Options

win32/spy.ursnif.A virus in my termsrv.dll file (Resolved)

Unknown
edited August 2009 in Spyware & Virus Removal
i'm using eset nod32 antivirus and alerts keep popping up about termsrv.dll before my winlogon used to be infected but i cleaned it with combofix, however i still cannot manage to get the termsrv.dll file cleaned. Any help suggestions would be highly appreciated

Comments

  • KatanaKatana
    edited July 2009
    Please note that all instructions given are customised for this computer only,
    the tools used may cause damage if used on a computer with different infections.

    If you think you have similar problems, please post a log in the HJT forum and wait for help.

    Hello and welcome to the forums

    My name is Katana and I will be helping you to remove any infection(s) that you may have.

    Please observe these rules while we work:
    1. Please Read All Instructions Carefully
    2. If you don't understand something, stop and ask! Don't keep going on.
    3. Please do not run any other tools or scans whilst I am helping you
    4. Failure to reply within 5 days will result in the topic being closed.
    5. Please continue to respond until I give you the "All Clear"
      (Just because you can't see a problem doesn't mean it isn't there)

    If you can do those few things, everything should go smoothly laechel.gif

    Some of the logs I request will be quite large, You may need to split them over a couple of replies.

    Please Note, your security programs may give warnings for some of the tools I will ask you to use.
    Be assured, any links I give are safe





    ==============================WARNING==============================
    There is some evidence of what may be a very nasty infection.
    If the Computer has been used for any important data, you are strongly advised to do the following, immediately:
    • If you have ever used this computer for shopping, banking, or any transactions relating to your financial well being:
      Call all of your banks, credit card companies, and financial institutions, informing them that you may be a victim of identity theft, and to put a watch on your accounts or change all your account numbers.
    • From a clean computer, change ALL your online passwords -- for ISP login, email, banks, financial accounts, PayPal, eBay, online companies, and any online forums or groups you belong to.
    • DO NOT change passwords or do any transactions while using the infected computer because the attacker will get the new password and transaction information.
    • Take any other steps you think appropriate for an attempted identity theft.
    ==============================WARNING==============================



    Download and Run ComboFix (by sUBs)
    Please visit this webpage for instructions for downloading and running ComboFix:

    Bleeping Computer ComboFix Tutorial

    • You must download it to and run it from your Desktop
    • Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
    • Double click combofix.exe & follow the prompts.
    • When finished, it will produce a log. Please save that log to post in your next reply
    • Re-enable all the programs that were disabled during the running of ComboFix..



    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
    This tool is not a toy and not for everyday use.
    ComboFix SHOULD NOT be used unless requested by a forum helper
    For instructions on how to disable your security programs, please see this topic
    How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs


    Download and Run RSIT
    • Please download Random's System Information Tool by random/random from here and save it to your desktop.
    • Double click on RSIT.exe to run RSIT.
    • Click Continue at the disclaimer screen.
    • Once it has finished, two logs will open:
      • log.txt will be opened maximized.
      • info.txt will be opened minimized.
    • Please post the contents of both log.txt and info.txt.
      ( They can also be found in the C:\RSIT folder )
  • Brooce
    edited August 2009
    ComboFix 09-07-31.04 - Bruce 08/01/2009 3:37.5.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2047.1576 [GMT -5:00]
    Running from: c:\documents and settings\Bruce\Desktop\ComboFix.exe
    AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\Installer\9d8c17.msi

    .
    ((((((((((((((((((((((((( Files Created from 2009-07-01 to 2009-08-01 )))))))))))))))))))))))))))))))
    .

    2009-08-01 08:17 . 2009-08-01 08:17
    d
    w- c:\windows\LastGood
    2009-08-01 07:18 . 2009-08-01 07:18
    d
    w- c:\documents and settings\2nd Account\Local Settings\Application Data\Mozilla
    2009-08-01 07:18 . 2009-08-01 07:52
    d
    w- c:\program files\Diablo II
    2009-07-30 20:49 . 2009-07-30 20:49
    d
    w- c:\program files\softnyx
    2009-07-28 23:43 . 2009-07-28 23:42 410984 ----a-w- c:\windows\system32\deploytk.dll
    2009-07-28 23:41 . 2009-07-28 23:41 152576 ----a-w- c:\documents and settings\Bruce\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
    2009-07-06 09:27 . 2009-07-06 09:27
    d
    w- c:\program files\Common Files\INCA Shared
    2009-07-06 09:12 . 2009-03-09 20:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll
    2009-07-06 09:12 . 2009-03-09 20:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll
    2009-07-06 09:12 . 2009-03-09 20:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll
    2009-07-06 09:11 . 2009-03-16 19:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll
    2009-07-06 09:11 . 2009-03-16 19:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll
    2009-07-06 09:11 . 2009-03-16 19:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll
    2009-07-06 09:11 . 2009-03-16 19:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll
    2009-07-06 09:11 . 2008-10-15 11:22 452440 ----a-w- c:\windows\system32\d3dx10_40.dll
    2009-07-06 09:11 . 2008-10-15 11:22 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll
    2009-07-06 09:11 . 2008-10-15 11:22 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll
    2009-07-06 09:11 . 2008-10-15 12:03 70992 ----a-w- c:\windows\system32\XAPOFX1_2.dll
    2009-07-06 09:11 . 2008-10-15 12:03 514384 ----a-w- c:\windows\system32\XAudio2_3.dll
    2009-07-06 09:11 . 2008-10-15 12:03 235856 ----a-w- c:\windows\system32\xactengine3_3.dll
    2009-07-06 09:10 . 2008-10-15 12:03 23376 ----a-w- c:\windows\system32\X3DAudio1_5.dll
    2009-07-06 09:10 . 2008-07-30 11:20 68616 ----a-w- c:\windows\system32\XAPOFX1_1.dll
    2009-07-06 09:10 . 2008-07-30 11:20 509448 ----a-w- c:\windows\system32\XAudio2_2.dll
    2009-07-06 09:10 . 2008-07-30 11:20 238088 ----a-w- c:\windows\system32\xactengine3_2.dll
    2009-07-06 09:10 . 2008-07-10 16:01 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
    2009-07-06 09:10 . 2008-07-10 16:00 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
    2009-07-06 09:10 . 2008-07-10 16:00 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
    2009-07-06 09:09 . 2008-05-30 19:19 507400 ----a-w- c:\windows\system32\XAudio2_1.dll
    2009-07-06 09:09 . 2008-05-30 19:17 65032 ----a-w- c:\windows\system32\XAPOFX1_0.dll
    2009-07-06 09:09 . 2008-05-30 19:18 238088 ----a-w- c:\windows\system32\xactengine3_1.dll
    2009-07-06 09:09 . 2008-05-30 19:17 25608 ----a-w- c:\windows\system32\X3DAudio1_4.dll
    2009-07-06 09:09 . 2008-05-30 19:11 467984 ----a-w- c:\windows\system32\d3dx10_38.dll
    2009-07-06 09:09 . 2008-05-30 19:11 1491992 ----a-w- c:\windows\system32\D3DCompiler_38.dll
    2009-07-06 09:09 . 2008-05-30 19:11 3850760 ----a-w- c:\windows\system32\D3DX9_38.dll
    2009-07-06 09:08 . 2008-03-05 21:03 479752 ----a-w- c:\windows\system32\XAudio2_0.dll
    2009-07-06 09:08 . 2008-03-05 21:03 238088 ----a-w- c:\windows\system32\xactengine3_0.dll
    2009-07-06 09:08 . 2008-03-05 21:00 25608 ----a-w- c:\windows\system32\X3DAudio1_3.dll
    2009-07-06 09:08 . 2008-03-05 20:56 1420824 ----a-w- c:\windows\system32\D3DCompiler_37.dll
    2009-07-06 09:08 . 2008-02-06 04:07 462864 ----a-w- c:\windows\system32\d3dx10_37.dll
    2009-07-06 09:08 . 2008-03-05 20:56 3786760 ----a-w- c:\windows\system32\D3DX9_37.dll
    2009-07-06 09:07 . 2007-10-22 08:39 267272 ----a-w- c:\windows\system32\xactengine2_10.dll
    2009-07-06 09:07 . 2007-10-12 20:14 1374232 ----a-w- c:\windows\system32\D3DCompiler_36.dll
    2009-07-06 09:07 . 2007-10-02 14:56 444776 ----a-w- c:\windows\system32\d3dx10_36.dll
    2009-07-06 09:07 . 2007-10-12 20:14 3734536 ----a-w- c:\windows\system32\d3dx9_36.dll
    2009-07-06 09:07 . 2007-07-20 05:57 267112 ----a-w- c:\windows\system32\xactengine2_9.dll
    2009-07-06 09:06 . 2007-07-19 23:14 444776 ----a-w- c:\windows\system32\d3dx10_35.dll
    2009-07-06 09:06 . 2007-07-19 23:14 1358192 ----a-w- c:\windows\system32\D3DCompiler_35.dll
    2009-07-06 09:06 . 2007-07-19 23:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll
    2009-07-06 09:06 . 2007-10-22 08:37 17928 ----a-w- c:\windows\system32\X3DAudio1_2.dll
    2009-07-06 09:06 . 2007-06-21 01:46 266088 ----a-w- c:\windows\system32\xactengine2_8.dll
    2009-07-06 09:06 . 2007-05-16 21:45 443752 ----a-w- c:\windows\system32\d3dx10_34.dll
    2009-07-06 09:06 . 2007-05-16 21:45 1124720 ----a-w- c:\windows\system32\D3DCompiler_34.dll
    2009-07-06 09:06 . 2007-05-16 21:45 3497832 ----a-w- c:\windows\system32\d3dx9_34.dll
    2009-07-06 09:06 . 2007-04-04 23:53 81768 ----a-w- c:\windows\system32\xinput1_3.dll
    2009-07-06 09:06 . 2007-04-04 23:55 261480 ----a-w- c:\windows\system32\xactengine2_7.dll
    2009-07-06 09:05 . 2007-03-15 21:57 443752 ----a-w- c:\windows\system32\d3dx10_33.dll
    2009-07-06 09:05 . 2007-03-12 21:42 1123696 ----a-w- c:\windows\system32\D3DCompiler_33.dll
    2009-07-06 09:05 . 2007-03-12 21:42 3495784 ----a-w- c:\windows\system32\d3dx9_33.dll
    2009-07-03 05:42 . 2009-07-03 05:55
    d
    w- c:\documents and settings\Bruce\Application Data\GetRightToGo

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-01 07:46 . 2007-12-23 22:13
    d
    w- c:\program files\Diablo 2
    2009-08-01 07:42 . 2007-12-23 22:16 71995 ----a-w- c:\windows\DIIUnin.dat
    2009-08-01 07:41 . 2007-12-23 22:22 21840 ----atw- c:\windows\system32\SIntfNT.dll
    2009-08-01 07:41 . 2007-12-23 22:22 17212 ----atw- c:\windows\system32\SIntf32.dll
    2009-08-01 07:41 . 2007-12-23 22:22 12067 ----atw- c:\windows\system32\SIntf16.dll
    2009-08-01 07:26 . 2007-12-23 22:16 94208 ----a-w- c:\windows\DIIUnin.exe
    2009-08-01 07:26 . 2007-12-23 22:16 2829 ----a-w- c:\windows\DIIUnin.pif
    2009-08-01 07:14 . 2009-08-01 07:14
    d
    w- c:\documents and settings\2nd Account\Application Data\Logitech
    2009-07-30 20:39 . 2006-12-31 02:52
    d
    w- c:\program files\Warcraft III
    2009-07-28 23:42 . 2007-02-23 09:26
    d
    w- c:\program files\Java
    2009-07-03 05:56 . 2009-07-03 05:55
    d
    w- c:\program files\NCSoft
    2009-07-03 05:55 . 2006-11-19 06:35
    d--h--w- c:\program files\InstallShield Installation Information
    2009-06-30 17:55 . 2009-06-30 17:55
    d
    w- c:\program files\Trend Micro
    2009-06-30 04:59 . 2009-06-29 19:40
    d
    w- c:\documents and settings\All Users\Application Data\13136564
    2009-06-29 19:59 . 2007-04-04 07:35
    d
    w- c:\program files\ESET
    2009-06-26 16:18 . 2004-08-03 22:56 659456 ----a-w- c:\windows\system32\wininet.dll
    2009-06-26 16:18 . 2004-08-03 22:56 81920 ----a-w- c:\windows\system32\ieencode.dll
    2009-06-16 14:55 . 2004-08-03 22:56 119808 ----a-w- c:\windows\system32\t2embed.dll
    2009-06-16 14:55 . 2001-08-23 11:00 82432 ----a-w- c:\windows\system32\fontsub.dll
    2009-06-10 21:32 . 2009-06-06 18:30
    d
    w- c:\program files\Bodog Poker
    2009-06-06 18:35 . 2009-06-06 18:35 19296 ----a-w- c:\documents and settings\Administrator.ROBIN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-06-04 19:43 . 2008-06-05 20:56
    d
    w- c:\program files\Full Tilt Poker
    2009-06-03 19:27 . 2004-08-03 22:56 1290752 ----a-w- c:\windows\system32\quartz.dll
    2009-05-07 15:44 . 2004-08-03 22:56 344064 ----a-w- c:\windows\system32\localspl.dll
    2009-07-26 08:12 . 2009-01-15 23:58 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
    .
    Sigcheck

    [-] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\termsrv.dll
    [-] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\termsrv.dll
    [-] 2008-09-11 06:22 295424 40FFC19A8D4875E9E19CECDC76EF9201 c:\windows\system32\termsrv.dll
    [7] 2004-08-03 22:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\windows\system32\dllcache\termsrv.dll
    .
    ((((((((((((((((((((((((((((( SnapShot@2009-06-30_18.14.29 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-07-12 00:41 . 2009-07-12 00:41 97280 c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.dll
    + 2009-08-01 08:11 . 2009-08-01 08:11 16384 c:\windows\temp\Perflib_Perfdata_69c.dat
    + 2009-07-06 09:05 . 2006-07-28 14:30 62744 c:\windows\system32\xinput1_2.dll
    + 2009-07-06 09:05 . 2007-03-05 17:42 15128 c:\windows\system32\x3daudio1_1.dll
    - 2006-11-19 06:38 . 2008-07-09 07:38 17272 c:\windows\system32\spmsg.dll
    + 2006-11-19 06:38 . 2009-05-26 11:40 17272 c:\windows\system32\spmsg.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 39424 c:\windows\system32\pngfilt.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 39424 c:\windows\system32\pngfilt.dll
    + 2001-08-23 11:00 . 2009-07-03 05:55 58596 c:\windows\system32\perfc009.dat
    + 2005-09-23 12:28 . 2005-09-23 12:28 32768 c:\windows\system32\netfxperf.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 74240 c:\windows\system32\mscories.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 16384 c:\windows\system32\jsproxy.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 16384 c:\windows\system32\jsproxy.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 96256 c:\windows\system32\inseng.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 96256 c:\windows\system32\inseng.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 55808 c:\windows\system32\extmgr.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 55808 c:\windows\system32\extmgr.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 39424 c:\windows\system32\dllcache\pngfilt.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 39424 c:\windows\system32\dllcache\pngfilt.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 16384 c:\windows\system32\dllcache\jsproxy.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 16384 c:\windows\system32\dllcache\jsproxy.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 96256 c:\windows\system32\dllcache\inseng.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 96256 c:\windows\system32\dllcache\inseng.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 81920 c:\windows\system32\dllcache\ieencode.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 81920 c:\windows\system32\dllcache\ieencode.dll
    + 2006-11-19 03:49 . 2009-06-22 11:38 18432 c:\windows\system32\dllcache\iedw.exe
    - 2006-11-19 03:49 . 2009-04-27 09:17 18432 c:\windows\system32\dllcache\iedw.exe
    + 2001-08-23 11:00 . 2009-06-16 14:55 82432 c:\windows\system32\dllcache\fontsub.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 55808 c:\windows\system32\dllcache\extmgr.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 55808 c:\windows\system32\dllcache\extmgr.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 83456 c:\windows\system32\dfshim.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 28160 c:\windows\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 71680 c:\windows\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL
    + 2005-09-23 12:28 . 2005-09-23 12:28 86016 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 47616 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 85504 c:\windows\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 59072 c:\windows\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 32768 c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 53248 c:\windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 78336 c:\windows\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 14848 c:\windows\Microsoft.NET\Framework\v2.0.50727\normalization.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 96440 c:\windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
    + 2005-09-23 12:29 . 2005-09-23 12:29 22528 c:\windows\Microsoft.NET\Framework\v2.0.50727\MUI\0409\mscorsecr.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 10240 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscortim.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 66240 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 67072 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 81408 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorld.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 73216 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 69632 c:\windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 87552 c:\windows\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 12800 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 32768 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 73728 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll
    + 2005-09-23 11:36 . 2005-09-23 11:36 85504 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.3082.dll
    + 2005-09-23 11:29 . 2005-09-23 11:29 80896 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.3076.dll
    + 2005-09-23 11:47 . 2005-09-23 11:47 84480 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.2070.dll
    + 2005-09-23 11:30 . 2005-09-23 11:30 80896 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.2052.dll
    + 2005-09-23 11:47 . 2005-09-23 11:47 80896 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1055.dll
    + 2005-09-23 11:47 . 2005-09-23 11:47 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1053.dll
    + 2005-09-23 11:47 . 2005-09-23 11:47 82432 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1049.dll
    + 2005-09-23 11:47 . 2005-09-23 11:47 82432 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1046.dll
    + 2005-09-23 11:46 . 2005-09-23 11:46 83456 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1045.dll
    + 2005-09-23 11:46 . 2005-09-23 11:46 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1044.dll
    + 2005-09-23 11:46 . 2005-09-23 11:46 83456 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1043.dll
    + 2005-09-23 11:44 . 2005-09-23 11:44 80896 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1042.dll
    + 2005-09-23 11:42 . 2005-09-23 11:42 80896 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1041.dll
    + 2005-09-23 11:40 . 2005-09-23 11:40 84480 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1040.dll
    + 2005-09-23 11:40 . 2005-09-23 11:40 83968 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1038.dll
    + 2005-09-23 11:40 . 2005-09-23 11:40 80896 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1037.dll
    + 2005-09-23 11:38 . 2005-09-23 11:38 86016 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1036.dll
    + 2005-09-23 11:38 . 2005-09-23 11:38 81408 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1035.dll
    + 2005-09-23 08:46 . 2005-09-23 08:46 80896 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1033.dll
    + 2005-09-23 11:36 . 2005-09-23 11:36 87552 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1032.dll
    + 2005-09-23 11:34 . 2005-09-23 11:34 85504 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1031.dll
    + 2005-09-23 11:34 . 2005-09-23 11:34 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1030.dll
    + 2005-09-23 11:34 . 2005-09-23 11:34 82944 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1029.dll
    + 2005-09-23 11:32 . 2005-09-23 11:32 80896 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1028.dll
    + 2005-09-23 11:29 . 2005-09-23 11:29 80896 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1025.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 40960 c:\windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 72192 c:\windows\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 55296 c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEHost.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 52736 c:\windows\Microsoft.NET\Framework\v2.0.50727\dfdll.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 31936 c:\windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 68608 c:\windows\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 17920 c:\windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 13312 c:\windows\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 76984 c:\windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 88576 c:\windows\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 29888 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 29896 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 26824 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 13824 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 70656 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 23552 c:\windows\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 10752 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 55488 c:\windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 87552 c:\windows\Microsoft.NET\Framework\v2.0.50727\alink.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 10752 c:\windows\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 18944 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 86528 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 72704 c:\windows\Microsoft.NET\Framework\NETFXSBS10.exe
    + 2009-07-06 09:05 . 2005-03-18 21:23 12800 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.dll
    + 2009-07-06 09:05 . 2005-03-18 21:23 53248 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.dll
    - 2009-06-30 05:17 . 2009-06-30 05:17 10134 c:\windows\Installer\{CDF97135-7FD2-4289-96B8-DD4505267ACD}\callmsi.exe
    + 2009-08-01 08:17 . 2009-08-01 08:17 10134 c:\windows\Installer\{CDF97135-7FD2-4289-96B8-DD4505267ACD}\callmsi.exe
    + 2009-07-03 07:41 . 2009-07-03 07:41 81920 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\fd3b434f71b4a542bcc6dad508174300\Microsoft.Build.Framework.ni.dll
    + 2009-07-03 07:41 . 2009-07-03 07:41 15360 c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\abbf412321fd304e8a3f0ac10ce5119a\dfsvc.ni.exe
    + 2009-07-03 07:41 . 2009-07-03 07:41 26624 c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\607401ccf243934c8dce3d6125675cd5\Accessibility.ni.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 86016 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 73728 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 36864 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 68608 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
    + 2009-07-06 09:05 . 2009-07-06 09:05 12800 c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
    + 2009-07-06 09:05 . 2009-07-06 09:05 53248 c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 6144 c:\windows\system32\mui\0409\mscorees.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 7680 c:\windows\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 9216 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 7168 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 5632 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 5632 c:\windows\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 8192 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 9728 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 9216 c:\windows\Microsoft.NET\Framework\v2.0.50727\fusion.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 4608 c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 8192 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 4608 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 7680 c:\windows\Microsoft.NET\Framework\SharedReg12.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 7680 c:\windows\Microsoft.NET\Framework\sbscmp20_perfcounter.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 7680 c:\windows\Microsoft.NET\Framework\sbscmp20_mscorwks.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 7680 c:\windows\Microsoft.NET\Framework\sbscmp10.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 5120 c:\windows\Microsoft.NET\Framework\sbs_wminet_utils.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 5120 c:\windows\Microsoft.NET\Framework\sbs_VsaVb7rt.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 5120 c:\windows\Microsoft.NET\Framework\sbs_system.enterpriseservices.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 5120 c:\windows\Microsoft.NET\Framework\sbs_system.data.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 5120 c:\windows\Microsoft.NET\Framework\sbs_system.configuration.install.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 5120 c:\windows\Microsoft.NET\Framework\sbs_mscorsec.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 5120 c:\windows\Microsoft.NET\Framework\sbs_mscorrc.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 5120 c:\windows\Microsoft.NET\Framework\sbs_mscordbi.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 5632 c:\windows\Microsoft.NET\Framework\sbs_microsoft.vsa.vb.codedomprocessor.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 5120 c:\windows\Microsoft.NET\Framework\sbs_microsoft.jscript.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 5120 c:\windows\Microsoft.NET\Framework\sbs_iehost.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 5120 c:\windows\Microsoft.NET\Framework\sbs_diasymreader.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 5632 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 114176 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
    + 2006-09-13 08:44 . 2009-06-22 11:26 352768 c:\windows\system32\xpsp3res.dll
    + 2009-07-06 09:05 . 2007-01-24 20:27 255848 c:\windows\system32\xactengine2_6.dll
    + 2009-07-06 09:05 . 2006-12-08 17:02 251672 c:\windows\system32\xactengine2_5.dll
    + 2009-07-06 09:05 . 2006-09-28 21:05 237848 c:\windows\system32\xactengine2_4.dll
    + 2009-07-06 09:05 . 2006-07-28 14:30 236824 c:\windows\system32\xactengine2_3.dll
    + 2009-07-06 09:05 . 2006-05-31 12:24 230168 c:\windows\system32\xactengine2_2.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 616448 c:\windows\system32\urlmon.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 616448 c:\windows\system32\urlmon.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 474112 c:\windows\system32\shlwapi.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 474112 c:\windows\system32\shlwapi.dll
    + 2001-08-23 11:00 . 2009-07-03 05:55 392296 c:\windows\system32\perfh009.dat
    + 2004-08-03 22:56 . 2009-06-26 16:18 532480 c:\windows\system32\mstime.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 532480 c:\windows\system32\mstime.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 146432 c:\windows\system32\msrating.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 146432 c:\windows\system32\msrating.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 449024 c:\windows\system32\mshtmled.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 449024 c:\windows\system32\mshtmled.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 150016 c:\windows\system32\mscorier.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 270848 c:\windows\system32\mscoree.dll
    + 2009-07-28 23:43 . 2009-07-28 23:42 148888 c:\windows\system32\javaws.exe
    + 2009-07-28 23:43 . 2009-07-28 23:42 144792 c:\windows\system32\javaw.exe
    + 2009-07-28 23:43 . 2009-07-28 23:42 144792 c:\windows\system32\java.exe
    + 2004-08-03 22:56 . 2009-06-26 16:18 251392 c:\windows\system32\iepeers.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 251392 c:\windows\system32\iepeers.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 205312 c:\windows\system32\dxtrans.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 205312 c:\windows\system32\dxtrans.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 357888 c:\windows\system32\dxtmsft.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 357888 c:\windows\system32\dxtmsft.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 659456 c:\windows\system32\dllcache\wininet.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 659456 c:\windows\system32\dllcache\wininet.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 616448 c:\windows\system32\dllcache\urlmon.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 616448 c:\windows\system32\dllcache\urlmon.dll
    + 2004-08-03 22:56 . 2009-06-16 14:55 119808 c:\windows\system32\dllcache\t2embed.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 474112 c:\windows\system32\dllcache\shlwapi.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 474112 c:\windows\system32\dllcache\shlwapi.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 532480 c:\windows\system32\dllcache\mstime.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 532480 c:\windows\system32\dllcache\mstime.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 146432 c:\windows\system32\dllcache\msrating.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 146432 c:\windows\system32\dllcache\msrating.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 449024 c:\windows\system32\dllcache\mshtmled.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 449024 c:\windows\system32\dllcache\mshtmled.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 251392 c:\windows\system32\dllcache\iepeers.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 251392 c:\windows\system32\dllcache\iepeers.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 205312 c:\windows\system32\dllcache\dxtrans.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 205312 c:\windows\system32\dllcache\dxtrans.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 357888 c:\windows\system32\dllcache\dxtmsft.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 357888 c:\windows\system32\dllcache\dxtmsft.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 151040 c:\windows\system32\dllcache\cdfview.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 151040 c:\windows\system32\dllcache\cdfview.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 151040 c:\windows\system32\cdfview.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 151040 c:\windows\system32\cdfview.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 298496 c:\windows\Microsoft.NET\Framework\v2.0.50727\webengine.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 823296 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 835584 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 260096 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 114688 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Security.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 131072 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 299008 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 368640 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 114176 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 700416 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 188416 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 397312 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 884736 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 716800 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 482304 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 389120 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 110592 c:\windows\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 377344 c:\windows\Microsoft.NET\Framework\v2.0.50727\SOS.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 107520 c:\windows\Microsoft.NET\Framework\v2.0.50727\shfusion.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 136192 c:\windows\Microsoft.NET\Framework\v2.0.50727\peverify.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 226816 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 330752 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 102400 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 326144 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 288768 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 800768 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 667648 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 372736 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 110592 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 745472 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 647168 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 413696 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
    + 2005-09-23 12:57 . 2005-09-23 12:57 245408 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\unicows.dll
    + 2005-09-23 12:01 . 2005-09-23 12:01 609472 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 224952 c:\windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 788992 c:\windows\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 547840 c:\windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 106496 c:\windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 503808 c:\windows\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 106496 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 138240 c:\windows\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 208896 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 183808 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 136192 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll


    Here's part 1
  • Brooce
    edited August 2009
    Continuing...part 2

    16:27 578560 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2911.0\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:05 . 2006-02-03 12:40 578560 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2910.0\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:05 . 2005-12-05 22:20 577536 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:05 . 2005-09-28 19:11 577536 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:05 . 2005-07-22 22:21 577024 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:05 . 2005-05-26 20:15 576000 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:05 . 2005-03-18 22:23 567296 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:05 . 2005-02-06 00:32 563712 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:05 . 2005-03-18 21:23 223232 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.dll
    + 2009-07-06 09:05 . 2005-03-18 21:23 178176 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.dll
    + 2009-07-06 09:05 . 2005-03-18 21:23 364544 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectPlay.dll
    + 2009-07-06 09:05 . 2005-03-18 21:23 159232 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.dll
    + 2009-07-06 09:05 . 2005-03-18 21:23 145920 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.dll
    + 2009-07-06 09:05 . 2005-03-18 21:23 473600 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.dll
    + 2009-07-29 00:36 . 2009-07-29 00:36 248832 c:\windows\Installer\6c209f8.msi
    + 2009-07-28 23:42 . 2009-07-28 23:42 598016 c:\windows\Installer\6907625.msi
    + 2008-08-27 01:55 . 2008-08-27 01:55 176128 c:\windows\Installer\5b89c13.msi
    + 2008-08-27 01:53 . 2008-08-27 01:53 213504 c:\windows\Installer\5b89c0e.msi
    + 2007-11-20 21:08 . 2007-11-20 21:08 451584 c:\windows\Installer\33c5030.msi
    + 2008-01-28 07:51 . 2008-01-28 07:51 282624 c:\windows\Installer\2fa5f8.msi
    + 2006-11-19 04:39 . 2006-11-19 04:39 264704 c:\windows\Installer\29aa36.msi
    + 2007-02-23 09:26 . 2007-02-23 09:26 178176 c:\windows\Installer\2413ab11.msi
    + 2007-07-19 05:09 . 2007-07-19 05:09 282624 c:\windows\Installer\1c5c36.msi
    + 2008-02-18 04:31 . 2008-02-18 04:31 431616 c:\windows\Installer\1a4d6e0.msi
    + 2007-08-24 00:32 . 2007-08-24 00:32 506368 c:\windows\Installer\14211e9f.msi
    - 2009-06-30 05:17 . 2009-06-30 05:17 101480 c:\windows\Installer\{CDF97135-7FD2-4289-96B8-DD4505267ACD}\egui.exe
    + 2009-08-01 08:17 . 2009-08-01 08:17 101480 c:\windows\Installer\{CDF97135-7FD2-4289-96B8-DD4505267ACD}\egui.exe
    + 2009-07-03 07:42 . 2009-07-03 07:42 237568 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\49299580d0c43145922a6ec88530eba0\System.Web.RegularExpressions.ni.dll
    + 2009-07-03 07:42 . 2009-07-03 07:42 684032 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\0dc0e9907d8ca3418d8b6d0f4d62166f\System.Transactions.ni.dll
    + 2009-07-03 07:42 . 2009-07-03 07:42 729088 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\54bc57dc73a8aa4fb05d55a2ef2b3820\System.Security.ni.dll
    + 2009-07-03 07:42 . 2009-07-03 07:42 294912 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\aaeca20fac60b14da9bdaa0362a33bdb\System.EnterpriseServices.Wrapper.dll
    + 2009-07-03 07:42 . 2009-07-03 07:42 659456 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\aaeca20fac60b14da9bdaa0362a33bdb\System.EnterpriseServices.ni.dll
    + 2009-07-03 05:53 . 2009-07-03 05:53 229376 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\76c5e7268d3f8246b00e7bc0d5cfd86d\System.Drawing.Design.ni.dll
    + 2009-07-03 07:42 . 2009-07-03 07:42 512000 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\bdf32d7ab2086b468d47d4480f4873b9\System.DirectoryServices.Protocols.ni.dll
    + 2009-07-03 07:41 . 2009-07-03 07:41 962560 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\4bea0e72543882409d1edecdfbebe19d\System.Configuration.ni.dll
    + 2009-07-03 07:41 . 2009-07-03 07:41 163840 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\7462b537523558479c23abaf1771e567\Microsoft.Build.Utilities.ni.dll
    + 2009-07-03 07:41 . 2009-07-03 07:41 880640 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\854c454a9566ef48857e3cd80201fba8\Microsoft.Build.Engine.ni.dll
    + 2009-07-03 07:41 . 2009-07-03 07:41 237568 c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\1a5630546338fd4b99b9e0853968a484\CustomMarshalers.ni.dll
    + 2009-07-03 07:41 . 2009-07-03 07:41 860160 c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\0ab51cadc4bf3241aa44b734a048a022\AspNetMMCExt.ni.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 823296 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 299008 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 368640 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 700416 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 397312 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 884736 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 716800 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 389120 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 667648 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 745472 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 647168 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 413696 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 503808 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 260096 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 114176 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 258048 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 482304 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
    + 2009-07-06 09:05 . 2009-07-06 09:05 223232 c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
    + 2009-07-06 09:05 . 2009-07-06 09:05 178176 c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
    + 2009-07-06 09:05 . 2009-07-06 09:05 364544 c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
    + 2009-07-06 09:05 . 2009-07-06 09:05 159232 c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
    + 2009-07-06 09:05 . 2009-07-06 09:05 145920 c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
    + 2009-07-06 09:05 . 2009-07-06 09:05 578560 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:05 . 2009-07-06 09:05 578560 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:05 . 2009-07-06 09:05 577536 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:05 . 2009-07-06 09:05 577536 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:05 . 2009-07-06 09:05 577024 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:05 . 2009-07-06 09:05 576000 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:05 . 2009-07-06 09:05 567296 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:05 . 2009-07-06 09:05 563712 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:05 . 2009-07-06 09:05 473600 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
    + 2004-07-17 09:35 . 2004-07-17 09:35 1326080 c:\windows\system32\webfldrs.msi
    + 2004-08-03 22:56 . 2009-07-18 16:20 1506304 c:\windows\system32\shdocvw.dll
    + 2004-08-03 22:56 . 2009-07-18 16:20 3062272 c:\windows\system32\mshtml.dll
    + 2004-08-03 22:56 . 2009-07-18 16:20 1506304 c:\windows\system32\dllcache\shdocvw.dll
    + 2004-08-03 22:56 . 2009-06-03 19:27 1290752 c:\windows\system32\dllcache\quartz.dll
    + 2004-08-03 22:56 . 2009-07-18 16:20 3062272 c:\windows\system32\dllcache\mshtml.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 1054208 c:\windows\system32\dllcache\danim.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 1054208 c:\windows\system32\dllcache\danim.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 1023488 c:\windows\system32\dllcache\browseui.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 1023488 c:\windows\system32\dllcache\browseui.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 1054208 c:\windows\system32\danim.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 1054208 c:\windows\system32\danim.dll
    + 2009-07-06 09:05 . 2006-11-29 18:06 3426072 c:\windows\system32\d3dx9_32.dll
    + 2009-07-06 09:05 . 2006-09-28 21:05 2414360 c:\windows\system32\d3dx9_31.dll
    - 2004-08-03 22:56 . 2009-04-29 04:52 1023488 c:\windows\system32\browseui.dll
    + 2004-08-03 22:56 . 2009-06-26 16:18 1023488 c:\windows\system32\browseui.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 1306624 c:\windows\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
    + 2005-09-23 12:29 . 2005-09-23 12:29 1140920 c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    + 2005-09-23 12:28 . 2005-09-23 12:28 2035712 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 5316608 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 5025792 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 3018752 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 5050368 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 2878976 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 5615616 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 4308992 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
    + 2005-09-23 12:28 . 2005-09-23 12:28 1144832 c:\windows\Microsoft.NET\Framework\v2.0.50727\cscomp.dll
    + 2009-07-06 09:05 . 2004-12-01 20:53 2846720 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:04 . 2004-09-29 17:38 2676224 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.dll
    + 2008-10-23 01:56 . 2008-10-23 01:56 4605440 c:\windows\Installer\f3a64e8.msi
    + 2008-08-27 01:53 . 2008-08-27 01:53 2863616 c:\windows\Installer\5b89c09.msi
    + 2008-08-27 01:51 . 2008-08-27 01:51 2628096 c:\windows\Installer\5b89c04.msi
    + 2009-08-01 08:17 . 2009-08-01 08:17 1117184 c:\windows\Installer\3f91a.msi
    + 2009-07-03 05:51 . 2009-07-03 05:51 2109440 c:\windows\Installer\2b3df76.msi
    + 2006-11-19 17:00 . 2006-11-19 17:00 3282432 c:\windows\Installer\22bfd62.msi
    + 2008-10-16 02:33 . 2008-10-16 02:33 8990208 c:\windows\Installer\17179d8.msi
    + 2008-10-16 02:31 . 2008-10-16 02:31 1549312 c:\windows\Installer\17179d4.msi
    + 2009-07-03 05:53 . 2009-07-03 05:53 8093696 c:\windows\assembly\NativeImages_v2.0.50727_32\System\a978291f343f3840acbf56cf7979e788\System.ni.dll
    + 2009-07-03 05:54 . 2009-07-03 05:54 5640192 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\2ecab25117991e439a85da4f94f81092\System.Xml.ni.dll
    + 2009-07-03 07:42 . 2009-07-03 07:42 1945600 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\eefdbfeeafc48644940c046418806047\System.Web.Services.ni.dll
    + 2009-07-03 07:42 . 2009-07-03 07:42 2310144 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\5fd422f61f6a8b448dcb72d3c5d9905c\System.Web.Mobile.ni.dll
    + 2009-07-03 05:53 . 2009-07-03 05:53 1626112 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\4161d20be650db4585d2ec9c553c412f\System.Drawing.ni.dll
    + 2009-07-03 07:42 . 2009-07-03 07:42 1220608 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\64b3dc62732d514fbce58ebbefab7649\System.DirectoryServices.ni.dll
    + 2009-07-03 07:41 . 2009-07-03 07:41 1712128 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\fd691404eded51468dac716ae1e01980\System.Deployment.ni.dll
    + 2009-07-03 05:54 . 2009-07-03 05:54 6688768 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\89db9fb8a909924ca88b1a13804dbed8\System.Data.ni.dll
    + 2009-07-03 07:41 . 2009-07-03 07:41 1724416 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\0fc147a184f33747a60b5a5b79aaf2a3\Microsoft.VisualBasic.ni.dll
    + 2009-07-03 07:41 . 2009-07-03 07:41 1691648 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\6406f0c9740bfd4bab6c248452805636\Microsoft.Build.Tasks.ni.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 3018752 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 2035712 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 5316608 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 5050368 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
    + 2009-07-03 05:50 . 2009-07-03 05:50 5025792 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 2878976 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
    + 2009-07-03 05:51 . 2009-07-03 05:51 4308992 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
    + 2009-07-06 09:05 . 2009-07-06 09:05 2846720 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-07-06 09:04 . 2009-07-06 09:04 2676224 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2006-11-24 01:44 . 2009-07-07 15:10 24539592 c:\windows\system32\MRT.exe
    + 2005-09-23 12:48 . 2005-09-23 12:48 24863744 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\netfx.msi
    + 2008-10-23 01:55 . 2008-10-23 01:55 15014912 c:\windows\Downloaded Installations\{BB1F9BC3-F3C9-499B-BDEA-C2A672A4F8D9}\WN111v2.msi
    + 2009-07-03 05:53 . 2009-07-03 05:54 13107200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ab3c6e9c55d83e409caa6442f174e256\System.Windows.Forms.ni.dll
    + 2009-07-03 07:42 . 2009-07-03 07:42 11808768 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\9aa1b5724d39084b8a7c708abbca16ef\System.Web.ni.dll
    + 2009-07-03 05:55 . 2009-07-03 05:55 10723328 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\6da35cf91e3d0a4eabeed79fcc081fa3\System.Design.ni.dll
    + 2009-07-03 05:52 . 2009-07-03 05:52 11415552 c:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\4df8bfbd92c95e4781a263be5c0ccd05\mscorlib.ni.dll
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
    "NCsoft Launcher"="c:\program files\ncsoft\launcher\NCLauncher.exe" [2009-07-22 38184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
    "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
    "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
    "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-28 148888]
    "WinampAgent"="c:\program files\Winamp3\winampa.exe" [2002-07-23 12288]
    "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
    "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400]
    "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-01-15 1657376]
    "High Definition Audio Property Page Shortcut"="HDAShCut.exe" - c:\windows\system32\HdAShCut.exe [2004-10-27 61952]
    "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-04-11 56080]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-04-11 56080]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-8-26 692224]
    NETGEAR WN111v2 Smart Wizard.lnk - c:\program files\NETGEAR\WN111v2\WN111V2.exe [2008-5-9 1474631]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    "FirewallOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\AIM\\aim.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-1.12.0.5595-to-1.12.1.5875-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
    "c:\\Program Files\\World of Warcraft\\Launcher.exe"=
    "c:\\Program Files\\Ubisoft\\Heroes of Might and Magic V\\bin\\H5_Game.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\WINDOWS\\system32\\dpvsetup.exe"=
    "c:\\Program Files\\Participatory Culture Foundation\\Miro\\Miro_Downloader.exe"=
    "c:\\Program Files\\Diablo II\\Diablo II.exe"=
    "c:\\Program Files\\Ubisoft\\Heroes of Might and Magic V\\bina1\\H5_Game.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-2.3.3.7799-to-2.4.0.8089-enUS-downloader.exe"=
    "c:\\Program Files\\Bodog Poker\\BPGame.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3724:TCP"= 3724:TCP:Wow
    "6112:TCP"= 6112:TCP:Wc3
    "6119:TCP"= 6119:TCP:blizz
    "6113:TCP"= 6113:TCP:blizz

    R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2/6/2009 2:23 PM 106208]
    R1 EncorMpd;EncorMpd;c:\windows\system32\drivers\ENCORMPD.SYS [12/28/2006 11:25 PM 35488]
    R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2/6/2009 2:24 PM 93336]
    R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2/6/2009 2:23 PM 727720]
    R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [7/24/2003 12:10 PM 17149]
    R3 JSWSCIMD;jswscimd Service;c:\windows\system32\drivers\jswscimd.sys [2/12/2008 6:05 PM 57440]
    R3 WSIMD;wsimd Service;c:\windows\system32\drivers\wsimd.sys [12/14/2007 4:31 AM 57408]
    S1 EncorDev;EncorDev;c:\windows\system32\drivers\ENCORDEV.SYS [12/28/2006 11:25 PM 9440]
    S3 A5AGU;D-Link USB Wireless Network Adapter Service;c:\windows\system32\drivers\A5AGU.sys [7/25/2005 11:32 PM 377920]
    S3 ATHFMWDL;D-Link predator Bootloader driver;c:\windows\system32\drivers\ATHFMWDL.sys [7/25/2005 11:35 PM 43392]
    S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\NETGEAR\WN111v2\jswpsapi.exe [2/27/2008 11:54 AM 360547]
    S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [8/2/2005 4:10 PM 32512]
    S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
    S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\DRIVERS\rt2870.sys --> c:\windows\system32\DRIVERS\rt2870.sys [?]
    S3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\system32\drivers\WN111v2.sys [5/31/2008 2:46 PM 434688]
    S3 XDva064;XDva064;\??\c:\windows\system32\XDva064.sys --> c:\windows\system32\XDva064.sys [?]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - EKRN
    *Deregistered* - project
    .
    Contents of the 'Scheduled Tasks' folder

    2009-08-01 c:\windows\Tasks\WGASetup.job
    - c:\windows\system32\KB905474\wgasetup.exe [2009-04-29 03:18]
    .
    - - - - ORPHANS REMOVED - - - -

    ShellExecuteHooks-{4DEC9B29-F08F-4cbc-B179-592B9283FAC7} - (no file)
    ShellExecuteHooks-{4DEC9B29-F08F-4cbc-B179-592B9283FAB1} - (no file)
    ShellExecuteHooks-{4DEC9B29-F08F-4cbc-B179-592B9283FAB0} - (no file)
    ShellExecuteHooks-{05397E9D-30D1-4216-AACB-F9EA1F1E4E85} - (no file)


    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.google.com/
    FF - ProfilePath - c:\documents and settings\Bruce\Application Data\Mozilla\Firefox\Profiles\9jqgccvx.default\
    FF - plugin: c:\documents and settings\Bruce\Application Data\Mozilla\Firefox\Profiles\9jqgccvx.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll
    FF - plugin: c:\documents and settings\Bruce\Application Data\Mozilla\plugins\npoctoshape.dll
    FF - plugin: c:\program files\Octoshape Streaming Services\Bruce\octoprogram-L03-NMS0806110_SUA_900\npoctoshape.dll
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-01 03:43
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\npggsvc]
    "ImagePath"="c:\windows\system32\GameMon.des -service"
    .
    Completion time: 2009-08-01 3:46
    ComboFix-quarantined-files.txt 2009-08-01 08:46
    ComboFix2.txt 2009-07-01 05:56
    ComboFix3.txt 2009-06-30 20:00
    ComboFix4.txt 2009-06-30 19:01
    ComboFix5.txt 2009-08-01 08:36

    Pre-Run: 45,214,449,664 bytes free
    Post-Run: 47,336,087,552 bytes free

    630 --- E O F --- 2009-07-29 00:39

    Now i'm going to do the RSIT log shortly
  • Brooce
    edited August 2009
    Here's the RSIT logs for last 2 months

    Logfile of random's system information tool 1.06 (written by random/random)
    Run by Bruce at 2009-08-01 03:55:07
    Microsoft Windows XP Professional Service Pack 2
    System drive C: has 45 GB (24%) free of 191 GB
    Total RAM: 2047 MB (75% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 3:55:11 AM, on 8/1/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\acs.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\WgaTray.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Winamp3\winampa.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\NETGEAR\WN111v2\WN111V2.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
    C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Bruce\Desktop\RSIT.exe
    C:\Program Files\Trend Micro\HijackThis\Bruce.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [NCsoft Launcher] C:\program files\ncsoft\launcher\NCLauncher.exe /Minimized
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: NETGEAR WN111v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WN111v2\WN111V2.exe
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1163919092359
    O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
    O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
    O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\NETGEAR\WN111v2\jswpsapi.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

    --
    End of file - 5763 bytes

    ======Scheduled tasks folder======

    C:\WINDOWS\tasks\WGASetup.job

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 63128]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
    Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-28 35840]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
    JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-28 73728]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "IMJPMIG8.1"=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2004-08-03 208952]
    "PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-03 455168]
    "PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-03 455168]
    "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-01-15 13680640]
    "nwiz"=nwiz.exe /install []
    "High Definition Audio Property Page Shortcut"=C:\WINDOWS\system32\HDAShCut.exe [2004-10-27 61952]
    "NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2006-01-12 155648]
    "DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2006-11-12 157592]
    "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-07-28 148888]
    "WinampAgent"=C:\Program Files\Winamp3\winampa.exe [2002-07-23 12288]
    "SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2005-05-20 925696]
    "Logitech Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2007-04-11 56080]
    "Kernel and Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2007-04-11 56080]
    "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
    "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-01-15 86016]
    "egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2009-02-06 2021400]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-10-13 1694208]
    "NCsoft Launcher"=C:\program files\ncsoft\launcher\NCLauncher.exe [2009-07-22 38184]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lphcjgmj0en1v]
    C:\WINDOWS\system32\lphcjgmj0en1v.exe []

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe
    NETGEAR WN111v2 Smart Wizard.lnk - C:\Program Files\NETGEAR\WN111v2\WN111V2.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
    C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername"=0
    "legalnoticecaption"=
    "legalnoticetext"=
    "shutdownwithoutlogon"=1
    "undockwithoutlogon"=1

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveTypeAutoRun"=323
    "NoDriveAutoRun"=67108863
    "NoDrives"=0

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "HonorAutoRunSetting"=
    "NoDriveAutoRun"=
    "NoDriveTypeAutoRun"=
    "NoDrives"=

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "C:\Program Files\AIM\aim.exe"="C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger"
    "C:\Program Files\World of Warcraft\WoW-1.12.0-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-1.12.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\Program Files\World of Warcraft\WoW-1.12.0.5595-to-1.12.1.5875-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-1.12.0.5595-to-1.12.1.5875-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\Program Files\World of Warcraft\BackgroundDownloader.exe"="C:\Program Files\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
    "C:\Program Files\World of Warcraft\Launcher.exe"="C:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:World of Warcraft"
    "C:\Program Files\Ubisoft\Heroes of Might and Magic V\bin\H5_Game.exe"="C:\Program Files\Ubisoft\Heroes of Might and Magic V\bin\H5_Game.exe:*:Enabled:Heroes of Might and Magic V"
    "C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
    "C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
    "C:\Program Files\Participatory Culture Foundation\Miro\Miro_Downloader.exe"="C:\Program Files\Participatory Culture Foundation\Miro\Miro_Downloader.exe:*:Enabled:Miro_Downloader"
    "C:\Program Files\Diablo II\Diablo II.exe"="C:\Program Files\Diablo II\Diablo II.exe:*:Enabled:Diablo II - Lord of Destruction"
    "C:\Program Files\Ubisoft\Heroes of Might and Magic V\bina1\H5_Game.exe"="C:\Program Files\Ubisoft\Heroes of Might and Magic V\bina1\H5_Game.exe:*:Enabled:Heroes of Might and Magic V: Hammers of Fate"
    "C:\Program Files\World of Warcraft\WoW-2.3.3.7799-to-2.4.0.8089-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-2.3.3.7799-to-2.4.0.8089-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
    "C:\Program Files\Bodog Poker\BPGame.exe"="C:\Program Files\Bodog Poker\BPGame.exe:*:Enabled:Bodog Poker"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

    ======List of files/folders created in the last 2 months======

    2009-08-01 03:55:07 ----D---- C:\rsit
    2009-08-01 03:46:48 ----A---- C:\ComboFix.txt
    2009-08-01 03:35:57 ----A---- C:\WINDOWS\zip.exe
    2009-08-01 03:35:57 ----A---- C:\WINDOWS\SWXCACLS.exe
    2009-08-01 03:35:57 ----A---- C:\WINDOWS\SWSC.exe
    2009-08-01 03:35:57 ----A---- C:\WINDOWS\SWREG.exe
    2009-08-01 03:35:57 ----A---- C:\WINDOWS\sed.exe
    2009-08-01 03:35:57 ----A---- C:\WINDOWS\PEV.exe
    2009-08-01 03:35:57 ----A---- C:\WINDOWS\grep.exe
    2009-08-01 03:35:53 ----SD---- C:\ComboFix
    2009-08-01 03:17:07 ----D---- C:\WINDOWS\LastGood
    2009-08-01 02:18:09 ----D---- C:\Program Files\Diablo II
    2009-07-30 15:49:33 ----D---- C:\Program Files\softnyx
    2009-07-28 19:38:02 ----HDC---- C:\WINDOWS\$NtUninstallKB972260$
    2009-07-28 18:43:40 ----A---- C:\WINDOWS\system32\javaws.exe
    2009-07-28 18:43:40 ----A---- C:\WINDOWS\system32\javaw.exe
    2009-07-28 18:43:40 ----A---- C:\WINDOWS\system32\deploytk.dll
    2009-07-28 18:43:39 ----A---- C:\WINDOWS\system32\java.exe
    2009-07-15 03:06:04 ----HDC---- C:\WINDOWS\$NtUninstallKB973346$
    2009-07-15 03:05:42 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
    2009-07-15 03:01:09 ----HDC---- C:\WINDOWS\$NtUninstallKB961371$
    2009-07-06 04:27:13 ----D---- C:\Program Files\Common Files\INCA Shared
    2009-07-06 04:12:12 ----A---- C:\WINDOWS\system32\d3dx10_41.dll
    2009-07-06 04:12:12 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll
    2009-07-06 04:12:06 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
    2009-07-06 04:11:56 ----A---- C:\WINDOWS\system32\XAudio2_4.dll
    2009-07-06 04:11:56 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll
    2009-07-06 04:11:50 ----A---- C:\WINDOWS\system32\xactengine3_4.dll
    2009-07-06 04:11:42 ----A---- C:\WINDOWS\system32\X3DAudio1_6.dll
    2009-07-06 04:11:32 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
    2009-07-06 04:11:32 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
    2009-07-06 04:11:24 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
    2009-07-06 04:11:11 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
    2009-07-06 04:11:11 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
    2009-07-06 04:11:02 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
    2009-07-06 04:10:54 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
    2009-07-06 04:10:41 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
    2009-07-06 04:10:41 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
    2009-07-06 04:10:30 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
    2009-07-06 04:10:15 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
    2009-07-06 04:10:15 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
    2009-07-06 04:10:04 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
    2009-07-06 04:09:47 ----A---- C:\WINDOWS\system32\XAudio2_1.dll
    2009-07-06 04:09:47 ----A---- C:\WINDOWS\system32\XAPOFX1_0.dll
    2009-07-06 04:09:36 ----A---- C:\WINDOWS\system32\xactengine3_1.dll
    2009-07-06 04:09:25 ----A---- C:\WINDOWS\system32\X3DAudio1_4.dll
    2009-07-06 04:09:12 ----A---- C:\WINDOWS\system32\d3dx10_38.dll
    2009-07-06 04:09:12 ----A---- C:\WINDOWS\system32\D3DCompiler_38.dll
    2009-07-06 04:09:03 ----A---- C:\WINDOWS\system32\D3DX9_38.dll
    2009-07-06 04:08:51 ----A---- C:\WINDOWS\system32\XAudio2_0.dll
    2009-07-06 04:08:39 ----A---- C:\WINDOWS\system32\xactengine3_0.dll
    2009-07-06 04:08:28 ----A---- C:\WINDOWS\system32\X3DAudio1_3.dll
    2009-07-06 04:08:12 ----A---- C:\WINDOWS\system32\d3dx10_37.dll
    2009-07-06 04:08:12 ----A---- C:\WINDOWS\system32\D3DCompiler_37.dll
    2009-07-06 04:08:00 ----A---- C:\WINDOWS\system32\D3DX9_37.dll
    2009-07-06 04:07:50 ----A---- C:\WINDOWS\system32\xactengine2_10.dll
    2009-07-06 04:07:27 ----A---- C:\WINDOWS\system32\d3dx10_36.dll
    2009-07-06 04:07:27 ----A---- C:\WINDOWS\system32\D3DCompiler_36.dll
    2009-07-06 04:07:19 ----A---- C:\WINDOWS\system32\d3dx9_36.dll
    2009-07-06 04:07:09 ----A---- C:\WINDOWS\system32\xactengine2_9.dll
    2009-07-06 04:06:57 ----A---- C:\WINDOWS\system32\d3dx10_35.dll
    2009-07-06 04:06:57 ----A---- C:\WINDOWS\system32\D3DCompiler_35.dll
    2009-07-06 04:06:51 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
    2009-07-06 04:06:42 ----A---- C:\WINDOWS\system32\xactengine2_8.dll
    2009-07-06 04:06:42 ----A---- C:\WINDOWS\system32\X3DAudio1_2.dll
    2009-07-06 04:06:33 ----A---- C:\WINDOWS\system32\d3dx10_34.dll
    2009-07-06 04:06:33 ----A---- C:\WINDOWS\system32\D3DCompiler_34.dll
    2009-07-06 04:06:27 ----A---- C:\WINDOWS\system32\d3dx9_34.dll
    2009-07-06 04:06:21 ----A---- C:\WINDOWS\system32\xinput1_3.dll
    2009-07-06 04:06:11 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
    2009-07-06 04:05:59 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
    2009-07-06 04:05:59 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
    2009-07-06 04:05:43 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
    2009-07-06 04:05:41 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
    2009-07-06 04:05:39 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
    2009-07-06 04:05:38 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
    2009-07-06 04:05:36 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
    2009-07-06 04:05:36 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
    2009-07-06 04:05:36 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
    2009-07-06 04:05:34 ----A---- C:\WINDOWS\system32\xinput1_2.dll
    2009-07-06 04:05:34 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
    2009-07-06 04:05:31 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
    2009-07-06 04:03:50 ----D---- C:\WINDOWS\Logs
    2009-07-03 00:55:40 ----D---- C:\Program Files\NCSoft
    2009-07-03 00:50:32 ----RSD---- C:\WINDOWS\assembly
    2009-07-03 00:49:01 ----D---- C:\WINDOWS\Microsoft.NET
    2009-07-03 00:42:33 ----D---- C:\Documents and Settings\Bruce\Application Data\GetRightToGo
    2009-07-01 00:56:56 ----D---- C:\WINDOWS\temp
    2009-06-30 13:03:27 ----A---- C:\Boot.bak
    2009-06-30 13:03:14 ----RASHD---- C:\cmdcons
    2009-06-30 13:01:41 ----A---- C:\WINDOWS\NIRCMD.exe
    2009-06-30 13:01:36 ----D---- C:\WINDOWS\ERDNT
    2009-06-30 13:01:31 ----D---- C:\Qoobox
    2009-06-30 12:55:20 ----D---- C:\Program Files\Trend Micro
    2009-06-29 23:58:22 ----D---- C:\Config.Msi
    2009-06-29 19:46:13 ----D---- C:\WINDOWS\system32\GroupPolicy
    2009-06-29 18:50:06 ----D---- C:\WINDOWS\pss
    2009-06-29 14:40:15 ----D---- C:\Documents and Settings\All Users\Application Data\13136564
    2009-06-12 03:08:05 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
    2009-06-12 03:06:59 ----HDC---- C:\WINDOWS\$NtUninstallKB969897$
    2009-06-12 03:06:46 ----HDC---- C:\WINDOWS\$NtUninstallKB969898$
    2009-06-12 03:01:33 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
    2009-06-12 03:01:09 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
    2009-06-06 13:30:58 ----D---- C:\Program Files\Bodog Poker

    ======List of files/folders modified in the last 2 months======

    2009-08-01 03:49:31 ----D---- C:\Program Files\Mozilla Firefox
    2009-08-01 03:46:51 ----D---- C:\WINDOWS\system32
    2009-08-01 03:43:57 ----D---- C:\WINDOWS
    2009-08-01 03:43:57 ----A---- C:\WINDOWS\system.ini
    2009-08-01 03:43:03 ----SHD---- C:\WINDOWS\Installer
    2009-08-01 03:41:16 ----D---- C:\WINDOWS\system32\drivers
    2009-08-01 03:41:15 ----D---- C:\WINDOWS\AppPatch
    2009-08-01 03:41:00 ----D---- C:\Program Files\Common Files
    2009-08-01 03:36:13 ----A---- C:\WINDOWS\SchedLgU.Txt
    2009-08-01 03:17:19 ----HD---- C:\WINDOWS\inf
    2009-08-01 03:17:06 ----D---- C:\WINDOWS\system32\CatRoot2
    2009-08-01 03:07:35 ----A---- C:\WINDOWS\NeroDigital.ini
    2009-08-01 02:46:00 ----D---- C:\Program Files\Diablo 2
    2009-08-01 02:41:29 ----AT---- C:\WINDOWS\system32\SIntfNT.dll
    2009-08-01 02:41:29 ----AT---- C:\WINDOWS\system32\SIntf32.dll
    2009-08-01 02:41:29 ----AT---- C:\WINDOWS\system32\SIntf16.dll
    2009-08-01 02:26:35 ----A---- C:\WINDOWS\DIIUnin.exe
    2009-08-01 02:18:09 ----RD---- C:\Program Files
    2009-08-01 02:15:17 ----D---- C:\WINDOWS\Prefetch
    2009-08-01 02:14:32 ----A---- C:\WINDOWS\OEWABLog.txt
    2009-08-01 02:14:02 ----D---- C:\Documents and Settings
    2009-07-30 15:39:41 ----D---- C:\Program Files\Warcraft III
    2009-07-28 19:38:32 ----RSHDC---- C:\WINDOWS\system32\dllcache
    2009-07-28 19:38:28 ----D---- C:\Program Files\Internet Explorer
    2009-07-28 19:36:16 ----D---- C:\WINDOWS\WinSxS
    2009-07-28 18:42:28 ----D---- C:\Program Files\Java
    2009-07-28 14:43:37 ----HD---- C:\WINDOWS\$hf_mig$
    2009-07-19 00:46:40 ----RASH---- C:\boot.ini
    2009-07-19 00:46:39 ----A---- C:\WINDOWS\win.ini
    2009-07-18 11:20:31 ----A---- C:\WINDOWS\system32\shdocvw.dll
    2009-07-18 11:20:31 ----A---- C:\WINDOWS\system32\mshtml.dll
    2009-07-15 03:06:11 ----A---- C:\WINDOWS\imsins.BAK
    2009-07-07 10:10:56 ----A---- C:\WINDOWS\system32\MRT.exe
    2009-07-06 04:12:24 ----D---- C:\WINDOWS\system32\DirectX
    2009-07-03 00:56:10 ----SD---- C:\Documents and Settings\Bruce\Application Data\Microsoft
    2009-07-03 00:55:36 ----HD---- C:\Program Files\InstallShield Installation Information
    2009-07-03 00:55:13 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
    2009-07-03 00:49:42 ----D---- C:\Program Files\Common Files\Microsoft Shared
    2009-06-30 13:10:06 ----D---- C:\WINDOWS\system32\config
    2009-06-30 00:00:16 ----D---- C:\WINDOWS\system32\wbem
    2009-06-30 00:00:14 ----D---- C:\WINDOWS\Registration
    2009-06-29 23:57:51 ----D---- C:\WINDOWS\system32\Restore
    2009-06-29 14:59:25 ----D---- C:\Program Files\ESET
    2009-06-26 11:18:54 ----A---- C:\WINDOWS\system32\wininet.dll
    2009-06-26 11:18:54 ----A---- C:\WINDOWS\system32\urlmon.dll
    2009-06-26 11:18:54 ----A---- C:\WINDOWS\system32\shlwapi.dll
    2009-06-26 11:18:54 ----A---- C:\WINDOWS\system32\pngfilt.dll
    2009-06-26 11:18:54 ----A---- C:\WINDOWS\system32\mstime.dll
    2009-06-26 11:18:53 ----A---- C:\WINDOWS\system32\msrating.dll
    2009-06-26 11:18:53 ----A---- C:\WINDOWS\system32\mshtmled.dll
    2009-06-26 11:18:52 ----A---- C:\WINDOWS\system32\jsproxy.dll
    2009-06-26 11:18:52 ----A---- C:\WINDOWS\system32\inseng.dll
    2009-06-26 11:18:52 ----A---- C:\WINDOWS\system32\iepeers.dll
    2009-06-26 11:18:52 ----A---- C:\WINDOWS\system32\ieencode.dll
    2009-06-26 11:18:52 ----A---- C:\WINDOWS\system32\extmgr.dll
    2009-06-26 11:18:52 ----A---- C:\WINDOWS\system32\dxtrans.dll
    2009-06-26 11:18:52 ----A---- C:\WINDOWS\system32\dxtmsft.dll
    2009-06-26 11:18:52 ----A---- C:\WINDOWS\system32\danim.dll
    2009-06-26 11:18:51 ----A---- C:\WINDOWS\system32\cdfview.dll
    2009-06-26 11:18:51 ----A---- C:\WINDOWS\system32\browseui.dll
    2009-06-22 06:26:06 ----A---- C:\WINDOWS\system32\xpsp3res.dll
    2009-06-16 09:55:16 ----A---- C:\WINDOWS\system32\t2embed.dll
    2009-06-16 09:55:16 ----A---- C:\WINDOWS\system32\fontsub.dll
    2009-06-10 16:32:17 ----D---- C:\Temp
    2009-06-04 14:43:41 ----D---- C:\Program Files\Full Tilt Poker
    2009-06-03 14:27:58 ----A---- C:\WINDOWS\system32\quartz.dll

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-02-06 106208]
    R1 EncorMpd;EncorMpd; C:\WINDOWS\system32\Drivers\EncorMpd.sys [1999-04-13 35488]
    R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2009-02-06 93336]
    R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-03 36096]
    R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-02-06 113448]
    R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2005-09-15 141312]
    R3 AEAudioService;AEAudio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2005-03-04 127872]
    R3 catchme;catchme; \??\C:\DOCUME~1\Bruce\LOCALS~1\Temp\catchme.sys []
    R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\DNINDIS5.SYS []
    R3 E1000;Intel(R) PRO/1000 Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e1000325.sys [2004-11-22 176128]
    R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2004-10-27 138240]
    R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
    R3 JSWSCIMD;jswscimd Service; C:\WINDOWS\system32\DRIVERS\jswscimd.sys [2008-02-12 57440]
    R3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2007-04-11 20496]
    R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2007-04-11 34832]
    R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2007-04-11 36112]
    R3 LUsbFilt;Logitech SetPoint KMDF USB Filter; C:\WINDOWS\System32\Drivers\LUsbFilt.Sys [2007-04-11 28688]
    R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
    R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-01-15 6301248]
    R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2005-08-11 393088]
    R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
    R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
    R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
    R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
    R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
    R3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service; C:\WINDOWS\system32\DRIVERS\WN111v2.sys [2008-05-31 434688]
    R3 WSIMD;wsimd Service; C:\WINDOWS\system32\DRIVERS\wsimd.sys [2007-12-14 57408]
    S1 EncorDev;EncorDev; C:\WINDOWS\system32\Drivers\EncorDev.sys [1998-11-02 9440]
    S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-03 14848]
    S1 project; service tool ; C:\WINDOWS\System32\Drivers\register.sys [2001-11-28 1950]
    S2 npkcrypt;npkcrypt; \??\C:\Nexon\MapleStory\npkcrypt.sys []
    S3 A5AGU;D-Link USB Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\A5AGU.sys [2007-06-06 377920]
    S3 aa5akyde;aa5akyde; C:\WINDOWS\system32\drivers\aa5akyde.sys []
    S3 ATHFMWDL;D-Link predator Bootloader driver; C:\WINDOWS\System32\Drivers\ATHFMWDL.sys [2005-07-25 43392]
    S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\HdAudio.sys [2004-10-27 145920]
    S3 L8042mou;SetPoint PS/2 Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\L8042mou.Sys [2007-04-11 63248]
    S3 LMouKE;SetPoint Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouKE.Sys [2007-04-11 79376]
    S3 nm;Network Monitor Driver; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-03 40320]
    S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 32512]
    S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\rt2870.sys []
    S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
    S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
    S3 XDva064;XDva064; \??\C:\WINDOWS\system32\XDva064.sys []
    S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-23 12032]

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 ACS;Atheros Configuration Service; C:\WINDOWS\system32\acs.exe [2008-05-04 467029]
    R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-02-06 727720]
    R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-07-28 152984]
    R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-04-24 73728]
    R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-01-15 163908]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
    S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2009-02-06 20680]
    S3 jswpsapi;Jumpstart Wifi Protected Setup; C:\Program Files\NETGEAR\WN111v2\jswpsapi.exe [2008-02-27 360547]
    S3 npggsvc;nProtect GameGuard Service; C:\WINDOWS\system32\GameMon.des [2009-06-02 2862428]
    S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2005-08-02 86016]
    S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2004-08-03 14336]
    EOF

    Appreciate the help so far!
  • Brooce
    edited August 2009
    Here's the info.txt the previous post was of log.txt

    info.txt logfile of random's system information tool 1.06 2009-08-01 03:55:13

    ======Uninstall list======

    -->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
    -->C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
    -->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
    -->C:\WINDOWS\UNNMP.exe /UNINSTALL
    -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
    Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
    Adobe Reader 7.0.8-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70800000002}
    Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
    AOL Instant Messenger-->C:\Program Files\AIM\uninstll.exe -LOG= C:\Program Files\AIM\install.log -OEM=
    Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
    Badongo-->MsiExec.exe /X{9985ABB2-14F3-4825-B5AF-0EFB23F715CB}
    BitZip - Powered by Miro-->C:\Program Files\Participatory Culture Foundation\Miro\uninstall.exe
    Bodog Poker Version 2.16.4.10-->"C:\Program Files\Bodog Poker\unins000.exe"
    CDDRV_Installer-->MsiExec.exe /I{8CC990CD-87C8-475C-AC32-8A7984E2FCFA}
    Diablo II-->C:\WINDOWS\DIIUnin.exe C:\WINDOWS\DIIUnin.dat
    DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
    DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
    DivX Converter-->C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
    DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
    DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
    Full Tilt Poker-->"C:\Program Files\InstallShield Installation Information\{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}\setup.exe" -runfromtemp -l0x0009 -removeonly
    GunboundWC-->"C:\Program Files\softnyx\GunboundWC\unins000.exe"
    Heroes of Might & Magic V: Hammers of Fate-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4272516D-0E81-48EF-AB66-7F6E28B4A615}\setup.exe" -l0x9
    Heroes of Might and Magic V - Tribes of the East-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{66FF4C48-0083-4E60-8556-B883AB200092}\setup.exe" -l0x9
    Heroes of Might and Magic V-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{28101984-0BA6-40FD-9ABE-72F62F80C06C}\setup.exe" -l0x9
    High Definition Audio Driver Package - KB888111-->C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe
    HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
    Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
    Intel(R) PRO Network Connections Drivers-->Prounstl.exe
    J2SE Runtime Environment 5.0 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150030}
    Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
    Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
    Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
    KhalInstallWrapper-->MsiExec.exe /I{56918C0C-0D87-4CA6-92BF-4975A43AC719}
    LimeWire 4.12.11-->"C:\Program Files\LimeWire\uninstall.exe"
    Logitech Registration-->MsiExec.exe /I{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}
    Logitech SetPoint-->C:\Program Files\InstallShield Installation Information\{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}\setup.exe -runfromtemp -l0x0009 -removeonly
    Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
    Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
    Move Networks Player for Internet Explorer-->"C:\Documents and Settings\Bruce\Application Data\Move Networks\ie_bin\unins000.exe"
    Mozilla Firefox (3.0.12)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
    NCsoft Launcher-->C:\Program Files\InstallShield Installation Information\{5F8E2CBB-949D-4175-AC98-5ADE7F6C9697}\setup.exe -runfromtemp -l0x0009 -removeonly
    Nero Suite-->C:\Program Files\Common Files\Nero\Uninstall\setupx.exe /uninstall ExtraUninstallID=""
    NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
    PokerStars-->"C:\Program Files\PokerStars\PokerStarsUninstall.exe" /u:PokerStars
    PristonTale-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B5B4799D-4E8D-4DC6-9C50-060EE5F8AA9C}\Setup.exe" -l0x9
    QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
    RangeMax Wireless-N USB Adapter WN111v2-->C:\Program Files\InstallShield Installation Information\{1C0E9C6B-D4D5-4D3C-8A10-F10A3E7BEEA5}\setup.exe -runfromtemp -l0x0409
    Security Update for Windows Media Player (KB911564)-->"C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe"
    Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
    Security Update for Windows Media Player 6.4 (KB925398)-->"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
    Security Update for Windows Media Player 9 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe"
    Security Update for Windows Media Player 9 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP9$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB893756)-->"C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB896358)-->"C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB896423)-->"C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB896424)-->"C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB896428)-->"C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB899587)-->"C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB899591)-->"C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB900725)-->"C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB901017)-->"C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB901190)-->"C:\WINDOWS\$NtUninstallKB901190$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB901214)-->"C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB902400)-->"C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB904706)-->"C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB905414)-->"C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB905749)-->"C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB908519)-->"C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB911562)-->"C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB911567)-->"C:\WINDOWS\$NtUninstallKB911567$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB911927)-->"C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB912919)-->"C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB913580)-->"C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB914388)-->"C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB914389)-->"C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB917344)-->"C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB917422)-->"C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB917953)-->"C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB918118)-->"C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB918439)-->"C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB919007)-->"C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB920213)-->"C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB920214)-->"C:\WINDOWS\$NtUninstallKB920214$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB920670)-->"C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB920683)-->"C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB920685)-->"C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB921398)-->"C:\WINDOWS\$NtUninstallKB921398$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB921503)-->"C:\WINDOWS\$NtUninstallKB921503$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB922616)-->"C:\WINDOWS\$NtUninstallKB922616$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB922760)-->"C:\WINDOWS\$NtUninstallKB922760$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB922819)-->"C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB923191)-->"C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB923414)-->"C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB923694)-->"C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB923980)-->"C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB924191)-->"C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB924270)-->"C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB924496)-->"C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB924667)-->"C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB925454)-->"C:\WINDOWS\$NtUninstallKB925454$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB925486)-->"C:\WINDOWS\$NtUninstallKB925486$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB925902)-->"C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB926255)-->"C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB926436)-->"C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB927779)-->"C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB927802)-->"C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB928090)-->"C:\WINDOWS\$NtUninstallKB928090$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB928255)-->"C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB928843)-->"C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB929123)-->"C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB929969)-->"C:\WINDOWS\$NtUninstallKB929969$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB930178)-->"C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB931261)-->"C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB931768)-->"C:\WINDOWS\$NtUninstallKB931768$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB931784)-->"C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB932168)-->"C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB933566)-->"C:\WINDOWS\$NtUninstallKB933566$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB933729)-->"C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB935839)-->"C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB935840)-->"C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB936021)-->"C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB937143)-->"C:\WINDOWS\$NtUninstallKB937143$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB937894)-->"C:\WINDOWS\$NtUninstallKB937894$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB938127)-->"C:\WINDOWS\$NtUninstallKB938127$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB938829)-->"C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB939653)-->"C:\WINDOWS\$NtUninstallKB939653$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB941202)-->"C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB941568)-->"C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB941644)-->"C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB941693)-->"C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB942615)-->"C:\WINDOWS\$NtUninstallKB942615$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB943055)-->"C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB943460)-->"C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB943485)-->"C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB944338)-->"C:\WINDOWS\$NtUninstallKB944338$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB944533)-->"C:\WINDOWS\$NtUninstallKB944533$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB944653)-->"C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB945553)-->"C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB946026)-->"C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB947864)-->"C:\WINDOWS\$NtUninstallKB947864$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB948590)-->"C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB948881)-->"C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB950749)-->"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB950759)-->"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB961371)-->"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB963027)-->"C:\WINDOWS\$NtUninstallKB963027$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB969897)-->"C:\WINDOWS\$NtUninstallKB969897$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB972260)-->"C:\WINDOWS\$NtUninstallKB972260$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
    SoundMAX-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\setup.exe" -l0x9 -removeonly
    System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
    Update for Windows XP (KB894391)-->"C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
    Update for Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
    Update for Windows XP (KB900485)-->"C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
    Update for Windows XP (KB908531)-->"C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
    Update for Windows XP (KB910437)-->"C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
    Update for Windows XP (KB911280)-->"C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
    Update for Windows XP (KB916595)-->"C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
    Update for Windows XP (KB920872)-->"C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
    Update for Windows XP (KB922582)-->"C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
    Update for Windows XP (KB927891)-->"C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
    Update for Windows XP (KB929338)-->"C:\WINDOWS\$NtUninstallKB929338$\spuninst\spuninst.exe"
    Update for Windows XP (KB930916)-->"C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
    Update for Windows XP (KB931836)-->"C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
    Update for Windows XP (KB933360)-->"C:\WINDOWS\$NtUninstallKB933360$\spuninst\spuninst.exe"
    Update for Windows XP (KB936357)-->"C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe"
    Update for Windows XP (KB938828)-->"C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
    Update for Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
    Update for Windows XP (KB942840)-->"C:\WINDOWS\$NtUninstallKB942840$\spuninst\spuninst.exe"
    Update for Windows XP (KB946627)-->"C:\WINDOWS\$NtUninstallKB946627$\spuninst\spuninst.exe"
    Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
    Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
    Update for Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
    Ventrilo Client-->MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
    VIA Register Tool-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Your Company Name\VIA Register Tool\Uninst.isu"
    Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Media Player\mtsAxInstaller.exe /u
    WC3Banlist-->"C:\Program Files\WC3Banlist\unins000.exe"
    Winamp3 (remove only)-->C:\Program Files\Winamp3\uninst-wa3.EXE
    Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
    Windows XP Hotfix - KB873339-->C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
    Windows XP Hotfix - KB885835-->C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
    Windows XP Hotfix - KB885836-->C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
    Windows XP Hotfix - KB886185-->C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
    Windows XP Hotfix - KB887472-->C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe
    Windows XP Hotfix - KB888302-->C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
    Windows XP Hotfix - KB890859-->"C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
    Windows XP Hotfix - KB891781-->C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
    WinPcap 3.1-->C:\Program Files\WinPcap\uninstall.exe
    WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
    World of Warcraft-->C:\Program Files\Common Files\Blizzard Entertainment\World of Warcraft\Uninstall.exe

    ======Security center information======

    AV: ESET NOD32 Antivirus 4.0

    ======System event log======

    Computer Name: ROBIN
    Event Code: 1007
    Message: Your computer has automatically configured the IP address for the Network
    Card with network address 00223F010564. The IP address being used is 169.254.4.134.

    Record Number: 30224
    Source Name: Dhcp
    Time Written: 20090621014944.000000-300
    Event Type: warning
    User:

    Computer Name: ROBIN
    Event Code: 1007
    Message: Your computer has automatically configured the IP address for the Network
    Card with network address 00223F010564. The IP address being used is 169.254.4.134.

    Record Number: 30219
    Source Name: Dhcp
    Time Written: 20090620231621.000000-300
    Event Type: warning
    User:

    Computer Name: ROBIN
    Event Code: 1007
    Message: Your computer has automatically configured the IP address for the Network
    Card with network address 00223F010564. The IP address being used is 169.254.4.134.

    Record Number: 30214
    Source Name: Dhcp
    Time Written: 20090620230323.000000-300
    Event Type: warning
    User:

    Computer Name: ROBIN
    Event Code: 32003
    Message: The Network Address Translator (NAT) was unable to request an operation
    of the kernel-mode translation module.
    This may indicate misconfiguration, insufficient resources, or
    an internal error.
    The data is the error code.

    Record Number: 30207
    Source Name: ipnathlp
    Time Written: 20090620220452.000000-300
    Event Type: error
    User:

    Computer Name: ROBIN
    Event Code: 1007
    Message: Your computer has automatically configured the IP address for the Network
    Card with network address 00223F010564. The IP address being used is 169.254.4.134.

    Record Number: 30204
    Source Name: Dhcp
    Time Written: 20090620185814.000000-300
    Event Type: warning
    User:

    =====Application event log=====

    Computer Name: ROBIN
    Event Code: 1000
    Message: Faulting application ANIWZCSdS.exe, version 1.0.1.30507, faulting module user32.dll, version 5.1.2600.3099, fault address 0x00015a30.

    Record Number: 387
    Source Name: Application Error
    Time Written: 20070428213927.000000-300
    Event Type: error
    User:

    Computer Name: ROBIN
    Event Code: 1000
    Message: Faulting application ANIWZCSdS.exe, version 1.0.1.30507, faulting module user32.dll, version 5.1.2600.3099, fault address 0x00015a48.

    Record Number: 355
    Source Name: Application Error
    Time Written: 20070417220931.000000-300
    Event Type: error
    User:

    Computer Name: ROBIN
    Event Code: 1000
    Message: Faulting application iexplore.exe, version 6.0.2900.2180, faulting module unknown, version 0.0.0.0, fault address 0x00000000.

    Record Number: 351
    Source Name: Application Error
    Time Written: 20070417174518.000000-300
    Event Type: error
    User:

    Computer Name: ROBIN
    Event Code: 1000
    Message: Faulting application ANIWZCSdS.exe, version 1.0.1.30507, faulting module user32.dll, version 5.1.2600.3099, fault address 0x00015a48.

    Record Number: 334
    Source Name: Application Error
    Time Written: 20070411045627.000000-300
    Event Type: error
    User:

    Computer Name: ROBIN
    Event Code: 1000
    Message: Faulting application ANIWZCSdS.exe, version 1.0.1.30507, faulting module user32.dll, version 5.1.2600.2622, fault address 0x000162cf.

    Record Number: 275
    Source Name: Application Error
    Time Written: 20070312041512.000000-300
    Event Type: error
    User:

    ======Environment variables======

    "ComSpec"=%SystemRoot%\system32\cmd.exe
    "Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\QuickTime\QTSystem
    "windir"=%SystemRoot%
    "FP_NO_HOST_CHECK"=NO
    "OS"=Windows_NT
    "PROCESSOR_ARCHITECTURE"=x86
    "PROCESSOR_LEVEL"=15
    "PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 9, GenuineIntel
    "PROCESSOR_REVISION"=0409
    "NUMBER_OF_PROCESSORS"=2
    "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    "TEMP"=%SystemRoot%\TEMP
    "TMP"=%SystemRoot%\TEMP
    "CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
    "QTJAVA"=C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
    EOF
  • KatanaKatana
    edited August 2009
    Information

    IMPORTANT
    I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

    LimeWire 4.12.11
    I'd like you to read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

    Also available here.

    My recommendation is you go to Control Panel > Add/Remove Programs and uninstall any P2P programs
    Please note: you must NOT use any P2P whilst we are cleaning your machine.



    Step 1


    Custom CFScript
    • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
      FCopy::
c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\termsrv.dll|c:\windows\system32\dllcache\termsrv.dll
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lphcjgmj0en1v]
ADS::
    • Save this as CFScript.txt and place it on your desktop.


      CFScriptb.gif
    • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
    • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
    • When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.


    CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
    ComboFix SHOULD NOT be used unless requested by a forum helper



    Step 2

    Kaspersky Online Scanner .
    Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
    NOTE:- This scan is best done from IE (Internet Explorer)
    NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
    Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

    Read the Requirements and limitations before you click Accept.
    Once the database has downloaded, click My Computer in the left pane
    Now go and put the kettle on !
    When the scan has completed, click Save Report As...
    Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
    Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.


    **Note**

    To optimize scanning time and produce a more sensible report for review:
    • Close any open programs.
    • Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

    Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.


    Logs/Information to Post in Reply
    Please post the following logs/Information in your reply
    Some of the logs I request will be quite large, You may need to split them over a couple of replies.
    • Combofix Log
    • Kaspersky Log
    • How are things running now ?






    Additional Notes



    Your Adobe Acrobat Reader is out of date. Older versions have vulnerabilities that malware can use to infect your system.

    Adobe Reader is a large program and uses unnecessary space.
    If you prefer a smaller program you can get Foxit 3.0 from http://www.foxitsoftware.com/pdf/rd_intro.php << Recommended

    There is a newer version of Adobe Acrobat Reader available.
    • Please go to this link Adobe Acrobat Reader Download Link
    • Click Download
    • On the right Untick Adobe Phototshop Album Starter Edition if you do not wish to include this in the installation.
    • Click the Continue button
    • Click Run, and click Run again
    • Next click the Install Now button and follow the on screen prompts




    Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

    Please download Java SE Runtime Environment (JRE) . ( don't install it yet )
    • Scroll down to where it says "Java SE Runtime Environment (JRE)".
    • Click the "Download" button to the right.
      • Platform = Windows
      • Language = Multi Language
    • Check the box that says: "Accept License Agreement".
    • The page will refresh.
    • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.


    Now download JavaRa and unzip it to your desktop.

    ***Please close any instances of Internet Explorer (or other web browser) before continuing!***

    • Double-click on JavaRa.exe to start the program.
    • From the drop-down menu, choose English and click on Select.
    • JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
    • Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
    • A logfile will pop up. Please save it to a convenient location.


    Now install the Java SE Runtime Environment (JRE) package you downloaded
    (it comes with a toolbar pre-selected, so make sure you uncheck the box)

    You can delete JavaRa (zip and exe)

    Remove Programs

    Older versions of some programs have vulnerabilities that malware can use to infect your system.

    Now click Start---Control Panel. Double click Add or Remove Programs (XP) / Programs and Features (Vista) .
    If any of the following programs are still listed there, click on the program to highlight it, and click on remove.
    • Adobe Reader 7.0.8

      J2SE Runtime Environment 5.0 Update 3
      Java(TM) 6 Update 13
      Java(TM) 6 Update 2
      Java(TM) 6 Update 3
    Now close the Control Panel.
  • Brooce
    edited August 2009
    Here's the combo fix log after the CFScript

    ComboFix 09-07-31.04 - Bruce 08/01/2009 12:27.6.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2047.1538 [GMT -5:00]
    Running from: c:\documents and settings\Bruce\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Bruce\Desktop\CFScript.txt
    AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    .
    FCopy

    c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\termsrv.dll --> c:\windows\system32\dllcache\termsrv.dll
    .
    ((((((((((((((((((((((((( Files Created from 2009-07-01 to 2009-08-01 )))))))))))))))))))))))))))))))
    .

    2009-08-01 08:55 . 2009-08-01 08:55
    d
    w- C:\rsit
    2009-08-01 07:18 . 2009-08-01 07:18
    d
    w- c:\documents and settings\2nd Account\Local Settings\Application Data\Mozilla
    2009-08-01 07:18 . 2009-08-01 09:04
    d
    w- c:\program files\Diablo II
    2009-07-30 20:49 . 2009-07-30 20:49
    d
    w- c:\program files\softnyx
    2009-07-28 23:43 . 2009-07-28 23:42 410984 ----a-w- c:\windows\system32\deploytk.dll
    2009-07-28 23:41 . 2009-07-28 23:41 152576 ----a-w- c:\documents and settings\Bruce\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
    2009-07-06 09:27 . 2009-07-06 09:27
    d
    w- c:\program files\Common Files\INCA Shared
    2009-07-06 09:12 . 2009-03-09 20:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll
    2009-07-06 09:12 . 2009-03-09 20:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll
    2009-07-06 09:12 . 2009-03-09 20:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll
    2009-07-06 09:11 . 2009-03-16 19:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll
    2009-07-06 09:11 . 2009-03-16 19:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll
    2009-07-06 09:11 . 2009-03-16 19:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll
    2009-07-06 09:11 . 2009-03-16 19:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll
    2009-07-06 09:11 . 2008-10-15 11:22 452440 ----a-w- c:\windows\system32\d3dx10_40.dll
    2009-07-06 09:11 . 2008-10-15 11:22 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll
    2009-07-06 09:11 . 2008-10-15 11:22 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll
    2009-07-06 09:11 . 2008-10-15 12:03 70992 ----a-w- c:\windows\system32\XAPOFX1_2.dll
    2009-07-06 09:11 . 2008-10-15 12:03 514384 ----a-w- c:\windows\system32\XAudio2_3.dll
    2009-07-06 09:11 . 2008-10-15 12:03 235856 ----a-w- c:\windows\system32\xactengine3_3.dll
    2009-07-06 09:10 . 2008-10-15 12:03 23376 ----a-w- c:\windows\system32\X3DAudio1_5.dll
    2009-07-06 09:10 . 2008-07-30 11:20 68616 ----a-w- c:\windows\system32\XAPOFX1_1.dll
    2009-07-06 09:10 . 2008-07-30 11:20 509448 ----a-w- c:\windows\system32\XAudio2_2.dll
    2009-07-06 09:10 . 2008-07-30 11:20 238088 ----a-w- c:\windows\system32\xactengine3_2.dll
    2009-07-06 09:10 . 2008-07-10 16:01 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
    2009-07-06 09:10 . 2008-07-10 16:00 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
    2009-07-06 09:10 . 2008-07-10 16:00 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
    2009-07-06 09:09 . 2008-05-30 19:19 507400 ----a-w- c:\windows\system32\XAudio2_1.dll
    2009-07-06 09:09 . 2008-05-30 19:17 65032 ----a-w- c:\windows\system32\XAPOFX1_0.dll
    2009-07-06 09:09 . 2008-05-30 19:18 238088 ----a-w- c:\windows\system32\xactengine3_1.dll
    2009-07-06 09:09 . 2008-05-30 19:17 25608 ----a-w- c:\windows\system32\X3DAudio1_4.dll
    2009-07-06 09:09 . 2008-05-30 19:11 467984 ----a-w- c:\windows\system32\d3dx10_38.dll
    2009-07-06 09:09 . 2008-05-30 19:11 1491992 ----a-w- c:\windows\system32\D3DCompiler_38.dll
    2009-07-06 09:09 . 2008-05-30 19:11 3850760 ----a-w- c:\windows\system32\D3DX9_38.dll
    2009-07-06 09:08 . 2008-03-05 21:03 479752 ----a-w- c:\windows\system32\XAudio2_0.dll
    2009-07-06 09:08 . 2008-03-05 21:03 238088 ----a-w- c:\windows\system32\xactengine3_0.dll
    2009-07-06 09:08 . 2008-03-05 21:00 25608 ----a-w- c:\windows\system32\X3DAudio1_3.dll
    2009-07-06 09:08 . 2008-03-05 20:56 1420824 ----a-w- c:\windows\system32\D3DCompiler_37.dll
    2009-07-06 09:08 . 2008-02-06 04:07 462864 ----a-w- c:\windows\system32\d3dx10_37.dll
    2009-07-06 09:08 . 2008-03-05 20:56 3786760 ----a-w- c:\windows\system32\D3DX9_37.dll
    2009-07-06 09:07 . 2007-10-22 08:39 267272 ----a-w- c:\windows\system32\xactengine2_10.dll
    2009-07-06 09:07 . 2007-10-12 20:14 1374232 ----a-w- c:\windows\system32\D3DCompiler_36.dll
    2009-07-06 09:07 . 2007-10-02 14:56 444776 ----a-w- c:\windows\system32\d3dx10_36.dll
    2009-07-06 09:07 . 2007-10-12 20:14 3734536 ----a-w- c:\windows\system32\d3dx9_36.dll
    2009-07-06 09:07 . 2007-07-20 05:57 267112 ----a-w- c:\windows\system32\xactengine2_9.dll
    2009-07-06 09:06 . 2007-07-19 23:14 444776 ----a-w- c:\windows\system32\d3dx10_35.dll
    2009-07-06 09:06 . 2007-07-19 23:14 1358192 ----a-w- c:\windows\system32\D3DCompiler_35.dll
    2009-07-06 09:06 . 2007-07-19 23:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll
    2009-07-06 09:06 . 2007-10-22 08:37 17928 ----a-w- c:\windows\system32\X3DAudio1_2.dll
    2009-07-06 09:06 . 2007-06-21 01:46 266088 ----a-w- c:\windows\system32\xactengine2_8.dll
    2009-07-06 09:06 . 2007-05-16 21:45 443752 ----a-w- c:\windows\system32\d3dx10_34.dll
    2009-07-06 09:06 . 2007-05-16 21:45 1124720 ----a-w- c:\windows\system32\D3DCompiler_34.dll
    2009-07-06 09:06 . 2007-05-16 21:45 3497832 ----a-w- c:\windows\system32\d3dx9_34.dll
    2009-07-06 09:06 . 2007-04-04 23:53 81768 ----a-w- c:\windows\system32\xinput1_3.dll
    2009-07-06 09:06 . 2007-04-04 23:55 261480 ----a-w- c:\windows\system32\xactengine2_7.dll
    2009-07-06 09:05 . 2007-03-15 21:57 443752 ----a-w- c:\windows\system32\d3dx10_33.dll
    2009-07-06 09:05 . 2007-03-12 21:42 1123696 ----a-w- c:\windows\system32\D3DCompiler_33.dll
    2009-07-06 09:05 . 2007-03-12 21:42 3495784 ----a-w- c:\windows\system32\d3dx9_33.dll
    2009-07-03 05:42 . 2009-07-03 05:55
    d
    w- c:\documents and settings\Bruce\Application Data\GetRightToGo

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-01 09:06 . 2007-12-23 22:13
    d
    w- c:\program files\Diablo 2
    2009-08-01 07:42 . 2007-12-23 22:16 71995 ----a-w- c:\windows\DIIUnin.dat
    2009-08-01 07:41 . 2007-12-23 22:22 21840 ----atw- c:\windows\system32\SIntfNT.dll
    2009-08-01 07:41 . 2007-12-23 22:22 17212 ----atw- c:\windows\system32\SIntf32.dll
    2009-08-01 07:41 . 2007-12-23 22:22 12067 ----atw- c:\windows\system32\SIntf16.dll
    2009-08-01 07:26 . 2007-12-23 22:16 94208 ----a-w- c:\windows\DIIUnin.exe
    2009-08-01 07:26 . 2007-12-23 22:16 2829 ----a-w- c:\windows\DIIUnin.pif
    2009-08-01 07:14 . 2009-08-01 07:14
    d
    w- c:\documents and settings\2nd Account\Application Data\Logitech
    2009-07-30 20:39 . 2006-12-31 02:52
    d
    w- c:\program files\Warcraft III
    2009-07-28 23:42 . 2007-02-23 09:26
    d
    w- c:\program files\Java
    2009-07-03 05:56 . 2009-07-03 05:55
    d
    w- c:\program files\NCSoft
    2009-07-03 05:55 . 2006-11-19 06:35
    d--h--w- c:\program files\InstallShield Installation Information
    2009-06-30 17:55 . 2009-06-30 17:55
    d
    w- c:\program files\Trend Micro
    2009-06-30 04:59 . 2009-06-29 19:40
    d
    w- c:\documents and settings\All Users\Application Data\13136564
    2009-06-29 19:59 . 2007-04-04 07:35
    d
    w- c:\program files\ESET
    2009-06-26 16:18 . 2004-08-03 22:56 659456 ----a-w- c:\windows\system32\wininet.dll
    2009-06-26 16:18 . 2004-08-03 22:56 81920 ----a-w- c:\windows\system32\ieencode.dll
    2009-06-16 14:55 . 2004-08-03 22:56 119808 ----a-w- c:\windows\system32\t2embed.dll
    2009-06-16 14:55 . 2001-08-23 11:00 82432 ----a-w- c:\windows\system32\fontsub.dll
    2009-06-10 21:32 . 2009-06-06 18:30
    d
    w- c:\program files\Bodog Poker
    2009-06-06 18:35 . 2009-06-06 18:35 19296 ----a-w- c:\documents and settings\Administrator.ROBIN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-06-04 19:43 . 2008-06-05 20:56
    d
    w- c:\program files\Full Tilt Poker
    2009-06-03 19:27 . 2004-08-03 22:56 1290752 ----a-w- c:\windows\system32\quartz.dll
    2009-05-07 15:44 . 2004-08-03 22:56 344064 ----a-w- c:\windows\system32\localspl.dll
    2009-07-26 08:12 . 2009-01-15 23:58 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
    .
    Sigcheck

    [-] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\termsrv.dll
    [-] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\termsrv.dll
    [-] 2008-09-11 06:22 295424 40FFC19A8D4875E9E19CECDC76EF9201 c:\windows\system32\termsrv.dll
    [-] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\system32\dllcache\termsrv.dll
    .
    ((((((((((((((((((((((((((((( SnapShot_2009-08-01_08.43.57 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-08-01 16:52 . 2009-08-01 16:52 16384 c:\windows\temp\Perflib_Perfdata_3fc.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
    "NCsoft Launcher"="c:\program files\ncsoft\launcher\NCLauncher.exe" [2009-07-22 38184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
    "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
    "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
    "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-28 148888]
    "WinampAgent"="c:\program files\Winamp3\winampa.exe" [2002-07-23 12288]
    "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
    "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400]
    "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-01-15 1657376]
    "High Definition Audio Property Page Shortcut"="HDAShCut.exe" - c:\windows\system32\HdAShCut.exe [2004-10-27 61952]
    "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-04-11 56080]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-04-11 56080]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-8-26 692224]
    NETGEAR WN111v2 Smart Wizard.lnk - c:\program files\NETGEAR\WN111v2\WN111V2.exe [2008-5-9 1474631]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=&quot;"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    "FirewallOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\AIM\\aim.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-1.12.0.5595-to-1.12.1.5875-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
    "c:\\Program Files\\World of Warcraft\\Launcher.exe"=
    "c:\\Program Files\\Ubisoft\\Heroes of Might and Magic V\\bin\\H5_Game.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\WINDOWS\\system32\\dpvsetup.exe"=
    "c:\\Program Files\\Participatory Culture Foundation\\Miro\\Miro_Downloader.exe"=
    "c:\\Program Files\\Diablo II\\Diablo II.exe"=
    "c:\\Program Files\\Ubisoft\\Heroes of Might and Magic V\\bina1\\H5_Game.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-2.3.3.7799-to-2.4.0.8089-enUS-downloader.exe"=
    "c:\\Program Files\\Bodog Poker\\BPGame.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3724:TCP"= 3724:TCP:Wow
    "6112:TCP"= 6112:TCP:Wc3
    "6119:TCP"= 6119:TCP:blizz
    "6113:TCP"= 6113:TCP:blizz

    R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2/6/2009 2:23 PM 106208]
    R1 EncorMpd;EncorMpd;c:\windows\system32\drivers\ENCORMPD.SYS [12/28/2006 11:25 PM 35488]
    R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2/6/2009 2:24 PM 93336]
    R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2/6/2009 2:23 PM 727720]
    R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [7/24/2003 12:10 PM 17149]
    R3 JSWSCIMD;jswscimd Service;c:\windows\system32\drivers\jswscimd.sys [2/12/2008 6:05 PM 57440]
    R3 WSIMD;wsimd Service;c:\windows\system32\drivers\wsimd.sys [12/14/2007 4:31 AM 57408]
    S1 EncorDev;EncorDev;c:\windows\system32\drivers\ENCORDEV.SYS [12/28/2006 11:25 PM 9440]
    S3 A5AGU;D-Link USB Wireless Network Adapter Service;c:\windows\system32\drivers\A5AGU.sys [7/25/2005 11:32 PM 377920]
    S3 ATHFMWDL;D-Link predator Bootloader driver;c:\windows\system32\drivers\ATHFMWDL.sys [7/25/2005 11:35 PM 43392]
    S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\NETGEAR\WN111v2\jswpsapi.exe [2/27/2008 11:54 AM 360547]
    S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [8/2/2005 4:10 PM 32512]
    S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
    S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\DRIVERS\rt2870.sys --> c:\windows\system32\DRIVERS\rt2870.sys [?]
    S3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\system32\drivers\WN111v2.sys [5/31/2008 2:46 PM 434688]
    S3 XDva064;XDva064;\??\c:\windows\system32\XDva064.sys --> c:\windows\system32\XDva064.sys [?]

    --- Other Services/Drivers In Memory ---

    *Deregistered* - project
    .
    Contents of the 'Scheduled Tasks' folder

    2009-08-01 c:\windows\Tasks\WGASetup.job
    - c:\windows\system32\KB905474\wgasetup.exe [2009-04-29 03:18]
    .
    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.google.com/
    FF - ProfilePath - c:\documents and settings\Bruce\Application Data\Mozilla\Firefox\Profiles\9jqgccvx.default\
    FF - plugin: c:\documents and settings\Bruce\Application Data\Mozilla\Firefox\Profiles\9jqgccvx.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll
    FF - plugin: c:\documents and settings\Bruce\Application Data\Mozilla\plugins\npoctoshape.dll
    FF - plugin: c:\program files\Octoshape Streaming Services\Bruce\octoprogram-L03-NMS0806110_SUA_900\npoctoshape.dll
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-01 12:34
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\npggsvc]
    "ImagePath"="c:\windows\system32\GameMon.des -service"
    .
    DLLs Loaded Under Running Processes

    - - - - - - - > 'explorer.exe'(376)
    c:\program files\Logitech\SetPoint\lgscroll.dll
    .
    Completion time: 2009-08-01 12:37
    ComboFix-quarantined-files.txt 2009-08-01 17:37
    ComboFix2.txt 2009-08-01 08:46
    ComboFix3.txt 2009-07-01 05:56
    ComboFix4.txt 2009-06-30 20:00
    ComboFix5.txt 2009-08-01 17:26

    Pre-Run: 47,381,245,952 bytes free
    Post-Run: 47,333,789,696 bytes free

    225 --- E O F --- 2009-07-29 00:39

    and now i'll start scanning with kasperspy i'll have that up in a bit
  • Brooce
    edited August 2009
    KASPERSKY ONLINE SCANNER 7.0 REPORT Saturday, August 1, 2009
    Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
    Kaspersky Online Scanner version: 7.0.26.13
    Program database last update: Saturday, August 01, 2009 19:42:06
    Records in database: 2570735

    Scan settings Scan using the following database extended Scan archives yes Scan mail databases yes
    Scan area My Computer A:\
    C:\
    D:\
    E:\
    G:\
    Scan statistics Files scanned 91025 Threat name 1 Infected objects 1 Suspicious objects 0 Duration of the scan 03:00:17
    File name Threat name Threats count C:\Program Files\DAEMON Tools\SetupDTSB.exeInfected: not-a-virus:WebToolbar.Win32.WhenU.a1

    The selected area was scanned.

    Here's the kasper spy report, while i was scanning my eset still detected termsrv.dll as a threat after entering the script from combofix. I'm wondering if that could still be a problem. Thanks in advance
  • KatanaKatana
    edited August 2009
    Brooce wrote:
    while i was scanning my eset still detected termsrv.dll as a threat after entering the script from combofix.

    Where did it find it this time ?

    Uninstall Combofix
    • This will clear your System Volume Information restore points and remove all the infected files that were quarantined
    • Click START then RUN
    • Now type Combofix /u in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
      • CF_Cleanup.png


    scan with Eset again and see if it still flags a problem
  • Brooce
    edited August 2009
    i just uninstalled combofix and scanned my operating memory with eset, it's still flagging termsrv.dll as a virus =/
  • KatanaKatana
    edited August 2009
    Download a fresh copy of Combofix

    ComboFix.exe

    Custom CFScript
    • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
      FCopy::
c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\termsrv.dll|c:\windows\system32\termsrv.dll
ADS::
    • Save this as CFScript.txt and place it on your desktop.


      CFScriptb.gif


    • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
    • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
    • When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.


    CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
    ComboFix SHOULD NOT be used unless requested by a forum helper
  • Brooce
    edited August 2009
    sorry for the long wait, i reinstalled combofix and put in the script. Afterwards it gave me a warning. The warning said if i wanted to keep the new system file that was different from the old one or something like that. I accepted it and i'm going to scan again to see if there's any problems. Ty for help

    ComboFix 09-08-02.03 - Bruce 08/03/2009 4:24.7.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2047.1567 [GMT -5:00]
    Running from: c:\documents and settings\Bruce\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Bruce\Desktop\CFScript.txt.txt
    AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    .
    FCopy

    c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\termsrv.dll --> c:\windows\system32\termsrv.dll
    .
    ((((((((((((((((((((((((( Files Created from 2009-07-03 to 2009-08-03 )))))))))))))))))))))))))))))))
    .

    2009-08-01 08:55 . 2009-08-01 08:55
    d
    w- C:\rsit
    2009-08-01 07:18 . 2009-08-01 07:18
    d
    w- c:\documents and settings\2nd Account\Local Settings\Application Data\Mozilla
    2009-08-01 07:18 . 2009-08-03 08:47
    d
    w- c:\program files\Diablo II
    2009-07-30 20:49 . 2009-07-30 20:49
    d
    w- c:\program files\softnyx
    2009-07-28 23:43 . 2009-07-28 23:42 410984 ----a-w- c:\windows\system32\deploytk.dll
    2009-07-28 23:41 . 2009-07-28 23:41 152576 ----a-w- c:\documents and settings\Bruce\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
    2009-07-06 09:27 . 2009-07-06 09:27
    d
    w- c:\program files\Common Files\INCA Shared
    2009-07-06 09:12 . 2009-03-09 20:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll
    2009-07-06 09:12 . 2009-03-09 20:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll
    2009-07-06 09:12 . 2009-03-09 20:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll
    2009-07-06 09:11 . 2009-03-16 19:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll
    2009-07-06 09:11 . 2009-03-16 19:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll
    2009-07-06 09:11 . 2009-03-16 19:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll
    2009-07-06 09:11 . 2009-03-16 19:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll
    2009-07-06 09:11 . 2008-10-15 11:22 452440 ----a-w- c:\windows\system32\d3dx10_40.dll
    2009-07-06 09:11 . 2008-10-15 11:22 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll
    2009-07-06 09:11 . 2008-10-15 11:22 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll
    2009-07-06 09:11 . 2008-10-15 12:03 70992 ----a-w- c:\windows\system32\XAPOFX1_2.dll
    2009-07-06 09:11 . 2008-10-15 12:03 514384 ----a-w- c:\windows\system32\XAudio2_3.dll
    2009-07-06 09:11 . 2008-10-15 12:03 235856 ----a-w- c:\windows\system32\xactengine3_3.dll
    2009-07-06 09:10 . 2008-10-15 12:03 23376 ----a-w- c:\windows\system32\X3DAudio1_5.dll
    2009-07-06 09:10 . 2008-07-30 11:20 68616 ----a-w- c:\windows\system32\XAPOFX1_1.dll
    2009-07-06 09:10 . 2008-07-30 11:20 509448 ----a-w- c:\windows\system32\XAudio2_2.dll
    2009-07-06 09:10 . 2008-07-30 11:20 238088 ----a-w- c:\windows\system32\xactengine3_2.dll
    2009-07-06 09:10 . 2008-07-10 16:01 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
    2009-07-06 09:10 . 2008-07-10 16:00 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
    2009-07-06 09:10 . 2008-07-10 16:00 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
    2009-07-06 09:09 . 2008-05-30 19:19 507400 ----a-w- c:\windows\system32\XAudio2_1.dll
    2009-07-06 09:09 . 2008-05-30 19:17 65032 ----a-w- c:\windows\system32\XAPOFX1_0.dll
    2009-07-06 09:09 . 2008-05-30 19:18 238088 ----a-w- c:\windows\system32\xactengine3_1.dll
    2009-07-06 09:09 . 2008-05-30 19:17 25608 ----a-w- c:\windows\system32\X3DAudio1_4.dll
    2009-07-06 09:09 . 2008-05-30 19:11 467984 ----a-w- c:\windows\system32\d3dx10_38.dll
    2009-07-06 09:09 . 2008-05-30 19:11 1491992 ----a-w- c:\windows\system32\D3DCompiler_38.dll
    2009-07-06 09:09 . 2008-05-30 19:11 3850760 ----a-w- c:\windows\system32\D3DX9_38.dll
    2009-07-06 09:08 . 2008-03-05 21:03 479752 ----a-w- c:\windows\system32\XAudio2_0.dll
    2009-07-06 09:08 . 2008-03-05 21:03 238088 ----a-w- c:\windows\system32\xactengine3_0.dll
    2009-07-06 09:08 . 2008-03-05 21:00 25608 ----a-w- c:\windows\system32\X3DAudio1_3.dll
    2009-07-06 09:08 . 2008-03-05 20:56 1420824 ----a-w- c:\windows\system32\D3DCompiler_37.dll
    2009-07-06 09:08 . 2008-02-06 04:07 462864 ----a-w- c:\windows\system32\d3dx10_37.dll
    2009-07-06 09:08 . 2008-03-05 20:56 3786760 ----a-w- c:\windows\system32\D3DX9_37.dll
    2009-07-06 09:07 . 2007-10-22 08:39 267272 ----a-w- c:\windows\system32\xactengine2_10.dll
    2009-07-06 09:07 . 2007-10-12 20:14 1374232 ----a-w- c:\windows\system32\D3DCompiler_36.dll
    2009-07-06 09:07 . 2007-10-02 14:56 444776 ----a-w- c:\windows\system32\d3dx10_36.dll
    2009-07-06 09:07 . 2007-10-12 20:14 3734536 ----a-w- c:\windows\system32\d3dx9_36.dll
    2009-07-06 09:07 . 2007-07-20 05:57 267112 ----a-w- c:\windows\system32\xactengine2_9.dll
    2009-07-06 09:06 . 2007-07-19 23:14 444776 ----a-w- c:\windows\system32\d3dx10_35.dll
    2009-07-06 09:06 . 2007-07-19 23:14 1358192 ----a-w- c:\windows\system32\D3DCompiler_35.dll
    2009-07-06 09:06 . 2007-07-19 23:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll
    2009-07-06 09:06 . 2007-10-22 08:37 17928 ----a-w- c:\windows\system32\X3DAudio1_2.dll
    2009-07-06 09:06 . 2007-06-21 01:46 266088 ----a-w- c:\windows\system32\xactengine2_8.dll
    2009-07-06 09:06 . 2007-05-16 21:45 443752 ----a-w- c:\windows\system32\d3dx10_34.dll
    2009-07-06 09:06 . 2007-05-16 21:45 1124720 ----a-w- c:\windows\system32\D3DCompiler_34.dll
    2009-07-06 09:06 . 2007-05-16 21:45 3497832 ----a-w- c:\windows\system32\d3dx9_34.dll
    2009-07-06 09:06 . 2007-04-04 23:53 81768 ----a-w- c:\windows\system32\xinput1_3.dll
    2009-07-06 09:06 . 2007-04-04 23:55 261480 ----a-w- c:\windows\system32\xactengine2_7.dll
    2009-07-06 09:05 . 2007-03-15 21:57 443752 ----a-w- c:\windows\system32\d3dx10_33.dll
    2009-07-06 09:05 . 2007-03-12 21:42 1123696 ----a-w- c:\windows\system32\D3DCompiler_33.dll
    2009-07-06 09:05 . 2007-03-12 21:42 3495784 ----a-w- c:\windows\system32\d3dx9_33.dll
    2009-07-06 09:05 . 2007-01-24 20:27 255848 ----a-w- c:\windows\system32\xactengine2_6.dll
    2009-07-06 09:05 . 2006-12-08 17:02 251672 ----a-w- c:\windows\system32\xactengine2_5.dll
    2009-07-06 09:05 . 2006-11-29 18:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
    2009-07-06 09:05 . 2007-03-05 17:42 15128 ----a-w- c:\windows\system32\x3daudio1_1.dll
    2009-07-06 09:05 . 2006-09-28 21:05 237848 ----a-w- c:\windows\system32\xactengine2_4.dll
    2009-07-06 09:05 . 2006-09-28 21:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
    2009-07-06 09:05 . 2006-07-28 14:30 236824 ----a-w- c:\windows\system32\xactengine2_3.dll
    2009-07-06 09:05 . 2006-07-28 14:30 62744 ----a-w- c:\windows\system32\xinput1_2.dll
    2009-07-06 09:03 . 2009-07-06 09:03
    d
    w- c:\windows\Logs

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-03 08:48 . 2007-12-23 22:13
    d
    w- c:\program files\Diablo 2
    2009-08-01 07:42 . 2007-12-23 22:16 71995 ----a-w- c:\windows\DIIUnin.dat
    2009-08-01 07:41 . 2007-12-23 22:22 21840 ----atw- c:\windows\system32\SIntfNT.dll
    2009-08-01 07:41 . 2007-12-23 22:22 17212 ----atw- c:\windows\system32\SIntf32.dll
    2009-08-01 07:41 . 2007-12-23 22:22 12067 ----atw- c:\windows\system32\SIntf16.dll
    2009-08-01 07:26 . 2007-12-23 22:16 94208 ----a-w- c:\windows\DIIUnin.exe
    2009-08-01 07:26 . 2007-12-23 22:16 2829 ----a-w- c:\windows\DIIUnin.pif
    2009-08-01 07:14 . 2009-08-01 07:14
    d
    w- c:\documents and settings\2nd Account\Application Data\Logitech
    2009-07-30 20:39 . 2006-12-31 02:52
    d
    w- c:\program files\Warcraft III
    2009-07-28 23:42 . 2007-02-23 09:26
    d
    w- c:\program files\Java
    2009-07-03 05:56 . 2009-07-03 05:55
    d
    w- c:\program files\NCSoft
    2009-07-03 05:55 . 2009-07-03 05:42
    d
    w- c:\documents and settings\Bruce\Application Data\GetRightToGo
    2009-07-03 05:55 . 2006-11-19 06:35
    d--h--w- c:\program files\InstallShield Installation Information
    2009-06-30 17:55 . 2009-06-30 17:55
    d
    w- c:\program files\Trend Micro
    2009-06-30 04:59 . 2009-06-29 19:40
    d
    w- c:\documents and settings\All Users\Application Data\13136564
    2009-06-29 19:59 . 2007-04-04 07:35
    d
    w- c:\program files\ESET
    2009-06-26 16:18 . 2004-08-03 22:56 659456 ----a-w- c:\windows\system32\wininet.dll
    2009-06-26 16:18 . 2004-08-03 22:56 81920 ----a-w- c:\windows\system32\ieencode.dll
    2009-06-16 14:55 . 2004-08-03 22:56 119808 ----a-w- c:\windows\system32\t2embed.dll
    2009-06-16 14:55 . 2001-08-23 11:00 82432 ----a-w- c:\windows\system32\fontsub.dll
    2009-06-10 21:32 . 2009-06-06 18:30
    d
    w- c:\program files\Bodog Poker
    2009-06-06 18:35 . 2009-06-06 18:35 19296 ----a-w- c:\documents and settings\Administrator.ROBIN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-06-04 19:43 . 2008-06-05 20:56
    d
    w- c:\program files\Full Tilt Poker
    2009-06-03 19:27 . 2004-08-03 22:56 1290752 ----a-w- c:\windows\system32\quartz.dll
    2009-05-07 15:44 . 2004-08-03 22:56 344064 ----a-w- c:\windows\system32\localspl.dll
    2009-07-26 08:12 . 2009-01-15 23:58 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
    .
    Sigcheck

    [-] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\termsrv.dll
    [-] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\termsrv.dll
    [-] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\system32\termsrv.dll
    [-] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\system32\dllcache\termsrv.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "nwiz"="nwiz.exe" [2009-01-15 1657376]
    "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952]
    "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 56080]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 56080]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-8-26 692224]
    NETGEAR WN111v2 Smart Wizard.lnk - c:\program files\NETGEAR\WN111v2\WN111V2.exe [2008-5-9 1474631]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=&quot;"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    "FirewallOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\AIM\\aim.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-1.12.0.5595-to-1.12.1.5875-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
    "c:\\Program Files\\World of Warcraft\\Launcher.exe"=
    "c:\\Program Files\\Ubisoft\\Heroes of Might and Magic V\\bin\\H5_Game.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\WINDOWS\\system32\\dpvsetup.exe"=
    "c:\\Program Files\\Participatory Culture Foundation\\Miro\\Miro_Downloader.exe"=
    "c:\\Program Files\\Diablo II\\Diablo II.exe"=
    "c:\\Program Files\\Ubisoft\\Heroes of Might and Magic V\\bina1\\H5_Game.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-2.3.3.7799-to-2.4.0.8089-enUS-downloader.exe"=
    "c:\\Program Files\\Bodog Poker\\BPGame.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3724:TCP"= 3724:TCP:Wow
    "6112:TCP"= 6112:TCP:Wc3
    "6119:TCP"= 6119:TCP:blizz
    "6113:TCP"= 6113:TCP:blizz

    R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2/6/2009 2:23 PM 106208]
    R1 EncorMpd;EncorMpd;c:\windows\system32\drivers\ENCORMPD.SYS [12/28/2006 11:25 PM 35488]
    R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2/6/2009 2:24 PM 93336]
    R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2/6/2009 2:23 PM 727720]
    R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [7/24/2003 12:10 PM 17149]
    R3 JSWSCIMD;jswscimd Service;c:\windows\system32\drivers\jswscimd.sys [2/12/2008 6:05 PM 57440]
    R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [8/2/2005 4:10 PM 32512]
    R3 WSIMD;wsimd Service;c:\windows\system32\drivers\wsimd.sys [12/14/2007 4:31 AM 57408]
    S1 EncorDev;EncorDev;c:\windows\system32\drivers\ENCORDEV.SYS [12/28/2006 11:25 PM 9440]
    S3 A5AGU;D-Link USB Wireless Network Adapter Service;c:\windows\system32\drivers\A5AGU.sys [7/25/2005 11:32 PM 377920]
    S3 ATHFMWDL;D-Link predator Bootloader driver;c:\windows\system32\drivers\ATHFMWDL.sys [7/25/2005 11:35 PM 43392]
    S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\NETGEAR\WN111v2\jswpsapi.exe [2/27/2008 11:54 AM 360547]
    S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
    S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\DRIVERS\rt2870.sys --> c:\windows\system32\DRIVERS\rt2870.sys [?]
    S3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\system32\drivers\WN111v2.sys [5/31/2008 2:46 PM 434688]
    S3 XDva064;XDva064;\??\c:\windows\system32\XDva064.sys --> c:\windows\system32\XDva064.sys [?]

    --- Other Services/Drivers In Memory ---

    *Deregistered* - project
    .
    Contents of the 'Scheduled Tasks' folder

    2009-08-01 c:\windows\Tasks\WGASetup.job
    - c:\windows\system32\KB905474\wgasetup.exe [2009-04-29 03:18]
    .
    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.google.com/
    FF - ProfilePath - c:\documents and settings\Bruce\Application Data\Mozilla\Firefox\Profiles\9jqgccvx.default\
    FF - plugin: c:\documents and settings\Bruce\Application Data\Mozilla\Firefox\Profiles\9jqgccvx.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll
    FF - plugin: c:\documents and settings\Bruce\Application Data\Mozilla\plugins\npoctoshape.dll
    FF - plugin: c:\program files\Octoshape Streaming Services\Bruce\octoprogram-L03-NMS0806110_SUA_900\npoctoshape.dll
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-03 04:31
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\npggsvc]
    "ImagePath"="c:\windows\system32\GameMon.des -service"
    .
    DLLs Loaded Under Running Processes

    - - - - - - - > 'explorer.exe'(5712)
    c:\program files\Logitech\SetPoint\lgscroll.dll

    - - - - - - - > 'explorer.exe'(5596)
    c:\program files\Logitech\SetPoint\lgscroll.dll
    .
    Completion time: 2009-08-03 4:35
    ComboFix-quarantined-files.txt 2009-08-03 09:34
    ComboFix2.txt 2009-08-01 17:37

    Pre-Run: 47,640,539,136 bytes free
    Post-Run: 47,668,768,768 bytes free

    214 --- E O F --- 2009-07-29 00:39
  • Brooce
    edited August 2009
    just scanned it and it doesn't detect termsrv.dll as a threat anymore, going to continue scanning to see if there's anymore problems. thanks!
  • KatanaKatana
    edited August 2009
    Submit a File For Analysis
    We need to have the files below Scanned by Uploading them/it to Virus Total

    Please visit Virustotal
    Copy/paste the the following file path into the window
    C:\WINDOWS\System32\Drivers\register.sys
    Click Submit/Send File

    When the scan has finished, you can copy the URL from the browser address window and paste it in your reply.

    If Virustotal is too busy please try Jotti
  • Brooce
    edited August 2009
    analisis/1d31b990adb87b6b1aec83f08d88a445acdcbd21f613d7475885a3b8f94584cb-1245637919
    here it is
  • KatanaKatana
    edited August 2009
    Congratulations your logs look clean :)

    Let's see if I can help you keep it that way

    First lets tidy up


    Uninstall Combofix
    • This will clear your System Volume Information restore points and remove all the infected files that were quarantined
    • Click START then RUN
    • Now type Combofix /u in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
      • CF_Cleanup.png



    OTCleanup
    Please download OTCleanup from HERE
    Click the OTC.exe icon and then click the CleanUp button.
    If you get any pop ups asking if it is OK let the program proceed. At the end the program will ask to let it reboot the computer. Let it do so.
    Let me know if there were any problems with OT CleanIt


    You can also delete any logs we have produced, and empty your Recycle bin.

    The following is some info to help you stay safe and clean.


    You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.
    ( Vista users must ensure that any programs are Vista compatible BEFORE installing )

    Online Scanners
    I would recommend a scan at one or more of the following sites at least once a month.

    http://www.pandasecurity.com/activescan
    http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html

    !!! Make sure that all your programs are updated !!!
    Secunia Software Inspector does all the work for you, .... see HERE for details

    AntiSpyware
      AntiSpyware is
    not the same thing as Antivirus.
    Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
    You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
    Most of the programs in this list have a free (for Home Users ) and paid versions,
    it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
    [*]Spybot - Search & Destroy <<< A must have program
    • It includes host protection and registry protection
    • A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites

    [*] MalwareBytes Anti-malware <<< A New and effective program
    [*]a-squared Free <<< A good "realtime" or "on demand" scanner
    [*]superantispyware <<< A good "realtime" or "on demand" scanner



    Prevention
      These programs don't detect malware, they help stop it getting on your machine in the first place. Each does a different job, so you can have more than one
    • Winpatrol
      • An excellent startup manager and then some !!
      • Notifies you if programs are added to startup
      • Allows delayed startup
      • A must have addition
    • SpywareBlaster 4.0
      • SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
    • SpywareGuard 2.2
      • SpywareGuard provides real-time protection against spyware.
      • Not required if you have other "realtime" antispyware or Winpatrol
    • ZonedOut
      • Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
    • MVPS HOSTS
      • This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
      • For information on how to download and install, please read this tutorial by WinHelp2002.
      • Not required if you are using other host file protections


    Internet Browsers
      Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys. Using a different web browser can help stop malware getting on your machine.
    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
      1. From within Internet Explorer click on the Tools menu and then click on Options.
      2. Click once on the Security tab
      3. Click once on the Internet icon so it becomes highlighted.
      4. Click once on the Custom Level button.
        • Change the Download signed ActiveX controls to Prompt
        • Change the Download unsigned ActiveX controls to Disable
        • Change the Initialise and script ActiveX controls not marked as safe to Disable
        • Change the Installation of desktop items to Prompt
        • Change the Launching programs and files in an IFRAME to Prompt
        • Change the Navigate sub-frames across different domains to Prompt
        • When all these settings have been made, click on the OK button.
        • If it prompts you as to whether or not you want to save the settings, press the Yes button.
      5. Next press the Apply button and then the OK to exit the Internet Properties page.

    If you are still using IE6 then either update, or get one of the following.
    • FireFox
      • With many addons available that make customization easy this is a very popular choice
      • NoScript and AdBlockPlus addons are essential
    • Opera
      • Another popular alternative
    • Netscape
      • Another popular alternative
      • Also has Addons available



    Cleaning Temporary Internet Files and Tracking Cookies
      Temporary Internet Files are mainly the files that are downloaded when you open a web page. Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware. It is a good idea to empty the Temporary Internet Files folder on a regular basis. Tracking Cookies are files that websites use to monitor which sites you visit and how often. A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted. CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords Both of these can be cleaned manually, but a quicker option is to use a program
    • ATF Cleaner
      • Free and very simple to use
    • CCleaner
      • Free and very flexible, you can chose which cookies to keep


    Also PLEASE read this article.....So How Did I Get Infected In The First Place

    The last and most important thing I can tell you is UPDATE.
    If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
    Malware changes on a day to day basis. You should update every week at the very least.

    If you follow this advice then (with a bit of luck) you will never have to hear from me again :D


    If you could post back one more time to let me know everything is OK, then I can have this thread archived.

    Happy surfing K'
  • Brooce
    edited August 2009
    alright i've updated java, acrobat, flash player, and windows updates, deleted combo fix and ran otc. Everything seems to be in order i'll let you know if there's anything wrong in the future. Once again thanks for all the help =)
Sign In or Register to comment.