PCTech Forums

by **kangtim69** » Fri May 04, 2007 9:42 pm

I've ran ccleaner and spybot and windows defender but I'm still getting warnings and the pc is very slow. Help please

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 4:38:12 PM, on 5/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Digital Media Reader\readericon45G.exe
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\iolo\System Mechanic 6\SMSystemAnalyzer.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\WINDOWS\system32\CROSOF~1\dvdplay.exe
C:\Program Files\EarthLink TotalAccess\FastLane\IPClient.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\EarthLink TotalAccess\Accelerator\ElinkAcc.exe
C:\Documents and Settings\The Kang\Desktop\Software\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/m ... earch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/m ... earch.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: EarthLink ScamBlocker V2 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: EarthLink PopUp Blocker V2 - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IE_PopupBlocker Class - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\Program Files\EarthLink TotalAccess\Accelerator\prpl_IePopupBlocker.dll
O2 - BHO: Earthlink Protection BHO - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: (no name) - {A86E7C02-3254-463F-B41B-4525BA371D9E} - C:\WINDOWS\system32\gebya.dll
O2 - BHO: (no name) - {D2692EE8-4795-44F4-A8FF-8FAC5D4FE947} - C:\WINDOWS\system32\pmnomjj.dll
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\ivmqkpau.dll
O2 - BHO: Uninstall Legacy Earthlink Toolbar - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\pefibkjl.dll",realset
O4 - HKCU\..\Run: [Power2GoExpress] NA
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 6\SMSystemAnalyzer.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Ealb] "C:\WINDOWS\system32\CROSOF~1\dvdplay.exe" -vt yazb
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-image.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 6018433515
O17 - HKLM\System\CCS\Services\Tcpip\..\{B568FE8E-75C2-4F26-821B-CB2342FABCA8}: NameServer = 207.69.188.185 207.69.188.186
O20 - Winlogon Notify: gebya - C:\WINDOWS\system32\gebya.dll
O20 - Winlogon Notify: pmnomjj - C:\WINDOWS\SYSTEM32\pmnomjj.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: EarthLink Monitor Service (EarthLinkMonitor) - Boingo Wireless, Inc. - C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

--
End of file - 8898 bytes

by **Gecko** » Fri May 04, 2007 10:15 pm

Hello kangtim69, welcome to our forum.

Warning these instructions are for this thread only!
You should never attempt to use them for anything else!

Please copy this to Notepad and save it to your desktop or print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
You should not have any other open windows when you are following the procedures below.

You need to turn off Windows Defenders Real-time protection:
Open Windows Defender
Click on "Tools"
Click on "General Settings"
Scroll down to "Real-time protection options"
Uncheck "Turn on Real-time protection (recommended)"
Click "Save"
Exit the program.

Once your log is clean you can re-enable Windows Defender Real Time Protection.

Please download to your desktop.

Double click combofix.exe and follow the prompts.

When it's done running it will produce a log for you. Please post that log in your next reply.

Important Note - Do not mouseclick combofix's window while it's running, that may cause it to stall.

by **kangtim69** » Wed May 09, 2007 12:10 pm

Been having trouble getting the reply to post. I downloaded superantispy and ran it first. Here's the combofix after running that program.

"The Kang" - 07-05-05 12:24:32 Service Pack 2
ComboFix 07-04-25.4V - Running from: "C:\Documents and Settings\The Kang\Desktop\"

(((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\ivmqkpau.dll
C:\WINDOWS\system32\aybeg.bak1
C:\WINDOWS\system32\aybeg.bak2
C:\WINDOWS\system32\aybeg.ini
C:\WINDOWS\system32\gebya.dll

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Program Files\Common Files\Yazzle1162OinUninstaller.exe
C:\Program Files\outerinfo\Terms.rtf
C:\WINDOWS\svchost.exe
C:\Program Files\outerinfo
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\C\WINDOWS\system32\CROSOF~1
C:\qoobox\purity\C\WINDOWS\system32\CROSOF~1\dvdplay.exe
C:\qoobox\purity\C\WINDOWS\system32\CROSOF~1\??crosoft

((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-05 ))))))))))))))))))))))))))))))))))

2007-05-04 13:20 132,660 --a------ C:\WINDOWS\system32\pefibkjl.dll
2007-05-04 12:56 <DIR> d-------- C:\!KillBox
2007-05-04 12:07 93,696 --a------ C:\WINDOWS\system32\drvcut.dll
2007-05-04 12:07 26,678 --a------ C:\WINDOWS\system32\pmnomjj.dll
2007-05-01 18:13 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2007-05-01 18:13 249,856 --------- C:\WINDOWS\Setup1.exe
2007-05-01 18:13 <DIR> d-------- C:\Program Files\Quick64
2007-05-01 18:02 <DIR> d--h----- C:\WINDOWS\msdownld.tmp
2007-05-01 15:43 40 --a------ C:\DOCUME~1\THEKAN~1\language.dat
2007-05-01 10:17 155,648 --a------ C:\WINDOWS\system32\libssl32.dll
2007-05-01 10:17 <DIR> d-------- C:\OpenSSL
2007-04-23 08:30 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2007-04-23 08:30 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2007-04-23 08:29 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2007-04-23 08:29 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2007-04-23 08:29 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
2007-04-23 08:29 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2007-04-23 08:29 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
2007-04-23 08:27 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2007-04-23 08:27 372,736 -ra------ C:\WINDOWS\system32\LVUI2RC.dll
2007-04-23 08:27 22,016 -ra------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2007-04-23 08:27 211,712 -ra------ C:\WINDOWS\system32\drivers\LV561AV.SYS
2007-04-23 08:27 204,800 -ra------ C:\WINDOWS\system32\LVUI2.dll
2007-04-23 08:27 204,800 -ra------ C:\WINDOWS\system32\lvcodec2.dll
2007-04-23 08:27 106,496 -ra------ C:\WINDOWS\system32\lvcoinst.dll
2007-04-23 08:19 53,248 -ra------ C:\WINDOWS\system32\InstMed.exe
2007-04-23 08:19 <DIR> d-------- C:\Program Files\Common Files\Logitech
2007-04-23 08:18 90,112 --a------ C:\WINDOWS\system32\LQCUI2.dll
2007-04-23 08:18 856,064 --a------ C:\WINDOWS\system32\Ltwvc12n.dll
2007-04-23 08:18 78,336 --a------ C:\WINDOWS\system32\lffax12n.dll
2007-04-23 08:18 466,944 --a------ C:\WINDOWS\system32\QCUI2.dll
2007-04-23 08:18 462,848 --a------ C:\WINDOWS\system32\LCamCpl.dll
2007-04-23 08:18 406,016 --a------ C:\WINDOWS\system32\ltkrn12n.dll
2007-04-23 08:18 328,704 --a------ C:\WINDOWS\system32\LFCMP12n.DLL
2007-04-23 08:18 30,720 --a------ C:\WINDOWS\system32\lfbmp12n.dll
2007-04-23 08:18 259,072 --a------ C:\WINDOWS\system32\LTDIS12n.dll
2007-04-23 08:18 215,552 --a------ C:\WINDOWS\system32\Lvkrn12n.dll
2007-04-23 08:18 207,872 --a------ C:\WINDOWS\system32\ltefx12n.dll
2007-04-23 08:18 164,864 --a------ C:\WINDOWS\system32\ltimg12n.dll
2007-04-23 08:18 141,312 --a------ C:\WINDOWS\system32\lftif12n.dll
2007-04-23 08:18 131,072 --a------ C:\WINDOWS\system32\ltfil12n.DLL
2007-04-23 08:18 <DIR> d-------- C:\Program Files\Logitech
2007-04-20 20:27 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
2007-04-18 20:11 22,016 --a------ C:\WINDOWS\system32\winhdn32.dll
2007-04-18 12:27 <DIR> d-------- C:\Program Files\uTorrent
2007-04-18 12:27 <DIR> d-------- C:\DOCUME~1\THEKAN~1\APPLIC~1\uTorrent
2007-04-18 11:59 <DIR> d-------- C:\DOCUME~1\THEKAN~1\APPLIC~1\acccore
2007-04-18 11:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL OCP
2007-04-18 11:57 <DIR> d-------- C:\Program Files\AIM6
2007-04-18 10:24 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL Downloads
2007-04-18 09:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
2007-04-18 07:41 <DIR> d-------- C:\Program Files\Yahoo!
2007-04-17 09:35 23,040 --------- C:\WINDOWS\kb913800.exe
2007-04-16 20:01 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-04-15 20:26 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2007-04-15 20:24 69,632 --------- C:\WINDOWS\system32\Ffdriver.dll
2007-04-15 20:24 204,800 --------- C:\WINDOWS\system32\Ffpage.dll
2007-04-15 19:38 <DIR> d-------- C:\Program Files\SlySoft
2007-04-15 11:10 <DIR> d-------- C:\Program Files\DAMN NFO Viewer
2007-04-14 07:32 <DIR> d-------- C:\DOCUME~1\THEKAN~1\APPLIC~1\MSNInstaller
2007-04-12 23:47 <DIR> d-------- C:\DOCUME~1\THEKAN~1\APPLIC~1\WinRAR
2007-04-12 21:07 <DIR> d--hs---- C:\WINDOWS\ftpcache
2007-04-11 09:12 <DIR> d-------- C:\DOCUME~1\THEKAN~1\APPLIC~1\Help
2007-04-10 18:00 720,896 --a------ C:\WINDOWS\iun6002.exe
2007-04-10 18:00 <DIR> d-------- C:\jKeysMegaPack
2007-04-10 17:53 <DIR> d-------- C:\DOCUME~1\THEKAN~1\APPLIC~1\Template
2007-04-10 17:44 39,488 --a------ C:\WINDOWS\system32\drivers\Pcouffin.sys
2007-04-10 17:44 <DIR> d-------- C:\Program Files\CloneDVD
2007-04-10 17:42 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\1.0.0.0
2007-04-10 17:32 <DIR> d-------- C:\Program Files\Symantec
2007-04-10 17:05 <DIR> d-------- C:\Program Files\ftapirate
2007-04-09 18:05 299,520 --a------ C:\WINDOWS\uninst.exe
2007-04-08 18:43 <DIR> d-------- C:\DOCUME~1\THEKAN~1\APPLIC~1\Ulead Systems
2007-04-08 18:26 <DIR> d-------- C:\Program Files\Common Files\Nova Development
2007-04-08 18:15 <DIR> d-------- C:\Program Files\Nova Development
2007-04-08 18:15 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems
2007-04-08 18:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
2007-04-08 18:14 <DIR> d-------- C:\Program Files\Web Publish
2007-04-08 15:36 <DIR> d-------- C:\HEGames
2007-04-08 10:51 <DIR> d-------- C:\Program Files\Windows Defender
2007-04-08 10:50 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-04-08 09:13 <DIR> d-------- C:\DOCUME~1\THEKAN~1\APPLIC~1\HP
2007-04-08 09:12 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
2007-04-08 09:11 <DIR> d-------- C:\bin
2007-04-08 09:10 <DIR> d-------- C:\Program Files\Common Files\Sonic Shared
2007-04-08 09:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
2007-04-08 09:08 <DIR> d-------- C:\Program Files\Common Files\HP
2007-04-08 09:06 <DIR> d-------- C:\Program Files\Hewlett-Packard
2007-04-08 09:06 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2007-04-08 09:05 77,824 -ra------ C:\WINDOWS\system32\HPZIDS01.dll
2007-04-08 09:05 49,664 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys
2007-04-08 09:05 38,400 --a------ C:\WINDOWS\system32\hpz3l054.dll
2007-04-08 09:05 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2007-04-08 09:05 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-04-08 08:57 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2007-04-08 08:57 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2007-04-08 08:57 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe
2007-04-08 08:57 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2007-04-08 08:57 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll
2007-04-08 08:57 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2007-04-08 08:55 <DIR> d-------- C:\Program Files\HP
2007-04-08 08:51 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-04-08 08:51 117,118 --a------ C:\WINDOWS\hpoins11.dat
2007-04-08 08:50 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-04-08 03:58 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-04-08 01:52 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2007-04-07 20:12 <DIR> d-------- C:\Program Files\Common Files\aolback
2007-04-07 20:12 <DIR> d-------- C:\MAV
2007-04-07 20:12 <DIR> d-------- C:\Install ICQ
2007-04-07 20:02 <DIR> d--h----- C:\TEMP
2007-04-07 19:43 <DIR> d---s---- C:\DOCUME~1\THEKAN~1\UserData
2007-04-07 19:32 <DIR> d-------- C:\DOCUME~1\THEKAN~1\APPLIC~1\EarthLink Toolbar
2007-04-07 19:29 <DIR> d-------- C:\DOCUME~1\THEKAN~1\APPLIC~1\Earthlink
2007-04-07 19:27 <DIR> d-------- C:\Program Files\EarthLink TotalAccess
2007-04-07 19:27 <DIR> d-------- C:\Program Files\Common Files\EarthLink
2007-04-07 19:27 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
2007-04-07 19:21 41,472 --a------ C:\WINDOWS\system32\iolobtdfg.exe
2007-04-07 19:21 25,264 --a------ C:\WINDOWS\system32\smrgdf.exe
2007-04-07 19:21 1,211,904 --a------ C:\WINDOWS\system32\Incinerator.dll
2007-04-07 19:21 <DIR> d-------- C:\Program Files\iolo
2007-04-07 19:14 <DIR> d-------- C:\Program Files\Trend Micro
2007-04-07 19:14 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trend Micro
2007-04-07 19:07 <DIR> d-------- C:\Program Files\mIRC
2007-04-07 19:07 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-04-07 19:06 <DIR> d-------- C:\Program Files\CCleaner
2007-04-07 19:05 <DIR> d-------- C:\Program Files\DVD Shrink
2007-04-07 19:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
2007-04-07 18:28 600 --a------ C:\DOCUME~1\THEKAN~1\APPLIC~1\wklnhst.dat
2007-04-07 18:24 <DIR> d-------- C:\Program Files\Digital Media Reader
2007-04-07 18:11 <DIR> d-------- C:\Program Files\MSN Encarta Plus
2007-04-07 18:06 <DIR> d-------- C:\DOCUME~1\THEKAN~1\APPLIC~1\CyberLink
2007-04-07 17:47 <DIR> d-------- C:\DOCUME~1\THEKAN~1\APPLIC~1\AOL
2007-04-07 17:43 9,728 -ra------ C:\WINDOWS\system32\bdco1ins.dll
2007-04-07 17:43 9,728 -ra------ C:\WINDOWS\system32\bdco1.dll
2007-04-07 17:43 34,048 -ra------ C:\WINDOWS\system32\drivers\NVENETFD.sys
2007-04-07 17:43 33,280 -ra------ C:\WINDOWS\system32\nvconrm.dll
2007-04-07 17:43 301,312 -ra------ C:\WINDOWS\system32\drivers\nvnrm.sys
2007-04-07 17:43 221,824 -ra------ C:\WINDOWS\system32\drivers\nvsnpu.sys
2007-04-07 17:43 202,240 -ra------ C:\WINDOWS\system32\fdco1ins.dll
2007-04-07 17:43 202,240 -ra------ C:\WINDOWS\system32\fdco1.dll
2007-04-07 17:43 176,128 -ra------ C:\WINDOWS\system32\nvusmb.exe
2007-04-07 17:43 176,128 --a------ C:\WINDOWS\system32\nvunrm.exe
2007-04-07 17:43 12,928 -ra------ C:\WINDOWS\system32\drivers\nvnetbus.sys
2007-04-07 17:43 100,480 -ra------ C:\WINDOWS\system32\drivers\nvtcp.sys
2007-04-07 17:43 <DIR> d-------- C:\WINDOWS\NV248232.TMP
2007-04-07 17:42 4 --a------ C:\WINDOWS\Pix11.dat
2007-04-07 17:41 <DIR> d-------- C:\Program Files\Microsoft Digital Image 2006
2007-04-07 17:39 <DIR> d-------- C:\Program Files\Microsoft Works
2007-04-07 17:37 <DIR> d-------- C:\Program Files\CyberLink
2007-04-07 17:36 86,016 --a------ C:\WINDOWS\system32\nvmctray.dll
2007-04-07 17:36 81,920 --a------ C:\WINDOWS\system32\nvwddi.dll
2007-04-07 17:36 7,204,864 --a------ C:\WINDOWS\system32\nvcpl.dll
2007-04-07 17:36 573,440 --a------ C:\WINDOWS\system32\nvhwvid.dll
2007-04-07 17:36 5,365,760 --a------ C:\WINDOWS\system32\nvoglnt.dll
2007-04-07 17:36 466,944 --a------ C:\WINDOWS\system32\nvshell.dll
2007-04-07 17:36 46,080 --a------ C:\WINDOWS\system32\nvapi.dll
2007-04-07 17:36 45,056 --a------ C:\WINDOWS\system32\nvmccsrs.dll
2007-04-07 17:36 442,368 --a------ C:\WINDOWS\system32\nvappbar.exe
2007-04-07 17:36 393,216 --a------ C:\WINDOWS\system32\keystone.exe
2007-04-07 17:36 335,872 --a------ C:\WINDOWS\system32\nvwrses.dll
2007-04-07 17:36 335,872 --a------ C:\WINDOWS\system32\nvwrsel.dll
2007-04-07 17:36 33,280 --a------ C:\WINDOWS\system32\nvcodins.dll
2007-04-07 17:36 33,280 --a------ C:\WINDOWS\system32\nvcod.dll
2007-04-07 17:36 327,680 --a------ C:\WINDOWS\system32\nvwrsfr.dll
2007-04-07 17:36 327,680 --a------ C:\WINDOWS\system32\nvwrsesm.dll
2007-04-07 17:36 323,584 --a------ C:\WINDOWS\system32\nvwrspt.dll
2007-04-07 17:36 323,584 --a------ C:\WINDOWS\system32\nvwrsit.dll
2007-04-07 17:36 319,488 --a------ C:\WINDOWS\system32\nvwrsptb.dll
2007-04-07 17:36 319,488 --a------ C:\WINDOWS\system32\nvwrsnl.dll
2007-04-07 17:36 319,488 --a------ C:\WINDOWS\system32\nvrsar.dll
2007-04-07 17:36 315,392 --a------ C:\WINDOWS\system32\nvwrsru.dll
2007-04-07 17:36 315,392 --a------ C:\WINDOWS\system32\nvwrshu.dll
2007-04-07 17:36 315,392 --a------ C:\WINDOWS\system32\nvrshe.dll
2007-04-07 17:36 311,296 --a------ C:\WINDOWS\system32\nvwrsde.dll
2007-04-07 17:36 303,104 --a------ C:\WINDOWS\system32\nvwrstr.dll
2007-04-07 17:36 303,104 --a------ C:\WINDOWS\system32\nvwrssl.dll
2007-04-07 17:36 303,104 --a------ C:\WINDOWS\system32\nvwrsfi.dll
2007-04-07 17:36 299,008 --a------ C:\WINDOWS\system32\nvwrssk.dll
2007-04-07 17:36 299,008 --a------ C:\WINDOWS\system32\nvwrsno.dll
2007-04-07 17:36 294,912 --a------ C:\WINDOWS\system32\nvwrssv.dll
2007-04-07 17:36 294,912 --a------ C:\WINDOWS\system32\nvwrspl.dll
2007-04-07 17:36 294,912 --a------ C:\WINDOWS\system32\nvwrsda.dll
2007-04-07 17:36 286,720 --a------ C:\WINDOWS\system32\nvwrseng.dll
2007-04-07 17:36 286,720 --a------ C:\WINDOWS\system32\nvwrscs.dll
2007-04-07 17:36 286,720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll
2007-04-07 17:36 282,624 --a------ C:\WINDOWS\system32\nvwrsar.dll
2007-04-07 17:36 278,528 --a------ C:\WINDOWS\system32\nvwrshe.dll
2007-04-07 17:36 274,432 --a------ C:\WINDOWS\system32\nvrsit.dll
2007-04-07 17:36 274,432 --a------ C:\WINDOWS\system32\nvrsfr.dll
2007-04-07 17:36 274,432 --a------ C:\WINDOWS\system32\nvrses.dll
2007-04-07 17:36 274,432 --a------ C:\WINDOWS\system32\nvrsel.dll
2007-04-07 17:36 270,336 --a------ C:\WINDOWS\system32\nvrsde.dll
2007-04-07 17:36 266,240 --a------ C:\WINDOWS\system32\nvrspt.dll
2007-04-07 17:36 266,240 --a------ C:\WINDOWS\system32\nvrsnl.dll
2007-04-07 17:36 266,240 --a------ C:\WINDOWS\system32\nvrsesm.dll
2007-04-07 17:36 262,144 --a------ C:\WINDOWS\system32\nvrsru.dll
2007-04-07 17:36 262,144 --a------ C:\WINDOWS\system32\nvrsptb.dll
2007-04-07 17:36 258,048 --a------ C:\WINDOWS\system32\nvrsja.dll
2007-04-07 17:36 253,952 --a------ C:\WINDOWS\system32\nvrsko.dll
2007-04-07 17:36 253,952 --a------ C:\WINDOWS\system32\nvrshu.dll
2007-04-07 17:36 249,856 --a------ C:\WINDOWS\system32\nvrstr.dll
2007-04-07 17:36 249,856 --a------ C:\WINDOWS\system32\nvrssl.dll
2007-04-07 17:36 249,856 --a------ C:\WINDOWS\system32\nvrssk.dll
2007-04-07 17:36 249,856 --a------ C:\WINDOWS\system32\nvrspl.dll
2007-04-07 17:36 245,760 --a------ C:\WINDOWS\system32\nvrssv.dll
2007-04-07 17:36 245,760 --a------ C:\WINDOWS\system32\nvrsno.dll
2007-04-07 17:36 245,760 --a------ C:\WINDOWS\system32\nvrsda.dll
2007-04-07 17:36 241,664 --a------ C:\WINDOWS\system32\nvrsfi.dll
2007-04-07 17:36 241,664 --a------ C:\WINDOWS\system32\nvrseng.dll
2007-04-07 17:36 241,664 --a------ C:\WINDOWS\system32\nvrscs.dll
2007-04-07 17:36 229,376 --a------ C:\WINDOWS\system32\nvmccs.dll
2007-04-07 17:36 217,088 --a------ C:\WINDOWS\system32\nvrszhc.dll
2007-04-07 17:36 212,992 --a------ C:\WINDOWS\system32\nvwrsja.dll
2007-04-07 17:36 196,608 --a------ C:\WINDOWS\system32\nvwrsko.dll
2007-04-07 17:36 176,128 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-04-07 17:36 176,128 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-04-07 17:36 167,936 --a------ C:\WINDOWS\system32\nvwrszht.dll
2007-04-07 17:36 163,840 --a------ C:\WINDOWS\system32\nvwrszhc.dll
2007-04-07 17:36 147,456 --a------ C:\WINDOWS\system32\nvcolor.exe
2007-04-07 17:36 131,139 --a------ C:\WINDOWS\system32\nvsvc32.exe
2007-04-07 17:36 118,784 --a------ C:\WINDOWS\system32\nvrszht.dll
2007-04-07 17:36 1,662,976 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2007-04-07 17:36 1,519,616 --a------ C:\WINDOWS\system32\nwiz.exe
2007-04-07 17:36 1,466,368 --a------ C:\WINDOWS\system32\nview.dll
2007-04-07 17:36 1,339,392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2007-04-07 17:36 1,019,904 --a------ C:\WINDOWS\system32\nvwimg.dll
2007-04-07 17:36 <DIR> d-------- C:\WINDOWS\nview
2007-04-07 17:35 90,112 -ra------ C:\WINDOWS\soundman.exe
2007-04-07 17:35 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2007-04-07 17:35 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2007-04-07 17:35 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2007-04-07 17:35 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2007-04-07 17:35 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2007-04-07 17:35 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2007-04-07 17:35 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2007-04-07 17:35 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2007-04-07 17:35 40,960 --------- C:\WINDOWS\system32\ChCfg.exe
2007-04-07 17:35 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys
2007-04-07 17:35 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2007-04-07 17:35 307,200 --------- C:\WINDOWS\alcupd.exe
2007-04-07 17:35 3,644,800 -ra------ C:\WINDOWS\system32\drivers\alcxwdm.sys
2007-04-07 17:35 212,992 --------- C:\WINDOWS\alcrmv.exe
2007-04-07 17:35 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2007-04-07 17:35 172,416 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2007-04-07 17:35 156,672 -ra------ C:\WINDOWS\system32\RtlCPAPI.dll
2007-04-07 17:35 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2007-04-07 17:35 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys
2007-04-07 17:35 10,458,112 -ra------ C:\WINDOWS\system32\RTLCPL.exe
2007-04-07 17:35 <DIR> d-------- C:\Program Files\Realtek Sound Manager
2007-04-07 17:35 <DIR> d-------- C:\Program Files\Realtek AC97
2007-04-07 17:35 <DIR> d-------- C:\Program Files\AvRack
2007-04-07 17:33 86,016 -ra------ C:\WINDOWS\system32\mdmxsdk.dll
2007-04-07 17:33 705,280 -ra------ C:\WINDOWS\system32\drivers\HSF_CNXT.sys
2007-04-07 17:33 42,858 -ra------ C:\WINDOWS\system32\hsfci014.dll
2007-04-07 17:33 221,440 -ra------ C:\WINDOWS\system32\drivers\HSFHWBS2.sys
2007-04-07 17:33 13,059 -ra------ C:\WINDOWS\system32\drivers\mdmxsdk.sys
2007-04-07 17:33 10,280 --a------ C:\WINDOWS\BigFixClientOverride.dll
2007-04-07 17:33 1,033,600 -ra------ C:\WINDOWS\system32\drivers\HSF_DPV.sys
2007-04-07 17:33 <DIR> d-------- C:\Program Files\CONEXANT
2007-04-07 17:33 <DIR> d-------- C:\Program Files\BigFix
2007-04-07 17:32 86,016 --a------ C:\WINDOWS\unvise32qt.exe
2007-04-07 17:32 8,552 --a------ C:\WINDOWS\system32\drivers\asctrm.sys
2007-04-07 17:32 102,400 --a------ C:\WINDOWS\system32\SimpleRegistry.dll
2007-04-07 17:32 10,752 --a------ C:\WINDOWS\system32\aamd532.dll
2007-04-07 17:32 <DIR> d-------- C:\WINDOWS\system32\QuickTime
2007-04-07 17:32 <DIR> d-------- C:\Program Files\Viewpoint
2007-04-07 17:32 <DIR> d-------- C:\Program Files\Real
2007-04-07 17:32 <DIR> d-------- C:\Program Files\QuickTime
2007-04-07 17:32 <DIR> d-------- C:\Program Files\Common Files\Real
2007-04-07 17:32 <DIR> d-------- C:\Program Files\Common Files\Nullsoft
2007-04-07 17:32 <DIR> d-------- C:\My Music
2007-04-07 17:32 <DIR> d-------- C:\DOCUME~1\THEKAN~1\APPLIC~1\You've Got Pictures Screensaver
2007-04-07 17:32 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
2007-04-07 17:32 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
2007-04-07 17:32 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pure Networks
2007-04-07 17:31 89,088 --a------ C:\WINDOWS\system32\atl71.dll
2007-04-07 17:31 335 --a------ C:\WINDOWS\nsreg.dat
2007-04-07 17:31 <DIR> d-------- C:\Program Files\Common Files\AOL
2007-04-07 17:31 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
2007-04-07 17:30 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-04-07 17:30 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-04-07 17:30 <DIR> d-------- C:\Program Files\Common Files\New Boundary
2007-04-07 17:30 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2007-04-07 17:30 <DIR> d-------- C:\DriversApps
2007-04-07 17:30 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Prism Deploy
2007-04-07 17:21 2,621,440 --ah----- C:\DOCUME~1\THEKAN~1\NTUSER.DAT
2007-04-07 17:21 <DIR> d-------- C:\SYSPREP
2007-04-07 17:21 <DIR> d-------- C:\DOCUME~1\THEKAN~1\WINDOWS
2007-04-07 17:17 <DIR> d--hs---- C:\RECYCLER
2007-04-07 17:16 262,144 --a------ C:\DOCUME~1\ALLUSE~1\NTUSER.DAT
2007-04-07 17:16 <DIR> d-------- C:\WINDOWS\system32\ReinstallBackups
2007-04-07 17:16 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\WINDOWS
2007-04-07 17:15 7,168 --a------ C:\WINDOWS\system32\hccoin.dll
2007-04-07 17:15 26,624 --a------ C:\WINDOWS\system32\drivers\usbehci.sys
2007-04-07 17:15 17,024 --a------ C:\WINDOWS\system32\drivers\usbohci.sys
2007-04-07 17:13 <DIR> d--hs---- C:\System Volume Information
2007-04-07 16:06 60 --a------ C:\WINDOWS\system32\SYSDRV.DAT
2007-04-07 16:05 69,700 --a------ C:\WINDOWS\system32\usrshuta.exe
2007-04-07 16:05 49,211 --a------ C:\WINDOWS\system32\usrvpa.dll
2007-04-07 16:05 49,209 --a------ C:\WINDOWS\system32\usrv80a.dll
2007-04-07 16:05 45,116 --a------ C:\WINDOWS\system32\usrvoica.dll
2007-04-07 16:05 41,019 --a------ C:\WINDOWS\system32\usrsvpia.dll
2007-04-07 16:05 3,200 --a------ C:\WINDOWS\system32\wowfax.dll
2007-04-07 16:05 13,824 --a------ C:\WINDOWS\system32\wowfaxui.dll
2007-04-07 16:05 102,457 --a------ C:\WINDOWS\system32\usrv42a.dll
2007-04-07 16:04 86,073 --a------ C:\WINDOWS\system32\usrfaxa.dll
2007-04-07 16:04 8,192 --a------ C:\WINDOWS\system32\tsbyuv.dll
2007-04-07 16:04 8,192 --a------ C:\WINDOWS\system32\streamci.dll
2007-04-07 16:04 77,891 --a------ C:\WINDOWS\system32\usrmlnka.exe
2007-04-07 16:04 77,890 --a------ C:\WINDOWS\system32\usrdpa.dll
2007-04-07 16:04 77,883 --a------ C:\WINDOWS\system32\usrrtosa.dll
2007-04-07 16:04 74,752 --a------ C:\WINDOWS\system32\storprop.dll
2007-04-07 16:04 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2007-04-07 16:04 72,192 --a------ C:\WINDOWS\system32\sprio800.dll
2007-04-07 16:04 70,656 --a------ C:\WINDOWS\system32\sprio600.dll
2007-04-07 16:04 69,699 --a------ C:\WINDOWS\system32\usrcoina.dll
2007-04-07 16:04 69,632 --a------ C:\WINDOWS\system32\spnike.dll
2007-04-07 16:04 61,508 --a------ C:\WINDOWS\system32\usrprbda.exe
2007-04-07 16:04 61,500 --a------ C:\WINDOWS\system32\usrcntra.dll
2007-04-07 16:04 53,305 --a------ C:\WINDOWS\system32\usrlbva.dll
2007-04-07 16:04 49,211 --a------ C:\WINDOWS\system32\usrsdpia.dll
2007-04-07 16:04 323,641 --a------ C:\WINDOWS\system32\usrdtea.dll
2007-04-07 16:03 58,112 --a------ C:\WINDOWS\system32\drivers\vdmindvd.sys
2007-04-07 16:03 55,296 --a------ C:\WINDOWS\system32\dvdplay.exe
2007-04-07 16:03 47,616 --a------ C:\WINDOWS\system32\iyuv_32.dll
2007-04-07 16:03 35,328 --a------ C:\WINDOWS\system32\pid.dll
2007-04-07 16:03 3,905,408 --a------ C:\WINDOWS\system32\nv4_disp.dll
2007-04-07 16:03 23,936 --a------ C:\WINDOWS\system32\drivers\usbcamd2.sys
2007-04-07 16:03 23,808 --a------ C:\WINDOWS\system32\drivers\usbcamd.sys
2007-04-07 16:03 20,992 --a------ C:\WINDOWS\system32\hid.dll
2007-04-07 16:03 17,408 --a------ C:\WINDOWS\system32\msyuv.dll
2007-04-07 16:03 16,000 --a------ C:\WINDOWS\system32\drivers\usbintel.sys
2007-04-07 16:03 157,696 --a------ C:\WINDOWS\system32\paqsp.dll
2007-04-07 16:03 15,360 --a------ C:\WINDOWS\system32\pjlmon.dll
2007-04-07 16:03 147,968 --a------ C:\WINDOWS\system32\mdwmdmsp.dll
2007-04-07 16:03 12,416 --a------ C:\WINDOWS\system32\drivers\tunmp.sys
2007-04-07 16:02 80,128 --a------ C:\WINDOWS\system32\drivers\parport.sys
2007-04-07 16:02 63,744 --a------ C:\WINDOWS\system32\drivers\mf.sys
2007-04-07 16:02 61,824 --a------ C:\WINDOWS\system32\drivers\nic1394.sys
2007-04-07 16:02 60,800 --a------ C:\WINDOWS\system32\drivers\arp1394.sys
2007-04-07 16:02 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-04-07 16:02 52,224 --a------ C:\WINDOWS\system32\dmutil.dll
2007-04-07 16:02 51,712 --a------ C:\WINDOWS\system32\drivers\tosdvd.sys
2007-04-07 16:02 48,640 --a------ C:\WINDOWS\system32\drivers\stream.sys
2007-04-07 16:02 47,104 --a------ C:\WINDOWS\system32\cnbjmon.dll
2007-04-07 16:02 44,928 --a------ C:\WINDOWS\system32\drivers\AGPCPQ.SYS
2007-04-07 16:02 43,008 --a------ C:\WINDOWS\system32\drivers\AMDAGP.SYS
2007-04-07 16:02 42,752 --a------ C:\WINDOWS\system32\drivers\ALIM1541.SYS
2007-04-07 16:02 42,496 --a------ C:\WINDOWS\system32\drivers\p3.sys
2007-04-07 16:02 42,368 --a------ C:\WINDOWS\system32\drivers\AGP440.SYS
2007-04-07 16:02 42,240 --a------ C:\WINDOWS\system32\drivers\VIAAGP.SYS
2007-04-07 16:02 41,088 --a------ C:\WINDOWS\system32\drivers\SISAGP.SYS
2007-04-07 16:02 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2007-04-07 16:02 4,352 --a------ C:\WINDOWS\system32\drivers\swenum.sys
2007-04-07 16:02 37,376 --a------ C:\WINDOWS\system32\drivers\amdk7.sys
2007-04-07 16:02 36,992 --a------ C:\WINDOWS\system32\drivers\amdk6.sys
2007-04-07 16:02 36,480 --a------ C:\WINDOWS\system32\drivers\crusoe.sys
2007-04-07 16:02 35,328 --a------ C:\WINDOWS\system32\drivers\processr.sys
2007-04-07 16:02 30,080 --a------ C:\WINDOWS\system32\drivers\modem.sys
2007-04-07 16:02 3,493,984 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-04-07 16:02 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-04-07 16:02 262,528 --a------ C:\WINDOWS\system32\drivers\cinemst2.sys
2007-04-07 16:02 25,472 --a------ C:\WINDOWS\system32\drivers\sonydcam.sys
2007-04-07 16:02 23,040 --a------ C:\WINDOWS\system32\drivers\mouclass.sys
2007-04-07 16:02 21,376 --a------ C:\WINDOWS\system32\drivers\tsbvcap.sys
2007-04-07 16:02 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2007-04-07 16:02 19,968 --a------ C:\WINDOWS\system32\drivers\mxnic.sys
2007-04-07 16:02 18,688 --a------ C:\WINDOWS\system32\drivers\cdaudio.sys
2007-04-07 16:02 15,488 --a------ C:\WINDOWS\system32\drivers\mssmbios.sys
2007-04-07 16:02 140,928 --a------ C:\WINDOWS\system32\drivers\ks.sys
2007-04-07 16:02 12,160 --a------ C:\WINDOWS\system32\drivers\fsvga.sys
2007-04-07 16:02 12,032 --a------ C:\WINDOWS\system32\drivers\riodrv.sys
2007-04-07 16:02 12,032 --a------ C:\WINDOWS\system32\drivers\rio8drv.sys
2007-04-07 16:02 12,032 --a------ C:\WINDOWS\system32\drivers\nikedrv.sys
2007-04-07 16:02 11,776 --a------ C:\WINDOWS\system32\drivers\cpqdap01.sys
2007-04-07 16:01 91,648 --a------ C:\WINDOWS\system32\xactsrv.dll
2007-04-07 16:01 9,216 --a------ C:\WINDOWS\system32\wshatm.dll
2007-04-07 16:01 82,944 --a------ C:\WINDOWS\system32\ws2_32.dll
2007-04-07 16:01 81,408 --a------ C:\WINDOWS\system32\wscsvc.dll
2007-04-07 16:01 707 --a------ C:\WINDOWS\_default.pif
2007-04-07 16:01 7,168 --a------ C:\WINDOWS\system32\wshnetbs.dll
2007-04-07 16:01 65,536 --a------ C:\WINDOWS\system32\wshext.dll
2007-04-07 16:01 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll
2007-04-07 16:01 596,992 --a------ C:\WINDOWS\system32\wsecedit.dll
2007-04-07 16:01 50,688 --a------ C:\WINDOWS\system32\wstdecod.dll
2007-04-07 16:01 50,176 --a------ C:\WINDOWS\system32\xmlprovi.dll
2007-04-07 16:01 5,632 --a------ C:\WINDOWS\system32\write.exe
2007-04-07 16:01 465,176 --a------ C:\WINDOWS\system32\wuapi.dll
2007-04-07 16:01 438,784 --a------ C:\WINDOWS\system32\xpob2res.dll
2007-04-07 16:01 42,496 --a------ C:\WINDOWS\system32\wsnmp32.dll
2007-04-07 16:01 41,240 --a------ C:\WINDOWS\system32\wups.dll
2007-04-07 16:01 337,920 --a------ C:\WINDOWS\system32\zipfldr.dll
2007-04-07 16:01 32,256 --a------ C:\WINDOWS\system32\wupdmgr.exe
2007-04-07 16:01 32,256 --a------ C:\WINDOWS\system32\wpnpinst.exe
2007-04-07 16:01 30,720 --a------ C:\WINDOWS\system32\xcopy.exe
2007-04-07 16:01 28,672 --a------ C:\WINDOWS\system32\wshcon.dll
2007-04-07 16:01 22,528 --a------ C:\WINDOWS\system32\wsock32.dll
2007-04-07 16:01 2,897,920 --a------ C:\WINDOWS\system32\xpsp2res.dll
2007-04-07 16:01 194,328 --a------ C:\WINDOWS\system32\wuaueng1.dll
2007-04-07 16:01 19,968 --a------ C:\WINDOWS\system32\wshtcpip.dll
2007-04-07 16:01 19,968 --a------ C:\WINDOWS\system32\ws2help.dll
2007-04-07 16:01 187,392 --a------ C:\WINDOWS\system32\xpsp1res.dll
2007-04-07 16:01 18,432 --a------ C:\WINDOWS\system32\wtsapi32.dll
2007-04-07 16:01 174,200 --a------ C:\WINDOWS\system32\xenroll.dll
2007-04-07 16:01 173,536 --a------ C:\WINDOWS\system32\wuweb.dll
2007-04-07 16:01 172,312 --a------ C:\WINDOWS\system32\wuauclt1.exe
2007-04-07 16:01 14,336 --a------ C:\WINDOWS\system32\wship6.dll
2007-04-07 16:01 13,824 --a------ C:\WINDOWS\system32\wscntfy.exe
2007-04-07 16:01 129,536 --a------ C:\WINDOWS\system32\xmlprov.dll
2007-04-07 16:01 127,256 --a------ C:\WINDOWS\system32\wucltui.dll
2007-04-07 16:01 124,184 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-04-07 16:01 12,032 --a------ C:\WINDOWS\system32\drivers\ws2ifsl.sys
2007-04-07 16:01 114,688 --a------ C:\WINDOWS\system32\wscript.exe
2007-04-07 16:01 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll
2007-04-07 16:01 11,776 --a------ C:\WINDOWS\system32\WshRm.dll
2007-04-07 16:01 11,776 --a------ C:\WINDOWS\system32\wshisn.dll
2007-04-07 16:01 108,032 --a------ C:\WINDOWS\system32\wshbth.dll
2007-04-07 16:01 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-04-07 16:01 <DIR> d-------- C:\WINDOWS\SMINST
2007-04-07 16:00 99,328 --a------ C:\WINDOWS\system32\winscard.dll
2007-04-07 16:00 984,576 --a------ C:\WINDOWS\system32\syssetup.dll
2007-04-07 16:00 983,552 --a------ C:\WINDOWS\system32\setupapi.dll
2007-04-07 16:00 98,304 --a------ C:\WINDOWS\system32\verifier.exe
2007-04-07 16:00 98,304 --a------ C:\WINDOWS\system32\slbiop.dll
2007-04-07 16:00 98,304 --a------ C:\WINDOWS\system32\rtm.dll
2007-04-07 16:00 96,768 --a------ C:\WINDOWS\system32\srvsvc.dll
2007-04-07 16:00 96,768 --a------ C:\WINDOWS\system32\psbase.dll
2007-04-07 16:00 96,256 --a------ C:\WINDOWS\system32\drivers\scsiport.sys
2007-04-07 16:00 95,744 --a------ C:\WINDOWS\system32\scardsvr.exe
2007-04-07 16:00 94,784 --a------ C:\WINDOWS\twain.dll
2007-04-07 16:00 937,984 --a------ C:\WINDOWS\system32\winbrand.dll
2007-04-07 16:00 93,696 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2007-04-07 16:00 92,672 --a------ C:\WINDOWS\system32\wlnotify.dll
2007-04-07 16:00 92,168 --a------ C:\WINDOWS\system32\rdpdd.dll
2007-04-07 16:00 90,624 --a------ C:\WINDOWS\system32\trkwks.dll
2007-04-07 16:00 90,112 --a------ C:\WINDOWS\system32\rsvpsp.dll
2007-04-07 16:00 9,728 --a------ C:\WINDOWS\system32\sprestrt.exe
2007-04-07 16:00 9,728 --a------ C:\WINDOWS\system32\sfc.exe
2007-04-07 16:00 9,728 --a------ C:\WINDOWS\system32\rsvpperf.dll
2007-04-07 16:00 9,728 --a------ C:\WINDOWS\system32\reset.exe
2007-04-07 16:00 9,344 --a------ C:\WINDOWS\system32\vga.dll
2007-04-07 16:00 9,216 --a------ C:\WINDOWS\system32\winfax.dll
2007-04-07 16:00 9,216 --a------ C:\WINDOWS\system32\wifeman.dll
2007-04-07 16:00 9,216 --a------ C:\WINDOWS\system32\subst.exe
2007-04-07 16:00 9,216 --a------ C:\WINDOWS\system32\scrnsave.scr
2007-04-07 16:00 9,008 --a------ C:\WINDOWS\system32\ver.dll
2007-04-07 16:00 9,008 --a------ C:\WINDOWS\system\VER.DLL
2007-04-07 16:00 89,600 --a------ C:\WINDOWS\system32\smlogsvc.exe
2007-04-07 16:00 89,088 --a------ C:\WINDOWS\system32\rasauto.dll
2007-04-07 16:00 882 --a------ C:\WINDOWS\system32\share.exe
2007-04-07 16:00 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll
2007-04-07 16:00 858,624 --a------ C:\WINDOWS\system32\tapi3.dll
2007-04-07 16:00 82,432 --a------ C:\WINDOWS\system32\ufat.dll
2007-04-07 16:00 81,920 --a------ C:\WINDOWS\system32\wmpshell.dll
2007-04-07 16:00 8,832 --a------ C:\WINDOWS\system32\drivers\rasacd.sys
2007-04-07 16:00 8,192 --a------ C:\WINDOWS\system32\winhlp32.exe
2007-04-07 16:00 8,192 --a------ C:\WINDOWS\system32\smbinst.exe
2007-04-07 16:00 8,192 --a------ C:\WINDOWS\system32\qosname.dll
2007-04-07 16:00 8,192 --a------ C:\WINDOWS\system32\psnppagn.dll
2007-04-07 16:00 79,744 --a------ C:\WINDOWS\system32\drivers\videoprt.sys
2007-04-07 16:00 78,848 --a------ C:\WINDOWS\system32\tapiui.dll
2007-04-07 16:00 78,336 --a------ C:\WINDOWS\system32\tlntsess.exe
2007-04-07 16:00 77,824 --a------ C:\WINDOWS\system32\shrpubw.exe
2007-04-07 16:00 77,312 --a------ C:\WINDOWS\system32\sdbinst.exe
2007-04-07 16:00 77,312 --a------ C:\WINDOWS\system32\rtcshare.exe
2007-04-07 16:00 764,928 --a------ C:\WINDOWS\system32\winntbbu.dll
2007-04-07 16:00 75,776 --a------ C:\WINDOWS\system32\wiascr.dll
2007-04-07 16:00 75,776 --a------ C:\WINDOWS\system32\telnet.exe
2007-04-07 16:00 75,776 --a------ C:\WINDOWS\system32\strmfilt.dll
2007-04-07 16:00 74,752 --a------ C:\WINDOWS\system32\spoolss.dll
2007-04-07 16:00 74,240 --a------ C:\WINDOWS\system32\unimdmat.dll
2007-04-07 16:00 733,696 --a------ C:\WINDOWS\system32\qedwipes.dll
2007-04-07 16:00 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys
2007-04-07 16:00 73,216 --a------ C:\WINDOWS\system32\tlntsvr.exe
2007-04-07 16:00 723,456 --a------ C:\WINDOWS\system32\userenv.dll
2007-04-07 16:00 72,192 --a------ C:\WINDOWS\system32\tasklist.exe
2007-04-07 16:00 72,192 --a------ C:\WINDOWS\system32\taskkill.exe
2007-04-07 16:00 713,216 --a------ C:\WINDOWS\system32\sxs.dll
2007-04-07 16:00 71,680 --a------ C:\WINDOWS\system32\ssdpsrv.dll
2007-04-07 16:00 704,512 --a------ C:\WINDOWS\system32\ss3dfo.scr
2007-04-07 16:00 70,144 --a------ C:\WINDOWS\system32\sigverif.exe
2007-04-07 16:00 7,680 --a------ C:\WINDOWS\system32\vcdex.dll
2007-04-07 16:00 7,168 --a------ C:\WINDOWS\system32\tlntsvrp.dll
2007-04-07 16:00 7,168 --a------ C:\WINDOWS\system32\recover.exe
2007-04-07 16:00 69,632 --a------ C:\WINDOWS\system32\scarddlg.dll
2007-04-07 16:00 69,632 --a------ C:\WINDOWS\system32\raschap.dll
2007-04-07 16:00 69,120 --a------ C:\WINDOWS\system32\drivers\psched.sys
2007-04-07 16:00 68,096 --a------ C:\WINDOWS\system32\webclnt.dll
2007-04-07 16:00 68,096 --a------ C:\WINDOWS\system32\systeminfo.exe
2007-04-07 16:00 68,096 --a------ C:\WINDOWS\system32\shgina.dll
2007-04-07 16:00 679,936 --a------ C:\WINDOWS\system32\sstext3d.scr
2007-04-07 16:00 67,584 --a------ C:\WINDOWS\system32\sti.dll
2007-04-07 16:00 67,584 --a------ C:\WINDOWS\system32\srclient.dll
2007-04-07 16:00 67,584 --a------ C:\WINDOWS\system32\drivers\sdbus.sys
2007-04-07 16:00 67,072 --a------ C:\WINDOWS\system32\rdshost.exe
2007-04-07 16:00 66,176 --a------ C:\WINDOWS\system32\drivers\udfs.sys
2007-04-07 16:00 657,920 --a------ C:\WINDOWS\system32\rasdlg.dll
2007-04-07 16:00 65,536 --a------ C:\WINDOWS\system32\wextract.exe
2007-04-07 16:00 65,536 --a------ C:\WINDOWS\system32\shimeng.dll
2007-04-07 16:00 64,896 --a------ C:\WINDOWS\system32\drivers\serial.sys
2007-04-07 16:00 64,000 --a------ C:\WINDOWS\system32\samlib.dll
2007-04-07 16:00 62,976 --a------ C:\WINDOWS\system32\rsopprov.exe
2007-04-07 16:00 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe
2007-04-07 16:00 610,304 --a------ C:\WINDOWS\system32\sspipes.scr
2007-04-07 16:00 61,440 --a------ C:\WINDOWS\system32\tlntadmn.exe
2007-04-07 16:00 61,440 --a------ C:\WINDOWS\system32\rasman.dll
2007-04-07 16:00 60,416 --a------ C:\WINDOWS\system32\remotepg.dll
2007-04-07 16:00 6,656 --a------ C:\WINDOWS\system32\sensapi.dll
2007-04-07 16:00 6,656 --a------ C:\WINDOWS\system32\routetab.dll
2007-04-07 16:00 6,144 --a------ C:\WINDOWS\system32\svcpack.dll
2007-04-07 16:00 59,904 --a------ C:\WINDOWS\system32\regsvc.dll
2007-04-07 16:00 589,312 --a------ C:\WINDOWS\system32\wiashext.dll
2007-04-07 16:00 581,120 --a------ C:\WINDOWS\system32\rpcrt4.dll
2007-04-07 16:00 58,880 --a------ C:\WINDOWS\system32\resutils.dll
2007-04-07 16:00 58,880 --a------ C:\WINDOWS\system32\rastapi.dll
2007-04-07 16:00 577,536 --a------ C:\WINDOWS\system32\user32.dll
2007-04-07 16:00 57,856 --a------ C:\WINDOWS\system32\synceng.dll
2007-04-07 16:00 57,856 --a------ C:\WINDOWS\system32\spoolsv.exe
2007-04-07 16:00 57,600 --a------ C:\WINDOWS\system32\drivers\usbhub.sys
2007-04-07 16:00 562,176 --a------ C:\WINDOWS\system32\qedit.dll
2007-04-07 16:00 56,832 --a------ C:\WINDOWS\system32\sol.exe
2007-04-07 16:00 56,832 --a------ C:\WINDOWS\system32\rasphone.exe
2007-04-07 16:00 56,320 --a------ C:\WINDOWS\system32\servdeps.dll
2007-04-07 16:00 55,808 --a------ C:\WINDOWS\system32\wmiscmgr.dll
2007-04-07 16:00 55,808 --a------ C:\WINDOWS\system32\secur32.dll
2007-04-07 16:00 55,296 --a------ C:\WINDOWS\system32\sendmail.dll
2007-04-07 16:00 549,376 --a------ C:\WINDOWS\system32\shdoclc.dll
2007-04-07 16:00 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2007-04-07 16:00 538,624 --a------ C:\WINDOWS\system32\spider.exe
2007-04-07 16:00 53,760 --a------ C:\WINDOWS\system32\winsta.dll
2007-04-07 16:00 52,352 --a------ C:\WINDOWS\system32\drivers\volsnap.sys
2007-04-07 16:00 52,224 --a------ C:\WINDOWS\system32\tsappcmp.dll
2007-04-07 16:00 51,712 --a------ C:\WINDOWS\system32\vdmredir.dll
2007-04-07 16:00 51,456 --a------ C:\WINDOWS\system32\vga256.dll
2007-04-07 16:00 51,328 --a------ C:\WINDOWS\system32\drivers\rasl2tp.sys
2007-04-07 16:00 51,200 --a------ C:\WINDOWS\system32\wmerrenu.dll
2007-04-07 16:00 51,200 --a------ C:\WINDOWS\system32\syncapp.exe
2007-04-07 16:00 502,272 --a------ C:\WINDOWS\system32\winlogon.exe
2007-04-07 16:00 50,688 --a------ C:\WINDOWS\twain_32.dll
2007-04-07 16:00 50,688 --a------ C:\WINDOWS\system32\smss.exe
2007-04-07 16:00 50,176 --a------ C:\WINDOWS\system32\utilman.exe
2007-04-07 16:00 50,176 --a------ C:\WINDOWS\system32\reg.exe
2007-04-07 16:00 5,888 --a------ C:\WINDOWS\system32\drivers\rootmdm.sys
2007-04-07 16:00 5,632 --a------ C:\WINDOWS\system32\wmi.dll
2007-04-07 16:00 5,632 --a------ C:\WINDOWS\system32\winver.exe
2007-04-07 16:00 5,632 --a------ C:\WINDOWS\system32\tapiperf.dll
2007-04-07 16:00 5,632 --a------ C:\WINDOWS\system32\softpub.dll
2007-04-07 16:00 5,632 --a------ C:\WINDOWS\system32\skdll.dll
2007-04-07 16:00 5,632 --a------ C:\WINDOWS\system32\security.dll
2007-04-07 16:00 5,376 --a------ C:\WINDOWS\system32\drivers\viaide.sys
2007-04-07 16:00 5,120 --a------ C:\WINDOWS\system32\winnls.dll
2007-04-07 16:00 5,120 --a------ C:\WINDOWS\system32\shell.dll
2007-04-07 16:00 5,120 --a------ C:\WINDOWS\system32\sfc.dll
2007-04-07 16:00 5,120 --a------ C:\WINDOWS\system\SHELL.DLL
2007-04-07 16:00 49,680 --a------ C:\WINDOWS\twunk_16.exe
2007-04-07 16:00 49,664 --a------ C:\WINDOWS\system32\w32tm.exe
2007-04-07 16:00 49,664 --a------ C:\WINDOWS\system32\regapi.dll
2007-04-07 16:00 49,179 --a------ C:\WINDOWS\system32\sqlwoa.dll
2007-04-07 16:00 49,152 --a------ C:\WINDOWS\system32\wdigest.dll
2007-04-07 16:00 49,152 --a------ C:\WINDOWS\system32\rsmui.exe
2007-04-07 16:00 49,152 --a------ C:\WINDOWS\system32\rsm.exe
2007-04-07 16:00 49,024 --a------ C:\WINDOWS\system32\drivers\ql1280.sys
2007-04-07 16:00 48,384 --a------ C:\WINDOWS\system32\drivers\raspptp.sys
2007-04-07 16:00 47,872 --a------ C:\WINDOWS\system32\user.exe
2007-04-07 16:00 47,104 --a------ C:\WINDOWS\system32\ssmypics.scr
2007-04-07 16:00 463,360 --a------ C:\WINDOWS\system32\wiadefui.dll
2007-04-07 16:00 45,568 --a------ C:\WINDOWS\system32\tcpmonui.dll
2007-04-07 16:00 45,568 --a------ C:\WINDOWS\system32\tcpmon.dll
2007-04-07 16:00 45,568 --a------ C:\WINDOWS\system32\safrslv.dll
2007-04-07 16:00 45,312 --a------ C:\WINDOWS\system32\drivers\ql12160.sys
2007-04-07 16:00 442,368 --a------ C:\WINDOWS\system32\sqlsrv32.dll
2007-04-07 16:00 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe
2007-04-07 16:00 44,032 --a------ C:\WINDOWS\system32\twext.dll
2007-04-07 16:00 44,032 --a------ C:\WINDOWS\system32\rtutils.dll
2007-04-07 16:00 438,272 --a------ C:\WINDOWS\system32\shimgvw.dll
2007-04-07 16:00 433,664 --a------ C:\WINDOWS\system32\wiaacmgr.exe
2007-04-07 16:00 430,592 --a------ C:\WINDOWS\system32\vssapi.dll
2007-04-07 16:00 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2007-04-07 16:00 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll
2007-04-07 16:00 43,520 --a------ C:\WINDOWS\system32\pstorec.dll
2007-04-07 16:00 42,496 --a------ C:\WINDOWS\system32\shmgrate.exe
2007-04-07 16:00 417,792 --a------ C:\WINDOWS\system32\vbscript.dll
2007-04-07 16:00 415,744 --a------ C:\WINDOWS\system32\samsrv.dll
2007-04-07 16:00 414,208 --a------ C:\WINDOWS\system32\setupdll.dll
2007-04-07 16:00 41,472 --a------ C:\WINDOWS\system32\drivers\raspppoe.sys
2007-04-07 16:00 406,528 --a------ C:\WINDOWS\system32\usp10.dll
2007-04-07 16:00 40,448 --a------ C:\WINDOWS\system32\webhits.dll
2007-04-07 16:00 40,448 --a------ C:\WINDOWS\system32\drivers\ql1240.sys
2007-04-07 16:00 40,320 --a------ C:\WINDOWS\system32\drivers\ql1080.sys
2007-04-07 16:00 4,992 --a------ C:\WINDOWS\system32\drivers\toside.sys
2007-04-07 16:00 4,736 --a------ C:\WINDOWS\system32\drivers\usbd.sys
2007-04-07 16:00 4,608 --a------ C:\WINDOWS\system32\vjoy.dll
2007-04-07 16:00 4,608 --a------ C:\WINDOWS\system32\regwiz.exe
2007-04-07 16:00 4,569 --a------ C:\WINDOWS\system32\secupd.dat
2007-04-07 16:00 4,352 --a------ C:\WINDOWS\system32\drivers\wmilib.sys
2007-04-07 16:00 4,224 --a------ C:\WINDOWS\system32\drivers\rdpcdd.sys
2007-04-07 16:00 4,208 --a------ C:\WINDOWS\system32\storage.dll
2007-04-07 16:00 4,096 --a------ C:\WINDOWS\system32\unlodctr.exe
2007-04-07 16:00 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2007-04-07 16:00 397,824 --a------ C:\WINDOWS\system32\rpcss.dll
2007-04-07 16:00 397,824 --a------ C:\WINDOWS\system32\regwizc.dll
2007-04-07 16:00 393,216 --a------ C:\WINDOWS\system32\ssflwbox.scr
2007-04-07 16:00 39,936 --a------ C:\WINDOWS\system32\rshx32.dll
2007-04-07 16:00 385,536 --a------ C:\WINDOWS\system32\themeui.dll
2007-04-07 16:00 382,464 --a------ C:\WINDOWS\system32\qmgr.dll
2007-04-07 16:00 38,912 --a------ C:\WINDOWS\system32\sens.dll
2007-04-07 16:00 363,008 --a------ C:\WINDOWS\system32\smlogcfg.dll
2007-04-07 16:00 36,864 --a------ C:\WINDOWS\system32\syskey.exe
2007-04-07 16:00 36,736 --a------ C:\WINDOWS\system32\drivers\ultra.sys
2007-04-07 16:00 36,352 --a------ C:\WINDOWS\system32\typeperf.exe
2007-04-07 16:00 359,808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys
2007-04-07 16:00 358,400 --a------ C:\WINDOWS\system32\termmgr.dll
2007-04-07 16:00 351,232 --a------ C:\WINDOWS\system32\winhttp.dll
2007-04-07 16:00 35,840 --a------ C:\WINDOWS\system32\umandlg.dll
2007-04-07 16:00 35,840 --a------ C:\WINDOWS\system32\rcimlby.exe
2007-04-07 16:00 35,328 --a------ C:\WINDOWS\system32\winchat.exe
2007-04-07 16:00 347,136 --a------ C:\WINDOWS\system32\tourstart.exe
2007-04-07 16:00 34,816 --a------ C:\WINDOWS\system32\ssdpapi.dll
2007-04-07 16:00 34,560 --a------ C:\WINDOWS\system32\drivers\wanarp.sys
2007-04-07 16:00 34,432 --a------ C:\WINDOWS\system32\drivers\rawwan.sys
2007-04-07 16:00 34,304 --a------ C:\WINDOWS\system32\pstorsvc.dll
2007-04-07 16:00 332,928 --a------ C:\WINDOWS\system32\drivers\srv.sys
2007-04-07 16:00 33,792 --a------ C:\WINDOWS\system32\vssadmin.exe
2007-04-07 16:00 33,792 --a------ C:\WINDOWS\system32\regini.exe
2007-04-07 16:00 33,280 --a------ C:\WINDOWS\system32\rundll32.exe
2007-04-07 16:00 33,152 --a------ C:\WINDOWS\system32\drivers\ql10wnt.sys
2007-04-07 16:00 32,768 --a------ C:\WINDOWS\system32\winipsec.dll
2007-04-07 16:00 32,768 --a------ C:\WINDOWS\system32\relog.exe
2007-04-07 16:00 32,640 --a------ C:\WINDOWS\system32\drivers\symc8xx.sys
2007-04-07 16:00 32,256 --a------ C:\WINDOWS\system32\wpabaln.exe
2007-04-07 16:00 316,416 --a------ C:\WINDOWS\system32\untfs.dll
2007-04-07 16:00 313,856 --a------ C:\WINDOWS\system32\scesrv.dll
2007-04-07 16:00 31,744 --a------ C:\WINDOWS\system32\tracert6.exe
2007-04-07 16:00 31,744 --a------ C:\WINDOWS\system32\rtipxmib.dll
2007-04-07 16:00 31,232 --a------ C:\WINDOWS\system32\traffic.dll
2007-04-07 16:00 31,232 --a------ C:\WINDOWS\system32\sethc.exe
2007-04-07 16:00 31,232 --a------ C:\WINDOWS\system32\sc.exe
2007-04-07 16:00 306,176 --a------ C:\WINDOWS\system32\slbcsp.dll
2007-04-07 16:00 303,616 --a------ C:\WINDOWS\system32\wmstream.dll
2007-04-07 16:00 30,749 --a------ C:\WINDOWS\system32\vbajet32.dll
2007-04-07 16:00 30,688 --a------ C:\WINDOWS\system32\drivers\sym_u3.sys
2007-04-07 16:00 30,080 --a------ C:\WINDOWS\system32\drivers\rndismp.sys
2007-04-07 16:00 3,708 --a------ C:\WINDOWS\system32\pubprn.vbs
2007-04-07 16:00 3,584 --a------ C:\WINDOWS\system32\riched32.dll
2007-04-07 16:00 3,584 --a------ C:\WINDOWS\system32\regedt32.exe
2007-04-07 16:00 3,371,008 --a------ C:\WINDOWS\system32\wmploc.dll
2007-04-07 16:00 3,338 --a------ C:\WINDOWS\system32\redir.exe
2007-04-07 16:00 3,072 --a------ C:\WINDOWS\system32\systray.exe
2007-04-07 16:00 3,072 --a------ C:\WINDOWS\system32\rnr20.dll
2007-04-07 16:00 292,864 --a------ C:\WINDOWS\system32\winsrv.dll
2007-04-07 16:00 29,696 --a------ C:\WINDOWS\system32\safrdm.dll
2007-04-07 16:00 29,184 --a------ C:\WINDOWS\system32\sendcmsg.dll
2007-04-07 16:00 29,184 --a------ C:\WINDOWS\system32\sdhcinst.dll
2007-04-07 16:00 289,792 --a------ C:\WINDOWS\system32\vssvc.exe
2007-04-07 16:00 283,648 --a------ C:\WINDOWS\winhlp32.exe
2007-04-07 16:00 28,672 --a------ C:\WINDOWS\system32\rsfsaps.dll
2007-04-07 16:00 28,384 --a------ C:\WINDOWS\system32\drivers\sym_hi.sys
2007-04-07 16:00 279,040 --a------ C:\WINDOWS\system32\qdv.dll
2007-04-07 16:00 278,528 --a------ C:\WINDOWS\system32\wmpdxm.dll
2007-04-07 16:00 275,456 --a------ C:\WINDOWS\system32\ulib.dll
2007-04-07 16:00 27,648 --a------ C:\WINDOWS\system32\shscrap.dll
2007-04-07 16:00 27,440 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2007-04-07 16:00 264,192 --a------ C:\WINDOWS\system32\wow32.dll
2007-04-07 16:00 26,624 --a------ C:\WINDOWS\system32\scredir.dll
2007-04-07 16:00 26,112 --a------ C:\WINDOWS\system32\vdmdbg.dll
2007-04-07 16:00 26,112 --a------ C:\WINDOWS\system32\skeys.exe
2007-04-07 16:00 259,584 --a------ C:\WINDOWS\system32\tracerpt.exe
2007-04-07 16:00 256,192 --a------ C:\WINDOWS\winhelp.exe
2007-04-07 16:00 25,600 --a------ C:\WINDOWS\twunk_32.exe
2007-04-07 16:00 25,600 --a------ C:\WINDOWS\system32\utildll.dll
2007-04-07 16:00 25,600 --a------ C:\WINDOWS\system32\udhisapi.dll
2007-04-07 16:00 25,600 --a------ C:\WINDOWS\system32\routemon.exe
2007-04-07 16:00 25,088 --a------ C:\WINDOWS\system32\slayerxp.dll
2007-04-07 16:00 25,088 --a------ C:\WINDOWS\system32\shfolder.dll
2007-04-07 16:00 249,344 --a------ C:\WINDOWS\system32\tapisrv.dll
2007-04-07 16:00 246,814 --a------ C:\WINDOWS\system32\strmdll.dll
2007-04-07 16:00 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2007-04-07 16:00 24,603 --a------ C:\WINDOWS\system32\sqlwid.dll
2007-04-07 16:00 24,576 --a------ C:\WINDOWS\system32\userinit.exe
2007-04-07 16:00 24,576 --a------ C:\WINDOWS\system32\rsmsink.exe
2007-04-07 16:00 239,616 --a------ C:\WINDOWS\system32\upnpui.dll
2007-04-07 16:00 239,104 --a------ C:\WINDOWS\system32\srrstr.dll
2007-04-07 16:00 236,544 --a------ C:\WINDOWS\system32\rasapi32.dll
2007-04-07 16:00 23,552 --a------ C:\WINDOWS\system32\sort.exe
2007-04-07 16:00 23,552 --a------ C:\WINDOWS\system32\sfmapi.dll
2007-04-07 16:00 23,552 --a------ C:\WINDOWS\system32\rsvpmsg.dll
2007-04-07 16:00 23,552 --a------ C:\WINDOWS\system32\rasrad.dll
2007-04-07 16:00 23,040 --a------ C:\WINDOWS\system32\setup.exe
2007-04-07 16:00 23,040 --a------ C:\WINDOWS\system32\psapi.dll
2007-04-07 16:00 225,664 --a------ C:\WINDOWS\system32\drivers\tcpip6.sys
2007-04-07 16:00 22,528 --a------ C:\WINDOWS\system32\rasmxs.dll
2007-04-07 16:00 22,016 --a------ C:\WINDOWS\system32\w32topl.dll
2007-04-07 16:00 22,016 --a------ C:\WINDOWS\system32\rpcns4.dll
2007-04-07 16:00 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe
2007-04-07 16:00 218,624 --a------ C:\WINDOWS\system32\uxtheme.dll
2007-04-07 16:00 21,896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2007-04-07 16:00 21,504 --a------ C:\WINDOWS\system32\rcp.exe
2007-04-07 16:00 209,408 --a------ C:\WINDOWS\system32\drivers\update.sys
2007-04-07 16:00 208,896 --a------ C:\WINDOWS\system32\wavemsp.dll
2007-04-07 16:00 206,336 --a------ C:\WINDOWS\system32\rasppp.dll
2007-04-07 16:00 202,240 --a------ C:\WINDOWS\system32\drivers\rmcast.sys
2007-04-07 16:00 20,992 --a------ C:\WINDOWS\system32\ssmarque.scr
2007-04-07 16:00 20,992 --a------ C:\WINDOWS\system32\sclgntfy.dll
2007-04-07 16:00 20,992 --a------ C:\WINDOWS\system32\drivers\vga.sys
2007-04-07 16:00 20,535 --a------ C:\WINDOWS\system32\vfpodbc.dll
2007-04-07 16:00 20,480 --a------ C:\WINDOWS\system32\wmpui.dll
2007-04-07 16:00 20,480 --a------ C:\WINDOWS\system32\wmpcore.dll
2007-04-07 16:00 20,480 --a------ C:\WINDOWS\system32\wmpcd.dll
2007-04-07 16:00 20,480 --a------ C:\WINDOWS\system32\qprocess.exe
2007-04-07 16:00 20,480 --a------ C:\WINDOWS\system32\drivers\usbuhci.sys
2007-04-07 16:00 2,864 --a------ C:\WINDOWS\system32\winsock.dll
2007-04-07 16:00 2,736 --a------ C:\WINDOWS\system32\wowdeb.exe
2007-04-07 16:00 2,112 --a------ C:\WINDOWS\system32\winspool.exe
2007-04-07 16:00 192,512 --a------ C:\WINDOWS\system32\qcap.dll
2007-04-07 16:00 191,488 --a------ C:\WINDOWS\system32\syncui.dll
2007-04-07 16:00 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll
2007-04-07 16:00 19,968 --a------ C:\WINDOWS\system32\ssbezier.scr
2007-04-07 16:00 19,968 --a------ C:\WINDOWS\system32\route.exe
2007-04-07 16:00 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll
2007-04-07 16:00 19,456 --a------ C:\WINDOWS\system32\vwipxspx.dll
2007-04-07 16:00 19,456 --a------ C:\WINDOWS\system32\tcpsvcs.exe
2007-04-07 16:00 19,456 --a------ C:\WINDOWS\system32\shutdown.exe
2007-04-07 16:00 19,200 --a------ C:\WINDOWS\system32\tapi.dll
2007-04-07 16:00 19,200 --a------ C:\WINDOWS\system\TAPI.DLL
2007-04-07 16:00 19,072 --a------ C:\WINDOWS\system32\drivers\sparrow.sys
2007-04-07 16:00 189,440 --a------ C:\WINDOWS\system32\wmerror.dll
2007-04-07 16:00 185,344 --a------ C:\WINDOWS\system32\upnphost.dll
2007-04-07 16:00 182,272 --a------ C:\WINDOWS\system32\snmpsnap.dll
2007-04-07 16:00 181,760 --a------ C:\WINDOWS\system32\tapi32.dll
2007-04-07 16:00 180,800 --a------ C:\WINDOWS\system32\sqlunirl.dll
2007-04-07 16:00 180,224 --a------ C:\WINDOWS\system32\scecli.dll
2007-04-07 16:00 18,944 --a------ C:\WINDOWS\vmmreg32.dll
2007-04-07 16:00 18,944 --a------ C:\WINDOWS\system32\wmiprop.dll
2007-04-07 16:00 18,944 --a------ C:\WINDOWS\system32\winstrm.dll
2007-04-07 16:00 18,944 --a------ C:\WINDOWS\system32\version.dll
2007-04-07 16:00 18,944 --a------ C:\WINDOWS\system32\ssmyst.scr
2007-04-07 16:00 18,944 --a------ C:\WINDOWS\system32\snmpapi.dll
2007-04-07 16:00 18,944 --a------ C:\WINDOWS\system32\seclogon.dll
2007-04-07 16:00 18,944 --a------ C:\WINDOWS\system32\rsmps.dll
2007-04-07 16:00 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-04-07 16:00 18,896 --a------ C:\WINDOWS\system32\sysedit.exe
2007-04-07 16:00 18,560 --a------ C:\WINDOWS\system32\drivers\tdi.sys
2007-04-07 16:00 18,432 --a------ C:\WINDOWS\system32\win.com
2007-04-07 16:00 18,432 --a------ C:\WINDOWS\system32\ups.exe
2007-04-07 16:00 18,432 --a------ C:\WINDOWS\system32\secedit.exe
2007-04-07 16:00 18,176 --a------ C:\WINDOWS\system32\vga64k.dll
2007-04-07 16:00 177,856 --a------ C:\WINDOWS\system32\typelib.dll
2007-04-07 16:00 176,640 --a------ C:\WINDOWS\system32\wintrust.dll
2007-04-07 16:00 176,128 --a------ C:\WINDOWS\system32\winmm.dll
2007-04-07 16:00 174,592 --a------ C:\WINDOWS\system32\w32time.dll
2007-04-07 16:00 174,592 --a------ C:\WINDOWS\system32\drivers\rdbss.sys
2007-04-07 16:00 174,080 --a------ C:\WINDOWS\system32\wmpsrcwp.dll
2007-04-07 16:00 172,032 --a------ C:\WINDOWS\system32\wldap32.dll
2007-04-07 16:00 171,008 --a------ C:\WINDOWS\system32\sccsccp.dll
2007-04-07 16:00 170,496 --a------ C:\WINDOWS\system32\srsvc.dll
2007-04-07 16:00 17,920 --a------ C:\WINDOWS\system32\ureg.dll
2007-04-07 16:00 17,792 --a------ C:\WINDOWS\system32\drivers\ptilink.sys
2007-04-07 16:00 17,664 --a------ C:\WINDOWS\system32\watchdog.sys
2007-04-07 16:00 17,408 --a------ C:\WINDOWS\system32\winshfhc.dll
2007-04-07 16:00 169,984 --a------ C:\WINDOWS\system32\sccbase.dll
2007-04-07 16:00 16,896 --a------ C:\WINDOWS\system32\winrnr.dll
2007-04-07 16:00 16,896 --a------ C:\WINDOWS\system32\vss_ps.dll
2007-04-07 16:00 16,896 --a------ C:\WINDOWS\system32\usbmon.dll
2007-04-07 16:00 16,896 --a------ C:\WINDOWS\system32\upnpcont.exe
2007-04-07 16:00 16,896 --a------ C:\WINDOWS\system32\tsshutdn.exe
2007-04-07 16:00 16,896 --a------ C:\WINDOWS\system32\tftp.exe
2007-04-07 16:00 16,896 --a------ C:\WINDOWS\system32\rassapi.dll
2007-04-07 16:00 16,896 --a------ C:\WINDOWS\system32\qappsrv.exe
2007-04-07 16:00 16,512 --a------ C:\WINDOWS\system32\drivers\raspti.sys
2007-04-07 16:00 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2007-04-07 16:00 16,384 --a------ C:\WINDOWS\system32\runas.exe
2007-04-07 16:00 16,256 --a------ C:\WINDOWS\system32\drivers\symc810.sys
2007-04-07 16:00 159,744 --a------ C:\WINDOWS\system32\scrobj.dll
2007-04-07 16:00 159,232 --a------ C:\WINDOWS\system32\sbeio.dll
2007-04-07 16:00 152,576 --a------ C:\WINDOWS\system32\rsaenh.dll
2007-04-07 16:00 151,552 --a------ C:\WINDOWS\system32\shmedia.dll
2007-04-07 16:00 151,552 --a------ C:\WINDOWS\system32\scrrun.dll
2007-04-07 16:00 15,872 --a------ C:\WINDOWS\system32\w3ssl.dll
2007-04-07 16:00 15,872 --a------ C:\WINDOWS\system32\sysinv.dll
2007-04-07 16:00 15,872 --a------ C:\WINDOWS\system32\rwinsta.exe
2007-04-07 16:00 15,488 --a------ C:\WINDOWS\system32\drivers\serenum.sys
2007-04-07 16:00 15,360 --a------ C:\WINDOWS\TASKMAN.EXE
2007-04-07 16:00 15,360 --a------ C:\WINDOWS\system32\tsd32.dll
2007-04-07 16:00 15,360 --a------ C:\WINDOWS\system32\taskman.exe
2007-04-07 16:00 147,968 --a------ C:\WINDOWS\system32\rdchost.dll
2007-04-07 16:00 146,432 --a------ C:\WINDOWS\regedit.exe
2007-04-07 16:00 145,408 --a------ C:\WINDOWS\system32\wiavusd.dll
2007-04-07 16:00 144,896 --a------ C:\WINDOWS\system32\schannel.dll
2007-04-07 16:00 143,360 --a------ C:\WINDOWS\system32\rasmontr.dll
2007-04-07 16:00 142,976 --a------ C:\WINDOWS\system32\drivers\usbport.sys
2007-04-07 16:00 140,800 --a------ C:\WINDOWS\system32\sessmgr.exe
2007-04-07 16:00 140,288 --a------ C:\WINDOWS\system32\sfc_os.dll
2007-04-07 16:00 14,976 --a------ C:\WINDOWS\system32\drivers\tape.sys
2007-04-07 16:00 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe
2007-04-07 16:00 14,848 --a------ C:\WINDOWS\system32\tscon.exe
2007-04-07 16:00 14,848 --a------ C:\WINDOWS\system32\tcpmib.dll
2007-04-07 16:00 14,848 --a------ C:\WINDOWS\system32\stimon.exe
2007-04-07 16:00 14,848 --a------ C:\WINDOWS\system32\slbrccsp.dll
2007-04-07 16:00 14,848 --a------ C:\WINDOWS\system32\shadow.exe
2007-04-07 16:00 14,848 --a------ C:\WINDOWS\system32\serwvdrv.dll
2007-04-07 16:00 14,848 --a------ C:\WINDOWS\system32\rsh.exe
2007-04-07 16:00 14,592 --a------ C:\WINDOWS\system32\drivers\smclib.sys
2007-04-07 16:00 14,336 --a------ C:\WINDOWS\system32\svchost.exe
2007-04-07 16:00 14,336 --a------ C:\WINDOWS\system32\ssstars.scr
2007-04-07 16:00 14,336 --a------ C:\WINDOWS\system32\serialui.dll
2007-04-07 16:00 14,336 --a------ C:\WINDOWS\system32\runonce.exe
2007-04-07 16:00 139,528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2007-04-07 16:00 138,752 --a------ C:\WINDOWS\system32\swprv.dll
2007-04-07 16:00 138,752 --a------ C:\WINDOWS\system32\sndvol32.exe
2007-04-07 16:00 136,704 --a------ C:\WINDOWS\system32\sti_ci.dll
2007-04-07 16:00 135,680 --a------ C:\WINDOWS\system32\webvw.dll
2007-04-07 16:00 135,680 --a------ C:\WINDOWS\system32\taskmgr.exe
2007-04-07 16:00 132,608 --a------ C:\WINDOWS\system32\upnp.dll
2007-04-07 16:00 132,608 --a------ C:\WINDOWS\system32\rsvp.exe
2007-04-07 16:00 132,096 --a------ C:\WINDOWS\system32\wkssvc.dll
2007-04-07 16:00 131,584 --a------ C:\WINDOWS\system32\sndrec32.exe
2007-04-07 16:00 131,072 --a------ C:\WINDOWS\system32\wmpasf.dll
2007-04-07 16:00 130,048 --a------ C:\WINDOWS\system32\sdpblb.dll
2007-04-07 16:00 13,888 --a------ C:\WINDOWS\system32\toolhelp.dll
2007-04-07 16:00 13,824 --a------ C:\WINDOWS\system32\uniplat.dll
2007-04-07 16:00 13,824 --a------ C:\WINDOWS\system32\sisbkup.dll
2007-04-07 16:00 13,824 --a------ C:\WINDOWS\system32\senscfg.dll
2007-04-07 16:00 13,824 --a------ C:\WINDOWS\system32\rexec.exe
2007-04-07 16:00 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe
2007-04-07 16:00 13,312 --a------ C:\WINDOWS\system32\win87em.dll
2007-04-07 16:00 13,312 --a------ C:\WINDOWS\system32\verifier.dll
2007-04-07 16:00 13,312 --a------ C:\WINDOWS\system32\umdmxfrm.dll
2007-04-07 16:00 13,312 --a------ C:\WINDOWS\system32\sigtab.dll
2007-04-07 16:00 13,312 --a------ C:\WINDOWS\system32\savedump.exe
2007-04-07 16:00 124,416 --a------ C:\WINDOWS\system32\wiadss.dll
2007-04-07 16:00 123,392 --a------ C:\WINDOWS\system32\umpnpmgr.dll
2007-04-07 16:00 121,856 --a------ C:\WINDOWS\system32\stobject.dll
2007-04-07 16:00 121,856 --a------ C:\WINDOWS\system32\schtasks.exe
2007-04-07 16:00 12,800 --a------ C:\WINDOWS\system32\spiisupd.exe
2007-04-07 16:00 12,800 --a------ C:\WINDOWS\system32\replace.exe
2007-04-07 16:00 12,800 --a------ C:\WINDOWS\system32\rasser.dll
2007-04-07 16:00 12,672 --a------ C:\WINDOWS\system32\drivers\usb8023.sys
2007-04-07 16:00 12,288 --a------ C:\WINDOWS\system32\tracert.exe
2007-04-07 16:00 12,288 --a------ C:\WINDOWS\system32\tcmsetup.exe
2007-04-07 16:00 12,168 --a------ C:\WINDOWS\system32\tsddd.dll
2007-04-07 16:00 12,040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2007-04-07 16:00 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2007-04-07 16:00 118,784 --a------ C:\WINDOWS\system32\scardssp.dll
2007-04-07 16:00 118,272 --a------ C:\WINDOWS\system32\t2embed.dll
2007-04-07 16:00 115,200 --a------ C:\WINDOWS\system32\wmsdmoe.dll
2007-04-07 16:00 112,128 --a------ C:\WINDOWS\system32\rastls.dll
2007-04-07 16:00 111,104 --a------ C:\WINDOWS\system32\wiavideo.dll
2007-04-07 16:00 11,776 --a------ C:\WINDOWS\system32\winmsd.exe
2007-04-07 16:00 11,776 --a------ C:\WINDOWS\system32\spnpinst.exe
2007-04-07 16:00 11,776 --a------ C:\WINDOWS\system32\regsvr32.exe
2007-04-07 16:00 11,776 --a------ C:\WINDOWS\system32\rasctrs.dll
2007-04-07 16:00 11,776 --a------ C:\WINDOWS\system32\rasautou.exe
2007-04-07 16:00 11,753 --a------ C:\WINDOWS\system32\setver.exe
2007-04-07 16:00 11,392 --a------ C:\WINDOWS\system32\drivers\sfloppy.sys
2007-04-07 16:00 11,264 --a------ C:\WINDOWS\system32\tree.com
2007-04-07 16:00 11,264 --a------ C:\WINDOWS\system32\rasdial.exe
2007-04-07 16:00 11,136 --a------ C:\WINDOWS\system32\drivers\sffdisk.sys
2007-04-07 16:00 108,032 --a------ C:\WINDOWS\system32\services.exe
2007-04-07 16:00 107,520 --a------ C:\WINDOWS\system32\rsnotify.exe
2007-04-07 16:00 107,520 --a------ C:\WINDOWS\system32\rend.dll
2007-04-07 16:00 105,984 --a------ C:\WINDOWS\system32\sysocmgr.exe
2007-04-07 16:00 102,400 --a------ C:\WINDOWS\system32\rcbdyctl.dll
2007-04-07 16:00 101,888 --a------ C:\WINDOWS\system32\win32spl.dll
2007-04-07 16:00 101,376 --a------ C:\WINDOWS\system32\txflog.dll
2007-04-07 16:00 10,752 --a------ C:\WINDOWS\system32\pschdprf.dll
2007-04-07 16:00 10,368 --a------ C:\WINDOWS\system32\wowexec.exe
2007-04-07 16:00 10,240 --a------ C:\WINDOWS\system32\scriptpw.dll
2007-04-07 16:00 10,240 --a------ C:\WINDOWS\system32\drivers\sffp_sd.sys
2007-04-07 16:00 1,843,584 --a------ C:\WINDOWS\system32\win32k.sys
2007-04-07 16:00 1,582,080 --a------ C:\WINDOWS\system32\wmpencen.dll
2007-04-07 16:00 1,580,544 --a------ C:\WINDOWS\system32\sfcfiles.dll
2007-04-07 16:00 1,435,648 --a------ C:\WINDOWS\system32\query.dll
2007-04-07 16:00 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd
2007-04-07 16:00 1,129 --a------ C:\WINDOWS\system32\vwipxspx.exe
2007-04-07 15:59 994,304 --a------ C:\WINDOWS\system32\msgina.dll
2007-04-07 15:59 99,840 --a------ C:\WINDOWS\system32\mprmsg.dll
2007-04-07 15:59 981,760 --a------ C:\WINDOWS\system32\mfc42u.dll
2007-04-07 15:59 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll
2007-04-07 15:59 95,744 --a------ C:\WINDOWS\system32\mqsec.dll
2007-04-07 15:59 94,282 --a------ C:\WINDOWS\system32\msencode.dll
2007-04-07 15:59 94,208 --a------ C:\WINDOWS\system32\odbcint.dll
2007-04-07 15:59 927,504 --a------ C:\WINDOWS\system32\mfc40u.dll
2007-04-07 15:59 924,432 --a------ C:\WINDOWS\system32\mfc40.dll
2007-04-07 15:59 91,776 --a------ C:\WINDOWS\system32\drivers\ndiswan.sys
2007-04-07 15:59 91,136 --a------ C:\WINDOWS\system32\ntprint.dll
2007-04-07 15:59 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll
2007-04-07 15:59 90,624 --a------ C:\WINDOWS\system32\mydocs.dll
2007-04-07 15:59 90,112 --a------ C:\WINDOWS\system32\mycomput.dll
2007-04-07 15:59 9,936 --a------ C:\WINDOWS\system32\lzexpand.dll
2007-04-07 15:59 9,936 --a------ C:\WINDOWS\system\LZEXPAND.DLL
2007-04-07 15:59 9,600 --a------ C:\WINDOWS\system32\drivers\ndistapi.sys
2007-04-07 15:59 9,216 --a------ C:\WINDOWS\system32\proxycfg.exe
2007-04-07 15:59 9,216 --a------ C:\WINDOWS\system32\print.exe
2007-04-07 15:59 89,088 --a------ C:\WINDOWS\system32\mqlogmgr.dll
2007-04-07 15:59 884,736 --a------ C:\WINDOWS\system32\msimsg.dll
2007-04-07 15:59 88,448 --a------ C:\WINDOWS\system32\drivers\nwlnkipx.sys
2007-04-07 15:59 88,064 --a------ C:\WINDOWS\system32\p2pnetsh.dll
2007-04-07 15:59 875,008 --a------ C:\WINDOWS\system32\netplwiz.dll
2007-04-07 15:59 87,040 --a------ C:\WINDOWS\system32\mprapi.dll
2007-04-07 15:59 86,016 --a------ C:\WINDOWS\system32\p2pgasvc.dll
2007-04-07 15:59 86,016 --a------ C:\WINDOWS\system32\netsh.exe
2007-04-07 15:59 86,016 --a------ C:\WINDOWS\system32\msapsspc.dll
2007-04-07 15:59 85,504 --a------ C:\WINDOWS\system32\makecab.exe
2007-04-07 15:59 84,480 --a------ C:\WINDOWS\system32\mciavi32.dll
2007-04-07 15:59 831,519 --a------ C:\WINDOWS\system32\mswdat10.dll
2007-04-07 15:59 83,456 --a------ C:\WINDOWS\system32\olepro32.dll
2007-04-07 15:59 82,944 --a------ C:\WINDOWS\system32\olecli.dll
2007-04-07 15:59 82,944 --a------ C:\WINDOWS\system\OLECLI.DLL
2007-04-07 15:59 817 --a------ C:\WINDOWS\system32\mscdexnt.exe
2007-04-07 15:59 815,104 --a------ C:\WINDOWS\system32\mmc.exe
2007-04-07 15:59 80,896 --a------ C:\WINDOWS\system32\netui0.dll
2007-04-07 15:59 8,192 --a------ C:\WINDOWS\system32\ntlsapi.dll
2007-04-07 15:59 8,192 --a------ C:\WINDOWS\system32\mqperf.dll
2007-04-07 15:59 8,192 --a------ C:\WINDOWS\system32\mountvol.exe
2007-04-07 15:59 8,192 --a------ C:\WINDOWS\system32\mciole16.dll
2007-04-07 15:59 8,192 --a------ C:\WINDOWS\system32\mag_hook.dll
2007-04-07 15:59 78,848 --a------ C:\WINDOWS\system32\msiexec.exe
2007-04-07 15:59 76,800 --a------ C:\WINDOWS\system32\nslookup.exe
2007-04-07 15:59 741 --a------ C:\WINDOWS\system32\noise.dat
2007-04-07 15:59 74,752 --a------ C:\WINDOWS\system32\olecli32.dll
2007-04-07 15:59 74,240 --a------ C:\WINDOWS\system32\mscms.dll
2007-04-07 15:59 73,802 --a------ C:\WINDOWS\system32\msrclr40.dll
2007-04-07 15:59 72,960 --a------ C:\WINDOWS\system32\drivers\mqac.sys
2007-04-07 15:59 72,704 --a------ C:\WINDOWS\system32\msw3prt.dll
2007-04-07 15:59 72,704 --a------ C:\WINDOWS\system32\magnify.exe
2007-04-07 15:59 713,728 --a------ C:\WINDOWS\system32\opengl32.dll
2007-04-07 15:59 71,680 --a------ C:\WINDOWS\system32\msacm32.dll
2007-04-07 15:59 708,096 --a------ C:\WINDOWS\system32\ntdll.dll
2007-04-07 15:59 701,440 --a------ C:\WINDOWS\system32\msxml2.dll
2007-04-07 15:59 70,656 --a------ C:\WINDOWS\system32\mmcbase.dll
2007-04-07 15:59 7,680 --a------ C:\WINDOWS\system32\ncxpnt.dll
2007-04-07 15:59 7,680 --a------ C:\WINDOWS\system32\mll_mtf.dll
2007-04-07 15:59 7,680 --a------ C:\WINDOWS\system32\mciole32.dll
2007-04-07 15:59 7,680 --a------ C:\WINDOWS\system32\drivers\mcd.sys
2007-04-07 15:59 7,168 --a------ C:\WINDOWS\system32\msr2cenu.dll
2007-04-07 15:59 7,168 --a------ C:\WINDOWS\system32\mscat32.dll
2007-04-07 15:59 7,052

by **Gecko** » Wed May 09, 2007 1:26 pm

kangtim69,

It looks like the combofix removed some of your infections.

Can you please post a new Hijackthis log

by **kangtim69** » Sun May 13, 2007 1:45 pm

Sure can, here it is.

Logfile of HijackThis v1.99.1
Scan saved at 8:43:37 AM, on 5/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\Program Files\EarthLink TotalAccess\FastLane\IPClient.exe
C:\Program Files\EarthLink TotalAccess\Accelerator\ElinkAcc.exe
C:\Program Files\EarthLink TotalAccess\MailClnt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\The Kang\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/m ... earch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: EarthLink ScamBlocker V2 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: EarthLink PopUp Blocker V2 - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IE_PopupBlocker Class - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\Program Files\EarthLink TotalAccess\Accelerator\prpl_IePopupBlocker.dll
O2 - BHO: (no name) - {8FAC89CE-B21D-4C5F-973C-ADBEEA5C22Ec} - C:\WINDOWS\system32\afudhjjw.dll (file missing)
O2 - BHO: Earthlink Protection BHO - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: (no name) - {C39B0585-4BB1-4F4D-BFD8-69F6C35BE73F} - (no file)
O2 - BHO: Uninstall Legacy Earthlink Toolbar - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\pefibkjl.dll",realset
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-image.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 6018433515
O17 - HKLM\System\CCS\Services\Tcpip\..\{B568FE8E-75C2-4F26-821B-CB2342FABCA8}: NameServer = 207.69.188.185 207.69.188.186
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: EarthLink Monitor Service (EarthLinkMonitor) - Boingo Wireless, Inc. - C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

by **Gecko** » Sun May 13, 2007 3:27 pm

kangtim69,

Warning these instructions are for this thread only!
You should never attempt to use them for anything else!

Please copy this to Notepad and save it to your desktop or print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
You should not have any other open windows when you are following the procedures below.

Please download to your desktop but do not run it yet.

Start HijackThis and click "Do a system scan only" put a check next to each of the following entries:
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {8FAC89CE-B21D-4C5F-973C-ADBEEA5C22Ec} - C:\WINDOWS\system32\afudhjjw.dll (file missing)
O2 - BHO: (no name) - {C39B0585-4BB1-4F4D-BFD8-69F6C35BE73F} - (no file)
O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\pefibkjl.dll",realset

Now click the "Fixed checked" button and then close HijackThis

Reboot in to Safe mode:
Restart Windows after you see the BIOS screen and before Windows starts to load.
Start tapping the F8 key. The Windows Advanced Options Menu appears.
Use the Arrow key to ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' is enabled. Also make sure that Display the contents of System Folders' is checked. Remember to reset these when done.

Click Start, click My computer and then right click on your C: drive and select "Properties"
Now click the "Disk cleanup" button, in the next window put a check next to Recycle Bin, Temporary Internet Files and Temporary Files click OK and then click yes in the popup window.

Click killbox.exe on your desktop, now select the option "Delete on reboot".
Now click on the "All files" button (it will turn green)

Next copy the below red part:
C:\WINDOWS\system32\pefibkjl.dll

Click 'File' in the killbox Menu on top and choose Paste from clipboard
Now click the red X icon to delete these files on reboot
Killbox will tell you that all listed files will be removed on next reboot and asks if you would like to Reboot now, click YES

If you don't get that message, reboot manually.

After your computer reboots please post a new HiJackThis log when you reply.

by **kangtim69** » Tue May 15, 2007 12:43 am

Here is the new hijack this log after doing the what you said.

Logfile of HijackThis v1.99.1
Scan saved at 7:40:41 PM, on 5/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\EarthLink TotalAccess\FastLane\IPClient.exe
C:\Program Files\EarthLink TotalAccess\Accelerator\ElinkAcc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Program Files\EarthLink TotalAccess\UpdMgr.exe
C:\Documents and Settings\The Kang\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/m ... earch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: EarthLink ScamBlocker V2 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: EarthLink PopUp Blocker V2 - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IE_PopupBlocker Class - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\Program Files\EarthLink TotalAccess\Accelerator\prpl_IePopupBlocker.dll
O2 - BHO: Earthlink Protection BHO - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: Uninstall Legacy Earthlink Toolbar - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-image.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 6018433515
O17 - HKLM\System\CCS\Services\Tcpip\..\{B568FE8E-75C2-4F26-821B-CB2342FABCA8}: NameServer = 207.69.188.185 207.69.188.186
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: EarthLink Monitor Service (EarthLinkMonitor) - Boingo Wireless, Inc. - C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

by **Gecko** » Tue May 15, 2007 11:39 am

kangtim69,

Your log is clean

How is it running now?

by **kangtim69** » Tue May 15, 2007 9:29 pm

All looks good. Thanks for the help.

PCTech Forums

spyware

spyware

Sorry it took so long!!!

New HiJack this log

Who is online