Computing.Net > Forums > Security and Virus > WinAntiVirusPro problems, another 1

WinAntiVirusPro problems, another 1

Reply to Message Icon

Original Message
Name: worthers20
Date: October 9, 2006 at 13:38:04 Pacific
Subject: WinAntiVirusPro problems, another 1
OS: WinXP SP2
CPU/Ram: C2duo 1.83Ghz
Model/Manufacturer: Dell Inspiron e1505
Comment:

I tried going through all these posts myself to not bother you guys with yet again another WinAntiVirusPro problem, but I couldn't get it :(

So, I have the HJT log ready to post if anyone is willign to help. Much appreciated.


Report Offensive Message For Removal


Response Number 1
Name: jabuck
Date: October 9, 2006 at 20:32:49 Pacific
Reply: (edit)

Rename hijackthis.exe as that sometime helps locate the baddies. Go to start> search> files and folders> type in the top space "hijackthis.exe" without the quotes> click search> when it is found in the right pane (looks like a pile of dynamite)>right click on it> click rename> rename it "show.exe" without the quotes> click a blank space on the screen.

Then post your Hijack This log please.

Please download SmitRemFix from this link http://siri.urz.free.fr/Fix/SmitfraudFix.zip Then extract the contents to your desktop.

!!!! Only run option #1 as runing the other options on an uninfected computer will damage the desktop.!!!!

Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd"
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.



Report Offensive Follow Up For Removal

Response Number 2
Name: worthers20
Date: October 10, 2006 at 18:01:41 Pacific
Reply: (edit)

HJT Log:
Logfile of HijackThis v1.99.1
Scan saved at 8:56:59 PM, on 10/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\BlazeVideo\BlazeDVD4 Professional\MediaDetector.exe
C:\DOCUME~1\Adam\LOCALS~1\Temp\clclean.0001
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Adam\Desktop\HJT\show.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.co...
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [zvjostj.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\zvjostj.dll,khmpyrc
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [BlazeServoTool] "C:\Program Files\BlazeVideo\BlazeDVD4 Professional\MediaDetector.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/englis...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/active...
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: winrzf32 - C:\WINDOWS\SYSTEM32\winrzf32.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE (file missing)

Smit Log:

SmitFraudFix v2.109

Scan done at 20:58:44.62, Tue 10/10/2006
Run from C:\Documents and Settings\Adam\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\ismini.exe FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Adam


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Adam\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Adam\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32


»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

Thanks for the help :)


Report Offensive Follow Up For Removal

Response Number 3
Name: jabuck
Date: October 10, 2006 at 18:42:06 Pacific
Reply: (edit)

Next, please reboot your computer in Safe Mode by doing the following :

Restart your computer

After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;

Instead of Windows loading as normal, a menu with options should appear;

Select the first option, to run Windows in Safe Mode, then press "Enter".

Choose your usual account.

Once in Safe Mode, open the "SmitfraudFix" folder again and double-click "smitfraudfix.cmd"
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing " Y " and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if "wininet.dll " is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing "Y" and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.

A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Please download VundoFix.exe to your C:\.
Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer, click OK.
Turn your computer back on.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot. Post the log located at C:Vundifix.txt please.

Please download ComboFix to the Desktop from this link:

http://download.bleepingcomputer.com/sUBs/combofix.exe

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running, it may cause your system to hang.)

Please post the combofix.txt log

Please download ATF-Cleaner to your desktop from this link
http://www.atribune.org/content/view/19/2/ We will need it later in safe mode

Download and install Ewido Security Suite We will need this later in safe mode

Be sure to update Ewido

Download Killbox to your desktop from this link Killbox by Option^Explicit. If you already have "Killbox" update to this newer version. We will need it later in safe mode


Report Offensive Follow Up For Removal

Response Number 4
Name: worthers20
Date: October 11, 2006 at 05:38:15 Pacific
Reply: (edit)

Thanks again :)

Vundo Log:
VundoFix V6.2.0

Checking Java version...

Java version is 1.5.0.9

Scan started at 8:25:47 AM 10/11/2006

Listing files found while scanning....

No infected files were found.

I ran this before I posted in attempts to try to fix it myself. This was the original log, if it helps any

ORIGINAL:
VundoFix V6.2.0

Checking Java version...

Java version is 1.5.0.9

Scan started at 1:58:47 AM 10/9/2006

Listing files found while scanning....

C:\WINDOWS\system32\geedd.dll
C:\WINDOWS\system32\ddeeg.ini
C:\WINDOWS\system32\ddeeg.bak1

Beginning removal...

Attempting to delete C:\WINDOWS\system32\geedd.dll
C:\WINDOWS\system32\geedd.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\ddeeg.ini
C:\WINDOWS\system32\ddeeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\ddeeg.bak1
C:\WINDOWS\system32\ddeeg.bak1 Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete C:\WINDOWS\system32\geedd.dll
C:\WINDOWS\system32\geedd.dll Has been deleted!

Performing Repairs to the registry.
Done!


And the Combofix Log:
Adam - 06-10-11 8:34:47.09 Service Pack 2
ComboFix 06.10.11 - Running from: "C:\Documents and Settings\Adam\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\components


((((((((((((((((((((((((((((((( Files Created from 2006-09-11 to 2006-10-11 ))))))))))))))))))))))))))))))))))

2006-10-11 01:08 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2006-10-09 02:11 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-10-09 00:54 93,696 --a------ C:\WINDOWS\system32\zvjostj.dll
2006-10-09 00:54 40,973 ---hs---- C:\WINDOWS\system32\ssqoopn.dll
2006-10-09 00:54 18,432 --a------ C:\WINDOWS\system32\winrzf32.dll
2006-10-06 22:18 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2006-10-04 01:06 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2006-10-03 22:49 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2006-10-03 22:47 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2006-10-03 15:29 94,299 --a------ C:\WINDOWS\system32\SynTPAPI.dll
2006-10-03 15:29 82,014 --a------ C:\WINDOWS\system32\SynCOM.dll
2006-10-03 15:29 81,920 --a------ C:\WINDOWS\system32\SynTPCo2.dll
2006-10-03 15:29 69,723 --a------ C:\WINDOWS\system32\SynTPFcs.dll
2006-10-03 15:29 191,872 --a------ C:\WINDOWS\system32\drivers\SynTP.sys
2006-10-03 15:29 114,688 --a------ C:\WINDOWS\system32\SynCtrl.dll
2006-10-02 23:17 87,808 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2006-10-02 23:17 107,696 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2006-10-02 23:02 44,032 --------- C:\WINDOWS\system32\CTSVCCDA.EXE
2006-10-02 23:02 25,088 --------- C:\WINDOWS\system32\CTSVCCTL.EXE
2006-10-02 23:01 90,112 --------- C:\WINDOWS\Updreg.EXE
2006-10-02 23:01 9,728 --------- C:\WINDOWS\system32\drivers\PfModNT.sys
2006-10-02 22:56 40,448 --a------ C:\WINDOWS\system32\CiEcho.dll
2006-10-02 22:56 20,992 --a------ C:\WINDOWS\system32\sfman32.dll
2006-10-02 22:56 160,768 --a------ C:\WINDOWS\system32\cifilter.dll
2006-10-02 22:56 158,464 --a------ C:\WINDOWS\system32\drivers\ctusfsyn.sys
2006-10-02 22:56 138,752 --a------ C:\WINDOWS\system32\drivers\ctsfm2k.sys
2006-10-02 22:56 115,200 --a------ C:\WINDOWS\system32\sfms32.dll
2006-10-02 22:56 11,776 --a------ C:\WINDOWS\inres.dll
2006-10-02 22:56 106,496 --a------ C:\WINDOWS\system32\drivers\ctoss2k.sys
2006-10-02 22:56 1,389,056 --a------ C:\WINDOWS\system32\drivers\monfilt.sys
2006-10-02 22:55 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2006-10-02 22:55 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2006-10-02 22:55 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2006-10-02 22:55 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2006-10-02 22:55 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2006-10-02 22:55 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2006-10-02 22:55 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2006-10-02 22:55 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys
2006-10-02 22:55 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2006-10-02 22:55 172,416 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2006-10-02 22:55 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys
2006-10-02 22:54 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2006-10-02 22:54 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2006-10-02 22:54 282,624 --a------ C:\WINDOWS\stsystra.exe
2006-10-02 22:54 208,896 --a------ C:\WINDOWS\system32\stacapi.dll
2006-10-02 22:54 112,128 --a------ C:\WINDOWS\system32\staco.dll
2006-10-02 22:54 1,156,648 --a------ C:\WINDOWS\system32\drivers\sthda.sys
2006-10-02 22:54 1,052,672 --a------ C:\WINDOWS\system32\stlang.dll
2006-10-02 22:27 516,096 --------- C:\WINDOWS\system32\ati2sgag.exe
2006-10-02 22:25 451,072 C:\WINDOWSRadeon Omega Drivers v3.8.273 Uninstall.exe
2006-10-02 22:18 89,088 --a------ C:\WINDOWS\system32\ATL71.DLL
2006-10-02 22:18 86,016 --a------ C:\WINDOWS\system32\preflib.dll
2006-10-02 22:18 774,144 --a------ C:\WINDOWS\system32\BCMLogon.dll
2006-10-02 22:18 761,856 --a------ C:\WINDOWS\system32\bcm1xsup.dll
2006-10-02 22:18 69,632 --a------ C:\WINDOWS\system32\bcmwlpkt.dll
2006-10-02 22:18 563,968 --a------ C:\WINDOWS\system32\drivers\BCMWL5.SYS
2006-10-02 22:18 499,712 --a------ C:\WINDOWS\system32\MSVCP71.DLL
2006-10-02 22:18 44,032 --a------ C:\WINDOWS\system32\wltrynt.dll
2006-10-02 22:18 348,160 --a------ C:\WINDOWS\system32\MSVCR71.DLL
2006-10-02 22:18 33,664 --a------ C:\WINDOWS\system32\drivers\BCMWLNPF.SYS
2006-10-02 22:18 253,952 --a------ C:\WINDOWS\system32\bcmwlu00.exe
2006-10-02 22:18 2,129,920 --a------ C:\WINDOWS\system32\WLBCGCBPRO731.DLL
2006-10-02 22:18 1,384,448 --a------ C:\WINDOWS\system32\WLTRAY.EXE
2006-10-02 22:18 1,236,992 --a------ C:\WINDOWS\system32\BCMWLTRY.EXE
2006-10-02 22:18 1,060,864 --a------ C:\WINDOWS\system32\MFC71.DLL
2006-10-02 22:17 61,440 --a------ C:\WINDOWS\system32\KPower.dll
2006-10-02 22:17 307,200 --a------ C:\WINDOWS\system32\BMAPI.dll
2006-10-02 22:17 16,128 --a------ C:\WINDOWS\system32\drivers\APPDRV.SYS
2006-10-02 22:16 666 --a------ C:\WINDOWS\speed.reg
2006-10-02 22:15 26,496 --a------ C:\WINDOWS\system32\drivers\USBSTOR.SYS
2006-10-02 22:09 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2006-10-02 22:09 0 -rahs---- C:\MSDOS.SYS
2006-10-02 22:09 0 -rahs---- C:\IO.SYS
2006-10-02 22:09 0 --a------ C:\CONFIG.SYS
2006-10-02 22:09 0 --a------ C:\AUTOEXEC.BAT
2006-10-02 22:07 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll
2006-10-02 22:07 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2006-10-02 22:07 64,512 --a------ C:\WINDOWS\system32\acctres.dll
2006-10-02 22:07 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll
2006-10-02 22:07 465,176 --a------ C:\WINDOWS\system32\wuapi.dll
2006-10-02 22:07 45,568 --a------ C:\WINDOWS\system32\safrslv.dll
2006-10-02 22:07 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2006-10-02 22:07 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll
2006-10-02 22:07 41,240 --a------ C:\WINDOWS\system32\wups.dll
2006-10-02 22:07 382,464 --a------ C:\WINDOWS\system32\qmgr.dll
2006-10-02 22:07 29,696 --a------ C:\WINDOWS\system32\safrdm.dll
2006-10-02 22:07 194,328 --a------ C:\WINDOWS\system32\wuaueng1.dll
2006-10-02 22:07 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2006-10-02 22:07 173,536 --a------ C:\WINDOWS\system32\wuweb.dll
2006-10-02 22:07 172,312 --a------ C:\WINDOWS\system32\wuauclt1.exe
2006-10-02 22:07 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2006-10-02 22:07 127,256 --a------ C:\WINDOWS\system32\wucltui.dll
2006-10-02 22:07 124,184 --a------ C:\WINDOWS\system32\wuauclt.exe
2006-10-02 22:07 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2006-10-02 22:07 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2006-10-02 22:07 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll
2006-10-02 22:06 81,920 --a------ C:\WINDOWS\system32\isign32.dll
2006-10-02 22:06 81,920 --a------ C:\WINDOWS\system32\ils.dll
2006-10-02 22:06 73,728 --a------ C:\WINDOWS\system32\icwdial.dll
2006-10-02 22:06 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys
2006-10-02 22:06 69,632 --a------ C:\WINDOWS\system32\msconf.dll
2006-10-02 22:06 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-10-02 22:06 67,584 --a------ C:\WINDOWS\system32\srclient.dll
2006-10-02 22:06 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll
2006-10-02 22:06 48,128 --a------ C:\WINDOWS\system32\inetres.dll
2006-10-02 22:06 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll
2006-10-02 22:06 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2006-10-02 22:06 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll
2006-10-02 22:06 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll
2006-10-02 22:06 274,944 --a------ C:\WINDOWS\system32\mstask.dll
2006-10-02 22:06 274,432 --a------ C:\WINDOWS\system32\inetcfg.dll
2006-10-02 22:06 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll
2006-10-02 22:06 239,104 --a------ C:\WINDOWS\system32\srrstr.dll
2006-10-02 22:06 23,040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-10-02 22:06 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll
2006-10-02 22:06 170,496 --a------ C:\WINDOWS\system32\srsvc.dll
2006-10-02 22:06 16,896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-10-02 22:06 128,896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys
2006-10-02 22:06 12,288 --a------ C:\WINDOWS\system32\mstinit.exe
2006-10-02 22:06 105,984 --a------ C:\WINDOWS\system32\msoert2.dll
2006-10-02 22:05 97,792 --a------ C:\WINDOWS\system32\comrepl.dll
2006-10-02 22:05 9,728 --a------ C:\WINDOWS\system32\reset.exe
2006-10-02 22:05 80,384 --a------ C:\WINDOWS\system32\charmap.exe
2006-10-02 22:05 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2006-10-02 22:05 605,696 --a------ C:\WINDOWS\system32\getuname.dll
2006-10-02 22:05 56,832 --a------ C:\WINDOWS\system32\sol.exe
2006-10-02 22:05 55,296 --a------ C:\WINDOWS\system32\freecell.exe
2006-10-02 22:05 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2006-10-02 22:05 5,632 --a------ C:\WINDOWS\system32\write.exe
2006-10-02 22:05 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2006-10-02 22:05 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2006-10-02 22:05 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2006-10-02 22:05 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2006-10-02 22:05 35,328 --a------ C:\WINDOWS\system32\winchat.exe
2006-10-02 22:05 33,792 --a------ C:\WINDOWS\system32\regini.exe
2006-10-02 22:05 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2006-10-02 22:05 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2006-10-02 22:05 227,840 --a------ C:\WINDOWS\system32\avtapi.dll
2006-10-02 22:05 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe
2006-10-02 22:05 20,992 --a------ C:\WINDOWS\system32\msg.exe
2006-10-02 22:05 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2006-10-02 22:05 16,896 --a------ C:\WINDOWS\system32\tsshutdn.exe
2006-10-02 22:05 16,896 --a------ C:\WINDOWS\system32\qappsrv.exe
2006-10-02 22:05 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2006-10-02 22:05 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2006-10-02 22:05 15,872 --a------ C:\WINDOWS\system32\rwinsta.exe
2006-10-02 22:05 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2006-10-02 22:05 15,360 --a------ C:\WINDOWS\system32\logoff.exe
2006-10-02 22:05 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2006-10-02 22:05 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe
2006-10-02 22:05 14,848 --a------ C:\WINDOWS\system32\tscon.exe
2006-10-02 22:05 14,848 --a------ C:\WINDOWS\system32\shadow.exe
2006-10-02 22:05 138,752 --a------ C:\WINDOWS\system32\sndvol32.exe
2006-10-02 22:05 126,976 --a------ C:\WINDOWS\system32\mshearts.exe
2006-10-02 22:05 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2006-10-02 22:05 114,688 --a------ C:\WINDOWS\system32\calc.exe
2006-10-02 22:05 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd
2006-10-02 22:04 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll
2006-10-02 22:04 93,696 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2006-10-02 22:04 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll
2006-10-02 22:04 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll
2006-10-02 22:04 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2006-10-02 22:04 67,072 --a------ C:\WINDOWS\system32\rdshost.exe
2006-10-02 22:04 655,360 --a------ C:\WINDOWS\system32\mstscax.dll
2006-10-02 22:04 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll
2006-10-02 22:04 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe
2006-10-02 22:04 60,416 --a------ C:\WINDOWS\system32\remotepg.dll
2006-10-02 22:04 60,416 --a------ C:\WINDOWS\system32\colbact.dll
2006-10-02 22:04 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2006-10-02 22:04 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll
2006-10-02 22:04 58,880 --a------ C:\WINDOWS\system32\licwmi.dll
2006-10-02 22:04 56,320 --a------ C:\WINDOWS\system32\servdeps.dll
2006-10-02 22:04 540,160 --a------ C:\WINDOWS\system32\comuid.dll
2006-10-02 22:04 538,624 --a------ C:\WINDOWS\system32\spider.exe
2006-10-02 22:04 498,688 --a------ C:\WINDOWS\system32\clbcatq.dll
2006-10-02 22:04 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe
2006-10-02 22:04 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll
2006-10-02 22:04 407,552 --a------ C:\WINDOWS\system32\mstsc.exe
2006-10-02 22:04 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2006-10-02 22:04 38,912 --a------ C:\WINDOWS\system32\cfgbkend.dll
2006-10-02 22:04 347,136 --a------ C:\WINDOWS\system32\hypertrm.dll
2006-10-02 22:04 343,040 --a------ C:\WINDOWS\system32\mspaint.exe
2006-10-02 22:04 295,424 --a------ C:\WINDOWS\system32\termsrv.dll
2006-10-02 22:04 225,792 --a------ C:\WINDOWS\system32\catsrv.dll
2006-10-02 22:04 21,896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2006-10-02 22:04 20,480 --a------ C:\WINDOWS\system32\qprocess.exe
2006-10-02 22:04 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2006-10-02 22:04 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll
2006-10-02 22:04 185,344 --a------ C:\WINDOWS\system32\cmprops.dll
2006-10-02 22:04 183,808 --a------ C:\WINDOWS\system32\accwiz.exe
2006-10-02 22:04 17,408 --a------ C:\WINDOWS\system32\mmfutil.dll
2006-10-02 22:04 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2006-10-02 22:04 147,968 --a------ C:\WINDOWS\system32\rdchost.dll
2006-10-02 22:04 140,800 --a------ C:\WINDOWS\system32\sessmgr.exe
2006-10-02 22:04 139,528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2006-10-02 22:04 131,584 --a------ C:\WINDOWS\system32\sndrec32.exe
2006-10-02 22:04 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe
2006-10-02 22:04 123,392 --a------ C:\WINDOWS\system32\mplay32.exe
2006-10-02 22:04 12,040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2006-10-02 22:04 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll
2006-10-02 22:04 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll
2006-10-02 22:04 11,264 --a------ C:\WINDOWS\system32\icaapi.dll
2006-10-02 22:04 102,912 --a------ C:\WINDOWS\system32\clipbrd.exe
2006-10-02 22:04 1,267,200 --a------ C:\WINDOWS\system32\comsvcs.dll
2006-10-02 17:35 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2006-10-02 17:35 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2006-10-02 17:34 9,344 --a------ C:\WINDOWS\system32\drivers\compbatt.sys
2006-10-02 17:34 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2006-10-02 17:34 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2006-10-02 17:34 14,080 --a------ C:\WINDOWS\system32\drivers\CmBatt.sys
2006-10-02 17:34 14,080 --a------ C:\WINDOWS\system32\drivers\battc.sys
2006-10-02 17:33 85,020 --a------ C:\WINDOWS\system32\dgsetup.dll
2006-10-02 17:33 8,704 --a------ C:\WINDOWS\system32\batt.dll
2006-10-02 17:33 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2006-10-02 17:33 74,752 --a------ C:\WINDOWS\system32\storprop.dll
2006-10-02 17:33 7,168 -ra------ C:\WINDOWS\system32\kbdcz.dll
2006-10-02 17:33 69,120 --a------ C:\WINDOWS\NOTEPAD.EXE
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdycl.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdsl1.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdsl.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdpl.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdhu.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdcz2.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdcz1.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdcr.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\KBDAL.DLL
2006-10-02 17:33 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2006-10-02 17:33 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2006-10-02 17:33 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2006-10-02 17:33 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2006-10-02 17:33 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2006-10-02 17:33 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2006-10-02 17:33 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdycc.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbduzb.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdur.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdtat.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdru1.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdru.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdro.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdpl1.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdkaz.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdhu1.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdbu.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdblr.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdaze.dll
2006-10-02 17:33 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2006-10-02 17:33 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2006-10-02 17:33 15,360 --a------ C:\WINDOWS\TASKMAN.EXE
2006-10-02 17:33 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2006-10-02 17:33 11,264 --a------ C:\WINDOWS\system32\drivers\irenum.sys
2006-10-02 17:33 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-10-11 08:24 -------- d-------- C:\Program Files\Mozilla Firefox
2006-10-11 08:23 -------- d-------- C:\Program Files\Symantec AntiVirus
2006-10-11 01:09 -------- d-------- C:\Program Files\EA GAMES
2006-10-10 20:53 -------- d-------- C:\Program Files\PCSpim
2006-10-09 23:51 -------- d-------- C:\Program Files\BlazeVideo
2006-10-09 16:32 -------- d-------- C:\Program Files\Internet Explorer
2006-10-09 16:31 -------- d-------- C:\Program Files\Common Files\Symantec Shared
2006-10-09 02:11 -------- d-------- C:\Program Files\Grisoft
2006-10-09 01:38 -------- d-------- C:\Documents and Settings\Adam\Application Data\Azureus
2006-10-09 01:34 -------- d---s---- C:\Documents and Settings\Adam\Application Data\Microsoft
2006-10-09 01:34 -------- d-------- C:\Program Files\LIUtilities
2006-10-09 01:34 -------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2006-10-09 01:34 -------- d-------- C:\Program Files\Common Files
2006-10-09 01:23 -------- d-------- C:\Program Files\Security Task Manager
2006-10-09 01:07 -------- d-------- C:\Program Files\Ultimate Cleaner
2006-10-08 02:08 -------- d-------- C:\Program Files\MyGlobalSearch
2006-10-08 02:08 -------- d-------- C:\Program Files\ffdshow
2006-10-08 02:08 -------- d-------- C:\Program Files\AC3Filter
2006-10-06 22:26 -------- d-------- C:\Documents and Settings\Adam\Application Data\Vso
2006-10-06 22:18 81920 --a------ C:\Documents and Settings\Adam\Application Data\ezpinst.exe
2006-10-06 22:18 7176 --a------ C:\Documents and Settings\Adam\Application Data\pcouffin.cat
2006-10-06 22:18 47360 --a------ C:\Documents and Settings\Adam\Application Data\pcouffin.sys
2006-10-06 22:18 34 --a------ C:\Documents and Settings\Adam\Application Data\pcouffin.log
2006-10-06 22:18 1144 --a------ C:\Documents and Settings\Adam\Application Data\pcouffin.inf
2006-10-06 22:18 -------- d-------- C:\Program Files\vso
2006-10-06 22:05 -------- d-------- C:\Program Files\DVD Shrink
2006-10-06 22:05 -------- d-------- C:\Program Files\DVD Decrypter
2006-10-04 23:21 -------- d-------- C:\Documents and Settings\Adam\Application Data\AdobeUM
2006-10-04 23:20 -------- d-------- C:\Documents and Settings\Adam\Application Data\Adobe
2006-10-04 23:08 -------- d-------- C:\Program Files\Common Files\Adobe
2006-10-04 22:43 875 --a------ C:\Documents and Settings\Adam\Application Data\AdobeDLM.log
2006-10-04 22:43 0 --a------ C:\Documents and Settings\Adam\Application Data\dm.ini
2006-10-04 22:43 -------- d-------- C:\Program Files\Adobe
2006-10-04 22:24 -------- d-------- C:\Program Files\WinRAR
2006-10-04 17:40 -------- d-------- C:\Documents and Settings\Adam\Application Data\Dev-Cpp
2006-10-04 17:18 -------- d-------- C:\Documents and Settings\Adam\Application Data\Help
2006-10-04 17:08 -------- d-------- C:\Documents and Settings\Adam\Application Data\Macromedia
2006-10-04 03:15 -------- d-------- C:\Program Files\Windows Media Player
2006-10-04 01:46 -------- d-------- C:\Program Files\Trillian Pro
2006-10-04 01:07 -------- d-------- C:\Program Files\Messenger
2006-10-04 01:03 -------- d-------- C:\Program Files\Outlook Express
2006-10-04 01:03 -------- d-------- C:\Program Files\Common Files\System
2006-10-04 00:48 -------- d-------- C:\Program Files\Azureus
2006-10-04 00:44 -------- d-------- C:\Documents and Settings\Adam\Application Data\Sun
2006-10-03 22:47 -------- d-------- C:\Program Files\Microsoft Office
2006-10-03 22:47 -------- d-------- C:\Program Files\Microsoft ActiveSync
2006-10-03 22:47 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-10-03 22:47 -------- d-------- C:\Program Files\Common Files\DESIGNER
2006-10-03 15:29 -------- d-------- C:\Program Files\Synaptics
2006-10-03 15:25 -------- d-------- C:\Program Files\Java
2006-10-03 15:25 -------- d-------- C:\Program Files\Common Files\Java
2006-10-02 23:20 -------- d-------- C:\Program Files\Lavasoft
2006-10-02 23:20 -------- d-------- C:\Documents and Settings\Adam\Application Data\Lavasoft
2006-10-02 23:17 -------- d-------- C:\Program Files\Symantec
2006-10-02 23:06 -------- d-------- C:\Program Files\Zone Labs
2006-10-02 23:02 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-10-02 23:02 -------- d--h----- C:\Program Files\Creative Installation Information
2006-10-02 23:02 -------- d-------- C:\Program Files\Creative
2006-10-02 23:02 -------- d-------- C:\Program Files\Common Files\Creative
2006-10-02 22:57 -------- d-------- C:\Program Files\Common Files\Creative Labs Shared
2006-10-02 22:54 -------- d-------- C:\Program Files\SigmaTel
2006-10-02 22:50 -------- d-------- C:\Documents and Settings\Adam\Application Data\Mozilla
2006-10-02 22:33 -------- d-------- C:\Program Files\Intel
2006-10-02 22:30 -------- d-------- C:\Documents and Settings\Adam\Application Data\atitray
2006-10-02 22:26 -------- d-------- C:\Program Files\MultiRes
2006-10-02 22:25 451072 --a------ C:\WINDOWS\Radeon Omega Drivers v3.8.273 Uninstall.exe
2006-10-02 22:25 -------- d-------- C:\Program Files\Radeon Omega Drivers
2006-10-02 22:18 -------- d-------- C:\Program Files\Dell
2006-10-02 22:18 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-10-02 22:14 -------- d--h----- C:\Program Files\Uninstall Information
2006-10-02 22:14 -------- d-------- C:\Documents and Settings\Adam\Application Data\Identities
2006-10-02 22:09 -------- d-------- C:\Program Files\xerox
2006-10-02 22:09 -------- d-------- C:\Program Files\microsoft frontpage
2006-10-02 22:08 -------- d--h----- C:\Program Files\WindowsUpdate
2006-10-02 22:07 -------- d-------- C:\Program Files\NetMeeting
2006-10-02 22:07 -------- d-------- C:\Program Files\Movie Maker
2006-10-02 22:07 -------- d-------- C:\Program Files\Common Files\Services
2006-10-02 22:07 -------- d-------- C:\Program Files\Common Files\MSSoap
2006-10-02 22:06 -------- d-------- C:\Program Files\ComPlus Applications
2006-10-02 22:05 -------- d-------- C:\Program Files\Windows NT
2006-10-02 22:05 -------- d-------- C:\Program Files\Online Services
2006-10-02 22:05 -------- d-------- C:\Program Files\MSN Gaming Zone
2006-10-02 22:04 -------- d-------- C:\Program Files\MSN
2006-10-02 17:33 -------- d-------- C:\Program Files\Common Files\SpeechEngines
2006-10-02 17:33 -------- d-------- C:\Program Files\Common Files\ODBC
2006-10-02 17:32 62 --ahs---- C:\Documents and Settings\Adam\Application Data\desktop.ini
2006-09-13 01:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-08-25 11:45 617472 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-16 07:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll
2006-08-16 05:37 225664 --a------ C:\WINDOWS\system32\drivers\tcpip6.sys
2006-08-14 06:34 332928 --a------ C:\WINDOWS\system32\drivers\srv.sys
2006-07-21 04:24 72704 --a------ C:\WINDOWS\system32\hlink.dll
2006-07-18 22:58 258048 --a------ C:\WINDOWS\system32\ati2dvag.dll
2006-07-18 22:53 77824 --a------ C:\WINDOWS\system32\Oemdspif.dll
2006-07-18 22:53 26112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe
2006-07-18 22:53 114688 --a------ C:\WINDOWS\system32\atipdlxx.dll
2006-07-18 22:52 86016 --a------ C:\WINDOWS\system32\ati2evxx.dll
2006-07-18 22:52 41984 --a------ C:\WINDOWS\system32\ati2edxx.dll
2006-07-18 22:51 53248 --a------ C:\WINDOWS\system32\ATIDDC.DLL
2006-07-18 22:51 401408 --a------ C:\WINDOWS\system32\ati2evxx.exe
2006-07-18 22:44 2732608 --a------ C:\WINDOWS\system32\ati3duag.dll
2006-07-18 22:39 1744416 --a------ C:\WINDOWS\system32\ativvaxx.dll
2006-07-18 22:27 204800 --a------ C:\WINDOWS\system32\atikvmag.dll
2006-07-18 22:26 17408 --a------ C:\WINDOWS\system32\atitvo32.dll
2006-07-18 22:23 307200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2006-07-18 22:22 6684672 --a------ C:\WINDOWS\system32\atioglx1.dll
2006-07-18 22:22 286720 --a------ C:\WINDOWS\system32\ati2cqag.dll
2006-07-18 22:21 290816 --a------ C:\WINDOWS\system32\ATIDEMGR.dll
2006-07-18 22:13 5136384 --a------ C:\WINDOWS\system32\atioglxx.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SetDefaultMIDI"="MIDIDef.exe"
"BlazeServoTool"="\"C:\\Program Files\\BlazeVideo\\BlazeDVD4 Professional\\MediaDetector.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell QuickSet"="C:\\Program Files\\Dell\\QuickSet\\quickset.exe"
"Broadcom Wireless Manager UI"="C:\\WINDOWS\\system32\\WLTRAY.exe"
"AtiPTA"="atiptaxx.exe"
"SigmatelSysTrayApp"="stsystra.exe"
"CTSysVol"="C:\\Program Files\\Creative\\SBAudigy\\Surround Mixer\\CTSysVol.exe /r"
"MBMon"="Rundll32 CTMBHA.DLL,MBMon"
"UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"zvjostj.dll"="C:\\WINDOWS\\system32\\rundll32.exe C:\\WINDOWS\\system32\\zvjostj.dll,khmpyrc"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Creative MediaSource Go]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CTCMSGoU"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Creative\\MediaSource5\\Go\\CTCMSGoU.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\VoiceCenter]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AndreaVC"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Creative\\VoiceCenter\\AndreaVC.exe\" /tray"
"inimapping"="0"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winrzf32

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Completion time: Wed 10/11/2006 8:35:16.18
ComboFix.txt


Report Offensive Follow Up For Removal

Response Number 5
Name: jabuck
Date: October 11, 2006 at 20:08:11 Pacific
Reply: (edit)

Go to satrt> control panel> add/remove programs> scroll down and uninstall these programs if found:

Ultimate Cleaner (rogue program)

MyGlobalSearch (rogue program)

Set up the computer to view hidden files by going to start>control panel>folder options>view tab>tick the circle beside "show hidden files and folders" and untick the box beside "hide extensions of known file types" and "hide protected system operating files">apply>ok.

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.

Reboot into safe mode

Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked":

O4 - HKLM\..\Run: [zvjostj.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\zvjostj.dll,khmpyrc

O20 - Winlogon Notify: winrzf32 - C:\WINDOWS\SYSTEM32\winrzf32.dll

Exit Hijack This but remain in safe mode

Double-click on Killbox.exe to run it.
Put a tick by Standard File Kill.
In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time.

C:\WINDOWS\system32\zvjostj.dll,khmpyrc

C:\WINDOWS\system32\zvjostj.dll

C:\WINDOWS\SYSTEM32\winrzf32.dll


Click on the button that has the red circle with the X in the middle after you enter each file.
It will ask for confimation to delete the file.
Click Yes.
Continue with that procedure until you have pasted all of these in the "Paste Full Path of File to Delete" box.

Navigate to and delete these folders if found:

C:\Program Files\Ultimate Cleaner

C:\Program Files\Ultimate Cleaner

Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Next, please reboot your computer in Safe Mode by doing the following :

Restart your computer

After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;

Instead of Windows loading as normal, a menu with options should appear;

Select the first option, to run Windows in Safe Mode, then press "Enter".

Choose your usual account.

Reboot ot normal mode.

Open notepad (Start Menu > Run > Type notepad and press "ok".

Copy and paste everything into notepad between the x's making regedit4 the top line.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"zvjostj.dll"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winrzf32]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it Fix.reg then save it to your desktop.

Double click Fix.reg (or right click and choose Merge) and it will ask if you want to merge the contents into the registry, choose Yes.

Then post the Ewido log on your desktop, a new combofix log,a new Hijack This log and of course the following jotti's scan reults.

Please upload this file:

C:\WINDOWS\system32\ssqoopn.dll

to http://virusscan.jotti.org/ and post the results.



Report Offensive Follow Up For Removal


Response Number 6
Name: worthers20
Date: October 12, 2006 at 14:27:26 Pacific
Reply: (edit)

I didn't have the ssqoopn.dll file in the system32 folder. But, here are the other logs:

ComboFix:
Adam - 06-10-12 17:07:00.35 Service Pack 2
ComboFix 06.10.11 - Running from: "C:\Documents and Settings\Adam\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-09-12 to 2006-10-12 ))))))))))))))))))))))))))))))))))

2006-10-11 01:08 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2006-10-09 02:11 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-10-09 00:54 40,973 ---hs---- C:\WINDOWS\system32\ssqoopn.dll
2006-10-09 00:54 18,432 --------- C:\WINDOWS\system32\winrzf32.dll
2006-10-06 22:18 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2006-10-04 01:06 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2006-10-03 22:49 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2006-10-03 22:47 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2006-10-03 15:29 94,299 --a------ C:\WINDOWS\system32\SynTPAPI.dll
2006-10-03 15:29 82,014 --a------ C:\WINDOWS\system32\SynCOM.dll
2006-10-03 15:29 81,920 --a------ C:\WINDOWS\system32\SynTPCo2.dll
2006-10-03 15:29 69,723 --a------ C:\WINDOWS\system32\SynTPFcs.dll
2006-10-03 15:29 191,872 --a------ C:\WINDOWS\system32\drivers\SynTP.sys
2006-10-03 15:29 114,688 --a------ C:\WINDOWS\system32\SynCtrl.dll
2006-10-02 23:17 87,808 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2006-10-02 23:17 107,696 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2006-10-02 23:02 44,032 --------- C:\WINDOWS\system32\CTSVCCDA.EXE
2006-10-02 23:02 25,088 --------- C:\WINDOWS\system32\CTSVCCTL.EXE
2006-10-02 23:01 90,112 --------- C:\WINDOWS\Updreg.EXE
2006-10-02 23:01 9,728 --------- C:\WINDOWS\system32\drivers\PfModNT.sys
2006-10-02 22:56 40,448 --a------ C:\WINDOWS\system32\CiEcho.dll
2006-10-02 22:56 20,992 --a------ C:\WINDOWS\system32\sfman32.dll
2006-10-02 22:56 160,768 --a------ C:\WINDOWS\system32\cifilter.dll
2006-10-02 22:56 158,464 --a------ C:\WINDOWS\system32\drivers\ctusfsyn.sys
2006-10-02 22:56 138,752 --a------ C:\WINDOWS\system32\drivers\ctsfm2k.sys
2006-10-02 22:56 115,200 --a------ C:\WINDOWS\system32\sfms32.dll
2006-10-02 22:56 11,776 --a------ C:\WINDOWS\inres.dll
2006-10-02 22:56 106,496 --a------ C:\WINDOWS\system32\drivers\ctoss2k.sys
2006-10-02 22:56 1,389,056 --a------ C:\WINDOWS\system32\drivers\monfilt.sys
2006-10-02 22:55 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2006-10-02 22:55 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2006-10-02 22:55 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2006-10-02 22:55 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2006-10-02 22:55 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2006-10-02 22:55 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2006-10-02 22:55 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2006-10-02 22:55 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys
2006-10-02 22:55 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2006-10-02 22:55 172,416 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2006-10-02 22:55 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys
2006-10-02 22:54 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2006-10-02 22:54 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2006-10-02 22:54 282,624 --a------ C:\WINDOWS\stsystra.exe
2006-10-02 22:54 208,896 --a------ C:\WINDOWS\system32\stacapi.dll
2006-10-02 22:54 112,128 --a------ C:\WINDOWS\system32\staco.dll
2006-10-02 22:54 1,156,648 --a------ C:\WINDOWS\system32\drivers\sthda.sys
2006-10-02 22:54 1,052,672 --a------ C:\WINDOWS\system32\stlang.dll
2006-10-02 22:27 516,096 --------- C:\WINDOWS\system32\ati2sgag.exe
2006-10-02 22:25 451,072 C:\WINDOWSRadeon Omega Drivers v3.8.273 Uninstall.exe
2006-10-02 22:18 89,088 --a------ C:\WINDOWS\system32\ATL71.DLL
2006-10-02 22:18 86,016 --a------ C:\WINDOWS\system32\preflib.dll
2006-10-02 22:18 774,144 --a------ C:\WINDOWS\system32\BCMLogon.dll
2006-10-02 22:18 761,856 --a------ C:\WINDOWS\system32\bcm1xsup.dll
2006-10-02 22:18 69,632 --a------ C:\WINDOWS\system32\bcmwlpkt.dll
2006-10-02 22:18 563,968 --a------ C:\WINDOWS\system32\drivers\BCMWL5.SYS
2006-10-02 22:18 499,712 --a------ C:\WINDOWS\system32\MSVCP71.DLL
2006-10-02 22:18 44,032 --a------ C:\WINDOWS\system32\wltrynt.dll
2006-10-02 22:18 348,160 --a------ C:\WINDOWS\system32\MSVCR71.DLL
2006-10-02 22:18 33,664 --a------ C:\WINDOWS\system32\drivers\BCMWLNPF.SYS
2006-10-02 22:18 253,952 --a------ C:\WINDOWS\system32\bcmwlu00.exe
2006-10-02 22:18 2,129,920 --a------ C:\WINDOWS\system32\WLBCGCBPRO731.DLL
2006-10-02 22:18 1,384,448 --a------ C:\WINDOWS\system32\WLTRAY.EXE
2006-10-02 22:18 1,236,992 --a------ C:\WINDOWS\system32\BCMWLTRY.EXE
2006-10-02 22:18 1,060,864 --a------ C:\WINDOWS\system32\MFC71.DLL
2006-10-02 22:17 61,440 --a------ C:\WINDOWS\system32\KPower.dll
2006-10-02 22:17 307,200 --a------ C:\WINDOWS\system32\BMAPI.dll
2006-10-02 22:17 16,128 --a------ C:\WINDOWS\system32\drivers\APPDRV.SYS
2006-10-02 22:16 666 --a------ C:\WINDOWS\speed.reg
2006-10-02 22:15 26,496 --a------ C:\WINDOWS\system32\drivers\USBSTOR.SYS
2006-10-02 22:09 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2006-10-02 22:09 0 -rahs---- C:\MSDOS.SYS
2006-10-02 22:09 0 -rahs---- C:\IO.SYS
2006-10-02 22:09 0 --a------ C:\CONFIG.SYS
2006-10-02 22:09 0 --a------ C:\AUTOEXEC.BAT
2006-10-02 22:07 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll
2006-10-02 22:07 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2006-10-02 22:07 64,512 --a------ C:\WINDOWS\system32\acctres.dll
2006-10-02 22:07 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll
2006-10-02 22:07 465,176 --a------ C:\WINDOWS\system32\wuapi.dll
2006-10-02 22:07 45,568 --a------ C:\WINDOWS\system32\safrslv.dll
2006-10-02 22:07 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2006-10-02 22:07 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll
2006-10-02 22:07 41,240 --a------ C:\WINDOWS\system32\wups.dll
2006-10-02 22:07 382,464 --a------ C:\WINDOWS\system32\qmgr.dll
2006-10-02 22:07 29,696 --a------ C:\WINDOWS\system32\safrdm.dll
2006-10-02 22:07 194,328 --a------ C:\WINDOWS\system32\wuaueng1.dll
2006-10-02 22:07 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2006-10-02 22:07 173,536 --a------ C:\WINDOWS\system32\wuweb.dll
2006-10-02 22:07 172,312 --a------ C:\WINDOWS\system32\wuauclt1.exe
2006-10-02 22:07 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2006-10-02 22:07 127,256 --a------ C:\WINDOWS\system32\wucltui.dll
2006-10-02 22:07 124,184 --a------ C:\WINDOWS\system32\wuauclt.exe
2006-10-02 22:07 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2006-10-02 22:07 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2006-10-02 22:07 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll
2006-10-02 22:06 81,920 --a------ C:\WINDOWS\system32\isign32.dll
2006-10-02 22:06 81,920 --a------ C:\WINDOWS\system32\ils.dll
2006-10-02 22:06 73,728 --a------ C:\WINDOWS\system32\icwdial.dll
2006-10-02 22:06 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys
2006-10-02 22:06 69,632 --a------ C:\WINDOWS\system32\msconf.dll
2006-10-02 22:06 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-10-02 22:06 67,584 --a------ C:\WINDOWS\system32\srclient.dll
2006-10-02 22:06 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll
2006-10-02 22:06 48,128 --a------ C:\WINDOWS\system32\inetres.dll
2006-10-02 22:06 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll
2006-10-02 22:06 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2006-10-02 22:06 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll
2006-10-02 22:06 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll
2006-10-02 22:06 274,944 --a------ C:\WINDOWS\system32\mstask.dll
2006-10-02 22:06 274,432 --a------ C:\WINDOWS\system32\inetcfg.dll
2006-10-02 22:06 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll
2006-10-02 22:06 239,104 --a------ C:\WINDOWS\system32\srrstr.dll
2006-10-02 22:06 23,040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-10-02 22:06 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll
2006-10-02 22:06 170,496 --a------ C:\WINDOWS\system32\srsvc.dll
2006-10-02 22:06 16,896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-10-02 22:06 128,896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys
2006-10-02 22:06 12,288 --a------ C:\WINDOWS\system32\mstinit.exe
2006-10-02 22:06 105,984 --a------ C:\WINDOWS\system32\msoert2.dll
2006-10-02 22:05 97,792 --a------ C:\WINDOWS\system32\comrepl.dll
2006-10-02 22:05 9,728 --a------ C:\WINDOWS\system32\reset.exe
2006-10-02 22:05 80,384 --a------ C:\WINDOWS\system32\charmap.exe
2006-10-02 22:05 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2006-10-02 22:05 605,696 --a------ C:\WINDOWS\system32\getuname.dll
2006-10-02 22:05 56,832 --a------ C:\WINDOWS\system32\sol.exe
2006-10-02 22:05 55,296 --a------ C:\WINDOWS\system32\freecell.exe
2006-10-02 22:05 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2006-10-02 22:05 5,632 --a------ C:\WINDOWS\system32\write.exe
2006-10-02 22:05 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2006-10-02 22:05 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2006-10-02 22:05 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2006-10-02 22:05 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2006-10-02 22:05 35,328 --a------ C:\WINDOWS\system32\winchat.exe
2006-10-02 22:05 33,792 --a------ C:\WINDOWS\system32\regini.exe
2006-10-02 22:05 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2006-10-02 22:05 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2006-10-02 22:05 227,840 --a------ C:\WINDOWS\system32\avtapi.dll
2006-10-02 22:05 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe
2006-10-02 22:05 20,992 --a------ C:\WINDOWS\system32\msg.exe
2006-10-02 22:05 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2006-10-02 22:05 16,896 --a------ C:\WINDOWS\system32\tsshutdn.exe
2006-10-02 22:05 16,896 --a------ C:\WINDOWS\system32\qappsrv.exe
2006-10-02 22:05 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2006-10-02 22:05 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2006-10-02 22:05 15,872 --a------ C:\WINDOWS\system32\rwinsta.exe
2006-10-02 22:05 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2006-10-02 22:05 15,360 --a------ C:\WINDOWS\system32\logoff.exe
2006-10-02 22:05 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2006-10-02 22:05 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe
2006-10-02 22:05 14,848 --a------ C:\WINDOWS\system32\tscon.exe
2006-10-02 22:05 14,848 --a------ C:\WINDOWS\system32\shadow.exe
2006-10-02 22:05 138,752 --a------ C:\WINDOWS\system32\sndvol32.exe
2006-10-02 22:05 126,976 --a------ C:\WINDOWS\system32\mshearts.exe
2006-10-02 22:05 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2006-10-02 22:05 114,688 --a------ C:\WINDOWS\system32\calc.exe
2006-10-02 22:05 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd
2006-10-02 22:04 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll
2006-10-02 22:04 93,696 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2006-10-02 22:04 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll
2006-10-02 22:04 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll
2006-10-02 22:04 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2006-10-02 22:04 67,072 --a------ C:\WINDOWS\system32\rdshost.exe
2006-10-02 22:04 655,360 --a------ C:\WINDOWS\system32\mstscax.dll
2006-10-02 22:04 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll
2006-10-02 22:04 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe
2006-10-02 22:04 60,416 --a------ C:\WINDOWS\system32\remotepg.dll
2006-10-02 22:04 60,416 --a------ C:\WINDOWS\system32\colbact.dll
2006-10-02 22:04 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2006-10-02 22:04 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll
2006-10-02 22:04 58,880 --a------ C:\WINDOWS\system32\licwmi.dll
2006-10-02 22:04 56,320 --a------ C:\WINDOWS\system32\servdeps.dll
2006-10-02 22:04 540,160 --a------ C:\WINDOWS\system32\comuid.dll
2006-10-02 22:04 538,624 --a------ C:\WINDOWS\system32\spider.exe
2006-10-02 22:04 498,688 --a------ C:\WINDOWS\system32\clbcatq.dll
2006-10-02 22:04 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe
2006-10-02 22:04 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll
2006-10-02 22:04 407,552 --a------ C:\WINDOWS\system32\mstsc.exe
2006-10-02 22:04 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2006-10-02 22:04 38,912 --a------ C:\WINDOWS\system32\cfgbkend.dll
2006-10-02 22:04 347,136 --a------ C:\WINDOWS\system32\hypertrm.dll
2006-10-02 22:04 343,040 --a------ C:\WINDOWS\system32\mspaint.exe
2006-10-02 22:04 295,424 --a------ C:\WINDOWS\system32\termsrv.dll
2006-10-02 22:04 225,792 --a------ C:\WINDOWS\system32\catsrv.dll
2006-10-02 22:04 21,896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2006-10-02 22:04 20,480 --a------ C:\WINDOWS\system32\qprocess.exe
2006-10-02 22:04 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2006-10-02 22:04 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll
2006-10-02 22:04 185,344 --a------ C:\WINDOWS\system32\cmprops.dll
2006-10-02 22:04 183,808 --a------ C:\WINDOWS\system32\accwiz.exe
2006-10-02 22:04 17,408 --a------ C:\WINDOWS\system32\mmfutil.dll
2006-10-02 22:04 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2006-10-02 22:04 147,968 --a------ C:\WINDOWS\system32\rdchost.dll
2006-10-02 22:04 140,800 --a------ C:\WINDOWS\system32\sessmgr.exe
2006-10-02 22:04 139,528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2006-10-02 22:04 131,584 --a------ C:\WINDOWS\system32\sndrec32.exe
2006-10-02 22:04 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe
2006-10-02 22:04 123,392 --a------ C:\WINDOWS\system32\mplay32.exe
2006-10-02 22:04 12,040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2006-10-02 22:04 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll
2006-10-02 22:04 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll
2006-10-02 22:04 11,264 --a------ C:\WINDOWS\system32\icaapi.dll
2006-10-02 22:04 102,912 --a------ C:\WINDOWS\system32\clipbrd.exe
2006-10-02 22:04 1,267,200 --a------ C:\WINDOWS\system32\comsvcs.dll
2006-10-02 17:35 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2006-10-02 17:35 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2006-10-02 17:34 9,344 --a------ C:\WINDOWS\system32\drivers\compbatt.sys
2006-10-02 17:34 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2006-10-02 17:34 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2006-10-02 17:34 14,080 --a------ C:\WINDOWS\system32\drivers\CmBatt.sys
2006-10-02 17:34 14,080 --a------ C:\WINDOWS\system32\drivers\battc.sys
2006-10-02 17:33 85,020 --a------ C:\WINDOWS\system32\dgsetup.dll
2006-10-02 17:33 8,704 --a------ C:\WINDOWS\system32\batt.dll
2006-10-02 17:33 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2006-10-02 17:33 74,752 --a------ C:\WINDOWS\system32\storprop.dll
2006-10-02 17:33 7,168 -ra------ C:\WINDOWS\system32\kbdcz.dll
2006-10-02 17:33 69,120 --a------ C:\WINDOWS\NOTEPAD.EXE
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdycl.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdsl1.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdsl.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdpl.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdhu.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdcz2.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdcz1.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\kbdcr.dll
2006-10-02 17:33 6,656 -ra------ C:\WINDOWS\system32\KBDAL.DLL
2006-10-02 17:33 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2006-10-02 17:33 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2006-10-02 17:33 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2006-10-02 17:33 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2006-10-02 17:33 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2006-10-02 17:33 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2006-10-02 17:33 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdycc.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbduzb.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdur.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdtat.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdru1.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdru.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdro.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdpl1.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdkaz.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdhu1.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdbu.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdblr.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2006-10-02 17:33 5,632 -ra------ C:\WINDOWS\system32\kbdaze.dll
2006-10-02 17:33 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2006-10-02 17:33 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2006-10-02 17:33 15,360 --a------ C:\WINDOWS\TASKMAN.EXE
2006-10-02 17:33 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2006-10-02 17:33 11,264 --a------ C:\WINDOWS\system32\drivers\irenum.sys
2006-10-02 17:33 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-10-12 17:04 -------- d-------- C:\Program Files\Symantec AntiVirus
2006-10-12 15:39 -------- d-------- C:\Program Files\Mozilla Firefox
2006-10-11 20:37 -------- d-------- C:\Program Files\QuickTime
2006-10-11 20:37 -------- d-------- C:\Program Files\iTunes
2006-10-11 20:37 -------- d-------- C:\Program Files\iPod
2006-10-11 20:37 -------- d-------- C:\Documents and Settings\Adam\Application Data\Apple Computer
2006-10-11 13:01 -------- d-------- C:\Documents and Settings\Adam\Application Data\Azureus
2006-10-11 01:09 -------- d-------- C:\Program Files\EA GAMES
2006-10-10 20:53 -------- d-------- C:\Program Files\PCSpim
2006-10-09 23:51 -------- d-------- C:\Program Files\BlazeVideo
2006-10-09 16:32 -------- d-------- C:\Program Files\Internet Explorer
2006-10-09 16:31 -------- d-------- C:\Program Files\Common Files\Symantec Shared
2006-10-09 02:11 -------- d-------- C:\Program Files\Grisoft
2006-10-09 01:34 -------- d---s---- C:\Documents and Settings\Adam\Application Data\Microsoft
2006-10-09 01:34 -------- d-------- C:\Program Files\LIUtilities
2006-10-09 01:34 -------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2006-10-09 01:34 -------- d-------- C:\Program Files\Common Files
2006-10-09 01:23 -------- d-------- C:\Program Files\Security Task Manager
2006-10-09 01:07 -------- d-------- C:\Program Files\Ultimate Cleaner
2006-10-08 02:08 -------- d-------- C:\Program Files\MyGlobalSearch
2006-10-08 02:08 -------- d-------- C:\Program Files\ffdshow
2006-10-08 02:08 -------- d-------- C:\Program Files\AC3Filter
2006-10-06 22:26 -------- d-------- C:\Documents and Settings\Adam\Application Data\Vso
2006-10-06 22:18 81920 --a------ C:\Documents and Settings\Adam\Application Data\ezpinst.exe
2006-10-06 22:18 7176 --a------ C:\Documents and Settings\Adam\Application Data\pcouffin.cat
2006-10-06 22:18 47360 --a------ C:\Documents and Settings\Adam\Application Data\pcouffin.sys
2006-10-06 22:18 34 --a------ C:\Documents and Settings\Adam\Application Data\pcouffin.log
2006-10-06 22:18 1144 --a------ C:\Documents and Settings\Adam\Application Data\pcouffin.inf
2006-10-06 22:18 -------- d-------- C:\Program Files\vso
2006-10-06 22:05 -------- d-------- C:\Program Files\DVD Shrink
2006-10-06 22:05 -------- d-------- C:\Program Files\DVD Decrypter
2006-10-04 23:21 -------- d-------- C:\Documents and Settings\Adam\Application Data\AdobeUM
2006-10-04 23:20 -------- d-------- C:\Documents and Settings\Adam\Application Data\Adobe
2006-10-04 23:08 -------- d-------- C:\Program Files\Common Files\Adobe
2006-10-04 22:43 875 --a------ C:\Documents and Settings\Adam\Application Data\AdobeDLM.log
2006-10-04 22:43 0 --a------ C:\Documents and Settings\Adam\Application Data\dm.ini
2006-10-04 22:43 -------- d-------- C:\Program Files\Adobe
2006-10-04 22:24 -------- d-------- C:\Program Files\WinRAR
2006-10-04 17:40 -------- d-------- C:\Documents and Settings\Adam\Application Data\Dev-Cpp
2006-10-04 17:18 -------- d-------- C:\Documents and Settings\Adam\Application Data\Help
2006-10-04 17:08 -------- d-------- C:\Documents and Settings\Adam\Application Data\Macromedia
2006-10-04 03:15 -------- d-------- C:\Program Files\Windows Media Player
2006-10-04 01:46 -------- d-------- C:\Program Files\Trillian Pro
2006-10-04 01:07 -------- d-------- C:\Program Files\Messenger
2006-10-04 01:03 -------- d-------- C:\Program Files\Outlook Express
2006-10-04 01:03 -------- d-------- C:\Program Files\Common Files\System
2006-10-04 00:48 -------- d-------- C:\Program Files\Azureus
2006-10-04 00:44 -------- d-------- C:\Documents and Settings\Adam\Application Data\Sun
2006-10-03 22:47 -------- d-------- C:\Program Files\Microsoft Office
2006-10-03 22:47 -------- d-------- C:\Program Files\Microsoft ActiveSync
2006-10-03 22:47 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-10-03 22:47 -------- d-------- C:\Program Files\Common Files\DESIGNER
2006-10-03 15:29 -------- d-------- C:\Program Files\Synaptics
2006-10-03 15:25 -------- d-------- C:\Program Files\Java
2006-10-03 15:25 -------- d-------- C:\Program Files\Common Files\Java
2006-10-02 23:20 -------- d-------- C:\Program Files\Lavasoft
2006-10-02 23:20 -------- d-------- C:\Documents and Settings\Adam\Application Data\Lavasoft
2006-10-02 23:17 -------- d-------- C:\Program Files\Symantec
2006-10-02 23:06 -------- d-------- C:\Program Files\Zone Labs
2006-10-02 23:02 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-10-02 23:02 -------- d--h----- C:\Program Files\Creative Installation Information
2006-10-02 23:02 -------- d-------- C:\Program Files\Creative
2006-10-02 23:02 -------- d-------- C:\Program Files\Common Files\Creative
2006-10-02 22:57 -------- d-------- C:\Program Files\Common Files\Creative Labs Shared
2006-10-02 22:54 -------- d-------- C:\Program Files\SigmaTel
2006-10-02 22:50 -------- d-------- C:\Documents and Settings\Adam\Application Data\Mozilla
2006-10-02 22:33 -------- d-------- C:\Program Files\Intel
2006-10-02 22:30 -------- d-------- C:\Documents and Settings\Adam\Application Data\atitray
2006-10-02 22:26 -------- d-------- C:\Program Files\MultiRes
2006-10-02 22:25 451072 --a------ C:\WINDOWS\Radeon Omega Drivers v3.8.273 Uninstall.exe
2006-10-02 22:25 -------- d-------- C:\Program Files\Radeon Omega Drivers
2006-10-02 22:18 -------- d-------- C:\Program Files\Dell
2006-10-02 22:18 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-10-02 22:14 -------- d--h----- C:\Program Files\Uninstall Information
2006-10-02 22:14 -------- d-------- C:\Documents and Settings\Adam\Application Data\Identities
2006-10-02 22:09 -------- d-------- C:\Program Files\xerox
2006-10-02 22:09 -------- d-------- C:\Program Files\microsoft frontpage
2006-10-02 22:08 -------- d--h----- C:\Program Files\WindowsUpdate
2006-10-02 22:07 -------- d-------- C:\Program Files\NetMeeting
2006-10-02 22:07 -------- d-------- C:\Program Files\Movie Maker
2006-10-02 22:07 -------- d-------- C:\Program Files\Common Files\Services
2006-10-02 22:07 -------- d-------- C:\Program Files\Common Files\MSSoap
2006-10-02 22:06 -------- d-------- C:\Program Files\ComPlus Applications
2006-10-02 22:05 -------- d-------- C:\Program Files\Windows NT
2006-10-02 22:05 -------- d-------- C:\Program Files\Online Services
2006-10-02 22:05 -------- d-------- C:\Program Files\MSN Gaming Zone
2006-10-02 22:04 -------- d-------- C:\Program Files\MSN
2006-10-02 17:33 -------- d-------- C:\Program Files\Common Files\SpeechEngines
2006-10-02 17:33 -------- d-------- C:\Program Files\Common Files\ODBC
2006-10-02 17:32 62 --ahs---- C:\Documents and Settings\Adam\Application Data\desktop.ini
2006-09-13 01:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-08-25 11:45 617472 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-16 07:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll
2006-08-16 05:37 225664 --a------ C:\WINDOWS\system32\drivers\tcpip6.sys
2006-08-14 06:34 332928 --a------ C:\WINDOWS\system32\drivers\srv.sys
2006-07-21 04:24 72704 --a------ C:\WINDOWS\system32\hlink.dll
2006-07-18 22:58 258048 --a------ C:\WINDOWS\system32\ati2dvag.dll
2006-07-18 22:53 77824 --a------ C:\WINDOWS\system32\Oemdspif.dll
2006-07-18 22:53 26112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe
2006-07-18 22:53 114688 --a------ C:\WINDOWS\system32\atipdlxx.dll
2006-07-18 22:52 86016 --a------ C:\WINDOWS\system32\ati2evxx.dll
2006-07-18 22:52 41984 --a------ C:\WINDOWS\system32\ati2edxx.dll
2006-07-18 22:51 53248 --a------ C:\WINDOWS\system32\ATIDDC.DLL
2006-07-18 22:51 401408 --a------ C:\WINDOWS\system32\ati2evxx.exe
2006-07-18 22:44 2732608 --a------ C:\WINDOWS\system32\ati3duag.dll
2006-07-18 22:39 1744416 --a------ C:\WINDOWS\system32\ativvaxx.dll
2006-07-18 22:27 204800 --a------ C:\WINDOWS\system32\atikvmag.dll
2006-07-18 22:26 17408 --a------ C:\WINDOWS\system32\atitvo32.dll
2006-07-18 22:23 307200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2006-07-18 22:22 6684672 --a------ C:\WINDOWS\system32\atioglx1.dll
2006-07-18 22:22 286720 --a------ C:\WINDOWS\system32\ati2cqag.dll
2006-07-18 22:21 290816 --a------ C:\WINDOWS\system32\ATIDEMGR.dll
2006-07-18 22:13 5136384 --a------ C:\WINDOWS\system32\atioglxx.dll
2006-07-14 14:51 108144 --a------ C:\WINDOWS\system32\GEARAspi.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SetDefaultMIDI"="MIDIDef.exe"
"BlazeServoTool"="\"C:\\Program Files\\BlazeVideo\\BlazeDVD4 Professional\\MediaDetector.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="C:\\WINDOWS\\system32\\WLTRAY.exe"
"AtiPTA"="atiptaxx.exe"
"SigmatelSysTrayApp"="stsystra.exe"
"CTSysVol"="C:\\Program Files\\Creative\\SBAudigy\\Surround Mixer\\CTSysVol.exe /r"
"MBMon"="Rundll32 CTMBHA.DLL,MBMon"
"UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Creative MediaSource Go]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CTCMSGoU"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Creative\\MediaSource5\\Go\\CTCMSGoU.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Dell QuickSet]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="quickset"
"hkey"="HKLM"
"command"="C:\\Program Files\\Dell\\QuickSet\\quickset.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\VoiceCenter]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AndreaVC"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Creative\\VoiceCenter\\AndreaVC.exe\" /tray"
"inimapping"="0"


HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Completion time: Thu 10/12/2006 17:07:36.32
ComboFix.txt
ComboFix2.txt

Ewido:
CWINDOWSsystem32ssqoopn.dll - Adware.Virtumonde No action taken.
mozilla.116CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Adbrite No action taken.
mozilla.120CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Adbrite No action taken.
mozilla.112CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Adrevolver No action taken.
mozilla.113CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Adrevolver No action taken.
mozilla.114CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Adrevolver No action taken.
mozilla.122CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Adrevolver No action taken.
mozilla.129CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Adrevolver No action taken.
mozilla.104CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Advertising No action taken.
mozilla.105CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Advertising No action taken.
mozilla.106CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Advertising No action taken.
mozilla.107CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Advertising No action taken.
mozilla.108CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Advertising No action taken.
mozilla.21CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Atdmt No action taken.
mozilla.100CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Bridgetrack No action taken.
mozilla.98CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Bridgetrack No action taken.
mozilla.99CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Bridgetrack No action taken.
mozilla.119CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Clickhype No action taken.
mozilla.17CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Doubleclick No action taken.
mozilla.136CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Fastclick No action taken.
mozilla.137CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Fastclick No action taken.
mozilla.138CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Fastclick No action taken.
mozilla.15CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Mediaplex No action taken.
mozilla.133CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Overture No action taken.
mozilla.16CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Pointroll No action taken.
mozilla.18CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Pointroll No action taken.
mozilla.19CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Pointroll No action taken.
mozilla.20CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Pointroll No action taken.
mozilla.143CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Questionmarket No action taken.
mozilla.144CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Questionmarket No action taken.
mozilla.134CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Revenue No action taken.
mozilla.141CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Revenue No action taken.
mozilla.142CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Revenue No action taken.
mozilla.130CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Ru4 No action taken.
mozilla.131CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Ru4 No action taken.
mozilla.132CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Ru4 No action taken.
mozilla.65CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Serving-sys No action taken.
mozilla.66CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Serving-sys No action taken.
mozilla.67CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Serving-sys No action taken.
mozilla.68CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Serving-sys No action taken.
mozilla.69CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Serving-sys No action taken.
mozilla.54CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Tacoda No action taken.
mozilla.55CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Tacoda No action taken.
mozilla.56CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Tacoda No action taken.
mozilla.57CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Tacoda No action taken.
mozilla.115CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Trafficmp No action taken.
mozilla.117CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Trafficmp No action taken.
mozilla.121CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Trafficmp No action taken.
mozilla.123CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Trafficmp No action taken.
mozilla.124CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Trafficmp No action taken.
mozilla.125CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Trafficmp No action taken.
mozilla.126CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Trafficmp No action taken.
mozilla.128CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Trafficmp No action taken.
mozilla.46CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Tribalfusion No action taken.
mozilla.47CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Tribalfusion No action taken.
mozilla.48CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Tribalfusion No action taken.
mozilla.49CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Tribalfusion No action taken.
mozilla.50CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Tribalfusion No action taken.
mozilla.51CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Tribalfusion No action taken.
mozilla.52CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Tribalfusion No action taken.
mozilla.53CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Tribalfusion No action taken.
mozilla.139CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Yieldmanager No action taken.
mozilla.140CDocuments and SettingsAdamApplication DataMozillaFirefoxProfilesv5qmyguv.defaultcookies.txt - TrackingCookie.Yieldmanager No action taken.
CWINDOWSsystem32winrzf32.dll - Trojan.Agent.vg No action taken.


Report end


HJT:

Logfile of HijackThis v1.99.1
Scan saved at 5:22:29 PM, on 10/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\DOCUME~1\Adam\LOCALS~1\Temp\clclean.0001
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\BlazeVideo\BlazeDVD4 Professional\MediaDetector.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Documents and Settings\Adam\Desktop\HJT\show.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [BlazeServoTool] "C:\Program Files\BlazeVideo\BlazeDVD4 Professional\MediaDetector.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/englis...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/active...
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE (file missing)


Report Offensive Follow Up For Removal

Response Number 7
Name: jabuck
Date: October 12, 2006 at 18:34:27 Pacific
Reply: (edit)

Run Killbox from safe mode.


Please double-click Killbox.exe to run it.
Select:
Delete on Reboot
then Click on the All Files button.
Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\system32\ssqoopn.dll

CWINDOWSsystem32winrzf32.dll

Return to Killbox, go to the File menu, and choose Paste from Clipboard.


Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let us know if you receive this message!).

If your computer does not restart automatically, please restart it manually.


If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click Here to download and run missingfilesetup.exe. Then try Killbox again.

Run AFT-Cleaner from safe mode.

Reboot to normal mode.

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.

Post a combofix log please and a Hijack This please.


Report Offensive Follow Up For Removal

Response Number 8
Name: worthers20
Date: October 13, 2006 at 00:30:07 Pacific
Reply: (edit)

First of all, I did get the PendingFileRename prompt.

Here is combolog:
Adam - 06-10-13 3:27:32.73 Service Pack 2
ComboFix 06.10.11 - Running from: "C:\Documents and Settings\Adam\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-09-13 to 2006-10-13 ))))))))))))))))))))))))))))))))))

2006-10-11 01:08 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2006-10-09 02:11 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-10-06 22:18 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2006-10-04 01:06 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2006-10-03 22:49 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2006-10-03 22:47 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2006-10-03 15:29 94,299 --a------ C:\WINDOWS\system32\SynTPAPI.dll
2006-10-03 15:29 82,014 --a------ C:\WINDOWS\system32\SynCOM.dll
2006-10-03 15:29 81,920 --a------ C:\WINDOWS\system32\SynTPCo2.dll
2006-10-03 15:29 69,723 --a------ C:\WINDOWS\system32\SynTPFcs.dll
2006-10-03 15:29 191,872 --a------ C:\WINDOWS\system32\drivers\SynTP.sys
2006-10-03 15:29 114,688 --a------ C:\WINDOWS\system32\SynCtrl.dll
2006-10-02 23:17 87,808 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2006-10-02 23:17 107,696 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2006-10-02 23:02 44,032 --------- C:\WINDOWS\system32\CTSVCCDA.EXE
2006-10-02 23:02 25,088 --------- C:\WINDOWS\system32\CTSVCCTL.EXE
2006-10-02 23:01 90,112 --------- C:\WINDOWS\Updreg.EXE
2006-10-02 23:01 9,728 --------- C:\WINDOWS\system32\drivers\PfModNT.sys
2006-10-02 22:56 40,448 --a------ C:\WINDOWS\system32\CiEcho.dll
2006-10-02 22:56 20,992 --a------ C:\WINDOWS\system32\sfman32.dll
2006-10-02 22:56 160,768 --a------ C:\WINDOWS\system32\cifilter.dll
2006-10-02 22:56 158,464 --a------ C:\WINDOWS\system32\drivers\ctusfsyn.sys
2006-10-02 22:56 138,752 --a------ C:\WINDOWS\system32\drivers\ctsfm2k.sys
2006-10-02 22:56 115,200 --a------ C:\WINDOWS\system32\sfms32.dll
2006-10-02 22:56 11,776 --a------ C:\WINDOWS\inres.dll
2006-10-02 22:56 106,496 --a------ C:\WINDOWS\system32\drivers\ctoss2k.sys
2006-10-02 22:56 1,389,056 --a------ C:\WINDOWS\system32\drivers\monfilt.sys
2006-10-02 22:55 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2006-10-02 22:55 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2006-10-02 22:55 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2006-10-02 22:55 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2006-10-02 22:55 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2006-10-02 22:55 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2006-10-02 22:55 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2006-10-02 22:55 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys
2006-10-02 22:55 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2006-10-02 22:55 172,416 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2006-10-02 22:55 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys
2006-10-02 22:54 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2006-10-02 22:54 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2006-10-02 22:54 282,624 --a------ C:\WINDOWS\sts