Trojan dns changer and blue screen of death

needhelpformycomputer · June 17, 2009

I believe my computer has a dns changer trojan. After searching all day for solutions i've come up empty handed.

My computer this morning would not start but gave me a blue screen with VER_IRQL_NOT_LESS_OR_EQUAL error.

I then started my computer in safe mode and tried using malware bytes to see if any problems came up. The results were negative and it said my computer was fine. I then restarted my computer with the last known good configuration and had some success as my computer was finally not giving me the blue screen of death.

I opened mozilla and searched in yahoo and was then redirected to a different site. using another computer I believe this is a DNS changer if not more...

I've tried all day trying to figure out how to fix these problems and my computer is still infected and will still randomly give me the blue screen error

Here is my Malware bytes most recent log:

Malwarebytes' Anti-Malware 1.37

Database version: 2285

Windows 5.1.2600 Service Pack 3

9/28/2004 11:16:56 PM

mbam-log-2004-09-28 (23-16-56).txt

Scan type: Quick Scan

Objects scanned: 107699

Time elapsed: 7 minute(s), 8 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

and my HJthis log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:06:20 PM, on 9/28/2004

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16850)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\AlienGUIse\wbload.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\McAfee.com\Agent\mcagent.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Samsung\Digimax Viewer 2.1\STImgBrowser.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\program files\common files\mcafee\mna\mcnasvc.exe

c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\McAfee\MPF\MPFSrv.exe

C:\Program Files\McAfee\MSK\MskSrver.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

c:\PROGRA~1\mcafee\msc\mcshell.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll

O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll

O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [bearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause

O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')

O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = C:\Documents and Settings\Carol\Local Settings\Temp\{2C275DDF-03EC-408B-8373-4E1B1088C37E}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe

O4 - Global Startup: Digimax Viewer 2.1.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab

O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab

O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo...toUploader3.cab

O16 - DPF: {5D80A6D1-B500-47DA-82B8-EB9875F85B4D} (Google Gadget Control) - http://dl.google.com/dl/desktop/nv/GoogleG...PluginIEWin.cab

O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1195769984656

O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-4d6adda944d9d292.spaces.live.co...ad/MsnPUpld.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {CAFECAFE-0013-0001-0028-ABCDEFABCDEF} (JInitiator 1.3.1.28) -

O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/GameHos...ronGameHost.cab

O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O20 - AppInit_DLLs: wbsys.dll c:\windows\system32\vufipuye.dll

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 11662 bytes

Thanks for any help!

Tigger93 · June 17, 2009

Hi.

Open open notepad and copy and paste in the following:

MD "%USERPROFILE%"\desktop\malware
xcopy c:\windows\system32\vufipuye.dll "%USERPROFILE%"\desktop\malware /c /q /r /h /y
Attrib -s -r -h "%USERPROFILE%"\desktop\malware\*.*

Save it as getmalware.bat to the desktop and double-click on it to run it. It will create a folder called malware on your desktop. Please zip up this folder and attach it here in a new topic with a link to this thread. I will get back to you once they have been analyzed.

needhelpformycomputer · June 17, 2009

hi tigger thanks for your help but I did as you said and the file malware appeared with nothing inside of it and there was nothing to compress...did I do something wrong? thanks

Tigger93 · June 17, 2009

It's okay. Good to know the file doesn't exist.

Download ComboFix from one of the locations below, and save it to your Desktop.

Link 1

Link 2

Double click combofix.exe and follow the prompts. Please, never rename Combofix unless instructed.

When finished, it shall produce a log for you. Post that log and a HijackThis log in your next reply

Note: Do not mouseclick Combofix's window while its running. That may cause it to stall

needhelpformycomputer · June 18, 2009

here is the Combofix log:

ComboFix 09-06-17.02 - Carol 09/29/2004 8:57.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.176 [GMT -4:00]

Running from: c:\documents and settings\Carol\Desktop\ComboFix.exe

AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\drivers\SKYNETbmqxftid.sys

c:\windows\system32\SKYNETbrdlypur.dat

c:\windows\system32\SKYNETihdaiycm.dat

c:\windows\system32\SKYNEToypktgru.dll

c:\windows\system32\SKYNETvkosnktt.dll

c:\windows\system32\drivers\SKYNETbmqxftid.sys

c:\windows\system32\SKYNETbrdlypur.dat

c:\windows\system32\SKYNETihdaiycm.dat

c:\windows\system32\SKYNEToypktgru.dll

c:\windows\system32\SKYNETvkosnktt.dll

c:\windows\wiaserviv.log

c:\windows\system32\proquota.exe was missing

Restored copy from - c:\windows\ServicePackFiles\i386\proquota.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_SKYNETletewmtb

((((((((((((((((((((((((( Files Created from 2004-08-28 to 2004-09-29 )))))))))))))))))))))))))))))))

.

2009-06-02 22:26 . 2009-06-02 22:26 -------- d-----w- c:\documents and settings\Carol\Oracle Jar Cache

2009-06-02 22:26 . 2009-06-02 22:26 -------- d-----w- c:\documents and settings\Carol\.jinit

2009-06-02 22:24 . 2009-06-02 22:24 -------- d-----w- c:\program files\Oracle

2009-06-02 22:24 . 2006-09-28 08:45 36962 ------w- c:\windows\system32\ActPanel.dll

2009-05-07 15:32 . 2009-05-07 15:32 345600 -c----w- c:\windows\system32\dllcache\localspl.dll

2009-04-17 21:54 . 2009-03-06 14:22 284160 -c----w- c:\windows\system32\dllcache\pdh.dll

2009-04-17 21:54 . 2009-02-09 12:10 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll

2009-04-17 21:54 . 2009-02-06 11:11 110592 -c----w- c:\windows\system32\dllcache\services.exe

2009-04-17 21:54 . 2009-02-09 12:10 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll

2009-04-17 21:54 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe

2009-04-17 21:54 . 2009-02-09 12:10 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll

2009-04-17 21:54 . 2009-02-09 12:10 729088 -c----w- c:\windows\system32\dllcache\lsasrv.dll

2009-04-17 21:54 . 2009-02-09 12:10 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll

2009-04-17 21:53 . 2009-02-09 12:10 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll

2009-04-17 21:50 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll

2009-04-17 21:50 . 2008-04-21 12:08 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe

2009-04-15 14:51 . 2009-04-15 14:51 585216 -c----w- c:\windows\system32\dllcache\rpcrt4.dll

2009-04-02 00:19 . 2009-04-02 00:20 1047072 ----a-w- c:\documents and settings\Carol\Application Data\Move Networks\MoveMediaPlayer_071303000006.exe

2009-03-21 14:06 . 2009-03-21 14:06 989696 -c----w- c:\windows\system32\dllcache\kernel32.dll

2009-03-18 11:02 . 2009-03-18 11:02 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\SACore

2009-03-15 02:48 . 2009-03-15 02:48 1878984 ----a-w- c:\documents and settings\Carol\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe

2009-03-09 17:29 . 2009-03-09 17:29 97144 ----a-w- c:\documents and settings\Carol\Application Data\Move Networks\ie_bin\MovePlayerUpgrade.exe

2009-03-09 17:29 . 2009-03-09 17:29 1010552 ----a-w- c:\documents and settings\Carol\Application Data\Move Networks\ie_bin\qsp2ie071303000006.dll

2009-02-20 18:09 . 2009-04-29 04:55 78336 -c----w- c:\windows\system32\dllcache\ieencode.dll

2009-02-06 21:06 . 2009-02-13 22:27 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll

2009-02-03 19:59 . 2009-02-03 19:59 56832 -c----w- c:\windows\system32\dllcache\secur32.dll

2009-01-31 00:48 . 2009-02-05 15:38 -------- d-----w- c:\program files\MySpace Games

2009-01-31 00:48 . 2009-01-31 00:48 -------- d-----w- c:\program files\Oberon Media

2009-01-31 00:48 . 2009-01-31 00:48 -------- d-----w- c:\program files\Common Files\Oberon Media

2009-01-16 01:18 . 2009-01-16 01:18 1887176 ----a-w- c:\documents and settings\Carol\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe

2009-01-16 00:20 . 2009-01-16 00:20 -------- d-----w- c:\program files\att-prt22

2009-01-16 00:20 . 2009-01-16 00:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive

2009-01-16 00:20 . 2009-01-16 00:20 -------- d-----w- c:\program files\Common Files\Motive

2009-01-16 00:19 . 2009-01-16 00:21 -------- d-----w- c:\program files\ATT-PRT22-WISE

2009-01-08 00:33 . 2008-11-27 07:29 43008 ----a-w- c:\documents and settings\Carol\Application Data\Mozilla\Firefox\Profiles\flchjt84.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll

2009-01-08 00:33 . 2008-11-27 07:29 43008 ----a-w- c:\documents and settings\Carol\Application Data\Mozilla\Firefox\Profiles\flchjt84.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll

2009-01-08 00:33 . 2008-11-27 07:29 245248 ----a-w- c:\documents and settings\Carol\Application Data\Mozilla\Firefox\Profiles\flchjt84.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\metrics-ff2.dll

2009-01-08 00:33 . 2008-11-27 07:29 243200 ----a-w- c:\documents and settings\Carol\Application Data\Mozilla\Firefox\Profiles\flchjt84.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\metrics-ff3.dll

2009-01-08 00:33 . 2008-11-27 07:29 239616 ----a-w- c:\documents and settings\Carol\Application Data\Mozilla\Firefox\Profiles\flchjt84.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll

2009-01-08 00:33 . 2008-11-27 07:29 233984 ----a-w- c:\documents and settings\Carol\Application Data\Mozilla\Firefox\Profiles\flchjt84.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll

2008-12-22 15:33 . 2008-05-28 11:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2008-12-22 15:33 . 2008-05-27 18:39 -------- d-----w- c:\program files\Spybot - Search & Destroy

2008-12-16 12:30 . 2008-12-16 12:30 354304 -c----w- c:\windows\system32\dllcache\winhttp.dll

2008-12-11 02:34 . 2008-12-11 02:34 -------- d-----w- c:\program files\Lavasoft

2008-12-11 02:34 . 2008-12-11 02:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2008-12-11 02:33 . 2008-12-11 02:33 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2008-12-10 03:35 . 2008-12-10 03:35 90112 ----a-w- c:\documents and settings\Carol\Application Data\Sun\Java\Deployment\cache\6.0\46\140de92e-447d3890-n\on2_decoder.dll

2008-12-10 03:35 . 2008-12-10 03:34 410984 ----a-w- c:\windows\system32\deploytk.dll

2008-12-10 03:28 . 2008-12-10 03:28 152576 ----a-w- c:\documents and settings\Carol\Application Data\Sun\Java\jre1.6.0_11\lzma.dll

2008-12-07 21:15 . 2008-12-07 21:15 -------- d-----w- c:\documents and settings\DaViD 8D\Application Data\Skype

2008-12-05 06:54 . 2008-12-05 06:54 144896 -c----w- c:\windows\system32\dllcache\schannel.dll

2008-12-03 22:55 . 2009-02-05 15:37 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2008-12-03 22:10 . 2008-12-03 22:10 -------- d-----w- C:\VundoFix Backups

2008-12-02 01:38 . 2004-09-29 10:06 3561743 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2008-11-30 22:51 . 2008-11-30 22:51 -------- d-----w- c:\documents and settings\DaViD 8D\Local Settings\Application Data\Mozilla

2008-11-28 18:14 . 2008-11-28 18:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Trymedia

2008-11-19 19:49 . 2009-06-12 01:08 -------- d-----w- c:\documents and settings\Carol\Application Data\Move Networks

2008-11-19 19:49 . 2009-04-02 00:20 34062 ----a-w- c:\documents and settings\Carol\Application Data\Move Networks\ie_bin\Uninst.exe

2008-11-12 12:29 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys

2008-11-12 12:28 . 2008-09-04 17:15 1106944 -c----w- c:\windows\system32\dllcache\msxml3.dll

2008-10-28 21:26 . 2008-10-28 21:26 -------- d-----w- c:\documents and settings\Mom\Application Data\Skype

2008-10-28 21:25 . 2008-10-28 21:25 -------- d-----w- c:\documents and settings\Mom\Local Settings\Application Data\Apple Computer

2008-10-28 21:25 . 2008-10-28 21:25 -------- d-----w- c:\documents and settings\Mom\Local Settings\Application Data\Mozilla

2008-10-24 11:17 . 2008-10-15 16:34 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll

2008-10-23 12:36 . 2008-10-23 12:36 286720 -c----w- c:\windows\system32\dllcache\gdi32.dll

2008-10-16 11:11 . 2008-12-11 10:57 333952 -c----w- c:\windows\system32\dllcache\srv.sys

2008-10-16 11:08 . 2009-04-17 12:26 1847168 -c----w- c:\windows\system32\dllcache\win32k.sys

2008-10-16 11:08 . 2009-02-06 11:06 2145280 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe

2008-10-16 11:08 . 2009-02-06 11:08 2189056 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe

2008-10-16 11:08 . 2009-02-06 10:32 2023936 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe

2008-10-16 11:08 . 2009-02-07 23:02 2066048 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe

2008-10-16 02:43 . 2008-10-16 02:43 -------- d-----w- c:\program files\Free iPod Video Converter

2008-10-01 21:58 . 2009-06-04 18:17 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore

2008-09-23 23:41 . 2008-09-23 23:41 -------- d-----w- c:\program files\iPod

2008-09-23 23:41 . 2008-09-23 23:42 -------- d-----w- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2008-09-23 23:41 . 2008-09-23 23:42 -------- d-----w- c:\program files\iTunes

2008-09-23 23:39 . 2008-09-23 23:39 -------- d-----w- c:\program files\QuickTime

2008-09-23 23:30 . 2008-09-23 23:30 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.0.0.35\SetupAdmin.exe

2008-09-11 17:20 . 2008-09-11 17:20 -------- d-----w- c:\windows\system32\scripting

2008-09-11 17:20 . 2008-09-11 17:20 -------- d-----w- c:\windows\l2schemas

2008-09-11 17:20 . 2008-09-11 17:20 -------- d-----w- c:\windows\system32\en

2008-09-11 17:20 . 2008-09-11 17:20 -------- d-----w- c:\windows\system32\bits

2008-09-11 17:17 . 2008-09-11 17:21 -------- d-----w- c:\windows\ServicePackFiles

2008-09-11 17:08 . 2008-09-11 17:08 -------- d-----w- c:\windows\EHome

2008-08-29 14:18 . 2008-08-29 14:18 87336 ----a-w- c:\windows\system32\dns-sd.exe

2008-08-29 13:53 . 2008-08-29 13:53 61440 ----a-w- c:\windows\system32\dnssd.dll

2008-08-26 19:54 . 2008-08-06 19:29 348160 ----a-w- c:\windows\system32\msvcr71.dll

2008-08-26 19:54 . 2008-08-06 19:27 499712 ----a-w- c:\windows\system32\msvcp71.dll

2008-08-26 19:53 . 2009-01-13 19:54 -------- d-----w- c:\windows\system32\Adobe

2008-08-23 18:11 . 2004-09-29 02:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater

2008-08-17 17:56 . 2008-04-14 00:12 20992 ------w- c:\windows\system32\spupdwxp.exe

2008-08-17 17:55 . 2008-04-14 00:11 37376 ------w- c:\windows\system32\l2gpstore.dll

2008-08-14 00:23 . 2008-08-14 00:23 -------- d-----w- c:\documents and settings\Carol\Application Data\Malwarebytes

2008-08-14 00:23 . 2009-06-17 15:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2008-08-14 00:23 . 2009-06-17 15:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2008-08-14 00:23 . 2008-08-14 00:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2008-08-14 00:23 . 2004-09-29 10:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2008-08-13 11:13 . 2008-04-11 19:04 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll

2008-08-10 21:41 . 2008-08-10 21:41 -------- d-----w- c:\windows\system32\wbem\Repository

2008-08-02 00:52 . 2008-08-02 00:52 -------- d-----w- c:\documents and settings\Mom\Application Data\MySpace

2008-08-01 00:19 . 2008-08-01 00:19 -------- d-----w- c:\documents and settings\Carol\WINDOWS

2008-08-01 00:19 . 2008-08-01 00:19 -------- d-----w- C:\Dell720

2008-07-31 23:45 . 2002-01-08 21:00 176128 ----a-w- c:\windows\system32\RcdScan.dll

2008-07-31 23:45 . 2000-03-23 16:50 446464 ----a-r- c:\windows\system32\hhactivex.dll

2008-07-31 23:45 . 1998-06-18 03:00 89360 ----a-w- c:\windows\system32\VB5DB.DLL

2008-07-31 23:45 . 2001-08-22 12:42 13632 ------w- c:\windows\system32\drivers\omci.sys

2008-07-31 23:39 . 2008-04-13 18:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys

2008-07-23 22:16 . 2008-10-02 11:11 -------- d-----w- c:\documents and settings\All Users\Application Data\SiteAdvisor

2008-07-21 00:21 . 2008-12-02 01:17 -------- d-----w- c:\program files\Bonjour

2008-07-21 00:08 . 2008-07-21 00:08 -------- d-----w- c:\program files\Common Files\Macrovision Shared

2008-07-07 20:26 . 2008-07-07 20:26 253952 -c----w- c:\windows\system32\dllcache\es.dll

2008-07-04 17:35 . 2008-07-04 17:35 54632 ----a-w- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\DifXInstall32.exe

2008-06-24 16:43 . 2008-06-24 16:43 74240 -c----w- c:\windows\system32\dllcache\mscms.dll

2008-06-22 02:48 . 2008-06-22 02:48 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet

2008-06-20 17:46 . 2008-06-20 17:46 245248 -c----w- c:\windows\system32\dllcache\mswsock.dll

2008-06-20 17:46 . 2008-06-20 17:46 147968 -c----w- c:\windows\system32\dllcache\dnsapi.dll

2008-06-20 11:51 . 2008-06-20 11:51 361600 -c----w- c:\windows\system32\dllcache\tcpip.sys

2008-06-20 11:40 . 2008-08-14 10:04 138496 -c----w- c:\windows\system32\dllcache\afd.sys

2008-06-20 11:08 . 2008-06-20 11:08 225856 -c----w- c:\windows\system32\dllcache\tcpip6.sys

2008-06-17 19:02 . 2008-06-17 19:02 8461312 -c----w- c:\windows\system32\dllcache\shell32.dll

2008-06-12 14:23 . 2008-06-12 14:23 956928 -c----w- c:\windows\system32\dllcache\msdtctm.dll

2008-06-12 14:23 . 2008-06-12 14:23 91648 -c----w- c:\windows\system32\dllcache\mtxoci.dll

2008-06-12 14:23 . 2008-06-12 14:23 66560 -c----w- c:\windows\system32\dllcache\mtxclu.dll

2008-06-12 14:23 . 2008-06-12 14:23 58880 -c----w- c:\windows\system32\dllcache\msdtclog.dll

2008-06-12 14:23 . 2008-06-12 14:23 428032 -c----w- c:\windows\system32\dllcache\msdtcprx.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-06-15 14:40 . 2007-06-05 16:27 90112 ----a-w- c:\windows\DUMP4882.tmp

2009-06-02 22:24 . 2007-06-05 21:16 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-05-07 15:32 . 2004-08-12 13:59 345600 ----a-w- c:\windows\system32\localspl.dll

2009-04-29 04:56 . 2004-08-12 14:09 827392 ----a-w- c:\windows\system32\wininet.dll

2009-04-29 04:55 . 2004-08-12 13:58 78336 ----a-w- c:\windows\system32\ieencode.dll

2009-04-17 12:26 . 2004-08-12 14:09 1847168 ----a-w- c:\windows\system32\win32k.sys

2009-04-15 14:51 . 2004-08-12 14:04 585216 ----a-w- c:\windows\system32\rpcrt4.dll

2009-03-06 14:22 . 2004-08-12 14:03 284160 ----a-w- c:\windows\system32\pdh.dll

2009-02-09 12:10 . 2004-08-12 13:59 729088 ----a-w- c:\windows\system32\lsasrv.dll

2009-02-09 12:10 . 2007-06-05 20:40 453120 ----a-w- c:\windows\system32\wbem\wmiprvsd.dll

2009-02-09 12:10 . 2007-06-05 20:40 473600 ----a-w- c:\windows\system32\wbem\fastprox.dll

2009-02-09 12:10 . 2004-08-12 14:04 401408 ----a-w- c:\windows\system32\rpcss.dll

2009-02-09 12:10 . 2004-08-12 14:02 714752 ----a-w- c:\windows\system32\ntdll.dll

2009-02-09 12:10 . 2004-08-12 13:55 617472 ----a-w- c:\windows\system32\advapi32.dll

2009-02-06 11:11 . 2004-08-12 14:05 110592 ----a-w- c:\windows\system32\services.exe

2009-02-06 11:06 . 2004-08-12 14:02 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe

2009-02-06 10:39 . 2004-08-12 14:04 35328 ----a-w- c:\windows\system32\sc.exe

2009-02-06 10:32 . 2004-08-03 22:59 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe

2009-02-06 10:10 . 2007-06-05 20:40 227840 ----a-w- c:\windows\system32\wbem\wmiprvse.exe

2009-02-03 19:59 . 2004-08-12 14:04 56832 ----a-w- c:\windows\system32\secur32.dll

2008-12-20 22:14 . 2004-08-12 14:03 1288192 ----a-w- c:\windows\system32\quartz.dll

2008-12-16 12:30 . 2004-08-12 14:09 354304 ----a-w- c:\windows\system32\winhttp.dll

2008-12-11 10:57 . 2004-08-12 14:06 333952 ----a-w- c:\windows\system32\drivers\srv.sys

2008-12-05 06:54 . 2004-08-12 14:04 144896 ----a-w- c:\windows\system32\schannel.dll

2008-10-24 11:21 . 2004-08-12 14:00 455296 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2008-10-23 12:36 . 2004-08-12 13:57 286720 ----a-w- c:\windows\system32\gdi32.dll

2008-10-16 19:13 . 2007-06-05 20:41 202776 ----a-w- c:\windows\system32\wuweb.dll

2008-10-16 19:13 . 2007-06-05 20:41 1809944 ----a-w- c:\windows\system32\wuaueng.dll

2008-10-16 19:12 . 2007-06-05 20:41 323608 ----a-w- c:\windows\system32\wucltui.dll

2008-10-16 19:12 . 2007-06-05 20:41 561688 ----a-w- c:\windows\system32\wuapi.dll

2008-10-16 19:09 . 2007-06-05 20:41 51224 ----a-w- c:\windows\system32\wuauclt.exe

2008-10-16 19:09 . 2007-04-17 02:45 43544 ----a-w- c:\windows\system32\wups2.dll

2008-10-16 19:09 . 2004-08-12 13:56 92696 ----a-w- c:\windows\system32\cdm.dll

2008-10-16 19:08 . 2007-06-05 20:41 34328 ----a-w- c:\windows\system32\wups.dll

2008-10-03 10:02 . 2004-08-12 14:06 247326 ----a-w- c:\windows\system32\strmdll.dll

2008-09-11 17:23 . 2007-06-05 20:43 77423 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2008-09-10 01:14 . 2008-08-17 17:56 1307648 ----a-w- c:\windows\system32\msxml6.dll

2008-09-04 17:15 . 2004-08-12 14:01 1106944 ----a-w- c:\windows\system32\msxml3.dll

2008-08-14 10:04 . 2004-08-12 13:55 138496 ----a-w- c:\windows\system32\drivers\afd.sys

2008-08-10 20:34 . 2008-08-10 20:34 0 -c--a-w- c:\windows\system32\1B.tmp

2008-07-07 20:26 . 2004-08-12 13:57 253952 ----a-w- c:\windows\system32\es.dll

2008-06-24 16:43 . 2004-08-12 14:00 74240 ----a-w- c:\windows\system32\mscms.dll

2008-06-20 17:46 . 2004-08-12 14:01 245248 ----a-w- c:\windows\system32\mswsock.dll

2008-06-20 11:51 . 2004-08-12 14:07 361600 ----a-w- c:\windows\system32\drivers\tcpip.sys

2008-06-20 11:08 . 2004-08-12 14:07 225856 ----a-w- c:\windows\system32\drivers\tcpip6.sys

2008-06-12 14:23 . 2007-06-05 20:40 91648 ----a-w- c:\windows\system32\mtxoci.dll

2008-06-12 14:23 . 2007-06-05 20:40 428032 ----a-w- c:\windows\system32\msdtcprx.dll

2008-06-12 14:23 . 2007-06-05 20:40 161792 ----a-w- c:\windows\system32\msdtcuiu.dll

2008-06-12 14:23 . 2007-06-05 20:40 956928 ----a-w- c:\windows\system32\msdtctm.dll

2008-06-12 14:23 . 2007-06-05 20:40 58880 ----a-w- c:\windows\system32\msdtclog.dll

2008-06-12 14:23 . 2004-08-12 14:01 66560 ----a-w- c:\windows\system32\mtxclu.dll

2008-06-10 11:11 . 2004-08-12 14:10 1053696 ----a-w- c:\windows\system32\WMNetmgr.dll

2008-06-10 08:11 . 2004-08-12 13:59 103936 ----a-w- c:\windows\system32\logagent.exe

2008-05-09 10:53 . 2004-08-12 14:10 90112 ----a-w- c:\windows\system32\wshext.dll

2008-05-09 10:53 . 2004-08-12 14:08 430080 ----a-w- c:\windows\system32\vbscript.dll

2008-05-09 10:53 . 2004-08-12 14:04 172032 ----a-w- c:\windows\system32\scrrun.dll

2008-05-09 10:53 . 2004-08-12 14:04 180224 ----a-w- c:\windows\system32\scrobj.dll

2008-05-08 14:02 . 2004-08-12 14:04 203136 ----a-w- c:\windows\system32\drivers\rmcast.sys

2008-05-08 11:24 . 2004-08-12 14:10 155648 ----a-w- c:\windows\system32\wscript.exe

2008-05-07 09:07 . 2004-08-12 13:56 135168 ----a-w- c:\windows\system32\cscript.exe

2008-04-17 17:12 . 2006-10-03 23:47 107368 ----a-w- c:\windows\system32\GEARAspi.dll

2008-04-17 17:12 . 2006-09-19 18:44 15464 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2008-04-14 09:42 . 2004-08-12 14:06 11264 ----a-w- c:\windows\system32\spnpinst.exe

2008-04-14 09:42 . 2004-08-12 14:05 985088 ----a-w- c:\windows\system32\setupapi.dll

2008-04-14 09:41 . 2004-08-12 13:59 423936 ----a-w- c:\windows\system32\licdll.dll

2008-04-14 00:25 . 2004-08-12 13:56 1804 ----a-w- c:\windows\system32\dcache.bin

2008-04-14 00:16 . 2004-08-12 14:02 329728 ----a-w- c:\windows\system32\netsetup.exe

2008-04-14 00:13 . 2007-06-05 20:40 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2008-04-14 00:13 . 2007-06-05 20:40 87176 ----a-w- c:\windows\system32\rdpwsx.dll

2008-04-14 00:13 . 2004-08-12 14:04 92424 ----a-w- c:\windows\system32\rdpdd.dll

2008-04-14 00:13 . 2007-06-05 20:40 21896 ----a-w- c:\windows\system32\drivers\tdtcp.sys

2008-04-14 00:13 . 2004-08-12 14:07 12168 ----a-w- c:\windows\system32\tsddd.dll

2008-04-14 00:13 . 2007-06-05 20:40 12040 ----a-w- c:\windows\system32\drivers\tdpipe.sys

2008-04-14 00:13 . 2007-06-05 20:39 40840 ----a-w- c:\windows\system32\drivers\termdd.sys

2008-04-14 00:13 . 2004-08-12 13:57 299520 ----a-w- c:\windows\system32\drmclien.dll

2008-04-14 00:11 . 2007-06-05 20:41 3166208 ----a-w- c:\windows\srchasst\msgr3en.dll

2008-04-14 00:10 . 2004-08-12 14:02 53279 ----a-w- c:\windows\system32\odbcji32.dll

2008-04-14 00:10 . 2004-08-12 14:00 4126 ----a-w- c:\windows\system32\msdxmlc.dll

2008-04-14 00:10 . 2004-08-12 14:00 3584 ----a-w- c:\windows\system32\msafd.dll

2008-04-13 21:00 . 2004-08-12 13:56 103424 ----a-w- c:\windows\system32\dpcdll.dll

2008-04-13 19:28 . 2004-08-12 14:04 175744 ----a-w- c:\windows\system32\drivers\rdbss.sys

2008-04-13 19:21 . 2004-08-12 14:01 162816 ----a-w- c:\windows\system32\drivers\netbt.sys

2008-04-13 19:20 . 2004-08-12 14:01 91520 ----a-w- c:\windows\system32\drivers\ndiswan.sys

2008-04-13 19:20 . 2004-08-12 14:01 182656 ----a-w- c:\windows\system32\drivers\ndis.sys

2008-04-13 19:19 . 2004-08-12 14:04 48384 ----a-w- c:\windows\system32\drivers\raspptp.sys

2008-04-13 19:19 . 2004-08-12 14:04 51328 ----a-w- c:\windows\system32\drivers\rasl2tp.sys

2008-04-13 19:19 . 2004-08-12 13:58 75264 ----a-w- c:\windows\system32\drivers\ipsec.sys

2008-04-13 19:19 . 2007-06-05 21:16 146048 ----a-w- c:\windows\system32\drivers\portcls.sys

2008-04-13 19:18 . 2004-08-12 13:57 52480 ----a-w- c:\windows\system32\drivers\i8042prt.sys

2008-04-13 19:17 . 2004-08-12 14:01 105344 ----a-w- c:\windows\system32\drivers\mup.sys

2008-04-13 19:16 . 2004-08-03 23:15 141056 ----a-w- c:\windows\system32\drivers\ks.sys

2008-04-13 19:16 . 2004-08-12 13:56 49536 ----a-w- c:\windows\system32\drivers\classpnp.sys

2008-04-13 19:15 . 2004-08-12 14:02 574976 ----a-w- c:\windows\system32\drivers\ntfs.sys

2008-04-13 19:15 . 2004-08-12 14:04 64512 ----a-w- c:\windows\system32\drivers\serial.sys

2008-04-13 19:14 . 2004-08-12 13:57 143744 ----a-w- c:\windows\system32\drivers\fastfat.sys

2008-04-13 19:14 . 2004-08-12 13:56 63744 ----a-w- c:\windows\system32\drivers\cdfs.sys

2008-04-13 19:00 . 2004-08-03 23:08 30080 ----a-w- c:\windows\system32\drivers\modem.sys

2008-04-13 19:00 . 2004-08-12 14:07 19072 ----a-w- c:\windows\system32\drivers\tdi.sys

2008-04-13 18:57 . 2004-08-12 14:04 41472 ----a-w- c:\windows\system32\drivers\raspppoe.sys

2008-04-13 18:57 . 2004-08-12 14:01 40576 ----a-w- c:\windows\system32\drivers\ndproxy.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]

"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-10 136600]

"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-04 81920]

"McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-01-09 1176808]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-10-04 1626112]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-02-01 8699904]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Digimax Viewer 2.1.lnk - c:\program files\Samsung\Digimax Viewer 2.1\STImgBrowser.exe [2007-6-8 634880]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]

2001-12-21 03:34 24576 ----a-w- c:\program files\AlienGUIse\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\system32\wbsys.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mfehidk.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mferkdk.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=

"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"c:\\Program Files\\MSN Messenger\\livecall.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\McAfee\\VirusScan\\mcsysmon.exe"=

"c:\\Program Files\\AlienGUIse\\wbload.exe"=

"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [10/1/2008 5:52 PM 210216]

S3 USB-100;USB Fast Ethernet Adapter;c:\windows\system32\drivers\USB150.SYS [6/5/2007 5:07 PM 27519]

.

Contents of the 'Scheduled Tasks' folder

2009-06-10 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 16:34]

2004-09-29 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-23 16:47]

2008-07-15 c:\windows\Tasks\McDefragTask.job

- c:\windows\system32\defrag.exe [2004-08-12 00:12]

2009-01-01 c:\windows\Tasks\McQcTask.job

- c:\program files\mcafee\mqc\QcConsol.exe [2007-06-05 15:53]

.

- - - - ORPHANS REMOVED - - - -

HKLM-Run-BearFlix - c:\program files\BearFlix\BearFlix.exe

SafeBoot-mfehidk

SafeBoot-mferkdk

SafeBoot-mfetdik

SafeBoot-mfetdik.sys

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

DPF: {5D80A6D1-B500-47DA-82B8-EB9875F85B4D} - hxxp://dl.google.com/dl/desktop/nv/GoogleGadgetPluginIEWin.cab

DPF: {CAFECAFE-0013-0001-0028-ABCDEFABCDEF}

FF - ProfilePath -

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2004-09-29 09:13

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2025429265-602162358-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]

@Denied: (Full) (LocalSystem)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(656)

c:\program files\AlienGUIse\fastload.dll

- - - - - - - > 'explorer.exe'(2044)

c:\program files\McAfee\SiteAdvisor\saHook.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\rundll32.exe

c:\windows\system32\LEXBCES.EXE

c:\windows\system32\LEXPPS.EXE

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Motive\McciCMService.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\windows\system32\nvsvc32.exe

c:\program files\iPod\bin\iPodService.exe

c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe

c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe

c:\program files\Common Files\McAfee\MNA\McNASvc.exe

c:\progra~1\McAfee\MSC\mcmscsvc.exe

c:\progra~1\McAfee.com\Agent\mcagent.exe

.

**************************************************************************

.

Completion time: 2004-09-29 9:18 - machine was rebooted

ComboFix-quarantined-files.txt 2004-09-29 13:18

Pre-Run: 36,074,323,968 bytes free

Post-Run: 36,466,401,280 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

Current=6 Default=6 Failed=4 LastKnownGood=7 Sets=1,2,3,4,5,6,7

399 --- E O F --- 2009-06-11 04:13

and here is the hijackthis log :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 9:20:53 AM, on 9/29/2004

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16850)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\explorer.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

c:\program files\common files\mcafee\mna\mcnasvc.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\PROGRA~1\mcafee.com\agent\mcagent.exe