secure32 problem and more

Computing.Net > Forums > Security and Virus > secure32 problem and more

Computing.Net: Over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to sign up now, it's free!

secure32 problem and more

Original Message

Name: Vinzor
Date: December 27, 2006 at 07:14:02 Pacific
Subject: secure32 problem and more
OS: Windows XP
CPU/Ram: 256
Model/Manufacturer: Dell

Comment:

Hi,
my computer caught a virus, I can't enable the Windowss firewall, or the Auto Protect status on my Norton Antivirus 2003 software.
I scanned with Spybot in safe mode it cleans every thing, till the next time I connect to the internet. Oh, and when i launch IE, I get the message "can't find secure32.html".
Please help!!!

Report Offensive Message For Removal

Response Number 1

Name: jabuck
Date: December 27, 2006 at 07:17:30 Pacific

Reply: (edit)

Please post a Hijack This log so that the files associated with the virus/spyware/hijacker can be identified.
Please download HJTsetup.exe from this link http://www.thespykiller.co.uk/files/HJTsetup.exe to your desktop.
Doubleclick on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This.
Continue to click "next" in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue.
Put a check by "Create a desktop icon" then click "Next" again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click "Finish" and it will launch Hijack This.
Click on the "Do a system scan and save a logfile" button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log and post it in this thread.
Do not fix anything yet unless you know what you are doing. This is a powerful tool that can crash the computer if used improperly.
Please download SmitFraudFix from this link http://siri.urz.free.fr/Fix/Smitfra... Then extract the contents to your desktop.
!!!! Only run option #1 as runing the other options on an uninfected computer will damage the desktop.!!!!
Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd"
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.
Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Report Offensive Follow Up For Removal

Response Number 2

Name: Vinzor
Date: December 27, 2006 at 07:26:09 Pacific

Reply: (edit)

Thank you for the quick reply.
Here's the hijackthus.log:
Logfile of HijackThis v1.99.1
Scan saved at 17:23:39, on 27/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\windows\system32\nsdsregm.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
O2 - BHO: C:\WINDOWS\system32\zgCrypt.dll - {8A5849C4-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\system32\zgCrypt.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\qwintoed.exe OLI001
O4 - HKLM\..\Run: [AutoSys] C:\WINDOWS\system32\autosys.exe
O4 - HKLM\..\Run: [czpeexk.dll] C:\WINDOWS\system32\rundll32.exe "C:\Documents and Settings\Assya\Local Settings\Application Data\czpeexk.dll",rzqlgze
O4 - HKLM\..\Run: [{52-27-7D-D9-ZN}] c:\windows\system32\nsdsregm.exe OLI001
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [startkey] C:\WINDOWS\system32\vmedia.exe
O4 - HKCU\..\Run: [Recoveru systems] C:\DOCUME~1\Assya\LOCALS~1\Temp\svchost.exe
O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe
O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\qwintoed.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microso...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso...
O17 - HKLM\System\CCS\Services\Tcpip\..\{C43E3DCD-0DDC-4E14-B460-D82FDA36C464}: NameServer = 212.117.129.12 212.117.129.5
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)

Here's the SmitFraudFix repport:
SmitFraudFix v2.131
Scan done at 17:22:35.10, 27/12/2006
Run from C:\Documents and Settings\Assya\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Assya

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Assya\Application Data
C:\Documents and Settings\Assya\Application Data\Install.dat FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Assya\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8A5849C4-93F3-429D-FF34-660A2068897C}"="OpenGL additional"
[HKEY_CLASSES_ROOT\CLSID\{8A5849C4-93F3-429D-FF34-660A2068897C}\InProcServer32]
@="C:\WINDOWS\system32\zgCrypt.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8A5849C4-93F3-429D-FF34-660A2068897C}\InProcServer32]
@="C:\WINDOWS\system32\zgCrypt.dll"
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32
pe386 detected, use a Rootkit scanner
»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

Report Offensive Follow Up For Removal

Response Number 3

Name: jabuck
Date: December 27, 2006 at 07:31:40 Pacific

Reply: (edit)

Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
Once in Safe Mode, open the "SmitfraudFix" folder again and double-click "smitfraudfix.cmd"
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing " Y " and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.
The tool will now check if "wininet.dll " is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing "Y" and press "Enter".
The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt
Please download ComboFix to the desktop from this link:
http://download.bleepingcomputer.com/sUBs/combofix.exe
Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running, it may cause your system to hang.)
Please post the combofix.txt log.

Report Offensive Follow Up For Removal

Response Number 4

Name: Vinzor
Date: December 27, 2006 at 08:07:22 Pacific

Reply: (edit)

Ok, my original desktop pictuire has been replaced to the blue background.

After running "SmitfraudFix" in Safe mode, this's the rapport.txt:
SmitFraudFix v2.131
Scan done at 17:44:08.49, 27/12/2006
Run from C:\Documents and Settings\Assya\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8A5849C4-93F3-429D-FF34-660A2068897C}"="OpenGL additional"
[HKEY_CLASSES_ROOT\CLSID\{8A5849C4-93F3-429D-FF34-660A2068897C}\InProcServer32]
@="C:\WINDOWS\system32\zgCrypt.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8A5849C4-93F3-429D-FF34-660A2068897C}\InProcServer32]
@="C:\WINDOWS\system32\zgCrypt.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
C:\Documents and Settings\Assya\Application Data\Install.dat Deleted
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8A5849C4-93F3-429D-FF34-660A2068897C}"="OpenGL additional"
[HKEY_CLASSES_ROOT\CLSID\{8A5849C4-93F3-429D-FF34-660A2068897C}\InProcServer32]
@="C:\WINDOWS\system32\zgCrypt.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8A5849C4-93F3-429D-FF34-660A2068897C}\InProcServer32]
@="C:\WINDOWS\system32\zgCrypt.dll"
»»»»»»»»»»»»»»»»»»»»»»»» End

This is the combofix.txt log.
Assya - 06-12-27 17:49:42.10 Service Pack 2
ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Assya\Desktop"
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\dwdsregt.exe

((((((((((((((((((((((((((((((( Files Created from 2006-11-27 to 2006-12-27 ))))))))))))))))))))))))))))))))))

2006-12-27 17:22 2,900 --a------ C:\WINDOWS\system32\tmp.reg
2006-12-27 17:01 <DIR> d-------- C:\Program Files\Ultimate Defender
2006-12-27 16:56 45,116 --a------ C:\WINDOWS\system32\nsdsregm.exe
2006-12-27 16:46 184,412 --a------ C:\WINDOWS\system32\qwintoed.exe
2006-12-27 16:38 <DIR> d-------- C:\Program Files\Network Associates
2006-12-27 16:38 <DIR> d-------- C:\Program Files\Common Files\Network Associates
2006-12-27 16:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Network Associates
2006-12-27 15:22 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2006-12-27 14:15 <DIR> d-------- C:\Program Files\Lavasoft
2006-12-27 14:15 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Lavasoft
2006-12-27 13:20 <DIR> d-------- C:\!KillBox
2006-12-27 12:10 <DIR> d-------- C:\Program Files\CleanUp!
2006-12-27 12:05 184,397 --a------ C:\WINDOWS\system32\lwintoed.exe
2006-12-26 23:55 <DIR> d-------- C:\hijackthis
2006-12-26 23:41 73,728 --a------ C:\WINDOWS\system32\out.dll
2006-12-26 23:41 <DIR> d-------- C:\Program Files\micore
2006-12-26 23:41 <DIR> d-------- C:\Program Files\atomwire
2006-12-26 23:41 <DIR> d-------- C:\Program Files\adwarespy
2006-12-26 23:41 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\al
2006-12-26 22:20 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2006-12-26 22:17 <DIR> d-------- C:\Documents and Settings\Assya\.housecall6.6
2006-12-26 21:24 184,450 --a------ C:\WINDOWS\system32\swintoed.exe
2006-12-26 21:15 <DIR> d-------- C:\Program Files\Mozilla Firefox
2006-12-26 21:15 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Mozilla
2006-12-26 20:12 184,445 --a------ C:\WINDOWS\system32\rwintoed.exe
2006-12-26 19:13 184,436 --a------ C:\WINDOWS\system32\mwintoed.exe
2006-12-26 16:39 183,808 --a-s---- C:\WINDOWS\NDNuninstall7_48.exe
2006-12-26 16:38 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Ultimate Cleaner
2006-12-26 16:37 <DIR> d-------- C:\Program Files\Ultimate Cleaner
2006-12-26 16:36 931 --a------ C:\WINDOWS\system32\winpfz32.sys
2006-12-26 16:36 2,981 --a------ C:\WINDOWS\system32\autosys.exe
2006-12-26 16:36 184,409 --a------ C:\WINDOWS\system32\mwinkoed.exe
2006-12-26 16:36 10,000 --a------ C:\WINDOWS\system32\zgCrypt.dll
2006-12-26 16:35 8,464 --a------ C:\WINDOWS\system32\sporder.dll
2006-12-26 16:35 <DIR> d--hs---- C:\WINDOWS\QXNzeWE
2006-12-26 16:35 <DIR> d-------- C:\Program Files\Symantec Technical Support
2006-12-24 20:25 1,240,778 --a------ C:\WINDOWS\system32\vmedia.exe
2006-12-24 20:20 <DIR> d-------- C:\Program Files\FlashGet
2006-12-23 20:12 <DIR> d-------- C:\WINDOWS\Sun
2006-12-23 20:12 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Sun
2006-12-23 20:09 <DIR> d-------- C:\Program Files\Java
2006-12-23 20:05 <DIR> d-------- C:\Program Files\Common Files\Java
2006-12-17 14:14 <DIR> d--h----- C:\WINDOWS\PIF
2006-12-17 13:37 <DIR> d-------- C:\Program Files\RevConnect
2006-12-14 23:07 <DIR> d-------- C:\Program Files\Common Files\xing shared
2006-12-14 23:07 <DIR> d-------- C:\Program Files\Common Files\Real
2006-12-14 23:06 <DIR> d-------- C:\Program Files\Real
2006-12-14 23:06 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Real
2006-12-14 22:56 <DIR> d-------- C:\My Downloads
2006-12-11 12:21 <DIR> d-------- C:\Program Files\BatteryInfo
2006-12-11 11:09 <DIR> d-------- C:\Program Files\Lavalys
2006-12-10 17:03 <DIR> d-------- C:\Program Files\SPDemo
2006-12-09 14:43 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\uTorrent
2006-12-09 14:02 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2006-12-09 11:00 <DIR> d-------- C:\Program Files\Microsoft Visual Studio
2006-12-09 10:22 724,992 --a------ C:\WINDOWS\iun6002.exe
2006-12-09 10:22 <DIR> d-------- C:\Program Files\Lion Heart's Codec Pack
2006-12-08 19:41 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Help
2006-12-08 19:18 <DIR> d-------- C:\Program Files\CronosPlus
2006-12-08 17:37 <DIR> d-------- C:\Program Files\eMule
2006-12-08 15:29 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL
2006-12-08 15:29 <DIR> d-------- C:\Program Files\cladDVD
2006-12-08 15:28 <DIR> d-------- C:\Program Files\ImTOO
2006-12-08 15:03 34,308 --a------ C:\WINDOWS\system32\BASSMOD.dll
2006-12-08 15:03 <DIR> d-------- C:\Program Files\Babylon
2006-12-08 15:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Babylon
2006-12-08 15:02 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Babylon
2006-12-08 14:45 <DIR> d-------- C:\Downloads
2006-12-08 14:44 <DIR> d-------- C:\Program Files\BitComet
2006-12-08 12:36 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2006-12-08 12:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2006-12-08 11:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2006-12-08 10:48 <DIR> d-------- C:\WINDOWS\pss
2006-12-08 10:32 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2006-12-08 10:32 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2006-12-08 10:32 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2006-12-08 10:09 303,104 --a------ C:\WINDOWS\system32\rmparser.dll
2006-12-08 10:09 1,003,520 --a------ C:\WINDOWS\system32\ltmm_n.dll
2006-12-08 10:09 <DIR> d-------- C:\AVOneExport
2006-12-08 10:08 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2006-12-08 10:08 <DIR> d-------- C:\Program Files\Mpgdvd.com
2006-12-08 10:07 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2006-12-08 09:51 <DIR> d-------- C:\WINDOWS\system32\appmgmt
2006-12-08 09:51 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Leadertech
2006-12-08 09:45 <DIR> d-------- C:\Program Files\Adobe
2006-12-08 09:45 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Adobe
2006-12-08 09:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2006-12-08 09:44 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2006-12-08 09:39 <DIR> d-------- C:\Program Files\Common Files\Adobe
2006-12-08 09:33 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Macromedia
2006-12-08 09:31 26,496 --a------ C:\WINDOWS\system32\drivers\USBSTOR.SYS
2006-12-08 00:46 127,208 --a------ C:\WINDOWS\system32\mucltui.dll
2006-12-07 23:26 56 -r-hs---- C:\WINDOWS\system32\38F032101D.sys
2006-12-07 23:26 1,682 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2006-12-07 23:26 <DIR> d-------- C:\Program Files\DivX
2006-12-07 23:10 <DIR> d-------- C:\Program Files\XVid;-)
2006-12-07 23:10 <DIR> d-------- C:\Program Files\XviD
2006-12-07 22:59 <DIR> d-------- C:\Program Files\ICQLite
2006-12-07 22:59 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\ICQLite
2006-12-07 22:47 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Ahead
2006-12-07 22:46 569,344 --a------ C:\WINDOWS\system32\imagr5.dll
2006-12-07 22:46 544,768 --a------ C:\WINDOWS\system32\imagx5.dll
2006-12-07 22:46 5,632 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys
2006-12-07 22:46 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2006-12-07 22:46 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll
2006-12-07 22:46 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2006-12-07 22:46 113,664 --a------ C:\WINDOWS\system32\drivers\imagesrv.sys
2006-12-07 22:46 <DIR> d-------- C:\Program Files\Common Files\Ahead
2006-12-07 22:46 <DIR> d-------- C:\Program Files\Ahead
2006-12-07 22:41 24,816 --a------ C:\WINDOWS\system32\mdimon.dll
2006-12-07 22:39 <DIR> d-------- C:\Program Files\Microsoft.NET
2006-12-07 22:39 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2006-12-07 22:38 <DIR> d-------- C:\Program Files\Common Files\DESIGNER
2006-12-07 22:37 <DIR> d-------- C:\WINDOWS\SHELLNEW
2006-12-07 22:37 <DIR> d-------- C:\Program Files\Microsoft Office
2006-12-07 22:35 <DIR> dr-h----- C:\MSOCache
2006-12-07 21:21 <DIR> d-------- C:\Program Files\WinZip
2006-12-07 21:17 <DIR> d-------- C:\Program Files\Webteh
2006-12-07 20:34 <DIR> d-------- C:\WINDOWS\system32\ReinstallBackups
2006-12-07 20:34 <DIR> d-------- C:\Program Files\Microsoft IntelliPoint 6.02
2006-12-07 20:34 <DIR> d-------- C:\Program Files\Microsoft IntelliPoint
2006-12-07 20:31 <DIR> d-------- C:\Program Files\Microsoft IntelliType Pro 6.02
2006-12-07 20:24 6,144 -ra------ C:\WINDOWS\system32\kbdth3.dll
2006-12-07 20:24 6,144 -ra------ C:\WINDOWS\system32\kbdth2.dll
2006-12-07 20:24 6,144 -ra------ C:\WINDOWS\system32\kbdinpun.dll
2006-12-07 20:24 6,144 --a------ C:\WINDOWS\system32\ftlx041e.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdvntc.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdurdu.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdth1.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdth0.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdsyr2.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdsyr1.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdintel.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdintam.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinmar.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinkan.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinhin.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinguj.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdindev.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdheb.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdfa.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbddiv2.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbddiv1.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbda3.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbda2.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbda1.dll
2006-12-07 20:24 5,632 --a------ C:\WINDOWS\system32\kbdusa.dll
2006-12-07 20:24 5,120 -ra------ C:\WINDOWS\system32\kbdgeo.dll
2006-12-07 20:24 5,120 -ra------ C:\WINDOWS\system32\kbdarmw.dll
2006-12-07 20:24 5,120 -ra------ C:\WINDOWS\system32\kbdarme.dll
2006-12-07 20:24 185,344 --a------ C:\WINDOWS\system32\Thawbrkr.dll
2006-12-07 20:24 10,752 --a------ C:\WINDOWS\system32\c_iscii.dll
2006-12-07 20:12 18,200 --a------ C:\WINDOWS\system32\wups2.dll
2006-12-07 20:12 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2006-12-07 20:10 <DIR> d---s---- C:\Documents and Settings\Assya\UserData
2006-12-07 20:06 306,688 --a------ C:\WINDOWS\IsUninst.exe
2006-12-07 20:05 <DIR> d-------- C:\Program Files\Symantec
2006-12-07 20:05 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Symantec
2006-12-07 20:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2006-12-07 20:04 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2006-12-07 20:00 <DIR> d-------- C:\Program Files\WinRAR
2006-12-07 19:56 <DIR> d--hs---- C:\RECYCLER
2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\SendTo
2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\Recent
2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\Application Data\.
2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\Application Data
2006-12-07 19:45 <DIR> dr------- C:\Documents and Settings\Assya\Start Menu
2006-12-07 19:45 <DIR> dr------- C:\Documents and Settings\Assya\My Documents
2006-12-07 19:45 <DIR> dr------- C:\Documents and Settings\Assya\Favorites
2006-12-07 19:45 <DIR> d--h----- C:\Program Files\Uninstall Information
2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\Templates
2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\PrintHood
2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\NetHood
2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\Local Settings
2006-12-07 19:45 <DIR> d---s---- C:\Documents and Settings\Assya\Cookies
2006-12-07 19:45 <DIR> d---s---- C:\Documents and Settings\Assya\Application Data\Microsoft
2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\Desktop
2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Identities
2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\..
2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\..
2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\.
2006-12-07 19:44 <DIR> d---s---- C:\WINDOWS\system32\Microsoft
2006-12-07 19:44 <DIR> d-------- C:\WINDOWS\SoftwareDistribution
2006-12-07 19:44 <DIR> d-------- C:\WINDOWS\Prefetch
2006-12-07 19:38 0 -rahs---- C:\MSDOS.SYS
2006-12-07 19:38 0 -rahs---- C:\IO.SYS
2006-12-07 19:38 0 --a------ C:\CONFIG.SYS
2006-12-07 19:38 0 --a------ C:\AUTOEXEC.BAT
2006-12-07 19:38 <DIR> d-------- C:\WINDOWS\system32\xircom
2006-12-07 19:38 <DIR> d-------- C:\Program Files\xerox
2006-12-07 19:38 <DIR> d-------- C:\Program Files\microsoft frontpage
2006-12-07 19:37 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2006-12-07 19:36 <DIR> dr------- C:\WINDOWS\Offline Web Pages
2006-12-07 19:36 <DIR> d--hs---- C:\Documents and Settings\All Users\DRM
2006-12-07 19:36 <DIR> d--h----- C:\Program Files\WindowsUpdate
2006-12-07 19:36 <DIR> d---s---- C:\WINDOWS\Downloaded Program Files
2006-12-07 19:35 64,512 --a------ C:\WINDOWS\system32\acctres.dll
2006-12-07 19:35 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2006-12-07 19:35 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2006-12-07 19:35 <DIR> d-------- C:\WINDOWS\system32\DirectX
2006-12-07 19:35 <DIR> d-------- C:\Program Files\Common Files\Services
2006-12-07 19:34 81,920 --a------ C:\WINDOWS\system32\isign32.dll
2006-12-07 19:34 81,920 --a------ C:\WINDOWS\system32\ils.dll
2006-12-07 19:34 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll
2006-12-07 19:34 73,728 --a------ C:\WINDOWS\system32\icwdial.dll
2006-12-07 19:34 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys
2006-12-07 19:34 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2006-12-07 19:34 69,632 --a------ C:\WINDOWS\system32\msconf.dll
2006-12-07 19:34 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-12-07 19:34 67,584 --a------ C:\WINDOWS\system32\srclient.dll
2006-12-07 19:34 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll
2006-12-07 19:34 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll
2006-12-07 19:34 48,128 --a------ C:\WINDOWS\system32\inetres.dll
2006-12-07 19:34 465,176 --a------ C:\WINDOWS\system32\wuapi.dll
2006-12-07 19:34 45,568 --a------ C:\WINDOWS\system32\safrslv.dll
2006-12-07 19:34 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2006-12-07 19:34 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll
2006-12-07 19:34 41,240 --a------ C:\WINDOWS\system32\wups.dll
2006-12-07 19:34 382,464 --a------ C:\WINDOWS\system32\qmgr.dll
2006-12-07 19:34 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll
2006-12-07 19:34 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2006-12-07 19:34 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll
2006-12-07 19:34 29,696 --a------ C:\WINDOWS\system32\safrdm.dll
2006-12-07 19:34 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll
2006-12-07 19:34 274,944 --a------ C:\WINDOWS\system32\mstask.dll
2006-12-07 19:34 274,432 --a------ C:\WINDOWS\system32\inetcfg.dll
2006-12-07 19:34 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll
2006-12-07 19:34 239,104 --a------ C:\WINDOWS\system32\srrstr.dll
2006-12-07 19:34 23,040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-12-07 19:34 194,328 --a------ C:\WINDOWS\system32\wuaueng1.dll
2006-12-07 19:34 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll
2006-12-07 19:34 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2006-12-07 19:34 173,536 --a------ C:\WINDOWS\system32\wuweb.dll
2006-12-07 19:34 172,312 --a------ C:\WINDOWS\system32\wuauclt1.exe
2006-12-07 19:34 170,496 --a------ C:\WINDOWS\system32\srsvc.dll
2006-12-07 19:34 16,896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-12-07 19:34 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2006-12-07 19:34 128,896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys
2006-12-07 19:34 127,256 --a------ C:\WINDOWS\system32\wucltui.dll
2006-12-07 19:34 124,184 --a------ C:\WINDOWS\system32\wuauclt.exe
2006-12-07 19:34 12,288 --a------ C:\WINDOWS\system32\mstinit.exe
2006-12-07 19:34 105,984 --a------ C:\WINDOWS\system32\msoert2.dll
2006-12-07 19:34 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll
2006-12-07 19:34 <DIR> d---s---- C:\WINDOWS\Tasks
2006-12-07 19:34 <DIR> d-------- C:\WINDOWS\system32\Restore
2006-12-07 19:34 <DIR> d-------- C:\WINDOWS\system32\Macromed
2006-12-07 19:34 <DIR> d-------- C:\WINDOWS\srchasst
2006-12-07 19:34 <DIR> d-------- C:\Program Files\Outlook Express
2006-12-07 19:34 <DIR> d-------- C:\Program Files\NetMeeting
2006-12-07 19:34 <DIR> d-------- C:\Program Files\Movie Maker
2006-12-07 19:34 <DIR> d-------- C:\Program Files\Internet Explorer
2006-12-07 19:34 <DIR> d-------- C:\Program Files\Common Files\System
2006-12-07 19:34 <DIR> d-------- C:\Program Files\Common Files\MSSoap
2006-12-07 19:33 <DIR> d-------- C:\WINDOWS\Registration
2006-12-07 19:33 <DIR> d-------- C:\Program Files\ComPlus Applications
2006-12-07 19:32 97,792 --a------ C:\WINDOWS\system32\comrepl.dll
2006-12-07 19:32 9,728 --a------ C:\WINDOWS\system32\reset.exe
2006-12-07 19:32 80,384 --a------ C:\WINDOWS\system32\charmap.exe
2006-12-07 19:32 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2006-12-07 19:32 605,696 --a------ C:\WINDOWS\system32\getuname.dll
2006-12-07 19:32 56,832 --a------ C:\WINDOWS\system32\sol.exe
2006-12-07 19:32 55,296 --a------ C:\WINDOWS\system32\freecell.exe
2006-12-07 19:32 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2006-12-07 19:32 5,632 --a------ C:\WINDOWS\system32\write.exe
2006-12-07 19:32 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2006-12-07 19:32 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2006-12-07 19:32 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2006-12-07 19:32 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2006-12-07 19:32 35,328 --a------ C:\WINDOWS\system32\winchat.exe
2006-12-07 19:32 347,136 --a------ C:\WINDOWS\system32\hypertrm.dll
2006-12-07 19:32 33,792 --a------ C:\WINDOWS\system32\regini.exe
2006-12-07 19:32 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2006-12-07 19:32 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2006-12-07 19:32 227,840 --a------ C:\WINDOWS\system32\avtapi.dll
2006-12-07 19:32 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe
2006-12-07 19:32 20,992 --a------ C:\WINDOWS\system32\msg.exe
2006-12-07 19:32 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2006-12-07 19:32 183,808 --a------ C:\WINDOWS\system32\accwiz.exe
2006-12-07 19:32 16,896 --a------ C:\WINDOWS\system32\tsshutdn.exe
2006-12-07 19:32 16,896 --a------ C:\WINDOWS\system32\qappsrv.exe
2006-12-07 19:32 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2006-12-07 19:32 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2006-12-07 19:32 15,872 --a------ C:\WINDOWS\system32\rwinsta.exe
2006-12-07 19:32 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2006-12-07 19:32 15,360 --a------ C:\WINDOWS\system32\logoff.exe
2006-12-07 19:32 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2006-12-07 19:32 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe
2006-12-07 19:32 14,848 --a------ C:\WINDOWS\system32\tscon.exe
2006-12-07 19:32 14,848 --a------ C:\WINDOWS\system32\shadow.exe
2006-12-07 19:32 138,752 --a------ C:\WINDOWS\system32\sndvol32.exe
2006-12-07 19:32 131,584 --a------ C:\WINDOWS\system32\sndrec32.exe
2006-12-07 19:32 126,976 --a------ C:\WINDOWS\system32\mshearts.exe
2006-12-07 19:32 123,392 --a------ C:\WINDOWS\system32\mplay32.exe
2006-12-07 19:32 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2006-12-07 19:32 114,688 --a------ C:\WINDOWS\system32\calc.exe
2006-12-07 19:32 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd
2006-12-07 19:32 <DIR> d-------- C:\Program Files\Windows Media Player
2006-12-07 19:32 <DIR> d-------- C:\Program Files\Online Services
2006-12-07 19:32 <DIR> d-------- C:\Program Files\MSN Gaming Zone
2006-12-07 19:32 <DIR> d-------- C:\Program Files\MSN
2006-12-07 19:32 <DIR> d-------- C:\Program Files\Messenger
2006-12-07 19:31 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll
2006-12-07 19:31 93,696 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2006-12-07 19:31 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll
2006-12-07 19:31 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll
2006-12-07 19:31 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2006-12-07 19:31 67,072 --a------ C:\WINDOWS\system32\rdshost.exe
2006-12-07 19:31 655,360 --a------ C:\WINDOWS\system32\mstscax.dll
2006-12-07 19:31 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll
2006-12-07 19:31 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe
2006-12-07 19:31 60,416 --a------ C:\WINDOWS\system32\remotepg.dll
2006-12-07 19:31 60,416 --a------ C:\WINDOWS\system32\colbact.dll
2006-12-07 19:31 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2006-12-07 19:31 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll
2006-12-07 19:31 58,880 --a------ C:\WINDOWS\system32\licwmi.dll
2006-12-07 19:31 56,320 --a------ C:\WINDOWS\system32\servdeps.dll
2006-12-07 19:31 540,160 --a------ C:\WINDOWS\system32\comuid.dll
2006-12-07 19:31 538,624 --a------ C:\WINDOWS\system32\spider.exe
2006-12-07 19:31 498,688 --a------ C:\WINDOWS\system32\clbcatq.dll
2006-12-07 19:31 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe
2006-12-07 19:31 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll
2006-12-07 19:31 407,552 --a------ C:\WINDOWS\system32\mstsc.exe
2006-12-07 19:31 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2006-12-07 19:31 38,912 --a------ C:\WINDOWS\system32\cfgbkend.dll
2006-12-07 19:31 343,040 --a------ C:\WINDOWS\system32\mspaint.exe
2006-12-07 19:31 295,424 --a------ C:\WINDOWS\system32\termsrv.dll
2006-12-07 19:31 225,792 --a------ C:\WINDOWS\system32\catsrv.dll
2006-12-07 19:31 21,896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2006-12-07 19:31 20,480 --a------ C:\WINDOWS\system32\qprocess.exe
2006-12-07 19:31 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2006-12-07 19:31 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll
2006-12-07 19:31 185,344 --a------ C:\WINDOWS\system32\cmprops.dll
2006-12-07 19:31 17,408 --a------ C:\WINDOWS\system32\mmfutil.dll
2006-12-07 19:31 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2006-12-07 19:31 147,968 --a------ C:\WINDOWS\system32\rdchost.dll
2006-12-07 19:31 140,800 --a------ C:\WINDOWS\system32\sessmgr.exe
2006-12-07 19:31 139,528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2006-12-07 19:31 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe
2006-12-07 19:31 12,040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2006-12-07 19:31 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll
2006-12-07 19:31 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll
2006-12-07 19:31 11,264 --a------ C:\WINDOWS\system32\icaapi.dll
2006-12-07 19:31 102,912 --a------ C:\WINDOWS\system32\clipbrd.exe
2006-12-07 19:31 1,267,200 --a------ C:\WINDOWS\system32\comsvcs.dll
2006-12-07 19:31 <DIR> d-------- C:\WINDOWS\system32\MsDtc
2006-12-07 19:31 <DIR> d-------- C:\WINDOWS\system32\Com
2006-12-07 19:31 <DIR> d-------- C:\Program Files\Windows NT

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
[color=red][b]Rootkit driver pe386 is present. A rootkit scan is required[/b][/color]
2006-12-27 16:38 -------- d-------- C:\Program Files\Common Files
2006-12-27 15:22 2560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2006-12-09 11:04 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-12-08 14:45 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll
2006-12-07 17:02 2174976 --a------ C:\WINDOWS\system32\wmvcore.dll
2006-10-19 15:56 713216 --a------ C:\WINDOWS\system32\sxs.dll
2006-10-13 14:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll
2006-10-13 14:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll
2006-10-13 14:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"startkey"="C:\\WINDOWS\\system32\\vmedia.exe"
"Recoveru systems"="C:\\DOCUME~1\\Assya\\LOCALS~1\\Temp\\svchost.exe"
"Aapp"=""
"network administration"=""
"profile"=""
"execution"=""
"WinDisk32"=""
"bawindo"=""
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\Ultimate Defender.install]
@="\"C:\\Documents and Settings\\Assya\\Local Settings\\Temporary Internet Files\\Content.IE5\\12F12OG8\\udefender_eE28o2QRe8[1].exe\" continue"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\ipoint.exe\""
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"Babylon Client"="C:\\Program Files\\Babylon\\Babylon-Pro\\Babylon.exe -AutoStart"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\""
"AutoSys"="C:\\WINDOWS\\system32\\autosys.exe"
"czpeexk.dll"="C:\\WINDOWS\\system32\\rundll32.exe \"C:\\Documents and Settings\\Assya\\Local Settings\\Application Data\\czpeexk.dll\",rzqlgze"
"{52-27-7D-D9-ZN}"="C:\\windows\\system32\\nsdsregm.exe OLI001"
"ShStatEXE"="\"C:\\Program Files\\Network Associates\\VirusScan\\SHSTAT.EXE\" /STANDALONE"
"McAfeeUpdaterUI"="\"C:\\Program Files\\Network Associates\\Common Framework\\UpdaterUI.exe\""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{8A5849C4-93F3-429D-FF34-660A2068897C}"="OpenGL additional"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoRun"=dword:00000000
"NoClose"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
backup-20061227-142927-303
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
backup-20061227-142927-135
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
backup-20061227-142927-321
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
backup-20061227-142927-598
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
backup-20061227-142927-432
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
backup-20061227-142927-818
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
backup-20061227-140941-100
O17 - HKLM\System\CCS\Services\Tcpip\..\{C43E3DCD-0DDC-4E14-B460-D82FDA36C464}: NameServer = 212.117.129.12 212.117.129.5
backup-20061227-140941-228
O2 - BHO: C:\WINDOWS\system32\zgCrypt.dll - {8A5849C4-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\system32\zgCrypt.dll
backup-20061227-140941-125
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
backup-20061227-140941-939
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
backup-20061227-140941-261
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
backup-20061227-140941-762
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
backup-20061227-140940-346
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
backup-20061227-140941-481
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
backup-20061227-122834-881
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
backup-20061227-122834-942
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
backup-20061227-122834-119
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
backup-20061227-122834-259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
backup-20061227-122834-864
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
backup-20061227-122834-495
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Symantec NetDetect.job
Completion time: 06-12-27 17:50:47.98
C:\ComboFix.txt ... 06-12-27 17:50

Report Offensive Follow Up For Removal

Response Number 5

Name: jabuck
Date: December 27, 2006 at 08:22:35 Pacific

Reply: (edit)

Go to start> control panel> display> desktop> customize desktop> web> and remove all entries except "my current home page " unless you put them in there.
Once removed restart the computer and let me know if anything was in there.

Report Offensive Follow Up For Removal


Activity Logger 2.0 and More Help!! Trojan Downloader How to setup good Security? NIS 2004 and MSN dial up problem Pc boot problem and other queries	Help - homepage hijacked and more.. spyaxe problems..... My space bar does not work and more Virus problem: iworm_attck_v122.02a Error in msvcrt.dll, and others...

Response Number 6

Name: Vinzor
Date: December 27, 2006 at 08:29:12 Pacific

Reply: (edit)

There's nothing there to remove. It's empty.

Report Offensive Follow Up For Removal

Response Number 7

Name: jabuck
Date: December 27, 2006 at 08:46:06 Pacific

Reply: (edit)

Ok, you have a rootkit, we will see if sdfix will remove it but first do the following:
Go to start> control panel > add/remove programs and uninstall these programs if found:
Ultimate Defender
adwarespy
Zenosearch
Zeno Search Assistant removal
Webhancer
Next restart the computer.
Please download SDFix by AndyManchesta and save it to your desktop.
Please then reboot your computer in Safe Mode by doing the following:
Restart your computer.
After hearing your computer beep once during startup, but just before the Windows icon appears, tap the F8 key continually.
Instead of Windows loading as normal, a menu with options should appear.
Select the first option, to run Windows in "Safe Mode", then press "Enter".
Choose your usual account.

Once in Safe Mode, please do the following:
In Safe Mode, right-click the SDFix.zip folder and choose Extract All.
Open the extracted folder and double-click RunThis.bat to start the script.
Type Y to begin the script.
It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
Your system will take longer that normal to restart as the fixtool will be running and removing files.
When the desktop loads the fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt

Report Offensive Follow Up For Removal

Response Number 8

Name: Vinzor
Date: December 27, 2006 at 12:27:46 Pacific

Reply: (edit)

Sorry for the delay...
Still get the error message "can't find secure32.html" when launching Internet Explorer.

Here's the SDFix log file:

SDFix: Version 1.52
****************
27/12/2006 - 22:19:11.33
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\DOCUME~1\Assya\Desktop\SDFix\SDFix
Stage One - Safe Mode
Checking Services...
Service Name:
MsaSvc
File Path:
C:\WINDOWS\system32\msasvc.exe
MsaSvc Deleted...
Starting Registry Repairs...

Restoring Default Hosts File...

Stage One Complete

Rebooting...

Stage Two - Normal Mode

Checking For Malware:
--------------------

C:\RECYCLER\NPROTECT\00044164.T
C:\RECYCLER\NPROTECT\00048072.T
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\system32\plugin1.dat
C:\WINDOWS\system32\SysPr.prx

Backing Up and Removing any Files Found...
Alternate Stream Check:
C:\WINDOWS\system32
No streams found.
Final Check:
Remaining Services:
------------------
[COLOR=RED][B]Rootkit PE386 Found![/COLOR]. Rootkit scan Needed...[/B]
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

Remaining Files:
---------------
Backups Folder: - C:\DOCUME~1\Assya\Desktop\SDFix\SDFix\backups\backups.zip
Checking for files with Hidden Attributes:
C:\WINDOWS\QXNzeWE\asappsrv.dll
C:\RECYCLER\NPROTECT\00048110.EXE
C:\WINDOWS\QXNzeWE\command.exe
C:\WINDOWS\system32\cdplayer.exe.manifest
C:\WINDOWS\system32\logonui.exe.manifest
C:\hiberfil.sys
C:\IO.SYS
C:\MSDOS.SYS
C:\pagefile.sys
C:\WINDOWS\system32\38F032101D.sys
C:\WINDOWS\system32\KGyGaAvL.sys
FINISHED!

Report Offensive Follow Up For Removal

Response Number 9

Name: jabuck
Date: December 27, 2006 at 12:59:16 Pacific

Reply: (edit)

Please download ATF-Cleaner to your desktop from this link
http://www.atribune.org/content/view/19/2/ We will need it later in safe mode
Download and install AVG Anti-Spyware We will need this later in safe mode
Be sure to update AVG Anti- Spyware
Download Killbox to your desktop from this link Killbox by Option^Explicit. If you already have "Killbox" update to this newer version. We will need it later in safe mode
Please download Dr Web CureIt to your desktop from this link ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe We will run this later also
Reboot into safe mode again.
Run hijack This from safe mode, close all windows except Hijack This, place check in the box to the left of then following items then press "fix checked":
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
O2 - BHO: C:\WINDOWS\system32\zgCrypt.dll - {8A5849C4-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\system32\zgCrypt.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [AutoSys] C:\WINDOWS\system32\autosys.exe
O4 - HKLM\..\Run: [czpeexk.dll] C:\WINDOWS\system32\rundll32.exe "C:\Documents and Settings\Assya\Local Settings\Application Data\czpeexk.dll",rzqlgze
O4 - HKLM\..\Run: [{52-27-7D-D9-ZN}] c:\windows\system32\nsdsregm.exe OLI001
O4 - HKCU\..\Run: [startkey] C:\WINDOWS\system32\vmedia.exe
O4 - HKCU\..\Run: [Recoveru systems] C:\DOCUME~1\Assya\LOCALS~1\Temp\svchost.exe
O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe
O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\qwintoed.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)
Exit Hijack This but remain in safe mode.
Run Killbox from safe mode.Please double-click Killbox.exe to run it.
Select:
Delete on Reboot
then Click on the All Files button.
Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
c:\secure32.html
C:\WINDOWS\system32\zgCrypt.dll
C:\WINDOWS\system32\autosys.exe
C:\Documents and Settings\Assya\Local Settings\Application Data\czpeexk.dll,rzqlgze
C:\Documents and Settings\Assya\Local Settings\Application Data\czpeexk.dll
c:\windows\system32\nsdsregm.exe
C:\WINDOWS\system32\vmedia.exe
C:\WINDOWS\system32\dwdsregt.exe
C:\WINDOWS\system32\qwintoed.exe
C:\WINDOWS\iun6002.exe
Return to Killbox, go to the File menu, and choose Paste from Clipboard.

Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let us know if you receive this message!).
If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click Here to download and run missingfilesetup.exe. Then try Killbox again.
Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.
Reboot into safe mode.
Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

In Safe Mode, run AVG Anti-spyware and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared.
AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side.
Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop).
Doubleclick the drweb-cureit.exe file and Allow to run the express scan.
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it.
This is only a short scan.
Once the short scan has finished, mark the drives that you want to scan.
Select all drives.
A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click 'Yes to all' if it asks if you want to cure/move the file.
When the scan has finished, look if you can click next icon next to the files found:
If so, click it and then click the next icon right below and select Move incurable.
This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.
Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
After reboot, post the contents of the log on your desktop.
There will be more work to do. Post the AVG Anti-Spyware and DR Web Cureit log the post a Combofix log and a Hijack This log in the order they were requested please.

Report Offensive Follow Up For Removal

Response Number 10

Name: Vinzor
Date: December 28, 2006 at 00:08:50 Pacific

Reply: (edit)

Hi there, hope i understood in what order you want me to post.
I did what you wrote in the last post:
Safe mode: Hijack this - fixed all besides these 2 things, I didn't find:
O4 - HKCU\..\Run: [startkey] C:\WINDOWS\system32\vmedia.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)

then Killbox - didn't get any PendingFileRenameOperations prompt there (and didn't receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox).
After rebooting (again) in Safe mode ran ATF-Cleaner, AVG Anti-spyware and finally drweb-cureit.
Here're the logs.
AVG Anti-Spyware log:

AVG Anti-Spyware - Scan Report

+ Created at: 00:43:08 28/12/2006
+ Scan result:
C:\WINDOWS\QXNzeWE\asappsrv.dll -> Adware.CommAd : Cleaned with backup (quarantined).
C:\WINDOWS\QXNzeWE\command.exe -> Adware.CommAd : Cleaned with backup (quarantined).
HKU\S-1-5-21-1644491937-813497703-1060284298-1003\CLSID\{6AE02E1C-8859-4F57-9097-5A55A56A4CAF} -> Adware.MyTool : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00043605.EXE -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\WINDOWS\NDNuninstall7_48.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00043655.exe -> Adware.SurfAcc : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00043818.exe -> Adware.SurfAccuracy : Cleaned with backup (quarantined).
C:\!KillBox\dwdsregt.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined).
C:\!KillBox\nsdsregm.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00043678.EXE -> Adware.ZenoSearch : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00043681.EXE -> Adware.ZenoSearch : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00043917.EXE -> Adware.ZenoSearch : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00044081.EXE -> Adware.ZenoSearch : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00044480.EXE -> Adware.ZenoSearch : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00047800.EXE -> Adware.ZenoSearch : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00048261.EXE -> Adware.ZenoSearch : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00048264.EXE -> Adware.ZenoSearch : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00043628.EXE -> Dialer.GBDialer.i : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00043752.dll -> Downloader.IstBar.pb : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00043634.EXE -> Downloader.Small.dgk : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00043637.EXE -> Not-A-Virus.Hoax.Win32.Renos.fl : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00043572.EXE -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined).
C:\WINDOWS\system32\protector.exe -> Proxy.Wopla.ac : Cleaned with backup (quarantined).
C:\WINDOWS\system32\ntio256.sys -> Rootkit.Agent.cf : Cleaned with backup (quarantined).
:mozilla.10:C:\RECYCLER\NPROTECT\00047599.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.10:C:\RECYCLER\NPROTECT\00047602.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.10:C:\RECYCLER\NPROTECT\00047603.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.10:C:\RECYCLER\NPROTECT\00047604.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.10:C:\RECYCLER\NPROTECT\00047610.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.10:C:\RECYCLER\NPROTECT\00047612.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.10:C:\RECYCLER\NPROTECT\00047616.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.10:C:\RECYCLER\NPROTECT\00047620.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.10:C:\RECYCLER\NPROTECT\00047623.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.14:C:\RECYCLER\NPROTECT\00047630.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.14:C:\RECYCLER\NPROTECT\00047633.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.28:C:\RECYCLER\NPROTECT\00047659.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.31:C:\RECYCLER\NPROTECT\00047635.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.31:C:\RECYCLER\NPROTECT\00047648.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.7:C:\RECYCLER\NPROTECT\00047590.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.9:C:\RECYCLER\NPROTECT\00047592.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.9:C:\RECYCLER\NPROTECT\00047595.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.9:C:\RECYCLER\NPROTECT\00047597.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.9:C:\RECYCLER\NPROTECT\00047658.MOZ -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.10:C:\RECYCLER\NPROTECT\00047658.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.13:C:\RECYCLER\NPROTECT\00047630.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.13:C:\RECYCLER\NPROTECT\00047633.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.29:C:\RECYCLER\NPROTECT\00047659.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.32:C:\RECYCLER\NPROTECT\00047635.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.32:C:\RECYCLER\NPROTECT\00047648.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.6:C:\RECYCLER\NPROTECT\00047590.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.8:C:\RECYCLER\NPROTECT\00047592.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.8:C:\RECYCLER\NPROTECT\00047595.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.8:C:\RECYCLER\NPROTECT\00047597.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.9:C:\RECYCLER\NPROTECT\00047599.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.9:C:\RECYCLER\NPROTECT\00047602.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.9:C:\RECYCLER\NPROTECT\00047603.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.9:C:\RECYCLER\NPROTECT\00047604.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.9:C:\RECYCLER\NPROTECT\00047610.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.9:C:\RECYCLER\NPROTECT\00047612.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.9:C:\RECYCLER\NPROTECT\00047616.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.9:C:\RECYCLER\NPROTECT\00047620.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.9:C:\RECYCLER\NPROTECT\00047623.MOZ -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.12:C:\RECYCLER\NPROTECT\00047630.MOZ -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.12:C:\RECYCLER\NPROTECT\00047633.MOZ -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.30:C:\RECYCLER\NPROTECT\00047635.MOZ -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.30:C:\RECYCLER\NPROTECT\00047648.MOZ -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.30:C:\RECYCLER\NPROTECT\00047659.MOZ -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.8:C:\RECYCLER\NPROTECT\00047623.MOZ -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.8:C:\RECYCLER\NPROTECT\00047658.MOZ -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.14:C:\RECYCLER\NPROTECT\00044738.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.15:C:\RECYCLER\NPROTECT\00044738.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.15:C:\RECYCLER\NPROTECT\00044742.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.16:C:\RECYCLER\NPROTECT\00044738.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.16:C:\RECYCLER\NPROTECT\00044742.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.16:C:\RECYCLER\NPROTECT\00044745.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.17:C:\RECYCLER\NPROTECT\00044738.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.17:C:\RECYCLER\NPROTECT\00044742.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.17:C:\RECYCLER\NPROTECT\00044745.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.18:C:\RECYCLER\NPROTECT\00044742.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.18:C:\RECYCLER\NPROTECT\00044745.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.19:C:\RECYCLER\NPROTECT\00044745.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.35:C:\RECYCLER\NPROTECT\00044748.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.35:C:\RECYCLER\NPROTECT\00044754.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.35:C:\RECYCLER\NPROTECT\00044780.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.35:C:\RECYCLER\NPROTECT\00044783.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.35:C:\RECYCLER\NPROTECT\00044790.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.35:C:\RECYCLER\NPROTECT\00044792.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.35:C:\RECYCLER\NPROTECT\00044820.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.35:C:\RECYCLER\NPROTECT\00044826.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.35:C:\RECYCLER\NPROTECT\00047097.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.35:C:\RECYCLER\NPROTECT\00047589.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.36:C:\RECYCLER\NPROTECT\00044748.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.36:C:\RECYCLER\NPROTECT\00044754.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.36:C:\RECYCLER\NPROTECT\00044780.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.36:C:\RECYCLER\NPROTECT\00044783.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.36:C:\RECYCLER\NPROTECT\00044790.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.36:C:\RECYCLER\NPROTECT\00044792.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.36:C:\RECYCLER\NPROTECT\00044820.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.36:C:\RECYCLER\NPROTECT\00044826.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.36:C:\RECYCLER\NPROTECT\00044829.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.36:C:\RECYCLER\NPROTECT\00044830.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.36:C:\RECYCLER\NPROTECT\00047097.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.36:C:\RECYCLER\NPROTECT\00047589.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.37:C:\RECYCLER\NPROTECT\00044748.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.37:C:\RECYCLER\NPROTECT\00044754.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.37:C:\RECYCLER\NPROTECT\00044780.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.37:C:\RECYCLER\NPROTECT\00044783.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.37:C:\RECYCLER\NPROTECT\00044790.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.37:C:\RECYCLER\NPROTECT\00044792.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.37:C:\RECYCLER\NPROTECT\00044820.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.37:C:\RECYCLER\NPROTECT\00044826.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.37:C:\RECYCLER\NPROTECT\00044829.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.37:C:\RECYCLER\NPROTECT\00044830.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.37:C:\RECYCLER\NPROTECT\00044833.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.37:C:\RECYCLER\NPROTECT\00044835.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.37:C:\RECYCLER\NPROTECT\00046756.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.37:C:\RECYCLER\NPROTECT\00047097.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.37:C:\RECYCLER\NPROTECT\00047589.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.37:C:\RECYCLER\NPROTECT\00047590.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.38:C:\RECYCLER\NPROTECT\00044748.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.38:C:\RECYCLER\NPROTECT\00044754.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.38:C:\RECYCLER\NPROTECT\00044780.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.38:C:\RECYCLER\NPROTECT\00044783.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.38:C:\RECYCLER\NPROTECT\00044790.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.38:C:\RECYCLER\NPROTECT\00044792.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.38:C:\RECYCLER\NPROTECT\00044820.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.38:C:\RECYCLER\NPROTECT\00044826.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.38:C:\RECYCLER\NPROTECT\00044829.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.38:C:\RECYCLER\NPROTECT\00044830.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.38:C:\RECYCLER\NPROTECT\00044833.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.38:C:\RECYCLER\NPROTECT\00044835.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.38:C:\RECYCLER\NPROTECT\00046756.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.38:C:\RECYCLER\NPROTECT\00047097.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.38:C:\RECYCLER\NPROTECT\00047589.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.38:C:\RECYCLER\NPROTECT\00047590.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.39:C:\RECYCLER\NPROTECT\00044829.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.39:C:\RECYCLER\NPROTECT\00044830.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.39:C:\RECYCLER\NPROTECT\00044833.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.39:C:\RECYCLER\NPROTECT\00044835.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.39:C:\RECYCLER\NPROTECT\00046756.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.39:C:\RECYCLER\NPROTECT\00047590.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.39:C:\RECYCLER\NPROTECT\00047592.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.39:C:\RECYCLER\NPROTECT\00047595.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.39:C:\RECYCLER\NPROTECT\00047597.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.39:C:\RECYCLER\NPROTECT\00047599.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.39:C:\RECYCLER\NPROTECT\00047602.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.39:C:\RECYCLER\NPROTECT\00047603.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.39:C:\RECYCLER\NPROTECT\00047604.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.39:C:\RECYCLER\NPROTECT\00047610.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.39:C:\RECYCLER\NPROTECT\00047612.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.39:C:\RECYCLER\NPROTECT\00047616.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.39:C:\RECYCLER\NPROTECT\00047620.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.40:C:\RECYCLER\NPROTECT\00044833.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.40:C:\RECYCLER\NPROTECT\00044835.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.40:C:\RECYCLER\NPROTECT\00046756.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.40:C:\RECYCLER\NPROTECT\00047590.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.40:C:\RECYCLER\NPROTECT\00047592.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.40:C:\RECYCLER\NPROTECT\00047595.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.40:C:\RECYCLER\NPROTECT\00047597.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.40:C:\RECYCLER\NPROTECT\00047599.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.40:C:\RECYCLER\NPROTECT\00047602.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.40:C:\RECYCLER\NPROTECT\00047603.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.40:C:\RECYCLER\NPROTECT\00047604.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.40:C:\RECYCLER\NPROTECT\00047610.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.40:C:\RECYCLER\NPROTECT\00047612.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.40:C:\RECYCLER\NPROTECT\00047616.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.40:C:\RECYCLER\NPROTECT\00047620.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.40:C:\RECYCLER\NPROTECT\00047623.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.41:C:\RECYCLER\NPROTECT\00047592.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.41:C:\RECYCLER\NPROTECT\00047595.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.41:C:\RECYCLER\NPROTECT\00047597.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.41:C:\RECYCLER\NPROTECT\00047599.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.41:C:\RECYCLER\NPROTECT\00047602.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.41:C:\RECYCLER\NPROTECT\00047603.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.41:C:\RECYCLER\NPROTECT\00047604.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.41:C:\RECYCLER\NPROTECT\00047610.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.41:C:\RECYCLER\NPROTECT\00047612.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.41:C:\RECYCLER\NPROTECT\00047616.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.41:C:\RECYCLER\NPROTECT\00047620.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.41:C:\RECYCLER\NPROTECT\00047623.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.42:C:\RECYCLER\NPROTECT\00047592.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.42:C:\RECYCLER\NPROTECT\00047595.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.42:C:\RECYCLER\NPROTECT\00047597.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.42:C:\RECYCLER\NPROTECT\00047599.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.42:C:\RECYCLER\NPROTECT\00047602.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.42:C:\RECYCLER\NPROTECT\00047603.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.42:C:\RECYCLER\NPROTECT\00047604.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.42:C:\RECYCLER\NPROTECT\00047610.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.42:C:\RECYCLER\NPROTECT\00047612.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.42:C:\RECYCLER\NPROTECT\00047616.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.42:C:\RECYCLER\NPROTECT\00047620.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.42:C:\RECYCLER\NPROTECT\00047623.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.43:C:\RECYCLER\NPROTECT\00047623.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.44:C:\RECYCLER\NPROTECT\00047630.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.44:C:\RECYCLER\NPROTECT\00047633.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.44:C:\RECYCLER\NPROTECT\00047635.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.44:C:\RECYCLER\NPROTECT\00047648.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.44:C:\RECYCLER\NPROTECT\00047658.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.44:C:\RECYCLER\NPROTECT\00047659.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.45:C:\RECYCLER\NPROTECT\00047630.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.45:C:\RECYCLER\NPROTECT\00047633.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.45:C:\RECYCLER\NPROTECT\00047635.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.45:C:\RECYCLER\NPROTECT\00047648.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.45:C:\RECYCLER\NPROTECT\00047658.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.45:C:\RECYCLER\NPROTECT\00047659.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.46:C:\RECYCLER\NPROTECT\00047630.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.46:C:\RECYCLER\NPROTECT\00047633.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.46:C:\RECYCLER\NPROTECT\00047635.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.46:C:\RECYCLER\NPROTECT\00047648.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.46:C:\RECYCLER\NPROTECT\00047658.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.46:C:\RECYCLER\NPROTECT\00047659.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.47:C:\RECYCLER\NPROTECT\00047630.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.47:C:\RECYCLER\NPROTECT\00047633.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.47:C:\RECYCLER\NPROTECT\00047635.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.47:C:\RECYCLER\NPROTECT\00047648.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.47:C:\RECYCLER\NPROTECT\00047658.MOZ -> TrackingCookie.Zedo : Cleaned.
:mozilla.47:C:\RECYCLER\NPROTECT\00047659.MOZ -> TrackingCookie.Zedo : Cleaned.
C:\!KillBox\vmedia.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00043665.EXE -> Trojan.ProcKill.DJ : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.dll -> Trojan.Sinowal.br : Cleaned with backup (quarantined).
C:\WINDOWS\QXNzeWE\krhWyqH.vbs -> Trojan.Small : Cleaned with backup (quarantined).

::Report end
DR Web Cureit log:
autosys.exe;C:\!KillBox;Trojan.StartPage.1769;Deleted.;
zgCrypt.dll;C:\!KillBox;Trojan.DownLoader.15676;Deleted.;
Process.exe;C:\Documents and Settings\Assya\Desktop\SDFix\SDFix\apps;Tool.Prockill;Incurable.Moved.;
Process.exe;C:\Documents and Settings\Assya\Desktop\SmitfraudFix\SmitfraudFix;Tool.Prockill;Incurable.Moved.;
restart.exe;C:\Documents and Settings\Assya\Desktop\SmitfraudFix\SmitfraudFix;Tool.ShutDown.11;Incurable.Moved.;
backup-20061227-140941-228.dll;C:\hijackthis\backups;Trojan.DownLoader.15676;Deleted.;
backup-20061227-234228-187.dll;C:\hijackthis\backups;Trojan.DownLoader.15676;Deleted.;
ibm00002.dll;C:\Program Files\Common Files\Microsoft Shared\Web Folders;Trojan.PWS.Snap;Deleted.;
00043631.DLL;C:\RECYCLER\NPROTECT;Trojan.PWS.Tanspy;Deleted.;
A0030065.dll;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.PWS.Snap;Deleted.;
A0030066.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Dialer.Maxd;Deleted.;
A0030067.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.DownLoader.14191;Deleted.;
A0030069.dll;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.DownLoader.10801;Deleted.;
A0030071.sys;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.Sklog;Deleted.;
A0030072.exe;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.Sklog;Deleted.;
A0030073.exe;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.;
A0030074.exe;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.;
A0030075.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.;
A0030076.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.;
A0030077.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.;
A0030078.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.;
A0030079.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.;
A0030080.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.;
A0030081.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.;
A0030082.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.;
A0030083.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.NewDotNet;Incurable.Moved.;
A0030084.exe;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.NewDotNet;Incurable.Moved.;
A0030085.exe;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.SurfAcc;Incurable.Moved.;
A0030086.exe;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.SurfAcc;Incurable.Moved.;
A0030087.dll;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.Proxy.493;Deleted.;
A0030088.exe;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.Proxy.493;Deleted.;
A0030089.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.DnsChange;Deleted.;
A0030090.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.Fakealert;Deleted.;
A0030091.exe;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.StartPage.1769;Deleted.;
A0030092.dll;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.DownLoader.15676;Deleted.;
A0030093.dll;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.DownLoader.15676;Deleted.;
A0030094.dll;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.DownLoader.15676;Deleted.;
A0030095.dll;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.PWS.Snap;Deleted.;
A0030096.DLL;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.PWS.Tanspy;Deleted.;

Combofix log:
Assya - 06-12-27 17:49:42.10 Service Pack 2
ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Assya\Desktop"
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\dwdsregt.exe

((((((((((((((((((((((((((((((( Files Created from 2006-11-27 to 2006-12-27 ))))))))))))))))))))))))))))))))))

2006-12-27 17:22 2,900 --a------ C:\WINDOWS\system32\tmp.reg
2006-12-27 17:01 <DIR> d-------- C:\Program Files\Ultimate Defender
2006-12-27 16:56 45,116 --a------ C:\WINDOWS\system32\nsdsregm.exe
2006-12-27 16:46 184,412 --a------ C:\WINDOWS\system32\qwintoed.exe
2006-12-27 16:38 <DIR> d-------- C:\Program Files\Network Associates
2006-12-27 16:38 <DIR> d-------- C:\Program Files\Common Files\Network Associates
2006-12-27 16:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Network Associates
2006-12-27 15:22 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2006-12-27 14:15 <DIR> d-------- C:\Program Files\Lavasoft
2006-12-27 14:15 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Lavasoft
2006-12-27 13:20 <DIR> d-------- C:\!KillBox
2006-12-27 12:10 <DIR> d-------- C:\Program Files\CleanUp!
2006-12-27 12:05 184,397 --a------ C:\WINDOWS\system32\lwintoed.exe
2006-12-26 23:55 <DIR> d-------- C:\hijackthis
2006-12-26 23:41 73,728 --a------ C:\WINDOWS\system32\out.dll
2006-12-26 23:41 <DIR> d-------- C:\Program Files\micore
2006-12-26 23:41 <DIR> d-------- C:\Program Files\atomwire
2006-12-26 23:41 <DIR> d-------- C:\Program Files\adwarespy
2006-12-26 23:41 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\al
2006-12-26 22:20 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2006-12-26 22:17 <DIR> d-------- C:\Documents and Settings\Assya\.housecall6.6
2006-12-26 21:24 184,450 --a------ C:\WINDOWS\system32\swintoed.exe
2006-12-26 21:15 <DIR> d-------- C:\Program Files\Mozilla Firefox
2006-12-26 21:15 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Mozilla
2006-12-26 20:12 184,445 --a------ C:\WINDOWS\system32\rwintoed.exe
2006-12-26 19:13 184,436 --a------ C:\WINDOWS\system32\mwintoed.exe
2006-12-26 16:39 183,808 --a-s---- C:\WINDOWS\NDNuninstall7_48.exe
2006-12-26 16:38 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Ultimate Cleaner
2006-12-26 16:37 <DIR> d-------- C:\Program Files\Ultimate Cleaner
2006-12-26 16:36 931 --a------ C:\WINDOWS\system32\winpfz32.sys
2006-12-26 16:36 2,981 --a------ C:\WINDOWS\system32\autosys.exe
2006-12-26 16:36 184,409 --a------ C:\WINDOWS\system32\mwinkoed.exe
2006-12-26 16:36 10,000 --a------ C:\WINDOWS\system32\zgCrypt.dll
2006-12-26 16:35 8,464 --a------ C:\WINDOWS\system32\sporder.dll
2006-12-26 16:35 <DIR> d--hs---- C:\WINDOWS\QXNzeWE
2006-12-26 16:35 <DIR> d-------- C:\Program Files\Symantec Technical Support
2006-12-24 20:25 1,240,778 --a------ C:\WINDOWS\system32\vmedia.exe
2006-12-24 20:20 <DIR> d-------- C:\Program Files\FlashGet
2006-12-23 20:12 <DIR> d-------- C:\WINDOWS\Sun
2006-12-23 20:12 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Sun
2006-12-23 20:09 <DIR> d-------- C:\Program Files\Java
2006-12-23 20:05 <DIR> d-------- C:\Program Files\Common Files\Java
2006-12-17 14:14 <DIR> d--h----- C:\WINDOWS\PIF
2006-12-17 13:37 <DIR> d-------- C:\Program Files\RevConnect
2006-12-14 23:07 <DIR> d-------- C:\Program Files\Common Files\xing shared
2006-12-14 23:07 <DIR> d-------- C:\Program Files\Common Files\Real
2006-12-14 23:06 <DIR> d-------- C:\Program Files\Real
2006-12-14 23:06 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Real
2006-12-14 22:56 <DIR> d-------- C:\My Downloads
2006-12-11 12:21 <DIR> d-------- C:\Program Files\BatteryInfo
2006-12-11 11:09 <DIR> d-------- C:\Program Files\Lavalys
2006-12-10 17:03 <DIR> d-------- C:\Program Files\SPDemo
2006-12-09 14:43 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\uTorrent
2006-12-09 14:02 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2006-12-09 11:00 <DIR> d-------- C:\Program Files\Microsoft Visual Studio
2006-12-09 10:22 724,992 --a------ C:\WINDOWS\iun6002.exe
2006-12-09 10:22 <DIR> d-------- C:\Program Files\Lion Heart's Codec Pack
2006-12-08 19:41 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Help
2006-12-08 19:18 <DIR> d-------- C:\Program Files\CronosPlus
2006-12-08 17:37 <DIR> d-------- C:\Program Files\eMule
2006-12-08 15:29 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL
2006-12-08 15:29 <DIR> d-------- C:\Program Files\cladDVD
2006-12-08 15:28 <DIR> d-------- C:\Program Files\ImTOO
2006-12-08 15:03 34,308 --a------ C:\WINDOWS\system32\BASSMOD.dll
2006-12-08 15:03 <DIR> d-------- C:\Program Files\Babylon
2006-12-08 15:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Babylon
2006-12-08 15:02 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Babylon
2006-12-08 14:45 <DIR> d-------- C:\Downloads
2006-12-08 14:44 <DIR> d-------- C:\Program Files\BitComet
2006-12-08 12:36 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2006-12-08 12:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2006-12-08 11:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2006-12-08 10:48 <DIR> d-------- C:\WINDOWS\pss
2006-12-08 10:32 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2006-12-08 10:32 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2006-12-08 10:32 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2006-12-08 10:09 303,104 --a------ C:\WINDOWS\system32\rmparser.dll
2006-12-08 10:09 1,003,520 --a------ C:\WINDOWS\system32\ltmm_n.dll
2006-12-08 10:09 <DIR> d-------- C:\AVOneExport
2006-12-08 10:08 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2006-12-08 10:08 <DIR> d-------- C:\Program Files\Mpgdvd.com
2006-12-08 10:07 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2006-12-08 09:51 <DIR> d-------- C:\WINDOWS\system32\appmgmt
2006-12-08 09:51 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Leadertech
2006-12-08 09:45 <DIR> d-------- C:\Program Files\Adobe
2006-12-08 09:45 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Adobe
2006-12-08 09:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2006-12-08 09:44 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2006-12-08 09:39 <DIR> d-------- C:\Program Files\Common Files\Adobe
2006-12-08 09:33 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Macromedia
2006-12-08 09:31 26,496 --a------ C:\WINDOWS\system32\drivers\USBSTOR.SYS
2006-12-08 00:46 127,208 --a------ C:\WINDOWS\system32\mucltui.dll
2006-12-07 23:26 56 -r-hs---- C:\WINDOWS\system32\38F032101D.sys
2006-12-07 23:26 1,682 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2006-12-07 23:26 <DIR> d-------- C:\Program Files\DivX
2006-12-07 23:10 <DIR> d-------- C:\Program Files\XVid;-)
2006-12-07 23:10 <DIR> d-------- C:\Program Files\XviD
2006-12-07 22:59 <DIR> d-------- C:\Program Files\ICQLite
2006-12-07 22:59 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\ICQLite
2006-12-07 22:47 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Ahead
2006-12-07 22:46 569,344 --a------ C:\WINDOWS\system32\imagr5.dll
2006-12-07 22:46 544,768 --a------ C:\WINDOWS\system32\imagx5.dll
2006-12-07 22:46 5,632 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys
2006-12-07 22:46 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2006-12-07 22:46 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll
2006-12-07 22:46 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2006-12-07 22:46 113,664 --a------ C:\WINDOWS\system32\drivers\imagesrv.sys
2006-12-07 22:46 <DIR> d-------- C:\Program Files\Common Files\Ahead
2006-12-07 22:46 <DIR> d-------- C:\Program Files\Ahead
2006-12-07 22:41 24,816 --a------ C:\WINDOWS\system32\mdimon.dll
2006-12-07 22:39 <DIR> d-------- C:\Program Files\Microsoft.NET
2006-12-07 22:39 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2006-12-07 22:38 <DIR> d-------- C:\Program Files\Common Files\DESIGNER
2006-12-07 22:37 <DIR> d-------- C:\WINDOWS\SHELLNEW
2006-12-07 22:37 <DIR> d-------- C:\Program Files\Microsoft Office
2006-12-07 22:35 <DIR> dr-h----- C:\MSOCache
2006-12-07 21:21 <DIR> d-------- C:\Program Files\WinZip
2006-12-07 21:17 <DIR> d-------- C:\Program Files\Webteh
2006-12-07 20:34 <DIR> d-------- C:\WINDOWS\system32\ReinstallBackups
2006-12-07 20:34 <DIR> d-------- C:\Program Files\Microsoft IntelliPoint 6.02
2006-12-07 20:34 <DIR> d-------- C:\Program Files\Microsoft IntelliPoint
2006-12-07 20:31 <DIR> d-------- C:\Program Files\Microsoft IntelliType Pro 6.02
2006-12-07 20:24 6,144 -ra------ C:\WINDOWS\system32\kbdth3.dll
2006-12-07 20:24 6,144 -ra------ C:\WINDOWS\system32\kbdth2.dll
2006-12-07 20:24 6,144 -ra------ C:\WINDOWS\system32\kbdinpun.dll
2006-12-07 20:24 6,144 --a------ C:\WINDOWS\system32\ftlx041e.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdvntc.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdurdu.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdth1.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdth0.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdsyr2.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdsyr1.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdintel.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdintam.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinmar.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinkan.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinhin.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinguj.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdindev.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdheb.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdfa.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbddiv2.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbddiv1.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbda3.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbda2.dll
2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbda1.dll
2006-12-07 20:24 5,632 --a------ C:\WINDOWS\system32\kbdusa.dll
2006-12-07 20:24 5,120 -ra------ C:\WINDOWS\system32\kbdgeo.dll
2006-12-07 20:24 5,120 -ra------ C:\WINDOWS\system32\kbdarmw.dll
2006-12-07 20:24 5,120 -ra------ C:\WINDOWS\system32\kbdarme.dll
2006-12-07 20:24 185,344 --a------ C:\WINDOWS\system32\Thawbrkr.dll
2006-12-07 20:24 10,752 --a------ C:\WINDOWS\system32\c_iscii.dll
2006-12-07 20:12 18,200 --a------ C:\WINDOWS\system32\wups2.dll
2006-12-07 20:12 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2006-12-07 20:10 <DIR> d---s---- C:\Documents and Settings\Assya\UserData
2006-12-07 20:06 306,688 --a------ C:\WINDOWS\IsUninst.exe
2006-12-07 20:05 <DIR> d-------- C:\Program Files\Symantec
2006-12-07 20:05 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Symantec
2006-12-07 20:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2006-12-07 20:04 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2006-12-07 20:00 <DIR> d-------- C:\Program Files\WinRAR
2006-12-07 19:56 <DIR> d--hs---- C:\RECYCLER
2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\SendTo
2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\Recent
2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\Application Data\.
2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\Application Data
2006-12-07 19:45 <DIR> dr------- C:\Documents and Settings\Assya\Start Menu
2006-12-07 19:45 <DIR> dr------- C:\Documents and Settings\Assya\My Documents
2006-12-07 19:45 <DIR> dr------- C:\Documents and Settings\Assya\Favorites
2006-12-07 19:45 <DIR> d--h----- C:\Program Files\Uninstall Information
2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\Templates
2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\PrintHood
2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\NetHood
2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\Local Settings
2006-12-07 19:45 <DIR> d---s---- C:\Documents and Settings\Assya\Cookies
2006-12-07 19:45 <DIR> d---s---- C:\Documents and Settings\Assya\Application Data\Microsoft
2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\Desktop
2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Identities
2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\..
2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\..
2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\.
2006-12-07 19:44 <DIR> d---s---- C:\WINDOWS\system32\Microsoft
2006-12-07 19:44 <DIR> d-------- C:\WINDOWS\SoftwareDistribution
2006-12-07 19:44 <DIR> d-------- C:\WINDOWS\Prefetch
2006-12-07 19:38 0 -rahs---- C:\MSDOS.SYS
2006-12-07 19:38 0 -rahs---- C:\IO.SYS
2006-12-07 19:38 0 --a------ C:\CONFIG.SYS
2006-12-07 19:38 0 --a------ C:\AUTOEXEC.BAT
2006-12-07 19:38 <DIR> d-------- C:\WINDOWS\system32\xircom
2006-12-07 19:38 <DIR> d-------- C:\Program Files\xerox
2006-12-07 19:38 <DIR> d-------- C:\Program Files\microsoft frontpage
2006-12-07 19:37 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2006-12-07 19:36 <DIR> dr------- C:\WINDOWS\Offline Web Pages
2006-12-07 19:36 <DIR> d--hs---- C:\Documents and Settings\All Users\DRM
2006-12-07 19:36 <DIR> d--h----- C:\Program Files\WindowsUpdate
2006-12-07 19:36 <DIR> d---s---- C:\WINDOWS\Downloaded Program Files
2006-12-07 19:35 64,512 --a------ C:\WINDOWS\system32\acctres.dll
2006-12-07 19:35 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2006-12-07 19:35 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2006-12-07 19:35 <DIR> d-------- C:\WINDOWS\system32\DirectX
2006-12-07 19:35 <DIR> d-------- C:\Program Files\Common Files\Services
2006-12-07 19:34 81,920 --a------ C:\WINDOWS\system32\isign32.dll
2006-12-07 19:34 81,920 --a------ C:\WINDOWS\system32\ils.dll
2006-12-07 19:34 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll
2006-12-07 19:34 73,728 --a------ C:\WINDOWS\system32\icwdial.dll
2006-12-07 19:34 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys
2006-12-07 19:34 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2006-12-07 19:34 69,632 --a------ C:\WINDOWS\system32\msconf.dll
2006-12-07 19:34 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-12-07 19:34 67,584 --a------ C:\WINDOWS\system32\srclient.dll
2006-12-07 19:34 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll
2006-12-07 19:34 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll
2006-12-07 19:34 48,128 --a------ C:\WINDOWS\system32\inetres.dll
2006-12-07 19:34 465,176 --a------ C:\WINDOWS\system32\wuapi.dll
2006-12-07 19:34 45,568 --a------ C:\WINDOWS\system32\safrslv.dll
2006-12-07 19:34 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2006-12-07 19:34 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll
2006-12-07 19:34 41,240 --a------ C:\WINDOWS\system32\wups.dll
2006-12-07 19:34 382,464 --a------ C:\WINDOWS\system32\qmgr.dll
2006-12-07 19:34 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll
2006-12-07 19:34 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2006-12-07 19:34 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll
2006-12-07 19:34 29,696 --a------ C:\WINDOWS\system32\safrdm.dll
2006-12-07 19:34 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll
2006-12-07 19:34 274,944 --a------ C:\WINDOWS\system32\mstask.dll
2006-12-07 19:34 274,432 --a------ C:\WINDOWS\system32\inetcfg.dll
2006-12-07 19:34 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll
2006-12-07 19:34 239,104 --a------ C:\WINDOWS\system32\srrstr.dll
2006-12-07 19:34 23,040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-12-07 19:34 194,328 --a------ C:\WINDOWS\system32\wuaueng1.dll
2006-12-07 19:34 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll
2006-12-07 19:34 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2006-12-07 19:34 173,536 --a------ C:\WINDOWS\system32\wuweb.dll
2006-12-07 19:34 172,312 --a------ C:\WINDOWS\system32\wuauclt1.exe
2006-12-07 19:34 170,496 --a------ C:\WINDOWS\system32\srsvc.dll
2006-12-07 19:34 16,896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-12-07 19:34 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2006-12-07 19:34 128,896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys
2006-12-07 19:34 127,256 --a------ C:\WINDOWS\system32\wucltui.dll
2006-12-07 19:34 124,184 --a------ C:\WINDOWS\system32\wuauclt.exe
2006-12-07 19:34 12,288 --a------ C:\WINDOWS\system32\mstinit.exe
2006-12-07 19:34 105,984 --a------ C:\WINDOWS\system32\msoert2.dll
2006-12-07 19:34 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll
2006-12-07 19:34 <DIR> d---s---- C:\WINDOWS\Tasks
2006-12-07 19:34 <DIR> d-------- C:\WINDOWS\system32\Restore
2006-12-07 19:34 <DIR> d-------- C:\WINDOWS\system32\Macromed
2006-12-07 19:34 <DIR> d-------- C:\WINDOWS\srchasst
2006-12-07 19:34 <DIR> d-------- C:\Program Files\Outlook Express
2006-12-07 19:34 <DIR> d-------- C:\Program Files\NetMeeting
2006-12-07 19:34 <DIR> d-------- C:\Program Files\Movie Maker
2006-12-07 19:34 <DIR> d-------- C:\Program Files\Internet Explorer
2006-12-07 19:34 <DIR> d-------- C:\Program Files\Common Files\System
2006-12-07 19:34 <DIR> d-------- C:\Program Files\Common Files\MSSoap
2006-12-07 19:33 <DIR> d-------- C:\WINDOWS\Registration
2006-12-07 19:33 <DIR> d-------- C:\Program Files\ComPlus Applications
2006-12-07 19:32 97,792 --a------ C:\WINDOWS\system32\comrepl.dll
2006-12-07 19:32 9,728 --a------ C:\WINDOWS\system32\reset.exe
2006-12-07 19:32 80,384 --a------ C:\WINDOWS\system32\charmap.exe
2006-12-07 19:32 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2006-12-07 19:32 605,696 --a------ C:\WINDOWS\system32\getuname.dll
2006-12-07 19:32 56,832 --a------ C:\WINDOWS\system32\sol.exe
2006-12-07 19:32 55,296 --a------ C:\WINDOWS\system32\freecell.exe
2006-12-07 19:32 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2006-12-07 19:32 5,632 --a------ C:\WINDOWS\system32\write.exe
2006-12-07 19:32 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2006-12-07 19:32 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2006-12-07 19:32 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2006-12-07 19:32 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2006-12-07 19:32 35,328 --a------ C:\WINDOWS\system32\winchat.exe
2006-12-07 19:32 347,136 --a------ C:\WINDOWS\system32\hypertrm.dll
2006-12-07 19:32 33,792 --a------ C:\WINDOWS\system32\regini.exe
2006-12-07 19:32 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2006-12-07 19:32 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2006-12-07 19:32 227,840 --a------ C:\WINDOWS\system32\avtapi.dll
2006-12-07 19:32 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe
2006-12-07 19:32 20,992 --a------ C:\WINDOWS\system32\msg.exe
2006-12-07 19:32 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2006-12-07 19:32 183,808 --a------ C:\WINDOWS\system32\accwiz.exe
2006-12-07 19:32 16,896 --a------ C:\WINDOWS\system32\tsshutdn.exe
2006-12-07 19:32 16,896 --a---