF986924-D69B-8812-E820-FF8A30F02EE1} -
C:\WINDOWS\system32\ohsdvi.dll (file missing)
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} -
C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA}
- C:\Program Files\FlashGet\getflash.dll
O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} -
C:\PROGRA~1\STARDO~1\SDIEInt.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no
file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program
files\google\googletoolbar4.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} -
C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O3 - Toolbar: Piolet Toolbar - {C75C8E7E-5059-4469-AC11-D7544B260382} -
C:\Program Files\Piolet Toolbar\v3.2.0.0\Piolet_Toolbar.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program
Files\Dealio\kb124\Dealio.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
- C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} -
C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE"
C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG
Anti-Spyware 7.5\avgas .exe" /minimized
O4 - HKLM\..\Run: [Flashget] "C:\Program Files\FlashGet\FlashGet .exe" /min
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy
Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Eijdrkcz] "C:\Documents and Settings\Kenneth\Application
Data\?dobe\explorer.exe"
O4 - HKCU\..\Run: [ISMModule7] "C:\Program Files\ISM\ISMModule7.exe"
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\IGN\Download
Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [Shsi] "C:\DOCUME~1\Kenneth\MYDOCU~1\WNSXS~1\msdtc.exe"
-vt ndrv
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe"
/background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office\OSA9.EXE
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program
Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Download All with FlashGet - C:\Program
Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program
Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program
Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites -
http://favorites.live.com/quickadd....
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents
and Settings\Kenneth\Application Data\Dealio\kb124\res\DealioSearch.html
O8 - Extra context menu item: Open in new background tab - res://C:\Program
Files\Windows Live
Toolbar\Components\en-us\msntabres.dll.mui/229?b390dcb8d80448aba0c6b6495b65
cfe2
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program
Files\Windows Live
Toolbar\Components\en-us\msntabres.dll.mui/230?b390dcb8d80448aba0c6b6495b65
cfe2
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}
- C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no
file)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} -
C:\Documents and Settings\Kenneth\Start Menu\Programs\IMVU\Run IMVU.lnk
(file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} -
C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -
{e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network
Diagnostic\xpnetdiag.exe
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} -
C:\Program Files\Dealio\kb124\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio -
{E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program
Files\Dealio\kb124\Dealio.dll
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data
Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient
Class) -
http://messenger.zone.msn.com/binar...
O16 - DPF: {2931566C-B8A6-46C5-BF4D-E6AB9251E953} (Nexon Package Manager
Control) - http://s.nx.com/activex/public_new/...
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) -
C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown
Class) -
http://messenger.zone.msn.com/binar...
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) -
http://messenger.zone.msn.com/EN-US...
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety
Center Base Module) -
http://cdn.scan.onecare.live.com/re...
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) -
http://gamedownload.ijjimax.com/gam...
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) -
http://www.acclaim.com/cabs/acclaim...
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) -
http://messenger.zone.msn.com/EN-US...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient
Class) -
http://messenger.zone.msn.com/binar...
O16 - DPF: {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} (NeffyLauncherCtl Class)
- http://dist.globalgamecdn.com/dist/...
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
(MsnMessengerSetupDownloadControl Class) -
http://messenger.msn.com/download/M...
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control)
- http://www.trendsecure.com/easy_ins...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
http://messenger.zone.msn.com/binar...
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer
ActiveX Control) - http://a.download.toontown.com/sv1....
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient
Class) -
http://messenger.zone.msn.com/binar...
O16 - DPF: {C52439A0-2693-4E40-B141-9F9AD5257241} (Lexmark eDiagnostics
Class) - https://ediagnostics.lexmark.com/serval.cab
O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} (Logout Class) -
http://www.gamengame.com/KALogoutCo...
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) -
http://messenger.zone.msn.com/binar...
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class)
- http://messenger.zone.msn.com/binar...
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) -
https://secure.gopetslive.com/dev/GoPetsWeb.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) -
http://utilities.pcpitstop.com/opti...
O20 - Winlogon Notify: pmnnopq - pmnnopq.dll (file missing)
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi
Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program
Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd
- C:\WINDOWS\system32\CTSvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel
32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program
Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA,
Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: M-Audio Micro Installer (MAudioMicroService) - Avid
Technology, Inc. - C:\Program Files\M-Audio\M-Audio Micro\MAUSBMRInst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program
Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program
Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) -
Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation -
C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) -
Webroot Software, Inc. - C:\Program Files\Webroot\Spy
Sweeper\SpySweeper.exe
--
End of file - 13999 bytes

Report Offensive Follow Up For Removal

Response Number 5

Name: jabuck
Date: January 27, 2008 at 15:33:39 Pacific

Reply: (edit)

Go to start> run> type in notepad> click "format"> click "wordwrap" to uncheck it> exit notepad.
Go to the this link:
Disable Realtime Protection
Follow their directions to disable any realtime protection (spysweeper) or any other that you have as it will interfere with the fix by reinstalling the corrupt files.
Please download ComboFix to the desktop from one of the following links:
Link1
Link 2
Link 3

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running, it may cause your system to hang.)
Please post the log it produces.

Report Offensive Follow Up For Removal


Red X on C Drive - Can you Help? Red X on c drive red x on C drive, posxxx.tmp files Red X on C drive Red X on C Drive	Red X on C Drive - Adware/Trojan POS Files and Red X on C: drive red x on c: and pos.tmp.files. red cross on C drive POS.tmp file and red X on C-dive

Response Number 6

Name: TehCrazy
Date: January 27, 2008 at 16:08:10 Pacific

Reply: (edit)

ComboFix 08-01-23.1C - Kenneth 2008-01-27 18:59:07.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.647 [GMT -5:00]
Running from: C:\Documents and Settings\Kenneth\Desktop\ComboFix(2).exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2007-12-27 to 2008-01-27 )))))))))))))))))))))))))))))))
.
2008-01-27 18:31 . 2008-01-27 18:31 <DIR> d-------- C:\Program Files\uTorrent
2008-01-27 18:14 . 1999-12-17 10:13 86,016 --a------ C:\WINDOWS\unvise32.exe
2008-01-27 16:41 . 2008-01-27 17:12 <DIR> d-------- C:\VundoFix Backups
2008-01-27 15:34 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-27 14:03 . 2008-01-27 14:03 338,432 --a------ C:\WINDOWS\system32\RCX351.tmp
2008-01-27 08:57 . 2008-01-27 08:57 5,376 --a------ C:\WINDOWS\system32\drivers\MS1000.sys
2008-01-27 08:56 . 2008-01-27 09:02 <DIR> d-------- C:\Program Files\The Cleaner Free
2008-01-27 07:33 . 2008-01-27 07:34 <DIR> d-------- C:\Program Files\XoftSpySE
2008-01-27 06:25 . 2008-01-27 06:25 1,994 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-27 06:24 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-01-27 06:24 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-01-27 06:24 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-01-27 06:24 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-01-27 06:24 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-27 06:24 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-26 14:16 . 2008-01-26 14:16 <DIR> d-------- C:\Program Files\Common Files\INCA Shared
2008-01-24 19:38 . 2008-01-24 19:40 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2008-01-24 15:19 . 2008-01-24 15:22 <DIR> d-------- C:\Program Files\MP3 WAV WMA Converter
2008-01-21 14:30 . 2007-09-27 12:08 692,224 --a------ C:\WINDOWS\system32\ijjiSetup.exe
2008-01-21 14:30 . 2007-06-21 18:59 58,776 --a------ C:\WINDOWS\system32\ijjiPlugin2.dll
2008-01-20 01:52 . 2008-01-22 10:45 <DIR> d-------- C:\Program Files\a-squared Anti-Malware
2008-01-20 01:52 . 2008-01-20 01:52 96 --a------ C:\index.ini
2008-01-20 01:51 . 2008-01-20 01:53 <DIR> d-------- C:\Program Files\a-squared HiJackFree
2008-01-20 01:14 . 2008-01-20 01:14 <DIR> d-------- C:\WINDOWS\ERUNT
2008-01-20 00:21 . 2008-01-27 18:54 <DIR> d-------- C:\Program Files\Mozilla Firefox 3 Beta 2
2008-01-20 00:10 . 2008-01-20 00:10 <DIR> d-------- C:\Program Files\Windows Live Favorites
2008-01-20 00:09 . 2008-01-20 00:09 268 --ah----- C:\sqmdata01.sqm
2008-01-20 00:09 . 2008-01-20 00:09 244 --ah----- C:\sqmnoopt01.sqm
2008-01-20 00:07 . 2008-01-20 00:10 <DIR> d-------- C:\Program Files\Windows Live Toolbar
2008-01-19 23:49 . 2008-01-19 23:49 2,014 -rah----- C:\WINDOWS\system32\drivers\hosts
2008-01-19 23:48 . 2008-01-19 23:49 <DIR> d-------- C:\Program Files\RogueRemover PRO
2008-01-19 23:47 . 2007-05-30 07:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-19 23:41 . 2008-01-19 23:44 <DIR> d-------- C:\Program Files\RogueRemover FREE
2008-01-19 21:57 . 2008-01-19 23:18 174,592 --a------ C:\WINDOWS\system32\LEXPPS .EXE
2008-01-19 20:56 . 2008-01-19 21:03 338,432 --a------ C:\WINDOWS\system32\mlljg.exe
2008-01-19 20:41 . 2008-01-19 20:41 <DIR> d-------- C:\WINDOWS\system32\nGpxx01
2008-01-19 20:41 . 2008-01-27 07:21 <DIR> d-------- C:\Temp
2008-01-18 10:35 . 2008-01-27 16:09 <DIR> d-------- C:\Program Files\iTunes
2008-01-18 10:35 . 2008-01-18 10:35 <DIR> d-------- C:\Program Files\iPod
2008-01-18 10:34 . 2008-01-18 10:34 <DIR> d-------- C:\Program Files\Bonjour
2008-01-18 10:33 . 2008-01-27 16:09 <DIR> d-------- C:\Program Files\QuickTime
2008-01-17 16:31 . 2008-01-17 16:43 <DIR> d-------- C:\Program Files\Crimson Editor
2008-01-17 07:04 . 2008-01-18 10:11 <DIR> d-------- C:\Program Files\MP3 Rocket
2008-01-16 17:38 . 2008-01-17 18:00 <DIR> d-------- C:\World of Warcraft
2008-01-16 17:27 . 2008-01-16 17:27 <DIR> d-------- C:\ijji
2008-01-16 12:02 . 2008-01-16 12:02 <DIR> d-------- C:\Program Files\Webroot
2008-01-16 12:02 . 2008-01-16 12:02 <DIR> d-------- C:\Program Files\AskSBar
2008-01-16 12:02 . 2008-01-04 20:56 1,526,640 --a------ C:\WINDOWS\WRSetup.dll
2008-01-16 12:02 . 2008-01-04 20:34 163,696 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys
2008-01-16 12:02 . 2008-01-04 20:34 23,920 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys
2008-01-16 12:02 . 2008-01-04 20:34 21,872 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys
2008-01-16 12:02 . 2008-01-04 20:34 20,336 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys
2008-01-16 12:01 . 2008-01-16 12:30 164 --a------ C:\install.dat
2008-01-16 11:48 . 2008-01-16 11:48 268 --ah----- C:\sqmdata02.sqm
2008-01-16 11:48 . 2008-01-16 11:48 244 --ah----- C:\sqmnoopt02.sqm
2008-01-15 21:53 . 2008-01-15 21:53 <DIR> d-------- C:\Program Files\WinAVI Video Converter
2008-01-12 22:39 . 2005-08-11 15:29 73,728 --a------ C:\WINDOWS\system32\ISUSPM.cpl
2008-01-10 19:29 . 2008-01-10 19:29 54,608 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-01-10 17:08 . 2008-01-10 17:08 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-01-10 17:00 . 2008-01-10 17:00 <DIR> d-------- C:\Program Files\Common Files\Java
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-04 22:04 . 2008-01-04 22:12 <DIR> d-------- C:\Program Files\RegCure
2008-01-04 20:14 . 2008-01-04 20:14 <DIR> d-------- C:\Program Files\Radeon Omega Drivers
2008-01-04 19:25 . 2008-01-04 19:25 <DIR> d-------- C:\Program Files\ATI Technologies
2008-01-04 19:04 . 2008-01-04 19:25 <DIR> d-------- C:\WINDOWS\uninstall\DirectX Buster
2008-01-04 19:04 . 2008-01-04 19:04 <DIR> d-------- C:\WINDOWS\uninstall
2008-01-04 19:04 . 2008-01-04 19:25 <DIR> d-------- C:\Program Files\DirectX Buster
2008-01-04 18:32 . 2008-01-04 19:25 <DIR> d-------- C:\ATI(2)
2008-01-04 18:26 . 2008-01-04 19:25 <DIR> d-------- C:\Program Files\Driver Cleaner Pro
2008-01-04 16:54 . 2008-01-04 19:31 <DIR> d-------- C:\Program Files\Microsoft DirectX SDK (November 2007)
2008-01-04 16:00 . 2007-08-22 21:06 352,256 --a------ C:\WINDOWS\system32\ATIDEMGX(2).dll
2008-01-03 15:59 . 2008-01-03 15:59 <DIR> d-------- C:\Program Files\BillP Studios
2008-01-02 16:42 . 2005-07-24 22:56 1,237,863 --a------ C:\WINDOWS\system32\ms98.cab
2008-01-02 16:42 . 2004-12-14 13:56 3,561 --a------ C:\WINDOWS\system32\HPMICE.PCX
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-27 23:31 --------- d-----w C:\Program Files\FlashGet
2008-01-27 21:09 --------- d-----w C:\Program Files\MSN Messenger
2008-01-27 21:09 --------- d-----w C:\Program Files\MessengerPlus! 3
2008-01-27 21:09 --------- d-----w C:\Program Files\Dealio
2008-01-27 21:09 --------- d-----w C:\Program Files\AIM6
2008-01-27 19:30 22,328 -c--a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-01-27 19:30 107,832 -c--a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-01-26 18:37 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-25 22:51 --------- d-----w C:\Program Files\Xfire
2008-01-24 20:32 --------- d-----w C:\Program Files\WarRock
2008-01-20 06:58 --------- d-----w C:\Program Files\iMesh Applications
2008-01-20 06:45 --------- d-----w C:\Program Files\Lexmark 4200 Series
2008-01-20 05:08 --------- d-----w C:\Program Files\Real
2008-01-20 03:05 499,200 ----a-w C:\WINDOWS\PCHealth\HelpCtr\Binaries\msconfig.exe.tmp
2008-01-19 23:56 --------- d-----w C:\Program Files\DivX
2008-01-18 15:08 --------- d-----w C:\Program Files\Java
2008-01-16 22:41 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2008-01-13 03:39 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-05 01:14 472,576 ----a-w C:\WINDOWS\Radeon Omega Drivers v4.8.442 Uninstall.exe
2008-01-04 00:51 --------- d-----w C:\Program Files\Yahoo!
2008-01-03 21:47 --------- d-----w C:\Program Files\MultiRes
2007-12-13 21:45 --------- d-----w C:\Program Files\BearShare Applications
2007-12-05 05:26 2,782,208 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-12-05 03:05 368,640 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-12-05 03:04 269,312 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-12-05 02:56 147,456 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-12-05 02:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-12-05 02:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-12-05 02:53 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-12-05 02:48 9,535,488 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-12-05 02:33 1,640,192 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-12-05 02:19 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-12-05 02:19 385,024 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-12-05 02:17 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-12-05 02:16 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-12-05 02:14 180,224 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-12-05 02:11 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-11-28 22:45 --------- d-----w C:\Program Files\Viewpoint
2007-11-28 22:44 --------- d-----w C:\Program Files\Common Files\AOL
2007-11-28 22:08 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2007-11-26 14:55 230,481 ----a-w C:\WINDOWS\Piolet_Toolbar_Uninstaller_6093.exe
2007-11-21 08:02 98,304 -c--a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-11-19 21:37 65,536 ----a-w C:\WINDOWS\IFinst27.exe
2007-10-29 22:43 1,287,680 -c--a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 10:04 350,720 ----a-w C:\WINDOWS\system32\SET5.tmp
2007-10-27 22:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-07-26 01:01 3,580 ----a-w C:\Program Files\INSTALL.LOG
2001-09-28 21:00 164,864 -c--a-w C:\Program Files\UNWISE.EXE
.
[code]
----a-w         1,816,208 2008-01-22 10:48:43  C:\Program Files\a-squared Anti-Malware\a2guard .exe
----a-w         2,007,088 2008-01-27 20:09:59  C:\Program Files\FlashGet\FlashGet  .exe
----a-w            57,344 2008-01-20 06:45:32  C:\Program Files\Lexmark 4200 Series\lxbmbmgr .exe
----a-w         1,694,208 2008-01-20 02:59:06  C:\Program Files\Messenger\msmsgs .exe
----a-w           304,632 2008-01-20 03:04:38  C:\Program Files\Verizon\Verizon Internet Security Suite\Rps .exe
----a-w            13,816 2008-01-20 04:19:07  C:\Program Files\Verizon\Verizon Internet Security Suite\ZkRunOnceR .exe
----a-w         5,367,664 2008-01-27 12:08:02  C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI .exe
----a-w           174,592 2008-01-20 04:18:49  C:\WINDOWS\system32\LEXPPS .EXE
[/code]

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
2008-01-16 12:02 66912 --a------ C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474597C5-AB09-49d6-A4D5-2E8D7341384E}]
C:\Program Files\iMesh Applications\iMesh MediaBar\iMeshIEHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8ABA9A9C-8791-4d61-8D5B-BCC9448EA573}]
C:\Program Files\ISM\BndDrive7.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EDDF3383-EC5F-49DF-A8B6-CEC2D8F6164C}]
2007-11-26 09:55 798720 --a--c--- C:\Program Files\Piolet Toolbar\v3.2.0.0\Piolet_Toolbar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EF986924-D69B-8812-E820-FF8A30F02EE1}]
C:\WINDOWS\system32\ohsdvi.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2008-01-16 12:02 267592 --a------ C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BA52B914-B692-46C4-B683-905236F6F655}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}
{C75C8E7E-5059-4469-AC11-D7544B260382}
{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}
[HKEY_CLASSES_ROOT\clsid\{c75c8e7e-5059-4469-ac11-d7544b260382}]
[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{C75C8E7E-5059-4469-AC11-D7544B260382}"= C:\Program Files\Piolet Toolbar\v3.2.0.0\Piolet_Toolbar.dll [2007-11-26 09:55 798720]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL [2008-01-16 12:02 267592]
[HKEY_CLASSES_ROOT\clsid\{c75c8e7e-5059-4469-ac11-d7544b260382}]
[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360]
"Eijdrkcz"="C:\Documents and Settings\Kenneth\Application Data\?dobe\explorer.exe" [ ]
"WebCamRT.exe"="" []
"ISMModule7"="C:\Program Files\ISM\ISMModule7.exe" [ ]
"igndlm.exe"="C:\Program Files\IGN\Download Manager\DLM.exe" [ ]
"Shsi"="C:\DOCUME~1\Kenneth\MYDOCU~1\WNSXS~1\msdtc.exe" [ ]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" []
"NvCplDaemon"="RUNDLL32.exe" [2004-08-03 23:56 33280 C:\WINDOWS\system32\rundll32.exe]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" [ ]
"Flashget"="C:\Program Files\FlashGet\FlashGet .exe" [ ]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [ ]
C:\Documents and Settings\Cindy\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2007-12-03 16:35:53 147456]
C:\Documents and Settings\rob\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2007-12-03 16:35:53 147456]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56 65588]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnnopq]
pmnnopq.dll
[HKLM\~\startupfolder\C:^Documents and Settings^Kenneth^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Kenneth\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Kenneth^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk]
path=C:\Documents and Settings\Kenneth\Start Menu\Programs\Startup\MyWebSearch Email Plugin.lnk
backup=C:\WINDOWS\pss\MyWebSearch Email Plugin.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Kenneth^Start Menu^Programs^Startup^Xfire.lnk]
path=C:\Documents and Settings\Kenneth\Start Menu\Programs\Startup\Xfire.lnk
backup=C:\WINDOWS\pss\Xfire.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ActiveSpeed]
C:\Program Files\Ascentive\ActiveSpeed\AS.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\adstart]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGEIA PhysX SysTray]
C:\Program Files\AGEIA Technologies\TrayIcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA]
--a------ 2006-02-21 20:05 344064 C:\WINDOWS\system32\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\au]
C:\Program Files\Dealio\DealioAU.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Babylon Client]
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dmsrs.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\e3391b63.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer4_in_1]
C:\Program Files\Lexmark 4200 Series\Fax\fm3032.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]
C:\Program Files\FlashGet\FlashGet.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IFStub]
C:\WINDOWS\Temp\Adware\InstaFinderK_inst .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\install]
C:\WINDOWS\WINDOWS\install.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Security Suite]
C:\Program Files\Verizon\Internet Security Suite\Freedom.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\irssyncd]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ityj]
C:\Program Files\??sks\chkntfs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA]
C:\Program Files\Kazaa\kazaa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 4200 Series]
C:\Program Files\Lexmark 4200 Series\lxbmbmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
--a------ 2008-01-19 21:03 338432 C:\WINDOWS\system32\mlljg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M-Audio Taskbar Icon]
C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MicroSys-CheckAjour]
C:\Program Files\Micro-Sys Software\Ajour\ChkAjour.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\System32\\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NexonPlug]
C:\Nexon\NexonPlug\NexonPlug.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2006-10-22 12:22 86016 C:\WINDOWS\system32\NvMcTray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2P Networking]
C:\WINDOWS\system32\P2P Networking\P2P Networking.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PAS_Check]
C:\Program Files\Common Files\DriveCleaner 2006 Free\udcpas.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Pitstop Optimize2 Reminder]
C:\Program Files\PCPitstop\Optimize2\Reminder.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Performance Center]
C:\Program Files\Ascentive\Performance Center\ApcMain.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pop06ap]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean]
C:\Program Files\RegClean\RegClean.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1]
C:\WINDOWS\tsitra11.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDR6_Check]
C:\Program Files\Common Files\DriveCleaner 2006 Free\udcsdr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shsi]
C:\PROGRA~1\COMMON~1\WNSXS~1\ati2evxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\Steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Verizon Internet Security Suite]
C:\Program Files\Verizon\Verizon Internet Security Suite\Rps.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
C:\Program Files\Zune\ZuneLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PnkBstrB"=2 (0x2)
"RP_FWS"=2 (0x2)
"RPSUpdaterR"=3 (0x3)
"WMPNetworkSvc"=3 (0x3)
"iPod Service"=3 (0x3)
"gusvc"=3 (0x3)
"dvpapi"=2 (0x2)
"Bonjour Service"=2 (0x2)
"ATI Smart"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"LexBceS"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
R1 atitray;atitray;C:\Program Files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys [2007-11-05 02:55]
R2 MAudioMicroService;M-Audio Micro Installer;C:\Program Files\M-Audio\M-Audio Micro\MAUSBMRInst.exe [2007-08-13 09:35]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-03 23:56]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 16:38]
S3 geebers12;geebers12;C:\Documents and Settings\Kenneth\Desktop\blorbslayerengine\nvid888.sys []
S3 Intels51;Intel(R) 536EP V.92 Modem;C:\WINDOWS\system32\DRIVERS\Intels51.sys [2002-05-10 08:31]
S3 MAUSBML;Service for M-Audio Micro (WDM);C:\WINDOWS\system32\DRIVERS\mausbmr.sys [2007-04-27 09:38]
S3 MS1000;MS1000;C:\WINDOWS\system32\DRIVERS\MS1000.sys [2008-01-27 08:57]
S3 oflpydin;oflpydin;C:\DOCUME~1\Kenneth\LOCALS~1\Temp\oflpydin.sys []
S3 Radialpoint Security Services;Verizon Internet Security Suite;C:\WINDOWS\system32\dllhost.exe [2004-08-03 23:56]
S3 XDva028;XDva028;C:\WINDOWS\system32\XDva028.sys []
S3 XDva030;XDva030;C:\WINDOWS\system32\XDva030.sys []
S3 XDva058;XDva058;C:\WINDOWS\system32\XDva058.sys []
S3 XDva062;XDva062;C:\WINDOWS\system32\XDva062.sys []
S3 XDva068;XDva068;C:\WINDOWS\system32\XDva068.sys []
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
"2008-01-25 22:40:52 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-01-27 20:10:22 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job"
- C:\Program Files\AdwareAlert\AdwareAlert .ex
- C:\Program Files\AdwareAlert
"2008-01-17 01:56:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-01-27 23:19:01 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-01-25 08:30:01 C:\WINDOWS\Tasks\RegClean Scheduled Scan.job"
- C:\Program Files\RegClean\RegClean.ex
- C:\Program Files\RegClean
"2008-01-27 22:15:05 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-01-24 09:10:51 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-01-16 17:02:29 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job"
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe&/ScheduleSweep=wrSpySweeperTrialSweep
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.ex
- A:\
"2008-01-27 22:14:59 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2008-01-27 12:33:16 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-27 19:03:28
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-27 19:04:22
ComboFix-quarantined-files.txt 2008-01-28 00:04:06
ComboFix2.txt 2008-01-27 22:13:09
ComboFix3.txt 2008-01-27 21:34:00
.
2007-12-11 12:42:14 --- E O F ---

Report Offensive Follow Up For Removal

Response Number 7

Name: jabuck
Date: January 27, 2008 at 17:47:14 Pacific

Reply: (edit)

Go to start. control panel> add/remove programs and uninstall these programs if found:

XoftSpySE
uTorrent
KAZAA
DriveCleaner 2006
MessengerPlus! 3
Piolet Toolbar
ISM
LimeWire
Imesh
Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
RenV::
----a-w 1,816,208 2008-01-22 10:48:43 C:\Program Files\a-squared Anti-Malware\a2guard .exe
----a-w 2,007,088 2008-01-27 20:09:59 C:\Program Files\FlashGet\FlashGet .exe
----a-w 57,344 2008-01-20 06:45:32 C:\Program Files\Lexmark 4200 Series\lxbmbmgr .exe
----a-w 1,694,208 2008-01-20 02:59:06 C:\Program Files\Messenger\msmsgs .exe
----a-w 304,632 2008-01-20 03:04:38 C:\Program Files\Verizon\Verizon Internet Security Suite\Rps .exe
----a-w 13,816 2008-01-20 04:19:07 C:\Program Files\Verizon\Verizon Internet Security Suite\ZkRunOnceR .exe
----a-w 5,367,664 2008-01-27 12:08:02 C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI .exe
----a-w 174,592 2008-01-20 04:18:49 C:\WINDOWS\system32\LEXPPS .EXE
File::
:\WINDOWS\system32\RCX351.tmp
C:\WINDOWS\system32\ijjiSetup.exe
C:\WINDOWS\system32\ijjiPlugin2.dll
C:\WINDOWS\system32\mlljg.exe
C:\WINDOWS\system32\nGpxx01
C:\WINDOWS\system32\awvvw.exe
C:\WINDOWS\system32\SET5.tmp
Driver::
pmnnopq
Folder::
C:\ijji

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8ABA9A9C-8791-4d61-8D5B-BCC9448EA573}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EDDF3383-EC5F-49DF-A8B6-CEC2D8F6164C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EF986924-D69B-8812-E820-FF8A30F02EE1}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474597C5-AB09-49d6-A4D5-2E8D7341384E}]
[-HKEY_CLASSES_ROOT\clsid\{c75c8e7e-5059-4469-ac11-d7544b260382}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{C75C8E7E-5059-4469-AC11-D7544B260382}"=-
[-HKEY_CLASSES_ROOT\clsid\{c75c8e7e-5059-4469-ac11-d7544b260382}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Eijdrkcz"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnnopq]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\adstart]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dmsrs.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\e3391b63.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IFStub]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\irssyncd]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ityj]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2P Networking]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PAS_Check]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pop06ap]
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop.
Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run".
Post a new Hijack This log and Combofix log.

Report Offensive Follow Up For Removal

Response Number 8

Name: TehCrazy
Date: January 27, 2008 at 18:25:22 Pacific

Reply: (edit)

ComboFix 08-01-23.1C - Kenneth 2008-01-27 21:16:50.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.640 [GMT -5:00]
Running from: C:\Documents and Settings\Kenneth\Desktop\ComboFix(2).exe
Command switches used :: C:\Documents and Settings\Kenneth\Desktop\CFScript.txt
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
FILE
:\WINDOWS\system32\RCX351.tmp
C:\WINDOWS\system32\awvvw.exe
C:\WINDOWS\system32\ijjiPlugin2.dll
C:\WINDOWS\system32\ijjiSetup.exe
C:\WINDOWS\system32\mlljg.exe
C:\WINDOWS\system32\nGpxx01
C:\WINDOWS\system32\SET5.tmp
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\ijji
C:\ijji\ENGLISH\Gunz\BAReport.exe
C:\ijji\ENGLISH\Gunz\config.xml
C:\ijji\ENGLISH\Gunz\dbghelp.dll
C:\ijji\ENGLISH\Gunz\fmod.dll
C:\ijji\ENGLISH\Gunz\GameGuard.des
C:\ijji\ENGLISH\Gunz\GameGuard\category.tsf
C:\ijji\ENGLISH\Gunz\GameGuard\daily.tsf
C:\ijji\ENGLISH\Gunz\GameGuard\GameGuard.des
C:\ijji\ENGLISH\Gunz\GameGuard\GameGuard.ver
C:\ijji\ENGLISH\Gunz\GameGuard\GameMon.des
C:\ijji\ENGLISH\Gunz\GameGuard\ggscan.des
C:\ijji\ENGLISH\Gunz\GameGuard\GunzUS.ini
C:\ijji\ENGLISH\Gunz\GameGuard\npgg.erl
C:\ijji\ENGLISH\Gunz\GameGuard\npgg9x.des
C:\ijji\ENGLISH\Gunz\GameGuard\npggNT.des
C:\ijji\ENGLISH\Gunz\GameGuard\npgl.erl
C:\ijji\ENGLISH\Gunz\GameGuard\npgm.erl
C:\ijji\ENGLISH\Gunz\GameGuard\npgmup.des
C:\ijji\ENGLISH\Gunz\GameGuard\npgmup.des.new
C:\ijji\ENGLISH\Gunz\GameGuard\npgmup.erl
C:\ijji\ENGLISH\Gunz\GameGuard\npsc.des
C:\ijji\ENGLISH\Gunz\GameGuard\npsc.erl
C:\ijji\ENGLISH\Gunz\GameGuard\Splash.jpg
C:\ijji\ENGLISH\Gunz\GameGuard\teas.dll
C:\ijji\ENGLISH\Gunz\GameGuard\teas.tls
C:\ijji\ENGLISH\Gunz\GameGuard\teasbase.tsf
C:\ijji\ENGLISH\Gunz\GameGuard\teasname.tsf
C:\ijji\ENGLISH\Gunz\GameGuard\TeCtrl.dll
C:\ijji\ENGLISH\Gunz\GameGuard\TyAv32.dll
C:\ijji\ENGLISH\Gunz\GameGuard\tyavd.tsf
C:\ijji\ENGLISH\Gunz\GameGuard\tyavn.tsf
C:\ijji\ENGLISH\Gunz\gdiplus.dll
C:\ijji\ENGLISH\Gunz\Gunz.exe
C:\ijji\ENGLISH\Gunz\GunzLauncher.exe
C:\ijji\ENGLISH\Gunz\GunzUS.ini
C:\ijji\ENGLISH\Gunz\HanAuthForClient.dll
C:\ijji\ENGLISH\Gunz\HanPollForClient.dll
C:\ijji\ENGLISH\Gunz\HanReportForClient.dll
C:\ijji\ENGLISH\Gunz\Interface\default.mrs
C:\ijji\ENGLISH\Gunz\Interface\loadable.mrs
C:\ijji\ENGLISH\Gunz\Interface\Login.mrs
C:\ijji\ENGLISH\Gunz\Interface\MonsterIllust.mrs
C:\ijji\ENGLISH\Gunz\lastchar.dat
C:\ijji\ENGLISH\Gunz\Maps\Battle Arena.mrs
C:\ijji\ENGLISH\Gunz\Maps\Castle.mrs
C:\ijji\ENGLISH\Gunz\Maps\Catacomb.mrs
C:\ijji\ENGLISH\Gunz\Maps\Dungeon.mrs
C:\ijji\ENGLISH\Gunz\Maps\Factory.mrs
C:\ijji\ENGLISH\Gunz\Maps\Garden.mrs
C:\ijji\ENGLISH\Gunz\Maps\Hall.mrs
C:\ijji\ENGLISH\Gunz\Maps\Island.mrs
C:\ijji\ENGLISH\Gunz\Maps\Jail.mrs
C:\ijji\ENGLISH\Gunz\Maps\Lost Shrine.mrs
C:\ijji\ENGLISH\Gunz\Maps\mansion.mrs
C:\ijji\ENGLISH\Gunz\Maps\Port.mrs
C:\ijji\ENGLISH\Gunz\Maps\prison II.mrs
C:\ijji\ENGLISH\Gunz\Maps\prison.mrs
C:\ijji\ENGLISH\Gunz\Maps\Ruin.mrs
C:\ijji\ENGLISH\Gunz\Maps\Shower Room.mrs
C:\ijji\ENGLISH\Gunz\Maps\Snow_Town.mrs
C:\ijji\ENGLISH\Gunz\Maps\Stairway.mrs
C:\ijji\ENGLISH\Gunz\Maps\station.mrs
C:\ijji\ENGLISH\Gunz\Maps\Town.mrs
C:\ijji\ENGLISH\Gunz\mlog.txt
C:\ijji\ENGLISH\Gunz\model.mrs
C:\ijji\ENGLISH\Gunz\Model\man.mrs
C:\ijji\ENGLISH\Gunz\Model\NPC\goblin.mrs
C:\ijji\ENGLISH\Gunz\Model\NPC\Palmpoa.mrs
C:\ijji\ENGLISH\Gunz\Model\NPC\Skeleton.mrs
C:\ijji\ENGLISH\Gunz\Model\woman.mrs
C:\ijji\ENGLISH\Gunz\msvcp71.dll
C:\ijji\ENGLISH\Gunz\msvcr71.dll
C:\ijji\ENGLISH\Gunz\patch.xml
C:\ijji\ENGLISH\Gunz\patchlog.txt
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_cavern1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_cavern2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_cavern3.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_nest1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_nest2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_nest3.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_passage1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_passage2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_passage3.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_hall1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_hall2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_hall3.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_passage1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_passage2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_passage3.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_room1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_room2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_room3.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_drainage1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_drainage2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_hall1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_hall2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_passage1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_passage2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_passage3.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_prison.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_shower_room.mrs
C:\ijji\ENGLISH\Gunz\sfx.mrs
C:\ijji\ENGLISH\Gunz\Shader\patchlog.txt
C:\ijji\ENGLISH\Gunz\Shader\skin.vso
C:\ijji\ENGLISH\Gunz\Shader\skin1.vso
C:\ijji\ENGLISH\Gunz\Sound\bgm.mrs
C:\ijji\ENGLISH\Gunz\Sound\effect.mrs
C:\ijji\ENGLISH\Gunz\Sound\Effect\fx2.mrs
C:\ijji\ENGLISH\Gunz\Sound\Effect\nar.mrs
C:\ijji\ENGLISH\Gunz\Sound\Effect\quest\goblin.mrs
C:\ijji\ENGLISH\Gunz\Sound\Effect\quest\golem.mrs
C:\ijji\ENGLISH\Gunz\Sound\Effect\quest\lizard.mrs
C:\ijji\ENGLISH\Gunz\Sound\Effect\quest\skeleton.mrs
C:\ijji\ENGLISH\Gunz\system.mrs
C:\ijji\ENGLISH\Gunz\Uninstall.exe
C:\ijji\ENGLISH\Gunz\Update1.mrs
C:\ijji\ENGLISH\Gunz\Update2.mrs
C:\ijji\ENGLISH\Gunz\Update3.mrs
C:\WINDOWS\system32\ijjiPlugin2.dll
C:\WINDOWS\system32\ijjiSetup.exe
C:\WINDOWS\system32\mlljg.exe
C:\WINDOWS\system32\SET5.tmp
.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-28 )))))))))))))))))))))))))))))))
.
2008-01-27 20:09 . 2008-01-27 20:09 <DIR> d-------- C:\Program Files\StepMania CVS
2008-01-27 20:02 . 2008-01-16 12:02 267,592 --a------ C:\Program Files\Uninstall Ask Toolbar.dll
2008-01-27 18:31 . 2008-01-27 18:31 <DIR> d-------- C:\Program Files\uTorrent
2008-01-27 18:14 . 1999-12-17 10:13 86,016 --a------ C:\WINDOWS\unvise32.exe
2008-01-27 15:34 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-27 14:03 . 2008-01-27 14:03 338,432 --a------ C:\WINDOWS\system32\RCX351.tmp
2008-01-27 08:57 . 2008-01-27 08:57 5,376 --a------ C:\WINDOWS\system32\drivers\MS1000.sys
2008-01-27 06:25 . 2008-01-27 06:25 1,994 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-27 06:24 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-01-27 06:24 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-01-27 06:24 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-01-27 06:24 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-01-27 06:24 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-27 06:24 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-26 14:16 . 2008-01-26 14:16 <DIR> d-------- C:\Program Files\Common Files\INCA Shared
2008-01-24 19:38 . 2008-01-24 19:40 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2008-01-24 15:19 . 2008-01-24 15:22 <DIR> d-------- C:\Program Files\MP3 WAV WMA Converter
2008-01-20 01:52 . 2008-01-27 21:16 <DIR> d-------- C:\Program Files\a-squared Anti-Malware
2008-01-20 01:52 . 2008-01-20 01:52 96 --a------ C:\index.ini
2008-01-20 01:14 . 2008-01-20 01:14 <DIR> d-------- C:\WINDOWS\ERUNT
2008-01-20 00:21 . 2008-01-27 20:12 <DIR> d-------- C:\Program Files\Mozilla Firefox 3 Beta 2
2008-01-20 00:10 . 2008-01-20 00:10 <DIR> d-------- C:\Program Files\Windows Live Favorites
2008-01-20 00:09 . 2008-01-20 00:09 268 --ah----- C:\sqmdata01.sqm
2008-01-20 00:09 . 2008-01-20 00:09 244 --ah----- C:\sqmnoopt01.sqm
2008-01-20 00:07 . 2008-01-20 00:10 <DIR> d-------- C:\Program Files\Windows Live Toolbar
2008-01-19 23:49 . 2008-01-19 23:49 2,014 -rah----- C:\WINDOWS\system32\drivers\hosts
2008-01-19 21:57 . 2008-01-19 23:18 174,592 --a------ C:\WINDOWS\system32\LEXPPS.EXE
2008-01-19 20:41 . 2008-01-19 20:41 <DIR> d-------- C:\WINDOWS\system32\nGpxx01
2008-01-19 20:41 . 2008-01-27 07:21 <DIR> d-------- C:\Temp
2008-01-18 10:35 . 2008-01-27 16:09 <DIR> d-------- C:\Program Files\iTunes
2008-01-18 10:35 . 2008-01-18 10:35 <DIR> d-------- C:\Program Files\iPod
2008-01-18 10:34 . 2008-01-18 10:34 <DIR> d-------- C:\Program Files\Bonjour
2008-01-18 10:33 . 2008-01-27 16:09 <DIR> d-------- C:\Program Files\QuickTime
2008-01-17 16:31 . 2008-01-17 16:43 <DIR> d-------- C:\Program Files\Crimson Editor
2008-01-17 07:04 . 2008-01-18 10:11 <DIR> d-------- C:\Program Files\MP3 Rocket
2008-01-16 17:38 . 2008-01-17 18:00 <DIR> d-------- C:\World of Warcraft
2008-01-16 12:02 . 2008-01-16 12:02 <DIR> d-------- C:\Program Files\Webroot
2008-01-16 12:02 . 2008-01-27 20:29 <DIR> d-a------ C:\Program Files\AskSBar
2008-01-16 12:02 . 2008-01-04 20:56 1,526,640 --a------ C:\WINDOWS\WRSetup.dll
2008-01-16 12:01 . 2008-01-16 12:30 164 --a------ C:\install.dat
2008-01-16 11:48 . 2008-01-16 11:48 268 --ah----- C:\sqmdata02.sqm
2008-01-16 11:48 . 2008-01-16 11:48 244 --ah----- C:\sqmnoopt02.sqm
2008-01-15 21:53 . 2008-01-15 21:53 <DIR> d-------- C:\Program Files\WinAVI Video Converter
2008-01-12 22:39 . 2005-08-11 15:29 73,728 --a------ C:\WINDOWS\system32\ISUSPM.cpl
2008-01-10 19:29 . 2008-01-10 19:29 54,608 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-01-10 17:08 . 2008-01-10 17:08 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-01-10 17:00 . 2008-01-10 17:00 <DIR> d-------- C:\Program Files\Common Files\Java
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-04 20:14 . 2008-01-04 20:14 <DIR> d-------- C:\Program Files\Radeon Omega Drivers
2008-01-04 19:25 . 2008-01-04 19:25 <DIR> d-------- C:\Program Files\ATI Technologies
2008-01-04 19:04 . 2008-01-04 19:25 <DIR> d-------- C:\WINDOWS\uninstall\DirectX Buster
2008-01-04 19:04 . 2008-01-04 19:04 <DIR> d-------- C:\WINDOWS\uninstall
2008-01-04 19:04 . 2008-01-04 19:25 <DIR> d-------- C:\Program Files\DirectX Buster
2008-01-04 18:32 . 2008-01-04 19:25 <DIR> d-------- C:\ATI(2)
2008-01-04 16:54 . 2008-01-04 19:31 <DIR> d-------- C:\Program Files\Microsoft DirectX SDK (November 2007)
2008-01-04 16:00 . 2007-08-22 21:06 352,256 --a------ C:\WINDOWS\system32\ATIDEMGX(2).dll
2008-01-03 15:59 . 2008-01-03 15:59 <DIR> d-------- C:\Program Files\BillP Studios
2008-01-02 16:42 . 2005-07-24 22:56 1,237,863 --a------ C:\WINDOWS\system32\ms98.cab
2008-01-02 16:42 . 2004-12-14 13:56 3,561 --a------ C:\WINDOWS\system32\HPMICE.PCX
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-28 02:16 --------- d-----w C:\Program Files\Lexmark 4200 Series
2008-01-28 01:51 --------- d-----w C:\Program Files\LimeWire
2008-01-28 01:50 --------- d-----w C:\Program Files\Piolet Toolbar
2008-01-28 01:24 --------- d-----w C:\Program Files\Yahoo!
2008-01-28 01:16 --------- d-----w C:\Program Files\Java
2008-01-27 23:31 --------- d-----w C:\Program Files\FlashGet
2008-01-27 21:09 --------- d-----w C:\Program Files\MSN Messenger
2008-01-27 21:09 --------- d-----w C:\Program Files\MessengerPlus! 3
2008-01-27 21:09 --------- d-----w C:\Program Files\Dealio
2008-01-27 21:09 --------- d-----w C:\Program Files\AIM6
2008-01-27 19:30 22,328 -c--a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-01-27 19:30 107,832 -c--a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-01-26 18:37 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-25 22:51 --------- d-----w C:\Program Files\Xfire
2008-01-24 20:32 --------- d-----w C:\Program Files\WarRock
2008-01-20 06:58 --------- d-----w C:\Program Files\iMesh Applications
2008-01-20 05:08 --------- d-----w C:\Program Files\Real
2008-01-20 03:05 499,200 ----a-w C:\WINDOWS\PCHealth\HelpCtr\Binaries\msconfig.exe.tmp
2008-01-19 23:56 --------- d-----w C:\Program Files\DivX
2008-01-16 22:41 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2008-01-13 03:39 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-05 01:14 472,576 ----a-w C:\WINDOWS\Radeon Omega Drivers v4.8.442 Uninstall.exe
2008-01-03 21:47 --------- d-----w C:\Program Files\MultiRes
2007-12-13 21:45 --------- d-----w C:\Program Files\BearShare Applications
2007-12-05 05:26 2,782,208 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-12-05 03:05 368,640 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-12-05 03:04 269,312 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-12-05 02:56 147,456 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-12-05 02:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-12-05 02:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-12-05 02:53 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-12-05 02:48 9,535,488 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-12-05 02:33 1,640,192 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-12-05 02:19 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-12-05 02:19 385,024 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-12-05 02:17 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-12-05 02:16 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-12-05 02:14 180,224 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-12-05 02:11 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-11-28 22:45 --------- d-----w C:\Program Files\Viewpoint
2007-11-28 22:44 --------- d-----w C:\Program Files\Common Files\AOL
2007-11-28 22:08 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2007-11-26 14:55 230,481 ----a-w C:\WINDOWS\Piolet_Toolbar_Uninstaller_6093.exe
2007-11-21 08:02 98,304 -c--a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-11-19 21:37 65,536 ----a-w C:\WINDOWS\IFinst27.exe
2007-10-29 22:43 1,287,680 -c--a-w C:\WINDOWS\system32\quartz.dll
2007-07-26 01:01 3,580 ----a-w C:\Program Files\INSTALL.LOG
2001-09-28 21:00 164,864 -c--a-w C:\Program Files\UNWISE.EXE
.
[code]
----a-w         2,007,088 2008-01-27 20:09:59  C:\Program Files\FlashGet\FlashGet  .exe
[/code]

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360]
"WebCamRT.exe"="" []
"ISMModule7"="C:\Program Files\ISM\ISMModule7.exe" [ ]
"igndlm.exe"="C:\Program Files\IGN\Download Manager\DLM.exe" [ ]
"Shsi"="C:\DOCUME~1\Kenneth\MYDOCU~1\WNSXS~1\msdtc.exe" [ ]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" []
"NvCplDaemon"="RUNDLL32.exe" [2004-08-03 23:56 33280 C:\WINDOWS\system32\rundll32.exe]
"Flashget"="C:\Program Files\FlashGet\FlashGet .exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56 65588]
[HKLM\~\startupfolder\C:^Documents and Settings^Kenneth^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Kenneth\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Kenneth^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk]
path=C:\Documents and Settings\Kenneth\Start Menu\Programs\Startup\MyWebSearch Email Plugin.lnk
backup=C:\WINDOWS\pss\MyWebSearch Email Plugin.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Kenneth^Start Menu^Programs^Startup^Xfire.lnk]
path=C:\Documents and Settings\Kenneth\Start Menu\Programs\Startup\Xfire.lnk
backup=C:\WINDOWS\pss\Xfire.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ActiveSpeed]
C:\Program Files\Ascentive\ActiveSpeed\AS.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGEIA PhysX SysTray]
C:\Program Files\AGEIA Technologies\TrayIcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA]
--a------ 2006-02-21 20:05 344064 C:\WINDOWS\system32\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\au]
C:\Program Files\Dealio\DealioAU.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Babylon Client]
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer4_in_1]
C:\Program Files\Lexmark 4200 Series\Fax\fm3032.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]
C:\Program Files\FlashGet\FlashGet.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\install]
C:\WINDOWS\WINDOWS\install.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Security Suite]
C:\Program Files\Verizon\Internet Security Suite\Freedom.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 4200 Series]
--a------ 2008-01-20 01:45 57344 C:\Program Files\Lexmark 4200 Series\lxbmbmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M-Audio Taskbar Icon]
C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MicroSys-CheckAjour]
C:\Program Files\Micro-Sys Software\Ajour\ChkAjour.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-01-19 21:59 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\System32\\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NexonPlug]
C:\Nexon\NexonPlug\NexonPlug.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2006-10-22 12:22 86016 C:\WINDOWS\system32\NvMcTray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Pitstop Optimize2 Reminder]
C:\Program Files\PCPitstop\Optimize2\Reminder.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Performance Center]
C:\Program Files\Ascentive\Performance Center\ApcMain.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean]
C:\Program Files\RegClean\RegClean.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1]
C:\WINDOWS\tsitra11.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDR6_Check]
C:\Program Files\Common Files\DriveCleaner 2006 Free\udcsdr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shsi]
C:\PROGRA~1\COMMON~1\WNSXS~1\ati2evxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\Steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Verizon Internet Security Suite]
--a------ 2008-01-19 22:04 304632 C:\Program Files\Verizon\Verizon Internet Security Suite\Rps.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
C:\Program Files\Zune\ZuneLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PnkBstrB"=2 (0x2)
"RP_FWS"=2 (0x2)
"RPSUpdaterR"=3 (0x3)
"WMPNetworkSvc"=3 (0x3)
"iPod Service"=3 (0x3)
"gusvc"=3 (0x3)
"dvpapi"=2 (0x2)
"Bonjour Service"=2 (0x2)
"ATI Smart"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"LexBceS"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
R1 atitray;atitray;C:\Program Files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys [2007-11-05 02:55]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-03 23:56]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 16:38]
S2 MAudioMicroService;M-Audio Micro Installer;C:\Program Files\M-Audio\M-Audio Micro\MAUSBMRInst.exe [2007-08-13 09:35]
S3 geebers12;geebers12;C:\Documents and Settings\Kenneth\Desktop\blorbslayerengine\nvid888.sys []
S3 Intels51;Intel(R) 536EP V.92 Modem;C:\WINDOWS\system32\DRIVERS\Intels51.sys [2002-05-10 08:31]
S3 MAUSBML;Service for M-Audio Micro (WDM);C:\WINDOWS\system32\DRIVERS\mausbmr.sys [2007-04-27 09:38]
S3 MS1000;MS1000;C:\WINDOWS\system32\DRIVERS\MS1000.sys [2008-01-27 08:57]
S3 oflpydin;oflpydin;C:\DOCUME~1\Kenneth\LOCALS~1\Temp\oflpydin.sys []
S3 Radialpoint Security Services;Verizon Internet Security Suite;C:\WINDOWS\system32\dllhost.exe [2004-08-03 23:56]
S3 XDva028;XDva028;C:\WINDOWS\system32\XDva028.sys []
S3 XDva030;XDva030;C:\WINDOWS\system32\XDva030.sys []
S3 XDva058;XDva058;C:\WINDOWS\system32\XDva058.sys []
S3 XDva062;XDva062;C:\WINDOWS\system32\XDva062.sys []
S3 XDva068;XDva068;C:\WINDOWS\system32\XDva068.sys []
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
"2008-01-25 22:40:52 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-01-27 20:10:22 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job"
- C:\Program Files\AdwareAlert\AdwareAlert .ex
- C:\Program Files\AdwareAlert
"2008-01-17 01:56:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-01-28 02:19:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-01-25 08:30:01 C:\WINDOWS\Tasks\RegClean Scheduled Scan.job"
- C:\Program Files\RegClean\RegClean.ex
- C:\Program Files\RegClean
"2008-01-27 22:15:05 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-01-24 09:10:51 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-27 21:21:18
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-27 21:22:04
ComboFix-quarantined-files.txt 2008-01-28 02:21:41
ComboFix2.txt 2008-01-28 00:04:22
.
2007-12-11 12:42:14 --- E O F ---

Report Offensive Follow Up For Removal

Response Number 9

Name: TehCrazy
Date: January 27, 2008 at 18:25:59 Pacific

Reply: (edit)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:25:12 PM, on 1/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Mozilla Firefox 3 Beta 2\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Kenneth\Desktop\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie...
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 72.52.163.100:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: PopKill Class - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Verizon\Verizon Internet Security Suite\pkR.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb124\Dealio.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - C:\PROGRA~1\STARDO~1\SDIEInt.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb124\Dealio.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Flashget] "C:\Program Files\FlashGet\FlashGet .exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ISMModule7] "C:\Program Files\ISM\ISMModule7.exe"
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\IGN\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [Shsi] "C:\DOCUME~1\Kenneth\MYDOCU~1\WNSXS~1\msdtc.exe" -vt ndrv
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Download All with FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd....
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\Kenneth\Application Data\Dealio\kb124\res\DealioSearch.html
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?b390dcb8d80448aba0c6b6495b65cfe2
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?b390dcb8d80448aba0c6b6495b65cfe2
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Kenneth\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb124\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb124\Dealio.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {2931566C-B8A6-46C5-BF4D-E6AB9251E953} (Nexon Package Manager Control) - http://s.nx.com/activex/public_new/...
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US...
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/re...
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gam...
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim...
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://messenger.zone.msn.com/EN-US...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} (NeffyLauncherCtl Class) - http://dist.globalgamecdn.com/dist/...
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/M...
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_ins...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1....
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {C52439A0-2693-4E40-B141-9F9AD5257241} (Lexmark eDiagnostics Class) - https://ediagnostics.lexmark.com/serval.cab
O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} (Logout Class) - http://www.gamengame.com/KALogoutCo...
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binar...
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/opti...
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: M-Audio Micro Installer (MAudioMicroService) - Avid Technology, Inc. - C:\Program Files\M-Audio\M-Audio Micro\MAUSBMRInst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
--
End of file - 11330 bytes

Report Offensive Follow Up For Removal

Response Number 10

Name: jabuck
Date: January 27, 2008 at 19:08:09 Pacific

Reply: (edit)

Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
RenV::
----a-w 2,007,088 2008-01-27 20:09:59 C:\Program Files\FlashGet\FlashGet .exe
File::
C:\WINDOWS\system32\RCX351.tmp
C:\WINDOWS\PCHealth\HelpCtr\Binaries\msconfig.exe.tmp
C:\WINDOWS\Piolet_Toolbar_Uninstaller_6093.exe

Folder::
C:\Program Files\uTorrent
C:\WINDOWS\system32\nGpxx01
C:\Program Files\LimeWire
C:\Program Files\Piolet Toolbar
C:\Program Files\MessengerPlus!
C:\Program Files\iMesh Applications
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\install]
[-HKLM\~\startupfolder\C:^Documents and Settings^Kenneth^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop.
Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run".
Post a new Combofix log.

Report Offensive Follow Up For Removal

Response Number 11

Name: TehCrazy
Date: January 28, 2008 at 04:31:18 Pacific

Reply: (edit)

ComboFix 08-01-23.1C - Kenneth 2008-01-28 7:23:50.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.667 [GMT -5:00]
Running from: C:\Documents and Settings\Kenneth\Desktop\ComboFix(2).exe
Command switches used :: C:\Documents and Settings\Kenneth\Desktop\CFScript.txt
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
FILE
C:\WINDOWS\PCHealth\HelpCtr\Binaries\msconfig.exe.tmp
C:\WINDOWS\Piolet_Toolbar_Uninstaller_6093.exe
C:\WINDOWS\system32\RCX351.tmp
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\LimeWire
C:\Program Files\LimeWire\KMFDM - Techno Combat (Mortal Kombat).mp3
C:\Program Files\LimeWire\Mortal Kombat - Final Combat (Techno).mp3
C:\Program Files\LimeWire\Rise Against - Behind Closed Doors.mp3
C:\Program Files\LimeWire\Rise Against - Give It All.mp3
C:\Program Files\LimeWire\Rise Against - State of The Union.mp3
C:\Program Files\LimeWire\Rise Against - The Good Left Undone(1).mp3
C:\Program Files\LimeWire\Rise Against - Worth Dying For.mp3
C:\Program Files\Piolet Toolbar
C:\WINDOWS\PCHealth\HelpCtr\Binaries\msconfig.exe.tmp
C:\WINDOWS\system32\nGpxx01
C:\WINDOWS\system32\nGpxx01\nGpxx011065.exe
C:\WINDOWS\system32\RCX351.tmp
.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-28 )))))))))))))))))))))))))))))))
.
2008-01-27 22:03 . 2008-01-27 22:03 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-27 22:02 . 2008-01-27 22:02 <DIR> d-------- C:\Program Files\Windows Live Favorites
2008-01-27 21:34 . 2008-01-27 21:34 <DIR> d-------- C:\Perfect World
2008-01-27 21:32 . 2007-09-19 10:14 <DIR> d-------- C:\Program Files\background
2008-01-27 21:28 . 2008-01-27 21:32 <DIR> d-------- C:\Program Files\Perfect World
2008-01-27 20:09 . 2008-01-27 20:09 <DIR> d-------- C:\Program Files\StepMania CVS
2008-01-27 18:14 . 1999-12-17 10:13 86,016 --a------ C:\WINDOWS\unvise32.exe
2008-01-27 15:34 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-27 08:57 . 2008-01-27 08:57 5,376 --a------ C:\WINDOWS\system32\drivers\MS1000.sys
2008-01-27 06:25 . 2008-01-27 06:25 1,994 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-27 06:24 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-01-27 06:24 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-01-27 06:24 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-01-27 06:24 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-01-27 06:24 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-27 06:24 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-26 14:16 . 2008-01-26 14:16 <DIR> d-------- C:\Program Files\Common Files\INCA Shared
2008-01-24 19:38 . 2008-01-24 19:40 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2008-01-24 15:19 . 2008-01-24 15:22 <DIR> d-------- C:\Program Files\MP3 WAV WMA Converter
2008-01-20 01:52 . 2008-01-20 01:52 96 --a------ C:\index.ini
2008-01-20 01:14 . 2008-01-20 01:14 <DIR> d-------- C:\WINDOWS\ERUNT
2008-01-20 00:21 . 2008-01-28 07:15 <DIR> d-------- C:\Program Files\Mozilla Firefox 3 Beta 2
2008-01-20 00:09 . 2008-01-20 00:09 268 --ah----- C:\sqmdata01.sqm
2008-01-20 00:09 . 2008-01-20 00:09 244 --ah----- C:\sqmnoopt01.sqm
2008-01-20 00:07 . 2008-01-27 22:02 <DIR> d-------- C:\Program Files\Windows Live Toolbar
2008-01-19 23:49 . 2008-01-19 23:49 2,014 -rah----- C:\WINDOWS\system32\drivers\hosts
2008-01-19 21:57 . 2008-01-19 23:18 174,592 --a------ C:\WINDOWS\system32\LEXPPS.EXE
2008-01-19 20:41 . 2008-01-27 07:21 <DIR> d-------- C:\Temp
2008-01-18 10:35 . 2008-01-27 16:09 <DIR> d-------- C:\Program Files\iTunes
2008-01-18 10:35 . 2008-01-18 10:35 <DIR> d-------- C:\Program Files\iPod
2008-01-18 10:34 . 2008-01-18 10:34 <DIR> d-------- C:\Program Files\Bonjour
2008-01-18 10:33 . 2008-01-27 16:09 <DIR> d-------- C:\Program Files\QuickTime
2008-01-17 16:31 . 2008-01-17 16:43 <DIR> d-------- C:\Program Files\Crimson Editor
2008-01-17 07:04 . 2008-01-18 10:11 <DIR> d-------- C:\Program Files\MP3 Rocket
2008-01-16 17:38 . 2008-01-17 18:00 <DIR> d-------- C:\World of Warcraft
2008-01-16 12:01 . 2008-01-16 12:30 164 --a------ C:\install.dat
2008-01-16 11:48 . 2008-01-16 11:48 268 --ah----- C:\sqmdata02.sqm
2008-01-16 11:48 . 2008-01-16 11:48 244 --ah----- C:\sqmnoopt02.sqm
2008-01-15 21:53 . 2008-01-15 21:53 <DIR> d-------- C:\Program Files\WinAVI Video Converter
2008-01-12 22:39 . 2005-08-11 15:29 73,728 --a------ C:\WINDOWS\system32\ISUSPM.cpl
2008-01-10 19:29 . 2008-01-10 19:29 54,608 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-01-10 17:08 . 2008-01-10 17:08 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-01-10 17:00 . 2008-01-10 17:00 <DIR> d-------- C:\Program Files\Common Files\Java
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-04 20:14 . 2008-01-04 20:14 <DIR> d-------- C:\Program Files\Radeon Omega Drivers
2008-01-04 19:25 . 2008-01-04 19:25 <DIR> d-------- C:\Program Files\ATI Technologies
2008-01-04 19:04 . 2008-01-04 19:25 <DIR> d-------- C:\WINDOWS\uninstall\DirectX Buster
2008-01-04 19:04 . 2008-01-04 19:04 <DIR> d-------- C:\WINDOWS\uninstall
2008-01-04 19:04 . 2008-01-04 19:25 <DIR> d-------- C:\Program Files\DirectX Buster
2008-01-04 18:32 . 2008-01-04 19:25 <DIR> d-------- C:\ATI(2)
2008-01-04 16:54 . 2008-01-04 19:31 <DIR> d-------- C:\Program Files\Microsoft DirectX SDK (November 2007)
2008-01-04 16:00 . 2007-08-22 21:06 352,256 --a------ C:\WINDOWS\system32\ATIDEMGX(2).dll
2008-01-03 15:59 . 2008-01-03 15:59 <DIR> d-------- C:\Program Files\BillP Studios
2008-01-02 16:42 . 2005-07-24 22:56 1,237,863 --a------ C:\WINDOWS\system32\ms98.cab
2008-01-02 16:42 . 2004-12-14 13:56 3,561 --a------ C:\WINDOWS\system32\HPMICE.PCX
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-28 02:16 --------- d-----w C:\Program Files\Lexmark 4200 Series
2008-01-28 01:24 --------- d-----w C:\Program Files\Yahoo!
2008-01-28 01:16 --------- d-----w C:\Program Files\Java
2008-01-27 23:31 --------- d-----w C:\Program Files\FlashGet
2008-01-27 21:09 --------- d-----w C:\Program Files\MSN Messenger
2008-01-27 21:09 --------- d-----w C:\Program Files\Dealio
2008-01-27 21:09 --------- d-----w C:\Program Files\AIM6
2008-01-27 19:30 22,328 -c--a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-01-27 19:30 107,832 -c--a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-01-26 18:37 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-25 22:51 --------- d-----w C:\Program Files\Xfire
2008-01-24 20:32 --------- d-----w C:\Program Files\WarRock
2008-01-20 05:08 --------- d-----w C:\Program Files\Real
2008-01-19 23:56 --------- d-----w C:\Program Files\DivX
2008-01-16 22:41 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2008-01-13 03:39 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-05 01:14 472,576 ----a-w C:\WINDOWS\Radeon Omega Drivers v4.8.442 Uninstall.exe
2008-01-03 21:47 --------- d-----w C:\Program Files\MultiRes
2007-12-13 21:45 --------- d-----w C:\Program Files\BearShare Applications
2007-12-05 05:26 2,782,208 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-12-05 03:05 368,640 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-12-05 03:04 269,312 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-12-05 02:56 147,456 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-12-05 02:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-12-05 02:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-12-05 02:53 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-12-05 02:48 9,535,488 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-12-05 02:33 1,640,192 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-12-05 02:19 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-12-05 02:19 385,024 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-12-05 02:17 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-12-05 02:16 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-12-05 02:14 180,224 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-12-05 02:11 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-11-28 22:45 --------- d-----w C:\Program Files\Viewpoint
2007-11-28 22:44 --------- d-----w C:\Program Files\Common Files\AOL
2007-11-28 22:08 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2007-11-21 08:02 98,304 -c--a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-11-19 21:37 65,536 ----a-w C:\WINDOWS\IFinst27.exe
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 -c--a-w C:\WINDOWS\system32\quartz.dll
2007-07-26 01:01 3,580 ----a-w C:\Program Files\INSTALL.LOG
2001-09-28 21:00 164,864 -c--a-w C:\Program Files\UNWISE.EXE
.
[code]
----a-w         2,007,088 2008-01-27 20:09:59  C:\Program Files\FlashGet\FlashGet  .exe
[/code]

((((((((((((((((((((((((((((( snapshot@2008-01-27_21.21.24.42 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-28 02:16:26 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-01-28 12:23:45 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT
- 2008-01-28 02:16:26 12,288 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-01-28 12:23:45 12,288 ----a-w C:\WINDOWS\erdnt\Hiv-bac