Malware.Trace&Trojan.Vundo (and possibly more...?)

Itoshiki · December 21, 2008

Hello,

my name is Zac.

Just recently (Yesterday) there was an attack on my computer (pop-ups), which I immidently took action on and ran a scan.

After the scan was finished, I removed everything, and then rebooted my computer (as instructed).

So when it finished restarting, I go to try and use the internet again, only to be greeted by more pop-ups.

So I ran yet another scan, only this time 2 items were picked up.

(This is from MBAM)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

So I did what I was told again and restarted. However when I went to try and use the internet again; more popups.

Ran another scan; same problem.

If anyone would be willing to help me fix this problem, it would be greatly appricitated.

I've been up for litterly almost 24 hours straight trying to fix this problem.

Thank you in advance.

--------------------------------------------------------------------------------------------------------------------------------------------------------------

Malwarebytes' Anti-Malware 1.31

Database version: 1528

Windows 5.1.2600 Service Pack 3

12/21/2008 2:36:13 PM

mbam-log-2008-12-21 (14-36-13).txt

Scan type: Quick Scan

Objects scanned: 63522

Time elapsed: 9 minute(s), 0 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

--------------------------------------------------------------------------------------------------------------------------------------------------------------

;*******************************************************************************

********************************************************************************

*

*******************

ANALYSIS: 2008-12-21 13:42:00

PROTECTIONS: 1

MALWARE: 17

SUSPECTS: 15

;*******************************************************************************

********************************************************************************

*

*******************

PROTECTIONS

Description Version Active Updated

;===============================================================================

================================================================================

=

===================

Norton AntiVirus 16.0.0.125 Yes Yes

;===============================================================================

================================================================================

=

===================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===============================================================================

================================================================================

=

===================

00029036 adware/superspider Adware No 1 Yes No c:\windows\system32\a.exe

00029434 spyware/virtumonde Spyware No 1 Yes No hkey_local_machine\software\microsoft\ms juan

00039204 adware/cws Adware No 0 Yes No c:\documents and settings\zac\favorites\health

00039204 adware/cws Adware No 0 Yes No c:\documents and settings\zac\favorites\insurance

00046757 spyware/bridge Spyware No 1 Yes No c:\windows\system32\a.exe

00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Zac\Cookies\zac@doubleclick[1].txt

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Zac\Cookies\zac@atdmt[2].txt

00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Zac\Cookies\zac@tribalfusion[1].txt

00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Zac\Cookies\zac@mediaplex[1].txt

00148914 Cookie/Tucows TrackingCookie No 0 Yes No C:\Documents and Settings\Zac\Cookies\zac@tucows[2].txt

00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Zac\Cookies\zac@ad.yieldmanager[2].txt

00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Zac\Cookies\zac@apmebf[1].txt

00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Zac\Cookies\zac@serving-sys[2].txt

00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Zac\Cookies\zac@bs.serving-sys[1].txt

00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\Zac\Cookies\zac@statse.webtrendslive[2].txt

00171475 adware/perfect-search Adware No 0 Yes No c:\documents and settings\zac\favorites\insurance\term life insurance.url

00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Zac\Cookies\zac@target[1].txt

00519333 Application/Processor HackTools No 0 Yes No C:\RECYCLER\S-1-5-21-823518204-2077806209-1801674531-1003\Dc342.exe

;===============================================================================

================================================================================

=

===================

SUSPECTS

Sent Location

;===============================================================================

================================================================================

=

===================

No C:\WINDOWS\System32\xydlaw.dll

No C:\WINDOWS\system32\xydlaw.dll

No C:\WINDOWS\system32\kvptifbq.dll

No C:\WINDOWS\system32\xydlaw.dll

No E:\Desktop Stuff\Files Needed\LocalHost_Multi-Client_v55_without_dmg_cap_swear_filter_disabled_and_drop_able_nx.rar[LocalHost.

exe]

No E:\MapleStory55\LocalHost55.exe

No E:\MapleStory55\LocalHost55.rar[LocalHost55.exe]

No E:\MapleStory55\NoDCFastAttbyjoen.exe

No E:\MapleStory58\localhost.exe

No E:\MapleStory58\localhost.rar[localhost.exe]

No E:\MapleStory58\pk's_edited_localhost.exe

No E:\MapleStory58\PlutoKiss_s_Edited_Localhost.zip[PlutoKiss's Edited Localhost/pk's_edited_localhost.exe]

No E:\MapleStory60\localhost60.exe

No E:\MapleStory60\localhost60.zip[localhost60.exe]

No E:\PlayOnline\SquareEnix\TetraMaster\polboot.exe

;===============================================================================

================================================================================

=

===================

VULNERABILITIES

Id Severity Description

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

--------------------------------------------------------------------------------------------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 4:07:13 AM, on 12/21/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\Program Files\TortoiseSVN\bin\TSVNCache.exe

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\Program Files\Microsoft IntelliType Pro\itype.exe

C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\DNA\btdna.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe

C:\Program Files\Norton AntiVirus\Engine\16.2.0.7\ccSvcHst.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Program Files\Norton AntiVirus\Engine\16.2.0.7\ccSvcHst.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\WINDOWS\system32\SearchFilterHost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\HPZipm12.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.msn.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: {7fe69e12-de0a-10bb-12e4-55b72766eba4} - {4abe6672-7b55-4e21-bb01-a0ed21e96ef7} - C:\WINDOWS\system32\xydlaw.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.2.0.7\IPSBHO.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"

O4 - HKLM\..\Run: [intelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"

O4 - HKLM\..\Run: [soundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [spyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe

O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe"

O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/as...abs/tgctlsr.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1228016758875

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1229228389937

O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O20 - AppInit_DLLs: ofyuwz.dll xydlaw.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)

O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\16.2.0.7\ccSvcHst.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--

End of file - 8090 bytes

Itoshiki · December 21, 2008

So can Malware.Trace and Trojan.Vundo not be removed?

I've still been working (after taking a small nap of course)

and I still can't find a way to successfully remove it.

Am I doomed?

Itoshiki · December 22, 2008

Just a small update;

From the looks of it, I think I have completely removed the Trojan.Vundo itself.

The only thing I have left to deal with and won't go away is The Malware.Trace.

Any idea's of how I could possibly get rid of this nasty thing?

(MBAM Log: Recent)

Malwarebytes' Anti-Malware 1.31

Database version: 1528

Windows 5.1.2600 Service Pack 3

12/21/2008 10:45:21 PM

mbam-log-2008-12-21 (22-45-21).txt

Scan type: Quick Scan

Objects scanned: 50560

Time elapsed: 3 minute(s), 38 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Delete on reboot.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

________________________________________________________________________________

_________________________________

(Combo Fix Log: Recent)

ComboFix 08-12-21.04 - Zac 2008-12-21 22:22:42.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2707 [GMT -5:00]

Running from: c:\documents and settings\Zac\Desktop\ComboFix.exe

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\hpowiax2.dll

c:\windows\system32\kvptifbq.dll

c:\windows\system32\nthbbywo.ini

.

((((((((((((((((((((((((( Files Created from 2008-11-22 to 2008-12-22 )))))))))))))))))))))))))))))))

.

2008-12-21 22:06 . 2008-12-21 22:06 410,984 --a------ c:\windows\system32\deploytk.dll

2008-12-21 21:34 . 2008-12-21 21:34 <DIR> d--hs---- c:\documents and settings\Zac\PrivacIE

2008-12-21 21:28 . 2008-12-21 21:29 <DIR> d--h-c--- c:\windows\ie8

2008-12-21 20:19 . 2008-12-21 20:23 <DIR> d-------- c:\program files\Exterminate It!

2008-12-21 20:07 . 2008-12-21 20:07 <DIR> d-------- c:\program files\MSXML 4.0

2008-12-21 04:15 . 2008-12-21 04:15 <DIR> d-------- c:\program files\Panda Security

2008-12-21 04:15 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys

2008-12-21 04:06 . 2008-12-21 04:06 <DIR> d-------- c:\program files\Trend Micro

2008-12-21 03:32 . 2008-12-21 03:32 <DIR> d-------- c:\program files\Enigma Software Group

2008-12-21 01:21 . 2008-12-21 01:21 <DIR> d-------- c:\documents and settings\Zac\Application Data\HP

2008-12-21 01:20 . 2008-12-21 01:21 <DIR> d-------- c:\program files\Common Files\HP

2008-12-21 01:19 . 2006-04-10 14:03 38,400 --a------ c:\windows\system32\hpz3l054.dll

2008-12-21 01:18 . 2008-04-14 00:15 15,104 --a------ c:\windows\system32\drivers\usbscan.sys

2008-12-21 01:18 . 2008-04-14 00:15 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys

2008-12-21 01:14 . 2008-12-21 01:21 117,156 --a------ c:\windows\hpoins11.dat

2008-12-21 01:13 . 2006-04-12 19:02 827,392 --a------ c:\windows\system32\hpotiop2.dll

2008-12-21 01:13 . 2006-04-12 19:02 254,026 --a------ c:\windows\system32\hpovst09.dll

2008-12-21 01:12 . 2006-05-05 18:17 11,634 --a------ c:\windows\hpomdl11.dat

2008-12-21 00:53 . 2008-12-21 00:53 <DIR> d-------- c:\documents and settings\All Users\Application Data\HP

2008-12-21 00:51 . 2008-12-21 01:20 <DIR> d-------- c:\program files\Hewlett-Packard

2008-12-21 00:51 . 2008-12-21 00:51 <DIR> d-------- c:\program files\Common Files\Hewlett-Packard

2008-12-21 00:48 . 2008-12-21 01:20 <DIR> d-------- c:\program files\HP

2008-12-21 00:48 . 2006-03-03 21:03 282,680 --a------ c:\windows\system32\HPZidr12.dll

2008-12-21 00:48 . 2006-03-03 21:02 204,800 --a------ c:\windows\system32\HPZipr12.dll

2008-12-21 00:48 . 2006-03-03 21:02 94,208 --a------ c:\windows\system32\HPZipt12.dll

2008-12-21 00:48 . 2006-03-03 21:03 69,632 --a------ c:\windows\system32\HPZipm12.exe

2008-12-21 00:48 . 2006-03-03 21:03 65,536 --a------ c:\windows\system32\HPZinw12.exe

2008-12-21 00:48 . 2006-03-03 21:02 57,344 --a------ c:\windows\system32\HPZisn12.dll

2008-12-21 00:48 . 2008-04-14 00:17 25,856 --a------ c:\windows\system32\drivers\usbprint.sys

2008-12-21 00:48 . 2008-04-14 00:17 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys

2008-12-21 00:47 . 2006-04-12 19:04 49,664 --a------ c:\windows\system32\drivers\HPZid412.sys

2008-12-21 00:47 . 2006-04-12 19:04 21,568 --a------ c:\windows\system32\drivers\HPZius12.sys

2008-12-21 00:47 . 2006-04-12 19:04 16,496 --a------ c:\windows\system32\drivers\HPZipr12.sys

2008-12-21 00:46 . 2006-04-12 19:04 282,624 --a------ c:\windows\system32\HPZc3212.dll

2008-12-21 00:46 . 2005-07-18 20:38 98,304 --a------ c:\windows\system32\hpzjsn01.dll

2008-12-21 00:46 . 2006-01-04 03:12 77,824 --a------ c:\windows\system32\HPZIDS01.dll

2008-12-20 23:26 . 2008-12-20 23:26 <DIR> d-------- c:\program files\SUPERAntiSpyware

2008-12-20 23:26 . 2008-12-20 23:26 <DIR> d-------- c:\documents and settings\Zac\Application Data\SUPERAntiSpyware.com

2008-12-20 23:26 . 2008-12-20 23:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2008-12-20 23:25 . 2008-12-20 23:25 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard

2008-12-20 22:29 . 2008-12-20 22:29 <DIR> d-------- C:\VundoFix Backups

2008-12-20 14:23 . 2008-12-20 14:23 <DIR> d-------- c:\program files\Microsoft SQL Server

2008-12-20 14:23 . 2008-12-20 14:23 <DIR> d-------- c:\program files\Microsoft Silverlight

2008-12-20 14:20 . 2008-12-20 14:21 <DIR> d-------- c:\program files\Microsoft Visual Studio 9.0

2008-12-20 14:20 . 2008-12-20 14:20 <DIR> d-------- c:\program files\Microsoft SDKs

2008-12-20 14:20 . 2008-12-20 14:21 <DIR> d-------- c:\program files\Common Files\Merge Modules

2008-12-20 14:20 . 2008-12-20 14:22 <DIR> d-------- c:\documents and settings\All Users\Application Data\Microsoft Help

2008-12-20 14:17 . 2008-12-20 18:10 <DIR> d-------- c:\windows\SxsCaPendDel

2008-12-20 14:17 . 2008-12-20 14:18 <DIR> d-------- C:\2ba7307b42c696e53db568a3

2008-12-18 14:32 . 2008-12-18 14:32 494 --a------ c:\windows\replace.vbs

2008-12-17 00:46 . 2008-12-17 00:46 <DIR> d-------- c:\documents and settings\Zac\Application Data\Broad Intelligence

2008-12-17 00:44 . 2008-12-17 03:08 <DIR> d-------- c:\program files\MediaCoder

2008-12-17 00:39 . 2008-12-17 00:39 <DIR> d-------- c:\program files\Veoh Networks

2008-12-16 19:10 . 2008-12-16 19:10 <DIR> d-------- c:\documents and settings\Zac\Application Data\TortoiseSVN

2008-12-16 19:08 . 2008-12-16 19:08 <DIR> d-------- c:\documents and settings\Zac\Application Data\Nexon

2008-12-16 18:41 . 2008-12-16 18:41 <DIR> d-------- c:\program files\HashCalc

2008-12-16 18:25 . 2008-12-16 18:25 <DIR> d-------- c:\program files\TortoiseSVN

2008-12-16 18:25 . 2008-12-16 18:25 <DIR> d-------- c:\program files\Common Files\TortoiseOverlays

2008-12-16 18:25 . 2008-12-16 18:25 <DIR> d-------- c:\documents and settings\Zac\Application Data\Subversion

2008-12-16 18:15 . 2008-12-16 18:15 <DIR> d-------- c:\windows\Sun

2008-12-16 18:15 . 2008-12-19 15:33 <DIR> d-------- c:\documents and settings\Zac\Application Data\MySQL

2008-12-16 18:15 . 2008-12-16 18:15 <DIR> d-------- c:\documents and settings\Zac\.netbeans-derby

2008-12-16 18:14 . 2008-12-16 18:14 <DIR> d-------- c:\documents and settings\Zac\.netbeans

2008-12-16 18:13 . 2008-12-16 18:13 <DIR> d-------- c:\program files\glassfish-v3-prelude

2008-12-16 18:13 . 2008-12-16 18:13 <DIR> d-------- c:\documents and settings\Zac\.netbeans-registration

2008-12-16 18:12 . 2008-12-18 14:23 <DIR> d-------- c:\program files\glassfish-v2ur2

2008-12-16 18:05 . 2008-12-16 18:13 <DIR> d-------- c:\program files\NetBeans 6.5

2008-12-16 18:04 . 2008-12-16 18:14 <DIR> d-------- c:\documents and settings\Zac\.nbi

2008-12-16 17:58 . 2008-12-19 15:52 <DIR> d-------- C:\Nexon

2008-12-16 17:46 . 2008-12-16 17:48 <DIR> d-------- c:\program files\MySQL

2008-12-16 17:39 . 2008-12-16 17:39 <DIR> d-------- c:\program files\Sun

2008-12-16 17:39 . 2008-12-21 22:06 73,728 --a------ c:\windows\system32\javacpl.cpl

2008-12-16 17:35 . 2008-12-16 17:35 <DIR> d-------- c:\program files\Common Files\Java

2008-12-16 17:33 . 2008-12-16 18:26 <DIR> d-------- c:\program files\Java

2008-12-16 17:14 . 2008-12-16 17:29 95 --a------ c:\windows\system32\productregistry

2008-12-16 16:55 . 2008-12-19 23:43 <DIR> d-------- c:\documents and settings\Zac\Application Data\Hamachi

2008-12-16 16:54 . 2008-12-16 16:55 <DIR> d-------- c:\program files\Hamachi

2008-12-16 16:54 . 2008-12-16 16:54 25,280 --a------ c:\windows\system32\drivers\hamachi.sys

2008-12-13 23:35 . 2008-12-13 23:35 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2008-12-13 23:35 . 2008-12-13 23:35 <DIR> d-------- c:\documents and settings\Zac\Application Data\Malwarebytes

2008-12-13 23:35 . 2008-12-13 23:35 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2008-12-13 23:35 . 2008-12-03 19:53 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2008-12-13 23:35 . 2008-12-03 19:53 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2008-12-13 22:31 . 2008-12-13 22:31 62,358,710 --a------ C:\SYM_REGISTRY_BACKUP.reg

2008-12-13 21:29 . 2008-12-13 21:29 <DIR> d--h----- c:\windows\PIF

2008-12-13 13:11 . 2008-07-12 08:18 3,851,784 --a------ c:\windows\system32\D3DX9_39.dll

2008-12-13 13:11 . 2008-07-12 08:18 1,493,528 --a------ c:\windows\system32\D3DCompiler_39.dll

2008-12-13 13:11 . 2008-07-31 10:40 509,448 --a------ c:\windows\system32\XAudio2_2.dll

2008-12-13 13:11 . 2008-07-12 08:18 467,984 --a------ c:\windows\system32\d3dx10_39.dll

2008-12-13 13:11 . 2008-07-31 10:41 238,088 --a------ c:\windows\system32\xactengine3_2.dll

2008-12-13 13:11 . 2008-07-31 10:41 68,616 --a------ c:\windows\system32\XAPOFX1_1.dll

2008-12-13 13:03 . 2008-12-13 13:03 <DIR> d-------- c:\program files\Ubisoft

2008-12-13 01:40 . 2008-12-05 04:52 36,272 -ra------ c:\windows\system32\drivers\SymIM.sys

2008-12-12 15:24 . 2008-12-12 15:24 <DIR> d-------- c:\documents and settings\Zac\Application Data\DivX

2008-12-12 15:23 . 2008-12-12 15:23 <DIR> d-------- c:\program files\DivX

2008-12-12 15:19 . 2008-12-12 15:19 <DIR> d-------- c:\windows\system32\QuickTime

2008-12-12 15:19 . 2008-12-12 15:19 <DIR> d-------- c:\program files\TechSmith

2008-12-12 15:19 . 2008-12-12 15:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\TechSmith

2008-12-12 15:19 . 2006-06-14 21:13 102,400 --a------ c:\windows\system32\tsccvid.dll

2008-12-11 18:12 . 2008-12-11 18:12 <DIR> d-------- c:\program files\Macromedia

2008-12-11 18:12 . 2008-12-11 18:12 <DIR> d-------- c:\program files\Common Files\Macromedia Shared

2008-12-11 18:12 . 2008-12-11 18:12 <DIR> d-------- c:\documents and settings\All Users\Application Data\Macrovision

2008-12-11 18:00 . 1998-10-29 16:45 306,688 --a------ c:\windows\IsUninst.exe

2008-12-09 19:58 . 2008-12-13 15:34 <DIR> d-------- c:\program files\NLVM

2008-12-09 19:57 . 2008-12-13 15:33 <DIR> d--h----- c:\program files\Zero G Registry

2008-12-07 00:41 . 2008-12-06 16:19 146,453 --a------ C:\1214433052944.jpg

2008-12-07 00:26 . 2008-12-07 00:26 <DIR> d-------- c:\program files\Microsoft IntelliPoint

2008-12-07 00:26 . 2008-06-10 13:04 31,048 --a------ c:\windows\system32\drivers\point32.sys

2008-12-07 00:24 . 2008-12-07 00:24 <DIR> d-------- c:\program files\Microsoft IntelliType Pro

2008-12-06 20:16 . 2008-12-06 20:16 <DIR> dr------- c:\program files\Norton Support

2008-12-05 21:37 . 2008-12-06 20:03 <DIR> d-------- c:\program files\LibUSB-Win32-0.1.10.1

2008-12-05 21:37 . 2005-03-09 20:50 46,592 --a------ c:\windows\system32\libusb0.dll

2008-12-05 21:37 . 2005-03-09 20:50 33,792 --a------ c:\windows\system32\drivers\libusb0.sys

2008-12-05 21:26 . 2008-12-05 21:26 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\Xfire

2008-12-05 21:25 . 2008-12-13 14:31 <DIR> d-------- c:\program files\Xfire

2008-12-05 21:25 . 2008-12-14 03:50 <DIR> d-------- c:\documents and settings\Zac\Application Data\Xfire

2008-12-02 14:48 . 2008-12-02 14:49 <DIR> d-------- c:\program files\Google

2008-12-01 22:06 . 2008-12-01 22:07 <DIR> d-------- c:\program files\Guild Wars

2008-12-01 02:20 . 2008-12-01 02:20 107,888 --a------ c:\windows\system32\CmdLineExt.dll

2008-12-01 02:05 . 2008-12-01 02:05 <DIR> d-------- c:\program files\Bethesda Softworks

2008-12-01 02:05 . 2008-12-01 02:05 <DIR> d-------- c:\documents and settings\Zac\Application Data\InstallShield Installation Information

2008-12-01 02:04 . 2008-12-01 02:04 <DIR> d-------- c:\windows\Logs

2008-12-01 02:04 . 2008-12-01 02:04 <DIR> d-------- c:\program files\MSBuild

2008-12-01 02:04 . 2005-05-26 15:34 2,297,552 --a------ c:\windows\system32\d3dx9_26.dll

2008-12-01 02:03 . 2008-12-20 14:18 <DIR> d-------- c:\windows\system32\XPSViewer

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-11-30 01:47 960 --sha-w C:\vjojavz3.sys

2008-11-30 01:47 --------- d-----w c:\program files\microsoft frontpage

2008-11-21 21:47 524,288 ----a-w c:\windows\system32\DivXsm.exe

2008-11-21 21:47 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll

2008-11-21 21:46 200,704 ----a-w c:\windows\system32\ssldivx.dll

2008-11-21 21:46 1,044,480 ----a-w c:\windows\system32\libdivx.dll

2008-11-21 21:44 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe

2008-11-21 21:44 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll

2008-11-20 20:45 42,320 ----a-w c:\windows\system32\xfcodec.dll

2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys

2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll

2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll

2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll

2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll

2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll

2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll

2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe

2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll

2008-10-16 19:07 208,744 ----a-w c:\windows\system32\muweb.dll

2008-10-03 10:02 247,326 ----a-w c:\windows\system32\strmdll.dll

2008-09-30 21:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]

@="{C5994560-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]