Something not quite right

Unknown · October 2008

I have a window that keeps popping up.
Windows Firewall
Windows security alert
Trojan-spy.html.bankfraud.dq
I don't use windows firewall or security for anything.
Hijackthis log as follows
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:02:48 PM, on 10/14/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Camera Assistant Software for Gateway\traybar.exe
C:\Program Files\Spare Backup\SpareBackup.exe
C:\Program Files\Napster\napster.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\sttray.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\ProgramData\cmdinfo\axknklsd.exe
C:\Program Files\BigFix\bigfix.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Camera Assistant Software for Gateway\CEC_MAIN.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\PROGRA~1\MICROS~2\wkcalrem.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?

Ch=Retail&SubCH=ODT&Br=GTW&Loc=ENG_US&Sys=PTB&M=M-6752
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?

LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?

Ch=Retail&SubCH=ODT&Br=GTW&Loc=ENG_US&Sys=PTB&M=M-6752
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?

Ch=Retail&SubCH=ODT&Br=GTW&Loc=ENG_US&Sys=PTB&M=M-6752
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common

Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common

Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Gateway\traybar.exe"
O4 - HKLM\..\Run: [Spare Backup] "C:\Program Files\Spare Backup\SpareBackup.exe" /silent
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [cmdinfo] C:\ProgramData\cmdinfo\axknklsd.exe
O4 - HKCU\..\Run: [brastk] C:\Windows\system32\brastk.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL

SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12

\ONENOTEM.EXE
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01

\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky

Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12

\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3

\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) -

http://lads.myspace.com/upload/MySpaceUploader1006.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,C:\PROGRA~1\KASPER~1\KASPER~1.0

\r3hook.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky

Internet Security 7.0\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\Gateway Games\Gateway Game

Console\GameConsoleService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel

Matrix Storage Manager\Iaantmon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 7571 bytes

Thanks for any help

Katana · October 2008

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:
1. If you don't know, stop and ask! Don't keep going on.
2. Please reply to this thread. Do not start a new topic.
3. Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those three things, everything should go smoothly

Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe

Step 1

Malwarebytes' Anti-Malware

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to
- Update Malwarebytes' Anti-Malware
- and Launch Malwarebytes' Anti-Malware
then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply
- If you accidently close it, the log file is saved here and will be named like this:
- C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Step 2

If the previous step did not automatically reboot your machine, Please reboot now

Step 3

Download and Run RSIT

Please download Random's System Information Tool by random/random from here and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open:
- log.txt will be opened maximized.
- info.txt will be opened minimized.
Please post the contents of both log.txt and info.txt.

Step 4

Logs/Information to Post in Reply
Please post the following logs/Information in your reply

MalwareBytes Log
RSIT Logs
How are things running now ?

bernickb · October 2008

To many characters for one post so several on the way.

Logfile of random's system information tool 1.04 (written by random/random)
Run by Brian at 2008-10-15 09:43:49
MicrosoftÂ® Windows Vistaâ„¢ Home Premium Service Pack 1
System drive C: has 149 GB (66%) free of 227 GB
Total RAM: 3062 MB (59% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:44:04 AM, on 10/15/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Camera Assistant Software for Gateway\traybar.exe
C:\Program Files\Spare Backup\SpareBackup.exe
C:\Program Files\Napster\napster.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\sttray.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\BigFix\bigfix.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Camera Assistant Software for Gateway\CEC_MAIN.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Users\Brian\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5IAG0RDU\RSIT[1].exe
C:\Program Files\Trend Micro\HijackThis\Brian.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=ODT&Br=GTW&Loc=ENG_US&Sys=PTB&M=M-6752
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=ODT&Br=GTW&Loc=ENG_US&Sys=PTB&M=M-6752
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch=Retail&SubCH=ODT&Br=GTW&Loc=ENG_US&Sys=PTB&M=M-6752
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Gateway\traybar.exe"
O4 - HKLM\..\Run: [Spare Backup] "C:\Program Files\Spare Backup\SpareBackup.exe" /silent
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\Gateway Games\Gateway Game Console\GameConsoleService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 7511 bytes

======Scheduled tasks folder======

C:\Windows\tasks\User_Feed_Synchronization-{80ACA5B2-0F20-4696-B018-3B642BA49A7A}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 501400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
CBrowserHelperObject Object - c:\windows\system32\BAE.dll [2006-02-01 94208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [2007-02-12 174872]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-11-17 815104]
"Camera Assistant Software"=C:\Program Files\Camera Assistant Software for Gateway\traybar.exe [2007-09-13 638976]
"Spare Backup"=C:\Program Files\Spare Backup\SpareBackup.exe [2007-09-13 5252936]
"NapsterShell"=C:\Program Files\Napster\napster.exe [2006-09-06 323216]
"AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe [2007-06-28 218376]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-02-01 385024]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-02-19 267048]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2008-02-11 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2008-02-11 166424]
"Persistence"=C:\Windows\system32\igfxpers.exe [2008-02-11 133656]
"SigmatelSysTrayApp"=C:\Windows\sttray.exe [2007-07-27 405504]
"Malwarebytes Anti-Malware (reboot)"=C:\Program files\Malwarebytes' Anti-Malware\mbam.exe [2008-09-10 1253040]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"=C:\Windows\SMINST\launcher.exe [2007-07-13 40072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"=C:\Program Files\MSN Messenger\msnmsgr.exe [2007-01-19 5674352]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
BigFix.lnk - C:\Program Files\BigFix\bigfix.exe

C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2008-02-11 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\Windows\system32\klogon.dll [2007-06-28 206088]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2008-10-15 09:43:49 ----D---- C:\rsit
2008-10-15 09:26:35 ----D---- C:\Avenger
2008-10-15 09:26:33 ----A---- C:\avenger.txt
2008-10-15 07:29:05 ----D---- C:\Users\Brian\AppData\Roaming\Malwarebytes
2008-10-15 07:29:00 ----D---- C:\ProgramData\Malwarebytes
2008-10-15 07:29:00 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-14 16:02:07 ----D---- C:\Program Files\Trend Micro
2008-10-13 22:16:44 ----D---- C:\ProgramData\yrcbepwp
2008-10-13 22:16:38 ----D---- C:\ProgramData\cmdinfo
2008-09-21 10:08:46 ----A---- C:\Windows\system32\msshooks.dll
2008-09-21 10:08:46 ----A---- C:\Windows\system32\msscb.dll
2008-09-21 10:08:43 ----A---- C:\Windows\system32\SearchFilterHost.exe
2008-09-21 10:08:43 ----A---- C:\Windows\system32\propsys.dll
2008-09-21 10:08:43 ----A---- C:\Windows\system32\propdefs.dll
2008-09-21 10:08:43 ----A---- C:\Windows\system32\msstrc.dll
2008-09-21 10:08:43 ----A---- C:\Windows\system32\mssprxy.dll
2008-09-21 10:08:43 ----A---- C:\Windows\system32\mssitlb.dll
2008-09-21 10:08:43 ----A---- C:\Windows\system32\msshsq.dll
2008-09-21 10:08:42 ----A---- C:\Windows\system32\thawbrkr.dll
2008-09-21 10:08:42 ----A---- C:\Windows\system32\srchadmin.dll
2008-09-21 10:08:42 ----A---- C:\Windows\system32\korwbrkr.dll
2008-09-21 10:08:41 ----A---- C:\Windows\system32\xmlfilter.dll
2008-09-21 10:08:41 ----A---- C:\Windows\system32\wsepno.dll
2008-09-21 10:08:41 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2008-09-21 10:08:41 ----A---- C:\Windows\system32\SearchIndexer.exe
2008-09-21 10:08:41 ----A---- C:\Windows\system32\rtffilt.dll
2008-09-21 10:08:41 ----A---- C:\Windows\system32\offfilt.dll
2008-09-21 10:08:41 ----A---- C:\Windows\system32\nlhtml.dll
2008-09-21 10:08:41 ----A---- C:\Windows\system32\msscntrs.dll
2008-09-21 10:08:41 ----A---- C:\Windows\system32\mimefilt.dll
2008-09-21 10:08:41 ----A---- C:\Windows\system32\chtbrkr.dll
2008-09-21 10:08:41 ----A---- C:\Windows\system32\chsbrkr.dll
2008-09-21 10:08:40 ----A---- C:\Windows\system32\tquery.dll
2008-09-21 10:08:40 ----A---- C:\Windows\system32\mssvp.dll
2008-09-21 10:08:40 ----A---- C:\Windows\system32\mssrch.dll
2008-09-21 10:08:40 ----A---- C:\Windows\system32\mssphtb.dll
2008-09-21 10:08:40 ----A---- C:\Windows\system32\mssph.dll
2008-09-20 13:23:49 ----A---- C:\Windows\system32\rpcrt4.dll
2008-09-20 13:23:49 ----A---- C:\Windows\system32\ntkrnlpa.exe
2008-09-20 13:23:48 ----A---- C:\Windows\system32\pacerprf.dll
2008-09-20 13:23:48 ----A---- C:\Windows\system32\ntoskrnl.exe
2008-09-20 13:23:47 ----A---- C:\Windows\system32\emdmgmt.dll
2008-09-20 13:23:47 ----A---- C:\Windows\system32\dataclen.dll
2008-09-20 13:23:47 ----A---- C:\Windows\system32\cdd.dll
2008-09-20 13:23:46 ----A---- C:\Windows\system32\vbscript.dll
2008-09-20 13:23:46 ----A---- C:\Windows\system32\jscript.dll
2008-09-20 13:23:45 ----A---- C:\Windows\system32\wshext.dll
2008-09-20 13:23:45 ----A---- C:\Windows\system32\wscript.exe
2008-09-20 13:23:45 ----A---- C:\Windows\system32\scrrun.dll
2008-09-20 13:23:45 ----A---- C:\Windows\system32\scrobj.dll
2008-09-20 13:23:45 ----A---- C:\Windows\system32\cscript.exe
2008-09-20 08:22:23 ----D---- C:\PerfLogs
2008-09-19 16:41:42 ----A---- C:\Windows\system32\SLsvc.exe
2008-09-19 16:41:42 ----A---- C:\Windows\system32\onex.dll
2008-09-19 16:41:32 ----A---- C:\Windows\system32\PSHED.DLL
2008-09-19 16:41:31 ----A---- C:\Windows\system32\imagesp1.dll
2008-09-19 16:41:28 ----A---- C:\Windows\system32\dfsr.exe
2008-09-19 16:41:27 ----A---- C:\Windows\system32\sstpsvc.dll
2008-09-19 16:41:27 ----A---- C:\Windows\system32\pidgenx.dll
2008-09-19 16:41:26 ----A---- C:\Windows\system32\mstscax.dll
2008-09-19 16:41:25 ----A---- C:\Windows\system32\WsmSvc.dll
2008-09-19 16:41:25 ----A---- C:\Windows\system32\winrscmd.dll
2008-09-19 16:41:24 ----A---- C:\Windows\system32\vssapi.dll
2008-09-19 16:41:24 ----A---- C:\Windows\system32\sysmain.dll
2008-09-19 16:41:24 ----A---- C:\Windows\system32\RMActivate.exe
2008-09-19 16:41:23 ----A---- C:\Windows\system32\VSSVC.exe
2008-09-19 16:41:23 ----A---- C:\Windows\system32\PresentationNative_v0300.dll
2008-09-19 16:41:22 ----A---- C:\Windows\system32\secproc.dll
2008-09-19 16:41:22 ----A---- C:\Windows\system32\RMActivate_isv.exe
2008-09-19 16:41:22 ----A---- C:\Windows\system32\iesetup.dll
2008-09-19 16:41:20 ----A---- C:\Windows\system32\secproc_isv.dll
2008-09-19 16:41:18 ----A---- C:\Windows\system32\icardres.dll
2008-09-19 16:41:18 ----A---- C:\Windows\system32\icardagt.exe
2008-09-19 16:41:18 ----A---- C:\Windows\system32\drmv2clt.dll
2008-09-19 16:41:18 ----A---- C:\Windows\system32\blackbox.dll
2008-09-19 16:41:17 ----A---- C:\Windows\system32\xpssvcs.dll
2008-09-19 16:41:16 ----A---- C:\Windows\system32\RacEngn.dll
2008-09-19 16:41:15 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2008-09-19 16:41:15 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2008-09-19 16:41:15 ----A---- C:\Windows\system32\MSMPEG2VDEC.DLL
2008-09-19 16:41:14 ----A---- C:\Windows\system32\spwizimg.dll
2008-09-19 16:41:14 ----A---- C:\Windows\system32\rdpencom.dll
2008-09-19 16:41:14 ----A---- C:\Windows\system32\msxml3.dll
2008-09-19 16:41:14 ----A---- C:\Windows\system32\lpremove.exe
2008-09-19 16:41:14 ----A---- C:\Windows\bfsvc.exe
2008-09-19 16:41:13 ----A---- C:\Windows\system32\ntdll.dll
2008-09-19 16:41:13 ----A---- C:\Windows\system32\msxml6.dll
2008-09-19 16:41:13 ----A---- C:\Windows\system32\msjet40.dll
2008-09-19 16:41:13 ----A---- C:\Windows\system32\lsasrv.dll
2008-09-19 16:41:12 ----A---- C:\Windows\system32\qmgr.dll
2008-09-19 16:41:12 ----A---- C:\Windows\system32\localspl.dll
2008-09-19 16:41:11 ----A---- C:\Windows\system32\wevtsvc.dll
2008-09-19 16:41:11 ----A---- C:\Windows\system32\wcncsvc.dll
2008-09-19 16:41:11 ----A---- C:\Windows\system32\TsWpfWrp.exe
2008-09-19 16:41:11 ----A---- C:\Windows\system32\recdisc.exe
2008-09-19 16:41:11 ----A---- C:\Windows\system32\mscoree.dll
2008-09-19 16:41:11 ----A---- C:\Windows\system32\kernel32.dll
2008-09-19 16:41:11 ----A---- C:\Windows\system32\IKEEXT.DLL
2008-09-19 16:41:10 ----A---- C:\Windows\system32\CompMgmtLauncher.exe
2008-09-19 16:41:09 ----A---- C:\Windows\system32\wmp.dll
2008-09-19 16:41:09 ----A---- C:\Windows\system32\vds.exe
2008-09-19 16:41:08 ----A---- C:\Windows\system32\wcnwiz.dll
2008-09-19 16:41:08 ----A---- C:\Windows\system32\SMBHelperClass.dll
2008-09-19 16:41:08 ----A---- C:\Windows\system32\mstsc.exe
2008-09-19 16:41:07 ----A---- C:\Windows\system32\msvbvm60.dll
2008-09-19 16:41:07 ----A---- C:\Windows\system32\mf.dll
2008-09-19 16:41:06 ----A---- C:\Windows\system32\termsrv.dll
2008-09-19 16:41:06 ----A---- C:\Windows\system32\msdtctm.dll
2008-09-19 16:41:06 ----A---- C:\Windows\system32\kerberos.dll
2008-09-19 16:41:06 ----A---- C:\Windows\system32\IMJP10K.DLL
2008-09-19 16:41:06 ----A---- C:\Windows\system32\advapi32.dll
2008-09-19 16:41:05 ----A---- C:\Windows\system32\mmcndmgr.dll
2008-09-19 16:41:05 ----A---- C:\Windows\system32\CertEnroll.dll
2008-09-19 16:41:04 ----A---- C:\Windows\system32\xolehlp.dll
2008-09-19 16:41:04 ----A---- C:\Windows\system32\Query.dll
2008-09-19 16:41:04 ----A---- C:\Windows\system32\MSMPEG2ADEC.DLL
2008-09-19 16:41:04 ----A---- C:\Windows\system32\msdtcprx.dll
2008-09-19 16:41:04 ----A---- C:\Windows\system32\MPSSVC.dll
2008-09-19 16:41:03 ----A---- C:\Windows\system32\WindowsAnytimeUpgradeCPL.dll
2008-09-19 16:41:03 ----A---- C:\Windows\system32\ole32.dll
2008-09-19 16:41:02 ----A---- C:\Windows\system32\SSShim.dll
2008-09-19 16:41:02 ----A---- C:\Windows\system32\netlogon.dll
2008-09-19 16:41:02 ----A---- C:\Windows\system32\msvcrt.dll
2008-09-19 16:41:02 ----A---- C:\Windows\system32\mcupdate_GenuineIntel.dll
2008-09-19 16:41:01 ----A---- C:\Windows\system32\shlwapi.dll
2008-09-19 16:41:01 ----A---- C:\Windows\system32\schedsvc.dll
2008-09-19 16:41:01 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe
2008-09-19 16:41:01 ----A---- C:\Windows\system32\nlmgp.dll
2008-09-19 16:41:01 ----A---- C:\Windows\system32\IasMigPlugin.dll
2008-09-19 16:41:01 ----A---- C:\Windows\system32\DfsShlEx.dll
2008-09-19 16:41:00 ----A---- C:\Windows\system32\wer.dll
2008-09-19 16:41:00 ----A---- C:\Windows\system32\user32.dll
2008-09-19 16:41:00 ----A---- C:\Windows\system32\sdclt.exe
2008-09-19 16:41:00 ----A---- C:\Windows\system32\milcore.dll
2008-09-19 16:41:00 ----A---- C:\Windows\system32\clusapi.dll
2008-09-19 16:40:59 ----A---- C:\Windows\system32\WSDApi.dll
2008-09-19 16:40:59 ----A---- C:\Windows\system32\vdsdyn.dll
2008-09-19 16:40:59 ----A---- C:\Windows\system32\QAGENTRT.DLL
2008-09-19 16:40:59 ----A---- C:\Windows\system32\diagperf.dll
2008-09-19 16:40:59 ----A---- C:\Windows\system32\d3d9.dll
2008-09-19 16:40:58 ----A---- C:\Windows\system32\winrsmgr.dll
2008-09-19 16:40:58 ----A---- C:\Windows\system32\SLC.dll
2008-09-19 16:40:58 ----A---- C:\Windows\system32\mtxclu.dll
2008-09-19 16:40:58 ----A---- C:\Windows\system32\mmc.exe
2008-09-19 16:40:57 ----A---- C:\Windows\system32\vdsbas.dll
2008-09-19 16:40:57 ----A---- C:\Windows\system32\swprv.dll
2008-09-19 16:40:57 ----A---- C:\Windows\system32\msi.dll
2008-09-19 16:40:57 ----A---- C:\Windows\system32\comctl32.dll
2008-09-19 16:40:56 ----A---- C:\Windows\system32\MSVidCtl.dll
2008-09-19 16:40:56 ----A---- C:\Windows\system32\msdtckrm.dll
2008-09-19 16:40:56 ----A---- C:\Windows\system32\gpsvc.dll
2008-09-19 16:40:55 ----A---- C:\Windows\system32\XPSSHHDR.dll
2008-09-19 16:40:55 ----A---- C:\Windows\system32\sbe.dll
2008-09-19 16:40:55 ----A---- C:\Windows\system32\samsrv.dll
2008-09-19 16:40:55 ----A---- C:\Windows\system32\mfc42u.dll
2008-09-19 16:40:55 ----A---- C:\Windows\system32\FWPUCLNT.DLL
2008-09-19 16:40:55 ----A---- C:\Windows\system32\esent.dll
2008-09-19 16:40:54 ----A---- C:\Windows\system32\wecutil.exe
2008-09-19 16:40:54 ----A---- C:\Windows\system32\usp10.dll
2008-09-19 16:40:54 ----A---- C:\Windows\system32\sdengin2.dll
2008-09-19 16:40:54 ----A---- C:\Windows\system32\mfc42.dll
2008-09-19 16:40:54 ----A---- C:\Windows\system32\gacinstall.dll
2008-09-19 16:40:54 ----A---- C:\Windows\system32\cmipnpinstall.dll
2008-09-19 16:40:54 ----A---- C:\Windows\system32\cmicryptinstall.dll
2008-09-19 16:40:53 ----A---- C:\Windows\system32\WSManMigrationPlugin.dll
2008-09-19 16:40:53 ----A---- C:\Windows\system32\mswsock.dll
2008-09-19 16:40:53 ----A---- C:\Windows\system32\crypt32.dll
2008-09-19 16:40:53 ----A---- C:\Windows\system32\comsvcs.dll
2008-09-19 16:40:53 ----A---- C:\Windows\system32\certutil.exe
2008-09-19 16:40:52 ----A---- C:\Windows\system32\wmdrmsdk.dll
2008-09-19 16:40:52 ----A---- C:\Windows\system32\sqlceqp30.dll
2008-09-19 16:40:52 ----A---- C:\Windows\system32\setupapi.dll
2008-09-19 16:40:52 ----A---- C:\Windows\system32\oleaut32.dll
2008-09-19 16:40:52 ----A---- C:\Windows\system32\FirewallAPI.dll
2008-09-19 16:40:52 ----A---- C:\Windows\explorer.exe
2008-09-19 16:40:51 ----A---- C:\Windows\system32\wecsvc.dll
2008-09-19 16:40:51 ----A---- C:\Windows\system32\sdohlp.dll
2008-09-19 16:40:51 ----A---- C:\Windows\system32\schannel.dll
2008-09-19 16:40:51 ----A---- C:\Windows\system32\msv1_0.dll
2008-09-19 16:40:51 ----A---- C:\Windows\system32\lsm.exe
2008-09-19 16:40:51 ----A---- C:\Windows\system32\iphlpsvc.dll
2008-09-19 16:40:51 ----A---- C:\Windows\system32\bcrypt.dll
2008-09-19 16:40:51 ----A---- C:\Windows\system32\AuxiliaryDisplayDriverLib.dll
2008-09-19 16:40:50 ----A---- C:\Windows\system32\wmpmde.dll
2008-09-19 16:40:50 ----A---- C:\Windows\system32\thumbcache.dll
2008-09-19 16:40:50 ----A---- C:\Windows\system32\p2psvc.dll
2008-09-19 16:40:50 ----A---- C:\Windows\system32\netapi32.dll
2008-09-19 16:40:50 ----A---- C:\Windows\system32\mcmde.dll
2008-09-19 16:40:50 ----A---- C:\Windows\system32\eapp3hst.dll
2008-09-19 16:40:49 ----A---- C:\Windows\system32\WinSAT.exe
2008-09-19 16:40:49 ----A---- C:\Windows\system32\vdsutil.dll
2008-09-19 16:40:49 ----A---- C:\Windows\system32\riched20.dll
2008-09-19 16:40:49 ----A---- C:\Windows\system32\imapi2fs.dll
2008-09-19 16:40:49 ----A---- C:\Windows\system32\d3d10_1.dll
2008-09-19 16:40:49 ----A---- C:\Windows\system32\autofmt.exe
2008-09-19 16:40:49 ----A---- C:\Windows\system32\autoconv.exe
2008-09-19 16:40:49 ----A---- C:\Windows\system32\autochk.exe
2008-09-19 16:40:49 ----A---- C:\Windows\system32\authfwcfg.dll
2008-09-19 16:40:48 ----A---- C:\Windows\system32\wevtapi.dll
2008-09-19 16:40:48 ----A---- C:\Windows\system32\dmvdsitf.dll
2008-09-19 16:40:48 ----A---- C:\Windows\system32\d3d10_1core.dll
2008-09-19 16:40:48 ----A---- C:\Windows\system32\comuid.dll
2008-09-19 16:40:48 ----A---- C:\Windows\system32\comdlg32.dll
2008-09-19 16:40:48 ----A---- C:\Windows\system32\browseui.dll
2008-09-19 16:40:48 ----A---- C:\Windows\system32\authui.dll
2008-09-19 16:40:47 ----A---- C:\Windows\system32\WSDMon.dll
2008-09-19 16:40:47 ----A---- C:\Windows\system32\wevtfwd.dll
2008-09-19 16:40:47 ----A---- C:\Windows\system32\mscories.dll
2008-09-19 16:40:47 ----A---- C:\Windows\system32\eapphost.dll
2008-09-19 16:40:46 ----A---- C:\Windows\system32\untfs.dll
2008-09-19 16:40:46 ----A---- C:\Windows\system32\uexfat.dll
2008-09-19 16:40:46 ----A---- C:\Windows\system32\sqlcese30.dll
2008-09-19 16:40:46 ----A---- C:\Windows\system32\rasmans.dll
2008-09-19 16:40:46 ----A---- C:\Windows\system32\iassam.dll
2008-09-19 16:40:46 ----A---- C:\Windows\system32\eappcfg.dll
2008-09-19 16:40:46 ----A---- C:\Windows\system32\DfrgNtfs.exe
2008-09-19 16:40:45 ----A---- C:\Windows\system32\wlansvc.dll
2008-09-19 16:40:45 ----A---- C:\Windows\system32\whealogr.dll
2008-09-19 16:40:45 ----A---- C:\Windows\system32\pcaui.dll
2008-09-19 16:40:44 ----A---- C:\Windows\system32\dot3svc.dll
2008-09-19 16:40:43 ----A---- C:\Windows\system32\rdpwsx.dll
2008-09-19 16:40:43 ----A---- C:\Windows\system32\mssha.dll
2008-09-19 16:40:42 ----A---- C:\Windows\system32\zipfldr.dll
2008-09-19 16:40:42 ----A---- C:\Windows\system32\WsmAuto.dll
2008-09-19 16:40:42 ----A---- C:\Windows\system32\winhttp.dll
2008-09-19 16:40:42 ----A---- C:\Windows\system32\nlasvc.dll
2008-09-19 16:40:42 ----A---- C:\Windows\system32\msdrm.dll
2008-09-19 16:40:42 ----A---- C:\Windows\system32\evr.dll
2008-09-19 16:40:42 ----A---- C:\Windows\system32\dfrgui.exe
2008-09-19 16:40:41 ----A---- C:\Windows\system32\rpcss.dll
2008-09-19 16:40:41 ----A---- C:\Windows\system32\rasppp.dll
2008-09-19 16:40:41 ----A---- C:\Windows\system32\ncrypt.dll
2008-09-19 16:40:41 ----A---- C:\Windows\system32\msrepl40.dll
2008-09-19 16:40:41 ----A---- C:\Windows\system32\BFE.DLL
2008-09-19 16:40:41 ----A---- C:\Windows\system32\audiosrv.dll
2008-09-19 16:40:40 ----A---- C:\Windows\system32\WsmWmiPl.dll
2008-09-19 16:40:40 ----A---- C:\Windows\system32\WMVCORE.DLL
2008-09-19 16:40:40 ----A---- C:\Windows\system32\wmdrmdev.dll
2008-09-19 16:40:40 ----A---- C:\Windows\system32\win32spl.dll
2008-09-19 16:40:40 ----A---- C:\Windows\system32\WebClnt.dll
2008-09-19 16:40:40 ----A---- C:\Windows\system32\themecpl.dll
2008-09-19 16:40:40 ----A---- C:\Windows\system32\rastls.dll
2008-09-19 16:40:40 ----A---- C:\Windows\system32\printui.dll
2008-09-19 16:40:40 ----A---- C:\Windows\system32\objsel.dll
2008-09-19 16:40:40 ----A---- C:\Windows\system32\dhcpcsvc6.dll
2008-09-19 16:40:40 ----A---- C:\Windows\system32\ddraw.dll
2008-09-19 16:40:39 ----A---- C:\Windows\system32\w32time.dll
2008-09-19 16:40:39 ----A---- C:\Windows\system32\sqlsrv32.dll
2008-09-19 16:40:39 ----A---- C:\Windows\system32\QAGENT.DLL
2008-09-19 16:40:39 ----A---- C:\Windows\system32\iasnap.dll
2008-09-19 16:40:39 ----A---- C:\Windows\system32\dbghelp.dll
2008-09-19 16:40:38 ----A---- C:\Windows\system32\wmdrmnet.dll
2008-09-19 16:40:38 ----A---- C:\Windows\system32\WerFaultSecure.exe
2008-09-19 16:40:38 ----A---- C:\Windows\system32\PresentationHost.exe
2008-09-19 16:40:38 ----A---- C:\Windows\system32\ncryptui.dll
2008-09-19 16:40:38 ----A---- C:\Windows\system32\iprtrmgr.dll
2008-09-19 16:40:38 ----A---- C:\Windows\system32\icm32.dll
2008-09-19 16:40:38 ----A---- C:\Windows\system32\azroles.dll
2008-09-19 16:40:37 ----A---- C:\Windows\system32\winsrv.dll
2008-09-19 16:40:37 ----A---- C:\Windows\system32\taskschd.dll
2008-09-19 16:40:37 ----A---- C:\Windows\system32\spoolss.dll
2008-09-19 16:40:37 ----A---- C:\Windows\system32\msctf.dll
2008-09-19 16:40:37 ----A---- C:\Windows\system32\infocardapi.dll
2008-09-19 16:40:37 ----A---- C:\Windows\system32\bcdedit.exe
2008-09-19 16:40:37 ----A---- C:\Windows\system32\basecsp.dll
2008-09-19 16:40:36 ----A---- C:\Windows\system32\wlangpui.dll
2008-09-19 16:40:36 ----A---- C:\Windows\system32\scksp.dll
2008-09-19 16:40:36 ----A---- C:\Windows\system32\mstlsapi.dll
2008-09-19 16:40:36 ----A---- C:\Windows\system32\AudioEng.dll
2008-09-19 16:40:32 ----A---- C:\Windows\system32\netprofm.dll
2008-09-19 16:40:31 ----A---- C:\Windows\system32\winsta.dll
2008-09-19 16:40:31 ----A---- C:\Windows\system32\rsaenh.dll
2008-09-19 16:40:31 ----A---- C:\Windows\system32\netcfgx.dll
2008-09-19 16:40:31 ----A---- C:\Windows\system32\hcrstco.dll
2008-09-19 16:40:31 ----A---- C:\Windows\system32\dbgeng.dll
2008-09-19 16:40:30 ----A---- C:\Windows\system32\winlogon.exe
2008-09-19 16:40:30 ----A---- C:\Windows\system32\wercon.exe
2008-09-19 16:40:30 ----A---- C:\Windows\system32\taskcomp.dll
2008-09-19 16:40:30 ----A---- C:\Windows\system32\sqmapi.dll
2008-09-19 16:40:30 ----A---- C:\Windows\system32\lpksetup.exe
2008-09-19 16:40:30 ----A---- C:\Windows\system32\dfshim.dll
2008-09-19 16:40:30 ----A---- C:\Windows\system32\cdosys.dll
2008-09-19 16:40:29 ----A---- C:\Windows\system32\wlansec.dll
2008-09-19 16:40:29 ----A---- C:\Windows\system32\msdtcuiu.dll
2008-09-19 16:40:29 ----A---- C:\Windows\system32\mprddm.dll
2008-09-19 16:40:29 ----A---- C:\Windows\system32\certcli.dll
2008-09-19 16:40:29 ----A---- C:\Windows\system32\apds.dll
2008-09-19 16:40:28 ----A---- C:\Windows\system32\tsgqec.dll
2008-09-19 16:40:28 ----A---- C:\Windows\system32\shdocvw.dll
2008-09-19 16:40:28 ----A---- C:\Windows\system32\iasrad.dll
2008-09-19 16:40:28 ----A---- C:\Windows\system32\eapsvc.dll
2008-09-19 16:40:28 ----A---- C:\Windows\system32\certmgr.dll
2008-09-19 16:40:28 ----A---- C:\Windows\system32\bcdsrv.dll
2008-09-19 16:40:28 ----A---- C:\Windows\system32\AUDIOKSE.dll
2008-09-19 16:40:28 ----A---- C:\Windows\system32\aaclient.dll
2008-09-19 16:40:27 ----A---- C:\Windows\system32\Wldap32.dll
2008-09-19 16:40:27 ----A---- C:\Windows\system32\uDWM.dll
2008-09-19 16:40:27 ----A---- C:\Windows\system32\msidcrl30.dll
2008-09-19 16:40:27 ----A---- C:\Windows\system32\dnsapi.dll
2008-09-19 16:40:26 ----A---- C:\Windows\system32\WMVDECOD.DLL
2008-09-19 16:40:26 ----A---- C:\Windows\system32\umpnpmgr.dll
2008-09-19 16:40:26 ----A---- C:\Windows\system32\pla.dll
2008-09-19 16:40:26 ----A---- C:\Windows\system32\dxgi.dll
2008-09-19 16:40:25 ----A---- C:\Windows\system32\wmicmiplugin.dll
2008-09-19 16:40:25 ----A---- C:\Windows\system32\netshell.dll
2008-09-19 16:40:25 ----A---- C:\Windows\system32\dot3gpui.dll
2008-09-19 16:40:24 ----A---- C:\Windows\system32\shsvcs.dll
2008-09-19 16:40:24 ----A---- C:\Windows\system32\ntprint.dll
2008-09-19 16:40:24 ----A---- C:\Windows\system32\MMDevAPI.dll
2008-09-19 16:40:24 ----A---- C:\Windows\system32\cryptnet.dll
2008-09-19 16:40:24 ----A---- C:\Windows\system32\comsnap.dll
2008-09-19 16:40:23 ----A---- C:\Windows\system32\wscsvc.dll
2008-09-19 16:40:23 ----A---- C:\Windows\system32\wscisvif.dll
2008-09-19 16:40:23 ----A---- C:\Windows\system32\winmm.dll
2008-09-19 16:40:23 ----A---- C:\Windows\system32\synceng.dll
2008-09-19 16:40:23 ----A---- C:\Windows\system32\services.exe
2008-09-19 16:40:23 ----A---- C:\Windows\system32\pnidui.dll
2008-09-19 16:40:23 ----A---- C:\Windows\system32\cmifw.dll
2008-09-19 16:40:22 ----A---- C:\Windows\system32\WMVSDECD.DLL
2008-09-19 16:40:22 ----A---- C:\Windows\system32\taskeng.exe
2008-09-19 16:40:22 ----A---- C:\Windows\system32\msjtes40.dll
2008-09-19 16:40:22 ----A---- C:\Windows\system32\msconfig.exe
2008-09-19 16:40:22 ----A---- C:\Windows\system32\iassdo.dll
2008-09-19 16:40:22 ----A---- C:\Windows\system32\cipher.exe
2008-09-19 16:40:21 ----A---- C:\Windows\system32\wersvc.dll
2008-09-19 16:40:21 ----A---- C:\Windows\system32\uxtheme.dll
2008-09-19 16:40:21 ----A---- C:\Windows\system32\tdh.dll
2008-09-19 16:40:21 ----A---- C:\Windows\system32\SessEnv.dll
2008-09-19 16:40:21 ----A---- C:\Windows\system32\rasapi32.dll
2008-09-19 16:40:21 ----A---- C:\Windows\system32\imapi2.dll
2008-09-19 16:40:21 ----A---- C:\Windows\system32\dot3api.dll
2008-09-19 16:40:21 ----A---- C:\Windows\system32\dmdskmgr.dll
2008-09-19 16:40:20 ----A---- C:\Windows\system32\qdvd.dll
2008-09-19 16:40:20 ----A---- C:\Windows\system32\msscp.dll
2008-09-19 16:40:20 ----A---- C:\Windows\system32\cmd.exe
2008-09-19 16:40:20 ----A---- C:\Windows\system32\cbsra.exe
2008-09-19 16:40:20 ----A---- C:\Windows\system32\AuthFWSnapin.dll
2008-09-19 16:40:19 ----A---- C:\Windows\system32\WUDFx.dll
2008-09-19 16:40:19 ----A---- C:\Windows\system32\wlanmsm.dll
2008-09-19 16:40:19 ----A---- C:\Windows\system32\wlancfg.dll
2008-09-19 16:40:19 ----A---- C:\Windows\system32\wkssvc.dll
2008-09-19 16:40:19 ----A---- C:\Windows\system32\wevtutil.exe
2008-09-19 16:40:19 ----A---- C:\Windows\system32\srvsvc.dll
2008-09-19 16:40:19 ----A---- C:\Windows\system32\mshtmled.dll
2008-09-19 16:40:19 ----A---- C:\Windows\system32\msdtcVSp1res.dll
2008-09-19 16:40:19 ----A---- C:\Windows\system32\loadperf.dll
2008-09-19 16:40:19 ----A---- C:\Windows\system32\diskpart.exe
2008-09-19 16:40:19 ----A---- C:\Windows\system32\comres.dll
2008-09-19 16:40:18 ----A---- C:\Windows\system32\wlanapi.dll
2008-09-19 16:40:18 ----A---- C:\Windows\system32\rpchttp.dll
2008-09-19 16:40:18 ----A---- C:\Windows\system32\rdpdd.dll
2008-09-19 16:40:18 ----A---- C:\Windows\system32\localsec.dll
2008-09-19 16:40:18 ----A---- C:\Windows\system32\hnetcfg.dll
2008-09-19 16:40:18 ----A---- C:\Windows\system32\fontext.dll
2008-09-19 16:40:17 ----A---- C:\Windows\system32\wsqmcons.exe
2008-09-19 16:40:17 ----A---- C:\Windows\system32\WMADMOD.DLL
2008-09-19 16:40:17 ----A---- C:\Windows\system32\wlanpref.dll
2008-09-19 16:40:17 ----A---- C:\Windows\system32\WinSATAPI.dll
2008-09-19 16:40:17 ----A---- C:\Windows\system32\RDPENCDD.dll
2008-09-19 16:40:17 ----A---- C:\Windows\system32\profprov.dll
2008-09-19 16:40:17 ----A---- C:\Windows\system32\NAPMONTR.DLL
2008-09-19 16:40:17 ----A---- C:\Windows\system32\filemgmt.dll
2008-09-19 16:40:17 ----A---- C:\Windows\system32\dsound.dll
2008-09-19 16:40:17 ----A---- C:\Windows\system32\avifil32.dll
2008-09-19 16:40:16 ----A---- C:\Windows\system32\wsecedit.dll
2008-09-19 16:40:16 ----A---- C:\Windows\system32\WindowsCodecs.dll
2008-09-19 16:40:16 ----A---- C:\Windows\system32\tracerpt.exe
2008-09-19 16:40:16 ----A---- C:\Windows\system32\SLCommDlg.dll
2008-09-19 16:40:16 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2008-09-19 16:40:16 ----A---- C:\Windows\system32\MuiUnattend.exe
2008-09-19 16:40:16 ----A---- C:\Windows\system32\dnsrslvr.dll
2008-09-19 16:40:16 ----A---- C:\Windows\system32\dhcpcsvc.dll
2008-09-19 16:40:15 ----A---- C:\Windows\system32\WMSPDMOD.DLL
2008-09-19 16:40:15 ----A---- C:\Windows\system32\wininit.exe
2008-09-19 16:40:15 ----A---- C:\Windows\system32\SmartcardCredentialProvider.dll
2008-09-19 16:40:15 ----A---- C:\Windows\system32\QSHVHOST.DLL
2008-09-19 16:40:15 ----A---- C:\Windows\system32\P2PGraph.dll
2008-09-19 16:40:15 ----A---- C:\Windows\system32\iassvcs.dll
2008-09-19 16:40:15 ----A---- C:\Windows\system32\gpresult.exe
2008-09-19 16:40:15 ----A---- C:\Windows\system32\dwmredir.dll
2008-09-19 16:40:15 ----A---- C:\Windows\system32\dwm.exe
2008-09-19 16:40:15 ----A---- C:\Windows\system32\AuxiliaryDisplayCpl.dll
2008-09-19 16:40:15 ----A---- C:\Windows\system32\apphelp.dll
2008-09-19 16:40:14 ----A---- C:\Windows\system32\spp.dll
2008-09-19 16:40:14 ----A---- C:\Windows\system32\rasdlg.dll
2008-09-19 16:40:14 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2008-09-19 16:40:14 ----A---- C:\Windows\system32\mscorier.dll
2008-09-19 16:40:14 ----A---- C:\Windows\system32\mcbuilder.exe
2008-09-19 16:40:14 ----A---- C:\Windows\system32\iashost.exe
2008-09-19 16:40:14 ----A---- C:\Windows\system32\azroleui.dll
2008-09-19 16:40:14 ----A---- C:\Windows\HelpPane.exe
2008-09-19 16:40:13 ----A---- C:\Windows\system32\wecapi.dll
2008-09-19 16:40:13 ----A---- C:\Windows\system32\unbcl.dll
2008-09-19 16:40:13 ----A---- C:\Windows\system32\tcpmon.dll
2008-09-19 16:40:13 ----A---- C:\Windows\system32\srrstr.dll
2008-09-19 16:40:13 ----A---- C:\Windows\system32\spwizeng.dll
2008-09-19 16:40:13 ----A---- C:\Windows\system32\SLUI.exe
2008-09-19 16:40:13 ----A---- C:\Windows\system32\rasmontr.dll
2008-09-19 16:40:13 ----A---- C:\Windows\system32\msra.exe
2008-09-19 16:40:13 ----A---- C:\Windows\system32\lltdsvc.dll
2008-09-19 16:40:12 ----A---- C:\Windows\system32\WMPEncEn.dll
2008-09-19 16:40:12 ----A---- C:\Windows\system32\shrink.dll
2008-09-19 16:40:12 ----A---- C:\Windows\system32\oleacc.dll
2008-09-19 16:40:12 ----A---- C:\Windows\system32\msdri.dll
2008-09-19 16:40:12 ----A---- C:\Windows\system32\IPHLPAPI.DLL
2008-09-19 16:40:12 ----A---- C:\Windows\system32\iashlpr.dll
2008-09-19 16:40:12 ----A---- C:\Windows\system32\gpedit.dll
2008-09-19 16:40:12 ----A---- C:\Windows\system32\brcpl.dll
2008-09-19 16:40:11 ----A---- C:\Windows\system32\raschap.dll
2008-09-19 16:40:11 ----A---- C:\Windows\system32\iertutil.dll
2008-09-19 16:40:11 ----A---- C:\Windows\system32\framedynos.dll
2008-09-19 16:40:10 ----A---- C:\Windows\system32\vsstrace.dll
2008-09-19 16:40:10 ----A---- C:\Windows\system32\regsvc.dll
2008-09-19 16:40:10 ----A---- C:\Windows\system32\PerfCenterCPL.dll
2008-09-19 16:40:10 ----A---- C:\Windows\system32\ntvdm.exe
2008-09-19 16:40:10 ----A---- C:\Windows\system32\ipsmsnap.dll
2008-09-19 16:40:10 ----A---- C:\Windows\system32\fdWSD.dll
2008-09-19 16:40:10 ----A---- C:\Windows\system32\Faultrep.dll
2008-09-19 16:40:10 ----A---- C:\Windows\system32\advpack.dll
2008-09-19 16:40:09 ----A---- C:\Windows\system32\wpdshext.dll
2008-09-19 16:40:09 ----A---- C:\Windows\system32\wdc.dll
2008-09-19 16:40:09 ----A---- C:\Windows\system32\Storprop.dll
2008-09-19 16:40:09 ----A---- C:\Windows\system32\ntlanman.dll
2008-09-19 16:40:09 ----A---- C:\Windows\system32\NetProjW.dll
2008-09-19 16:40:09 ----A---- C:\Windows\system32\netman.dll
2008-09-19 16:40:09 ----A---- C:\Windows\system32\l2nacp.dll
2008-09-19 16:40:09 ----A---- C:\Windows\system32\iedkcs32.dll
2008-09-19 16:40:08 ----A---- C:\Windows\system32\WlanMM.dll
2008-09-19 16:40:08 ----A---- C:\Windows\system32\tcpipcfg.dll
2008-09-19 16:40:08 ----A---- C:\Windows\system32\profsvc.dll
2008-09-19 16:40:08 ----A---- C:\Windows\system32\KMSVC.DLL
2008-09-19 16:40:08 ----A---- C:\Windows\system32\ieapfltr.dll
2008-09-19 16:40:08 ----A---- C:\Windows\system32\framedyn.dll
2008-09-19 16:40:08 ----A---- C:\Windows\system32\dssenh.dll
2008-09-19 16:40:08 ----A---- C:\Windows\system32\certreq.exe
2008-09-19 16:40:08 ----A---- C:\Windows\system32\adsnt.dll
2008-09-19 16:40:07 ----A---- C:\Windows\system32\WsmProv.dll
2008-09-19 16:40:07 ----A---- C:\Windows\system32\wlanhlp.dll
2008-09-19 16:40:07 ----A---- C:\Windows\system32\WLanConn.dll
2008-09-19 16:40:07 ----A---- C:\Windows\system32\sxs.dll
2008-09-19 16:40:07 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2008-09-19 16:40:07 ----A---- C:\Windows\system32\IPBusEnum.dll
2008-09-19 16:40:06 ----A---- C:\Windows\system32\wusa.exe
2008-09-19 16:40:06 ----A---- C:\Windows\system32\WUDFHost.exe
2008-09-19 16:40:06 ----A---- C:\Windows\system32\WerFault.exe
2008-09-19 16:40:06 ----A---- C:\Windows\system32\VAN.dll
2008-09-19 16:40:06 ----A---- C:\Windows\system32\userenv.dll
2008-09-19 16:40:06 ----A---- C:\Windows\system32\umb.dll
2008-09-19 16:40:06 ----A---- C:\Windows\system32\ncsi.dll
2008-09-19 16:40:06 ----A---- C:\Windows\system32\ie4uinit.exe
2008-09-19 16:40:06 ----A---- C:\Windows\system32\fundisc.dll
2008-09-19 16:40:06 ----A---- C:\Windows\system32\catsrvut.dll
2008-09-19 16:40:05 ----A---- C:\Windows\system32\puiobj.dll
2008-09-19 16:40:05 ----A---- C:\Windows\system32\photowiz.dll
2008-09-19 16:40:05 ----A---- C:\Windows\system32\netid.dll
2008-09-19 16:40:05 ----A---- C:\Windows\system32\MdSched.exe
2008-09-19 16:40:05 ----A---- C:\Windows\system32\InkEd.dll
2008-09-19 16:40:05 ----A---- C:\Windows\system32\dps.dll
2008-09-19 16:40:05 ----A---- C:\Windows\system32\cryptui.dll
2008-09-19 16:40:04 ----A---- C:\Windows\system32\netcenter.dll
2008-09-19 16:40:04 ----A---- C:\Windows\system32\ipsecsnp.dll
2008-09-19 16:40:03 ----A---- C:\Windows\system32\ws2_32.dll
2008-09-19 16:40:03 ----A---- C:\Windows\system32\WinSCard.dll
2008-09-19 16:40:03 ----A---- C:\Windows\system32\winrs.exe
2008-09-19 16:40:03 ----A---- C:\Windows\system32\spbcd.dll
2008-09-19 16:40:03 ----A---- C:\Windows\system32\secur32.dll
2008-09-19 16:40:03 ----A---- C:\Windows\system32\prnntfy.dll
2008-09-19 16:40:03 ----A---- C:\Windows\system32\odbcjt32.dll
2008-09-19 16:40:03 ----A---- C:\Windows\system32\ntdsapi.dll
2008-09-19 16:40:03 ----A---- C:\Windows\system32\NAPSTAT.EXE
2008-09-19 16:40:03 ----A---- C:\Windows\system32\msinfo32.exe
2008-09-19 16:40:02 ----A---- C:\Windows\system32\schtasks.exe
2008-09-19 16:40:02 ----A---- C:\Windows\system32\RelMon.dll
2008-09-19 16:40:02 ----A---- C:\Windows\system32\msfeeds.dll
2008-09-19 16:40:02 ----A---- C:\Windows\system32\mblctr.exe
2008-09-19 16:40:02 ----A---- C:\Windows\system32\iasacct.dll
2008-09-19 16:40:02 ----A---- C:\Windows\system32\cryptsvc.dll
2008-09-19 16:40:01 ----A---- C:\Windows\system32\TSpkg.dll
2008-09-19 16:40:01 ----A---- C:\Windows\system32\pdh.dll
2008-09-19 16:40:01 ----A---- C:\Windows\system32\netdiagfx.dll
2008-09-19 16:40:01 ----A---- C:\Windows\system32\FirewallControlPanel.exe
2008-09-19 16:40:01 ----A---- C:\Windows\system32\dmdlgs.dll
2008-09-19 16:40:01 ----A---- C:\Windows\system32\dhcpsapi.dll
2008-09-19 16:40:01 ----A---- C:\Windows\system32\dfrgfat.exe
2008-09-19 16:40:01 ----A---- C:\Windows\system32\catsrv.dll
2008-09-19 16:40:01 ----A---- C:\Windows\system32\activeds.dll
2008-09-19 16:40:00 ----A---- C:\Windows\system32\wvc.dll
2008-09-19 16:40:00 ----A---- C:\Windows\system32\winrm.vbs
2008-09-19 16:40:00 ----A---- C:\Windows\system32\rastapi.dll
2008-09-19 16:40:00 ----A---- C:\Windows\system32\qwave.dll
2008-09-19 16:40:00 ----A---- C:\Windows\system32\netcorehc.dll
2008-09-19 16:40:00 ----A---- C:\Windows\system32\NAPHLPR.DLL
2008-09-19 16:40:00 ----A---- C:\Windows\system32\MSMPEG2ENC.DLL
2008-09-19 16:40:00 ----A---- C:\Windows\system32\msacm32.dll
2008-09-19 16:40:00 ----A---- C:\Windows\system32\ifmon.dll
2008-09-19 16:40:00 ----A---- C:\Windows\system32\fdWCN.dll
2008-09-19 16:40:00 ----A---- C:\Windows\system32\dot3msm.dll
2008-09-19 16:40:00 ----A---- C:\Windows\system32\dot3cfg.dll
2008-09-19 16:40:00 ----A---- C:\Windows\system32\AudioSes.dll
2008-09-19 16:39:59 ----A---- C:\Windows\system32\wow32.dll
2008-09-19 16:39:59 ----A---- C:\Windows\system32\shsetup.dll
2008-09-19 16:39:59 ----A---- C:\Windows\system32\ntshrui.dll
2008-09-19 16:39:59 ----A---- C:\Windows\system32\els.dll
2008-09-19 16:39:59 ----A---- C:\Windows\system32\adsldp.dll
2008-09-19 16:39:58 ----A---- C:\Windows\system32\wscntfy.dll
2008-09-19 16:39:58 ----A---- C:\Windows\system32\WMNetMgr.dll
2008-09-19 16:39:58 ----A---- C:\Windows\system32\stobject.dll
2008-09-19 16:39:58 ----A---- C:\Windows\system32\sdrsvc.dll
2008-09-19 16:39:58 ----A---- C:\Windows\system32\QUTIL.DLL
2008-09-19 16:39:58 ----A---- C:\Windows\system32\net1.exe
2008-09-19 16:39:58 ----A---- C:\Windows\system32\msdt.dll
2008-09-19 16:39:58 ----A---- C:\Windows\system32\ipnathlp.dll
2008-09-19 16:39:58 ----A---- C:\Windows\system32\iasrecst.dll
2008-09-19 16:39:58 ----A---- C:\Windows\system32\iasdatastore.dll
2008-09-19 16:39:58 ----A---- C:\Windows\system32\fdSSDP.dll
2008-09-19 16:39:58 ----A---- C:\Windows\system32\clbcatq.dll
2008-09-19 16:39:57 ----A---- C:\Windows\system32\wlgpclnt.dll
2008-09-19 16:39:57 ----A---- C:\Windows\system32\wlanui.dll
2008-09-19 16:39:57 ----A---- C:\Windows\system32\smss.exe
2008-09-19 16:39:57 ----A---- C:\Windows\system32\nci.dll
2008-09-19 16:39:57 ----A---- C:\Windows\system32\dsprop.dll
2008-09-19 16:39:57 ----A---- C:\Windows\system32\Defrag.exe
2008-09-19 16:39:57 ----A---- C:\Windows\system32\adsldpc.dll
2008-09-19 16:39:56 ----A---- C:\Windows\system32\upnphost.dll
2008-09-19 16:39:56 ----A---- C:\Windows\system32\systemcpl.dll
2008-09-19 16:39:56 ----A---- C:\Windows\system32\rasman.dll
2008-09-19 16:39:56 ----A---- C:\Windows\system32\P2P.dll
2008-09-19 16:39:56 ----A---- C:\Windows\system32\msftedit.dll
2008-09-19 16:39:56 ----A---- C:\Windows\system32\mprmsg.dll
2008-09-19 16:39:56 ----A---- C:\Windows\system32\CompatUI.dll
2008-09-19 16:39:56 ----A---- C:\Windows\system32\ActiveContentWizard.dll
2008-09-19 16:39:55 ----A---- C:\Windows\system32\Wpc.dll
2008-09-19 16:39:55 ----A---- C:\Windows\system32\t2embed.dll
2008-09-19 16:39:55 ----A---- C:\Windows\system32\rascfg.dll
2008-09-19 16:39:55 ----A---- C:\Windows\system32\PresentationSettings.exe
2008-09-19 16:39:55 ----A---- C:\Windows\system32\oleprn.dll
2008-09-19 16:39:55 ----A---- C:\Windows\system32\MSAC3ENC.DLL
2008-09-19 16:39:55 ----A---- C:\Windows\system32\MigAutoPlay.exe
2008-09-19 16:39:55 ----A---- C:\Windows\system32\loghours.dll
2008-09-19 16:39:55 ----A---- C:\Windows\system32\L2SecHC.dll
2008-09-19 16:39:55 ----A---- C:\Windows\system32\fde.dll
2008-09-19 16:39:55 ----A---- C:\Windows\system32\dxdiag.exe
2008-09-19 16:39:55 ----A---- C:\Windows\system32\DFDWiz.exe
2008-09-19 16:39:54 ----A---- C:\Windows\system32\wdigest.dll
2008-09-19 16:39:54 ----A---- C:\Windows\system32\setupcl.exe
2008-09-19 16:39:54 ----A---- C:\Windows\system32\rtm.dll
2008-09-19 16:39:54 ----A---- C:\Windows\system32\msutb.dll
2008-09-19 16:39:54 ----A---- C:\Windows\system32\mprdim.dll
2008-09-19 16:39:54 ----A---- C:\Windows\system32\gpapi.dll
2008-09-19 16:39:54 ----A---- C:\Windows\system32\AuxiliaryDisplayServices.dll
2008-09-19 16:39:53 ----A---- C:\Windows\system32\wiaservc.dll
2008-09-19 16:39:53 ----A---- C:\Windows\system32\scansetting.dll
2008-09-19 16:39:53 ----A---- C:\Windows\system32\NAPCRYPT.DLL
2008-09-19 16:39:53 ----A---- C:\Windows\system32\msihnd.dll
2008-09-19 16:39:53 ----A---- C:\Windows\system32\devmgr.dll
2008-09-19 16:39:53 ----A---- C:\Windows\system32\CertEnrollUI.dll
2008-09-19 16:39:52 ----A---- C:\Windows\system32\wdi.dll
2008-09-19 16:39:52 ----A---- C:\Windows\system32\kdusb.dll
2008-09-19 16:39:52 ----A---- C:\Windows\system32\ifsutil.dll
2008-09-19 16:39:52 ----A---- C:\Windows\system32\dimsroam.dll
2008-09-19 16:39:52 ----A---- C:\Windows\system32\actxprxy.dll
2008-09-19 16:39:51 ----A---- C:\Windows\system32\wscapi.dll
2008-09-19 16:39:51 ----A---- C:\Windows\system32\WinFXDocObj.exe
2008-09-19 16:39:51 ----A---- C:\Windows\system32\usbmon.dll
2008-09-19 16:39:51 ----A---- C:\Windows\system32\SyncCenter.dll
2008-09-19 16:39:51 ----A---- C:\Windows\system32\spoolsv.exe
2008-09-19 16:39:51 ----A---- C:\Windows\system32\mswmdm.dll
2008-09-19 16:39:51 ----A---- C:\Windows\system32\imagehlp.dll
2008-09-19 16:39:51 ----A---- C:\Windows\system32\BOOTVID.DLL
2008-09-19 16:39:51 ----A---- C:\Windows\system32\audiodg.exe
2008-09-19 16:39:50 ----A---- C:\Windows\system32\wlandlg.dll
2008-09-19 16:39:50 ----A---- C:\Windows\system32\vssadmin.exe
2008-09-19 16:39:50 ----A---- C:\Windows\system32\uudf.dll
2008-09-19 16:39:50 ----A---- C:\Windows\system32\regapi.dll
2008-09-19 16:39:50 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll

bernickb · October 2008

Part 2 of RSIT

2008-09-19 16:39:50 ----A---- C:\Windows\system32\PortableDeviceWMDRM.dll
2008-09-19 16:39:50 ----A---- C:\Windows\system32\mycomput.dll
2008-09-19 16:39:50 ----A---- C:\Windows\system32\msls31.dll
2008-09-19 16:39:47 ----A---- C:\Windows\system32\scecli.dll
2008-09-19 16:39:46 ----A---- C:\Windows\system32\SCardSvr.dll
2008-09-19 16:39:46 ----A---- C:\Windows\system32\newdev.dll
2008-09-19 16:39:46 ----A---- C:\Windows\system32\mstask.dll
2008-09-19 16:39:46 ----A---- C:\Windows\system32\mspaint.exe
2008-09-19 16:39:46 ----A---- C:\Windows\system32\kdcom.dll
2008-09-19 16:39:45 ----A---- C:\Windows\system32\termmgr.dll
2008-09-19 16:39:45 ----A---- C:\Windows\system32\tapisrv.dll
2008-09-19 16:39:45 ----A---- C:\Windows\system32\sud.dll
2008-09-19 16:39:45 ----A---- C:\Windows\system32\ssdpsrv.dll
2008-09-19 16:39:45 ----A---- C:\Windows\system32\samlib.dll
2008-09-19 16:39:45 ----A---- C:\Windows\system32\puiapi.dll
2008-09-19 16:39:45 ----A---- C:\Windows\system32\mtxoci.dll
2008-09-19 16:39:45 ----A---- C:\Windows\system32\duser.dll
2008-09-19 16:39:45 ----A---- C:\Windows\system32\adtschema.dll
2008-09-19 16:39:44 ----A---- C:\Windows\system32\SLUINotify.dll
2008-09-19 16:39:44 ----A---- C:\Windows\system32\Robocopy.exe
2008-09-19 16:39:44 ----A---- C:\Windows\system32\input.dll
2008-09-19 16:39:44 ----A---- C:\Windows\system32\inetpp.dll
2008-09-19 16:39:44 ----A---- C:\Windows\system32\cic.dll
2008-09-19 16:39:44 ----A---- C:\Windows\system32\AzSqlExt.dll
2008-09-19 16:39:43 ----A---- C:\Windows\system32\wisptis.exe
2008-09-19 16:39:43 ----A---- C:\Windows\system32\PortableDeviceTypes.dll
2008-09-19 16:39:43 ----A---- C:\Windows\system32\netiohlp.dll
2008-09-19 16:39:43 ----A---- C:\Windows\system32\iasads.dll
2008-09-19 16:39:43 ----A---- C:\Windows\system32\cscapi.dll
2008-09-19 16:39:43 ----A---- C:\Windows\system32\authz.dll
2008-09-19 16:39:42 ----A---- C:\Windows\system32\WUDFPlatform.dll
2008-09-19 16:39:42 ----A---- C:\Windows\system32\webcheck.dll
2008-09-19 16:39:42 ----A---- C:\Windows\system32\verifier.exe
2008-09-19 16:39:42 ----A---- C:\Windows\system32\themeui.dll
2008-09-19 16:39:42 ----A---- C:\Windows\system32\sdshext.dll
2008-09-19 16:39:42 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll
2008-09-19 16:39:42 ----A---- C:\Windows\system32\msdtclog.dll
2008-09-19 16:39:42 ----A---- C:\Windows\system32\msdt.exe
2008-09-19 16:39:42 ----A---- C:\Windows\system32\d3d8.dll
2008-09-19 16:39:42 ----A---- C:\Windows\system32\cmdial32.dll
2008-09-19 16:39:41 ----A---- C:\Windows\system32\wpcsvc.dll
2008-09-19 16:39:41 ----A---- C:\Windows\system32\wpccpl.dll
2008-09-19 16:39:41 ----A---- C:\Windows\system32\wintrust.dll
2008-09-19 16:39:41 ----A---- C:\Windows\system32\vdsldr.exe
2008-09-19 16:39:41 ----A---- C:\Windows\system32\SndVol.exe
2008-09-19 16:39:41 ----A---- C:\Windows\system32\slcinst.dll
2008-09-19 16:39:41 ----A---- C:\Windows\system32\rasgcw.dll
2008-09-19 16:39:41 ----A---- C:\Windows\system32\oledlg.dll
2008-09-19 16:39:41 ----A---- C:\Windows\system32\ntmarta.dll
2008-09-19 16:39:41 ----A---- C:\Windows\system32\mmcbase.dll
2008-09-19 16:39:41 ----A---- C:\Windows\system32\icardie.dll
2008-09-19 16:39:41 ----A---- C:\Windows\system32\dxtmsft.dll
2008-09-19 16:39:41 ----A---- C:\Windows\system32\clfsw32.dll
2008-09-19 16:39:40 ----A---- C:\Windows\system32\WMPhoto.dll
2008-09-19 16:39:40 ----A---- C:\Windows\system32\SnippingTool.exe
2008-09-19 16:39:40 ----A---- C:\Windows\system32\rasqec.dll
2008-09-19 16:39:40 ----A---- C:\Windows\system32\pnpsetup.dll
2008-09-19 16:39:40 ----A---- C:\Windows\system32\ncobjapi.dll
2008-09-19 16:39:40 ----A---- C:\Windows\system32\msrd3x40.dll
2008-09-19 16:39:40 ----A---- C:\Windows\system32\msaatext.dll
2008-09-19 16:39:40 ----A---- C:\Windows\system32\mpr.dll
2008-09-19 16:39:40 ----A---- C:\Windows\system32\mlang.dll
2008-09-19 16:39:40 ----A---- C:\Windows\system32\icfupgd.dll
2008-09-19 16:39:40 ----A---- C:\Windows\system32\diskraid.exe
2008-09-19 16:39:39 ----A---- C:\Windows\system32\wtsapi32.dll
2008-09-19 16:39:39 ----A---- C:\Windows\system32\wpd_ci.dll
2008-09-19 16:39:39 ----A---- C:\Windows\system32\unlodctr.exe
2008-09-19 16:39:39 ----A---- C:\Windows\system32\syssetup.dll
2008-09-19 16:39:39 ----A---- C:\Windows\system32\slmgr.vbs
2008-09-19 16:39:39 ----A---- C:\Windows\system32\sethc.exe
2008-09-19 16:39:39 ----A---- C:\Windows\system32\pnpui.dll
2008-09-19 16:39:39 ----A---- C:\Windows\system32\nslookup.exe
2008-09-19 16:39:39 ----A---- C:\Windows\system32\mscms.dll
2008-09-19 16:39:39 ----A---- C:\Windows\system32\lodctr.exe
2008-09-19 16:39:39 ----A---- C:\Windows\system32\iaspolcy.dll
2008-09-19 16:39:39 ----A---- C:\Windows\system32\extmgr.dll
2008-09-19 16:39:39 ----A---- C:\Windows\system32\dxdiagn.dll
2008-09-19 16:39:39 ----A---- C:\Windows\system32\accessibilitycpl.dll
2008-09-19 16:39:38 ----A---- C:\Windows\system32\WSManHTTPConfig.exe
2008-09-19 16:39:38 ----A---- C:\Windows\system32\Utilman.exe
2008-09-19 16:39:38 ----A---- C:\Windows\system32\ulib.dll
2008-09-19 16:39:38 ----A---- C:\Windows\system32\trkwks.dll
2008-09-19 16:39:38 ----A---- C:\Windows\system32\scesrv.dll
2008-09-19 16:39:38 ----A---- C:\Windows\system32\oobefldr.dll
2008-09-19 16:39:38 ----A---- C:\Windows\system32\Mcx2Svc.dll
2008-09-19 16:39:38 ----A---- C:\Windows\system32\lnkstub.exe
2008-09-19 16:39:38 ----A---- C:\Windows\system32\fontsub.dll
2008-09-19 16:39:38 ----A---- C:\Windows\system32\cabinet.dll
2008-09-19 16:39:37 ----A---- C:\Windows\system32\wermgr.exe
2008-09-19 16:39:37 ----A---- C:\Windows\system32\unattend.dll
2008-09-19 16:39:37 ----A---- C:\Windows\system32\ogldrv.dll
2008-09-19 16:39:37 ----A---- C:\Windows\system32\occache.dll
2008-09-19 16:39:37 ----A---- C:\Windows\system32\dfdts.dll
2008-09-19 16:39:37 ----A---- C:\Windows\system32\cabview.dll
2008-09-19 16:39:37 ----A---- C:\Windows\system32\bthci.dll
2008-09-19 16:39:36 ----A---- C:\Windows\system32\wpcao.dll
2008-09-19 16:39:36 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll
2008-09-19 16:39:36 ----A---- C:\Windows\system32\p2pcollab.dll
2008-09-19 16:39:36 ----A---- C:\Windows\system32\msnetobj.dll
2008-09-19 16:39:36 ----A---- C:\Windows\system32\iepeers.dll
2008-09-19 16:39:36 ----A---- C:\Windows\system32\ieaksie.dll
2008-09-19 16:39:36 ----A---- C:\Windows\system32\eappgnui.dll
2008-09-19 16:39:36 ----A---- C:\Windows\system32\basesrv.dll
2008-09-19 16:39:35 ----A---- C:\Windows\system32\drvinst.exe
2008-09-19 16:39:35 ----A---- C:\Windows\system32\dispdiag.exe
2008-09-19 16:39:35 ----A---- C:\Windows\system32\DHCPQEC.DLL
2008-09-19 16:39:34 ----A---- C:\Windows\system32\mmcss.dll
2008-09-19 16:39:34 ----A---- C:\Windows\system32\dsquery.dll
2008-09-19 16:39:33 ----A---- C:\Windows\system32\verifier.dll
2008-09-19 16:39:33 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2008-09-19 16:39:33 ----A---- C:\Windows\system32\secproc_ssp.dll
2008-09-19 16:39:33 ----A---- C:\Windows\system32\RstrtMgr.dll
2008-09-19 16:39:33 ----A---- C:\Windows\system32\qedit.dll
2008-09-19 16:39:33 ----A---- C:\Windows\system32\mprapi.dll
2008-09-19 16:39:33 ----A---- C:\Windows\system32\efsadu.dll
2008-09-19 16:39:32 ----A---- C:\Windows\system32\WPDSp.dll
2008-09-19 16:39:32 ----A---- C:\Windows\system32\WPDShServiceObj.dll
2008-09-19 16:39:32 ----A---- C:\Windows\system32\WMVENCOD.DLL
2008-09-19 16:39:32 ----A---- C:\Windows\system32\wiascanprofiles.dll
2008-09-19 16:39:32 ----A---- C:\Windows\system32\wercplsupport.dll
2008-09-19 16:39:32 ----A---- C:\Windows\system32\setupugc.exe
2008-09-19 16:39:32 ----A---- C:\Windows\system32\networkmap.dll
2008-09-19 16:39:32 ----A---- C:\Windows\system32\msoeacct.dll
2008-09-19 16:39:32 ----A---- C:\Windows\system32\iscsiexe.dll
2008-09-19 16:39:32 ----A---- C:\Windows\system32\icacls.exe
2008-09-19 16:39:32 ----A---- C:\Windows\system32\d3d10core.dll
2008-09-19 16:39:32 ----A---- C:\Windows\system32\consent.exe
2008-09-19 16:39:31 ----A---- C:\Windows\system32\xactsrv.dll
2008-09-19 16:39:31 ----A---- C:\Windows\system32\wiaaut.dll
2008-09-19 16:39:31 ----A---- C:\Windows\system32\usercpl.dll
2008-09-19 16:39:31 ----A---- C:\Windows\system32\QSVRMGMT.DLL
2008-09-19 16:39:31 ----A---- C:\Windows\system32\pnrpnsp.dll
2008-09-19 16:39:31 ----A---- C:\Windows\system32\pngfilt.dll
2008-09-19 16:39:31 ----A---- C:\Windows\system32\p2pnetsh.dll
2008-09-19 16:39:31 ----A---- C:\Windows\system32\msrdc.dll
2008-09-19 16:39:31 ----A---- C:\Windows\system32\msdmo.dll
2008-09-19 16:39:31 ----A---- C:\Windows\system32\conime.exe
2008-09-19 16:39:30 ----A---- C:\Windows\system32\xwizards.dll
2008-09-19 16:39:30 ----A---- C:\Windows\system32\systeminfo.exe
2008-09-19 16:39:30 ----A---- C:\Windows\system32\PNPXAssocPrx.dll
2008-09-19 16:39:30 ----A---- C:\Windows\system32\PNPXAssoc.dll
2008-09-19 16:39:30 ----A---- C:\Windows\system32\pcadm.dll
2008-09-19 16:39:30 ----A---- C:\Windows\system32\netcfg.exe
2008-09-19 16:39:30 ----A---- C:\Windows\system32\msrating.dll
2008-09-19 16:39:30 ----A---- C:\Windows\system32\mfplat.dll
2008-09-19 16:39:30 ----A---- C:\Windows\system32\lsass.exe
2008-09-19 16:39:30 ----A---- C:\Windows\system32\lpk.dll
2008-09-19 16:39:30 ----A---- C:\Windows\system32\findstr.exe
2008-09-19 16:39:30 ----A---- C:\Windows\system32\eappprxy.dll
2008-09-19 16:39:30 ----A---- C:\Windows\system32\drmmgrtn.dll
2008-09-19 16:39:30 ----A---- C:\Windows\system32\dpapimig.exe
2008-09-19 16:39:30 ----A---- C:\Windows\system32\cmdl32.exe
2008-09-19 16:39:30 ----A---- C:\Windows\system32\autoplay.dll
2008-09-19 16:39:29 ----A---- C:\Windows\system32\resutils.dll
2008-09-19 16:39:29 ----A---- C:\Windows\system32\powercpl.dll
2008-09-19 16:39:29 ----A---- C:\Windows\system32\netprof.dll
2008-09-19 16:39:29 ----A---- C:\Windows\system32\MFWMAAEC.DLL
2008-09-19 16:39:29 ----A---- C:\Windows\system32\DWWIN.EXE
2008-09-19 16:39:29 ----A---- C:\Windows\system32\dssec.dll
2008-09-19 16:39:29 ----A---- C:\Windows\system32\dot3ui.dll
2008-09-19 16:39:29 ----A---- C:\Windows\system32\dfrgifc.exe
2008-09-19 16:39:29 ----A---- C:\Windows\system32\dbnetlib.dll
2008-09-19 16:39:29 ----A---- C:\Windows\system32\alg.exe
2008-09-19 16:39:29 ----A---- C:\Windows\regedit.exe
2008-09-19 16:39:28 ----A---- C:\Windows\system32\txflog.dll
2008-09-19 16:39:28 ----A---- C:\Windows\system32\tbssvc.dll
2008-09-19 16:39:28 ----A---- C:\Windows\system32\taskkill.exe
2008-09-19 16:39:28 ----A---- C:\Windows\system32\odbc32.dll
2008-09-19 16:39:28 ----A---- C:\Windows\system32\nshhttp.dll
2008-09-19 16:39:28 ----A---- C:\Windows\system32\imm32.dll
2008-09-19 16:39:28 ----A---- C:\Windows\system32\iexpress.exe
2008-09-19 16:39:28 ----A---- C:\Windows\system32\feclient.dll
2008-09-19 16:39:28 ----A---- C:\Windows\system32\dxva2.dll
2008-09-19 16:39:28 ----A---- C:\Windows\system32\dwmapi.dll
2008-09-19 16:39:28 ----A---- C:\Windows\system32\btpanui.dll
2008-09-19 16:39:28 ----A---- C:\Windows\system32\bcdprov.dll
2008-09-19 16:39:28 ----A---- C:\Windows\system32\apircl.dll
2008-09-19 16:39:27 ----A---- C:\Windows\system32\syncui.dll
2008-09-19 16:39:27 ----A---- C:\Windows\system32\svchost.exe
2008-09-19 16:39:27 ----A---- C:\Windows\system32\slwmi.dll
2008-09-19 16:39:27 ----A---- C:\Windows\system32\shwebsvc.dll
2008-09-19 16:39:27 ----A---- C:\Windows\system32\RASMM.dll
2008-09-19 16:39:27 ----A---- C:\Windows\system32\provthrd.dll
2008-09-19 16:39:27 ----A---- C:\Windows\system32\msieftp.dll
2008-09-19 16:39:27 ----A---- C:\Windows\system32\MediaMetadataHandler.dll
2008-09-19 16:39:27 ----A---- C:\Windows\system32\EAPQEC.DLL
2008-09-19 16:39:27 ----A---- C:\Windows\system32\dmocx.dll
2008-09-19 16:39:27 ----A---- C:\Windows\system32\d3d10.dll
2008-09-19 16:39:27 ----A---- C:\Windows\system32\ActionQueue.dll
2008-09-19 16:39:26 ----A---- C:\Windows\system32\WMASF.DLL
2008-09-19 16:39:26 ----A---- C:\Windows\system32\SLCExt.dll
2008-09-19 16:39:26 ----A---- C:\Windows\system32\slcc.dll
2008-09-19 16:39:26 ----A---- C:\Windows\system32\raserver.exe
2008-09-19 16:39:26 ----A---- C:\Windows\system32\PnPUnattend.exe
2008-09-19 16:39:26 ----A---- C:\Windows\system32\olepro32.dll
2008-09-19 16:39:26 ----A---- C:\Windows\system32\networkexplorer.dll
2008-09-19 16:39:26 ----A---- C:\Windows\system32\dnscacheugc.exe
2008-09-19 16:39:26 ----A---- C:\Windows\system32\connect.dll
2008-09-19 16:39:26 ----A---- C:\Windows\system32\aclui.dll
2008-09-19 16:39:25 ----A---- C:\Windows\system32\xcopy.exe
2008-09-19 16:39:25 ----A---- C:\Windows\system32\uxsms.dll
2008-09-19 16:39:25 ----A---- C:\Windows\system32\upnp.dll
2008-09-19 16:39:25 ----A---- C:\Windows\system32\UIHub.dll
2008-09-19 16:39:25 ----A---- C:\Windows\system32\taskmgr.exe
2008-09-19 16:39:25 ----A---- C:\Windows\system32\reg.exe
2008-09-19 16:39:25 ----A---- C:\Windows\system32\QCLIPROV.DLL
2008-09-19 16:39:25 ----A---- C:\Windows\system32\icsfiltr.dll
2008-09-19 16:39:25 ----A---- C:\Windows\system32\ias.dll
2008-09-19 16:39:25 ----A---- C:\Windows\system32\brcplsdw.dll
2008-09-19 16:39:25 ----A---- C:\Windows\system32\audiodev.dll
2008-09-19 16:39:25 ----A---- C:\Windows\system32\appinfo.dll
2008-09-19 16:39:24 ----A---- C:\Windows\system32\wmpdxm.dll
2008-09-19 16:39:24 ----A---- C:\Windows\system32\wlanext.exe
2008-09-19 16:39:24 ----A---- C:\Windows\system32\perfts.dll
2008-09-19 16:39:24 ----A---- C:\Windows\system32\netplwiz.dll
2008-09-19 16:39:24 ----A---- C:\Windows\system32\NapiNSP.dll
2008-09-19 16:39:24 ----A---- C:\Windows\system32\msoert2.dll
2008-09-19 16:39:24 ----A---- C:\Windows\system32\msjetoledb40.dll
2008-09-19 16:39:24 ----A---- C:\Windows\system32\mountvol.exe
2008-09-19 16:39:24 ----A---- C:\Windows\system32\mmcshext.dll
2008-09-19 16:39:24 ----A---- C:\Windows\system32\inetmib1.dll
2008-09-19 16:39:24 ----A---- C:\Windows\system32\dskquoui.dll
2008-09-19 16:39:24 ----A---- C:\Windows\system32\cmstp.exe
2008-09-19 16:39:24 ----A---- C:\Windows\system32\certprop.dll
2008-09-19 16:39:24 ----A---- C:\Windows\system32\browser.dll
2008-09-19 16:39:24 ----A---- C:\Windows\system32\AuxiliaryDisplayApi.dll
2008-09-19 16:39:24 ----A---- C:\Windows\system32\atl.dll
2008-09-19 16:39:23 ----A---- C:\Windows\system32\WUDFSvc.dll
2008-09-19 16:39:23 ----A---- C:\Windows\system32\WUDFCoinstaller.dll
2008-09-19 16:39:23 ----A---- C:\Windows\system32\WpdMtpUS.dll
2008-09-19 16:39:23 ----A---- C:\Windows\system32\WMVXENCD.DLL
2008-09-19 16:39:23 ----A---- C:\Windows\system32\SysFxUI.dll
2008-09-19 16:39:23 ----A---- C:\Windows\system32\SoundRecorder.exe
2008-09-19 16:39:23 ----A---- C:\Windows\system32\rekeywiz.exe
2008-09-19 16:39:23 ----A---- C:\Windows\system32\qcap.dll
2008-09-19 16:39:23 ----A---- C:\Windows\system32\qasf.dll
2008-09-19 16:39:23 ----A---- C:\Windows\system32\PING.EXE
2008-09-19 16:39:23 ----A---- C:\Windows\system32\ieakeng.dll
2008-09-19 16:39:23 ----A---- C:\Windows\system32\httpapi.dll
2008-09-19 16:39:23 ----A---- C:\Windows\system32\dsuiext.dll
2008-09-19 16:39:23 ----A---- C:\Windows\system32\dmusic.dll
2008-09-19 16:39:23 ----A---- C:\Windows\system32\cewmdm.dll
2008-09-19 16:39:23 ----A---- C:\Windows\system32\bitsadmin.exe
2008-09-19 16:39:23 ----A---- C:\Windows\system32\auditpol.exe
2008-09-19 16:39:23 ----A---- C:\Windows\system32\adsmsext.dll
2008-09-19 16:39:22 ----A---- C:\Windows\system32\xwtpw32.dll
2008-09-19 16:39:22 ----A---- C:\Windows\system32\WMVSENCD.DLL
2008-09-19 16:39:22 ----A---- C:\Windows\system32\wmpsrcwp.dll
2008-09-19 16:39:22 ----A---- C:\Windows\system32\sppnp.dll
2008-09-19 16:39:22 ----A---- C:\Windows\system32\shimgvw.dll
2008-09-19 16:39:22 ----A---- C:\Windows\system32\Sens.dll
2008-09-19 16:39:22 ----A---- C:\Windows\system32\seclogon.dll
2008-09-19 16:39:22 ----A---- C:\Windows\system32\SecEdit.exe
2008-09-19 16:39:22 ----A---- C:\Windows\system32\sbeio.dll
2008-09-19 16:39:22 ----A---- C:\Windows\system32\printcom.dll
2008-09-19 16:39:22 ----A---- C:\Windows\system32\ndfapi.dll
2008-09-19 16:39:22 ----A---- C:\Windows\system32\mtstocom.exe
2008-09-19 16:39:22 ----A---- C:\Windows\system32\mscandui.dll
2008-09-19 16:39:22 ----A---- C:\Windows\system32\makecab.exe
2008-09-19 16:39:22 ----A---- C:\Windows\system32\lsmproxy.dll
2008-09-19 16:39:22 ----A---- C:\Windows\system32\dot3gpclnt.dll
2008-09-19 16:39:22 ----A---- C:\Windows\system32\batt.dll
2008-09-19 16:39:21 ----A---- C:\Windows\system32\wzcdlg.dll
2008-09-19 16:39:21 ----A---- C:\Windows\system32\wscmisetup.dll
2008-09-19 16:39:21 ----A---- C:\Windows\system32\wpdwcn.dll
2008-09-19 16:39:21 ----A---- C:\Windows\system32\WMSPDMOE.DLL
2008-09-19 16:39:21 ----A---- C:\Windows\system32\wiashext.dll
2008-09-19 16:39:21 ----A---- C:\Windows\system32\wiadefui.dll
2008-09-19 16:39:21 ----A---- C:\Windows\system32\userinit.exe
2008-09-19 16:39:21 ----A---- C:\Windows\system32\sxstrace.exe
2008-09-19 16:39:21 ----A---- C:\Windows\system32\shacct.dll
2008-09-19 16:39:21 ----A---- C:\Windows\system32\perfmon.exe
2008-09-19 16:39:21 ----A---- C:\Windows\system32\p2phost.exe
2008-09-19 16:39:21 ----A---- C:\Windows\system32\napipsec.dll
2008-09-19 16:39:21 ----A---- C:\Windows\system32\msorcl32.dll
2008-09-19 16:39:21 ----A---- C:\Windows\system32\msdadiag.dll
2008-09-19 16:39:21 ----A---- C:\Windows\system32\HelpPaneProxy.dll
2008-09-19 16:39:21 ----A---- C:\Windows\system32\dxtrans.dll
2008-09-19 16:39:21 ----A---- C:\Windows\system32\apss.dll
2008-09-19 16:39:20 ----A---- C:\Windows\system32\winrshost.exe
2008-09-19 16:39:20 ----A---- C:\Windows\system32\UIAutomationCore.dll
2008-09-19 16:39:20 ----A---- C:\Windows\system32\tasklist.exe
2008-09-19 16:39:20 ----A---- C:\Windows\system32\TapiMigPlugin.dll
2008-09-19 16:39:20 ----A---- C:\Windows\system32\rrinstaller.exe
2008-09-19 16:39:20 ----A---- C:\Windows\system32\prntvpt.dll
2008-09-19 16:39:20 ----A---- C:\Windows\system32\notepad.exe
2008-09-19 16:39:20 ----A---- C:\Windows\system32\msiexec.exe
2008-09-19 16:39:20 ----A---- C:\Windows\system32\MP4SDECD.DLL
2008-09-19 16:39:20 ----A---- C:\Windows\system32\ktmutil.exe
2008-09-19 16:39:20 ----A---- C:\Windows\system32\keymgr.dll
2008-09-19 16:39:20 ----A---- C:\Windows\system32\ftp.exe
2008-09-19 16:39:20 ----A---- C:\Windows\system32\fmifs.dll
2008-09-19 16:39:20 ----A---- C:\Windows\system32\d3dim700.dll
2008-09-19 16:39:20 ----A---- C:\Windows\system32\csrsrv.dll
2008-09-19 16:39:20 ----A---- C:\Windows\system32\colorui.dll
2008-09-19 16:39:20 ----A---- C:\Windows\notepad.exe
2008-09-19 16:39:19 ----A---- C:\Windows\system32\wscproxystub.dll
2008-09-19 16:39:19 ----A---- C:\Windows\system32\wpdbusenum.dll
2008-09-19 16:39:19 ----A---- C:\Windows\system32\wmiprop.dll
2008-09-19 16:39:19 ----A---- C:\Windows\system32\winethc.dll
2008-09-19 16:39:19 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2008-09-19 16:39:19 ----A---- C:\Windows\system32\txfw32.dll
2008-09-19 16:39:19 ----A---- C:\Windows\system32\takeown.exe
2008-09-19 16:39:19 ----A---- C:\Windows\system32\pots.dll
2008-09-19 16:39:19 ----A---- C:\Windows\system32\PnPutil.exe
2008-09-19 16:39:19 ----A---- C:\Windows\system32\pcasvc.dll
2008-09-19 16:39:19 ----A---- C:\Windows\system32\nshipsec.dll
2008-09-19 16:39:19 ----A---- C:\Windows\system32\netiougc.exe
2008-09-19 16:39:19 ----A---- C:\Windows\system32\msimtf.dll
2008-09-19 16:39:19 ----A---- C:\Windows\system32\mfps.dll
2008-09-19 16:39:19 ----A---- C:\Windows\system32\logagent.exe
2008-09-19 16:39:19 ----A---- C:\Windows\system32\inseng.dll
2008-09-19 16:39:19 ----A---- C:\Windows\system32\findnetprinters.dll
2008-09-19 16:39:19 ----A---- C:\Windows\system32\driverquery.exe
2008-09-19 16:39:19 ----A---- C:\Windows\system32\cryptdll.dll
2008-09-19 16:39:18 ----A---- C:\Windows\system32\WLanHC.dll
2008-09-19 16:39:18 ----A---- C:\Windows\system32\shrpubw.exe
2008-09-19 16:39:18 ----A---- C:\Windows\system32\shgina.dll
2008-09-19 16:39:18 ----A---- C:\Windows\system32\sfc_os.dll
2008-09-19 16:39:18 ----A---- C:\Windows\system32\sendmail.dll
2008-09-19 16:39:18 ----A---- C:\Windows\system32\RESAMPLEDMO.DLL
2008-09-19 16:39:18 ----A---- C:\Windows\system32\rasplap.dll
2008-09-19 16:39:18 ----A---- C:\Windows\system32\powrprof.dll
2008-09-19 16:39:18 ----A---- C:\Windows\system32\perfnet.dll
2008-09-19 16:39:18 ----A---- C:\Windows\system32\olecli32.dll
2008-09-19 16:39:18 ----A---- C:\Windows\system32\nsisvc.dll
2008-09-19 16:39:18 ----A---- C:\Windows\system32\mfpmp.exe
2008-09-19 16:39:18 ----A---- C:\Windows\system32\luainstall.dll
2008-09-19 16:39:18 ----A---- C:\Windows\system32\imapi.dll
2008-09-19 16:39:18 ----A---- C:\Windows\system32\fsutil.exe
2008-09-19 16:39:18 ----A---- C:\Windows\system32\fdPHost.dll
2008-09-19 16:39:18 ----A---- C:\Windows\system32\dnshc.dll
2008-09-19 16:39:18 ----A---- C:\Windows\system32\cmmon32.exe
2008-09-19 16:39:18 ----A---- C:\Windows\system32\capisp.dll
2008-09-19 16:39:17 ----A---- C:\Windows\system32\WMADMOE.DLL
2008-09-19 16:39:17 ----A---- C:\Windows\system32\wiaacmgr.exe
2008-09-19 16:39:17 ----A---- C:\Windows\system32\wextract.exe
2008-09-19 16:39:17 ----A---- C:\Windows\system32\version.dll
2008-09-19 16:39:17 ----A---- C:\Windows\system32\unregmp2.exe
2008-09-19 16:39:17 ----A---- C:\Windows\system32\UI0Detect.exe
2008-09-19 16:39:17 ----A---- C:\Windows\system32\TMM.dll
2008-09-19 16:39:17 ----A---- C:\Windows\system32\runonce.exe
2008-09-19 16:39:17 ----A---- C:\Windows\system32\rshx32.dll
2008-09-19 16:39:17 ----A---- C:\Windows\system32\RpcPing.exe
2008-09-19 16:39:17 ----A---- C:\Windows\system32\mdminst.dll
2008-09-19 16:39:17 ----A---- C:\Windows\system32\ktmw32.dll
2008-09-19 16:39:17 ----A---- C:\Windows\system32\getmac.exe
2008-09-19 16:39:17 ----A---- C:\Windows\system32\dimsjob.dll
2008-09-19 16:39:17 ----A---- C:\Windows\system32\d3dim.dll
2008-09-19 16:39:17 ----A---- C:\Windows\system32\compstui.dll
2008-09-19 16:39:17 ----A---- C:\Windows\system32\cmlua.dll
2008-09-19 16:39:16 ----A---- C:\Windows\system32\wmpshell.dll
2008-09-19 16:39:16 ----A---- C:\Windows\system32\w32tm.exe
2008-09-19 16:39:16 ----A---- C:\Windows\system32\tscupgrd.exe
2008-09-19 16:39:16 ----A---- C:\Windows\system32\sdchange.exe
2008-09-19 16:39:16 ----A---- C:\Windows\system32\pnpts.dll
2008-09-19 16:39:16 ----A---- C:\Windows\system32\net.exe
2008-09-19 16:39:16 ----A---- C:\Windows\system32\msvfw32.dll
2008-09-19 16:39:16 ----A---- C:\Windows\system32\MPG4DECD.DLL
2008-09-19 16:39:16 ----A---- C:\Windows\system32\MP43DECD.DLL
2008-09-19 16:39:16 ----A---- C:\Windows\system32\migisol.dll
2008-09-19 16:39:16 ----A---- C:\Windows\system32\ipconfig.exe
2008-09-19 16:39:16 ----A---- C:\Windows\system32\imgutil.dll
2008-09-19 16:39:16 ----A---- C:\Windows\system32\fdeploy.dll
2008-09-19 16:39:16 ----A---- C:\Windows\system32\dsauth.dll
2008-09-19 16:39:16 ----A---- C:\Windows\system32\credui.dll
2008-09-19 16:39:16 ----A---- C:\Windows\system32\ACW.exe
2008-09-19 16:39:15 ----A---- C:\Windows\system32\sfc.exe
2008-09-19 16:39:15 ----A---- C:\Windows\system32\PortableDeviceWiaCompat.dll
2008-09-19 16:39:15 ----A---- C:\Windows\system32\dispci.dll
2008-09-19 16:39:15 ----A---- C:\Windows\system32\dinput8.dll
2008-09-19 16:39:15 ----A---- C:\Windows\system32\diantz.exe
2008-09-19 16:39:15 ----A---- C:\Windows\system32\comrepl.dll
2008-09-19 16:39:15 ----A---- C:\Windows\system32\cmutil.dll
2008-09-19 16:39:14 ----A---- C:\Windows\system32\TSTheme.exe
2008-09-19 16:39:14 ----A---- C:\Windows\system32\remotepg.dll
2008-09-19 16:39:14 ----A---- C:\Windows\system32\pdhui.dll
2008-09-19 16:39:14 ----A---- C:\Windows\system32\nlaapi.dll
2008-09-19 16:39:14 ----A---- C:\Windows\system32\ExplorerFrame.dll
2008-09-19 16:39:14 ----A---- C:\Windows\system32\EncDump.dll
2008-09-19 16:39:14 ----A---- C:\Windows\system32\cfgbkend.dll
2008-09-19 16:39:13 ----A---- C:\Windows\system32\wmidx.dll
2008-09-19 16:39:13 ----A---- C:\Windows\system32\fwcfg.dll
2008-09-19 16:39:13 ----A---- C:\Windows\system32\expand.exe
2008-09-19 16:39:10 ----A---- C:\Windows\system32\wsnmp32.dll
2008-09-19 16:39:10 ----A---- C:\Windows\system32\WPDShextAutoplay.exe
2008-09-19 16:39:10 ----A---- C:\Windows\system32\wmvdspa.dll
2008-09-19 16:39:10 ----A---- C:\Windows\system32\vds_ps.dll
2008-09-19 16:39:10 ----A---- C:\Windows\system32\vdmredir.dll
2008-09-19 16:39:10 ----A---- C:\Windows\system32\utildll.dll
2008-09-19 16:39:10 ----A---- C:\Windows\system32\TpmInit.exe
2008-09-19 16:39:10 ----A---- C:\Windows\system32\sti_ci.dll
2008-09-19 16:39:10 ----A---- C:\Windows\system32\softkbd.dll
2008-09-19 16:39:10 ----A---- C:\Windows\system32\rdrleakdiag.exe
2008-09-19 16:39:10 ----A---- C:\Windows\system32\msfeedsbs.dll
2008-09-19 16:39:10 ----A---- C:\Windows\system32\modemui.dll
2008-09-19 16:39:10 ----A---- C:\Windows\system32\McxDriv.dll
2008-09-19 16:39:10 ----A---- C:\Windows\system32\iernonce.dll
2008-09-19 16:39:10 ----A---- C:\Windows\system32\hlink.dll
2008-09-19 16:39:10 ----A---- C:\Windows\system32\esentutl.exe
2008-09-19 16:39:10 ----A---- C:\Windows\system32\colbact.dll
2008-09-19 16:39:10 ----A---- C:\Windows\system32\bridgeunattend.exe
2008-09-19 16:39:10 ----A---- C:\Windows\system32\bootcfg.exe
2008-09-19 16:39:10 ----A---- C:\Windows\system32\amstream.dll
2008-09-19 16:39:09 ----A---- C:\Windows\system32\WsmCl.dll
2008-09-19 16:39:09 ----A---- C:\Windows\system32\wfapigp.dll
2008-09-19 16:39:09 ----A---- C:\Windows\system32\waitfor.exe
2008-09-19 16:39:09 ----A---- C:\Windows\system32\tabcal.exe
2008-09-19 16:39:09 ----A---- C:\Windows\system32\shutdown.exe
2008-09-19 16:39:09 ----A---- C:\Windows\system32\qdv.dll
2008-09-19 16:39:09 ----A---- C:\Windows\system32\osblprov.dll
2008-09-19 16:39:09 ----A---- C:\Windows\system32\odbccp32.dll
2008-09-19 16:39:09 ----A---- C:\Windows\system32\logman.exe
2008-09-19 16:39:09 ----A---- C:\Windows\system32\iscsium.dll
2008-09-19 16:39:09 ----A---- C:\Windows\system32\dpnet.dll
2008-09-19 16:39:09 ----A---- C:\Windows\system32\cmcfg32.dll
2008-09-19 16:39:09 ----A---- C:\Windows\system32\cacls.exe
2008-09-19 16:39:09 ----A---- C:\Windows\system32\admparse.dll
2008-09-19 16:39:08 ----A---- C:\Windows\system32\wpnpinst.exe
2008-09-19 16:39:08 ----A---- C:\Windows\system32\wmpcm.dll
2008-09-19 16:39:08 ----A---- C:\Windows\system32\werdiagcontroller.dll
2008-09-19 16:39:08 ----A---- C:\Windows\system32\wavemsp.dll
2008-09-19 16:39:08 ----A---- C:\Windows\system32\ufat.dll
2008-09-19 16:39:08 ----A---- C:\Windows\system32\SLLUA.exe
2008-09-19 16:39:08 ----A---- C:\Windows\system32\rasauto.dll
2008-09-19 16:39:08 ----A---- C:\Windows\system32\olethk32.dll
2008-09-19 16:39:08 ----A---- C:\Windows\system32\olesvr32.dll
2008-09-19 16:39:08 ----A---- C:\Windows\system32\mstext40.dll
2008-09-19 16:39:08 ----A---- C:\Windows\system32\msdtc.exe
2008-09-19 16:39:08 ----A---- C:\Windows\system32\mfvdsp.dll
2008-09-19 16:39:08 ----A---- C:\Windows\system32\iscsiwmi.dll
2008-09-19 16:39:08 ----A---- C:\Windows\system32\DpiScaling.exe
2008-09-19 16:39:08 ----A---- C:\Windows\system32\dmsynth.dll
2008-09-19 16:39:08 ----A---- C:\Windows\system32\COLORCNV.DLL
2008-09-19 16:39:07 ----A---- C:\Windows\system32\xmlprovi.dll
2008-09-19 16:39:07 ----A---- C:\Windows\system32\WpdConns.dll
2008-09-19 16:39:07 ----A---- C:\Windows\system32\ucsvc.exe
2008-09-19 16:39:07 ----A---- C:\Windows\system32\TimeDateMUICallback.dll
2008-09-19 16:39:07 ----A---- C:\Windows\system32\sxproxy.dll
2008-09-19 16:39:07 ----A---- C:\Windows\system32\rgb9rast.dll
2008-09-19 16:39:07 ----A---- C:\Windows\system32\RegCtrl.dll
2008-09-19 16:39:07 ----A---- C:\Windows\system32\prevhost.exe
2008-09-19 16:39:07 ----A---- C:\Windows\system32\odbctrac.dll
2008-09-19 16:39:07 ----A---- C:\Windows\system32\networkitemfactory.dll
2008-09-19 16:39:07 ----A---- C:\Windows\system32\netbtugc.exe
2008-09-19 16:39:07 ----A---- C:\Windows\system32\mshta.exe
2008-09-19 16:39:07 ----A---- C:\Windows\system32\msctfui.dll
2008-09-19 16:39:07 ----A---- C:\Windows\system32\mobsync.exe
2008-09-19 16:39:07 ----A---- C:\Windows\system32\licmgr10.dll
2008-09-19 16:39:07 ----A---- C:\Windows\system32\itss.dll
2008-09-19 16:39:07 ----A---- C:\Windows\system32\iscsied.dll
2008-09-19 16:39:07 ----A---- C:\Windows\system32\dskquota.dll
2008-09-19 16:39:07 ----A---- C:\Windows\system32\csrstub.exe
2008-09-19 16:39:07 ----A---- C:\Windows\system32\convert.exe
2008-09-19 16:39:07 ----A---- C:\Windows\system32\bitsigd.dll
2008-09-19 16:39:07 ----A---- C:\Windows\system32\AuthFWGP.dll
2008-09-19 16:39:07 ----A---- C:\Windows\system32\at.exe
2008-09-19 16:39:06 ----A---- C:\Windows\system32\winnsi.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\usbui.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\unattendedjoin.exe
2008-09-19 16:39:06 ----A---- C:\Windows\system32\tbs.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\setupcln.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\regini.exe
2008-09-19 16:39:06 ----A---- C:\Windows\system32\rasdiag.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\odbccu32.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\odbccr32.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\ocsetup.exe
2008-09-19 16:39:06 ----A---- C:\Windows\system32\napdsnap.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\mydocs.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\msident.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\msdart.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\l2gpstore.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\GuidedHelp.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\fphc.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\dsdmo.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\dot3dlg.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\dmime.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\devenum.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\cscdll.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\cmstplua.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\cmpbk32.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\AtBroker.exe
2008-09-19 16:39:06 ----A---- C:\Windows\system32\apilogen.dll
2008-09-19 16:39:06 ----A---- C:\Windows\system32\amxread.dll
2008-09-19 16:39:05 ----A---- C:\Windows\system32\wsock32.dll
2008-09-19 16:39:05 ----A---- C:\Windows\system32\wpclsp.dll
2008-09-19 16:39:05 ----A---- C:\Windows\system32\WINSRPC.DLL
2008-09-19 16:39:05 ----A---- C:\Windows\system32\wiarpc.dll
2008-09-19 16:39:05 ----A---- C:\Windows\system32\WavDest.dll
2008-09-19 16:39:05 ----A---- C:\Windows\system32\vss_ps.dll
2008-09-19 16:39:05 ----A---- C:\Windows\system32\VIDRESZR.DLL
2008-09-19 16:39:05 ----A---- C:\Windows\system32\vfwwdm32.dll
2008-09-19 16:39:05 ----A---- C:\Windows\system32\upnpcont.exe
2008-09-19 16:39:05 ----A---- C:\Windows\system32\syskey.exe
2008-09-19 16:39:05 ----A---- C:\Windows\system32\srwmi.dll
2008-09-19 16:39:05 ----A---- C:\Windows\system32\ROUTE.EXE
2008-09-19 16:39:05 ----A---- C:\Windows\system32\rasphone.exe
2008-09-19 16:39:05 ----A---- C:\Windows\system32\RacAgent.exe
2008-09-19 16:39:05 ----A---- C:\Windows\system32\odbcbcp.dll
2008-09-19 16:39:05 ----A---- C:\Windows\system32\nsi.dll
2008-09-19 16:39:05 ----A---- C:\Windows\system32\netevent.dll
2008-09-19 16:39:05 ----A---- C:\Windows\system32\ndfetw.dll
2008-09-19 16:39:05 ----A---- C:\Windows\system32\nbtstat.exe
2008-09-19 16:39:05 ----A---- C:\Windows\system32\mtxlegih.dll
2008-09-19 16:39:05 ----A---- C:\Windows\system32\mtxdm.dll
2008-09-19 16:39:05 ----A---- C:\Windows\system32\msexcl40.dll
2008-09-19 16:39:05 ----A---- C:\Windows\system32\MsCtfMonitor.dll
2008-09-19 16:39:05 ----A---- C:\Windows\system32\mfcsubs.dll
2008-09-19 16:39:05 ----A---- C:\Windows\system32\graftabl.com
2008-09-19 16:39:05 ----A---- C:\Windows\system32\gpupdate.exe
2008-09-19 16:39:05 ----A---- C:\Windows\system32\extrac32.exe
2008-09-19 16:39:05 ----A---- C:\Windows\system32\avrt.dll
2008-09-19 16:39:04 ----A---- C:\Windows\system32\WlanMmHC.dll
2008-09-19 16:39:04 ----A---- C:\Windows\system32\WindowsAnytimeUpgrade.exe
2008-09-19 16:39:04 ----A---- C:\Windows\system32\wiadss.dll
2008-09-19 16:39:04 ----A---- C:\Windows\system32\TabbtnEx.dll
2008-09-19 16:39:04 ----A---- C:\Windows\system32\Tabbtn.dll
2008-09-19 16:39:04 ----A---- C:\Windows\system32\psbase.dll
2008-09-19 16:39:04 ----A---- C:\Windows\system32\procinst.dll
2008-09-19 16:39:04 ----A---- C:\Windows\system32\msxbde40.dll
2008-09-19 16:39:04 ----A---- C:\Windows\system32\MP3DMOD.DLL
2008-09-19 16:39:04 ----A---- C:\Windows\system32\inetppui.dll
2008-09-19 16:39:04 ----A---- C:\Windows\system32\eventcls.dll
2008-09-19 16:39:04 ----A---- C:\Windows\system32\dmscript.dll
2008-09-19 16:39:04 ----A---- C:\Windows\system32\dmloader.dll
2008-09-19 16:39:04 ----A---- C:\Windows\system32\d3dxof.dll
2008-09-19 16:39:04 ----A---- C:\Windows\system32\csrss.exe
2008-09-19 16:39:04 ----A---- C:\Windows\system32\CertEnrollCtrl.exe
2008-09-19 16:39:04 ----A---- C:\Windows\system32\atmfd.dll
2008-09-19 16:39:04 ----A---- C:\Windows\fveupdate.exe
2008-09-19 16:39:03 ----A---- C:\Windows\system32\WsmRes.dll
2008-09-19 16:39:03 ----A---- C:\Windows\system32\WSHTCPIP.DLL
2008-09-19 16:39:03 ----A---- C:\Windows\system32\wship6.dll
2008-09-19 16:39:03 ----A---- C:\Windows\system32\wshcon.dll
2008-09-19 16:39:03 ----A---- C:\Windows\system32\sxsstore.dll
2008-09-19 16:39:03 ----A---- C:\Windows\system32\PlaySndSrv.dll
2008-09-19 16:39:03 ----A---- C:\Windows\system32\Netplwiz.exe
2008-09-19 16:39:03 ----A---- C:\Windows\system32\msvidc32.dll
2008-09-19 16:39:03 ----A---- C:\Windows\system32\mspbde40.dll
2008-09-19 16:39:03 ----A---- C:\Windows\system32\msltus40.dll
2008-09-19 16:39:03 ----A---- C:\Windows\system32\localui.dll
2008-09-19 16:39:03 ----A---- C:\Windows\system32\lltdapi.dll
2008-09-19 16:39:03 ----A---- C:\Windows\system32\icsunattend.exe
2008-09-19 16:39:03 ----A---- C:\Windows\system32\HotStartUserAgent.dll
2008-09-19 16:39:03 ----A---- C:\Windows\system32\credssp.dll
2008-09-19 16:39:03 ----A---- C:\Windows\system32\ComputerDefaults.exe
2008-09-19 16:39:02 ----A---- C:\Windows\system32\usbperf.dll
2008-09-19 16:39:02 ----A---- C:\Windows\system32\tcpmon.ini
2008-09-19 16:39:02 ----A---- C:\Windows\system32\spopk.dll
2008-09-19 16:39:02 ----A---- C:\Windows\system32\slwga.dll
2008-09-19 16:39:02 ----A---- C:\Windows\system32\setupSNK.exe
2008-09-19 16:39:02 ----A---- C:\Windows\system32\serialui.dll
2008-09-19 16:39:02 ----A---- C:\Windows\system32\sbunattend.exe
2008-09-19 16:39:02 ----A---- C:\Windows\system32\OptionalFeatures.exe
2008-09-19 16:39:02 ----A---- C:\Windows\system32\odbcconf.dll
2008-09-19 16:39:02 ----A---- C:\Windows\system32\NcdProp.dll
2008-09-19 16:39:02 ----A---- C:\Windows\system32\LangCleanupSysprepAction.dll
2008-09-19 16:39:02 ----A---- C:\Windows\system32\icaapi.dll
2008-09-19 16:39:02 ----A---- C:\Windows\system32\dmutil.dll
2008-09-19 16:39:02 ----A---- C:\Windows\system32\cofiredm.dll
2008-09-19 16:39:01 ----A---- C:\Windows\system32\vdmdbg.dll
2008-09-19 16:39:01 ----A---- C:\Windows\system32\url.dll
2008-09-19 16:39:01 ----A---- C:\Windows\system32\rasctrs.dll
2008-09-19 16:39:01 ----A---- C:\Windows\system32\nlsbres.dll
2008-09-19 16:39:01 ----A---- C:\Windows\system32\msobjs.dll
2008-09-19 16:39:01 ----A---- C:\Windows\system32\msfeedssync.exe
2008-09-19 16:39:01 ----A---- C:\Windows\system32\midimap.dll
2008-09-19 16:39:01 ----A---- C:\Windows\system32\LogonUI.exe
2008-09-19 16:39:01 ----A---- C:\Windows\system32\iprtprio.dll
2008-09-19 16:39:01 ----A---- C:\Windows\system32\InfDefaultInstall.exe
2008-09-19 16:39:01 ----A---- C:\Windows\system32\ieencode.dll
2008-09-19 16:39:01 ----A---- C:\Windows\system32\hnetmon.dll
2008-09-19 16:39:01 ----A---- C:\Windows\system32\hbaapi.dll
2008-09-19 16:39:01 ----A---- C:\Windows\system32\esentprf.dll
2008-09-19 16:39:01 ----A---- C:\Windows\system32\corpol.dll
2008-09-19 16:39:00 ----A---- C:\Windows\system32\sdspres.dll
2008-09-19 16:39:00 ----A---- C:\Windows\system32\osbaseln.dll
2008-09-19 16:39:00 ----A---- C:\Windows\system32\cfgmgr32.dll
2008-09-19 16:38:59 ----A---- C:\Windows\system32\winusb.dll
2008-09-19 16:38:59 ----A---- C:\Windows\system32\rdpcfgex.dll
2008-09-19 16:38:59 ----A---- C:\Windows\system32\msmmsp.dll
2008-09-19 16:38:59 ----A---- C:\Windows\system32\msisip.dll
2008-09-19 16:38:59 ----A---- C:\Windows\system32\dispex.dll
2008-09-19 16:38:58 ----A---- C:\Windows\system32\spwmp.dll
2008-09-19 16:38:58 ----A---- C:\Windows\system32\riched32.dll
2008-09-19 16:38:58 ----A---- C:\Windows\system32\Nlsdl.dll
2008-09-19 16:38:58 ----A---- C:\Windows\system32\msidle.dll
2008-09-19 16:38:58 ----A---- C:\Windows\system32\idndl.dll
2008-09-19 16:38:57 ----A---- C:\Windows\system32\KBDKOR.DLL
2008-09-19 16:38:57 ----A---- C:\Windows\system32\KBDJPN.DLL
2008-09-19 16:38:57 ----A---- C:\Windows\system32\iscsilog.dll
2008-09-19 16:38:56 ----A---- C:\Windows\system32\wmploc.DLL
2008-09-19 16:38:56 ----A---- C:\Windows\system32\vga64k.dll
2008-09-19 16:38:56 ----A---- C:\Windows\system32\vga256.dll
2008-09-19 16:38:56 ----A---- C:\Windows\system32\vga.dll
2008-09-19 16:38:56 ----A---- C:\Windows\system32\tsddd.dll
2008-09-19 16:38:56 ----A---- C:\Windows\system32\framebuf.dll
2008-09-19 16:38:56 ----A---- C:\Windows\system32\dxmasf.dll
2008-09-19 16:38:56 ----A---- C:\Windows\system32\bootstr.dll
2008-09-19 16:38:55 ----A---- C:\Windows\system32\spwizres.dll
2008-09-19 16:38:55 ----A---- C:\Windows\system32\gatherWiredInfo.vbs
2008-09-19 16:38:55 ----A---- C:\Windows\system32\f3ahvoas.dll
2008-09-19 16:38:55 ----A---- C:\Windows\system32\dmdskres2.dll
2008-09-19 16:38:54 ----A---- C:\Windows\system32\gatherWirelessInfo.vbs
2008-09-19 16:38:54 ----A---- C:\Windows\system32\fsmgmt.msc
2008-09-19 16:38:53 ----A---- C:\Windows\system32\vsp1cln.exe
2008-09-19 16:38:53 ----A---- C:\Windows\system32\perfmon.msc
2008-09-19 16:38:19 ----A---- C:\Windows\system32\xmllite.dll
2008-09-19 16:38:18 ----A---- C:\Windows\system32\wbemcomn.dll
2008-09-19 16:38:10 ----A---- C:\Windows\system32\SmiInstaller.dll
2008-09-19 16:38:10 ----A---- C:\Windows\system32\SmiEngine.dll
2008-09-19 16:38:02 ----A---- C:\Windows\system32\wdscore.dll
2008-09-19 16:38:02 ----A---- C:\Windows\system32\PkgMgr.exe
2008-09-19 16:37:42 ----A---- C:\Windows\system32\drvstore.dll
2008-09-19 16:37:41 ----A---- C:\Windows\system32\mspatcha.dll
2008-09-19 16:37:41 ----A---- C:\Windows\system32\msdelta.dll
2008-09-19 16:37:41 ----A---- C:\Windows\system32\dpx.dll

======List of files/folders modified in the last 1 months======

2008-10-15 09:43:52 ----D---- C:\Windows\Temp
2008-10-15 09:33:04 ----HD---- C:\Windows\inf
2008-10-15 09:33:04 ----D---- C:\Windows\System32
2008-10-15 09:33:04 ----A---- C:\Windows\system32\PerfStringBackup.INI
2008-10-15 09:27:47 ----D---- C:\Users\Brian\AppData\Roaming\Spare Backup
2008-10-15 09:27:16 ----D---- C:\ProgramData\Kaspersky Lab
2008-10-15 09:26:35 ----D---- C:\Windows\system32\drivers
2008-10-15 09:26:35 ----D---- C:\Windows
2008-10-15 07:29:49 ----D---- C:\Windows\Prefetch
2008-10-15 07:29:00 ----RD---- C:\Program Files
2008-10-15 07:29:00 ----HD---- C:\ProgramData
2008-10-15 00:00:28 ----SHD---- C:\System Volume Information
2008-10-14 10:18:48 ----D---- C:\Users\Brian\AppData\Roaming\Template
2008-10-08 07:06:46 ----D---- C:\Windows\system32\catroot2
2008-09-29 17:00:30 ----SD---- C:\Users\Brian\AppData\Roaming\Microsoft
2008-09-25 13:24:22 ----D---- C:\Windows\system32\WDI
2008-09-21 10:29:40 ----D---- C:\Windows\rescache
2008-09-21 10:10:43 ----D---- C:\Windows\system32\en-US
2008-09-21 10:10:43 ----D---- C:\Windows\PolicyDefinitions
2008-09-21 10:09:40 ----D---- C:\Windows\winsxs
2008-09-21 10:09:22 ----D---- C:\Windows\system32\catroot
2008-09-20 09:27:38 ----D---- C:\Windows\Logs
2008-09-20 08:46:04 ----D---- C:\Windows\Microsoft.NET
2008-09-20 08:45:58 ----RSD---- C:\Windows\assembly
2008-09-20 08:37:56 ----SHD---- C:\Boot
2008-09-20 08:37:53 ----ASH---- C:\Program Files\desktop.ini
2008-09-20 08:27:16 ----D---- C:\Program Files\Windows Calendar
2008-09-20 08:27:15 ----D---- C:\Program Files\Windows Sidebar
2008-09-20 08:27:15 ----D---- C:\Program Files\Movie Maker
2008-09-20 08:27:14 ----D---- C:\Program Files\Windows Media Player
2008-09-20 08:27:14 ----D---- C:\Program Files\Windows Mail
2008-09-20 08:27:14 ----D---- C:\Program Files\Internet Explorer
2008-09-20 08:27:13 ----D---- C:\Program Files\Windows Photo Gallery
2008-09-20 08:27:13 ----D---- C:\Program Files\Windows Journal
2008-09-20 08:27:13 ----D---- C:\Program Files\Windows Collaboration
2008-09-20 08:27:08 ----D---- C:\Program Files\Windows Defender
2008-09-20 08:27:08 ----D---- C:\Program Files\Common Files\System
2008-09-20 08:27:07 ----D---- C:\Windows\servicing
2008-09-20 08:27:07 ----D---- C:\Windows\ehome
2008-09-20 08:26:54 ----D---- C:\Windows\MSAgent
2008-09-20 08:26:53 ----D---- C:\Windows\IME
2008-09-20 08:26:53 ----D---- C:\Windows\DigitalLocker
2008-09-20 08:26:52 ----D---- C:\Windows\L2Schemas
2008-09-20 08:26:49 ----D---- C:\Windows\system32\XPSViewer
2008-09-20 08:26:49 ----D---- C:\Windows\system32\ko-KR
2008-09-20 08:26:49 ----D---- C:\Windows\system32\da-DK
2008-09-20 08:26:49 ----D---- C:\Windows\system32\com
2008-09-20 08:26:35 ----D---- C:\Windows\system32\it-IT
2008-09-20 08:26:35 ----D---- C:\Windows\system32\el-GR
2008-09-20 08:26:35 ----D---- C:\Windows\system32\de-DE
2008-09-20 08:26:34 ----D---- C:\Windows\system32\sysprep
2008-09-20 08:26:34 ----D---- C:\Windows\system32\oobe
2008-09-20 08:26:34 ----D---- C:\Windows\system32\migration
2008-09-20 08:26:30 ----D---- C:\Windows\system32\AdvancedInstallers
2008-09-20 08:26:29 ----D---- C:\Windows\system32\sv-SE
2008-09-20 08:26:29 ----D---- C:\Windows\system32\setup
2008-09-20 08:26:29 ----D---- C:\Windows\system32\ru-RU
2008-09-20 08:26:29 ----D---- C:\Windows\system32\pt-PT
2008-09-20 08:26:29 ----D---- C:\Windows\system32\ias
2008-09-20 08:26:29 ----D---- C:\Windows\system32\hu-HU
2008-09-20 08:26:29 ----D---- C:\Windows\system32\he-IL
2008-09-20 08:26:29 ----D---- C:\Windows\system32\fr-FR
2008-09-20 08:26:29 ----D---- C:\Windows\system32\fi-FI
2008-09-20 08:26:29 ----D---- C:\Windows\system32\cs-CZ
2008-09-20 08:26:28 ----D---- C:\Windows\system32\SLUI
2008-09-20 08:26:25 ----D---- C:\Windows\system32\zh-TW
2008-09-20 08:26:25 ----D---- C:\Windows\system32\zh-CN
2008-09-20 08:26:25 ----D---- C:\Windows\system32\pl-PL
2008-09-20 08:26:25 ----D---- C:\Windows\system32\manifeststore
2008-09-20 08:26:25 ----D---- C:\Windows\system32\ja-JP
2008-09-20 08:26:25 ----D---- C:\Windows\system32\es-ES
2008-09-20 08:26:25 ----D---- C:\Windows\system32\en
2008-09-20 08:26:24 ----D---- C:\Windows\system32\ro-RO
2008-09-20 08:26:20 ----D---- C:\Windows\system32\tr-TR
2008-09-20 08:26:19 ----D---- C:\Windows\system32\wbem
2008-09-20 08:26:16 ----D---- C:\Windows\system32\nl-NL
2008-09-20 08:26:16 ----D---- C:\Windows\system32\nb-NO
2008-09-20 08:26:16 ----D---- C:\Windows\system32\ar-SA
2008-09-20 08:26:13 ----D---- C:\Windows\system32\migwiz
2008-09-20 08:26:12 ----D---- C:\Windows\system32\pt-BR
2008-09-20 08:24:49 ----D---- C:\Windows\AppPatch
2008-09-20 08:22:24 ----D---- C:\Windows\Boot
2008-09-20 08:22:23 ----D---- C:\Windows\system32\Boot
2008-09-20 08:10:29 ----A---- C:\Windows\system32\ifxcardm.dll
2008-09-20 08:10:27 ----A---- C:\Windows\system32\axaltocm.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Cdr4_xp;Cdr4_xp; C:\Windows\system32\drivers\Cdr4_xp.sys [2005-09-07 44288]
R1 Cdralw2k;Cdralw2k; C:\Windows\system32\drivers\Cdralw2k.sys [2005-09-07 24960]
R1 kl1;kl1; C:\Windows\system32\DRIVERS\kl1.sys [2008-05-28 112144]
R1 KLIF;KLIF; C:\Windows\system32\DRIVERS\klif.sys [2008-02-10 127768]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter; C:\Windows\system32\DRIVERS\klim6.sys [2007-04-04 20760]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-01-29 8704]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-18 14208]
R3 GEARAspiWDM;GEARAspiWDM; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2006-09-19 15664]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2006-12-21 985600]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2006-12-21 207360]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-02-11 2302976]
R3 MRVW147;Marvell TOPDOG (TM) 802.11bgn Driver for Vista Native WIFI (CB8x/EC8x); C:\Windows\system32\DRIVERS\MRVW147.sys [2007-08-17 526848]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-07-22 123904]
R3 RTSTOR;Realtek USB 2.0 Card Reader; C:\Windows\system32\drivers\RTSTOR.SYS [2008-06-23 62464]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\Windows\system32\drivers\stwrt.sys [2007-07-27 329728]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2006-11-17 181176]
R3 usbvideo;Gateway USB 2.0 Webcam; C:\Windows\System32\Drivers\usbvideo.sys [2008-01-18 134016]
R3 UVCFTR;UVCFTR; C:\Windows\System32\Drivers\UVCFTR_S.SYS [2007-05-23 11776]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2006-12-21 659968]
S3 ac97intc;Intel(r) 82801 Audio Driver Install Service (WDM); C:\Windows\system32\drivers\ac97intc.sys [2006-11-02 108032]
S3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\Windows\system32\DRIVERS\bcm4sbxp.sys [2006-11-02 45056]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-18 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 ialm;ialm; C:\Windows\system32\DRIVERS\ialmnt5.sys [2006-11-02 1302492]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-18 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-18 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-18 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-18 6016]
S3 MUD;Driver for Magellan USB Device; C:\Windows\system32\DRIVERS\MUD.sys [2008-03-07 51200]
S3 NETw2v32;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows Vista; C:\Windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184]
S3 SymIM;Symantec Network Security Intermediate Filter Service; C:\Windows\system32\DRIVERS\SymIM.sys []
S3 SymIMMP;SymIMMP; C:\Windows\system32\DRIVERS\SymIM.sys []
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-18 35328]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-18 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-18 83328]
S4 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2006-11-02 82432]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-02-18 110592]
R2 AVP;Kaspersky Internet Security 7.0; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe [2007-06-28 218376]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2007-02-12 355096]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-01-29 386560]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-02-19 504104]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S3 GameConsoleService;GameConsoleService; C:\Program Files\Gateway Games\Gateway Game Console\GameConsoleService.exe [2007-08-29 181800]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]

EOF

bernickb · October 2008

info.txt logfile of random's system information tool 1.04 2008-10-15 09:44:10

======Uninstall list======

-->"C:\Program Files\Gateway Games\Bejeweled 2 Deluxe\Uninstall.exe"
-->"C:\Program Files\Gateway Games\Blasterball 3\Uninstall.exe"
-->"C:\Program Files\Gateway Games\Chuzzle Deluxe\Uninstall.exe"
-->"C:\Program Files\Gateway Games\Diner Dash\Uninstall.exe"
-->"C:\Program Files\Gateway Games\FATE\Uninstall.exe"
-->"C:\Program Files\Gateway Games\Gateway Game Console\Uninstall.exe"
-->"C:\Program Files\Gateway Games\Penguins!\Uninstall.exe"
-->"C:\Program Files\Gateway Games\Polar Bowler\Uninstall.exe"
-->"C:\Program Files\Gateway Games\Polar Golfer\Uninstall.exe"
-->"C:\Program Files\Gateway Games\Tradewinds\Uninstall.exe"
-->"C:\Program Files\Gateway Games\Virtual Villagers - A New Home\Uninstall.exe"
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player 9 ActiveX-->C:\Windows\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Adobe Shockwave Player 11-->C:\Windows\system32\adobe\SHOCKW~1\UNWISE.EXE C:\Windows\system32\Adobe\SHOCKW~1\Install.log
Apple Mobile Device Support-->MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543}
Apple Software Update-->MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
Back Roads Explorer 3D-->MsiExec.exe /I{9ADE5105-91A7-48AB-ABB3-8C4A392EB034}
BigFix-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{34FF0741-EC67-4C05-AC2A-6D257123DF2E}\setup.exe" -l0x9 -uninst -f"C:\Program Files\BigFix\Uninst.isu" -c"C:\Program Files\BigFix\Lib\UninstallHelper.dll"
Bonjour-->MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
Browser Address Error Redirector-->regsvr32 /u /s "c:\windows\system32\BAE.dll"
Camera Assistant Software for Gateway-->C:\Program Files\InstallShield Installation Information\{39098402-3F7A-4257-A4AE-FC1181D1B40B}\setup.exe -runfromtemp -l0x0009
Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
Gateway Connect-->MsiExec.exe /I{EE5EEDAF-F932-462B-A2CB-EEBDF819D5F5}
Gateway Games-->"C:\Program Files\Gateway Games\Uninstall.exe"
Gateway Recovery Center Installer-->MsiExec.exe /X{7F3BCF8A-8E02-4659-AF25-F9AB66BD6718}
HDAUDIO Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2C06&SUBSYS_14F10000\UIU32m.exe -U -IPDZONCMzK.inf
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
IDT Audio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{07D8511D-C9FE-4A93-933F-EAA5C8F20095}\setup.exe" -l0x9 -remove -removeonly
Intel(R) Graphics Media Accelerator Driver-->C:\Windows\system32\igxpun.exe -uninstall
Intel(R) Matrix Storage Manager-->C:\Windows\System32\Imsmudlg.exe
iTunes-->MsiExec.exe /I{80FD852F-5AAC-4129-B931-06AAFFA43138}
Java(TM) SE Runtime Environment 6 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Kaspersky Internet Security 7.0-->MsiExec.exe /I{C774410D-3EF9-4DE7-AC01-332613163ECF}
Kaspersky Internet Security 7.0-->MsiExec.exe /I{C774410D-3EF9-4DE7-AC01-332613163ECF}
LabelPrint-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C59C179C-668D-49A9-B6EA-0121CCFC1243}\Setup.exe" -uninstall
Malwarebytes' Anti-Malware-->"C:\Program files\Malwarebytes' Anti-Malware\unins000.exe"
Marvell(R) Wireless Card Software Package-->MsiExec.exe /X{FE5BB5C7-BD6E-4F90-82FD-6DB7B3781BE9}
Microsoft Money Essentials-->"C:\Program Files\Microsoft Money 2007\MNYCoreFiles\Setup\uninst.exe" /s:120
Microsoft Money Plus-->"C:\Program Files\Microsoft Money Plus\MNYCoreFiles\Setup\uninst.exe" /s:120
Microsoft Money Shared Libraries-->MsiExec.exe /X{5F00DF7E-418B-4CD9-8EC5-781156BCC49E}
Microsoft Money Shared Libraries-->MsiExec.exe /X{7F1B3341-A94E-4F5C-B587-CA0EB964221E}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint Viewer 2007 (English)-->MsiExec.exe /X{95120000-00AF-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Works-->MsiExec.exe /I{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}
Microsoft WorldWide Telescope-->MsiExec.exe /I{A5C16084-032F-4A6D-B19A-2E700421F9FB}
Microsoft WSE 2.0 SP3 Runtime-->MsiExec.exe /X{F3CA9611-CD42-4562-ADAB-A554CF8E17F1}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
Napster Burn Engine-->MsiExec.exe /I{8DCE550C-CA43-4E82-92DF-FFC4A48F5BE1}
Napster-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BBBCAE4B-B416-4182-A6F2-438180894A81}\setup.exe" -l0x9 -removeonly
Power2Go 5.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\Setup.exe" -uninstall
QuickTime-->MsiExec.exe /I{BFD96B89-B769-4CD6-B11E-E79FFD46F067}
Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista-->C:\Program Files\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -l0x0009 -removeonly
Realtek USB 2.0 Card Reader-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.exe" -l0x9 -removeonly
Security Update for 2007 Microsoft Office System (KB951596)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {1AFF2298-CC00-4A3B-866A-C62B8373794E}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for Microsoft Office Excel 2007 (KB951546)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7399DD71-8E24-4E60-B6A8-6CED89C0AC26}
Security Update for Microsoft Office OneNote 2007 (KB950130)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {F1B2401C-B610-4BF2-AA1C-52C55827A8F4}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office system 2007 (KB951808)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office Word 2007 (KB950113)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
Security Update for Visio 2007 (KB947590)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
Spare Backup-->MsiExec.exe /X{A57C6094-FC5A-4DEC-B1E0-1B2F48EEE8F4}
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
The Right Track (R) Software-->C:\PROGRA~1\RTS8~1.0\UNWISE.EXE C:\PROGRA~1\RTS8~1.0\INSTALL.LOG
TOPO! 4-->MsiExec.exe /I{5B3FB6D4-1B88-413D-8DE7-A7E2D58DE5B2}
TV Player Classic 4.6-->"C:\Program Files\TVPlayerClassic\unins000.exe"
Update for Office 2007 (KB946691)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
VantagePoint-->"C:\Program Files\InstallShield Installation Information\{1D21ED4F-3C5E-45C3-9795-8C8CB2AB31DC}\setup.exe" -runfromtemp -l0x0409 -removeonly
VantagePoint-->MsiExec.exe /X{1D21ED4F-3C5E-45C3-9795-8C8CB2AB31DC}
Windows Live installer-->MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Mail-->MsiExec.exe /I{184E7118-0295-43C4-B72C-1D54AA75AAF7}
Windows Live Messenger-->MsiExec.exe /I{571700F0-DB9D-4B3A-B03D-35A14BB5939F}
Windows Live Sign-in Assistant-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
yDecode 1.62-->C:\Program Files\yDecode\uninst.exe

======Security center information======

AV: Kaspersky Internet Security
FW: Kaspersky Internet Security
AS: Windows Defender
AS: Kaspersky Internet Security

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_REVISION"=0f0d
"NUMBER_OF_PROCESSORS"=2
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_01\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_01\lib\ext\QTJava.zip

EOF

bernickb · October 2008

Malwarebytes' Anti-Malware 1.28
Database version: 1272
Windows 6.0.6001 Service Pack 1

10/15/2008 9:23:40 AM
mbam-log-2008-10-15 (09-23-40).txt

Scan type: Full Scan (C:\|E:\|)
Objects scanned: 183258
Time elapsed: 1 hour(s), 50 minute(s), 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 28
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\hol5_vxiewer.full.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Golden Palace Casino PT (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmdinfo (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\brastk (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\ProgramData\cmdinfo\axknklsd.exe (Trojan.FakeAlert.H) -> Delete on reboot.
C:\Users\Brian\AppData\Local\Temp\mso11.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Katana · October 2008

Fix With HJT

Please note:- Due to the restrictions on Vista, all tools should be started by Right-Click >>> Run As Administrator
Close all other windows and then start HiJack This
Click Do A System Scan Only
When it has finished scanning put a check next to the following lines IF still present

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)

- Close ALL open windows (especially Internet Explorer!)-
Now click Fix checked
Click yes to any prompts
Close HijackThis

Active Scan
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Please go to this site Link >> ActiveScan << LINK

Click the Scan Now button
Follow the prompts to install the Active X if necessary
Go and make a cup of tea/coffee/beverage of your choice and watch some TV
When the scan is finished, a report will be generated
Next to Scan Details click the small Save button and save the report to your desktop.
Please post the report in your reply.

How are things running now ?

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location.

Now download and install Java Runtime Environment (JRE) 6 Update 7.

Your Adobe Acrobat Reader is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Adobe Reader is a large program and if you prefer a smaller program you can get Foxit 2.0 from http://www.foxitsoftware.com/pdf/rd_intro.php << Recommended

There is a newer version of Adobe Acrobat Reader available.

Please go to this link Adobe Acrobat Reader Download Link
Click Download
On the right Untick Adobe Phototshop Album Starter Edition if you do not wish to include this in the installation.
Click the Continue button
Click Run, and click Run again
Next click the Install Now button and follow the on screen prompts

When the installation is complete go to Add/Remove Programs and uninstall all previous versions.

bernickb · October 2008

Still no popup.

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-10-15 11:55:25
PROTECTIONS: 2
MALWARE: 34
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Windows Defender 1.1.4005.0 No Yes
Kaspersky Internet Security 7.0 7.0.0.125 No No
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@trafficmp[1].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@doubleclick[1].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\brian@doubleclick[1].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@atdmt[2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\brian@atdmt[1].txt
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@247realmedia[1].txt
00145453 Cookie/Bfast TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\brian@bfast[2].txt
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@fastclick[2].txt
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@tribalfusion[2].txt
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@mediaplex[1].txt
00146967 Cookie/PayCounter TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@paycounter[2].txt
00149116 Cookie/Ccbill TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@ccbill[1].txt
00160284 Cookie/Findwhat TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@findwhat[1].txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@com[1].txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@statcounter[2].txt
00167758 Cookie/Barelylegal TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@c.fsx[1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@ad.yieldmanager[2].txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@apmebf[1].txt
00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@adtech[1].txt
00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@server.iad.liveperson[2].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@advertising[2].txt
00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@statse.webtrendslive[2].txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@ads.pointroll[1].txt
00170549 Cookie/FortuneCity TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@fortunecity[1].txt
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@overture[2].txt
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@realmedia[1].txt
00170559 Cookie/Com.com TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@uol.com[2].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@questionmarket[2].txt
00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@zedo[2].txt
00172449 Cookie/MetriWeb TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@metriweb[1].txt
00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@adrevolver[2].txt
00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@adultfriendfinder[2].txt
00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@go[1].txt
00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@searchportal.information[2].txt
00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@target[1].txt
00207862 Cookie/did-it TrackingCookie No 0 Yes No C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Cookies\Low\brian@did-it[1].txt
;===================================================================================================================================================================================
SUSPECTS
Sent Location Pï¿½ï¿½x0ï¿½
s5ï¿½
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description Pï¿½ï¿½x0ï¿½
s5ï¿½
;===================================================================================================================================================================================
;===================================================================================================================================================================================

Katana · October 2008

Congratulations your logs look clean

Let's see if I can help you keep it that way

First lets tidy up

Delete any logs we have produced and empty your Recycle bin

Reset System Restore.
Now you should disable System restore to purge any infected files and then re-enable it,

Turn off System Restore.

Click the Vista/Start icon
Right Click Computer
Click Properties.
Click the System Protection tab.
Uncheck All drives
Click "Turn Off System Restore" at the prompt then click "Apply",
Restart your computer

Turn ON System Restore

Click the Vista/Start icon
Right Click Computer
Click Properties.
Click the System Protection tab.
Checkmark All drives that were selected previously
then click "Apply",
Restart your computer

The following is some info to help you stay safe and clean.
( Vista users must ensure that any programs are Vista compatible BEFORE installing )

You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.

Online Scanners
I would recommend a scan at one or more of the following sites at least once a month.

http://www.pandasecurity.com/activescan
http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html

!!! Make sure that all your programs are updated !!!
Secunia Software Inspector does all the work for you, .... see HERE for details

AntiSpyware

AntiSpyware isnot the same thing as Antivirus.
Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
Most of the programs in this list have a free (for Home Users ) and paid versions,
it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
[*]Spybot - Search & Destroy <<< A must have program

It includes host protection and registry protection
A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites

[*] MalwareBytes Anti-malware <<< A New and effective program
[*]a-squared Free <<< A good "realtime" or "on demand" scanner
[*]superantispyware <<< A good "realtime" or "on demand" scanner

Prevention

Winpatrol
- An excellent startup manager and then some !!
- Notifies you if programs are added to startup
- Allows delayed startup
- A must have addition
SpywareBlaster 4.0
- SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
SpywareGuard 2.2
- SpywareGuard provides real-time protection against spyware.
- Not required if you have other "realtime" antispyware or Winpatrol
ZonedOut
- Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
MVPS HOSTS
- This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
- For information on how to download and install, please read this tutorial by WinHelp2002.
- Not required if you are using other host file protections

Internet Browsers

Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys. Using a different web browser can help stop malware getting on your machine.

Make your Internet Explorer more secure - This can be done by following these simple instructions:
1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click once on the Security tab
3. Click once on the Internet icon so it becomes highlighted.
4. Click once on the Custom Level button.
  - Change the Download signed ActiveX controls to Prompt
  - Change the Download unsigned ActiveX controls to Disable
  - Change the Initialise and script ActiveX controls not marked as safe to Disable
  - Change the Installation of desktop items to Prompt
  - Change the Launching programs and files in an IFRAME to Prompt
  - Change the Navigate sub-frames across different domains to Prompt
  - When all these settings have been made, click on the OK button.
  - If it prompts you as to whether or not you want to save the settings, press the Yes button.
5. Next press the Apply button and then the OK to exit the Internet Properties page.

If you are still using IE6 then either update, or get one of the following.

FireFox
- With many addons available that make customization easy this is a very popular choice
- NoScript and AdBlockPlus addons are essential
Opera
- Another popular alternative
Netscape
- Another popular alternative
- Also has Addons available

Cleaning Temporary Internet Files and Tracking Cookies

ATF Cleaner
- Free and very simple to use
CCleaner
- Free and very flexible, you can chose which cookies to keep

Also PLEASE read this article.....So How Did I Get Infected In The First Place

The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.

If you follow this advice then (with a bit of luck) you will never have to hear from me again

If you could post back one more time to let me know everything is OK, then I can have this thread archived.

Happy surfing K'

bernickb · October 2008

Everything works great. I had spybot on a previous computer but couldn't transfer the program. Thanks for all the help.

Katana · October 2008

Glad we could be of assistance! This topic is now closed.

If you wish to reopen your topic, please send a Private Message (PM) to Trogan with a link to your thread.

If you are not the user who started this thread, you must start your own Thread instead

Something not quite right

Comments