trojan.win32.autorun.aco

View previous topic View next topic Go down

trojan.win32.autorun.aco

Post by anaelle on 22nd March 2010, 7:56 am

Hi,

The anti virus Kaspersky detects trojan.win32.autorun.aco in my external hard disk but fails to delete it. I suppose the trojan has also infected the computer hard disk, since I always connect my external harddisk to work.
The virus cannot be seen even if the hidden files are shown.

It seems to be quite a serious virus and I don't know how to delete it..
Thanks

anaelle
Novice
Novice

Posts Posts : 14
Joined Joined : 2010-03-22
OS OS : Windows XP Professional
Points Points : 24718
# Likes # Likes : 0

View user profile

Back to top Go down

Re: trojan.win32.autorun.aco

Post by Nazzgull on 22nd March 2010, 11:39 am

Hi,
please read [You must be registered and logged in to see this link.] post, and post your HijackThis log file in this topic.

Wait for instructions given only by [You must be registered and logged in to see this link.], [You must be registered and logged in to see this link.] or [You must be registered and logged in to see this link.]



Nazzgull
Top Dog
Top Dog

Posts Posts : 2343
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : Windows 7 Professional
Points Points : 40465
# Likes # Likes : 1

View user profile

Back to top Go down

Re: trojan.win32.autorun.aco

Post by Dr Jay on 23rd March 2010, 3:23 am

Download [You must be registered and logged in to see this link.] to your Desktop

  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Under the Custom Scan box paste this in

    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\system32\*.exe /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
    %SYSTEMDRIVE%\*.*
    %PROGRAMFILES%\*.
    netsvcs
    msconfig
    safebootminimal
    safebootnetwork
    activex
    drivers32
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    nvrd32.sys
    symmpi.sys
    adp3132.sys
    mv61xx.sys
    /md5stop
    CREATERESTOREPOINT
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs


  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time



Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 13743
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Protection Protection : Bitdefender Total Security
Points Points : 302211
# Likes # Likes : 10

View user profile

Back to top Go down

trojan.win32.autorun.aco hijack file

Post by anaelle on 23rd March 2010, 9:51 am

The following is the hijack file of the computer without the infected device. I avoid to connect it.. Should I do another hijack scan with it?



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:15:52 PM, on 3/23/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
C:\Program Files\TeamViewer\Version4\TeamViewer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Suvidha\Desktop\ipmsg.exe
D:\Grand Rapport PANI\winlogon.scr

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Fusion|Ace Enterprises-Internet Explorer
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\CleanVirus.vbs
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [USB Antivirus] C:\Program Files\USB Disk Security\USBGuard.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Suvidha\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Software Informer] "C:\Program Files\Software Informer\softinfo.exe" -autorun
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - [You must be registered and logged in to see this link.]
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{C4B483F9-2F7A-4C9A-97DD-4A8AF197B222}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe

--
End of file - 5333 bytes

anaelle
Novice
Novice

Posts Posts : 14
Joined Joined : 2010-03-22
OS OS : Windows XP Professional
Points Points : 24718
# Likes # Likes : 0

View user profile

Back to top Go down

OTL.txt

Post by anaelle on 23rd March 2010, 10:04 am

OTL logfile created on: 3/23/2010 3:25:52 PM - Run 1
OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\Suvidha\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

447.00 Mb Total Physical Memory | 212.00 Mb Available Physical Memory | 47.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19.53 Gb Total Space | 12.02 Gb Free Space | 61.55% Space Free | Partition Type: NTFS
Drive D: | 29.29 Gb Total Space | 22.06 Gb Free Space | 75.29% Space Free | Partition Type: NTFS
Drive E: | 25.69 Gb Total Space | 24.46 Gb Free Space | 95.20% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PANI1
Current User Name: Suvidha
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/03/23 15:23:15 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Suvidha\Desktop\OTL.exe
PRC - [2010/03/04 12:21:46 | 000,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/05/06 15:04:10 | 004,557,608 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version4\TeamViewer.exe
PRC - [2009/05/06 14:41:20 | 000,185,640 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
PRC - [2007/09/10 15:12:44 | 000,069,632 | ---- | M] (Software 2000 Limited) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\HP1006MC.EXE
PRC - [2007/01/17 01:35:41 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/06/21 03:12:44 | 000,577,536 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2005/11/01 01:45:12 | 000,163,840 | R--- | M] (S3 Graphics Co., Ltd.) -- C:\WINDOWS\system32\VTTrayp.exe
PRC - [2005/03/08 01:03:28 | 000,053,248 | R--- | M] (S3 Graphics, Inc.) -- C:\WINDOWS\system32\VTTimer.exe
PRC - [2004/09/08 01:19:06 | 000,159,744 | ---- | M] (H.Shirouzu) -- C:\Documents and Settings\Suvidha\Desktop\ipmsg.exe


========== Modules (SafeList) ==========

MOD - [2010/03/23 15:23:15 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Suvidha\Desktop\OTL.exe
MOD - [2007/01/17 01:37:25 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
MOD - [2007/01/17 01:37:23 | 000,248,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\xpsp3res.dll
MOD - [2004/08/04 05:26:38 | 002,897,920 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\xpsp2res.dll


========== Win32 Services (SafeList) ==========

SRV - [2009/07/03 15:56:14 | 000,303,376 | ---- | M] (Kaspersky Lab) [Auto | Running] -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe -- (AVP)
SRV - [2009/05/06 14:41:20 | 000,185,640 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe -- (TeamViewer4)
SRV - [2005/10/06 18:12:30 | 000,855,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Media Connect 2\wmccds.exe -- (WMConnectCDS)


========== Driver Services (SafeList) ==========

DRV - [2009/12/29 15:50:50 | 000,296,976 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF)
DRV - [2009/06/15 14:01:00 | 000,128,016 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\kl1.sys -- (kl1)
DRV - [2009/05/16 20:59:44 | 000,019,472 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klmouflt.sys -- (klmouflt)
DRV - [2009/05/13 17:46:52 | 000,031,760 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klim5.sys -- (klim5)
DRV - [2008/12/15 20:41:32 | 000,033,808 | ---- | M] (Kaspersky Lab) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\klbg.sys -- (klbg)
DRV - [2006/06/27 15:12:14 | 003,972,672 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = [You must be registered and logged in to see this link.]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = [You must be registered and logged in to see this link.]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [You must be registered and logged in to see this link.]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546
FF - prefs.js..extensions.enabledItems: [You must be registered and logged in to see this link.]:9.0.0.463


FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/03/13 10:57:16 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/03/04 12:22:00 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt [2009/12/29 15:52:06 | 000,000,000 | ---D | M]

[2009/07/23 13:47:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Suvidha\Application Data\Mozilla\Extensions
[2010/03/22 15:37:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Suvidha\Application Data\Mozilla\Firefox\Profiles\sjj36trr.default\extensions
[2009/10/03 15:52:05 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\Suvidha\Application Data\Mozilla\Firefox\Profiles\sjj36trr.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/03/22 12:50:24 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/12/29 15:52:55 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru

O1 HOSTS File: ([2001/08/23 17:30:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [USB Antivirus] C:\Program Files\USB Disk Security\USBGuard.exe (Zbshareware Lab)
O4 - HKLM..\Run: [VTTimer] C:\WINDOWS\System32\VTTimer.exe (S3 Graphics, Inc.)
O4 - HKLM..\Run: [VTTrayp] C:\WINDOWS\System32\VTTrayp.exe (S3 Graphics Co., Ltd.)
O4 - HKCU..\Run: [fsm] File not found
O4 - HKCU..\Run: [Software Informer] C:\Program Files\Software Informer\softinfo.exe (Informer Technologies, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 159
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_16)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\mzvkbd3.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\kloehk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: TaskMan - (C:\Documents and Settings\Suvidha\csrss.exe) - C:\Documents and Settings\Suvidha\csrss.exe (LMOiJlpDF)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/18 05:45:19 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{11a3255f-74f6-11de-966e-93a54eeb7b8f}\Shell\AutoRun\command - "" = G:\storage\sys.exe -- File not found
O33 - MountPoints2\{11a3255f-74f6-11de-966e-93a54eeb7b8f}\Shell\opEN\coMmand - "" = G:\storage\sys.exe -- File not found
O33 - MountPoints2\{1332ec6c-35db-11de-a7f0-0019219df179}\Shell - "" = AutoRun
O33 - MountPoints2\{1332ec6c-35db-11de-a7f0-0019219df179}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1332ec6c-35db-11de-a7f0-0019219df179}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -- File not found
O33 - MountPoints2\{15c511c9-ccea-11de-b679-0019219df179}\Shell\autoplay\cOmManD - "" = halk.exe
O33 - MountPoints2\{15c511c9-ccea-11de-b679-0019219df179}\Shell\AutoRun\command - "" = halk.exe
O33 - MountPoints2\{15c511c9-ccea-11de-b679-0019219df179}\Shell\exploRe\commanD - "" = halk.exe
O33 - MountPoints2\{15c511c9-ccea-11de-b679-0019219df179}\Shell\oPeN\COmmaNd - "" = halk.exe
O33 - MountPoints2\{2193c583-7295-11de-b324-0019219df179}\Shell\Auto\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{2193c583-7295-11de-b324-0019219df179}\Shell\AutoRun\command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{2193c583-7295-11de-b324-0019219df179}\Shell\Explore\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{2193c583-7295-11de-b324-0019219df179}\Shell\Find\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{2193c583-7295-11de-b324-0019219df179}\Shell\Format...\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{2193c583-7295-11de-b324-0019219df179}\Shell\open\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{2bbe5184-0af5-11df-bdbe-0019219df179}\Shell\AutoRun\command - "" = folder.tmpdat/tmpdat.exe
O33 - MountPoints2\{2bbe5184-0af5-11df-bdbe-0019219df179}\Shell\explore\command - "" = folder.tmpdat/tmpdat.exe
O33 - MountPoints2\{2bbe5184-0af5-11df-bdbe-0019219df179}\Shell\open\command - "" = folder.tmpdat/tmpdat.exe
O33 - MountPoints2\{31957ab6-31b9-11de-a7e7-0019219df179}\Shell\Auto\Command - "" = G:\
O33 - MountPoints2\{31957ab6-31b9-11de-a7e7-0019219df179}\Shell\AutoRun\command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{31957ab6-31b9-11de-a7e7-0019219df179}\Shell\Explore\Command - "" = G:\
O33 - MountPoints2\{31957ab6-31b9-11de-a7e7-0019219df179}\Shell\Find\Command - "" = G:\
O33 - MountPoints2\{31957ab6-31b9-11de-a7e7-0019219df179}\Shell\Format...\Command - "" = G:\
O33 - MountPoints2\{31957ab6-31b9-11de-a7e7-0019219df179}\Shell\open\Command - "" = G:\
O33 - MountPoints2\{3d55f1f4-69bf-11de-ba7d-0019219df179}\Shell\AutoRun\command - "" = G:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\RemovableDrive.exe -- File not found
O33 - MountPoints2\{3d55f1f4-69bf-11de-ba7d-0019219df179}\Shell\open\command - "" = G:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\RemovableDrive.exe -- File not found
O33 - MountPoints2\{5ec01464-4e3c-11de-b191-0019219df179}\Shell\Auto\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{5ec01464-4e3c-11de-b191-0019219df179}\Shell\AutoRun\command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{5ec01464-4e3c-11de-b191-0019219df179}\Shell\Explore\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{5ec01464-4e3c-11de-b191-0019219df179}\Shell\Find\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{5ec01464-4e3c-11de-b191-0019219df179}\Shell\Format...\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{5ec01464-4e3c-11de-b191-0019219df179}\Shell\open\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{6cb44409-aa9f-11de-9705-0019219df179}\Shell\AutoRun\command - "" = AppDataDB\AppData.exe
O33 - MountPoints2\{6cb44409-aa9f-11de-9705-0019219df179}\Shell\explore\command - "" = AppDataDB\AppData.exe
O33 - MountPoints2\{6cb44409-aa9f-11de-9705-0019219df179}\Shell\open\command - "" = AppDataDB\AppData.exe
O33 - MountPoints2\{6cb44409-aa9f-11de-9705-0019219df179}\Shell\search\command - "" = AppDataDB\AppData.exe
O33 - MountPoints2\{75e09a0d-2c54-11de-a7de-0019219df179}\Shell\Auto\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09a0d-2c54-11de-a7de-0019219df179}\Shell\AutoRun\command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09a0d-2c54-11de-a7de-0019219df179}\Shell\Explore\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09a0d-2c54-11de-a7de-0019219df179}\Shell\Find\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09a0d-2c54-11de-a7de-0019219df179}\Shell\Format...\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09a0d-2c54-11de-a7de-0019219df179}\Shell\open\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09c43-2c54-11de-a7de-0019219df179}\Shell\Auto\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09c43-2c54-11de-a7de-0019219df179}\Shell\AutoRun\command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09c43-2c54-11de-a7de-0019219df179}\Shell\Explore\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09c43-2c54-11de-a7de-0019219df179}\Shell\Find\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09c43-2c54-11de-a7de-0019219df179}\Shell\Format...\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09c43-2c54-11de-a7de-0019219df179}\Shell\open\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{8765ac1e-3a03-11de-a7f6-0019219df179}\Shell\Auto\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{8765ac1e-3a03-11de-a7f6-0019219df179}\Shell\AutoRun\command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{8765ac1e-3a03-11de-a7f6-0019219df179}\Shell\Explore\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{8765ac1e-3a03-11de-a7f6-0019219df179}\Shell\Find\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{8765ac1e-3a03-11de-a7f6-0019219df179}\Shell\Format...\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{8765ac1e-3a03-11de-a7f6-0019219df179}\Shell\open\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{8fb30607-cdb3-11de-89e6-0019219df179}\Shell\Auto\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{8fb30607-cdb3-11de-89e6-0019219df179}\Shell\AutoRun\command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{8fb30607-cdb3-11de-89e6-0019219df179}\Shell\Explore\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{8fb30607-cdb3-11de-89e6-0019219df179}\Shell\Find\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{8fb30607-cdb3-11de-89e6-0019219df179}\Shell\Format...\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{8fb30607-cdb3-11de-89e6-0019219df179}\Shell\open\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{98da220a-6c63-11de-b5d0-0019219df179}\Shell\Auto\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{98da220a-6c63-11de-b5d0-0019219df179}\Shell\AutoRun\command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{98da220a-6c63-11de-b5d0-0019219df179}\Shell\Explore\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{98da220a-6c63-11de-b5d0-0019219df179}\Shell\Find\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{98da220a-6c63-11de-b5d0-0019219df179}\Shell\Format...\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{98da220a-6c63-11de-b5d0-0019219df179}\Shell\open\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{a1422c24-3a5d-11de-9194-0019219df179}\Shell\Auto\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a1422c24-3a5d-11de-9194-0019219df179}\Shell\AutoRun\command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a1422c24-3a5d-11de-9194-0019219df179}\Shell\Explore\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a1422c24-3a5d-11de-9194-0019219df179}\Shell\Find\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a1422c24-3a5d-11de-9194-0019219df179}\Shell\Format...\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a1422c24-3a5d-11de-9194-0019219df179}\Shell\open\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a780a767-2c1d-11de-a7db-0019219df179}\Shell\Auto\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a780a767-2c1d-11de-a7db-0019219df179}\Shell\AutoRun\command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a780a767-2c1d-11de-a7db-0019219df179}\Shell\Explore\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a780a767-2c1d-11de-a7db-0019219df179}\Shell\Find\Command - "" = G:\
O33 - MountPoints2\{a780a767-2c1d-11de-a7db-0019219df179}\Shell\Format...\Command - "" = G:\
O33 - MountPoints2\{a780a767-2c1d-11de-a7db-0019219df179}\Shell\open\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{b139d777-3ba9-11de-9196-0019219df179}\Shell\Auto\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{b139d777-3ba9-11de-9196-0019219df179}\Shell\AutoRun\command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{b139d777-3ba9-11de-9196-0019219df179}\Shell\Explore\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{b139d777-3ba9-11de-9196-0019219df179}\Shell\Find\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{b139d777-3ba9-11de-9196-0019219df179}\Shell\Format...\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{b139d777-3ba9-11de-9196-0019219df179}\Shell\open\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{c1aaaa28-b61d-11de-a45b-0019219df179}\Shell\AutoRun\command - "" = ctu8r.exe
O33 - MountPoints2\{c1aaaa28-b61d-11de-a45b-0019219df179}\Shell\open\Command - "" = ctu8r.exe
O33 - MountPoints2\{f9696c83-a43a-11de-b3c3-0019219df179}\Shell\Auto\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{f9696c83-a43a-11de-b3c3-0019219df179}\Shell\AutoRun\command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{f9696c83-a43a-11de-b3c3-0019219df179}\Shell\Explore\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{f9696c83-a43a-11de-b3c3-0019219df179}\Shell\Find\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{f9696c83-a43a-11de-b3c3-0019219df179}\Shell\Format...\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{f9696c83-a43a-11de-b3c3-0019219df179}\Shell\open\Command - "" = wscript.exe FAantivirus.vbs
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2009/04/18 05:44:34 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found


SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4b218e3e-bc98-4770-93d3-2731b9329278} - %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (64461162690904064)

========== Files/Folders - Created Within 30 Days ==========

[2010/03/23 15:22:54 | 000,555,520 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Suvidha\Desktop\OTL.exe
[2010/03/15 15:51:16 | 000,000,000 | ---D | C] -- C:\Program Files\Marvell
[2010/03/15 15:48:16 | 000,147,456 | RHS- | C] (LMOiJlpDF) -- C:\Documents and Settings\Suvidha\csrss.exe
[2010/03/15 13:37:15 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2010/03/15 13:37:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\OPTIONS
[2010/03/15 13:37:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Suvidha\Application Data\InstallShield
[2010/03/11 14:20:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Suvidha\Desktop\New Folder
[2009/09/10 19:58:04 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2009/05/14 22:33:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\TeamViewer
[2009/04/18 05:49:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/04/18 05:49:34 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/04/18 05:49:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/03/23 15:23:15 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Suvidha\Desktop\OTL.exe
[2010/03/23 15:08:18 | 000,218,112 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\Force Field (FF) Analysis.xls
[2010/03/23 15:07:39 | 000,031,232 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\FF.doc
[2010/03/23 14:54:00 | 000,000,986 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-602609370-725345543-1003UA.job
[2010/03/23 12:58:39 | 000,212,480 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\PANI_ Presentation.ppt_AIF.ppt
[2010/03/23 10:54:00 | 000,000,934 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-602609370-725345543-1003Core.job
[2010/03/23 10:16:36 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/03/23 10:16:28 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/03/22 18:57:08 | 005,242,880 | -H-- | M] () -- C:\Documents and Settings\Suvidha\NTUSER.DAT
[2010/03/22 18:56:57 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\Suvidha\ntuser.ini
[2010/03/22 12:05:46 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/03/20 18:48:18 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\New Microsoft Word Document (2).doc
[2010/03/20 14:58:58 | 000,071,680 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\Presentation1.ppt
[2010/03/20 12:36:28 | 000,020,480 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\20march
[2010/03/18 14:59:32 | 000,039,936 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\LWF samminer (1).doc
[2010/03/18 14:29:39 | 000,010,752 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\New Microsoft Word Document.doc
[2010/03/17 14:10:16 | 004,552,450 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\SCDP House hold Survey format.rar
[2010/03/14 15:32:54 | 000,072,192 | ---- | M] () -- C:\Documents and Settings\Suvidha\My Documents\Presentation1.ppt
[2010/03/12 12:53:12 | 000,147,456 | RHS- | M] (LMOiJlpDF) -- C:\Documents and Settings\Suvidha\csrss.exe
[2010/03/12 11:49:15 | 000,036,352 | ---- | M] () -- C:\Documents and Settings\Suvidha\My Documents\Attendens Sheet..doc
[2010/03/08 11:04:11 | 000,022,016 | ---- | M] () -- C:\Documents and Settings\Suvidha\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/04 11:02:54 | 000,000,376 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[2010/02/24 14:09:16 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Suvidha\My Documents\SUMMER TRAINING CERTIFICATE.doc
[2010/02/23 15:24:19 | 000,026,112 | ---- | M] () -- C:\Documents and Settings\Suvidha\My Documents\Loan Details as on 22nd Feb.xls
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/03/23 14:54:02 | 000,031,232 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\FF.doc
[2010/03/23 13:18:45 | 000,218,112 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\Force Field (FF) Analysis.xls
[2010/03/22 17:15:08 | 000,212,480 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\PANI_ Presentation.ppt_AIF.ppt
[2010/03/20 18:27:17 | 000,020,992 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\New Microsoft Word Document (2).doc
[2010/03/20 12:57:38 | 000,071,680 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\Presentation1.ppt
[2010/03/20 12:25:39 | 000,020,480 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\20march
[2010/03/18 14:29:39 | 000,010,752 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\New Microsoft Word Document.doc
[2010/03/17 14:24:54 | 000,039,936 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\LWF samminer (1).doc
[2010/03/17 14:12:32 | 004,552,450 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\SCDP House hold Survey format.rar
[2010/03/14 11:50:50 | 000,072,192 | ---- | C] () -- C:\Documents and Settings\Suvidha\My Documents\Presentation1.ppt
[2010/03/12 11:42:47 | 000,036,352 | ---- | C] () -- C:\Documents and Settings\Suvidha\My Documents\Attendens Sheet..doc
[2010/02/24 14:02:28 | 000,020,992 | ---- | C] () -- C:\Documents and Settings\Suvidha\My Documents\SUMMER TRAINING CERTIFICATE.doc
[2010/02/23 15:24:19 | 000,026,112 | ---- | C] () -- C:\Documents and Settings\Suvidha\My Documents\Loan Details as on 22nd Feb.xls
[2009/11/14 17:03:03 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth2.dll
[2009/11/14 17:03:03 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth1.dll
[2009/11/14 17:03:03 | 000,000,100 | ---- | C] () -- C:\WINDOWS\System32\prsgrc.dll
[2009/11/14 16:47:16 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2009/11/14 16:47:16 | 000,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2009/10/03 15:53:29 | 000,001,024 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\pdfdoc2.dll
[2009/10/03 15:50:26 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfmonnt.dll
[2009/10/03 15:50:23 | 000,000,164 | ---- | C] () -- C:\WINDOWS\System32\psconv.ini
[2009/07/21 17:56:38 | 000,012,288 | ---- | C] () -- C:\WINDOWS\impborl.dll
[2009/07/04 09:13:26 | 000,022,016 | ---- | C] () -- C:\Documents and Settings\Suvidha\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/25 00:10:57 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/04/18 18:16:36 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/04/18 17:53:20 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\HPPLVS.dll
[2009/04/18 17:50:52 | 000,143,360 | R--- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2004/08/04 05:26:44 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== Custom Scans ==========


< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2007/02/17 03:36:48 | 001,386,496 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\msvbvm60.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\*.exe /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2009/04/18 11:02:03 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2009/04/18 11:02:03 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2009/04/18 11:02:03 | 000,892,928 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %SYSTEMDRIVE%\*.* >
[2009/04/18 05:45:19 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009/04/18 05:39:22 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2009/04/18 05:45:19 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2009/04/18 05:45:19 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/04/18 05:45:19 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/04 03:08:34 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2004/08/04 03:29:34 | 000,250,032 | RHS- | M] () -- C:\ntldr
[2010/03/23 10:16:23 | 704,643,072 | -HS- | M] () -- C:\pagefile.sys

< %PROGRAMFILES%\*. >
[2009/04/18 18:58:36 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2009/04/18 19:00:38 | 000,000,000 | ---D | M] -- C:\Program Files\Ahead
[2009/04/18 17:55:13 | 000,000,000 | -H-D | M] -- C:\Program Files\Avago-HP
[2009/11/14 16:47:42 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2009/04/18 05:41:29 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
[2009/04/18 19:01:45 | 000,000,000 | ---D | M] -- C:\Program Files\CyberLink
[2009/05/05 23:50:59 | 000,000,000 | ---D | M] -- C:\Program Files\Free PDF to Word Doc Converter
[2009/09/30 13:30:24 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2010/03/08 15:05:08 | 000,000,000 | ---D | M] -- C:\Program Files\HMIS
[2010/03/15 15:49:28 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2009/10/15 17:18:32 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2009/10/02 08:47:56 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2009/12/29 15:51:19 | 000,000,000 | ---D | M] -- C:\Program Files\Kaspersky Lab
[2009/10/15 17:25:53 | 000,000,000 | ---D | M] -- C:\Program Files\Lipikaar
[2010/03/15 15:51:16 | 000,000,000 | ---D | M] -- C:\Program Files\Marvell
[2009/04/18 05:41:03 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
[2009/04/18 18:14:32 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft ActiveSync
[2009/04/18 05:45:43 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2009/04/18 18:13:48 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2009/04/18 18:14:47 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft.NET
[2009/04/18 05:42:29 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/03/23 12:59:12 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2010/03/14 16:18:53 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
[2009/04/18 05:40:59 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
[2009/04/18 05:42:42 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2009/04/18 05:43:23 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services
[2009/04/18 05:42:38 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
[2009/10/03 15:50:25 | 000,000,000 | ---D | M] -- C:\Program Files\PDF-Convert
[2009/10/03 15:50:19 | 000,000,000 | ---D | M] -- C:\Program Files\psconvert
[2010/03/15 13:56:18 | 000,000,000 | ---D | M] -- C:\Program Files\Realtek
[2009/07/21 17:56:02 | 000,000,000 | ---D | M] -- C:\Program Files\ResumeMaker
[2009/07/25 12:02:22 | 000,000,000 | R--D | M] -- C:\Program Files\Skype
[2009/11/14 13:59:01 | 000,000,000 | ---D | M] -- C:\Program Files\Software Informer
[2009/05/14 04:08:11 | 000,000,000 | ---D | M] -- C:\Program Files\TeamViewer
[2009/04/18 17:48:31 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2009/05/01 04:37:58 | 000,000,000 | ---D | M] -- C:\Program Files\USB Disk Security
[2009/07/21 17:15:41 | 000,000,000 | ---D | M] -- C:\Program Files\VideoLAN
[2009/04/18 05:41:09 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Connect 2
[2009/04/18 05:45:18 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2009/04/18 05:40:52 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2009/04/18 05:43:27 | 000,000,000 | -H-D | M] -- C:\Program Files\WindowsUpdate
[2010/01/26 15:16:40 | 000,000,000 | ---D | M] -- C:\Program Files\WinRAR
[2009/04/18 05:45:43 | 000,000,000 | ---D | M] -- C:\Program Files\xerox


< MD5 for: ATAPI.SYS >
[2004/08/04 03:29:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2004/08/04 05:26:44 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2004/08/04 05:26:44 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2004/08/04 05:26:46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2004/08/04 05:26:46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 05:26:46 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\system32\dllcache\scecli.dll
[2004/08/04 05:26:46 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\system32\scecli.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >

anaelle
Novice
Novice

Posts Posts : 14
Joined Joined : 2010-03-22
OS OS : Windows XP Professional
Points Points : 24718
# Likes # Likes : 0

View user profile

Back to top Go down

Extras.txt

Post by anaelle on 23rd March 2010, 10:05 am

OTL Extras logfile created on: 3/23/2010 3:25:52 PM - Run 1
OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\Suvidha\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

447.00 Mb Total Physical Memory | 212.00 Mb Available Physical Memory | 47.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19.53 Gb Total Space | 12.02 Gb Free Space | 61.55% Space Free | Partition Type: NTFS
Drive D: | 29.29 Gb Total Space | 22.06 Gb Free Space | 75.29% Space Free | Partition Type: NTFS
Drive E: | 25.69 Gb Total Space | 24.46 Gb Free Space | 95.20% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PANI1
Current User Name: Suvidha
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\spool\drivers\w32x86\3\HP1006MC.EXE" = C:\WINDOWS\system32\spool\drivers\w32x86\3\HP1006MC.EXE:*:Enabled:SMLMProxy Module - HP1006MC.EXE -- (Software 2000 Limited)
"C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\English\setup.exe" = C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\English\setup.exe:*:Enabled:Kaspersky Internet Security 7.0 Setup -- (Kaspersky Lab)
"C:\Documents and Settings\Suvidha\Desktop\ipmsg.exe" = C:\Documents and Settings\Suvidha\Desktop\ipmsg.exe:*:Enabled:IPMsg English -- (H.Shirouzu)
"C:\Program Files\SPSSInc\Statistics17\SPSSWinWrapIDE.exe" = C:\Program Files\SPSSInc\Statistics17\SPSSWinWrapIDE.exe:*:Disabled:SPSS Basic script Editor -- File not found
"C:\Program Files\SPSSInc\Statistics17\statistics.exe" = C:\Program Files\SPSSInc\Statistics17\statistics.exe:*:Disabled:Statistics17:exe -- File not found
"C:\Program Files\SPSSInc\Statistics17\statistics.com" = C:\Program Files\SPSSInc\Statistics17\statistics.com:*:Disabled:Statistics17:com -- File not found


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 16
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7CCEBC24-62DB-4280-A8EC-BFA49F167920}" = Software Update for Web Folders
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0
"{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}" = REALTEK GbE & FE Ethernet PCI NIC Driver
"{AE236CDD-6312-4B9B-BD08-A99738D22480}" = Lipikaar
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"Free PS Convert driver_is1" = Free PS Convert driver 8.15
"HijackThis" = HijackThis 2.0.2
"InstallWIX_{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Mozilla Firefox (3.5.8)" = Mozilla Firefox (3.5.8)
"MSNINST" = MSN
"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition
"Picasa 3" = Picasa 3
"ResumeMaker" = ResumeMaker
"Software Informer_is1" = Software Informer 1.0 BETA
"ST6UNST #1" = HMIS
"TeamViewer 4" = TeamViewer 4
"USB Disk Security_is1" = USB Disk Security 5.0.0.80
"VLC media player" = VLC media player 0.9.8a
"WinRAR archiver" = WinRAR archiver
"Word to PDF Converter_is1" = Word to PDF Converter 3.00

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2/8/2010 10:33:25 AM | Computer Name = PANI-SUVIDHA | Source = Google Update | ID = 20
Description =

Error - 2/10/2010 2:32:16 AM | Computer Name = PANI-SUVIDHA | Source = Google Update | ID = 20
Description =

Error - 2/10/2010 3:35:14 AM | Computer Name = PANI-SUVIDHA | Source = Google Update | ID = 20
Description =

Error - 2/10/2010 4:35:14 AM | Computer Name = PANI-SUVIDHA | Source = Google Update | ID = 20
Description =

Error - 2/10/2010 5:35:14 AM | Computer Name = PANI-SUVIDHA | Source = Google Update | ID = 20
Description =

Error - 2/11/2010 1:35:14 AM | Computer Name = PANI-SUVIDHA | Source = Google Update | ID = 20
Description =

Error - 2/11/2010 2:35:15 AM | Computer Name = PANI-SUVIDHA | Source = Google Update | ID = 20
Description =

Error - 2/11/2010 3:32:15 AM | Computer Name = PANI-SUVIDHA | Source = Google Update | ID = 20
Description =

Error - 2/11/2010 3:39:00 AM | Computer Name = PANI-SUVIDHA | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.1.3642, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 2/11/2010 4:13:41 AM | Computer Name = PANI-SUVIDHA | Source = Application Hang | ID = 1002
Description = Hanging application rundll32.exe, version 5.1.2600.2180, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 3/19/2010 4:15:25 AM | Computer Name = PANI1 | Source = SideBySide | ID = 16842810
Description = Syntax error in manifest or policy file "C:\Program Files\Software
Informer\softinfo.exe" on line 0.

Error - 3/19/2010 4:15:25 AM | Computer Name = PANI1 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\Software Informer\softinfo.exe.
Reference
error message: The operation completed successfully. .

Error - 3/19/2010 4:49:41 AM | Computer Name = PANI1 | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
PRAKASH that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{C4B483F9-2F7A-4C9A-9. The master browser is stopping or an election
is being forced.

Error - 3/19/2010 6:21:42 AM | Computer Name = PANI1 | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
PRAKASH that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{C4B483F9-2F7A-4C9A-9. The master browser is stopping or an election
is being forced.

Error - 3/19/2010 7:46:27 AM | Computer Name = PANI1 | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
PRAKASH that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{C4B483F9-2F7A-4C9A-9. The master browser is stopping or an election
is being forced.

Error - 3/22/2010 7:40:56 AM | Computer Name = PANI1 | Source = SideBySide | ID = 16842810
Description = Syntax error in manifest or policy file "C:\Program Files\Software
Informer\softinfo.exe" on line 0.

Error - 3/22/2010 7:40:56 AM | Computer Name = PANI1 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\Software Informer\softinfo.exe.
Reference
error message: The operation completed successfully. .

Error - 3/23/2010 1:41:25 AM | Computer Name = PANI1 | Source = SideBySide | ID = 16842810
Description = Syntax error in manifest or policy file "C:\Program Files\Software
Informer\softinfo.exe" on line 0.

Error - 3/23/2010 1:41:25 AM | Computer Name = PANI1 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\Software Informer\softinfo.exe.
Reference
error message: The operation completed successfully. .

Error - 3/23/2010 2:57:44 AM | Computer Name = PANI1 | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
PRAKASH that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{C4B483F9-2F7A-4C9A-9. The master browser is stopping or an election
is being forced.


< End of report >

anaelle
Novice
Novice

Posts Posts : 14
Joined Joined : 2010-03-22
OS OS : Windows XP Professional
Points Points : 24718
# Likes # Likes : 0

View user profile

Back to top Go down

Re: trojan.win32.autorun.aco

Post by Dr Jay on 23rd March 2010, 4:51 pm

Please download the newest version of Adobe Acrobat Reader from [You must be registered and logged in to see this link.]

Before installing: it is important to remove older versions of Acrobat Reader since it does not do so automatically and old versions still leave you vulnerable.
Go to the Control Panel and enter Add or Remove Programs.
Search in the list for all previous installed versions of Adobe Acrobat Reader. Uninstall/Remove each of them.

Once old versions are gone, please install the newest version.

==

Please download the newest version of Java from [You must be registered and logged in to see this link.].

Before installing: it is important to remove older versions of Java since it does not do so automatically and old versions still leave you vulnerable.
Go to the Control Panel and enter Add or Remove Programs.
Search in the list for all previous installed versions of Java. (J2SE Runtime Environment). Please uninstall/remove each of them.

Once old versions are gone, please install the newest version.

===========

Do you know what these programs are:
Lipikaar
HMIS

===============

Please run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following:
    Code:
    :otl
    O4 - HKCU..\Run: [fsm] File not found

    :files
    C:\Documents and Settings\Suvidha\csrss.exe
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done.


==================

We need to do some diagnostics.

1. Please download [You must be registered and logged in to see this link.] by noahdfear.
  • Save it to your desktop.
  • Double-click profiles.exe and post its log when you reply


2. Download [You must be registered and logged in to see this link.] by ad13 and save it to your Desktop.
  • Double-click Win32kDiag.exe to run Win32kDiag and let it finish.
  • When it states "Finished! Press any key to exit...", press any key on your keyboard to close the program.
  • Double-click on the Win32kDiag.txt file that is located on your Desktop and post the entire contents of that log as a reply to this topic.


3. In your next reply, please post the following logs for my review:
  • Profiles log (1)
  • Win32kDiag log (2)


Thanks! Smile


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 13743
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Protection Protection : Bitdefender Total Security
Points Points : 302211
# Likes # Likes : 10

View user profile

Back to top Go down

OTL, Profile log and Win32kDial log

Post by anaelle on 27th March 2010, 5:55 am

Hi,
Lipikaar is a software for hindi writing.
As for HMIS, I don't know, but this pc is being used by several people, so I may not be aware of it.

I have installed new adobe and Java, but now firefox is not recognized any longer (it was also in a process of renewing but the pc blocked and had to be shut down..(Well, I know this is another thing, my focus remains on the virus elimination)

As for the 'Run fix' OTL, this is the message:

Error: Unable to interpret in the current context!
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\fsm deleted successfully.
========== FILES ==========
File\Folder C:\Documents and Settings\Suvidha\csrss.exe not found.

OTL by OldTimer - Version 3.1.37.3 log created on 03272010_110858


The following is the Profiles log (1):


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
DefaultUserProfile REG_SZ Default User
AllUsersProfile REG_SZ All Users

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
ProfileImagePath REG_EXPAND_SZ %systemroot%\system32\config\systemprofile

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\LocalService

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\NetworkService

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-2052111302-602609370-725345543-1003
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\Suvidha

SystemRoot REG_SZ C:\WINDOWS



And here comes the Win32kDiag log (2) :
(Still, I am doing all the scans without connecting the infected hard disk: should I connect it in order to detect the virus?)

Running from: C:\Documents and Settings\Suvidha\My Documents\Downloads\Win32kDiag.exe

Log file at : C:\Documents and Settings\Suvidha\Desktop\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...





Finished!



...
Thank you..

anaelle
Novice
Novice

Posts Posts : 14
Joined Joined : 2010-03-22
OS OS : Windows XP Professional
Points Points : 24718
# Likes # Likes : 0

View user profile

Back to top Go down

Re: trojan.win32.autorun.aco

Post by Dr Jay on 27th March 2010, 12:28 pm

Yes. We will need to disinfect everything here.

Please visit this webpage for a tutorial on downloading and running ComboFix:

[You must be registered and logged in to see this link.]

See the area: Using ComboFix, and when done, post the log back here.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 13743
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Protection Protection : Bitdefender Total Security
Points Points : 302211
# Likes # Likes : 10

View user profile

Back to top Go down

combofix log + new trojan

Post by anaelle on 3rd April 2010, 9:09 am

Hi,
Sorry for the delay;
Combofix has just finished, I have run it with my infected devices connected to the computer.
After its completion, I scanned again the devices and Kaspersky detected new malwares!

One is HEUR:Trojan.Win32.Generic, which can not be deleted, and the second one in worm.win32.AutoIt.bg, which has been supposedly put into quarantine.

Another problem is that even if I finally manage to desinfect this computer, other devices which may have been infected earlier will infect it again: shall I, then, run Combofix also on the 2nd computer of the office with the remaining infected pen drives?

Thank you..

Here is the log:


ComboFix 10-03-29.04 - Suvidha 04/03/2010 14:08:15.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.447.240 [GMT 5.5:30]
Running from: c:\documents and settings\Suvidha\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((( Files Created from 2010-03-03 to 2010-04-03 )))))))))))))))))))))))))))))))
.

2010-03-27 08:02 . 2010-03-27 08:02 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee
2010-03-24 09:26 . 2010-03-24 09:26 -------- d-----w- c:\program files\Common Files\Java
2010-03-24 09:24 . 2010-03-24 09:24 348160 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-29b474b9-n\msvcr71.dll
2010-03-24 09:24 . 2010-03-24 09:24 503808 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-29b474b9-n\msvcp71.dll
2010-03-24 09:24 . 2010-03-24 09:24 499712 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-29b474b9-n\jmc.dll
2010-03-24 09:24 . 2010-03-24 09:24 61440 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7304003f-n\decora-sse.dll
2010-03-24 09:24 . 2010-03-24 09:24 12800 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7304003f-n\decora-d3d.dll
2010-03-24 09:23 . 2010-03-24 09:23 -------- d-----w- c:\program files\Java
2010-03-24 09:13 . 2010-03-24 09:13 924448 ----a-w- c:\program files\jre-6u18-windows-i586-iftw-rv.exe
2010-03-24 08:20 . 2010-03-24 08:20 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Adobe
2010-03-24 08:18 . 2010-03-24 08:19 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-24 08:17 . 2010-03-24 08:17 -------- d-----w- c:\program files\Adobe Reader 9 Installer
2010-03-24 08:00 . 2010-02-01 01:45 38784 ----a-w- c:\documents and settings\Suvidha\Application Data\Macromedia\Flash Player\[You must be registered and logged in to see this link.]
2010-03-24 08:00 . 2010-02-01 01:45 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\[You must be registered and logged in to see this link.]
2010-03-24 07:59 . 2010-03-24 07:59 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-24 07:41 . 2010-03-24 07:41 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2010-03-24 07:41 . 2010-03-24 07:41 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-03-24 07:41 . 2010-03-27 08:01 -------- d-----w- c:\program files\McAfee Security Scan
2010-03-24 07:39 . 2010-03-24 08:20 -------- d-----w- c:\documents and settings\Suvidha\Local Settings\Application Data\nos
2010-03-24 07:39 . 2010-03-24 07:39 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-03-24 07:38 . 2010-03-24 08:55 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-03-15 10:21 . 2010-03-15 10:21 -------- d-----w- c:\program files\Marvell
2010-03-15 08:07 . 2010-03-15 08:26 -------- d-----w- c:\program files\Realtek
2010-03-15 08:07 . 2010-03-15 08:07 -------- d-----w- c:\windows\OPTIONS
2010-03-15 08:07 . 2010-03-15 08:07 -------- d-----w- c:\documents and settings\Suvidha\Application Data\InstallShield

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-03 08:47 . 2009-11-14 08:29 -------- d-----w- c:\documents and settings\Suvidha\Application Data\Software Informer
2010-04-03 08:46 . 2009-12-29 10:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-04-03 07:44 . 2010-02-05 11:44 -------- d-----w- c:\program files\HMIS
2010-04-01 07:22 . 2009-05-01 12:16 110592 ----a-w- c:\documents and settings\Suvidha\Application Data\U3\temp\cleanup.exe
2010-04-01 07:22 . 2009-05-01 12:14 -------- d-----w- c:\documents and settings\Suvidha\Application Data\U3
2010-03-24 09:23 . 2009-10-02 03:18 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-03-15 10:20 . 2009-04-18 13:31 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-15 10:19 . 2009-04-18 13:31 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-05 11:43 . 2010-02-05 11:39 286720 ------w- c:\windows\Setup1.exe
2010-02-05 11:43 . 2010-01-05 09:50 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-12-29 10:24 . 2009-12-29 10:24 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Suvidha\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-07-23 133104]
"Software Informer"="c:\program files\Software Informer\softinfo.exe" [2009-11-07 1978437]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-06-20 577536]
"VTTimer"="VTTimer.exe" [2005-03-07 53248]
"VTTrayp"="VTtrayp.exe" [2005-10-31 163840]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"USB Antivirus"="c:\program files\USB Disk Security\USBGuard.exe" [2009-04-30 798720]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-07-03 303376]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\HP1006MC.EXE"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\English\\setup.exe"=
"c:\\Documents and Settings\\Suvidha\\Desktop\\ipmsg.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [12/15/2008 8:41 PM 33808]
R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [5/6/2009 2:41 PM 185640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [5/13/2009 5:46 PM 31760]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [5/16/2009 8:59 PM 19472]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 6:19 PM 227232]
.
Contents of the 'Scheduled Tasks' folder

2010-04-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-602609370-725345543-1003Core.job
- c:\documents and settings\Suvidha\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-23 08:22]

2010-04-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-602609370-725345543-1003UA.job
- c:\documents and settings\Suvidha\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-23 08:22]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uDefault_Search_URL = [You must be registered and logged in to see this link.]
uSearchAssistant = [You must be registered and logged in to see this link.]
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {C4B483F9-2F7A-4C9A-97DD-4A8AF197B222} = 208.67.222.222,208.67.220.220
FF - ProfilePath - c:\documents and settings\Suvidha\Application Data\Mozilla\Firefox\Profiles\sjj36trr.default\
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHANS REMOVED - - - -

AddRemove-HijackThis - d:\grand rapport pani\HijackThis.exe
AddRemove-Picasa 3 - c:\program files\Google\Picasa3\Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2010-04-03 14:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3648)
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\TeamViewer\Version4\TeamViewer.exe
c:\windows\system32\wscntfy.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\VTTimer.exe
c:\windows\system32\VTtrayp.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
.
**************************************************************************
.
Completion time: 2010-04-03 14:20:05 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-03 08:50

Pre-Run: 12,057,899,008 bytes free
Post-Run: 12,532,711,424 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - C5BA3EDD9252F0B9F9FDF88AC91A10FA

anaelle
Novice
Novice

Posts Posts : 14
Joined Joined : 2010-03-22
OS OS : Windows XP Professional
Points Points : 24718
# Likes # Likes : 0

View user profile

Back to top Go down

Re: trojan.win32.autorun.aco

Post by Dr Jay on 3rd April 2010, 5:46 pm

No. Plug in all of them, if possible.

Then, re-run ComboFix and post a log.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 13743
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Protection Protection : Bitdefender Total Security
Points Points : 302211
# Likes # Likes : 10

View user profile

Back to top Go down

Re: trojan.win32.autorun.aco

Post by anaelle on 6th April 2010, 7:27 am

Ok, I'll do it as soon as the computer is available.

The problem is that the 2nd computer of the office shall be infected as well (from the pen drives), but it has no access to the internet.. This is why I was asking if i shall combofix it as well..
thanks.

anaelle
Novice
Novice

Posts Posts : 14
Joined Joined : 2010-03-22
OS OS : Windows XP Professional
Points Points : 24718
# Likes # Likes : 0

View user profile

Back to top Go down

Re: trojan.win32.autorun.aco

Post by Dr Jay on 6th April 2010, 4:31 pm

Start a new thread for that machine.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 13743
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Protection Protection : Bitdefender Total Security
Points Points : 302211
# Likes # Likes : 10

View user profile

Back to top Go down

2nd Combofix log

Post by anaelle on 7th April 2010, 9:35 am

Hi, this is the new combofix's log.
I'm sorry I am not sure to get what you mean by 'start a new thread': should I post a new topic, or make a scan, or something.. for the other machine?

After the run of Combofix, kaspersky still found HEUR:Trojan.Win2.Generic on my harddisk and said it could not be deleted nor quarantined; but the 2nd scan didn't find it.
Thank you..



ComboFix 10-03-29.04 - Suvidha 04/07/2010 14:30:18.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.447.225 [GMT 5.5:30]
Running from: c:\documents and settings\Suvidha\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((( Files Created from 2010-03-07 to 2010-04-07 )))))))))))))))))))))))))))))))
.

2010-04-07 05:52 . 2010-04-07 05:52 -------- d-----w- c:\windows\system32\KB905474
2010-04-07 05:47 . 2010-04-07 05:47 -------- d-----w- c:\windows\ServicePackFiles
2010-04-07 05:46 . 2010-04-07 05:46 -------- d-----w- c:\program files\MSXML 6.0
2010-04-07 05:45 . 2008-07-09 07:38 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2010-04-06 19:31 . 2010-04-06 19:31 -------- d-----w- c:\program files\MSXML 4.0
2010-04-06 19:30 . 2010-04-07 05:59 -------- d--h--w- c:\windows\$hf_mig$
2010-04-06 17:28 . 2010-04-06 17:37 -------- d-----w- c:\windows\system32\CatRoot_bak
2010-04-06 17:08 . 2009-11-27 17:04 17920 -c----w- c:\windows\system32\dllcache\msyuv.dll
2010-04-06 16:49 . 2009-11-27 16:37 8704 -c----w- c:\windows\system32\dllcache\tsbyuv.dll
2010-04-06 16:49 . 2009-11-27 16:37 48128 -c----w- c:\windows\system32\dllcache\iyuv_32.dll
2010-04-06 16:36 . 2009-06-09 14:53 290816 -c----w- c:\windows\system32\dllcache\rhttpaa.dll
2010-04-06 16:36 . 2009-06-09 14:53 53248 -c----w- c:\windows\system32\dllcache\tsgqec.dll
2010-04-06 16:36 . 2009-06-09 14:53 136192 -c----w- c:\windows\system32\dllcache\aaclient.dll
2010-04-06 16:35 . 2009-12-08 18:11 2142720 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-04-06 16:35 . 2009-12-08 18:14 2185984 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-04-06 16:35 . 2009-12-08 17:35 2020864 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-04-06 16:35 . 2009-12-08 17:35 2063104 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-04-06 16:29 . 2009-12-04 13:37 456832 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-04-06 16:16 . 2008-06-13 13:10 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-04-06 16:16 . 2008-06-13 13:10 272128 ------w- c:\windows\system32\drivers\bthport.sys
2010-04-06 15:33 . 2009-08-06 13:53 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-03-27 08:02 . 2010-03-27 08:02 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee
2010-03-24 09:26 . 2010-03-24 09:26 -------- d-----w- c:\program files\Common Files\Java
2010-03-24 09:24 . 2010-03-24 09:24 348160 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-29b474b9-n\msvcr71.dll
2010-03-24 09:24 . 2010-03-24 09:24 503808 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-29b474b9-n\msvcp71.dll
2010-03-24 09:24 . 2010-03-24 09:24 499712 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-29b474b9-n\jmc.dll
2010-03-24 09:24 . 2010-03-24 09:24 61440 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7304003f-n\decora-sse.dll
2010-03-24 09:24 . 2010-03-24 09:24 12800 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7304003f-n\decora-d3d.dll
2010-03-24 09:23 . 2010-03-24 09:23 -------- d-----w- c:\program files\Java
2010-03-24 09:13 . 2010-03-24 09:13 924448 ----a-w- c:\program files\jre-6u18-windows-i586-iftw-rv.exe
2010-03-24 08:20 . 2010-03-24 08:20 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Adobe
2010-03-24 08:18 . 2010-03-24 08:19 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-24 08:17 . 2010-03-24 08:17 -------- d-----w- c:\program files\Adobe Reader 9 Installer
2010-03-24 08:00 . 2010-02-01 01:45 38784 ----a-w- c:\documents and settings\Suvidha\Application Data\Macromedia\Flash Player\[You must be registered and logged in to see this link.]
2010-03-24 08:00 . 2010-02-01 01:45 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\[You must be registered and logged in to see this link.]
2010-03-24 07:59 . 2010-03-24 07:59 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-24 07:41 . 2010-03-24 07:41 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2010-03-24 07:41 . 2010-03-24 07:41 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-03-24 07:41 . 2010-03-27 08:01 -------- d-----w- c:\program files\McAfee Security Scan
2010-03-24 07:39 . 2010-03-24 08:20 -------- d-----w- c:\documents and settings\Suvidha\Local Settings\Application Data\nos
2010-03-24 07:39 . 2010-03-24 07:39 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-03-24 07:38 . 2010-03-24 08:55 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-03-15 10:21 . 2010-03-15 10:21 -------- d-----w- c:\program files\Marvell
2010-03-15 08:07 . 2010-03-15 08:26 -------- d-----w- c:\program files\Realtek
2010-03-15 08:07 . 2010-03-15 08:07 -------- d-----w- c:\windows\OPTIONS
2010-03-15 08:07 . 2010-03-15 08:07 -------- d-----w- c:\documents and settings\Suvidha\Application Data\InstallShield

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-07 07:37 . 2010-02-05 11:44 -------- d-----w- c:\program files\HMIS
2010-04-07 06:05 . 2009-12-29 10:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-04-03 08:47 . 2009-11-14 08:29 -------- d-----w- c:\documents and settings\Suvidha\Application Data\Software Informer
2010-04-01 07:22 . 2009-05-01 12:16 110592 ----a-w- c:\documents and settings\Suvidha\Application Data\U3\temp\cleanup.exe
2010-04-01 07:22 . 2009-05-01 12:14 -------- d-----w- c:\documents and settings\Suvidha\Application Data\U3
2010-03-24 09:23 . 2009-10-02 03:18 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-03-15 10:20 . 2009-04-18 13:31 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-15 10:19 . 2009-04-18 13:31 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-26 06:05 . 2007-01-16 20:07 668672 ----a-w- c:\windows\system32\wininet.dll
2010-02-26 06:05 . 2004-08-03 23:56 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-02-05 11:43 . 2010-02-05 11:39 286720 ------w- c:\windows\Setup1.exe
2010-02-05 11:43 . 2010-01-05 09:50 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-12-29 10:24 . 2009-12-29 10:24 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat
.

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-11 14:11 . 2009-07-11 14:11 97280 c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.dll
+ 2009-06-28 18:12 . 2009-06-28 18:12 91656 c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll
+ 2010-04-05 12:31 . 2010-04-05 12:31 16384 c:\windows\Temp\Perflib_Perfdata_304.dat
+ 2007-01-16 20:07 . 2009-08-06 13:54 44768 c:\windows\system32\wups2.dll
+ 2009-04-18 00:12 . 2009-08-06 13:54 35552 c:\windows\system32\wups.dll
+ 2009-04-18 00:12 . 2009-08-06 13:54 53472 c:\windows\system32\wuauclt.exe
+ 2007-01-16 20:07 . 2009-06-25 08:17 59392 c:\windows\system32\wdigest.dll
+ 2010-04-06 16:16 . 2010-01-23 08:11 46080 c:\windows\system32\tzchange.exe
+ 2007-01-16 20:07 . 2009-06-09 14:53 53248 c:\windows\system32\tsgqec.dll
+ 2004-08-03 23:56 . 2009-06-12 11:49 80896 c:\windows\system32\tlntsess.exe
+ 2005-05-10 23:51 . 2009-06-12 11:49 76288 c:\windows\system32\telnet.exe
+ 2010-04-06 19:30 . 2009-05-26 11:40 17272 c:\windows\system32\spmsg.dll
+ 2010-04-06 15:32 . 2009-08-06 13:54 44768 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.4.7600.226\wups2.dll
+ 2010-04-06 15:32 . 2009-08-06 13:54 35552 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.4.7600.226\wups.dll
+ 2004-08-03 23:56 . 2009-06-25 08:17 56320 c:\windows\system32\secur32.dll
+ 2001-08-23 12:00 . 2009-02-06 09:54 35328 c:\windows\system32\sc.exe
+ 2004-08-03 23:56 . 2009-10-12 13:54 69632 c:\windows\system32\raschap.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 69632 c:\windows\system32\raschap.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 39424 c:\windows\system32\pngfilt.dll
+ 2007-01-16 20:06 . 2010-02-26 06:05 39424 c:\windows\system32\pngfilt.dll
- 2001-08-23 12:00 . 2010-02-17 07:20 59440 c:\windows\system32\perfc009.dat
+ 2001-08-23 12:00 . 2010-04-07 06:08 59440 c:\windows\system32\perfc009.dat
+ 2009-04-18 00:10 . 2008-06-12 13:47 91648 c:\windows\system32\mtxoci.dll
- 2009-04-18 00:10 . 2007-01-16 20:06 91648 c:\windows\system32\mtxoci.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 66560 c:\windows\system32\mtxclu.dll
+ 2007-01-16 20:06 . 2008-06-12 13:47 66560 c:\windows\system32\mtxclu.dll
+ 2004-08-04 00:56 . 2009-11-27 17:04 17920 c:\windows\system32\msyuv.dll
+ 2001-08-23 12:00 . 2009-11-27 16:37 28672 c:\windows\system32\msvidc32.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 11264 c:\windows\system32\msrle32.dll
+ 2004-08-03 23:56 . 2009-11-27 16:37 11264 c:\windows\system32\msrle32.dll
- 2009-04-18 00:10 . 2007-01-16 20:06 58880 c:\windows\system32\msdtclog.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 58880 c:\windows\system32\msdtclog.dll
+ 2007-01-16 20:06 . 2008-06-24 16:28 74240 c:\windows\system32\mscms.dll
+ 2004-08-03 23:56 . 2009-09-04 20:45 58880 c:\windows\system32\msasn1.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 48640 c:\windows\system32\mqupgrd.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 48640 c:\windows\system32\mqupgrd.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 95744 c:\windows\system32\mqsec.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 95744 c:\windows\system32\mqsec.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 16896 c:\windows\system32\mqise.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 16896 c:\windows\system32\mqise.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 47104 c:\windows\system32\mqdscli.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 47104 c:\windows\system32\mqdscli.dll
+ 2004-08-03 23:56 . 2009-06-22 11:49 19968 c:\windows\system32\mqbkup.exe
- 2004-08-03 23:56 . 2004-08-03 23:56 19968 c:\windows\system32\mqbkup.exe
+ 2007-01-16 20:07 . 2008-06-10 21:17 96768 c:\windows\system32\logagent.exe
- 2007-01-16 20:07 . 2007-01-16 20:07 96768 c:\windows\system32\logagent.exe
+ 2007-01-16 20:05 . 2010-02-26 06:05 16384 c:\windows\system32\jsproxy.dll
+ 2004-08-04 00:56 . 2009-11-27 16:37 48128 c:\windows\system32\iyuv_32.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 96256 c:\windows\system32\inseng.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 96256 c:\windows\system32\inseng.dll
+ 2007-01-16 20:05 . 2009-10-15 16:56 81920 c:\windows\system32\fontsub.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 55808 c:\windows\system32\extmgr.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 55808 c:\windows\system32\extmgr.dll
+ 2004-08-03 21:58 . 2009-06-22 11:48 91776 c:\windows\system32\drivers\mqac.sys
+ 2004-08-03 21:59 . 2009-06-22 11:35 92544 c:\windows\system32\drivers\ksecdd.sys
+ 2009-04-18 00:12 . 2009-08-06 13:54 35552 c:\windows\system32\dllcache\wups.dll
+ 2009-04-18 00:12 . 2009-08-06 13:54 53472 c:\windows\system32\dllcache\wuauclt.exe
+ 2007-01-16 20:07 . 2009-06-25 08:17 59392 c:\windows\system32\dllcache\wdigest.dll
+ 2004-08-03 23:56 . 2009-06-12 11:49 80896 c:\windows\system32\dllcache\tlntsess.exe
+ 2005-05-10 23:51 . 2009-06-12 11:49 76288 c:\windows\system32\dllcache\telnet.exe
+ 2004-08-03 23:56 . 2009-06-25 08:17 56320 c:\windows\system32\dllcache\secur32.dll
+ 2001-08-23 12:00 . 2009-02-06 09:54 35328 c:\windows\system32\dllcache\sc.exe
+ 2004-08-03 23:56 . 2009-10-12 13:54 69632 c:\windows\system32\dllcache\raschap.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 69632 c:\windows\system32\dllcache\raschap.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 39424 c:\windows\system32\dllcache\pngfilt.dll
+ 2007-01-16 20:06 . 2010-02-26 06:05 39424 c:\windows\system32\dllcache\pngfilt.dll
- 2009-04-18 00:10 . 2007-01-16 20:06 91648 c:\windows\system32\dllcache\mtxoci.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 91648 c:\windows\system32\dllcache\mtxoci.dll
+ 2007-01-16 20:06 . 2008-06-12 13:47 66560 c:\windows\system32\dllcache\mtxclu.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 66560 c:\windows\system32\dllcache\mtxclu.dll
+ 2001-08-23 12:00 . 2009-11-27 16:37 28672 c:\windows\system32\dllcache\msvidc32.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 11264 c:\windows\system32\dllcache\msrle32.dll
+ 2004-08-03 23:56 . 2009-11-27 16:37 11264 c:\windows\system32\dllcache\msrle32.dll
- 2009-04-18 00:10 . 2007-01-16 20:06 58880 c:\windows\system32\dllcache\msdtclog.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 58880 c:\windows\system32\dllcache\msdtclog.dll
+ 2007-01-16 20:06 . 2008-06-24 16:28 74240 c:\windows\system32\dllcache\mscms.dll
+ 2004-08-03 23:56 . 2009-09-04 20:45 58880 c:\windows\system32\dllcache\msasn1.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 48640 c:\windows\system32\dllcache\mqupgrd.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 48640 c:\windows\system32\dllcache\mqupgrd.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 95744 c:\windows\system32\dllcache\mqsec.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 95744 c:\windows\system32\dllcache\mqsec.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 16896 c:\windows\system32\dllcache\mqise.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 16896 c:\windows\system32\dllcache\mqise.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 47104 c:\windows\system32\dllcache\mqdscli.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 47104 c:\windows\system32\dllcache\mqdscli.dll
+ 2004-08-03 23:56 . 2009-06-22 11:49 19968 c:\windows\system32\dllcache\mqbkup.exe
- 2004-08-03 23:56 . 2004-08-03 23:56 19968 c:\windows\system32\dllcache\mqbkup.exe
+ 2004-08-03 21:58 . 2009-06-22 11:48 91776 c:\windows\system32\dllcache\mqac.sys
+ 2007-01-16 20:07 . 2008-06-10 21:17 96768 c:\windows\system32\dllcache\logagent.exe
- 2007-01-16 20:07 . 2007-01-16 20:07 96768 c:\windows\system32\dllcache\logagent.exe
+ 2004-08-03 21:59 . 2009-06-22 11:35 92544 c:\windows\system32\dllcache\ksecdd.sys
+ 2007-01-16 20:05 . 2010-02-26 06:05 16384 c:\windows\system32\dllcache\jsproxy.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 96256 c:\windows\system32\dllcache\inseng.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 96256 c:\windows\system32\dllcache\inseng.dll
+ 2004-08-03 23:56 . 2010-02-26 06:05 81920 c:\windows\system32\dllcache\ieencode.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 81920 c:\windows\system32\dllcache\ieencode.dll
- 2009-04-18 00:12 . 2007-01-16 20:05 18432 c:\windows\system32\dllcache\iedw.exe
+ 2009-04-18 00:12 . 2010-02-25 11:17 18432 c:\windows\system32\dllcache\iedw.exe
+ 2007-01-16 20:05 . 2009-10-15 16:56 81920 c:\windows\system32\dllcache\fontsub.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 55808 c:\windows\system32\dllcache\extmgr.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 55808 c:\windows\system32\dllcache\extmgr.dll
+ 2004-08-03 23:56 . 2009-12-14 07:35 33280 c:\windows\system32\dllcache\csrsrv.dll
+ 2007-01-16 20:05 . 2009-08-06 13:54 96480 c:\windows\system32\dllcache\cdm.dll
+ 2004-08-03 23:56 . 2009-11-27 16:37 84992 c:\windows\system32\dllcache\avifil32.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 84992 c:\windows\system32\dllcache\avifil32.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 58880 c:\windows\system32\dllcache\atl.dll
+ 2004-08-03 23:56 . 2009-07-17 18:55 58880 c:\windows\system32\dllcache\atl.dll
+ 2004-08-03 23:56 . 2009-12-14 07:35 33280 c:\windows\system32\csrsrv.dll
+ 2009-04-18 00:19 . 2010-04-05 05:06 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-04-18 00:19 . 2010-03-23 05:02 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-04-18 00:19 . 2010-04-05 05:06 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-04-18 00:19 . 2010-03-23 05:02 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-04-05 05:06 . 2010-04-05 05:06 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-04-18 00:19 . 2010-03-23 05:02 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2007-01-16 20:05 . 2009-08-06 13:54 96480 c:\windows\system32\cdm.dll
+ 2004-08-03 23:56 . 2009-11-27 16:37 84992 c:\windows\system32\avifil32.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 84992 c:\windows\system32\avifil32.dll
+ 2004-08-03 23:56 . 2009-07-17 18:55 58880 c:\windows\system32\atl.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 58880 c:\windows\system32\atl.dll
+ 2010-04-06 19:31 . 2010-04-06 19:31 32768 c:\windows\Installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}\icon.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 23040 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 23040 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 61440 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 61440 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 27136 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 27136 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 11264 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 11264 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 86016 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 86016 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 12288 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 12288 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2010-04-06 17:08 . 2009-11-27 17:04 17920 c:\windows\Driver Cache\i386\msyuv.dll
+ 2010-04-06 16:49 . 2009-11-27 16:37 48128 c:\windows\Driver Cache\i386\iyuv_32.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 39424 c:\windows\AppPatch\acadproc.dll
+ 2007-01-16 20:05 . 2009-03-25 05:54 39424 c:\windows\AppPatch\acadproc.dll
+ 2001-08-17 22:36 . 2009-11-27 16:37 8704 c:\windows\system32\tsbyuv.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 4608 c:\windows\system32\mqsvc.exe
+ 2004-08-03 23:56 . 2009-06-22 11:49 4608 c:\windows\system32\mqsvc.exe
+ 2004-08-03 23:56 . 2009-06-22 11:49 4608 c:\windows\system32\dllcache\mqsvc.exe
- 2004-08-03 23:56 . 2004-08-03 23:56 4608 c:\windows\system32\dllcache\mqsvc.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 4096 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 4096 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2010-04-06 16:49 . 2009-11-27 16:37 8704 c:\windows\Driver Cache\i386\tsbyuv.dll
+ 2007-01-16 20:07 . 2010-02-25 11:01 352768 c:\windows\system32\xpsp3res.dll
+ 2009-04-18 00:12 . 2009-08-06 13:54 209632 c:\windows\system32\wuweb.dll
+ 2009-04-18 00:12 . 2009-08-06 13:54 327896 c:\windows\system32\wucltui.dll
+ 2009-04-18 00:12 . 2009-08-06 13:53 575704 c:\windows\system32\wuapi.dll
+ 2007-01-16 20:08 . 2009-04-09 19:31 413544 c:\windows\system32\wmspdmod.dll
+ 2007-01-16 20:08 . 2009-07-13 04:38 286720 c:\windows\system32\wmpdxm.dll
- 2007-01-16 20:08 . 2007-01-16 20:08 988672 c:\windows\system32\wmnetmgr.dll
+ 2007-01-16 20:08 . 2008-06-10 21:28 988672 c:\windows\system32\WMNetmgr.dll
+ 2007-01-16 20:07 . 2007-10-27 12:09 228864 c:\windows\system32\wmasf.dll
+ 2007-01-16 20:07 . 2009-06-10 06:26 134144 c:\windows\system32\wkssvc.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 351232 c:\windows\system32\winhttp.dll
+ 2004-08-03 23:56 . 2008-12-16 12:47 351232 c:\windows\system32\winhttp.dll
+ 2009-04-18 00:10 . 2009-02-06 09:41 227840 c:\windows\system32\wbem\wmiprvse.exe
+ 2009-04-18 00:10 . 2009-02-10 13:01 453120 c:\windows\system32\wbem\wmiprvsd.dll
+ 2009-04-18 00:10 . 2009-02-09 10:01 473088 c:\windows\system32\wbem\fastprox.dll
+ 2007-01-16 20:07 . 2007-12-18 14:40 417792 c:\windows\system32\vbscript.dll
+ 2007-01-16 20:07 . 2010-02-26 06:05 628224 c:\windows\system32\urlmon.dll
+ 2007-01-16 20:07 . 2009-10-15 16:56 119808 c:\windows\system32\t2embed.dll
+ 2007-01-16 20:07 . 2009-08-26 08:16 247326 c:\windows\system32\strmdll.dll
+ 2007-01-16 20:07 . 2010-02-26 06:05 474112 c:\windows\system32\shlwapi.dll
- 2007-01-16 20:07 . 2007-01-16 20:07 474112 c:\windows\system32\shlwapi.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 169472 c:\windows\system32\Setup\msmqocm.dll
+ 2004-08-03 23:56 . 2009-02-06 10:22 110592 c:\windows\system32\services.exe
+ 2004-08-03 23:56 . 2009-06-25 08:17 168448 c:\windows\system32\schannel.dll
+ 2007-01-16 20:06 . 2009-02-09 10:01 401408 c:\windows\system32\rpcss.dll
+ 2007-01-16 20:06 . 2009-04-15 15:26 583168 c:\windows\system32\rpcrt4.dll
+ 2007-01-16 20:06 . 2009-06-09 14:53 290816 c:\windows\system32\rhttpaa.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 112128 c:\windows\system32\rastls.dll
+ 2004-08-03 23:56 . 2009-10-12 13:54 112128 c:\windows\system32\rastls.dll
- 2001-08-23 12:00 . 2010-02-17 07:20 395200 c:\windows\system32\perfh009.dat
+ 2001-08-23 12:00 . 2010-04-07 06:08 395200 c:\windows\system32\perfh009.dat
+ 2004-08-03 23:56 . 2009-03-06 14:00 284160 c:\windows\system32\pdh.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 270336 c:\windows\system32\oakley.dll
+ 2007-01-16 20:06 . 2009-10-13 10:45 270336 c:\windows\system32\oakley.dll
+ 2004-08-03 23:56 . 2009-02-09 10:01 715264 c:\windows\system32\ntdll.dll
+ 2004-08-03 23:56 . 2009-02-06 18:46 408064 c:\windows\system32\netlogon.dll
+ 2007-01-16 20:06 . 2008-10-15 16:53 339456 c:\windows\system32\netapi32.dll
+ 2007-01-16 20:06 . 2009-08-06 13:53 215920 c:\windows\system32\muweb.dll
+ 2004-08-03 23:56 . 2008-06-20 17:36 245248 c:\windows\system32\mswsock.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 245248 c:\windows\system32\mswsock.dll
+ 2004-08-03 23:56 . 2009-08-05 09:11 204800 c:\windows\system32\mswebdvd.dll
+ 2004-08-03 23:56 . 2009-09-11 14:03 136192 c:\windows\system32\msv1_0.dll
+ 2009-04-18 00:10 . 2009-06-09 09:12 677888 c:\windows\system32\mstsc.exe
- 2007-01-16 20:06 . 2007-01-16 20:06 532480 c:\windows\system32\mstime.dll
+ 2007-01-16 20:06 . 2010-02-26 06:05 532480 c:\windows\system32\mstime.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 146432 c:\windows\system32\msrating.dll
+ 2007-01-16 20:06 . 2010-02-26 06:05 146432 c:\windows\system32\msrating.dll
- 2009-04-18 00:10 . 2004-08-03 23:56 343040 c:\windows\system32\mspaint.exe
+ 2009-04-18 00:10 . 2009-12-16 12:58 343040 c:\windows\system32\mspaint.exe
+ 2007-01-16 20:06 . 2010-02-26 06:05 449024 c:\windows\system32\mshtmled.dll
- 2009-04-18 00:10 . 2007-01-16 20:06 161792 c:\windows\system32\msdtcuiu.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 161792 c:\windows\system32\msdtcuiu.dll
- 2009-04-18 00:10 . 2007-01-16 20:06 956928 c:\windows\system32\msdtctm.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 956928 c:\windows\system32\msdtctm.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 428032 c:\windows\system32\msdtcprx.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 471552 c:\windows\system32\mqutil.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 471552 c:\windows\system32\mqutil.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 186880 c:\windows\system32\mqtrig.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 186880 c:\windows\system32\mqtrig.dll
+ 2004-08-03 23:56 . 2009-06-22 11:49 117248 c:\windows\system32\mqtgsvc.exe
- 2004-08-03 23:56 . 2004-08-03 23:56 117248 c:\windows\system32\mqtgsvc.exe
+ 2004-08-03 23:56 . 2009-06-25 18:36 517120 c:\windows\system32\mqsnap.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 123392 c:\windows\system32\mqrtdep.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 123392 c:\windows\system32\mqrtdep.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 177152 c:\windows\system32\mqrt.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 177152 c:\windows\system32\mqrt.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 661504 c:\windows\system32\mqqm.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 225280 c:\windows\system32\mqoa.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 225280 c:\windows\system32\mqoa.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 138240 c:\windows\system32\mqad.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 138240 c:\windows\system32\mqad.dll
+ 2007-01-16 20:05 . 2009-06-25 08:17 729600 c:\windows\system32\lsasrv.dll
+ 2004-08-03 23:56 . 2009-05-07 15:44 344064 c:\windows\system32\localspl.dll
+ 2007-01-16 20:05 . 2009-03-21 13:54 989184 c:\windows\system32\kernel32.dll
+ 2007-01-16 20:05 . 2009-06-25 08:17 301568 c:\windows\system32\kerberos.dll
+ 2010-04-07 05:52 . 2009-03-10 16:48 453512 c:\windows\system32\KB905474\wgasetup.exe
+ 2007-01-16 20:05 . 2009-08-21 09:46 450560 c:\windows\system32\jscript.dll
+ 2009-04-18 00:12 . 2008-04-11 18:39 683520 c:\windows\system32\inetcomm.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 251904 c:\windows\system32\iepeers.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 251904 c:\windows\system32\iepeers.dll
+ 2007-01-16 20:05 . 2008-10-23 12:51 284160 c:\windows\system32\gdi32.dll
- 2009-04-18 05:32 . 2009-11-16 05:26 263024 c:\windows\system32\FNTCACHE.DAT
+ 2009-04-18 05:32 . 2010-04-07 05:34 263024 c:\windows\system32\FNTCACHE.DAT
+ 2007-01-16 20:05 . 2008-07-07 20:06 253952 c:\windows\system32\es.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 205312 c:\windows\system32\dxtrans.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 205312 c:\windows\system32\dxtrans.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 357888 c:\windows\system32\dxtmsft.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 357888 c:\windows\system32\dxtmsft.dll
+ 2007-01-16 20:07 . 2008-06-20 09:32 225920 c:\windows\system32\drivers\tcpip6.sys
+ 2007-01-16 20:07 . 2008-06-20 10:44 360960 c:\windows\system32\drivers\tcpip.sys
+ 2007-01-16 20:07 . 2009-12-31 15:06 352640 c:\windows\system32\drivers\srv.sys
+ 2007-01-16 20:06 . 2008-05-08 12:14 203008 c:\windows\system32\drivers\rmcast.sys
+ 2007-01-16 20:06 . 2009-12-04 13:37 456832 c:\windows\system32\drivers\mrxsmb.sys
+ 2004-08-03 22:14 . 2008-08-14 09:48 138368 c:\windows\system32\drivers\afd.sys
+ 2007-01-16 20:05 . 2008-06-20 17:36 147968 c:\windows\system32\dnsapi.dll
+ 2009-04-18 00:12 . 2009-08-06 13:54 209632 c:\windows\system32\dllcache\wuweb.dll
+ 2009-04-18 00:12 . 2009-08-06 13:54 327896 c:\windows\system32\dllcache\wucltui.dll
+ 2009-04-18 00:12 . 2009-08-06 13:53 575704 c:\windows\system32\dllcache\wuapi.dll
+ 2009-04-18 00:10 . 2008-04-21 10:02 215552 c:\windows\system32\dllcache\wordpad.exe
+ 2007-01-16 20:08 . 2009-04-09 19:31 413544 c:\windows\system32\dllcache\wmspdmod.dll
+ 2007-01-16 20:08 . 2009-07-13 04:38 286720 c:\windows\system32\dllcache\wmpdxm.dll
+ 2007-01-16 20:08 . 2008-06-10 21:28 988672 c:\windows\system32\dllcache\WMNetmgr.dll
- 2007-01-16 20:08 . 2007-01-16 20:08 988672 c:\windows\system32\dllcache\wmnetmgr.dll
+ 2009-04-18 00:10 . 2009-02-06 09:41 227840 c:\windows\system32\dllcache\wmiprvse.exe
+ 2009-04-18 00:10 . 2009-02-10 13:01 453120 c:\windows\system32\dllcache\wmiprvsd.dll
+ 2007-01-16 20:07 . 2007-10-27 12:09 228864 c:\windows\system32\dllcache\wmasf.dll
+ 2007-01-16 20:07 . 2009-06-10 06:26 134144 c:\windows\system32\dllcache\wkssvc.dll
+ 2007-01-16 20:07 . 2010-02-26 06:05 668672 c:\windows\system32\dllcache\wininet.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 351232 c:\windows\system32\dllcache\winhttp.dll
+ 2004-08-03 23:56 . 2008-12-16 12:47 351232 c:\windows\system32\dllcache\winhttp.dll
+ 2007-01-16 20:07 . 2007-12-18 14:40 417792 c:\windows\system32\dllcache\vbscript.dll
+ 2007-01-16 20:07 . 2010-02-26 06:05 628224 c:\windows\system32\dllcache\urlmon.dll
+ 2009-04-18 00:12 . 2009-06-21 22:04 153088 c:\windows\system32\dllcache\triedit.dll
- 2009-04-18 00:12 . 2004-08-03 23:56 153088 c:\windows\system32\dllcache\triedit.dll
+ 2007-01-16 20:07 . 2008-06-20 09:32 225920 c:\windows\system32\dllcache\tcpip6.sys
+ 2007-01-16 20:07 . 2008-06-20 10:44 360960 c:\windows\system32\dllcache\tcpip.sys
+ 2007-01-16 20:07 . 2009-10-15 16:56 119808 c:\windows\system32\dllcache\t2embed.dll
+ 2007-01-16 20:07 . 2009-08-26 08:16 247326 c:\windows\system32\dllcache\strmdll.dll
+ 2007-01-16 20:07 . 2009-12-31 15:06 352640 c:\windows\system32\dllcache\srv.sys
- 2007-01-16 20:07 . 2007-01-16 20:07 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2007-01-16 20:07 . 2010-02-26 06:05 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2004-08-03 23:56 . 2009-02-06 10:22 110592 c:\windows\system32\dllcache\services.exe
+ 2004-08-03 23:56 . 2009-06-25 08:17 168448 c:\windows\system32\dllcache\schannel.dll
+ 2007-01-16 20:06 . 2009-02-09 10:01 401408 c:\windows\system32\dllcache\rpcss.dll
+ 2007-01-16 20:06 . 2009-04-15 15:26 583168 c:\windows\system32\dllcache\rpcrt4.dll
+ 2007-01-16 20:06 . 2008-05-08 12:14 203008 c:\windows\system32\dllcache\rmcast.sys
+ 2004-08-03 23:56 . 2009-10-12 13:54 112128 c:\windows\system32\dllcache\rastls.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 112128 c:\windows\system32\dllcache\rastls.dll
+ 2004-08-03 23:56 . 2009-03-06 14:00 284160 c:\windows\system32\dllcache\pdh.dll
+ 2007-01-16 20:06 . 2009-10-13 10:45 270336 c:\windows\system32\dllcache\oakley.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 270336 c:\windows\system32\dllcache\oakley.dll
+ 2004-08-03 23:56 . 2009-02-09 10:01 715264 c:\windows\system32\dllcache\ntdll.dll
+ 2004-08-03 23:56 . 2009-02-06 18:46 408064 c:\windows\system32\dllcache\netlogon.dll
+ 2007-01-16 20:06 . 2008-10-15 16:53 339456 c:\windows\system32\dllcache\netapi32.dll
+ 2004-08-03 23:56 . 2008-06-20 17:36 245248 c:\windows\system32\dllcache\mswsock.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 245248 c:\windows\system32\dllcache\mswsock.dll
+ 2004-08-03 23:56 . 2009-08-05 09:11 204800 c:\windows\system32\dllcache\mswebdvd.dll
+ 2004-08-03 23:56 . 2009-09-11 14:03 136192 c:\windows\system32\dllcache\msv1_0.dll
+ 2009-04-18 00:10 . 2009-06-09 09:12 677888 c:\windows\system32\dllcache\mstsc.exe
+ 2007-01-16 20:06 . 2010-02-26 06:05 532480 c:\windows\system32\dllcache\mstime.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 532480 c:\windows\system32\dllcache\mstime.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 146432 c:\windows\system32\dllcache\msrating.dll
+ 2007-01-16 20:06 . 2010-02-26 06:05 146432 c:\windows\system32\dllcache\msrating.dll
- 2009-04-18 00:10 . 2004-08-03 23:56 343040 c:\windows\system32\dllcache\mspaint.exe
+ 2009-04-18 00:10 . 2009-12-16 12:58 343040 c:\windows\system32\dllcache\mspaint.exe
+ 2004-08-03 23:56 . 2009-06-25 18:36 169472 c:\windows\system32\dllcache\msmqocm.dll
+ 2007-01-16 20:06 . 2010-02-26 06:05 449024 c:\windows\system32\dllcache\mshtmled.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 161792 c:\windows\system32\dllcache\msdtcuiu.dll
- 2009-04-18 00:10 . 2007-01-16 20:06 161792 c:\windows\system32\dllcache\msdtcuiu.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 956928 c:\windows\system32\dllcache\msdtctm.dll
- 2009-04-18 00:10 . 2007-01-16 20:06 956928 c:\windows\system32\dllcache\msdtctm.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 428032 c:\windows\system32\dllcache\msdtcprx.dll
- 2009-04-18 00:12 . 2004-08-03 23:56 331776 c:\windows\system32\dllcache\msadce.dll
+ 2009-04-18 00:12 . 2008-05-01 14:30 331776 c:\windows\system32\dllcache\msadce.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 471552 c:\windows\system32\dllcache\mqutil.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 471552 c:\windows\system32\dllcache\mqutil.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 186880 c:\windows\system32\dllcache\mqtrig.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 186880 c:\windows\system32\dllcache\mqtrig.dll
+ 2004-08-03 23:56 . 2009-06-22 11:49 117248 c:\windows\system32\dllcache\mqtgsvc.exe
- 2004-08-03 23:56 . 2004-08-03 23:56 117248 c:\windows\system32\dllcache\mqtgsvc.exe
+ 2004-08-03 23:56 . 2009-06-25 18:36 517120 c:\windows\system32\dllcache\mqsnap.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 123392 c:\windows\system32\dllcache\mqrtdep.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 123392 c:\windows\system32\dllcache\mqrtdep.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 177152 c:\windows\system32\dllcache\mqrt.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 177152 c:\windows\system32\dllcache\mqrt.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 661504 c:\windows\system32\dllcache\mqqm.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 225280 c:\windows\system32\dllcache\mqoa.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 225280 c:\windows\system32\dllcache\mqoa.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 138240 c:\windows\system32\dllcache\mqad.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 138240 c:\windows\system32\dllcache\mqad.dll
+ 2007-01-16 20:05 . 2009-06-25 08:17 729600 c:\windows\system32\dllcache\lsasrv.dll
+ 2004-08-03 23:56 . 2009-05-07 15:44 344064 c:\windows\system32\dllcache\localspl.dll
+ 2007-01-16 20:05 . 2009-03-21 13:54 989184 c:\windows\system32\dllcache\kernel32.dll
+ 2007-01-16 20:05 . 2009-06-25 08:17 301568 c:\windows\system32\dllcache\kerberos.dll
+ 2007-01-16 20:05 . 2009-08-21 09:46 450560 c:\windows\system32\dllcache\jscript.dll
+ 2009-04-18 00:12 . 2008-04-11 18:39 683520 c:\windows\system32\dllcache\inetcomm.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 251904 c:\windows\system32\dllcache\iepeers.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 251904 c:\windows\system32\dllcache\iepeers.dll
+ 2007-01-16 20:05 . 2008-10-23 12:51 284160 c:\windows\system32\dllcache\gdi32.dll
+ 2009-04-18 00:10 . 2009-02-09 10:01 473088 c:\windows\system32\dllcache\fastprox.dll
+ 2007-01-16 20:05 . 2008-07-07 20:06 253952 c:\windows\system32\dllcache\es.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 205312 c:\windows\system32\dllcache\dxtrans.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 205312 c:\windows\system32\dllcache\dxtrans.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 357888 c:\windows\system32\dllcache\dxtmsft.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 357888 c:\windows\system32\dllcache\dxtmsft.dll
+ 2007-01-16 20:05 . 2008-06-20 17:36 147968 c:\windows\system32\dllcache\dnsapi.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 151040 c:\windows\system32\dllcache\cdfview.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 151040 c:\windows\system32\dllcache\cdfview.dll
+ 2004-08-03 22:14 . 2008-08-14 09:48 138368 c:\windows\system32\dllcache\afd.sys
+ 2004-08-03 23:56 . 2009-02-09 10:01 617984 c:\windows\system32\dllcache\advapi32.dll
+ 2007-01-16 20:05 . 2009-11-21 16:24 470528 c:\windows\system32\dllcache\aclayers.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 151040 c:\windows\system32\cdfview.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 151040 c:\windows\system32\cdfview.dll
+ 2004-08-03 23:56 . 2009-02-09 10:01 617984 c:\windows\system32\advapi32.dll
+ 2007-01-16 20:05 . 2009-06-09 14:53 136192 c:\windows\system32\aaclient.dll
+ 2010-04-06 19:31 . 2010-04-06 19:31 429568 c:\windows\Installer\ddd6d3.msi
+ 2010-04-06 19:31 . 2010-04-06 19:31 248832 c:\windows\Installer\ddd6cb.msi
+ 2010-04-07 05:57 . 2010-04-07 05:57 969728 c:\windows\Installer\b257c.msi
+ 2009-04-18 12:46 . 2010-04-07 05:58 409600 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 409600 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 286720 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 286720 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 249856 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 249856 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 794624 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 794624 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 135168 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 135168 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 593920 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 593920 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2003-07-08 06:18 . 2003-07-08 06:18 115288 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.5614\OUTLFLTR.DLL
+ 2010-04-06 16:29 . 2009-12-04 13:37 456832 c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2010-04-06 16:16 . 2008-06-13 13:10 272128 c:\windows\Driver Cache\i386\bthport.sys
+ 2007-01-16 20:05 . 2009-11-21 16:24 470528 c:\windows\AppPatch\aclayers.dll
+ 2010-04-06 16:44 . 2009-08-13 13:55 1748992 c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll
+ 2009-07-20 18:33 . 2009-07-20 18:33 1348432 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5\msxml4.dll
+ 2009-04-18 00:12 . 2009-08-06 13:53 1929952 c:\windows\system32\wuaueng.dll
- 2007-01-16 20:08 . 2007-01-16 20:08 2330624 c:\windows\system32\wmvcore.dll
+ 2007-01-16 20:08 . 2009-06-08 16:54 2330624 c:\windows\system32\WMVCore.dll
+ 2007-01-16 20:08 . 2009-07-13 04:38 5537792 c:\windows\system32\wmp.dll
+ 2007-01-16 20:07 . 2009-08-14 11:22 1859328 c:\windows\system32\win32k.sys
+ 2007-01-16 20:07 . 2008-07-03 13:03 8460800 c:\windows\system32\shell32.dll
+ 2007-01-16 20:06 . 2010-03-10 04:57 1509888 c:\windows\system32\shdocvw.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 1435648 c:\windows\system32\query.dll
+ 2007-01-16 20:06 . 2009-07-17 16:10 1435648 c:\windows\system32\query.dll
+ 2007-01-16 20:06 . 2009-11-27 17:04 1291776 c:\windows\system32\quartz.dll
+ 2007-01-16 20:06 . 2009-12-08 18:11 2142720 c:\windows\system32\ntoskrnl.exe
+ 2006-10-30 12:27 . 2009-12-08 17:35 2020864 c:\windows\system32\ntkrnlpa.exe
+ 2009-08-19 11:37 . 2009-08-19 11:37 1415000 c:\windows\system32\msxml6.dll
+ 2009-07-20 18:35 . 2009-07-20 18:35 1348432 c:\windows\system32\msxml4.dll
+ 2007-01-16 20:06 . 2009-07-31 04:36 1172480 c:\windows\system32\msxml3.dll
+ 2009-04-18 00:10 . 2009-06-09 14:53 2067968 c:\windows\system32\mstscax.dll
+ 2007-01-16 20:06 . 2010-02-26 19:35 3073024 c:\windows\system32\mshtml.dll
+ 2010-04-07 05:52 . 2009-03-10 16:56 1403264 c:\windows\system32\KB905474\wganotifypackageinner.exe
+ 2009-04-18 00:12 . 2009-08-06 13:53 1929952 c:\windows\system32\dllcache\wuaueng.dll
+ 2007-01-16 20:08 . 2009-06-08 16:54 2330624 c:\windows\system32\dllcache\WMVCore.dll
- 2007-01-16 20:08 . 2007-01-16 20:08 2330624 c:\windows\system32\dllcache\wmvcore.dll
+ 2007-01-16 20:08 . 2009-07-13 04:38 5537792 c:\windows\system32\dllcache\wmp.dll
+ 2007-01-16 20:07 . 2009-08-14 11:22 1859328 c:\windows\system32\dllcache\win32k.sys
+ 2007-01-16 20:07 . 2008-07-03 13:03 8460800 c:\windows\system32\dllcache\shell32.dll
+ 2007-01-16 20:06 . 2010-03-10 04:57 1509888 c:\windows\system32\dllcache\shdocvw.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 1435648 c:\windows\system32\dllcache\query.dll
+ 2007-01-16 20:06 . 2009-07-17 16:10 1435648 c:\windows\system32\dllcache\query.dll
+ 2007-01-16 20:06 . 2009-11-27 17:04 1291776 c:\windows\system32\dllcache\quartz.dll
+ 2007-01-16 20:06 . 2009-07-31 04:36 1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2009-04-18 00:10 . 2009-06-09 14:53 2067968 c:\windows\system32\dllcache\mstscax.dll
+ 2009-04-18 00:12 . 2009-07-10 13:36 1315328 c:\windows\system32\dllcache\msoe.dll
+ 2007-01-16 20:06 . 2010-02-26 19:35 3073024 c:\windows\system32\dllcache\mshtml.dll
+ 2009-04-18 00:12 . 2009-10-23 14:27 3555328 c:\windows\system32\dllcache\moviemk.exe
- 2009-04-18 00:12 . 2004-08-03 23:56 3555328 c:\windows\system32\dllcache\moviemk.exe
+ 2007-01-16 20:05 . 2010-02-26 06:05 1054208 c:\windows\system32\dllcache\danim.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 1054208 c:\windows\system32\dllcache\danim.dll
+ 2007-01-16 20:05 . 2010-03-10 04:57 1024000 c:\windows\system32\dllcache\browseui.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 1054208 c:\windows\system32\danim.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 1054208 c:\windows\system32\danim.dll
+ 2007-01-16 20:05 . 2010-03-10 04:57 1024000 c:\windows\system32\browseui.dll
+ 2008-09-30 15:37 . 2008-09-30 15:37 6042112 c:\windows\Installer\ddd6d4.msi
+ 2005-10-26 09:29 . 2005-10-26 09:29 2883072 c:\windows\Installer\b2597.msp
+ 2010-02-04 12:41 . 2010-02-04 12:41 5526528 c:\windows\Installer\b2573.msp
+ 2003-07-07 08:06 . 2003-07-07 08:06 2058343 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.5614\OUTLFLTR.DAT
+ 2010-04-06 16:35 . 2009-12-08 18:14 2185984 c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2010-04-06 16:35 . 2009-12-08 17:35 2020864 c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2010-04-06 16:35 . 2009-12-08 17:35 2063104 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2010-04-06 16:35 . 2009-12-08 18:11 2142720 c:\windows\Driver Cache\i386\ntkrnlmp.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Suvidha\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-07-23 133104]
"Software Informer"="c:\program files\Software Informer\softinfo.exe" [2009-11-07 1978437]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-06-20 577536]
"VTTimer"="VTTimer.exe" [2005-03-07 53248]
"VTTrayp"="VTtrayp.exe" [2005-10-31 163840]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"USB Antivirus"="c:\program files\USB Disk Security\USBGuard.exe" [2009-04-30 798720]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-07-03 303376]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\HP1006MC.EXE"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\English\\setup.exe"=
"c:\\Documents and Settings\\Suvidha\\Desktop\\ipmsg.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [12/15/2008 8:41 PM 33808]
R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [5/6/2009 2:41 PM 185640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [5/13/2009 5:46 PM 31760]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [5/16/2009 8:59 PM 19472]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 6:19 PM 227232]
.
Contents of the 'Scheduled Tasks' folder

2010-04-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-602609370-725345543-1003Core.job
- c:\documents and settings\Suvidha\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-23 08:22]

2010-04-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-602609370-725345543-1003UA.job
- c:\documents and settings\Suvidha\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-23 08:22]

2010-04-07 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-04-07 16:48]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uDefault_Search_URL = [You must be registered and logged in to see this link.]
uSearchAssistant = [You must be registered and logged in to see this link.]
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {C4B483F9-2F7A-4C9A-97DD-4A8AF197B222} = 208.67.222.222,208.67.220.220
FF - ProfilePath - c:\documents and settings\Suvidha\Application Data\Mozilla\Firefox\Profiles\sjj36trr.default\
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2010-04-07 14:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(4020)
c:\windows\system32\msi.dll
.
Completion time: 2010-04-07 14:34:16
ComboFix-quarantined-files.txt 2010-04-07 09:04
ComboFix2.txt 2010-04-03 08:50

Pre-Run: 10,696,679,424 bytes free
Post-Run: 10,665,766,912 bytes free

- - End Of File - - 380C7FAE057625049BDA083B223D5D8F

anaelle
Novice
Novice

Posts Posts : 14
Joined Joined : 2010-03-22
OS OS : Windows XP Professional
Points Points : 24718
# Likes # Likes : 0

View user profile

Back to top Go down

Re: trojan.win32.autorun.aco

Post by Dr Jay on 7th April 2010, 2:20 pm

Yes, start a new thread for the other machine.

Please do a scan with [You must be registered and logged in to see this link.]

Click on the Accept button and install any components it needs.

  • The program will install and then begin downloading the latest definition files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer.
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run.
  • Once the scan is complete, click on View scan report
  • Now, click on the Save Report as button.
  • Save the file to your desktop.
  • Copy and paste that information in your next post.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 13743
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Protection Protection : Bitdefender Total Security
Points Points : 302211
# Likes # Likes : 10

View user profile

Back to top Go down

Re: trojan.win32.autorun.aco

Post by anaelle on 8th April 2010, 9:12 am

This the message I get from the Kaspersky online scanner..:

0 [ERROR: java.lang.RuntimeException: Kaspersky Online Scanner 7.0 cannot be started because this computer has Kaspersky Internet Security 8.0 (9.0) installed.]

anaelle
Novice
Novice

Posts Posts : 14
Joined Joined : 2010-03-22
OS OS : Windows XP Professional
Points Points : 24718
# Likes # Likes : 0

View user profile

Back to top Go down

Re: trojan.win32.autorun.aco

Post by Dr Jay on 8th April 2010, 3:06 pm

Please use Internet Explorer and run a [You must be registered and logged in to see this link.]

  • Please check I agree with the Terms and Conditions and click Start Here
  • You will need to allow an Active X install for the scan to run.
  • Leave the scanning options at default and click Start Scan
Please post the results in your next reply.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 13743
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Protection Protection : Bitdefender Total Security
Points Points : 302211
# Likes # Likes : 10

View user profile

Back to top Go down

Bit Defender online scanner also failed..

Post by anaelle on 9th April 2010, 8:59 am

Bit Defender online scanner also failed..

The first message to come, after the process started and ran for some minutes, was:
BitDefender failed to update the virus definitions. Although it might be possible to check for viruses, the result will probably not b 100% accurate.
Do you want to start scanning?

And when I tried, it immediately showed "Scan failed! Could not check the computer for viruses."

I'll try again, in the case it was due to an error of my part..

anaelle
Novice
Novice

Posts Posts : 14
Joined Joined : 2010-03-22
OS OS : Windows XP Professional
Points Points : 24718
# Likes # Likes : 0

View user profile

Back to top Go down

Re: trojan.win32.autorun.aco

Post by Dr Jay on 9th April 2010, 2:22 pm

ok


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 13743
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Protection Protection : Bitdefender Total Security
Points Points : 302211
# Likes # Likes : 10

View user profile

Back to top Go down

Re: trojan.win32.autorun.aco

Post by anaelle on 27th April 2010, 11:31 am

It still doesn't work..
The scan is complete but then nothing reacts and I can only cancel.

Meanwhile, a new name has been detected: worm.win32.autorun.rxx..
Will it finish some day?? !
Let us hope..

Thanks

anaelle
Novice
Novice

Posts Posts : 14
Joined Joined : 2010-03-22
OS OS : Windows XP Professional
Points Points : 24718
# Likes # Likes : 0

View user profile

Back to top Go down

Re: trojan.win32.autorun.aco

Post by Dr Jay on 27th April 2010, 4:21 pm

Ok. No biggie.

Please download Malwarebytes Anti-Malware from [You must be registered and logged in to see this link.].
Alternate link: [You must be registered and logged in to see this link.].
(Note: if you already have the program installed, just follow the directions. No need to re-download or re-install!)

Double Click mbam-setup.exe to install the application.

(Note: if you already have the program installed, open Malwarebytes from the Start Menu or Desktop shortcut, click the Update tab, and click Check for Updates, before doing the scan as instructed below!)

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. If you are prompted to restart, please allow it to restart your computer. Failure to do this, will cause the infection to still be active on the computer.
  • Please save the log to a location you will remember.
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • The log can also be found at C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
  • Copy and paste the entire report in your next reply.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 13743
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Protection Protection : Bitdefender Total Security
Points Points : 302211
# Likes # Likes : 10

View user profile

Back to top Go down

mbam log

Post by anaelle on 28th April 2010, 9:24 am

Hi, Malewarebytes has found no malicious item on the computer.
Here comes the log.
However, in parallel, Kaspersky detected worm.win32.autorun.zvd and made me restart the computer to fix it.



Malwarebytes' Anti-Malware 1.45
[You must be registered and logged in to see this link.]

Database version: 4044

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

4/28/2010 2:41:46 PM
mbam-log-2010-04-28 (14-41-46).txt

Scan type: Full scan (A:\|C:\|D:\|E:\|F:\|G:\|H:\|)
Objects scanned: 168874
Time elapsed: 1 hour(s), 16 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

anaelle
Novice
Novice

Posts Posts : 14
Joined Joined : 2010-03-22
OS OS : Windows XP Professional
Points Points : 24718
# Likes # Likes : 0

View user profile

Back to top Go down

Re: trojan.win32.autorun.aco

Post by Dr Jay on 28th April 2010, 5:09 pm

Will you post the log from Kaspersky antivirus, please.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 13743
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Protection Protection : Bitdefender Total Security
Points Points : 302211
# Likes # Likes : 10

View user profile

Back to top Go down

Re: trojan.win32.autorun.aco

Post by anaelle on 30th April 2010, 11:06 am

I'm sorry I cannot give you a log, the threats were only detected by warning messages -I just had time to note down the name of the trojan and it disappeared.
As for Kaspersky online it still doesn't work.

Right now no malware at all is detected -but my colleagues don't care about using their infected pen drives on the computer, so it may not be completely finished..!

Thank you

anaelle
Novice
Novice

Posts Posts : 14
Joined Joined : 2010-03-22
OS OS : Windows XP Professional
Points Points : 24718
# Likes # Likes : 0

View user profile

Back to top Go down

Re: trojan.win32.autorun.aco

Post by Dr Jay on 30th April 2010, 1:06 pm

Can you try a full scan Kaspersky Internet Security (antivirus)?


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 13743
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Protection Protection : Bitdefender Total Security
Points Points : 302211
# Likes # Likes : 10

View user profile

Back to top Go down

Re: trojan.win32.autorun.aco

Post by anaelle on 15th May 2010, 8:34 am

No threat is detected, it seems to have been all cleaned..
Thank you very much for your advices and patience!

anaelle
Novice
Novice

Posts Posts : 14
Joined Joined : 2010-03-22
OS OS : Windows XP Professional
Points Points : 24718
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum