عزيزتي التقرير ما يظهر مرتب ،، لان حاليا في خلل بالمنتدى
فيرجى منك ارفاق التقرير في ملف وورد
وايضا ارفاق تقرير ببرنامج Hijackthis
في انتظارك غاليتي
ممكن المساعده ارجوكم
و
24-06-2008 | 11:57 AM
n
24-06-2008 | 12:09 PM
التقرير الاول
ComboFix 08-06-16.5 - ali 06/24/2008 12:00:46.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1256.1.1033.18.274 [GMT 3:00]
Running from: C:\Documents and Settings\ali\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\ali\Desktop\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\MicroSoft.bat
C:\MicroSoft.pif
C:\MicroSoft.vbs
C:\WINDOWS\system32\agxyaloe.exe
C:\WINDOWS\system32\apsgfjba.dll
C:\WINDOWS\system32\arjrdler.dll
C:\WINDOWS\system32\dazfajke.exe
C:\WINDOWS\system32\dfqnabib.exe
C:\WINDOWS\System32\drivers\eth802 3.sys
C:\WINDOWS\system32\dtzfajke.sys
C:\WINDOWS\system32\erxybloe.dll
C:\WINDOWS\system32\igxyaloe.sys
C:\WINDOWS\system32\jke34kl32.dll
C:\WINDOWS\system32\midimapyt2.dll
C:\WINDOWS\system32\mkjraler.exe
C:\WINDOWS\system32\mndsgsrv.dll
C:\WINDOWS\system32\pedadt.dll
C:\WINDOWS\system32\posqatyu.exe
C:\WINDOWS\system32\pqzfajke.dll
C:\WINDOWS\system32\rijxbkin.dll
C:\WINDOWS\system32\stjxakin.exe
C:\WINDOWS\system32\tjfyabyt.exe
C:\WINDOWS\System32\ypdjgbmp.dll
C:\WINDOWS\system32\yzztjmsn.dll
C:\WINDOWS\system32\zdesfx.dll
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\AppPatch\AcXtrnel.dll
C:\WINDOWS\AppPatch\Jview.dll
C:\WINDOWS\system32\ismhasrv.exe
C:\WINDOWS\system32\mnmhgsrv.dll
C:\WINDOWS\system32\smmhbsrv.sys
.
((((((((((((((((((((((((( Files Created from 2008-05-24 to 2008-06-24 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-23 20:48 9,728 ----a-w C:\WINDOWS\AppPatch\AcSpecf.dll
2008-06-23 20:44 18,048 ----a-w C:\WINDOWS\system32\drivers\eth8023.sys
2008-06-21 12:22 27,136 ----a-w C:\WINDOWS\AppPatch\AcPlugin.dll
2008-06-19 20:46 --------- d-----w C:\Documents and Settings\ali\Application Data\cleaner
2008-06-18 16:22 --------- d-----w C:\Documents and Settings\ali\Application Data\CyberScrub
2008-06-18 11:36 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-06-16 19:28 --------- d-----w C:\Program Files\ERUNT
2008-06-16 08:54 --------- d-----w C:\Documents and Settings\ali\Application Data\Media Player Classic
2008-06-14 21:45 --------- d-----w C:\Documents and Settings\ali\Application Data\DivX
2008-06-13 19:58 --------- d-----w C:\Program Files\Google
2008-06-13 18:10 --------- d-----w C:\Program Files\Yahoo!
2008-06-13 15:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-13 15:10 --------- d-----w C:\Documents and Settings\ali\Application Data\Malwarebytes
2008-06-12 22:46 --------- d-----w C:\Documents and Settings\ali\Application Data\Talkback
2008-06-12 21:58 --------- d-----w C:\Documents and Settings\jana\Application Data\Media Player Classic
2008-06-12 18:09 --------- d-----w C:\Program Files\Yahoo! Games
2008-06-12 18:09 --------- d-----w C:\Program Files\TryMedia
2008-06-12 17:42 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-06-12 11:32 --------- d-----w C:\Program Files\Trend Micro
2008-06-10 16:02 34,296 ----a-w C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-10 16:02 15,864 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-06-09 14:36 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-06-09 14:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-09 09:03 --------- d-----w C:\Program Files\Common Files\xing shared
2008-06-09 09:03 --------- d-----w C:\Program Files\Common Files\Real
2008-06-08 20:13 --------- d-----w C:\Documents and Settings\ali\Application Data\Yahoo!
2008-06-08 19:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-06-07 16:11 --------- d-----w C:\Program Files\Real
2008-06-07 15:30 --------- d-----w C:\Program Files\Avira
2008-06-07 15:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-06-07 14:09 --------- d-----w C:\Program Files\Winamp
2008-06-07 14:08 --------- d-----w C:\Documents and Settings\jana\Application Data\Winamp
2008-06-06 22:58 --------- d-----w C:\Documents and Settings\jana\Application Data\Yahoo!
2008-06-06 22:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-06-06 20:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-06 20:47 --------- d-----w C:\Program Files\Realtek
2008-06-06 20:46 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-06-06 20:46 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-06 20:46 --------- d-----w C:\Documents and Settings\jana\Application Data\InstallShield
2008-06-06 20:45 4,716 ----a-w C:\WINDOWS\gdrv.sys
2008-06-06 20:42 --------- d-----w C:\Program Files\Intel
2008-06-06 20:07 --------- d-----w C:\Program Files\microsoft frontpage
2004-08-08 19:34 535,560 --sh--w C:\WINDOWS\system32\arjreler.dll
2004-08-08 19:32 1,040 --sh--w C:\WINDOWS\system32\cgsqatyu.sys
2004-08-08 19:33 16,582 --sh--w C:\WINDOWS\system32\dsdyapaw.exe
2004-08-08 19:33 536,584 --sh--w C:\WINDOWS\system32\ijdyapaw.dll
2004-08-08 19:34 1,040 --sh--w C:\WINDOWS\system32\iujraler.sys
2004-08-08 19:35 16,317 --sh--w C:\WINDOWS\system32\lpmxajkl.exe
2004-08-08 13:17 536,072 --sh--w C:\WINDOWS\system32\nhmxcjkl.dll
2004-08-08 19:33 16,421 --sh--w C:\WINDOWS\system32\pusqakol.exe
2004-08-08 19:33 520 --sh--w C:\WINDOWS\system32\pzdyapaw.sys
2004-08-08 19:35 520 --sh--w C:\WINDOWS\system32\rnmxajkl.sys
2004-08-08 07:25 538,632 --sh--w C:\WINDOWS\system32\s2da2f323.dll
2004-08-08 19:33 520 --sh--w C:\WINDOWS\system32\sbsqakol.sys
2004-08-08 19:36 520 --sh--w C:\WINDOWS\system32\smdsbsrv.sys
2004-08-08 19:34 520 --sh--w C:\WINDOWS\system32\snfybbyt.sys
2004-08-08 19:33 535,560 --sh--w C:\WINDOWS\system32\tysqbkol.dll
2004-08-08 07:24 1,040 --sh--w C:\WINDOWS\system32\xsdjbbmp.sys
2004-08-08 21:25 536,584 --sh--w C:\WINDOWS\system32\yzztkmsn.dll
2004-08-08 07:24 16,667 --sh--w C:\WINDOWS\system32\zsdjabmp.exe
.
((((((((((((((((((((((((((((( snapshot_Mon 06-23-2008_23.54.04.34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-23 20:51:18 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-24 09:02:22 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2005-10-20 09:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-24\ERDNT.EXE
+ 2008-06-24 08:18:21 2,195,456 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-24\Users\00000001\NTUSER.DAT
+ 2008-06-24 08:18:21 32,768 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-24\Users\00000002\UsrClass.dat
+ 2005-10-20 09:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\24-06-2008\ERDNT.EXE
+ 2008-06-24 08:12:49 2,195,456 ----a-w C:\WINDOWS\erdnt\AutoBackup\24-06-2008\Users\00000001\NTUSER.DAT
+ 2008-06-24 08:12:50 32,768 ----a-w C:\WINDOWS\erdnt\AutoBackup\24-06-2008\Users\00000002\UsrClass.dat
- 2008-06-23 20:51:20 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-06-24 09:02:23 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-06-23 20:51:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-06-24 09:02:23 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-06-23 20:51:20 65,536 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-24 09:02:23 65,536 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-24 08:14:07 28,672 ----a-w C:\WINDOWS\system32\wpuplder.dll
+ 2008-06-24 08:14:07 11,776 ----a-w C:\WINDOWS\system32\wpuplderk.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1A698452-C5D8-C584-C256-C264C987C5A1}]
08/08/2004 10:33 PM 536584 ---hs---- C:\WINDOWS\System32\ijdyapaw.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5D098345-6785-1098-5413-678067AE03D5}]
08/08/2004 10:33 PM 535560 ---hs---- C:\WINDOWS\System32\tysqbkol.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7C69034A-F45F-D34D-A33A-C33C4D324FC7}]
08/08/2004 10:34 PM 535560 ---hs---- C:\WINDOWS\System32\arjreler.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97421D0D-E07F-40DF-8F07-99597B9585AD}]
06/21/2008 10:27 AM 45056 --a------ C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A629FF4F-ACDB-5C90-A098-FACB3456A26A}]
08/08/2004 10:25 AM 538632 ---hs---- C:\WINDOWS\System32\s2da2f323.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B490415F-65F8-B5C5-D8BA-9405FB12054B}]
08/09/2004 12:25 AM 536584 ---hs---- C:\WINDOWS\System32\yzztkmsn.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [08/30/2007 05:43 PM 4670704]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [08/29/2002 03:00 PM 13312]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [06/09/2008 12:02 PM 185896]
C:\Documents and Settings\ali\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE [2005-10-20 12:04:08 38912]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{B490415F-65F8-B5C5-D8BA-9405FB12054B}"= C:\WINDOWS\System32\yzztkmsn.dll [08/09/2004 12:25 AM 536584]
"{81AF1CF6-D1C9-4C6A-AC01-EDE54E71945B}"= C:\WINDOWS\System32\jfdses.dll [06/23/2008 10:33 PM 218624]
"{A629FF4F-ACDB-5C90-A098-FACB3456A26A}"= C:\WINDOWS\System32\s2da2f323.dll [08/08/2004 10:25 AM 538632]
"{1A698452-C5D8-C584-C256-C264C987C5A1}"= C:\WINDOWS\System32\ijdyapaw.dll [08/08/2004 10:33 PM 536584]
"{5D098345-6785-1098-5413-678067AE03D5}"= C:\WINDOWS\System32\tysqbkol.dll [08/08/2004 10:33 PM 535560]
"{7C69034A-F45F-D34D-A33A-C33C4D324FC7}"= C:\WINDOWS\System32\arjreler.dll [08/08/2004 10:34 PM 535560]
"{00180018-0018-0018-0018-00180018BB15}"= C:\WINDOWS\System32\mstimewd.dll [06/23/2001 10:36 PM 1059476]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"JavaView"= {DA191DE0-AA86-D04E-4B87-2A3D4928BE99} - C:\WINDOWS\AppPatch\Jview.dll [ ]
"ThunderAdvise"= {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll [06/21/2008 10:27 AM 45056]
"mstimewd"= {00180018-0018-0018-0018-00180018BB15} - C:\WINDOWS\System32\mstimewd.dll [06/23/2001 10:36 PM 1059476]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys [07/18/2007 02:22 PM]
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [08/09/2007 01:04 PM]
R2 NwSapAgent;SAP Agent;C:\WINDOWS\System32\svchost.exe [08/29/2002 03:00 PM]
S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [06/06/2008 11:45 PM]
S3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\System32\DRIVERS\loop.sys [08/17/2001 01:53 PM]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://go.3roos.com/XP68JmxSgb7
Rootkit scan 2008-06-24 12:02:47
Windows 5.1.2600 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP.NEW 516 bytes
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP.NEW 2552 bytes
scan completed successfully
hidden files: 2
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 06/24/2008 12:05:08 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-24 09:05:05
ComboFix2.txt 2008-06-24 08:20:49
ComboFix3.txt 2008-06-23 20:54:16
ComboFix4.txt 2008-06-20 18:59:09
ComboFix5.txt 2008-06-20 09:58:04
Pre-Run: 8,779,104,256 bytes free
Post-Run: 8,773,029,888 bytes free
201 --- E O F --- 2008-06-16 16:58:27
ComboFix 08-06-16.5 - ali 06/24/2008 12:00:46.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1256.1.1033.18.274 [GMT 3:00]
Running from: C:\Documents and Settings\ali\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\ali\Desktop\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\MicroSoft.bat
C:\MicroSoft.pif
C:\MicroSoft.vbs
C:\WINDOWS\system32\agxyaloe.exe
C:\WINDOWS\system32\apsgfjba.dll
C:\WINDOWS\system32\arjrdler.dll
C:\WINDOWS\system32\dazfajke.exe
C:\WINDOWS\system32\dfqnabib.exe
C:\WINDOWS\System32\drivers\eth802 3.sys
C:\WINDOWS\system32\dtzfajke.sys
C:\WINDOWS\system32\erxybloe.dll
C:\WINDOWS\system32\igxyaloe.sys
C:\WINDOWS\system32\jke34kl32.dll
C:\WINDOWS\system32\midimapyt2.dll
C:\WINDOWS\system32\mkjraler.exe
C:\WINDOWS\system32\mndsgsrv.dll
C:\WINDOWS\system32\pedadt.dll
C:\WINDOWS\system32\posqatyu.exe
C:\WINDOWS\system32\pqzfajke.dll
C:\WINDOWS\system32\rijxbkin.dll
C:\WINDOWS\system32\stjxakin.exe
C:\WINDOWS\system32\tjfyabyt.exe
C:\WINDOWS\System32\ypdjgbmp.dll
C:\WINDOWS\system32\yzztjmsn.dll
C:\WINDOWS\system32\zdesfx.dll
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\AppPatch\AcXtrnel.dll
C:\WINDOWS\AppPatch\Jview.dll
C:\WINDOWS\system32\ismhasrv.exe
C:\WINDOWS\system32\mnmhgsrv.dll
C:\WINDOWS\system32\smmhbsrv.sys
.
((((((((((((((((((((((((( Files Created from 2008-05-24 to 2008-06-24 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-23 20:48 9,728 ----a-w C:\WINDOWS\AppPatch\AcSpecf.dll
2008-06-23 20:44 18,048 ----a-w C:\WINDOWS\system32\drivers\eth8023.sys
2008-06-21 12:22 27,136 ----a-w C:\WINDOWS\AppPatch\AcPlugin.dll
2008-06-19 20:46 --------- d-----w C:\Documents and Settings\ali\Application Data\cleaner
2008-06-18 16:22 --------- d-----w C:\Documents and Settings\ali\Application Data\CyberScrub
2008-06-18 11:36 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-06-16 19:28 --------- d-----w C:\Program Files\ERUNT
2008-06-16 08:54 --------- d-----w C:\Documents and Settings\ali\Application Data\Media Player Classic
2008-06-14 21:45 --------- d-----w C:\Documents and Settings\ali\Application Data\DivX
2008-06-13 19:58 --------- d-----w C:\Program Files\Google
2008-06-13 18:10 --------- d-----w C:\Program Files\Yahoo!
2008-06-13 15:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-13 15:10 --------- d-----w C:\Documents and Settings\ali\Application Data\Malwarebytes
2008-06-12 22:46 --------- d-----w C:\Documents and Settings\ali\Application Data\Talkback
2008-06-12 21:58 --------- d-----w C:\Documents and Settings\jana\Application Data\Media Player Classic
2008-06-12 18:09 --------- d-----w C:\Program Files\Yahoo! Games
2008-06-12 18:09 --------- d-----w C:\Program Files\TryMedia
2008-06-12 17:42 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-06-12 11:32 --------- d-----w C:\Program Files\Trend Micro
2008-06-10 16:02 34,296 ----a-w C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-10 16:02 15,864 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-06-09 14:36 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-06-09 14:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-09 09:03 --------- d-----w C:\Program Files\Common Files\xing shared
2008-06-09 09:03 --------- d-----w C:\Program Files\Common Files\Real
2008-06-08 20:13 --------- d-----w C:\Documents and Settings\ali\Application Data\Yahoo!
2008-06-08 19:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-06-07 16:11 --------- d-----w C:\Program Files\Real
2008-06-07 15:30 --------- d-----w C:\Program Files\Avira
2008-06-07 15:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-06-07 14:09 --------- d-----w C:\Program Files\Winamp
2008-06-07 14:08 --------- d-----w C:\Documents and Settings\jana\Application Data\Winamp
2008-06-06 22:58 --------- d-----w C:\Documents and Settings\jana\Application Data\Yahoo!
2008-06-06 22:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-06-06 20:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-06 20:47 --------- d-----w C:\Program Files\Realtek
2008-06-06 20:46 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-06-06 20:46 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-06 20:46 --------- d-----w C:\Documents and Settings\jana\Application Data\InstallShield
2008-06-06 20:45 4,716 ----a-w C:\WINDOWS\gdrv.sys
2008-06-06 20:42 --------- d-----w C:\Program Files\Intel
2008-06-06 20:07 --------- d-----w C:\Program Files\microsoft frontpage
2004-08-08 19:34 535,560 --sh--w C:\WINDOWS\system32\arjreler.dll
2004-08-08 19:32 1,040 --sh--w C:\WINDOWS\system32\cgsqatyu.sys
2004-08-08 19:33 16,582 --sh--w C:\WINDOWS\system32\dsdyapaw.exe
2004-08-08 19:33 536,584 --sh--w C:\WINDOWS\system32\ijdyapaw.dll
2004-08-08 19:34 1,040 --sh--w C:\WINDOWS\system32\iujraler.sys
2004-08-08 19:35 16,317 --sh--w C:\WINDOWS\system32\lpmxajkl.exe
2004-08-08 13:17 536,072 --sh--w C:\WINDOWS\system32\nhmxcjkl.dll
2004-08-08 19:33 16,421 --sh--w C:\WINDOWS\system32\pusqakol.exe
2004-08-08 19:33 520 --sh--w C:\WINDOWS\system32\pzdyapaw.sys
2004-08-08 19:35 520 --sh--w C:\WINDOWS\system32\rnmxajkl.sys
2004-08-08 07:25 538,632 --sh--w C:\WINDOWS\system32\s2da2f323.dll
2004-08-08 19:33 520 --sh--w C:\WINDOWS\system32\sbsqakol.sys
2004-08-08 19:36 520 --sh--w C:\WINDOWS\system32\smdsbsrv.sys
2004-08-08 19:34 520 --sh--w C:\WINDOWS\system32\snfybbyt.sys
2004-08-08 19:33 535,560 --sh--w C:\WINDOWS\system32\tysqbkol.dll
2004-08-08 07:24 1,040 --sh--w C:\WINDOWS\system32\xsdjbbmp.sys
2004-08-08 21:25 536,584 --sh--w C:\WINDOWS\system32\yzztkmsn.dll
2004-08-08 07:24 16,667 --sh--w C:\WINDOWS\system32\zsdjabmp.exe
.
((((((((((((((((((((((((((((( snapshot_Mon 06-23-2008_23.54.04.34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-23 20:51:18 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-24 09:02:22 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2005-10-20 09:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-24\ERDNT.EXE
+ 2008-06-24 08:18:21 2,195,456 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-24\Users\00000001\NTUSER.DAT
+ 2008-06-24 08:18:21 32,768 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-24\Users\00000002\UsrClass.dat
+ 2005-10-20 09:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\24-06-2008\ERDNT.EXE
+ 2008-06-24 08:12:49 2,195,456 ----a-w C:\WINDOWS\erdnt\AutoBackup\24-06-2008\Users\00000001\NTUSER.DAT
+ 2008-06-24 08:12:50 32,768 ----a-w C:\WINDOWS\erdnt\AutoBackup\24-06-2008\Users\00000002\UsrClass.dat
- 2008-06-23 20:51:20 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-06-24 09:02:23 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-06-23 20:51:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-06-24 09:02:23 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-06-23 20:51:20 65,536 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-24 09:02:23 65,536 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-24 08:14:07 28,672 ----a-w C:\WINDOWS\system32\wpuplder.dll
+ 2008-06-24 08:14:07 11,776 ----a-w C:\WINDOWS\system32\wpuplderk.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1A698452-C5D8-C584-C256-C264C987C5A1}]
08/08/2004 10:33 PM 536584 ---hs---- C:\WINDOWS\System32\ijdyapaw.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5D098345-6785-1098-5413-678067AE03D5}]
08/08/2004 10:33 PM 535560 ---hs---- C:\WINDOWS\System32\tysqbkol.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7C69034A-F45F-D34D-A33A-C33C4D324FC7}]
08/08/2004 10:34 PM 535560 ---hs---- C:\WINDOWS\System32\arjreler.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97421D0D-E07F-40DF-8F07-99597B9585AD}]
06/21/2008 10:27 AM 45056 --a------ C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A629FF4F-ACDB-5C90-A098-FACB3456A26A}]
08/08/2004 10:25 AM 538632 ---hs---- C:\WINDOWS\System32\s2da2f323.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B490415F-65F8-B5C5-D8BA-9405FB12054B}]
08/09/2004 12:25 AM 536584 ---hs---- C:\WINDOWS\System32\yzztkmsn.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [08/30/2007 05:43 PM 4670704]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [08/29/2002 03:00 PM 13312]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [06/09/2008 12:02 PM 185896]
C:\Documents and Settings\ali\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE [2005-10-20 12:04:08 38912]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{B490415F-65F8-B5C5-D8BA-9405FB12054B}"= C:\WINDOWS\System32\yzztkmsn.dll [08/09/2004 12:25 AM 536584]
"{81AF1CF6-D1C9-4C6A-AC01-EDE54E71945B}"= C:\WINDOWS\System32\jfdses.dll [06/23/2008 10:33 PM 218624]
"{A629FF4F-ACDB-5C90-A098-FACB3456A26A}"= C:\WINDOWS\System32\s2da2f323.dll [08/08/2004 10:25 AM 538632]
"{1A698452-C5D8-C584-C256-C264C987C5A1}"= C:\WINDOWS\System32\ijdyapaw.dll [08/08/2004 10:33 PM 536584]
"{5D098345-6785-1098-5413-678067AE03D5}"= C:\WINDOWS\System32\tysqbkol.dll [08/08/2004 10:33 PM 535560]
"{7C69034A-F45F-D34D-A33A-C33C4D324FC7}"= C:\WINDOWS\System32\arjreler.dll [08/08/2004 10:34 PM 535560]
"{00180018-0018-0018-0018-00180018BB15}"= C:\WINDOWS\System32\mstimewd.dll [06/23/2001 10:36 PM 1059476]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"JavaView"= {DA191DE0-AA86-D04E-4B87-2A3D4928BE99} - C:\WINDOWS\AppPatch\Jview.dll [ ]
"ThunderAdvise"= {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll [06/21/2008 10:27 AM 45056]
"mstimewd"= {00180018-0018-0018-0018-00180018BB15} - C:\WINDOWS\System32\mstimewd.dll [06/23/2001 10:36 PM 1059476]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys [07/18/2007 02:22 PM]
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [08/09/2007 01:04 PM]
R2 NwSapAgent;SAP Agent;C:\WINDOWS\System32\svchost.exe [08/29/2002 03:00 PM]
S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [06/06/2008 11:45 PM]
S3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\System32\DRIVERS\loop.sys [08/17/2001 01:53 PM]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://go.3roos.com/XP68JmxSgb7
Rootkit scan 2008-06-24 12:02:47
Windows 5.1.2600 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP.NEW 516 bytes
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP.NEW 2552 bytes
scan completed successfully
hidden files: 2
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 06/24/2008 12:05:08 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-24 09:05:05
ComboFix2.txt 2008-06-24 08:20:49
ComboFix3.txt 2008-06-23 20:54:16
ComboFix4.txt 2008-06-20 18:59:09
ComboFix5.txt 2008-06-20 09:58:04
Pre-Run: 8,779,104,256 bytes free
Post-Run: 8,773,029,888 bytes free
201 --- E O F --- 2008-06-16 16:58:27
n
24-06-2008 | 12:12 PM
التقرير الثاني
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:11:35, on 24/06/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\WgaTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.3roos.com/FGGcZaWh0vb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.3roos.com/TCKiZR6BROl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.3roos.com/fW7dMmVYlEU
O2 - BHO: ijdyapaw.dll - {1A698452-C5D8-C584-C256-C264C987C5A1} - C:\WINDOWS\System32\ijdyapaw.dll
O2 - BHO: tysqbkol.dll - {5D098345-6785-1098-5413-678067AE03D5} - C:\WINDOWS\System32\tysqbkol.dll
O2 - BHO: arjreler.dll - {7C69034A-F45F-D34D-A33A-C33C4D324FC7} - C:\WINDOWS\System32\arjreler.dll
O2 - BHO: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O2 - BHO: s2da2f323.dll - {A629FF4F-ACDB-5C90-A098-FACB3456A26A} - C:\WINDOWS\System32\s2da2f323.dll
O2 - BHO: yzztkmsn.dll - {B490415F-65F8-B5C5-D8BA-9405FB12054B} - C:\WINDOWS\System32\yzztkmsn.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{45E890EC-2E69-4BB8-9096-657E7C13A6B2}: NameServer = 66.11.234.90,66.11.234.91
O20 - AppInit_DLLs: yzztkmsn.dll,arjreler.dll
O21 - SSODL: JavaView - {DA191DE0-AA86-D04E-4B87-2A3D4928BE99} - C:\WINDOWS\AppPatch\Jview.dll (file missing)
O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O21 - SSODL: mstimewd - {00180018-0018-0018-0018-00180018BB15} - C:\WINDOWS\System32\mstimewd.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
--
End of file - 3615 bytes
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:11:35, on 24/06/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\WgaTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.3roos.com/FGGcZaWh0vb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.3roos.com/TCKiZR6BROl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.3roos.com/fW7dMmVYlEU
O2 - BHO: ijdyapaw.dll - {1A698452-C5D8-C584-C256-C264C987C5A1} - C:\WINDOWS\System32\ijdyapaw.dll
O2 - BHO: tysqbkol.dll - {5D098345-6785-1098-5413-678067AE03D5} - C:\WINDOWS\System32\tysqbkol.dll
O2 - BHO: arjreler.dll - {7C69034A-F45F-D34D-A33A-C33C4D324FC7} - C:\WINDOWS\System32\arjreler.dll
O2 - BHO: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O2 - BHO: s2da2f323.dll - {A629FF4F-ACDB-5C90-A098-FACB3456A26A} - C:\WINDOWS\System32\s2da2f323.dll
O2 - BHO: yzztkmsn.dll - {B490415F-65F8-B5C5-D8BA-9405FB12054B} - C:\WINDOWS\System32\yzztkmsn.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{45E890EC-2E69-4BB8-9096-657E7C13A6B2}: NameServer = 66.11.234.90,66.11.234.91
O20 - AppInit_DLLs: yzztkmsn.dll,arjreler.dll
O21 - SSODL: JavaView - {DA191DE0-AA86-D04E-4B87-2A3D4928BE99} - C:\WINDOWS\AppPatch\Jview.dll (file missing)
O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O21 - SSODL: mstimewd - {00180018-0018-0018-0018-00180018BB15} - C:\WINDOWS\System32\mstimewd.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
--
End of file - 3615 bytes
n
24-06-2008 | 02:52 PM
ارجوكي ردي عليا في امل في ان يتصلح الجهاز ولا لأ
و
24-06-2008 | 04:46 PM
اوكي عزيزتي راح نجرب بعض الحلول الاخيرة واذا ما ضبط ،، وديه للصيانه
-----------------------------------
احذفي هالقيم
O2 - BHO: ijdyapaw.dll - {1A698452-C5D8-C584-C256-C264C987C5A1} - C:\WINDOWS\System32\ijdyapaw.dll
O2 - BHO: tysqbkol.dll - {5D098345-6785-1098-5413-678067AE03D5} - C:\WINDOWS\System32\tysqbkol.dll
O2 - BHO: arjreler.dll - {7C69034A-F45F-D34D-A33A-C33C4D324FC7} - C:\WINDOWS\System32\arjreler.dll
O2 - BHO: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O2 - BHO: s2da2f323.dll - {A629FF4F-ACDB-5C90-A098-FACB3456A26A} - C:\WINDOWS\System32\s2da2f323.dll
O2 - BHO: yzztkmsn.dll - {B490415F-65F8-B5C5-D8BA-9405FB12054B} - C:\WINDOWS\System32\yzztkmsn.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{45E890EC-2E69-4BB8-9096-657E7C13A6B2}: NameServer = 66.11.234.90,66.11.234.91
O20 - AppInit_DLLs: yzztkmsn.dll,arjreler.dll
O21 - SSODL: JavaView - {DA191DE0-AA86-D04E-4B87-2A3D4928BE99} - C:\WINDOWS\AppPatch\Jview.dll (file missing)
O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O21 - SSODL: mstimewd - {00180018-0018-0018-0018-00180018BB15} - C:\WINDOWS\System32\mstimewd.dll
وعقب اعملي تقرير مرة اخرى ببرنامج Hijackthis
-----------------------------------
احذفي هالقيم
O2 - BHO: ijdyapaw.dll - {1A698452-C5D8-C584-C256-C264C987C5A1} - C:\WINDOWS\System32\ijdyapaw.dll
O2 - BHO: tysqbkol.dll - {5D098345-6785-1098-5413-678067AE03D5} - C:\WINDOWS\System32\tysqbkol.dll
O2 - BHO: arjreler.dll - {7C69034A-F45F-D34D-A33A-C33C4D324FC7} - C:\WINDOWS\System32\arjreler.dll
O2 - BHO: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O2 - BHO: s2da2f323.dll - {A629FF4F-ACDB-5C90-A098-FACB3456A26A} - C:\WINDOWS\System32\s2da2f323.dll
O2 - BHO: yzztkmsn.dll - {B490415F-65F8-B5C5-D8BA-9405FB12054B} - C:\WINDOWS\System32\yzztkmsn.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{45E890EC-2E69-4BB8-9096-657E7C13A6B2}: NameServer = 66.11.234.90,66.11.234.91
O20 - AppInit_DLLs: yzztkmsn.dll,arjreler.dll
O21 - SSODL: JavaView - {DA191DE0-AA86-D04E-4B87-2A3D4928BE99} - C:\WINDOWS\AppPatch\Jview.dll (file missing)
O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O21 - SSODL: mstimewd - {00180018-0018-0018-0018-00180018BB15} - C:\WINDOWS\System32\mstimewd.dll
وعقب اعملي تقرير مرة اخرى ببرنامج Hijackthis
n
24-06-2008 | 06:51 PM
التقرير
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:49:51, on 24/06/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.3roos.com/FGGcZaWh0vb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.3roos.com/TCKiZR6BROl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.3roos.com/fW7dMmVYlEU
O2 - BHO: ijdyapaw.dll - {1A698452-C5D8-C584-C256-C264C987C5A1} - C:\WINDOWS\System32\ijdyapaw.dll
O2 - BHO: tysqbkol.dll - {5D098345-6785-1098-5413-678067AE03D5} - C:\WINDOWS\System32\tysqbkol.dll
O2 - BHO: arjreler.dll - {7C69034A-F45F-D34D-A33A-C33C4D324FC7} - C:\WINDOWS\System32\arjreler.dll
O2 - BHO: mnmhgsrv.dll - {7C8D1401-A58D-A81C-CD24-A5915C4517C7} - C:\WINDOWS\System32\mnmhgsrv.dll
O2 - BHO: s2da2f323.dll - {A629FF4F-ACDB-5C90-A098-FACB3456A26A} - C:\WINDOWS\System32\s2da2f323.dll
O2 - BHO: yzztkmsn.dll - {B490415F-65F8-B5C5-D8BA-9405FB12054B} - C:\WINDOWS\System32\yzztkmsn.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O20 - AppInit_DLLs: arjreler.dll,yzztkmsn.dll
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O21 - SSODL: mstimewd - {00180018-0018-0018-0018-00180018BB15} - C:\WINDOWS\System32\mstimewd.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
--
End of file - 2794 bytes
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:49:51, on 24/06/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.3roos.com/FGGcZaWh0vb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.3roos.com/TCKiZR6BROl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.3roos.com/fW7dMmVYlEU
O2 - BHO: ijdyapaw.dll - {1A698452-C5D8-C584-C256-C264C987C5A1} - C:\WINDOWS\System32\ijdyapaw.dll
O2 - BHO: tysqbkol.dll - {5D098345-6785-1098-5413-678067AE03D5} - C:\WINDOWS\System32\tysqbkol.dll
O2 - BHO: arjreler.dll - {7C69034A-F45F-D34D-A33A-C33C4D324FC7} - C:\WINDOWS\System32\arjreler.dll
O2 - BHO: mnmhgsrv.dll - {7C8D1401-A58D-A81C-CD24-A5915C4517C7} - C:\WINDOWS\System32\mnmhgsrv.dll
O2 - BHO: s2da2f323.dll - {A629FF4F-ACDB-5C90-A098-FACB3456A26A} - C:\WINDOWS\System32\s2da2f323.dll
O2 - BHO: yzztkmsn.dll - {B490415F-65F8-B5C5-D8BA-9405FB12054B} - C:\WINDOWS\System32\yzztkmsn.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O20 - AppInit_DLLs: arjreler.dll,yzztkmsn.dll
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O21 - SSODL: mstimewd - {00180018-0018-0018-0018-00180018BB15} - C:\WINDOWS\System32\mstimewd.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
--
End of file - 2794 bytes
n
24-06-2008 | 06:53 PM
حبيبتي لو ما في حل ردي عليا
و
25-06-2008 | 09:44 AM
حبيبتي شوفي عشان نحاول حل المشكلة يجب حذف برنامج الحماية اللي بجهازج الافيرا
وعقب بعطيج نسخة رائعة للكاسبر سكاي
الحين استخدمي هالاداة واحذفي برنامج Avira
استخدامي هالاداة لحذف برنامج Avira من جذوره
بعد حذفه اعملي لي تقرير ببرنامج Hijackthis حتى اتأكد من حذفه
في انتظارك
وعقب بعطيج نسخة رائعة للكاسبر سكاي
الحين استخدمي هالاداة واحذفي برنامج Avira
استخدامي هالاداة لحذف برنامج Avira من جذوره
بعد حذفه اعملي لي تقرير ببرنامج Hijackthis حتى اتأكد من حذفه
في انتظارك
n
25-06-2008 | 12:59 PM
حذفتها
النقرير
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:58:30, on 25/06/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.3roos.com/FGGcZaWh0vb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.3roos.com/TCKiZR6BROl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.3roos.com/fW7dMmVYlEU
O2 - BHO: ijdyapaw.dll - {1A698452-C5D8-C584-C256-C264C987C5A1} - C:\WINDOWS\System32\ijdyapaw.dll
O2 - BHO: tysqbkol.dll - {5D098345-6785-1098-5413-678067AE03D5} - C:\WINDOWS\System32\tysqbkol.dll
O2 - BHO: arjreler.dll - {7C69034A-F45F-D34D-A33A-C33C4D324FC7} - C:\WINDOWS\System32\arjreler.dll
O2 - BHO: mnmhgsrv.dll - {7C8D1401-A58D-A81C-CD24-A5915C4517C7} - C:\WINDOWS\System32\mnmhgsrv.dll
O2 - BHO: s2da2f323.dll - {A629FF4F-ACDB-5C90-A098-FACB3456A26A} - C:\WINDOWS\System32\s2da2f323.dll
O2 - BHO: yzztkmsn.dll - {B490415F-65F8-B5C5-D8BA-9405FB12054B} - C:\WINDOWS\System32\yzztkmsn.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{45E890EC-2E69-4BB8-9096-657E7C13A6B2}: NameServer = 66.11.234.90,66.11.234.91
O20 - AppInit_DLLs: arjreler.dll,yzztkmsn.dll
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O21 - SSODL: mstimewd - {00180018-0018-0018-0018-00180018BB15} - C:\WINDOWS\System32\mstimewd.dll
O21 - SSODL: JavaView - {DA191DE0-AA86-D04E-4B87-2A3D4928BE99} - C:\WINDOWS\AppPatch\Jview.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
--
End of file - 3284 bytes
النقرير
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:58:30, on 25/06/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.3roos.com/FGGcZaWh0vb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.3roos.com/TCKiZR6BROl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.3roos.com/fW7dMmVYlEU
O2 - BHO: ijdyapaw.dll - {1A698452-C5D8-C584-C256-C264C987C5A1} - C:\WINDOWS\System32\ijdyapaw.dll
O2 - BHO: tysqbkol.dll - {5D098345-6785-1098-5413-678067AE03D5} - C:\WINDOWS\System32\tysqbkol.dll
O2 - BHO: arjreler.dll - {7C69034A-F45F-D34D-A33A-C33C4D324FC7} - C:\WINDOWS\System32\arjreler.dll
O2 - BHO: mnmhgsrv.dll - {7C8D1401-A58D-A81C-CD24-A5915C4517C7} - C:\WINDOWS\System32\mnmhgsrv.dll
O2 - BHO: s2da2f323.dll - {A629FF4F-ACDB-5C90-A098-FACB3456A26A} - C:\WINDOWS\System32\s2da2f323.dll
O2 - BHO: yzztkmsn.dll - {B490415F-65F8-B5C5-D8BA-9405FB12054B} - C:\WINDOWS\System32\yzztkmsn.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{45E890EC-2E69-4BB8-9096-657E7C13A6B2}: NameServer = 66.11.234.90,66.11.234.91
O20 - AppInit_DLLs: arjreler.dll,yzztkmsn.dll
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O21 - SSODL: mstimewd - {00180018-0018-0018-0018-00180018BB15} - C:\WINDOWS\System32\mstimewd.dll
O21 - SSODL: JavaView - {DA191DE0-AA86-D04E-4B87-2A3D4928BE99} - C:\WINDOWS\AppPatch\Jview.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
--
End of file - 3284 bytes
و
25-06-2008 | 02:48 PM
عزيزتي مازلت ارى برنامج الافيرا بجهازج
دقائق واعود لك بشرح مصور لكيفية استخدام الاداة لحذف برنامج الافيرا
دقائق واعود لك بشرح مصور لكيفية استخدام الاداة لحذف برنامج الافيرا
و
25-06-2008 | 03:04 PM
عزيزتي اتبعي هالخطوات بالتفصيييييل والترتييييييب
-----------------------------
اول خطوة تفكين الضغط عن هالملف avira antivir registrycleaner
اللي حملتيه من قبل من هالرابط استخدامي هالاداة لحذف برنامج Avira من جذوره
ثم عند فك الضغط بيظهر لج فولد مضغوط بأسم Avira AntiVir RegistryCleaner r واخر بأسم Avira AntiVir
فكي الضغط عنهم الاثنين
ثم اغلقي جميع صفحات الانترنت واي برامج اخرى
ثم من فولد Avira AntiVir دبل كليك على AVUNINST
وبيظهر لك كما بالصورة ،،، اضغطي Yes
وهكذا اتركيه الى ان يكمل عملية الحذف
ثم اذهبي الى فولدر Avira AntiVir RegistryCleaner r
ودبل كليك على Avira_RegistryCleaner
ثم اضغطي على Remove RegKey
-----------------------------
اول خطوة تفكين الضغط عن هالملف avira antivir registrycleaner
اللي حملتيه من قبل من هالرابط استخدامي هالاداة لحذف برنامج Avira من جذوره
ثم عند فك الضغط بيظهر لج فولد مضغوط بأسم Avira AntiVir RegistryCleaner r واخر بأسم Avira AntiVir
فكي الضغط عنهم الاثنين
ثم اغلقي جميع صفحات الانترنت واي برامج اخرى
ثم من فولد Avira AntiVir دبل كليك على AVUNINST
وبيظهر لك كما بالصورة ،،، اضغطي Yes
وهكذا اتركيه الى ان يكمل عملية الحذف
ثم اذهبي الى فولدر Avira AntiVir RegistryCleaner r
ودبل كليك على Avira_RegistryCleaner
ثم اضغطي على Remove RegKey
و
25-06-2008 | 03:06 PM
واخبريني عند اتمام عملية الحذف
انا في انتظارك
انا في انتظارك
n
25-06-2008 | 04:44 PM
الحمد لله تمام اتمسح نهاءي وحاسه ان الجهاز خفيف مشكوررررررررره حبيبتي
و
25-06-2008 | 07:46 PM
nado4;6439488:
الحمد لله تمام اتمسح نهاءي وحاسه ان الجهاز خفيف مشكوررررررررره حبيبتي
حبيبتي اعملي لي تقرير ببرنامج HijackThis
n
25-06-2008 | 11:46 PM
التقرير
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:45:52, on 25/06/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WgaTray.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Yahoo!\Messenger\yupdater.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.3roos.com/FGGcZaWh0vb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.3roos.com/TCKiZR6BROl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.3roos.com/fW7dMmVYlEU
O2 - BHO: tisqatyu.dll - {18093456-9012-4568-9076-908765467181} - C:\WINDOWS\System32\tisqatyu.dll
O2 - BHO: ijdyapaw.dll - {1A698452-C5D8-C584-C256-C264C987C5A1} - C:\WINDOWS\System32\ijdyapaw.dll
O2 - BHO: akjsdkaq.dll - {4A908760-8000-4000-A000-9000322145A4} - C:\WINDOWS\System32\akjsdkaq.dll
O2 - BHO: tysqbkol.dll - {5D098345-6785-1098-5413-678067AE03D5} - C:\WINDOWS\System32\tysqbkol.dll
O2 - BHO: arjreler.dll - {7C69034A-F45F-D34D-A33A-C33C4D324FC7} - C:\WINDOWS\System32\arjreler.dll
O2 - BHO: mnmhgsrv.dll - {7C8D1401-A58D-A81C-CD24-A5915C4517C7} - C:\WINDOWS\System32\mnmhgsrv.dll
O2 - BHO: s2da2f323.dll - {A629FF4F-ACDB-5C90-A098-FACB3456A26A} - C:\WINDOWS\System32\s2da2f323.dll
O2 - BHO: yzztkmsn.dll - {B490415F-65F8-B5C5-D8BA-9405FB12054B} - C:\WINDOWS\System32\yzztkmsn.dll
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{45E890EC-2E69-4BB8-9096-657E7C13A6B2}: NameServer = 66.11.234.90,66.11.234.91
O20 - AppInit_DLLs: jkjkll.dll,ghjyer.dll,ilkyu.dll,yukevg.dll,ghkrg.dll,tuker.dll,ujkwet.dll,asfjthj.dll,hmsdvf.dll,jrhhh.dll,sdrfh.dll,vhsdfg.dll,dger.dll,losdf.dll,kergt.dll,gfcfg.dll,reger.dll,hrergh.dll,frntrn.dll,qrhhb.dll,drghszd.dll,fngn.dll,gnfctt.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,xdndn.dll,xdfntt.dll,hgfhk.dll,dnteh.dll,xfng.dll,njritc.dll,chmfcmh.dll,jwlah.dll,gmnait.dll,hfjg.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,fgthde.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,ydgn.dll,dbfb.dll,fjnbv.dll,rthkyuk.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,xdhdg.dll,rhs.dll,mrjhtjd.dll,zdbfbd.dll,fjyjy.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,ghthhh.dll,yjrfe.dll,dscef.dll,crugd.dll,lariytrz.dll,hjaiq.dll,kduy.dll,hkfgh.dll,awef.dll,dfhsh.dll,ethsh.dll,stehs.dll,sthth.dll,wfhyt.dll,rgghjj.dll,ghjkdr.dll,hfther.dll,,tisqatyu.dll,yzztkmsn.dll,akjsdkaq.dll,arjreler.dll
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O21 - SSODL: mstimewd - {00180018-0018-0018-0018-00180018BB15} - C:\WINDOWS\System32\mstimewd.dll
O21 - SSODL: JavaView - {DA191DE0-AA86-D04E-4B87-2A3D4928BE99} - C:\WINDOWS\AppPatch\Jview.dll
O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - (no file)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
--
End of file - 4491 bytes
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:45:52, on 25/06/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WgaTray.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Yahoo!\Messenger\yupdater.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.3roos.com/FGGcZaWh0vb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.3roos.com/TCKiZR6BROl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.3roos.com/fW7dMmVYlEU
O2 - BHO: tisqatyu.dll - {18093456-9012-4568-9076-908765467181} - C:\WINDOWS\System32\tisqatyu.dll
O2 - BHO: ijdyapaw.dll - {1A698452-C5D8-C584-C256-C264C987C5A1} - C:\WINDOWS\System32\ijdyapaw.dll
O2 - BHO: akjsdkaq.dll - {4A908760-8000-4000-A000-9000322145A4} - C:\WINDOWS\System32\akjsdkaq.dll
O2 - BHO: tysqbkol.dll - {5D098345-6785-1098-5413-678067AE03D5} - C:\WINDOWS\System32\tysqbkol.dll
O2 - BHO: arjreler.dll - {7C69034A-F45F-D34D-A33A-C33C4D324FC7} - C:\WINDOWS\System32\arjreler.dll
O2 - BHO: mnmhgsrv.dll - {7C8D1401-A58D-A81C-CD24-A5915C4517C7} - C:\WINDOWS\System32\mnmhgsrv.dll
O2 - BHO: s2da2f323.dll - {A629FF4F-ACDB-5C90-A098-FACB3456A26A} - C:\WINDOWS\System32\s2da2f323.dll
O2 - BHO: yzztkmsn.dll - {B490415F-65F8-B5C5-D8BA-9405FB12054B} - C:\WINDOWS\System32\yzztkmsn.dll
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{45E890EC-2E69-4BB8-9096-657E7C13A6B2}: NameServer = 66.11.234.90,66.11.234.91
O20 - AppInit_DLLs: jkjkll.dll,ghjyer.dll,ilkyu.dll,yukevg.dll,ghkrg.dll,tuker.dll,ujkwet.dll,asfjthj.dll,hmsdvf.dll,jrhhh.dll,sdrfh.dll,vhsdfg.dll,dger.dll,losdf.dll,kergt.dll,gfcfg.dll,reger.dll,hrergh.dll,frntrn.dll,qrhhb.dll,drghszd.dll,fngn.dll,gnfctt.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,xdndn.dll,xdfntt.dll,hgfhk.dll,dnteh.dll,xfng.dll,njritc.dll,chmfcmh.dll,jwlah.dll,gmnait.dll,hfjg.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,fgthde.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,ydgn.dll,dbfb.dll,fjnbv.dll,rthkyuk.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,xdhdg.dll,rhs.dll,mrjhtjd.dll,zdbfbd.dll,fjyjy.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,ghthhh.dll,yjrfe.dll,dscef.dll,crugd.dll,lariytrz.dll,hjaiq.dll,kduy.dll,hkfgh.dll,awef.dll,dfhsh.dll,ethsh.dll,stehs.dll,sthth.dll,wfhyt.dll,rgghjj.dll,ghjkdr.dll,hfther.dll,,tisqatyu.dll,yzztkmsn.dll,akjsdkaq.dll,arjreler.dll
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O21 - SSODL: mstimewd - {00180018-0018-0018-0018-00180018BB15} - C:\WINDOWS\System32\mstimewd.dll
O21 - SSODL: JavaView - {DA191DE0-AA86-D04E-4B87-2A3D4928BE99} - C:\WINDOWS\AppPatch\Jview.dll
O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - (no file)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
--
End of file - 4491 bytes
و
26-06-2008 | 12:07 AM
عزيزتي انتي متأكدة انك حذفتي البرنامج بالطريقة اللي شرحت لج؟؟
لانه من التقرير مبين ان البرنامج بعده موجود؟؟
لانه من التقرير مبين ان البرنامج بعده موجود؟؟
و
26-06-2008 | 12:30 AM
عزيزتي عندي استفسار ،، الاحظ ان عندج حسابين
واحد بأسم : ali والثاني بأسم : jana
بس ممكن تخبريني اي واحد انتي تستخدمين ؟ والاخر من يستخدمه؟؟
-----------------------------------------
اوكي حملي هالملف ،، http://go.3roos.com/EkOp8wbmIgi
هالملف غير الملفات السابقة التي تم تحميلها ،، يعني لازم تحملين هالملف
ثم اقفلي جميع صفحات اﻻنترنت والبرامج
واعملي اﻻتي: اسحبي هالملف الى برنامج ComboFix كما هو موضح بالصورة
وبرنامج ComboFix راح يشتغل و يمكن بعدها يسوي ريستارت "اعادة تشغيل " للجهاز
بعدها بيظهر لج التقرير ارفقيه بردك القادم
ملاحظة هامة: عند عمل هالبرنامج فلا تضغطي على الفأرة ابدا لانه قد يسبب في تعليق البرنامج اتركيه حتى يكمل
-------------------------------------------------
وفي الاخير تقرير مرة اخرى ببرنامج Hijackthis
واحد بأسم : ali والثاني بأسم : jana
بس ممكن تخبريني اي واحد انتي تستخدمين ؟ والاخر من يستخدمه؟؟
-----------------------------------------
اوكي حملي هالملف ،، http://go.3roos.com/EkOp8wbmIgi
هالملف غير الملفات السابقة التي تم تحميلها ،، يعني لازم تحملين هالملف
ثم اقفلي جميع صفحات اﻻنترنت والبرامج
واعملي اﻻتي: اسحبي هالملف الى برنامج ComboFix كما هو موضح بالصورة
وبرنامج ComboFix راح يشتغل و يمكن بعدها يسوي ريستارت "اعادة تشغيل " للجهاز
بعدها بيظهر لج التقرير ارفقيه بردك القادم
ملاحظة هامة: عند عمل هالبرنامج فلا تضغطي على الفأرة ابدا لانه قد يسبب في تعليق البرنامج اتركيه حتى يكمل
-------------------------------------------------
وفي الاخير تقرير مرة اخرى ببرنامج Hijackthis
n
26-06-2008 | 05:33 AM
عزيزتي الجهز واحد فقط لكن زوجي عامل مستخدمين انا اظن ان الافيرا هو الفيرس لاني مسحته مثل ما قلتي لي
n
26-06-2008 | 05:50 AM
التقريركبير هقسمه مرتين
ComboFix 08-06-16.5 - ali 06/26/2008 5:35:34.8 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1256.1.1033.18.245 [GMT 3:00]
Running from: C:\Documents and Settings\ali\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\ali\Desktop\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\WINDOWS\AppPatch\AcPlugin.dll
C:\WINDOWS\AppPatch\AcSpecf.dll
C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
C:\WINDOWS\system32\arjreler.dll
C:\WINDOWS\system32\cgsqatyu.sys
C:\WINDOWS\system32\drivers\eth8023.sys
C:\WINDOWS\system32\dsdyapaw.exe
C:\WINDOWS\system32\ijdyapaw.dll
C:\WINDOWS\system32\iujraler.sys
C:\WINDOWS\system32\lpmxajkl.exe
C:\WINDOWS\System32\mstimewd.dll
C:\WINDOWS\system32\nhmxcjkl.dll
C:\WINDOWS\system32\pusqakol.exe
C:\WINDOWS\system32\pzdyapaw.sys
C:\WINDOWS\system32\rnmxajkl.sys
C:\WINDOWS\system32\s2da2f323.dll
C:\WINDOWS\system32\sbsqakol.sys
C:\WINDOWS\system32\smdsbsrv.sys
C:\WINDOWS\system32\snfybbyt.sys
C:\WINDOWS\system32\tysqbkol.dll
C:\WINDOWS\system32\wpuplder.dll
C:\WINDOWS\system32\wpuplderk.exe
C:\WINDOWS\system32\xsdjbbmp.sys
C:\WINDOWS\system32\yzztkmsn.dll
C:\WINDOWS\system32\zsdjabmp.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\ali\Local Settings\Temporary Internet Files\Content.IE5\LHBCDWHT\cnsminex_empty[2].htm
C:\Program Files\TryMedia
C:\Program Files\TryMedia\ActiveMark\data\{1446B6EB-3E8D-FC4E-CFDB-AA8B3FD8ADED}
C:\Program Files\TryMedia\ActiveMark\data\{3249137E-5008-446A-453E-2E92D9CF5125}
C:\Program Files\TryMedia\ActiveMark\data\{39BACCC6-4799-CD6D-E602-725D910BDD72}
C:\WINDOWS\AppPatch\AcPlugin.dll
C:\WINDOWS\AppPatch\AcSpecf.dll
C:\WINDOWS\AppPatch\AcXtrnel.dll
C:\WINDOWS\AppPatch\Jview.dll
C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
C:\WINDOWS\linkinfo.dll
C:\WINDOWS\system32\aitlasys.exe
C:\WINDOWS\system32\arjreler.dll
C:\WINDOWS\system32\asfjthj.dll
C:\WINDOWS\system32\cedafb.dll
C:\WINDOWS\system32\cgsqatyu.sys
C:\WINDOWS\system32\ddserh.dll
C:\WINDOWS\system32\drivers\cdralw.sys
C:\WINDOWS\system32\drivers\eth8023.sys
C:\WINDOWS\system32\dsdyapaw.exe
C:\WINDOWS\system32\ergfwe.dll
C:\WINDOWS\system32\fassaplo.sys
C:\WINDOWS\system32\fsrgeb.dll
C:\WINDOWS\system32\fstlbsys.sys
C:\WINDOWS\system32\gajzalit.sys
C:\WINDOWS\system32\ghjyer.dll
C:\WINDOWS\system32\ghwxattb.exe
C:\WINDOWS\system32\gjbhr.dll
C:\WINDOWS\system32\gpsgajba.sys
C:\WINDOWS\system32\hgfhk.cfg
C:\WINDOWS\system32\hgfhk.dll
C:\WINDOWS\system32\hjk.dll
C:\WINDOWS\system32\ijdyapaw.dll
C:\WINDOWS\system32\ijsgajba.sys
C:\WINDOWS\system32\isdsasrv.exe
C:\WINDOWS\system32\ismhasrv.exe
C:\WINDOWS\system32\iujraler.sys
C:\WINDOWS\system32\jkjkll.dll
C:\WINDOWS\system32\lariytrz.cfg
C:\WINDOWS\system32\lariytrz.dll
C:\WINDOWS\system32\lkssaplo.exe
C:\WINDOWS\system32\lojxadwd.exe
C:\WINDOWS\system32\lpmxajkl.exe
C:\WINDOWS\system32\lpsgajba.exe
C:\WINDOWS\system32\mkjsakaq.exe
C:\WINDOWS\system32\mnmhgsrv.dll
C:\WINDOWS\System32\mstimewd.dll
C:\WINDOWS\system32\newxbttb.sys
C:\WINDOWS\system32\njritc.cfg
C:\WINDOWS\system32\njritc.dll
C:\WINDOWS\system32\onjzalit.exe
C:\WINDOWS\system32\oqrthc.cfg
C:\WINDOWS\system32\oqrthc.dll
C:\WINDOWS\system32\pmjhbhlp.sys
C:\WINDOWS\system32\pusqakol.exe
C:\WINDOWS\system32\pzdyapaw.sys
C:\WINDOWS\system32\rnmxajkl.sys
C:\WINDOWS\system32\s2da2f323.dll
C:\WINDOWS\system32\sbsqakol.sys
C:\WINDOWS\system32\sdjsakaq.sys
C:\WINDOWS\system32\sergy.dll
C:\WINDOWS\system32\simyaapi.exe
C:\WINDOWS\system32\smdsbsrv.sys
C:\WINDOWS\system32\smmhbsrv.sys
C:\WINDOWS\system32\snfybbyt.sys
C:\WINDOWS\system32\spjhahlp.exe
C:\WINDOWS\system32\spmybapi.sys
C:\WINDOWS\system32\sqjsakaq.sys
C:\WINDOWS\system32\tdggrz.dll
C:\WINDOWS\system32\tfsdmz.dll
C:\WINDOWS\system32\tisqatyu.dll
C:\WINDOWS\system32\tiwxattb.sys
C:\WINDOWS\system32\tysqbkol.dll
C:\WINDOWS\system32\ujkwet.dll
C:\WINDOWS\system32\wpuplder.dll
C:\WINDOWS\system32\wpuplderk.exe
C:\WINDOWS\system32\wymxajkl.sys
C:\WINDOWS\system32\wyrsdj.dll
C:\WINDOWS\system32\xfztbmsn.sys
C:\WINDOWS\system32\xsdjbbmp.sys
C:\WINDOWS\system32\xzcsbhlp.sys
C:\WINDOWS\system32\ysjxbdwd.sys
C:\WINDOWS\system32\yzztkmsn.dll
C:\WINDOWS\system32\zaztamsn.exe
C:\WINDOWS\system32\zdbdb.cfg
C:\WINDOWS\system32\zdbdb.dll
C:\WINDOWS\system32\zptlcsys.dll
C:\WINDOWS\system32\zsdjabmp.exe
C:\WINDOWS\system32\zxcsahlp.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_CDRALW
-------\Service_cdralw
((((((((((((((((((((((((( Files Created from 2008-05-26 to 2008-06-26 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-25 20:42 30 ----a-w C:\MicroSoft.bat
2008-06-25 20:42 186 ----a-w C:\MicroSoft.vbs
2008-06-19 20:46 --------- d-----w C:\Documents and Settings\ali\Application Data\cleaner
2008-06-18 16:22 --------- d-----w C:\Documents and Settings\ali\Application Data\CyberScrub
2008-06-18 11:36 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-06-16 19:28 --------- d-----w C:\Program Files\ERUNT
2008-06-16 08:54 --------- d-----w C:\Documents and Settings\ali\Application Data\Media Player Classic
2008-06-14 21:45 --------- d-----w C:\Documents and Settings\ali\Application Data\DivX
2008-06-13 19:58 --------- d-----w C:\Program Files\Google
2008-06-13 18:10 --------- d-----w C:\Program Files\Yahoo!
2008-06-13 15:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-13 15:10 --------- d-----w C:\Documents and Settings\ali\Application Data\Malwarebytes
2008-06-12 22:46 --------- d-----w C:\Documents and Settings\ali\Application Data\Talkback
2008-06-12 21:58 --------- d-----w C:\Documents and Settings\jana\Application Data\Media Player Classic
2008-06-12 18:09 --------- d-----w C:\Program Files\Yahoo! Games
2008-06-12 11:32 --------- d-----w C:\Program Files\Trend Micro
2008-06-10 16:02 34,296 ----a-w C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-10 16:02 15,864 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-06-09 14:36 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-06-09 14:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-09 09:03 --------- d-----w C:\Program Files\Common Files\xing shared
2008-06-09 09:03 --------- d-----w C:\Program Files\Common Files\Real
2008-06-08 20:13 --------- d-----w C:\Documents and Settings\ali\Application Data\Yahoo!
2008-06-08 19:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-06-07 16:11 --------- d-----w C:\Program Files\Real
2008-06-07 15:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-06-07 14:09 --------- d-----w C:\Program Files\Winamp
2008-06-07 14:08 --------- d-----w C:\Documents and Settings\jana\Application Data\Winamp
2008-06-06 22:58 --------- d-----w C:\Documents and Settings\jana\Application Data\Yahoo!
2008-06-06 22:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-06-06 20:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-06 20:47 --------- d-----w C:\Program Files\Realtek
2008-06-06 20:46 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-06-06 20:46 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-06 20:46 --------- d-----w C:\Documents and Settings\jana\Application Data\InstallShield
2008-06-06 20:45 4,716 ----a-w C:\WINDOWS\gdrv.sys
2008-06-06 20:42 --------- d-----w C:\Program Files\Intel
2008-06-06 20:07 --------- d-----w C:\Program Files\microsoft frontpage
2004-08-08 10:04 16,734 --sh--w C:\WINDOWS\system32\agxyaloe.exe
2004-08-08 09:59 536,072 --sh--w C:\WINDOWS\system32\akjsdkaq.dll
2004-08-08 20:47 16,497 --sh--w C:\WINDOWS\system32\dazfajke.exe
2004-08-08 20:47 1,040 --sh--w C:\WINDOWS\system32\dtzfajke.sys
2004-08-08 10:04 520 --sh--w C:\WINDOWS\system32\igxyaloe.sys
2004-08-08 10:00 16,530 --sh--w C:\WINDOWS\system32\mkjraler.exe
2004-08-08 20:47 534,024 --sh--w C:\WINDOWS\system32\mndshsrv.dll
2004-08-08 09:59 15,467 --sh--w C:\WINDOWS\system32\posqatyu.exe
2004-08-08 20:47 536,072 --sh--w C:\WINDOWS\system32\pqzfajke.dll
2004-08-08 10:00 15,044 --sh--w C:\WINDOWS\system32\tjfyabyt.exe
.
((((((((((((((((((((((((((((( snapshot_Mon 06-23-2008_23.54.04.34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-23 20:51:18 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-26 02:38:14 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2005-10-20 09:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-24\ERDNT.EXE
+ 2008-06-24 08:18:21 2,195,456 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-24\Users\00000001\NTUSER.DAT
+ 2008-06-24 08:18:21 32,768 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-24\Users\00000002\UsrClass.dat
+ 2005-10-20 09:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\24-06-2008\ERDNT.EXE
+ 2008-06-24 08:12:49 2,195,456 ----a-w C:\WINDOWS\erdnt\AutoBackup\24-06-2008\Users\00000001\NTUSER.DAT
+ 2008-06-24 08:12:50 32,768 ----a-w C:\WINDOWS\erdnt\AutoBackup\24-06-2008\Users\00000002\UsrClass.dat
- 2005-05-25 22:44:31 10,752 ----a-w C:\WINDOWS\hh.exe
+ 2002-08-29 12:00:00 10,752 ----a-w C:\WINDOWS\hh.exe
- 2005-04-22 05:20:24 51,712 ----a-w C:\WINDOWS\msagent\agentdpv.dll
+ 2002-08-29 12:00:00 50,688 ----a-w C:\WINDOWS\msagent\agentdpv.dll
- 2006-08-16 12:14:23 95,232 ----a-w C:\WINDOWS\system32\6to4svc.dll
+ 2002-08-29 12:00:00 59,392 ----a-w C:\WINDOWS\system32\6to4svc.dll
+ 2006-07-22 20:49:26 5,376 ----a-w C:\WINDOWS\system32\antiwpa.dll
- 2005-03-02 18:20:03 53,760 ----a-w C:\WINDOWS\system32\authz.dll
+ 2002-08-29 12:00:00 51,200 ----a-w C:\WINDOWS\system32\authz.dll
- 2006-09-04 06:23:53 1,027,072 ----a-w C:\WINDOWS\system32\BROWSEUI.DLL
+ 2005-06-17 21:16:18 1,017,856 ----a-w C:\WINDOWS\system32\browseui.dll
- 2005-07-26 04:30:34 220,672 ----a-w C:\WINDOWS\system32\catsrv.dll
+ 2002-08-29 12:00:00 215,040 ----a-w C:\WINDOWS\system32\catsrv.dll
- 2005-07-26 04:30:38 581,632 ----a-w C:\WINDOWS\system32\catsrvut.dll
+ 2002-08-29 12:00:00 582,656 ----a-w C:\WINDOWS\system32\catsrvut.dll
- 2004-12-07 15:43:02 143,360 ----a-w C:\WINDOWS\system32\CDFVIEW.DLL
+ 2002-08-29 12:00:00 142,336 ----a-w C:\WINDOWS\system32\cdfview.dll
- 2005-07-26 04:30:38 110,080 ----a-w C:\WINDOWS\system32\clbcatex.dll
+ 2002-08-29 12:00:00 100,864 ----a-w C:\WINDOWS\system32\clbcatex.dll
- 2005-07-26 04:30:41 497,152 ----a-w C:\WINDOWS\system32\clbcatq.dll
+ 2002-08-29 12:00:00 468,480 ----a-w C:\WINDOWS\system32\clbcatq.dll
- 2005-07-26 04:30:41 62,464 ----a-w C:\WINDOWS\system32\colbact.dll
+ 2002-08-29 12:00:00 56,832 ----a-w C:\WINDOWS\system32\colbact.dll
- 2005-07-26 04:30:42 187,392 ----a-w C:\WINDOWS\system32\Com\comadmin.dll
+ 2002-08-29 12:00:00 186,880 ----a-w C:\WINDOWS\system32\Com\comadmin.dll
- 2006-08-25 15:53:55 561,664 ----a-w C:\WINDOWS\system32\comctl32.dll
+ 2002-08-29 12:00:00 557,056 ----a-w C:\WINDOWS\system32\comctl32.dll
- 2005-07-26 04:30:42 89,600 ----a-w C:\WINDOWS\system32\comrepl.dll
+ 2002-08-29 12:00:00 82,432 ----a-w C:\WINDOWS\system32\comrepl.dll
- 2005-07-26 04:30:49 1,179,136 ----a-w C:\WINDOWS\system32\comsvcs.dll
+ 2002-08-29 12:00:00 1,172,992 ----a-w C:\WINDOWS\system32\comsvcs.dll
- 2005-07-26 04:31:11 499,200 ----a-w C:\WINDOWS\system32\comuid.dll
+ 2002-08-29 12:00:00 495,616 ----a-w C:\WINDOWS\system32\comuid.dll
- 2008-06-23 20:51:20 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-06-26 02:38:15 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-06-23 20:51:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-06-26 02:38:15 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-06-23 20:51:20 65,536 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-26 02:38:15 65,536 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2004-10-28 01:29:54 92,160 ----a-w C:\WINDOWS\system32\cscdll.dll
+ 2002-08-29 12:00:00 89,600 ----a-w C:\WINDOWS\system32\cscdll.dll
- 2005-10-20 17:08:44 986,112 ----a-w C:\WINDOWS\system32\DANIM.DLL
+ 2002-08-29 12:00:00 986,112 ----a-w C:\WINDOWS\system32\danim.dll
- 2006-05-19 12:15:32 103,936 ----a-w C:\WINDOWS\system32\dhcpcsvc.dll
+ 2002-08-29 12:00:00 99,840 ----a-w C:\WINDOWS\system32\dhcpcsvc.dll
- 2006-08-16 12:14:23 95,232 -c--a-w C:\WINDOWS\system32\dllcache\6to4svc.dll
+ 2002-08-29 12:00:00 59,392 -c--a-w C:\WINDOWS\system32\dllcache\6to4svc.dll
- 2005-04-22 05:20:24 51,712 -c--a-w C:\WINDOWS\system32\dllcache\agentdpv.dll
+ 2002-08-29 12:00:00 50,688 -c--a-w C:\WINDOWS\system32\dllcache\agentdpv.dll
- 2005-03-02 18:20:03 53,760 -c--a-w C:\WINDOWS\system32\dllcache\authz.dll
+ 2002-08-29 12:00:00 51,200 ----a-w C:\WINDOWS\system32\dllcache\authz.dll
- 2006-09-04 06:23:53 1,027,072 -c--a-w C:\WINDOWS\system32\dllcache\browseui.dll
+ 2005-06-17 21:16:18 1,017,856 ----a-w C:\WINDOWS\system32\dllcache\browseui.dll
- 2005-07-26 04:30:34 220,672 -c--a-w C:\WINDOWS\system32\dllcache\catsrv.dll
+ 2002-08-29 12:00:00 215,040 ----a-w C:\WINDOWS\system32\dllcache\catsrv.dll
- 2005-07-26 04:30:38 581,632 -c--a-w C:\WINDOWS\system32\dllcache\catsrvut.dll
+ 2002-08-29 12:00:00 582,656 ----a-w C:\WINDOWS\system32\dllcache\catsrvut.dll
- 2004-12-07 15:43:02 143,360 -c--a-w C:\WINDOWS\system32\dllcache\CDFVIEW.DLL
+ 2002-08-29 12:00:00 142,336 ----a-w C:\WINDOWS\system32\dllcache\cdfview.dll
- 2005-07-26 04:30:38 110,080 -c--a-w C:\WINDOWS\system32\dllcache\clbcatex.dll
+ 2002-08-29 12:00:00 100,864 ----a-w C:\WINDOWS\system32\dllcache\clbcatex.dll
- 2005-07-26 04:30:41 497,152 -c--a-w C:\WINDOWS\system32\dllcache\clbcatq.dll
+ 2002-08-29 12:00:00 468,480 ----a-w C:\WINDOWS\system32\dllcache\clbcatq.dll
- 2005-07-26 04:30:41 62,464 -c--a-w C:\WINDOWS\system32\dllcache\colbact.dll
+ 2002-08-29 12:00:00 56,832 ----a-w C:\WINDOWS\system32\dllcache\colbact.dll
- 2005-07-26 04:30:42 187,392 -c--a-w C:\WINDOWS\system32\dllcache\comadmin.dll
+ 2002-08-29 12:00:00 186,880 ----a-w C:\WINDOWS\system32\dllcache\comadmin.dll
- 2006-08-25 15:53:55 561,664 -c--a-w C:\WINDOWS\system32\dllcache\comctl32.dll
+ 2002-08-29 12:00:00 557,056 ----a-w C:\WINDOWS\system32\dllcache\comctl32.dll
- 2005-07-26 04:30:42 89,600 -c--a-w C:\WINDOWS\system32\dllcache\comrepl.dll
+ 2002-08-29 12:00:00 82,432 ----a-w C:\WINDOWS\system32\dllcache\comrepl.dll
- 2005-07-26 04:30:49 1,179,136 -c--a-w C:\WINDOWS\system32\dllcache\comsvcs.dll
+ 2002-08-29 12:00:00 1,172,992 ----a-w C:\WINDOWS\system32\dllcache\comsvcs.dll
- 2005-07-26 04:31:11 499,200 -c--a-w C:\WINDOWS\system32\dllcache\comuid.dll
+ 2002-08-29 12:00:00 495,616 ----a-w C:\WINDOWS\system32\dllcache\comuid.dll
- 2004-10-28 01:29:54 92,160 -c--a-w C:\WINDOWS\system32\dllcache\cscdll.dll
+ 2002-08-29 12:00:00 89,600 -c--a-w C:\WINDOWS\system32\dllcache\cscdll.dll
- 2005-10-20 17:08:44 986,112 -c--a-w C:\WINDOWS\system32\dllcache\DANIM.DLL
+ 2002-08-29 12:00:00 986,112 ----a-w C:\WINDOWS\system32\dllcache\danim.dll
- 2006-05-19 12:15:32 103,936 -c--a-w C:\WINDOWS\system32\dllcache\dhcpcsvc.dll
+ 2002-08-29 12:00:00 99,840 ----a-w C:\WINDOWS\system32\dllcache\dhcpcsvc.dll
- 2006-02-27 10:31:38 75,776 -c--a-w C:\WINDOWS\system32\dllcache\DIRECTDB.DLL
+ 2002-08-29 12:00:00 76,288 ----a-w C:\WINDOWS\system32\dllcache\directdb.dll
- 2006-06-26 17:47:50 140,288 -c--a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
+ 2002-08-29 12:00:00 139,264 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
- 2002-08-29 12:00:00 115,200 -c--a-w C:\WINDOWS\system32\dllcache\dpcdll.dll
+ 2002-08-29 00:40:50 115,200 -c--a-w C:\WINDOWS\system32\dllcache\dpcdll.dll
- 2006-06-09 11:35:50 351,744 -c--a-w C:\WINDOWS\system32\dllcache\DXTMSFT.DLL
+ 2002-08-29 12:00:00 337,920 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2006-06-09 11:35:30 192,512 -c--a-w C:\WINDOWS\system32\dllcache\DXTRANS.DLL
+ 2002-08-29 12:00:00 194,560 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2005-07-26 04:31:12 227,328 -c--a-w C:\WINDOWS\system32\dllcache\es.dll
+ 2002-08-29 12:00:00 225,280 ----a-w C:\WINDOWS\system32\dllcache\es.dll
- 2005-10-20 22:33:08 991,232 -c--a-w C:\WINDOWS\system32\dllcache\esent.dll
+ 2002-08-29 12:00:00 1,018,368 ----a-w C:\WINDOWS\system32\dllcache\esent.dll
- 2004-08-20 22:01:15 82,432 -c--a-w C:\WINDOWS\system32\dllcache\fldrclnr.dll
+ 2002-08-29 12:00:00 82,432 -c--a-w C:\WINDOWS\system32\dllcache\fldrclnr.dll
- 2005-10-17 21:29:53 77,824 -c--a-w C:\WINDOWS\system32\dllcache\fontsub.dll
+ 2002-08-29 12:00:00 79,360 ----a-w C:\WINDOWS\system32\dllcache\fontsub.dll
- 2006-01-02 22:38:03 260,608 -c--a-w C:\WINDOWS\system32\dllcache\gdi32.dll
+ 2002-08-29 12:00:00 250,368 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll
- 2004-08-25 22:07:34 183,808 -c--a-w C:\WINDOWS\system32\dllcache\gptext.dll
+ 2002-08-29 12:00:00 183,296 ----a-w C:\WINDOWS\system32\dllcache\gptext.dll
- 2005-05-25 22:44:31 10,752 -c--a-w C:\WINDOWS\system32\dllcache\hh.exe
+ 2002-08-29 12:00:00 10,752 ----a-w C:\WINDOWS\system32\dllcache\hh.exe
- 2005-05-27 01:59:52 38,912 -c--a-w C:\WINDOWS\system32\dllcache\hhsetup.dll
+ 2002-08-29 12:00:00 37,888 ----a-w C:\WINDOWS\system32\dllcache\hhsetup.dll
- 2006-07-21 08:30:50 72,704 -c--a-w C:\WINDOWS\system32\dllcache\hlink.dll
+ 2002-08-29 12:00:00 77,850 ----a-w C:\WINDOWS\system32\dllcache\hlink.dll
- 2005-06-29 01:54:58 237,056 -c--a-w C:\WINDOWS\system32\dllcache\icm32.dll
+ 2002-08-29 12:00:00 236,032 ----a-w C:\WINDOWS\system32\dllcache\icm32.dll
- 2006-02-24 12:24:42 236,032 -c--a-w C:\WINDOWS\system32\dllcache\IEPEERS.DLL
+ 2002-08-29 12:00:00 231,424 ----a-w C:\WINDOWS\system32\dllcache\iepeers.dll
- 2006-02-27 10:31:54 596,480 -c--a-w C:\WINDOWS\system32\dllcache\INETCOMM.DLL
+ 2002-08-29 12:00:00 587,776 ----a-w C:\WINDOWS\system32\dllcache\inetcomm.dll
- 2006-08-16 12:14:23 31,232 -c--a-w C:\WINDOWS\system32\dllcache\inetmib1.dll
+ 2002-08-29 12:00:00 31,232 -c--a-w C:\WINDOWS\system32\dllcache\inetmib1.dll
- 2006-02-27 10:31:50 47,616 -c--a-w C:\WINDOWS\system32\dllcache\INETRES.DLL
+ 2002-08-29 12:00:00 47,616 ----a-w C:\WINDOWS\system32\dllcache\inetres.dll
- 2004-08-26 07:53:48 69,632 -c--a-w C:\WINDOWS\system32\dllcache\INSENG.DLL
+ 2002-08-29 12:00:00 69,632 ----a-w C:\WINDOWS\system32\dllcache\inseng.dll
- 2006-08-16 12:14:23 83,456 -c--a-w C:\WINDOWS\system32\dllcache\iphlpapi.dll
+ 2002-08-29 12:00:00 82,944 -c--a-w C:\WINDOWS\system32\dllcache\iphlpapi.dll
- 2006-05-13 10:13:31 74,368 -c--a-w C:\WINDOWS\system32\dllcache\ipsec.sys
+ 2002-08-29 12:00:00 57,984 -c--a-w C:\WINDOWS\system32\dllcache\ipsec.sys
- 2006-05-14 09:13:41 334,848 -c--a-w C:\WINDOWS\system32\dllcache\ipsecsnp.dll
+ 2002-08-29 12:00:00 332,800 -c--a-w C:\WINDOWS\system32\dllcache\ipsecsnp.dll
- 2006-05-14 09:13:41 159,744 -c--a-w C:\WINDOWS\system32\dllcache\ipsecsvc.dll
+ 2002-08-29 12:00:00 155,648 -c--a-w C:\WINDOWS\system32\dllcache\ipsecsvc.dll
- 2006-05-14 09:13:41 364,544 -c--a-w C:\WINDOWS\system32\dllcache\ipsmsnap.dll
+ 2002-08-29 12:00:00 364,032 -c--a-w C:\WINDOWS\system32\dllcache\ipsmsnap.dll
- 2006-08-16 09:28:55 48,640 -c--a-w C:\WINDOWS\system32\dllcache\ipv6.exe
+ 2002-08-29 12:00:00 60,928 -c--a-w C:\WINDOWS\system32\dllcache\ipv6.exe
- 2006-08-16 12:14:23 54,272 -c--a-w C:\WINDOWS\system32\dllcache\ipv6mon.dll
+ 2002-08-29 12:00:00 134,144 -c--a-w C:\WINDOWS\system32\dllcache\ipv6mon.dll
- 2005-05-27 01:59:52 143,872 -c--a-w C:\WINDOWS\system32\dllcache\itircl.dll
+ 2002-08-29 12:00:00 143,872 ----a-w C:\WINDOWS\system32\dllcache\itircl.dll
- 2005-05-27 01:59:52 128,000 -c--a-w C:\WINDOWS\system32\dllcache\itss.dll
+ 2002-08-29 12:00:00 122,368 ----a-w C:\WINDOWS\system32\dllcache\itss.dll
- 2006-05-26 19:19:50 163,840 -c--a-w C:\WINDOWS\system32\dllcache\JGDW400.DLL
+ 2002-08-29 12:00:00 144,896 ----a-w C:\WINDOWS\system32\dllcache\jgdw400.dll
- 2006-04-06 13:15:48 27,648 -c--a-w C:\WINDOWS\system32\dllcache\JGPL400.DLL
+ 2002-08-29 12:00:00 42,496 ----a-w C:\WINDOWS\system32\dllcache\jgpl400.dll
- 2006-05-18 05:58:56 458,752 -c--a-w C:\WINDOWS\system32\dllcache\jscript.dll
+ 2002-08-29 12:00:00 593,948 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll
- 2006-04-28 07:58:48 12,288 -c--a-w C:\WINDOWS\system32\dllcache\JSPROXY.DLL
+ 2002-08-29 12:00:00 12,288 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2006-07-05 10:46:36 928,768 -c--a-w C:\WINDOWS\system32\dllcache\kernel32.dll
+ 2002-08-29 12:00:00 930,304 ----a-w C:\WINDOWS\system32\dllcache\kernel32.dll
- 2005-09-01 01:49:29 16,384 -c--a-w C:\WINDOWS\system32\dllcache\linkinfo.dll
+ 2002-08-29 12:00:00 15,360 ----a-w C:\WINDOWS\system32\dllcache\linkinfo.dll
- 2004-03-30 01:48:36 36,864 -c--a-w C:\WINDOWS\system32\dllcache\mf3216.dll
+ 2002-08-29 12:00:00 35,328 -c--a-w C:\WINDOWS\system32\dllcache\mf3216.dll
- 2005-07-22 23:03:37 7,680 -c--a-w C:\WINDOWS\system32\dllcache\migregdb.exe
+ 2002-08-29 12:00:00 6,656 ----a-w C:\WINDOWS\system32\dllcache\migregdb.exe
- 2005-03-23 00:55:20 67,456 -c--a-w C:\WINDOWS\system32\dllcache\mqac.sys
+ 2002-08-29 12:00:00 67,200 ----a-w C:\WINDOWS\system32\dllcache\mqac.sys
- 2005-03-23 18:12:48 130,048 -c--a-w C:\WINDOWS\system32\dllcache\mqad.dll
+ 2002-08-29 12:00:00 130,048 ----a-w C:\WINDOWS\system32\dllcache\mqad.dll
- 2005-03-23 18:12:48 44,032 -c--a-w C:\WINDOWS\system32\dllcache\mqdscli.dll
+ 2002-08-29 12:00:00 44,032 ----a-w C:\WINDOWS\system32\dllcache\mqdscli.dll
- 2005-03-23 18:12:48 14,848 -c--a-w C:\WINDOWS\system32\dllcache\mqise.dll
+ 2002-08-29 12:00:00 14,848 ----a-w C:\WINDOWS\system32\dllcache\mqise.dll
- 2005-03-23 18:12:48 608,768 -c--a-w C:\WINDOWS\system32\dllcache\mqqm.dll
+ 2002-08-29 12:00:00 613,888 ----a-w C:\WINDOWS\system32\dllcache\mqqm.dll
- 2005-03-23 18:12:48 165,888 -c--a-w C:\WINDOWS\system32\dllcache\mqrt.dll
+ 2002-08-29 12:00:00 164,864 ----a-w C:\WINDOWS\system32\dllcache\mqrt.dll
- 2005-03-23 18:12:48 88,576 -c--a-w C:\WINDOWS\system32\dllcache\mqsec.dll
+ 2002-08-29 12:00:00 89,088 ----a-w C:\WINDOWS\system32\dllcache\mqsec.dll
- 2005-03-23 18:12:48 44,544 -c--a-w C:\WINDOWS\system32\dllcache\mqupgrd.dll
+ 2002-08-29 12:00:00 44,544 ----a-w C:\WINDOWS\system32\dllcache\mqupgrd.dll
- 2005-03-23 18:12:48 467,456 -c--a-w C:\WINDOWS\system32\dllcache\mqutil.dll
+ 2002-08-29 12:00:00 469,504 ----a-w C:\WINDOWS\system32\dllcache\mqutil.dll
- 2006-03-23 06:05:25 135,168 -c--a-w C:\WINDOWS\system32\dllcache\msadco.dll
+ 2002-08-29 12:00:00 131,072 ----a-w C:\WINDOWS\system32\dllcache\msadco.dll
- 2005-06-29 01:54:58 68,608 -c--a-w C:\WINDOWS\system32\dllcache\mscms.dll
+ 2002-08-29 12:00:00 68,096 ----a-w C:\WINDOWS\system32\dllcache\mscms.dll
- 2006-03-01 19:44:39 368,640 -c--a-w C:\WINDOWS\system32\dllcache\msdtcprx.dll
+ 2002-08-29 12:00:00 359,936 ----a-w C:\WINDOWS\system32\dllcache\msdtcprx.dll
- 2006-03-01 19:44:39 974,336 -c--a-w C:\WINDOWS\system32\dllcache\msdtctm.dll
+ 2002-08-29 12:00:00 869,376 ----a-w C:\WINDOWS\system32\dllcache\msdtctm.dll
- 2006-03-01 19:44:39 150,528 -c--a-w C:\WINDOWS\system32\dllcache\msdtcuiu.dll
+ 2002-08-29 12:00:00 151,040 ----a-w C:\WINDOWS\system32\dllcache\msdtcuiu.dll
- 2006-06-30 07:28:26 2,703,872 -c--a-w C:\WINDOWS\system32\dllcache\MSHTML.DLL
+ 2002-08-29 12:00:00 2,833,920 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2005-05-04 11:45:32 2,890,240 -c--a-w C:\WINDOWS\system32\dllcache\msi.dll
+ 2002-08-29 12:00:00 2,086,400 ----a-w C:\WINDOWS\system32\dllcache\msi.dll
- 2006-02-27 10:29:32 44,032 -c--a-w C:\WINDOWS\system32\dllcache\MSIDENT.DLL
+ 2002-08-29 12:00:00 44,032 ----a-w C:\WINDOWS\system32\dllcache\msident.dll
- 2005-08-05 17:23:27 230,400 -c--a-w C:\WINDOWS\system32\dllcache\msieftp.dll
+ 2002-08-29 12:00:00 229,888 ----a-w C:\WINDOWS\system32\dllcache\msieftp.dll
- 2005-03-21 12:00:22 78,848 -c--a-w C:\WINDOWS\system32\dllcache\msiexec.exe
+ 2002-08-29 12:00:00 64,512 ----a-w C:\WINDOWS\system32\dllcache\msiexec.exe
- 2005-03-21 12:00:22 271,360 -c--a-w C:\WINDOWS\system32\dllcache\msihnd.dll
+ 2002-08-29 12:00:00 305,664 ----a-w C:\WINDOWS\system32\dllcache\msihnd.dll
- 2006-02-27 10:32:04 56,832 -c--a-w C:\WINDOWS\system32\dllcache\MSIMN.EXE
+ 2002-08-29 12:00:00 57,344 ----a-w C:\WINDOWS\system32\dllcache\msimn.exe
- 2005-03-21 12:00:22 884,736 -c--a-w C:\WINDOWS\system32\dllcache\msimsg.dll
+ 2002-08-29 12:00:00 847,872 ----a-w C:\WINDOWS\system32\dllcache\msimsg.dll
- 2005-03-21 12:00:22 15,360 -c--a-w C:\WINDOWS\system32\dllcache\msisip.dll
+ 2002-08-29 12:00:00 39,936 ----a-w C:\WINDOWS\system32\dllcache\msisip.dll
- 2006-02-27 10:32:00 1,176,064 -c--a-w C:\WINDOWS\system32\dllcache\MSOE.DLL
+ 2002-08-29 12:00:00 1,174,016 ----a-w C:\WINDOWS\system32\dllcache\msoe.dll
- 2006-02-27 10:31:40 229,376 -c--a-w C:\WINDOWS\system32\dllcache\MSOEACCT.DLL
+ 2002-08-29 12:00:00 228,864 ----a-w C:\WINDOWS\system32\dllcache\msoeacct.dll
- 2006-02-27 10:32:08 2,479,616 -c--a-w C:\WINDOWS\system32\dllcache\MSOERES.DLL
+ 2002-08-29 12:00:00 2,479,104 ----a-w C:\WINDOWS\system32\dllcache\msoeres.dll
- 2006-02-27 10:31:36 91,136 -c--a-w C:\WINDOWS\system32\dllcache\MSOERT2.DLL
+ 2002-08-29 12:00:00 81,408 ----a-w C:\WINDOWS\system32\dllcache\msoert2.dll
- 2005-02-24 09:54:42 132,096 -c--a-w C:\WINDOWS\system32\dllcache\MSRATING.DLL
+ 2002-08-29 12:00:00 132,096 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll
- 2006-03-03 13:13:30 498,176 -c--a-w C:\WINDOWS\system32\dllcache\MSTIME.DLL
+ 2002-08-29 12:00:00 496,128 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll
- 2006-03-01 19:44:39 64,512 -c--a-w C:\WINDOWS\system32\dllcache\mtxclu.dll
+ 2002-08-29 12:00:00 61,440 ----a-w C:\WINDOWS\system32\dllcache\mtxclu.dll
- 2006-03-01 19:44:39 83,456 -c--a-w C:\WINDOWS\system32\dllcache\mtxoci.dll
+ 2002-08-29 12:00:00 83,968 ----a-w C:\WINDOWS\system32\dllcache\mtxoci.dll
- 2005-08-22 18:36:34 154,624 -c--a-w C:\WINDOWS\system32\dllcache\netman.dll
+ 2002-08-29 12:00:00 154,112 ----a-w C:\WINDOWS\system32\dllcache\netman.dll
ComboFix 08-06-16.5 - ali 06/26/2008 5:35:34.8 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1256.1.1033.18.245 [GMT 3:00]
Running from: C:\Documents and Settings\ali\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\ali\Desktop\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\WINDOWS\AppPatch\AcPlugin.dll
C:\WINDOWS\AppPatch\AcSpecf.dll
C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
C:\WINDOWS\system32\arjreler.dll
C:\WINDOWS\system32\cgsqatyu.sys
C:\WINDOWS\system32\drivers\eth8023.sys
C:\WINDOWS\system32\dsdyapaw.exe
C:\WINDOWS\system32\ijdyapaw.dll
C:\WINDOWS\system32\iujraler.sys
C:\WINDOWS\system32\lpmxajkl.exe
C:\WINDOWS\System32\mstimewd.dll
C:\WINDOWS\system32\nhmxcjkl.dll
C:\WINDOWS\system32\pusqakol.exe
C:\WINDOWS\system32\pzdyapaw.sys
C:\WINDOWS\system32\rnmxajkl.sys
C:\WINDOWS\system32\s2da2f323.dll
C:\WINDOWS\system32\sbsqakol.sys
C:\WINDOWS\system32\smdsbsrv.sys
C:\WINDOWS\system32\snfybbyt.sys
C:\WINDOWS\system32\tysqbkol.dll
C:\WINDOWS\system32\wpuplder.dll
C:\WINDOWS\system32\wpuplderk.exe
C:\WINDOWS\system32\xsdjbbmp.sys
C:\WINDOWS\system32\yzztkmsn.dll
C:\WINDOWS\system32\zsdjabmp.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\ali\Local Settings\Temporary Internet Files\Content.IE5\LHBCDWHT\cnsminex_empty[2].htm
C:\Program Files\TryMedia
C:\Program Files\TryMedia\ActiveMark\data\{1446B6EB-3E8D-FC4E-CFDB-AA8B3FD8ADED}
C:\Program Files\TryMedia\ActiveMark\data\{3249137E-5008-446A-453E-2E92D9CF5125}
C:\Program Files\TryMedia\ActiveMark\data\{39BACCC6-4799-CD6D-E602-725D910BDD72}
C:\WINDOWS\AppPatch\AcPlugin.dll
C:\WINDOWS\AppPatch\AcSpecf.dll
C:\WINDOWS\AppPatch\AcXtrnel.dll
C:\WINDOWS\AppPatch\Jview.dll
C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
C:\WINDOWS\linkinfo.dll
C:\WINDOWS\system32\aitlasys.exe
C:\WINDOWS\system32\arjreler.dll
C:\WINDOWS\system32\asfjthj.dll
C:\WINDOWS\system32\cedafb.dll
C:\WINDOWS\system32\cgsqatyu.sys
C:\WINDOWS\system32\ddserh.dll
C:\WINDOWS\system32\drivers\cdralw.sys
C:\WINDOWS\system32\drivers\eth8023.sys
C:\WINDOWS\system32\dsdyapaw.exe
C:\WINDOWS\system32\ergfwe.dll
C:\WINDOWS\system32\fassaplo.sys
C:\WINDOWS\system32\fsrgeb.dll
C:\WINDOWS\system32\fstlbsys.sys
C:\WINDOWS\system32\gajzalit.sys
C:\WINDOWS\system32\ghjyer.dll
C:\WINDOWS\system32\ghwxattb.exe
C:\WINDOWS\system32\gjbhr.dll
C:\WINDOWS\system32\gpsgajba.sys
C:\WINDOWS\system32\hgfhk.cfg
C:\WINDOWS\system32\hgfhk.dll
C:\WINDOWS\system32\hjk.dll
C:\WINDOWS\system32\ijdyapaw.dll
C:\WINDOWS\system32\ijsgajba.sys
C:\WINDOWS\system32\isdsasrv.exe
C:\WINDOWS\system32\ismhasrv.exe
C:\WINDOWS\system32\iujraler.sys
C:\WINDOWS\system32\jkjkll.dll
C:\WINDOWS\system32\lariytrz.cfg
C:\WINDOWS\system32\lariytrz.dll
C:\WINDOWS\system32\lkssaplo.exe
C:\WINDOWS\system32\lojxadwd.exe
C:\WINDOWS\system32\lpmxajkl.exe
C:\WINDOWS\system32\lpsgajba.exe
C:\WINDOWS\system32\mkjsakaq.exe
C:\WINDOWS\system32\mnmhgsrv.dll
C:\WINDOWS\System32\mstimewd.dll
C:\WINDOWS\system32\newxbttb.sys
C:\WINDOWS\system32\njritc.cfg
C:\WINDOWS\system32\njritc.dll
C:\WINDOWS\system32\onjzalit.exe
C:\WINDOWS\system32\oqrthc.cfg
C:\WINDOWS\system32\oqrthc.dll
C:\WINDOWS\system32\pmjhbhlp.sys
C:\WINDOWS\system32\pusqakol.exe
C:\WINDOWS\system32\pzdyapaw.sys
C:\WINDOWS\system32\rnmxajkl.sys
C:\WINDOWS\system32\s2da2f323.dll
C:\WINDOWS\system32\sbsqakol.sys
C:\WINDOWS\system32\sdjsakaq.sys
C:\WINDOWS\system32\sergy.dll
C:\WINDOWS\system32\simyaapi.exe
C:\WINDOWS\system32\smdsbsrv.sys
C:\WINDOWS\system32\smmhbsrv.sys
C:\WINDOWS\system32\snfybbyt.sys
C:\WINDOWS\system32\spjhahlp.exe
C:\WINDOWS\system32\spmybapi.sys
C:\WINDOWS\system32\sqjsakaq.sys
C:\WINDOWS\system32\tdggrz.dll
C:\WINDOWS\system32\tfsdmz.dll
C:\WINDOWS\system32\tisqatyu.dll
C:\WINDOWS\system32\tiwxattb.sys
C:\WINDOWS\system32\tysqbkol.dll
C:\WINDOWS\system32\ujkwet.dll
C:\WINDOWS\system32\wpuplder.dll
C:\WINDOWS\system32\wpuplderk.exe
C:\WINDOWS\system32\wymxajkl.sys
C:\WINDOWS\system32\wyrsdj.dll
C:\WINDOWS\system32\xfztbmsn.sys
C:\WINDOWS\system32\xsdjbbmp.sys
C:\WINDOWS\system32\xzcsbhlp.sys
C:\WINDOWS\system32\ysjxbdwd.sys
C:\WINDOWS\system32\yzztkmsn.dll
C:\WINDOWS\system32\zaztamsn.exe
C:\WINDOWS\system32\zdbdb.cfg
C:\WINDOWS\system32\zdbdb.dll
C:\WINDOWS\system32\zptlcsys.dll
C:\WINDOWS\system32\zsdjabmp.exe
C:\WINDOWS\system32\zxcsahlp.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_CDRALW
-------\Service_cdralw
((((((((((((((((((((((((( Files Created from 2008-05-26 to 2008-06-26 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-25 20:42 30 ----a-w C:\MicroSoft.bat
2008-06-25 20:42 186 ----a-w C:\MicroSoft.vbs
2008-06-19 20:46 --------- d-----w C:\Documents and Settings\ali\Application Data\cleaner
2008-06-18 16:22 --------- d-----w C:\Documents and Settings\ali\Application Data\CyberScrub
2008-06-18 11:36 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-06-16 19:28 --------- d-----w C:\Program Files\ERUNT
2008-06-16 08:54 --------- d-----w C:\Documents and Settings\ali\Application Data\Media Player Classic
2008-06-14 21:45 --------- d-----w C:\Documents and Settings\ali\Application Data\DivX
2008-06-13 19:58 --------- d-----w C:\Program Files\Google
2008-06-13 18:10 --------- d-----w C:\Program Files\Yahoo!
2008-06-13 15:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-13 15:10 --------- d-----w C:\Documents and Settings\ali\Application Data\Malwarebytes
2008-06-12 22:46 --------- d-----w C:\Documents and Settings\ali\Application Data\Talkback
2008-06-12 21:58 --------- d-----w C:\Documents and Settings\jana\Application Data\Media Player Classic
2008-06-12 18:09 --------- d-----w C:\Program Files\Yahoo! Games
2008-06-12 11:32 --------- d-----w C:\Program Files\Trend Micro
2008-06-10 16:02 34,296 ----a-w C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-10 16:02 15,864 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-06-09 14:36 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-06-09 14:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-09 09:03 --------- d-----w C:\Program Files\Common Files\xing shared
2008-06-09 09:03 --------- d-----w C:\Program Files\Common Files\Real
2008-06-08 20:13 --------- d-----w C:\Documents and Settings\ali\Application Data\Yahoo!
2008-06-08 19:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-06-07 16:11 --------- d-----w C:\Program Files\Real
2008-06-07 15:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-06-07 14:09 --------- d-----w C:\Program Files\Winamp
2008-06-07 14:08 --------- d-----w C:\Documents and Settings\jana\Application Data\Winamp
2008-06-06 22:58 --------- d-----w C:\Documents and Settings\jana\Application Data\Yahoo!
2008-06-06 22:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-06-06 20:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-06 20:47 --------- d-----w C:\Program Files\Realtek
2008-06-06 20:46 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-06-06 20:46 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-06 20:46 --------- d-----w C:\Documents and Settings\jana\Application Data\InstallShield
2008-06-06 20:45 4,716 ----a-w C:\WINDOWS\gdrv.sys
2008-06-06 20:42 --------- d-----w C:\Program Files\Intel
2008-06-06 20:07 --------- d-----w C:\Program Files\microsoft frontpage
2004-08-08 10:04 16,734 --sh--w C:\WINDOWS\system32\agxyaloe.exe
2004-08-08 09:59 536,072 --sh--w C:\WINDOWS\system32\akjsdkaq.dll
2004-08-08 20:47 16,497 --sh--w C:\WINDOWS\system32\dazfajke.exe
2004-08-08 20:47 1,040 --sh--w C:\WINDOWS\system32\dtzfajke.sys
2004-08-08 10:04 520 --sh--w C:\WINDOWS\system32\igxyaloe.sys
2004-08-08 10:00 16,530 --sh--w C:\WINDOWS\system32\mkjraler.exe
2004-08-08 20:47 534,024 --sh--w C:\WINDOWS\system32\mndshsrv.dll
2004-08-08 09:59 15,467 --sh--w C:\WINDOWS\system32\posqatyu.exe
2004-08-08 20:47 536,072 --sh--w C:\WINDOWS\system32\pqzfajke.dll
2004-08-08 10:00 15,044 --sh--w C:\WINDOWS\system32\tjfyabyt.exe
.
((((((((((((((((((((((((((((( snapshot_Mon 06-23-2008_23.54.04.34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-23 20:51:18 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-26 02:38:14 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2005-10-20 09:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-24\ERDNT.EXE
+ 2008-06-24 08:18:21 2,195,456 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-24\Users\00000001\NTUSER.DAT
+ 2008-06-24 08:18:21 32,768 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-24\Users\00000002\UsrClass.dat
+ 2005-10-20 09:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\24-06-2008\ERDNT.EXE
+ 2008-06-24 08:12:49 2,195,456 ----a-w C:\WINDOWS\erdnt\AutoBackup\24-06-2008\Users\00000001\NTUSER.DAT
+ 2008-06-24 08:12:50 32,768 ----a-w C:\WINDOWS\erdnt\AutoBackup\24-06-2008\Users\00000002\UsrClass.dat
- 2005-05-25 22:44:31 10,752 ----a-w C:\WINDOWS\hh.exe
+ 2002-08-29 12:00:00 10,752 ----a-w C:\WINDOWS\hh.exe
- 2005-04-22 05:20:24 51,712 ----a-w C:\WINDOWS\msagent\agentdpv.dll
+ 2002-08-29 12:00:00 50,688 ----a-w C:\WINDOWS\msagent\agentdpv.dll
- 2006-08-16 12:14:23 95,232 ----a-w C:\WINDOWS\system32\6to4svc.dll
+ 2002-08-29 12:00:00 59,392 ----a-w C:\WINDOWS\system32\6to4svc.dll
+ 2006-07-22 20:49:26 5,376 ----a-w C:\WINDOWS\system32\antiwpa.dll
- 2005-03-02 18:20:03 53,760 ----a-w C:\WINDOWS\system32\authz.dll
+ 2002-08-29 12:00:00 51,200 ----a-w C:\WINDOWS\system32\authz.dll
- 2006-09-04 06:23:53 1,027,072 ----a-w C:\WINDOWS\system32\BROWSEUI.DLL
+ 2005-06-17 21:16:18 1,017,856 ----a-w C:\WINDOWS\system32\browseui.dll
- 2005-07-26 04:30:34 220,672 ----a-w C:\WINDOWS\system32\catsrv.dll
+ 2002-08-29 12:00:00 215,040 ----a-w C:\WINDOWS\system32\catsrv.dll
- 2005-07-26 04:30:38 581,632 ----a-w C:\WINDOWS\system32\catsrvut.dll
+ 2002-08-29 12:00:00 582,656 ----a-w C:\WINDOWS\system32\catsrvut.dll
- 2004-12-07 15:43:02 143,360 ----a-w C:\WINDOWS\system32\CDFVIEW.DLL
+ 2002-08-29 12:00:00 142,336 ----a-w C:\WINDOWS\system32\cdfview.dll
- 2005-07-26 04:30:38 110,080 ----a-w C:\WINDOWS\system32\clbcatex.dll
+ 2002-08-29 12:00:00 100,864 ----a-w C:\WINDOWS\system32\clbcatex.dll
- 2005-07-26 04:30:41 497,152 ----a-w C:\WINDOWS\system32\clbcatq.dll
+ 2002-08-29 12:00:00 468,480 ----a-w C:\WINDOWS\system32\clbcatq.dll
- 2005-07-26 04:30:41 62,464 ----a-w C:\WINDOWS\system32\colbact.dll
+ 2002-08-29 12:00:00 56,832 ----a-w C:\WINDOWS\system32\colbact.dll
- 2005-07-26 04:30:42 187,392 ----a-w C:\WINDOWS\system32\Com\comadmin.dll
+ 2002-08-29 12:00:00 186,880 ----a-w C:\WINDOWS\system32\Com\comadmin.dll
- 2006-08-25 15:53:55 561,664 ----a-w C:\WINDOWS\system32\comctl32.dll
+ 2002-08-29 12:00:00 557,056 ----a-w C:\WINDOWS\system32\comctl32.dll
- 2005-07-26 04:30:42 89,600 ----a-w C:\WINDOWS\system32\comrepl.dll
+ 2002-08-29 12:00:00 82,432 ----a-w C:\WINDOWS\system32\comrepl.dll
- 2005-07-26 04:30:49 1,179,136 ----a-w C:\WINDOWS\system32\comsvcs.dll
+ 2002-08-29 12:00:00 1,172,992 ----a-w C:\WINDOWS\system32\comsvcs.dll
- 2005-07-26 04:31:11 499,200 ----a-w C:\WINDOWS\system32\comuid.dll
+ 2002-08-29 12:00:00 495,616 ----a-w C:\WINDOWS\system32\comuid.dll
- 2008-06-23 20:51:20 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-06-26 02:38:15 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-06-23 20:51:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-06-26 02:38:15 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-06-23 20:51:20 65,536 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-26 02:38:15 65,536 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2004-10-28 01:29:54 92,160 ----a-w C:\WINDOWS\system32\cscdll.dll
+ 2002-08-29 12:00:00 89,600 ----a-w C:\WINDOWS\system32\cscdll.dll
- 2005-10-20 17:08:44 986,112 ----a-w C:\WINDOWS\system32\DANIM.DLL
+ 2002-08-29 12:00:00 986,112 ----a-w C:\WINDOWS\system32\danim.dll
- 2006-05-19 12:15:32 103,936 ----a-w C:\WINDOWS\system32\dhcpcsvc.dll
+ 2002-08-29 12:00:00 99,840 ----a-w C:\WINDOWS\system32\dhcpcsvc.dll
- 2006-08-16 12:14:23 95,232 -c--a-w C:\WINDOWS\system32\dllcache\6to4svc.dll
+ 2002-08-29 12:00:00 59,392 -c--a-w C:\WINDOWS\system32\dllcache\6to4svc.dll
- 2005-04-22 05:20:24 51,712 -c--a-w C:\WINDOWS\system32\dllcache\agentdpv.dll
+ 2002-08-29 12:00:00 50,688 -c--a-w C:\WINDOWS\system32\dllcache\agentdpv.dll
- 2005-03-02 18:20:03 53,760 -c--a-w C:\WINDOWS\system32\dllcache\authz.dll
+ 2002-08-29 12:00:00 51,200 ----a-w C:\WINDOWS\system32\dllcache\authz.dll
- 2006-09-04 06:23:53 1,027,072 -c--a-w C:\WINDOWS\system32\dllcache\browseui.dll
+ 2005-06-17 21:16:18 1,017,856 ----a-w C:\WINDOWS\system32\dllcache\browseui.dll
- 2005-07-26 04:30:34 220,672 -c--a-w C:\WINDOWS\system32\dllcache\catsrv.dll
+ 2002-08-29 12:00:00 215,040 ----a-w C:\WINDOWS\system32\dllcache\catsrv.dll
- 2005-07-26 04:30:38 581,632 -c--a-w C:\WINDOWS\system32\dllcache\catsrvut.dll
+ 2002-08-29 12:00:00 582,656 ----a-w C:\WINDOWS\system32\dllcache\catsrvut.dll
- 2004-12-07 15:43:02 143,360 -c--a-w C:\WINDOWS\system32\dllcache\CDFVIEW.DLL
+ 2002-08-29 12:00:00 142,336 ----a-w C:\WINDOWS\system32\dllcache\cdfview.dll
- 2005-07-26 04:30:38 110,080 -c--a-w C:\WINDOWS\system32\dllcache\clbcatex.dll
+ 2002-08-29 12:00:00 100,864 ----a-w C:\WINDOWS\system32\dllcache\clbcatex.dll
- 2005-07-26 04:30:41 497,152 -c--a-w C:\WINDOWS\system32\dllcache\clbcatq.dll
+ 2002-08-29 12:00:00 468,480 ----a-w C:\WINDOWS\system32\dllcache\clbcatq.dll
- 2005-07-26 04:30:41 62,464 -c--a-w C:\WINDOWS\system32\dllcache\colbact.dll
+ 2002-08-29 12:00:00 56,832 ----a-w C:\WINDOWS\system32\dllcache\colbact.dll
- 2005-07-26 04:30:42 187,392 -c--a-w C:\WINDOWS\system32\dllcache\comadmin.dll
+ 2002-08-29 12:00:00 186,880 ----a-w C:\WINDOWS\system32\dllcache\comadmin.dll
- 2006-08-25 15:53:55 561,664 -c--a-w C:\WINDOWS\system32\dllcache\comctl32.dll
+ 2002-08-29 12:00:00 557,056 ----a-w C:\WINDOWS\system32\dllcache\comctl32.dll
- 2005-07-26 04:30:42 89,600 -c--a-w C:\WINDOWS\system32\dllcache\comrepl.dll
+ 2002-08-29 12:00:00 82,432 ----a-w C:\WINDOWS\system32\dllcache\comrepl.dll
- 2005-07-26 04:30:49 1,179,136 -c--a-w C:\WINDOWS\system32\dllcache\comsvcs.dll
+ 2002-08-29 12:00:00 1,172,992 ----a-w C:\WINDOWS\system32\dllcache\comsvcs.dll
- 2005-07-26 04:31:11 499,200 -c--a-w C:\WINDOWS\system32\dllcache\comuid.dll
+ 2002-08-29 12:00:00 495,616 ----a-w C:\WINDOWS\system32\dllcache\comuid.dll
- 2004-10-28 01:29:54 92,160 -c--a-w C:\WINDOWS\system32\dllcache\cscdll.dll
+ 2002-08-29 12:00:00 89,600 -c--a-w C:\WINDOWS\system32\dllcache\cscdll.dll
- 2005-10-20 17:08:44 986,112 -c--a-w C:\WINDOWS\system32\dllcache\DANIM.DLL
+ 2002-08-29 12:00:00 986,112 ----a-w C:\WINDOWS\system32\dllcache\danim.dll
- 2006-05-19 12:15:32 103,936 -c--a-w C:\WINDOWS\system32\dllcache\dhcpcsvc.dll
+ 2002-08-29 12:00:00 99,840 ----a-w C:\WINDOWS\system32\dllcache\dhcpcsvc.dll
- 2006-02-27 10:31:38 75,776 -c--a-w C:\WINDOWS\system32\dllcache\DIRECTDB.DLL
+ 2002-08-29 12:00:00 76,288 ----a-w C:\WINDOWS\system32\dllcache\directdb.dll
- 2006-06-26 17:47:50 140,288 -c--a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
+ 2002-08-29 12:00:00 139,264 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
- 2002-08-29 12:00:00 115,200 -c--a-w C:\WINDOWS\system32\dllcache\dpcdll.dll
+ 2002-08-29 00:40:50 115,200 -c--a-w C:\WINDOWS\system32\dllcache\dpcdll.dll
- 2006-06-09 11:35:50 351,744 -c--a-w C:\WINDOWS\system32\dllcache\DXTMSFT.DLL
+ 2002-08-29 12:00:00 337,920 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2006-06-09 11:35:30 192,512 -c--a-w C:\WINDOWS\system32\dllcache\DXTRANS.DLL
+ 2002-08-29 12:00:00 194,560 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2005-07-26 04:31:12 227,328 -c--a-w C:\WINDOWS\system32\dllcache\es.dll
+ 2002-08-29 12:00:00 225,280 ----a-w C:\WINDOWS\system32\dllcache\es.dll
- 2005-10-20 22:33:08 991,232 -c--a-w C:\WINDOWS\system32\dllcache\esent.dll
+ 2002-08-29 12:00:00 1,018,368 ----a-w C:\WINDOWS\system32\dllcache\esent.dll
- 2004-08-20 22:01:15 82,432 -c--a-w C:\WINDOWS\system32\dllcache\fldrclnr.dll
+ 2002-08-29 12:00:00 82,432 -c--a-w C:\WINDOWS\system32\dllcache\fldrclnr.dll
- 2005-10-17 21:29:53 77,824 -c--a-w C:\WINDOWS\system32\dllcache\fontsub.dll
+ 2002-08-29 12:00:00 79,360 ----a-w C:\WINDOWS\system32\dllcache\fontsub.dll
- 2006-01-02 22:38:03 260,608 -c--a-w C:\WINDOWS\system32\dllcache\gdi32.dll
+ 2002-08-29 12:00:00 250,368 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll
- 2004-08-25 22:07:34 183,808 -c--a-w C:\WINDOWS\system32\dllcache\gptext.dll
+ 2002-08-29 12:00:00 183,296 ----a-w C:\WINDOWS\system32\dllcache\gptext.dll
- 2005-05-25 22:44:31 10,752 -c--a-w C:\WINDOWS\system32\dllcache\hh.exe
+ 2002-08-29 12:00:00 10,752 ----a-w C:\WINDOWS\system32\dllcache\hh.exe
- 2005-05-27 01:59:52 38,912 -c--a-w C:\WINDOWS\system32\dllcache\hhsetup.dll
+ 2002-08-29 12:00:00 37,888 ----a-w C:\WINDOWS\system32\dllcache\hhsetup.dll
- 2006-07-21 08:30:50 72,704 -c--a-w C:\WINDOWS\system32\dllcache\hlink.dll
+ 2002-08-29 12:00:00 77,850 ----a-w C:\WINDOWS\system32\dllcache\hlink.dll
- 2005-06-29 01:54:58 237,056 -c--a-w C:\WINDOWS\system32\dllcache\icm32.dll
+ 2002-08-29 12:00:00 236,032 ----a-w C:\WINDOWS\system32\dllcache\icm32.dll
- 2006-02-24 12:24:42 236,032 -c--a-w C:\WINDOWS\system32\dllcache\IEPEERS.DLL
+ 2002-08-29 12:00:00 231,424 ----a-w C:\WINDOWS\system32\dllcache\iepeers.dll
- 2006-02-27 10:31:54 596,480 -c--a-w C:\WINDOWS\system32\dllcache\INETCOMM.DLL
+ 2002-08-29 12:00:00 587,776 ----a-w C:\WINDOWS\system32\dllcache\inetcomm.dll
- 2006-08-16 12:14:23 31,232 -c--a-w C:\WINDOWS\system32\dllcache\inetmib1.dll
+ 2002-08-29 12:00:00 31,232 -c--a-w C:\WINDOWS\system32\dllcache\inetmib1.dll
- 2006-02-27 10:31:50 47,616 -c--a-w C:\WINDOWS\system32\dllcache\INETRES.DLL
+ 2002-08-29 12:00:00 47,616 ----a-w C:\WINDOWS\system32\dllcache\inetres.dll
- 2004-08-26 07:53:48 69,632 -c--a-w C:\WINDOWS\system32\dllcache\INSENG.DLL
+ 2002-08-29 12:00:00 69,632 ----a-w C:\WINDOWS\system32\dllcache\inseng.dll
- 2006-08-16 12:14:23 83,456 -c--a-w C:\WINDOWS\system32\dllcache\iphlpapi.dll
+ 2002-08-29 12:00:00 82,944 -c--a-w C:\WINDOWS\system32\dllcache\iphlpapi.dll
- 2006-05-13 10:13:31 74,368 -c--a-w C:\WINDOWS\system32\dllcache\ipsec.sys
+ 2002-08-29 12:00:00 57,984 -c--a-w C:\WINDOWS\system32\dllcache\ipsec.sys
- 2006-05-14 09:13:41 334,848 -c--a-w C:\WINDOWS\system32\dllcache\ipsecsnp.dll
+ 2002-08-29 12:00:00 332,800 -c--a-w C:\WINDOWS\system32\dllcache\ipsecsnp.dll
- 2006-05-14 09:13:41 159,744 -c--a-w C:\WINDOWS\system32\dllcache\ipsecsvc.dll
+ 2002-08-29 12:00:00 155,648 -c--a-w C:\WINDOWS\system32\dllcache\ipsecsvc.dll
- 2006-05-14 09:13:41 364,544 -c--a-w C:\WINDOWS\system32\dllcache\ipsmsnap.dll
+ 2002-08-29 12:00:00 364,032 -c--a-w C:\WINDOWS\system32\dllcache\ipsmsnap.dll
- 2006-08-16 09:28:55 48,640 -c--a-w C:\WINDOWS\system32\dllcache\ipv6.exe
+ 2002-08-29 12:00:00 60,928 -c--a-w C:\WINDOWS\system32\dllcache\ipv6.exe
- 2006-08-16 12:14:23 54,272 -c--a-w C:\WINDOWS\system32\dllcache\ipv6mon.dll
+ 2002-08-29 12:00:00 134,144 -c--a-w C:\WINDOWS\system32\dllcache\ipv6mon.dll
- 2005-05-27 01:59:52 143,872 -c--a-w C:\WINDOWS\system32\dllcache\itircl.dll
+ 2002-08-29 12:00:00 143,872 ----a-w C:\WINDOWS\system32\dllcache\itircl.dll
- 2005-05-27 01:59:52 128,000 -c--a-w C:\WINDOWS\system32\dllcache\itss.dll
+ 2002-08-29 12:00:00 122,368 ----a-w C:\WINDOWS\system32\dllcache\itss.dll
- 2006-05-26 19:19:50 163,840 -c--a-w C:\WINDOWS\system32\dllcache\JGDW400.DLL
+ 2002-08-29 12:00:00 144,896 ----a-w C:\WINDOWS\system32\dllcache\jgdw400.dll
- 2006-04-06 13:15:48 27,648 -c--a-w C:\WINDOWS\system32\dllcache\JGPL400.DLL
+ 2002-08-29 12:00:00 42,496 ----a-w C:\WINDOWS\system32\dllcache\jgpl400.dll
- 2006-05-18 05:58:56 458,752 -c--a-w C:\WINDOWS\system32\dllcache\jscript.dll
+ 2002-08-29 12:00:00 593,948 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll
- 2006-04-28 07:58:48 12,288 -c--a-w C:\WINDOWS\system32\dllcache\JSPROXY.DLL
+ 2002-08-29 12:00:00 12,288 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2006-07-05 10:46:36 928,768 -c--a-w C:\WINDOWS\system32\dllcache\kernel32.dll
+ 2002-08-29 12:00:00 930,304 ----a-w C:\WINDOWS\system32\dllcache\kernel32.dll
- 2005-09-01 01:49:29 16,384 -c--a-w C:\WINDOWS\system32\dllcache\linkinfo.dll
+ 2002-08-29 12:00:00 15,360 ----a-w C:\WINDOWS\system32\dllcache\linkinfo.dll
- 2004-03-30 01:48:36 36,864 -c--a-w C:\WINDOWS\system32\dllcache\mf3216.dll
+ 2002-08-29 12:00:00 35,328 -c--a-w C:\WINDOWS\system32\dllcache\mf3216.dll
- 2005-07-22 23:03:37 7,680 -c--a-w C:\WINDOWS\system32\dllcache\migregdb.exe
+ 2002-08-29 12:00:00 6,656 ----a-w C:\WINDOWS\system32\dllcache\migregdb.exe
- 2005-03-23 00:55:20 67,456 -c--a-w C:\WINDOWS\system32\dllcache\mqac.sys
+ 2002-08-29 12:00:00 67,200 ----a-w C:\WINDOWS\system32\dllcache\mqac.sys
- 2005-03-23 18:12:48 130,048 -c--a-w C:\WINDOWS\system32\dllcache\mqad.dll
+ 2002-08-29 12:00:00 130,048 ----a-w C:\WINDOWS\system32\dllcache\mqad.dll
- 2005-03-23 18:12:48 44,032 -c--a-w C:\WINDOWS\system32\dllcache\mqdscli.dll
+ 2002-08-29 12:00:00 44,032 ----a-w C:\WINDOWS\system32\dllcache\mqdscli.dll
- 2005-03-23 18:12:48 14,848 -c--a-w C:\WINDOWS\system32\dllcache\mqise.dll
+ 2002-08-29 12:00:00 14,848 ----a-w C:\WINDOWS\system32\dllcache\mqise.dll
- 2005-03-23 18:12:48 608,768 -c--a-w C:\WINDOWS\system32\dllcache\mqqm.dll
+ 2002-08-29 12:00:00 613,888 ----a-w C:\WINDOWS\system32\dllcache\mqqm.dll
- 2005-03-23 18:12:48 165,888 -c--a-w C:\WINDOWS\system32\dllcache\mqrt.dll
+ 2002-08-29 12:00:00 164,864 ----a-w C:\WINDOWS\system32\dllcache\mqrt.dll
- 2005-03-23 18:12:48 88,576 -c--a-w C:\WINDOWS\system32\dllcache\mqsec.dll
+ 2002-08-29 12:00:00 89,088 ----a-w C:\WINDOWS\system32\dllcache\mqsec.dll
- 2005-03-23 18:12:48 44,544 -c--a-w C:\WINDOWS\system32\dllcache\mqupgrd.dll
+ 2002-08-29 12:00:00 44,544 ----a-w C:\WINDOWS\system32\dllcache\mqupgrd.dll
- 2005-03-23 18:12:48 467,456 -c--a-w C:\WINDOWS\system32\dllcache\mqutil.dll
+ 2002-08-29 12:00:00 469,504 ----a-w C:\WINDOWS\system32\dllcache\mqutil.dll
- 2006-03-23 06:05:25 135,168 -c--a-w C:\WINDOWS\system32\dllcache\msadco.dll
+ 2002-08-29 12:00:00 131,072 ----a-w C:\WINDOWS\system32\dllcache\msadco.dll
- 2005-06-29 01:54:58 68,608 -c--a-w C:\WINDOWS\system32\dllcache\mscms.dll
+ 2002-08-29 12:00:00 68,096 ----a-w C:\WINDOWS\system32\dllcache\mscms.dll
- 2006-03-01 19:44:39 368,640 -c--a-w C:\WINDOWS\system32\dllcache\msdtcprx.dll
+ 2002-08-29 12:00:00 359,936 ----a-w C:\WINDOWS\system32\dllcache\msdtcprx.dll
- 2006-03-01 19:44:39 974,336 -c--a-w C:\WINDOWS\system32\dllcache\msdtctm.dll
+ 2002-08-29 12:00:00 869,376 ----a-w C:\WINDOWS\system32\dllcache\msdtctm.dll
- 2006-03-01 19:44:39 150,528 -c--a-w C:\WINDOWS\system32\dllcache\msdtcuiu.dll
+ 2002-08-29 12:00:00 151,040 ----a-w C:\WINDOWS\system32\dllcache\msdtcuiu.dll
- 2006-06-30 07:28:26 2,703,872 -c--a-w C:\WINDOWS\system32\dllcache\MSHTML.DLL
+ 2002-08-29 12:00:00 2,833,920 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2005-05-04 11:45:32 2,890,240 -c--a-w C:\WINDOWS\system32\dllcache\msi.dll
+ 2002-08-29 12:00:00 2,086,400 ----a-w C:\WINDOWS\system32\dllcache\msi.dll
- 2006-02-27 10:29:32 44,032 -c--a-w C:\WINDOWS\system32\dllcache\MSIDENT.DLL
+ 2002-08-29 12:00:00 44,032 ----a-w C:\WINDOWS\system32\dllcache\msident.dll
- 2005-08-05 17:23:27 230,400 -c--a-w C:\WINDOWS\system32\dllcache\msieftp.dll
+ 2002-08-29 12:00:00 229,888 ----a-w C:\WINDOWS\system32\dllcache\msieftp.dll
- 2005-03-21 12:00:22 78,848 -c--a-w C:\WINDOWS\system32\dllcache\msiexec.exe
+ 2002-08-29 12:00:00 64,512 ----a-w C:\WINDOWS\system32\dllcache\msiexec.exe
- 2005-03-21 12:00:22 271,360 -c--a-w C:\WINDOWS\system32\dllcache\msihnd.dll
+ 2002-08-29 12:00:00 305,664 ----a-w C:\WINDOWS\system32\dllcache\msihnd.dll
- 2006-02-27 10:32:04 56,832 -c--a-w C:\WINDOWS\system32\dllcache\MSIMN.EXE
+ 2002-08-29 12:00:00 57,344 ----a-w C:\WINDOWS\system32\dllcache\msimn.exe
- 2005-03-21 12:00:22 884,736 -c--a-w C:\WINDOWS\system32\dllcache\msimsg.dll
+ 2002-08-29 12:00:00 847,872 ----a-w C:\WINDOWS\system32\dllcache\msimsg.dll
- 2005-03-21 12:00:22 15,360 -c--a-w C:\WINDOWS\system32\dllcache\msisip.dll
+ 2002-08-29 12:00:00 39,936 ----a-w C:\WINDOWS\system32\dllcache\msisip.dll
- 2006-02-27 10:32:00 1,176,064 -c--a-w C:\WINDOWS\system32\dllcache\MSOE.DLL
+ 2002-08-29 12:00:00 1,174,016 ----a-w C:\WINDOWS\system32\dllcache\msoe.dll
- 2006-02-27 10:31:40 229,376 -c--a-w C:\WINDOWS\system32\dllcache\MSOEACCT.DLL
+ 2002-08-29 12:00:00 228,864 ----a-w C:\WINDOWS\system32\dllcache\msoeacct.dll
- 2006-02-27 10:32:08 2,479,616 -c--a-w C:\WINDOWS\system32\dllcache\MSOERES.DLL
+ 2002-08-29 12:00:00 2,479,104 ----a-w C:\WINDOWS\system32\dllcache\msoeres.dll
- 2006-02-27 10:31:36 91,136 -c--a-w C:\WINDOWS\system32\dllcache\MSOERT2.DLL
+ 2002-08-29 12:00:00 81,408 ----a-w C:\WINDOWS\system32\dllcache\msoert2.dll
- 2005-02-24 09:54:42 132,096 -c--a-w C:\WINDOWS\system32\dllcache\MSRATING.DLL
+ 2002-08-29 12:00:00 132,096 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll
- 2006-03-03 13:13:30 498,176 -c--a-w C:\WINDOWS\system32\dllcache\MSTIME.DLL
+ 2002-08-29 12:00:00 496,128 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll
- 2006-03-01 19:44:39 64,512 -c--a-w C:\WINDOWS\system32\dllcache\mtxclu.dll
+ 2002-08-29 12:00:00 61,440 ----a-w C:\WINDOWS\system32\dllcache\mtxclu.dll
- 2006-03-01 19:44:39 83,456 -c--a-w C:\WINDOWS\system32\dllcache\mtxoci.dll
+ 2002-08-29 12:00:00 83,968 ----a-w C:\WINDOWS\system32\dllcache\mtxoci.dll
- 2005-08-22 18:36:34 154,624 -c--a-w C:\WINDOWS\system32\dllcache\netman.dll
+ 2002-08-29 12:00:00 154,112 ----a-w C:\WINDOWS\system32\dllcache\netman.dll
n
26-06-2008 | 05:52 AM
باقي التقرير
- 2006-08-16 09:27:50 83,456 -c--a-w C:\WINDOWS\system32\dllcache\netsh.exe
+ 2002-08-29 12:00:00 82,944 -c--a-w C:\WINDOWS\system32\dllcache\netsh.exe
- 2005-08-11 15:21:02 57,856 -c--a-w C:\WINDOWS\system32\dllcache\nwwks.dll
+ 2002-08-29 12:00:00 57,344 ----a-w C:\WINDOWS\system32\dllcache\nwwks.dll
- 2006-05-14 09:13:41 257,536 -c--a-w C:\WINDOWS\system32\dllcache\oakley.dll
+ 2002-08-29 12:00:00 328,704 -c--a-w C:\WINDOWS\system32\dllcache\oakley.dll
- 2006-02-27 10:31:58 93,184 -c--a-w C:\WINDOWS\system32\dllcache\OEIMPORT.DLL
+ 2002-08-29 12:00:00 92,672 ----a-w C:\WINDOWS\system32\dllcache\oeimport.dll
- 2006-02-27 10:32:08 55,808 -c--a-w C:\WINDOWS\system32\dllcache\OEMIG50.EXE
+ 2002-08-29 12:00:00 55,808 ----a-w C:\WINDOWS\system32\dllcache\oemig50.exe
- 2006-02-27 10:32:10 31,744 -c--a-w C:\WINDOWS\system32\dllcache\OEMIGLIB.DLL
+ 2002-08-29 12:00:00 32,256 ----a-w C:\WINDOWS\system32\dllcache\oemiglib.dll
- 2005-07-26 04:31:13 1,190,400 -c--a-w C:\WINDOWS\system32\dllcache\ole32.dll
+ 2002-08-29 12:00:00 1,169,920 -c--a-w C:\WINDOWS\system32\dllcache\ole32.dll
- 2005-07-26 04:31:13 68,608 -c--a-w C:\WINDOWS\system32\dllcache\olecli32.dll
+ 2002-08-29 12:00:00 68,608 ----a-w C:\WINDOWS\system32\dllcache\olecli32.dll
- 2005-07-26 04:31:13 35,328 -c--a-w C:\WINDOWS\system32\dllcache\olecnv32.dll
+ 2002-08-29 12:00:00 34,304 ----a-w C:\WINDOWS\system32\dllcache\olecnv32.dll
- 2002-08-29 12:00:00 27,648 -c--a-w C:\WINDOWS\system32\dllcache\pidgen.dll
+ 2003-03-31 01:00:00 28,160 -c--a-w C:\WINDOWS\system32\dllcache\pidgen.dll
- 2005-04-27 07:53:06 34,816 -c--a-w C:\WINDOWS\system32\dllcache\PNGFILT.DLL
+ 2002-08-29 12:00:00 34,304 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2006-05-14 09:13:41 98,304 -c--a-w C:\WINDOWS\system32\dllcache\polstore.dll
+ 2002-08-29 12:00:00 87,552 -c--a-w C:\WINDOWS\system32\dllcache\polstore.dll
- 2004-07-01 22:08:18 361,984 -c--a-w C:\WINDOWS\system32\dllcache\qmgr.dll
+ 2002-08-29 12:00:00 221,696 ----a-w C:\WINDOWS\system32\dllcache\qmgr.dll
- 2004-07-01 22:08:18 17,408 -c--a-w C:\WINDOWS\system32\dllcache\qmgrprxy.dll
+ 2002-08-29 12:00:00 17,408 ----a-w C:\WINDOWS\system32\dllcache\qmgrprxy.dll
- 2005-08-30 04:02:45 1,158,656 -c--a-w C:\WINDOWS\system32\dllcache\quartz.dll
+ 2002-08-29 12:00:00 1,142,784 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll
- 2006-06-26 17:47:50 6,144 -c--a-w C:\WINDOWS\system32\dllcache\rasadhlp.dll
+ 2002-08-29 12:00:00 6,144 ----a-w C:\WINDOWS\system32\dllcache\rasadhlp.dll
- 2006-06-22 10:59:17 169,984 -c--a-w C:\WINDOWS\system32\dllcache\rasmans.dll
+ 2002-08-29 12:00:00 158,720 -c--a-w C:\WINDOWS\system32\dllcache\rasmans.dll
- 2006-05-05 09:40:31 166,656 -c--a-w C:\WINDOWS\system32\dllcache\rdbss.sys
+ 2002-08-29 12:00:00 163,328 -c--a-w C:\WINDOWS\system32\dllcache\rdbss.sys
- 2006-07-13 08:41:42 199,936 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
+ 2002-08-29 12:00:00 200,064 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys
- 2004-03-06 02:16:11 535,552 -c--a-w C:\WINDOWS\system32\dllcache\rpcrt4.dll
+ 2002-08-29 12:00:00 530,432 -c--a-w C:\WINDOWS\system32\dllcache\rpcrt4.dll
- 2005-07-26 04:31:13 276,992 -c--a-w C:\WINDOWS\system32\dllcache\rpcss.dll
+ 2002-08-29 12:00:00 260,608 -c--a-w C:\WINDOWS\system32\dllcache\rpcss.dll
- 2006-09-04 06:23:53 1,351,680 -c--a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
+ 2006-05-26 12:40:58 1,339,904 ----a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
- 2006-07-13 13:46:56 8,353,280 -c--a-w C:\WINDOWS\system32\dllcache\shell32.dll
+ 2002-08-29 12:00:00 8,336,384 -c--a-w C:\WINDOWS\system32\dllcache\shell32.dll
- 2005-08-31 15:49:30 409,088 -c--a-w C:\WINDOWS\system32\dllcache\SHLWAPI.DLL
+ 2002-08-29 12:00:00 401,920 ----a-w C:\WINDOWS\system32\dllcache\shlwapi.dll
- 2005-06-10 23:55:46 53,248 -c--a-w C:\WINDOWS\system32\dllcache\spoolsv.exe
+ 2002-08-29 12:00:00 51,200 ----a-w C:\WINDOWS\system32\dllcache\spoolsv.exe
- 2005-10-27 19:06:37 226,816 -c--a-w C:\WINDOWS\system32\dllcache\srrstr.dll
+ 2002-08-29 12:00:00 226,304 ----a-w C:\WINDOWS\system32\dllcache\srrstr.dll
- 2004-12-07 19:34:37 79,872 -c--a-w C:\WINDOWS\system32\dllcache\srvsvc.dll
+ 2002-08-29 12:00:00 87,040 ----a-w C:\WINDOWS\system32\dllcache\srvsvc.dll
- 2004-08-20 22:01:15 700,928 -c--a-w C:\WINDOWS\system32\dllcache\sxs.dll
+ 2002-08-29 12:00:00 674,816 -c--a-w C:\WINDOWS\system32\dllcache\sxs.dll
- 2005-10-17 21:29:54 111,616 -c--a-w C:\WINDOWS\system32\dllcache\t2embed.dll
+ 2002-08-29 12:00:00 198,656 ----a-w C:\WINDOWS\system32\dllcache\t2embed.dll
- 2006-04-20 11:38:44 340,480 -c--a-w C:\WINDOWS\system32\dllcache\tcpip.sys
+ 2002-08-29 12:00:00 332,928 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
- 2006-08-16 09:28:57 205,120 -c--a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
+ 2002-08-29 12:00:00 196,288 -c--a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
- 2005-05-11 00:09:48 72,192 -c--a-w C:\WINDOWS\system32\dllcache\telnet.exe
+ 2002-08-29 12:00:00 71,168 ----a-w C:\WINDOWS\system32\dllcache\telnet.exe
- 2005-07-26 04:31:13 97,280 -c--a-w C:\WINDOWS\system32\dllcache\txflog.dll
+ 2002-08-29 12:00:00 90,624 ----a-w C:\WINDOWS\system32\dllcache\txflog.dll
- 2005-08-23 03:51:10 111,104 -c--a-w C:\WINDOWS\system32\dllcache\umpnpmgr.dll
+ 2002-08-29 12:00:00 107,008 ----a-w C:\WINDOWS\system32\dllcache\umpnpmgr.dll
- 2006-08-30 17:42:56 461,824 -c--a-w C:\WINDOWS\system32\dllcache\URLMON.DLL
+ 2002-08-29 12:00:00 455,680 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2005-03-02 18:20:03 561,152 -c--a-w C:\WINDOWS\system32\dllcache\user32.dll
+ 2002-08-29 12:00:00 560,128 ----a-w C:\WINDOWS\system32\dllcache\user32.dll
- 2006-09-18 11:20:10 851,456 -c--a-w C:\WINDOWS\system32\dllcache\VGX.DLL
+ 2002-08-29 12:00:00 802,304 ----a-w C:\WINDOWS\system32\dllcache\vgx.dll
- 2006-02-27 10:31:46 42,496 -c--a-w C:\WINDOWS\system32\dllcache\WAB.EXE
+ 2002-08-29 12:00:00 43,008 ----a-w C:\WINDOWS\system32\dllcache\wab.exe
- 2006-03-16 13:08:34 465,408 -c--a-w C:\WINDOWS\system32\dllcache\WAB32.DLL
+ 2002-08-29 12:00:00 459,776 ----a-w C:\WINDOWS\system32\dllcache\wab32.dll
- 2006-02-27 10:31:48 30,208 -c--a-w C:\WINDOWS\system32\dllcache\WABFIND.DLL
+ 2002-08-29 12:00:00 30,720 ----a-w C:\WINDOWS\system32\dllcache\wabfind.dll
- 2006-02-27 10:31:44 77,824 -c--a-w C:\WINDOWS\system32\dllcache\WABIMP.DLL
+ 2002-08-29 12:00:00 76,800 ----a-w C:\WINDOWS\system32\dllcache\wabimp.dll
- 2006-02-27 10:31:42 27,648 -c--a-w C:\WINDOWS\system32\dllcache\WABMIG.EXE
+ 2002-08-29 12:00:00 27,648 ----a-w C:\WINDOWS\system32\dllcache\wabmig.exe
- 2005-10-04 01:38:18 1,799,552 -c--a-w C:\WINDOWS\system32\dllcache\win32k.sys
+ 2002-08-29 12:00:00 1,813,632 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
- 2005-06-11 02:41:12 102,400 -c--a-w C:\WINDOWS\system32\dllcache\win32spl.dll
+ 2002-08-29 12:00:00 99,328 ----a-w C:\WINDOWS\system32\dllcache\win32spl.dll
- 2004-07-01 22:08:18 331,776 -c--a-w C:\WINDOWS\system32\dllcache\winhttp.dll
+ 2002-08-29 12:00:00 310,272 ----a-w C:\WINDOWS\system32\dllcache\winhttp.dll
- 2006-06-23 08:33:58 575,488 -c--a-w C:\WINDOWS\system32\dllcache\WININET.DLL
+ 2002-08-29 12:00:00 599,040 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
- 2006-05-14 09:13:41 29,184 -c--a-w C:\WINDOWS\system32\dllcache\winipsec.dll
+ 2002-08-29 12:00:00 25,600 -c--a-w C:\WINDOWS\system32\dllcache\winipsec.dll
- 2005-09-01 01:49:31 278,016 -c--a-w C:\WINDOWS\system32\dllcache\winsrv.dll
+ 2002-08-29 12:00:00 276,480 ----a-w C:\WINDOWS\system32\dllcache\winsrv.dll
- 2006-08-16 12:14:23 70,656 -c--a-w C:\WINDOWS\system32\dllcache\ws2_32.dll
+ 2002-08-29 12:00:00 75,264 -c--a-w C:\WINDOWS\system32\dllcache\ws2_32.dll
- 2006-08-16 12:14:23 13,312 -c--a-w C:\WINDOWS\system32\dllcache\wship6.dll
+ 2002-08-29 12:00:00 13,312 -c--a-w C:\WINDOWS\system32\dllcache\wship6.dll
- 2006-03-01 19:44:39 11,776 -c--a-w C:\WINDOWS\system32\dllcache\xolehlp.dll
+ 2002-08-29 12:00:00 9,728 ----a-w C:\WINDOWS\system32\dllcache\xolehlp.dll
- 2006-06-26 17:47:50 140,288 ----a-w C:\WINDOWS\system32\dnsapi.dll
+ 2002-08-29 12:00:00 139,264 ----a-w C:\WINDOWS\system32\dnsapi.dll
- 2002-08-29 12:00:00 115,200 ----a-w C:\WINDOWS\system32\dpcdll.dll
+ 2002-08-29 00:40:50 115,200 ----a-w C:\WINDOWS\system32\dpcdll.dll
- 2006-05-13 10:13:31 74,368 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys
+ 2002-08-29 12:00:00 57,984 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys
- 2005-03-23 00:55:20 67,456 ----a-w C:\WINDOWS\system32\drivers\mqac.sys
+ 2002-08-29 12:00:00 67,200 ----a-w C:\WINDOWS\system32\drivers\mqac.sys
- 2006-05-05 09:31:04 433,152 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
+ 2002-08-29 12:00:00 407,552 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
- 2006-05-05 09:40:31 166,656 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys
+ 2002-08-29 12:00:00 163,328 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys
- 2006-07-13 08:41:42 199,936 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
+ 2002-08-29 12:00:00 200,064 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
- 2006-04-20 11:38:44 340,480 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
+ 2002-08-29 12:00:00 332,928 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
- 2006-08-16 09:28:57 205,120 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
+ 2002-08-29 12:00:00 196,288 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
- 2006-08-16 09:27:12 11,776 ----a-w C:\WINDOWS\system32\drivers\tunmp.sys
+ 2002-08-29 12:00:00 9,856 ----a-w C:\WINDOWS\system32\drivers\tunmp.sys
- 2006-06-09 11:35:50 351,744 ----a-w C:\WINDOWS\system32\DXTMSFT.DLL
+ 2002-08-29 12:00:00 337,920 ----a-w C:\WINDOWS\system32\dxtmsft.dll
- 2006-06-09 11:35:30 192,512 ----a-w C:\WINDOWS\system32\DXTRANS.DLL
+ 2002-08-29 12:00:00 194,560 ----a-w C:\WINDOWS\system32\dxtrans.dll
- 2005-07-26 04:31:12 227,328 ----a-w C:\WINDOWS\system32\es.dll
+ 2002-08-29 12:00:00 225,280 ----a-w C:\WINDOWS\system32\es.dll
- 2005-10-20 22:33:08 991,232 ----a-w C:\WINDOWS\system32\esent.dll
+ 2002-08-29 12:00:00 1,018,368 ----a-w C:\WINDOWS\system32\esent.dll
- 2004-08-20 22:01:15 82,432 ----a-w C:\WINDOWS\system32\fldrclnr.dll
+ 2002-08-29 12:00:00 82,432 ----a-w C:\WINDOWS\system32\fldrclnr.dll
- 2008-06-21 12:14:32 149,992 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-06-24 10:03:18 149,992 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2005-10-17 21:29:53 77,824 ----a-w C:\WINDOWS\system32\fontsub.dll
+ 2002-08-29 12:00:00 79,360 ----a-w C:\WINDOWS\system32\fontsub.dll
- 2006-01-02 22:38:03 260,608 ----a-w C:\WINDOWS\system32\gdi32.dll
+ 2002-08-29 12:00:00 250,368 ----a-w C:\WINDOWS\system32\gdi32.dll
- 2004-08-25 22:07:34 183,808 ----a-w C:\WINDOWS\system32\gptext.dll
+ 2002-08-29 12:00:00 183,296 ----a-w C:\WINDOWS\system32\gptext.dll
+ 2008-06-25 10:03:57 24,576 ----a-w C:\WINDOWS\system32\hellodon.dll
- 2005-05-27 01:59:52 38,912 ----a-w C:\WINDOWS\system32\hhsetup.dll
+ 2002-08-29 12:00:00 37,888 ----a-w C:\WINDOWS\system32\hhsetup.dll
- 2006-07-21 08:30:50 72,704 ----a-w C:\WINDOWS\system32\hlink.dll
+ 2002-08-29 12:00:00 77,850 ----a-w C:\WINDOWS\system32\hlink.dll
- 2004-11-17 17:57:01 493,056 ----a-w C:\WINDOWS\system32\hypertrm.dll
+ 2002-08-29 12:00:00 489,984 ----a-w C:\WINDOWS\system32\hypertrm.dll
- 2005-06-29 01:54:58 237,056 ----a-w C:\WINDOWS\system32\icm32.dll
+ 2002-08-29 12:00:00 236,032 ----a-w C:\WINDOWS\system32\icm32.dll
- 2006-02-24 12:24:42 236,032 ----a-w C:\WINDOWS\system32\IEPEERS.DLL
+ 2002-08-29 12:00:00 231,424 ----a-w C:\WINDOWS\system32\iepeers.dll
- 2006-02-27 10:31:54 596,480 ----a-w C:\WINDOWS\system32\INETCOMM.DLL
+ 2002-08-29 12:00:00 587,776 ----a-w C:\WINDOWS\system32\inetcomm.dll
- 2006-08-16 12:14:23 31,232 ----a-w C:\WINDOWS\system32\inetmib1.dll
+ 2002-08-29 12:00:00 31,232 ----a-w C:\WINDOWS\system32\inetmib1.dll
- 2006-02-27 10:31:50 47,616 ----a-w C:\WINDOWS\system32\INETRES.DLL
+ 2002-08-29 12:00:00 47,616 ----a-w C:\WINDOWS\system32\inetres.dll
- 2004-08-26 07:53:48 69,632 ----a-w C:\WINDOWS\system32\INSENG.DLL
+ 2002-08-29 12:00:00 69,632 ----a-w C:\WINDOWS\system32\inseng.dll
- 2006-08-16 12:14:23 83,456 ----a-w C:\WINDOWS\system32\iphlpapi.dll
+ 2002-08-29 12:00:00 82,944 ----a-w C:\WINDOWS\system32\iphlpapi.dll
- 2006-05-14 09:13:41 334,848 ----a-w C:\WINDOWS\system32\ipsecsnp.dll
+ 2002-08-29 12:00:00 332,800 ----a-w C:\WINDOWS\system32\ipsecsnp.dll
- 2006-05-14 09:13:41 159,744 ----a-w C:\WINDOWS\system32\ipsecsvc.dll
+ 2002-08-29 12:00:00 155,648 ----a-w C:\WINDOWS\system32\ipsecsvc.dll
- 2006-05-14 09:13:41 364,544 ----a-w C:\WINDOWS\system32\ipsmsnap.dll
+ 2002-08-29 12:00:00 364,032 ----a-w C:\WINDOWS\system32\ipsmsnap.dll
- 2006-08-16 09:28:55 48,640 ----a-w C:\WINDOWS\system32\ipv6.exe
+ 2002-08-29 12:00:00 60,928 ----a-w C:\WINDOWS\system32\ipv6.exe
- 2006-08-16 12:14:23 54,272 ----a-w C:\WINDOWS\system32\ipv6mon.dll
+ 2002-08-29 12:00:00 134,144 ----a-w C:\WINDOWS\system32\ipv6mon.dll
- 2005-05-27 01:59:52 143,872 ----a-w C:\WINDOWS\system32\itircl.dll
+ 2002-08-29 12:00:00 143,872 ----a-w C:\WINDOWS\system32\itircl.dll
- 2005-05-27 01:59:52 128,000 ----a-w C:\WINDOWS\system32\itss.dll
+ 2002-08-29 12:00:00 122,368 ----a-w C:\WINDOWS\system32\itss.dll
- 2006-05-26 19:19:50 163,840 ----a-w C:\WINDOWS\system32\JGDW400.DLL
+ 2002-08-29 12:00:00 144,896 ----a-w C:\WINDOWS\system32\jgdw400.dll
- 2006-04-06 13:15:48 27,648 ----a-w C:\WINDOWS\system32\JGPL400.DLL
+ 2002-08-29 12:00:00 42,496 ----a-w C:\WINDOWS\system32\jgpl400.dll
- 2006-05-18 05:58:56 458,752 ----a-w C:\WINDOWS\system32\jscript.dll
+ 2002-08-29 12:00:00 593,948 ----a-w C:\WINDOWS\system32\jscript.dll
- 2006-04-28 07:58:48 12,288 ----a-w C:\WINDOWS\system32\JSPROXY.DLL
+ 2002-08-29 12:00:00 12,288 ----a-w C:\WINDOWS\system32\jsproxy.dll
- 2006-07-05 10:46:36 928,768 ----a-w C:\WINDOWS\system32\kernel32.dll
+ 2002-08-29 12:00:00 930,304 ----a-w C:\WINDOWS\system32\kernel32.dll
- 2005-09-01 01:49:29 16,384 ----a-w C:\WINDOWS\system32\linkinfo.dll
+ 2002-08-29 12:00:00 15,360 ----a-w C:\WINDOWS\system32\linkinfo.dll
- 2004-03-30 01:48:36 36,864 ----a-w C:\WINDOWS\system32\mf3216.dll
+ 2002-08-29 12:00:00 35,328 ----a-w C:\WINDOWS\system32\mf3216.dll
- 2005-03-23 18:12:48 130,048 ----a-w C:\WINDOWS\system32\mqad.dll
+ 2002-08-29 12:00:00 130,048 ----a-w C:\WINDOWS\system32\mqad.dll
- 2005-03-23 18:12:48 44,032 ----a-w C:\WINDOWS\system32\mqdscli.dll
+ 2002-08-29 12:00:00 44,032 ----a-w C:\WINDOWS\system32\mqdscli.dll
- 2005-03-23 18:12:48 14,848 ----a-w C:\WINDOWS\system32\mqise.dll
+ 2002-08-29 12:00:00 14,848 ----a-w C:\WINDOWS\system32\mqise.dll
- 2005-03-23 18:12:48 608,768 ----a-w C:\WINDOWS\system32\mqqm.dll
+ 2002-08-29 12:00:00 613,888 ----a-w C:\WINDOWS\system32\mqqm.dll
- 2005-03-23 18:12:48 165,888 ----a-w C:\WINDOWS\system32\mqrt.dll
+ 2002-08-29 12:00:00 164,864 ----a-w C:\WINDOWS\system32\mqrt.dll
- 2005-03-23 18:12:48 88,576 ----a-w C:\WINDOWS\system32\mqsec.dll
+ 2002-08-29 12:00:00 89,088 ----a-w C:\WINDOWS\system32\mqsec.dll
- 2005-03-23 18:12:48 44,544 ----a-w C:\WINDOWS\system32\mqupgrd.dll
+ 2002-08-29 12:00:00 44,544 ----a-w C:\WINDOWS\system32\mqupgrd.dll
- 2005-03-23 18:12:48 467,456 ----a-w C:\WINDOWS\system32\mqutil.dll
+ 2002-08-29 12:00:00 469,504 ----a-w C:\WINDOWS\system32\mqutil.dll
+ 2008-06-25 14:35:28 24,576 ----a-w C:\WINDOWS\system32\mrsingd.dll
+ 2008-06-25 14:35:28 10,752 ----a-w C:\WINDOWS\system32\mrsingdk.exe
- 2005-06-29 01:54:58 68,608 ----a-w C:\WINDOWS\system32\mscms.dll
+ 2002-08-29 12:00:00 68,096 ----a-w C:\WINDOWS\system32\mscms.dll
- 2006-03-01 19:44:39 368,640 ----a-w C:\WINDOWS\system32\msdtcprx.dll
+ 2002-08-29 12:00:00 359,936 ----a-w C:\WINDOWS\system32\msdtcprx.dll
- 2006-03-01 19:44:39 974,336 ----a-w C:\WINDOWS\system32\msdtctm.dll
+ 2002-08-29 12:00:00 869,376 ----a-w C:\WINDOWS\system32\msdtctm.dll
- 2006-03-01 19:44:39 150,528 ----a-w C:\WINDOWS\system32\msdtcuiu.dll
+ 2002-08-29 12:00:00 151,040 ----a-w C:\WINDOWS\system32\msdtcuiu.dll
- 2006-06-30 07:28:26 2,703,872 ----a-w C:\WINDOWS\system32\MSHTML.DLL
+ 2002-08-29 12:00:00 2,833,920 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2005-05-04 11:45:32 2,890,240 ----a-w C:\WINDOWS\system32\msi.dll
+ 2002-08-29 12:00:00 2,086,400 ----a-w C:\WINDOWS\system32\msi.dll
- 2006-02-27 10:29:32 44,032 ----a-w C:\WINDOWS\system32\MSIDENT.DLL
+ 2002-08-29 12:00:00 44,032 ----a-w C:\WINDOWS\system32\msident.dll
- 2005-08-05 17:23:27 230,400 ----a-w C:\WINDOWS\system32\msieftp.dll
+ 2002-08-29 12:00:00 229,888 ----a-w C:\WINDOWS\system32\msieftp.dll
- 2005-03-21 12:00:22 78,848 ----a-w C:\WINDOWS\system32\msiexec.exe
+ 2002-08-29 12:00:00 64,512 ----a-w C:\WINDOWS\system32\msiexec.exe
- 2005-03-21 12:00:22 271,360 ----a-w C:\WINDOWS\system32\msihnd.dll
+ 2002-08-29 12:00:00 305,664 ----a-w C:\WINDOWS\system32\msihnd.dll
- 2005-03-21 12:00:22 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll
+ 2002-08-29 12:00:00 847,872 ----a-w C:\WINDOWS\system32\msimsg.dll
- 2005-03-21 12:00:22 15,360 ----a-w C:\WINDOWS\system32\msisip.dll
+ 2002-08-29 12:00:00 39,936 ----a-w C:\WINDOWS\system32\msisip.dll
- 2006-02-27 10:31:40 229,376 ----a-w C:\WINDOWS\system32\MSOEACCT.DLL
+ 2002-08-29 12:00:00 228,864 ----a-w C:\WINDOWS\system32\msoeacct.dll
- 2006-02-27 10:31:36 91,136 ----a-w C:\WINDOWS\system32\MSOERT2.DLL
+ 2002-08-29 12:00:00 81,408 ----a-w C:\WINDOWS\system32\msoert2.dll
- 2005-02-24 09:54:42 132,096 ----a-w C:\WINDOWS\system32\MSRATING.DLL
+ 2002-08-29 12:00:00 132,096 ----a-w C:\WINDOWS\system32\msrating.dll
- 2006-03-03 13:13:30 498,176 ----a-w C:\WINDOWS\system32\MSTIME.DLL
+ 2002-08-29 12:00:00 496,128 ----a-w C:\WINDOWS\system32\mstime.dll
- 2006-03-01 19:44:39 64,512 ----a-w C:\WINDOWS\system32\mtxclu.dll
+ 2002-08-29 12:00:00 61,440 ----a-w C:\WINDOWS\system32\mtxclu.dll
- 2006-03-01 19:44:39 83,456 ----a-w C:\WINDOWS\system32\mtxoci.dll
+ 2002-08-29 12:00:00 83,968 ----a-w C:\WINDOWS\system32\mtxoci.dll
- 2005-08-22 18:36:34 154,624 ----a-w C:\WINDOWS\system32\netman.dll
+ 2002-08-29 12:00:00 154,112 ----a-w C:\WINDOWS\system32\netman.dll
- 2006-08-16 09:27:50 83,456 ----a-w C:\WINDOWS\system32\netsh.exe
+ 2002-08-29 12:00:00 82,944 ----a-w C:\WINDOWS\system32\netsh.exe
- 2005-03-02 00:36:42 1,955,840 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
+ 2002-08-29 12:00:00 1,947,904 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
- 2005-03-02 01:33:36 2,040,832 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
+ 2002-08-29 12:00:00 2,042,240 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
- 2005-08-11 15:21:02 57,856 ----a-w C:\WINDOWS\system32\nwwks.dll
+ 2002-08-29 12:00:00 57,344 ----a-w C:\WINDOWS\system32\nwwks.dll
- 2006-05-14 09:13:41 257,536 ----a-w C:\WINDOWS\system32\oakley.dll
+ 2002-08-29 12:00:00 328,704 ----a-w C:\WINDOWS\system32\oakley.dll
- 2005-07-26 04:31:13 1,190,400 ----a-w C:\WINDOWS\system32\ole32.dll
+ 2002-08-29 12:00:00 1,169,920 ----a-w C:\WINDOWS\system32\ole32.dll
- 2005-07-26 04:31:13 68,608 ----a-w C:\WINDOWS\system32\olecli32.dll
+ 2002-08-29 12:00:00 68,608 ----a-w C:\WINDOWS\system32\olecli32.dll
- 2005-07-26 04:31:13 35,328 ----a-w C:\WINDOWS\system32\olecnv32.dll
+ 2002-08-29 12:00:00 34,304 ----a-w C:\WINDOWS\system32\olecnv32.dll
+ 2008-06-25 10:00:38 229,376 ---ha-w C:\WINDOWS\system32\pedadt.dll
- 2002-08-29 12:00:00 27,648 ----a-w C:\WINDOWS\system32\pidgen.dll
+ 2003-03-31 01:00:00 28,160 ----a-w C:\WINDOWS\system32\pidgen.dll
- 2005-04-27 07:53:06 34,816 ----a-w C:\WINDOWS\system32\PNGFILT.DLL
+ 2002-08-29 12:00:00 34,304 ----a-w C:\WINDOWS\system32\pngfilt.dll
- 2006-05-14 09:13:41 98,304 ----a-w C:\WINDOWS\system32\polstore.dll
+ 2002-08-29 12:00:00 87,552 ----a-w C:\WINDOWS\system32\polstore.dll
+ 2008-06-25 10:04:08 28,672 ----a-w C:\WINDOWS\system32\qflxs.dll
- 2004-07-01 22:08:18 361,984 ----a-w C:\WINDOWS\system32\qmgr.dll
+ 2002-08-29 12:00:00 221,696 ----a-w C:\WINDOWS\system32\qmgr.dll
- 2004-07-01 22:08:18 17,408 ----a-w C:\WINDOWS\system32\qmgrprxy.dll
+ 2002-08-29 12:00:00 17,408 ----a-w C:\WINDOWS\system32\qmgrprxy.dll
- 2005-08-30 04:02:45 1,158,656 ----a-w C:\WINDOWS\system32\quartz.dll
+ 2002-08-29 12:00:00 1,142,784 ----a-w C:\WINDOWS\system32\quartz.dll
- 2006-06-26 17:47:50 6,144 ----a-w C:\WINDOWS\system32\rasadhlp.dll
+ 2002-08-29 12:00:00 6,144 ----a-w C:\WINDOWS\system32\rasadhlp.dll
- 2006-06-22 10:59:17 169,984 ----a-w C:\WINDOWS\system32\rasmans.dll
+ 2002-08-29 12:00:00 158,720 ----a-w C:\WINDOWS\system32\rasmans.dll
- 2004-03-06 02:16:11 535,552 ----a-w C:\WINDOWS\system32\rpcrt4.dll
+ 2002-08-29 12:00:00 530,432 ----a-w C:\WINDOWS\system32\rpcrt4.dll
- 2005-07-26 04:31:13 276,992 ----a-w C:\WINDOWS\system32\rpcss.dll
+ 2002-08-29 12:00:00 260,608 ----a-w C:\WINDOWS\system32\rpcss.dll
- 2006-09-04 06:23:53 1,351,680 ----a-w C:\WINDOWS\system32\SHDOCVW.DLL
+ 2006-05-26 12:40:58 1,339,904 ----a-w C:\WINDOWS\system32\shdocvw.dll
- 2006-07-13 13:46:56 8,353,280 ----a-w C:\WINDOWS\system32\shell32.dll
+ 2002-08-29 12:00:00 8,336,384 ----a-w C:\WINDOWS\system32\shell32.dll
- 2005-09-01 01:49:30 409,088 ----a-w C:\WINDOWS\system32\SHLWAPI.DLL
+ 2002-08-29 12:00:00 401,920 ----a-w C:\WINDOWS\system32\shlwapi.dll
- 2005-06-10 23:55:46 53,248 ----a-w C:\WINDOWS\system32\spoolsv.exe
+ 2002-08-29 12:00:00 51,200 ----a-w C:\WINDOWS\system32\spoolsv.exe
- 2005-10-27 19:06:37 226,816 ----a-w C:\WINDOWS\system32\srrstr.dll
+ 2002-08-29 12:00:00 226,304 ----a-w C:\WINDOWS\system32\srrstr.dll
- 2004-12-07 19:34:37 79,872 ----a-w C:\WINDOWS\system32\srvsvc.dll
+ 2002-08-29 12:00:00 87,040 ----a-w C:\WINDOWS\system32\srvsvc.dll
- 2004-08-20 22:01:15 700,928 ----a-w C:\WINDOWS\system32\sxs.dll
+ 2002-08-29 12:00:00 674,816 ----a-w C:\WINDOWS\system32\sxs.dll
- 2005-10-17 21:29:54 111,616 ----a-w C:\WINDOWS\system32\t2embed.dll
+ 2002-08-29 12:00:00 198,656 ----a-w C:\WINDOWS\system32\t2embed.dll
- 2005-05-11 00:09:48 72,192 ----a-w C:\WINDOWS\system32\telnet.exe
+ 2002-08-29 12:00:00 71,168 ----a-w C:\WINDOWS\system32\telnet.exe
- 2005-07-26 04:31:13 97,280 ----a-w C:\WINDOWS\system32\txflog.dll
+ 2002-08-29 12:00:00 90,624 ----a-w C:\WINDOWS\system32\txflog.dll
- 2005-08-23 03:51:10 111,104 ----a-w C:\WINDOWS\system32\umpnpmgr.dll
+ 2002-08-29 12:00:00 107,008 ----a-w C:\WINDOWS\system32\umpnpmgr.dll
- 2006-08-30 17:42:56 461,824 ----a-w C:\WINDOWS\system32\URLMON.DLL
+ 2002-08-29 12:00:00 455,680 ----a-w C:\WINDOWS\system32\urlmon.dll
- 2005-03-02 18:20:03 561,152 ----a-w C:\WINDOWS\system32\user32.dll
+ 2002-08-29 12:00:00 560,128 ----a-w C:\WINDOWS\system32\user32.dll
+ 2008-06-25 20:47:40 28,672 ----a-w C:\WINDOWS\system32\weblso.dll
- 2005-10-04 01:38:18 1,799,552 ----a-w C:\WINDOWS\system32\win32k.sys
+ 2002-08-29 12:00:00 1,813,632 ----a-w C:\WINDOWS\system32\win32k.sys
- 2005-06-11 02:41:12 102,400 ----a-w C:\WINDOWS\system32\win32spl.dll
+ 2002-08-29 12:00:00 99,328 ----a-w C:\WINDOWS\system32\win32spl.dll
- 2004-07-01 22:08:18 331,776 ----a-w C:\WINDOWS\system32\winhttp.dll
+ 2002-08-29 12:00:00 310,272 ----a-w C:\WINDOWS\system32\winhttp.dll
- 2006-06-23 08:33:58 575,488 ----a-w C:\WINDOWS\system32\WININET.DLL
+ 2002-08-29 12:00:00 599,040 ----a-w C:\WINDOWS\system32\wininet.dll
- 2006-05-14 09:13:41 29,184 ----a-w C:\WINDOWS\system32\winipsec.dll
+ 2002-08-29 12:00:00 25,600 ----a-w C:\WINDOWS\system32\winipsec.dll
- 2005-09-01 01:49:31 278,016 ----a-w C:\WINDOWS\system32\winsrv.dll
+ 2002-08-29 12:00:00 276,480 ----a-w C:\WINDOWS\system32\winsrv.dll
+ 2008-06-25 20:47:59 24,576 ----a-w C:\WINDOWS\system32\womsoy.dll
- 2006-08-16 12:14:23 70,656 ----a-w C:\WINDOWS\system32\ws2_32.dll
+ 2002-08-29 12:00:00 75,264 ----a-w C:\WINDOWS\system32\ws2_32.dll
- 2006-08-16 12:14:23 13,312 ----a-w C:\WINDOWS\system32\wship6.dll
+ 2002-08-29 12:00:00 13,312 ----a-w C:\WINDOWS\system32\wship6.dll
- 2006-03-01 19:44:39 11,776 ----a-w C:\WINDOWS\system32\xolehlp.dll
+ 2002-08-29 12:00:00 9,728 ----a-w C:\WINDOWS\system32\xolehlp.dll
- 2006-08-16 09:42:14 159,232 ----a-w C:\WINDOWS\system32\xpob2res.dll
+ 2004-06-30 23:59:25 158,720 ----a-w C:\WINDOWS\system32\xpob2res.dll
- 2006-08-25 09:14:17 595,968 ----a-w C:\WINDOWS\system32\xpsp2res.dll
+ 2006-03-22 01:28:49 594,944 ----a-w C:\WINDOWS\system32\xpsp2res.dll
+ 2008-06-25 20:47:20 24,576 ----a-w C:\WINDOWS\system32\yitalle.dll
+ 2008-06-25 20:47:19 10,240 ----a-w C:\WINDOWS\system32\yitallek.exe
- 2008-06-23 19:34:00 218,624 ---ha-w C:\WINDOWS\system32\zgrjdx.dll
+ 2008-06-25 10:00:13 218,624 ---ha-w C:\WINDOWS\system32\zgrjdx.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4A908760-8000-4000-A000-9000322145A4}]
08/08/2004 12:59 PM 536072 ---hs---- C:\WINDOWS\System32\akjsdkaq.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60A345CD-ABCD-EFAB-CDEF-ABCD01020306}]
08/08/2004 11:47 PM 536072 ---hs---- C:\WINDOWS\System32\pqzfajke.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{87FD640A-158F-48AC-FD14-1597F14A9778}]
08/08/2004 11:47 PM 534024 ---hs---- C:\WINDOWS\System32\mndshsrv.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [08/30/2007 05:43 PM 4670704]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{4A908760-8000-4000-A000-9000322145A4}"= C:\WINDOWS\System32\akjsdkaq.dll [08/08/2004 12:59 PM 536072]
"{45AADFAA-DD36-42AB-83AD-0521BBF58C24}"= C:\WINDOWS\System32\zgrjdx.dll [06/25/2008 01:00 PM 218624]
"{60A345CD-ABCD-EFAB-CDEF-ABCD01020306}"= C:\WINDOWS\System32\pqzfajke.dll [08/08/2004 11:47 PM 536072]
"{5E907A48-400E-4EA8-9792-FFAE052D59E9}"= C:\WINDOWS\System32\pedadt.dll [06/25/2008 01:00 PM 229376]
"{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38}"= C:\WINDOWS\System32\wyrsdj.dll [ ]
"{A9895933-6636-4281-BC58-EE6DE2AF96E3}"= C:\WINDOWS\System32\ddserh.dll [ ]
"{87FD640A-158F-48AC-FD14-1597F14A9778}"= C:\WINDOWS\System32\mndshsrv.dll [08/08/2004 11:47 PM 534024]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
antiwpa.dll 07/22/2006 11:49 PM 5376 C:\WINDOWS\system32\antiwpa.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys [07/18/2007 02:22 PM]
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [08/09/2007 01:04 PM]
R2 NwSapAgent;SAP Agent;C:\WINDOWS\System32\svchost.exe [08/29/2002 03:00 PM]
S3 eth8023;eth8023;C:\WINDOWS\System32\drivers\eth8023.sys []
S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [06/06/2008 11:45 PM]
S3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\System32\DRIVERS\loop.sys [08/17/2001 01:53 PM]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://go.3roos.com/XP68JmxSgb7
Rootkit scan 2008-06-26 05:41:56
Windows 5.1.2600 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\WgaTray.exe
.
**************************************************************************
.
Completion time: 06/26/2008 5:44:08 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-26 02:44:06
ComboFix2.txt 2008-06-24 09:05:09
ComboFix3.txt 2008-06-24 08:20:49
ComboFix4.txt 2008-06-23 20:54:16
ComboFix5.txt 2008-06-20 18:59:09
Pre-Run: 9,233,084,416 bytes free
Post-Run: 9,244,033,024 bytes free
810 --- E O F --- 2008-06-16 16:58:27
- 2006-08-16 09:27:50 83,456 -c--a-w C:\WINDOWS\system32\dllcache\netsh.exe
+ 2002-08-29 12:00:00 82,944 -c--a-w C:\WINDOWS\system32\dllcache\netsh.exe
- 2005-08-11 15:21:02 57,856 -c--a-w C:\WINDOWS\system32\dllcache\nwwks.dll
+ 2002-08-29 12:00:00 57,344 ----a-w C:\WINDOWS\system32\dllcache\nwwks.dll
- 2006-05-14 09:13:41 257,536 -c--a-w C:\WINDOWS\system32\dllcache\oakley.dll
+ 2002-08-29 12:00:00 328,704 -c--a-w C:\WINDOWS\system32\dllcache\oakley.dll
- 2006-02-27 10:31:58 93,184 -c--a-w C:\WINDOWS\system32\dllcache\OEIMPORT.DLL
+ 2002-08-29 12:00:00 92,672 ----a-w C:\WINDOWS\system32\dllcache\oeimport.dll
- 2006-02-27 10:32:08 55,808 -c--a-w C:\WINDOWS\system32\dllcache\OEMIG50.EXE
+ 2002-08-29 12:00:00 55,808 ----a-w C:\WINDOWS\system32\dllcache\oemig50.exe
- 2006-02-27 10:32:10 31,744 -c--a-w C:\WINDOWS\system32\dllcache\OEMIGLIB.DLL
+ 2002-08-29 12:00:00 32,256 ----a-w C:\WINDOWS\system32\dllcache\oemiglib.dll
- 2005-07-26 04:31:13 1,190,400 -c--a-w C:\WINDOWS\system32\dllcache\ole32.dll
+ 2002-08-29 12:00:00 1,169,920 -c--a-w C:\WINDOWS\system32\dllcache\ole32.dll
- 2005-07-26 04:31:13 68,608 -c--a-w C:\WINDOWS\system32\dllcache\olecli32.dll
+ 2002-08-29 12:00:00 68,608 ----a-w C:\WINDOWS\system32\dllcache\olecli32.dll
- 2005-07-26 04:31:13 35,328 -c--a-w C:\WINDOWS\system32\dllcache\olecnv32.dll
+ 2002-08-29 12:00:00 34,304 ----a-w C:\WINDOWS\system32\dllcache\olecnv32.dll
- 2002-08-29 12:00:00 27,648 -c--a-w C:\WINDOWS\system32\dllcache\pidgen.dll
+ 2003-03-31 01:00:00 28,160 -c--a-w C:\WINDOWS\system32\dllcache\pidgen.dll
- 2005-04-27 07:53:06 34,816 -c--a-w C:\WINDOWS\system32\dllcache\PNGFILT.DLL
+ 2002-08-29 12:00:00 34,304 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2006-05-14 09:13:41 98,304 -c--a-w C:\WINDOWS\system32\dllcache\polstore.dll
+ 2002-08-29 12:00:00 87,552 -c--a-w C:\WINDOWS\system32\dllcache\polstore.dll
- 2004-07-01 22:08:18 361,984 -c--a-w C:\WINDOWS\system32\dllcache\qmgr.dll
+ 2002-08-29 12:00:00 221,696 ----a-w C:\WINDOWS\system32\dllcache\qmgr.dll
- 2004-07-01 22:08:18 17,408 -c--a-w C:\WINDOWS\system32\dllcache\qmgrprxy.dll
+ 2002-08-29 12:00:00 17,408 ----a-w C:\WINDOWS\system32\dllcache\qmgrprxy.dll
- 2005-08-30 04:02:45 1,158,656 -c--a-w C:\WINDOWS\system32\dllcache\quartz.dll
+ 2002-08-29 12:00:00 1,142,784 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll
- 2006-06-26 17:47:50 6,144 -c--a-w C:\WINDOWS\system32\dllcache\rasadhlp.dll
+ 2002-08-29 12:00:00 6,144 ----a-w C:\WINDOWS\system32\dllcache\rasadhlp.dll
- 2006-06-22 10:59:17 169,984 -c--a-w C:\WINDOWS\system32\dllcache\rasmans.dll
+ 2002-08-29 12:00:00 158,720 -c--a-w C:\WINDOWS\system32\dllcache\rasmans.dll
- 2006-05-05 09:40:31 166,656 -c--a-w C:\WINDOWS\system32\dllcache\rdbss.sys
+ 2002-08-29 12:00:00 163,328 -c--a-w C:\WINDOWS\system32\dllcache\rdbss.sys
- 2006-07-13 08:41:42 199,936 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
+ 2002-08-29 12:00:00 200,064 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys
- 2004-03-06 02:16:11 535,552 -c--a-w C:\WINDOWS\system32\dllcache\rpcrt4.dll
+ 2002-08-29 12:00:00 530,432 -c--a-w C:\WINDOWS\system32\dllcache\rpcrt4.dll
- 2005-07-26 04:31:13 276,992 -c--a-w C:\WINDOWS\system32\dllcache\rpcss.dll
+ 2002-08-29 12:00:00 260,608 -c--a-w C:\WINDOWS\system32\dllcache\rpcss.dll
- 2006-09-04 06:23:53 1,351,680 -c--a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
+ 2006-05-26 12:40:58 1,339,904 ----a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
- 2006-07-13 13:46:56 8,353,280 -c--a-w C:\WINDOWS\system32\dllcache\shell32.dll
+ 2002-08-29 12:00:00 8,336,384 -c--a-w C:\WINDOWS\system32\dllcache\shell32.dll
- 2005-08-31 15:49:30 409,088 -c--a-w C:\WINDOWS\system32\dllcache\SHLWAPI.DLL
+ 2002-08-29 12:00:00 401,920 ----a-w C:\WINDOWS\system32\dllcache\shlwapi.dll
- 2005-06-10 23:55:46 53,248 -c--a-w C:\WINDOWS\system32\dllcache\spoolsv.exe
+ 2002-08-29 12:00:00 51,200 ----a-w C:\WINDOWS\system32\dllcache\spoolsv.exe
- 2005-10-27 19:06:37 226,816 -c--a-w C:\WINDOWS\system32\dllcache\srrstr.dll
+ 2002-08-29 12:00:00 226,304 ----a-w C:\WINDOWS\system32\dllcache\srrstr.dll
- 2004-12-07 19:34:37 79,872 -c--a-w C:\WINDOWS\system32\dllcache\srvsvc.dll
+ 2002-08-29 12:00:00 87,040 ----a-w C:\WINDOWS\system32\dllcache\srvsvc.dll
- 2004-08-20 22:01:15 700,928 -c--a-w C:\WINDOWS\system32\dllcache\sxs.dll
+ 2002-08-29 12:00:00 674,816 -c--a-w C:\WINDOWS\system32\dllcache\sxs.dll
- 2005-10-17 21:29:54 111,616 -c--a-w C:\WINDOWS\system32\dllcache\t2embed.dll
+ 2002-08-29 12:00:00 198,656 ----a-w C:\WINDOWS\system32\dllcache\t2embed.dll
- 2006-04-20 11:38:44 340,480 -c--a-w C:\WINDOWS\system32\dllcache\tcpip.sys
+ 2002-08-29 12:00:00 332,928 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
- 2006-08-16 09:28:57 205,120 -c--a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
+ 2002-08-29 12:00:00 196,288 -c--a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
- 2005-05-11 00:09:48 72,192 -c--a-w C:\WINDOWS\system32\dllcache\telnet.exe
+ 2002-08-29 12:00:00 71,168 ----a-w C:\WINDOWS\system32\dllcache\telnet.exe
- 2005-07-26 04:31:13 97,280 -c--a-w C:\WINDOWS\system32\dllcache\txflog.dll
+ 2002-08-29 12:00:00 90,624 ----a-w C:\WINDOWS\system32\dllcache\txflog.dll
- 2005-08-23 03:51:10 111,104 -c--a-w C:\WINDOWS\system32\dllcache\umpnpmgr.dll
+ 2002-08-29 12:00:00 107,008 ----a-w C:\WINDOWS\system32\dllcache\umpnpmgr.dll
- 2006-08-30 17:42:56 461,824 -c--a-w C:\WINDOWS\system32\dllcache\URLMON.DLL
+ 2002-08-29 12:00:00 455,680 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2005-03-02 18:20:03 561,152 -c--a-w C:\WINDOWS\system32\dllcache\user32.dll
+ 2002-08-29 12:00:00 560,128 ----a-w C:\WINDOWS\system32\dllcache\user32.dll
- 2006-09-18 11:20:10 851,456 -c--a-w C:\WINDOWS\system32\dllcache\VGX.DLL
+ 2002-08-29 12:00:00 802,304 ----a-w C:\WINDOWS\system32\dllcache\vgx.dll
- 2006-02-27 10:31:46 42,496 -c--a-w C:\WINDOWS\system32\dllcache\WAB.EXE
+ 2002-08-29 12:00:00 43,008 ----a-w C:\WINDOWS\system32\dllcache\wab.exe
- 2006-03-16 13:08:34 465,408 -c--a-w C:\WINDOWS\system32\dllcache\WAB32.DLL
+ 2002-08-29 12:00:00 459,776 ----a-w C:\WINDOWS\system32\dllcache\wab32.dll
- 2006-02-27 10:31:48 30,208 -c--a-w C:\WINDOWS\system32\dllcache\WABFIND.DLL
+ 2002-08-29 12:00:00 30,720 ----a-w C:\WINDOWS\system32\dllcache\wabfind.dll
- 2006-02-27 10:31:44 77,824 -c--a-w C:\WINDOWS\system32\dllcache\WABIMP.DLL
+ 2002-08-29 12:00:00 76,800 ----a-w C:\WINDOWS\system32\dllcache\wabimp.dll
- 2006-02-27 10:31:42 27,648 -c--a-w C:\WINDOWS\system32\dllcache\WABMIG.EXE
+ 2002-08-29 12:00:00 27,648 ----a-w C:\WINDOWS\system32\dllcache\wabmig.exe
- 2005-10-04 01:38:18 1,799,552 -c--a-w C:\WINDOWS\system32\dllcache\win32k.sys
+ 2002-08-29 12:00:00 1,813,632 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
- 2005-06-11 02:41:12 102,400 -c--a-w C:\WINDOWS\system32\dllcache\win32spl.dll
+ 2002-08-29 12:00:00 99,328 ----a-w C:\WINDOWS\system32\dllcache\win32spl.dll
- 2004-07-01 22:08:18 331,776 -c--a-w C:\WINDOWS\system32\dllcache\winhttp.dll
+ 2002-08-29 12:00:00 310,272 ----a-w C:\WINDOWS\system32\dllcache\winhttp.dll
- 2006-06-23 08:33:58 575,488 -c--a-w C:\WINDOWS\system32\dllcache\WININET.DLL
+ 2002-08-29 12:00:00 599,040 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
- 2006-05-14 09:13:41 29,184 -c--a-w C:\WINDOWS\system32\dllcache\winipsec.dll
+ 2002-08-29 12:00:00 25,600 -c--a-w C:\WINDOWS\system32\dllcache\winipsec.dll
- 2005-09-01 01:49:31 278,016 -c--a-w C:\WINDOWS\system32\dllcache\winsrv.dll
+ 2002-08-29 12:00:00 276,480 ----a-w C:\WINDOWS\system32\dllcache\winsrv.dll
- 2006-08-16 12:14:23 70,656 -c--a-w C:\WINDOWS\system32\dllcache\ws2_32.dll
+ 2002-08-29 12:00:00 75,264 -c--a-w C:\WINDOWS\system32\dllcache\ws2_32.dll
- 2006-08-16 12:14:23 13,312 -c--a-w C:\WINDOWS\system32\dllcache\wship6.dll
+ 2002-08-29 12:00:00 13,312 -c--a-w C:\WINDOWS\system32\dllcache\wship6.dll
- 2006-03-01 19:44:39 11,776 -c--a-w C:\WINDOWS\system32\dllcache\xolehlp.dll
+ 2002-08-29 12:00:00 9,728 ----a-w C:\WINDOWS\system32\dllcache\xolehlp.dll
- 2006-06-26 17:47:50 140,288 ----a-w C:\WINDOWS\system32\dnsapi.dll
+ 2002-08-29 12:00:00 139,264 ----a-w C:\WINDOWS\system32\dnsapi.dll
- 2002-08-29 12:00:00 115,200 ----a-w C:\WINDOWS\system32\dpcdll.dll
+ 2002-08-29 00:40:50 115,200 ----a-w C:\WINDOWS\system32\dpcdll.dll
- 2006-05-13 10:13:31 74,368 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys
+ 2002-08-29 12:00:00 57,984 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys
- 2005-03-23 00:55:20 67,456 ----a-w C:\WINDOWS\system32\drivers\mqac.sys
+ 2002-08-29 12:00:00 67,200 ----a-w C:\WINDOWS\system32\drivers\mqac.sys
- 2006-05-05 09:31:04 433,152 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
+ 2002-08-29 12:00:00 407,552 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
- 2006-05-05 09:40:31 166,656 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys
+ 2002-08-29 12:00:00 163,328 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys
- 2006-07-13 08:41:42 199,936 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
+ 2002-08-29 12:00:00 200,064 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
- 2006-04-20 11:38:44 340,480 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
+ 2002-08-29 12:00:00 332,928 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
- 2006-08-16 09:28:57 205,120 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
+ 2002-08-29 12:00:00 196,288 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
- 2006-08-16 09:27:12 11,776 ----a-w C:\WINDOWS\system32\drivers\tunmp.sys
+ 2002-08-29 12:00:00 9,856 ----a-w C:\WINDOWS\system32\drivers\tunmp.sys
- 2006-06-09 11:35:50 351,744 ----a-w C:\WINDOWS\system32\DXTMSFT.DLL
+ 2002-08-29 12:00:00 337,920 ----a-w C:\WINDOWS\system32\dxtmsft.dll
- 2006-06-09 11:35:30 192,512 ----a-w C:\WINDOWS\system32\DXTRANS.DLL
+ 2002-08-29 12:00:00 194,560 ----a-w C:\WINDOWS\system32\dxtrans.dll
- 2005-07-26 04:31:12 227,328 ----a-w C:\WINDOWS\system32\es.dll
+ 2002-08-29 12:00:00 225,280 ----a-w C:\WINDOWS\system32\es.dll
- 2005-10-20 22:33:08 991,232 ----a-w C:\WINDOWS\system32\esent.dll
+ 2002-08-29 12:00:00 1,018,368 ----a-w C:\WINDOWS\system32\esent.dll
- 2004-08-20 22:01:15 82,432 ----a-w C:\WINDOWS\system32\fldrclnr.dll
+ 2002-08-29 12:00:00 82,432 ----a-w C:\WINDOWS\system32\fldrclnr.dll
- 2008-06-21 12:14:32 149,992 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-06-24 10:03:18 149,992 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2005-10-17 21:29:53 77,824 ----a-w C:\WINDOWS\system32\fontsub.dll
+ 2002-08-29 12:00:00 79,360 ----a-w C:\WINDOWS\system32\fontsub.dll
- 2006-01-02 22:38:03 260,608 ----a-w C:\WINDOWS\system32\gdi32.dll
+ 2002-08-29 12:00:00 250,368 ----a-w C:\WINDOWS\system32\gdi32.dll
- 2004-08-25 22:07:34 183,808 ----a-w C:\WINDOWS\system32\gptext.dll
+ 2002-08-29 12:00:00 183,296 ----a-w C:\WINDOWS\system32\gptext.dll
+ 2008-06-25 10:03:57 24,576 ----a-w C:\WINDOWS\system32\hellodon.dll
- 2005-05-27 01:59:52 38,912 ----a-w C:\WINDOWS\system32\hhsetup.dll
+ 2002-08-29 12:00:00 37,888 ----a-w C:\WINDOWS\system32\hhsetup.dll
- 2006-07-21 08:30:50 72,704 ----a-w C:\WINDOWS\system32\hlink.dll
+ 2002-08-29 12:00:00 77,850 ----a-w C:\WINDOWS\system32\hlink.dll
- 2004-11-17 17:57:01 493,056 ----a-w C:\WINDOWS\system32\hypertrm.dll
+ 2002-08-29 12:00:00 489,984 ----a-w C:\WINDOWS\system32\hypertrm.dll
- 2005-06-29 01:54:58 237,056 ----a-w C:\WINDOWS\system32\icm32.dll
+ 2002-08-29 12:00:00 236,032 ----a-w C:\WINDOWS\system32\icm32.dll
- 2006-02-24 12:24:42 236,032 ----a-w C:\WINDOWS\system32\IEPEERS.DLL
+ 2002-08-29 12:00:00 231,424 ----a-w C:\WINDOWS\system32\iepeers.dll
- 2006-02-27 10:31:54 596,480 ----a-w C:\WINDOWS\system32\INETCOMM.DLL
+ 2002-08-29 12:00:00 587,776 ----a-w C:\WINDOWS\system32\inetcomm.dll
- 2006-08-16 12:14:23 31,232 ----a-w C:\WINDOWS\system32\inetmib1.dll
+ 2002-08-29 12:00:00 31,232 ----a-w C:\WINDOWS\system32\inetmib1.dll
- 2006-02-27 10:31:50 47,616 ----a-w C:\WINDOWS\system32\INETRES.DLL
+ 2002-08-29 12:00:00 47,616 ----a-w C:\WINDOWS\system32\inetres.dll
- 2004-08-26 07:53:48 69,632 ----a-w C:\WINDOWS\system32\INSENG.DLL
+ 2002-08-29 12:00:00 69,632 ----a-w C:\WINDOWS\system32\inseng.dll
- 2006-08-16 12:14:23 83,456 ----a-w C:\WINDOWS\system32\iphlpapi.dll
+ 2002-08-29 12:00:00 82,944 ----a-w C:\WINDOWS\system32\iphlpapi.dll
- 2006-05-14 09:13:41 334,848 ----a-w C:\WINDOWS\system32\ipsecsnp.dll
+ 2002-08-29 12:00:00 332,800 ----a-w C:\WINDOWS\system32\ipsecsnp.dll
- 2006-05-14 09:13:41 159,744 ----a-w C:\WINDOWS\system32\ipsecsvc.dll
+ 2002-08-29 12:00:00 155,648 ----a-w C:\WINDOWS\system32\ipsecsvc.dll
- 2006-05-14 09:13:41 364,544 ----a-w C:\WINDOWS\system32\ipsmsnap.dll
+ 2002-08-29 12:00:00 364,032 ----a-w C:\WINDOWS\system32\ipsmsnap.dll
- 2006-08-16 09:28:55 48,640 ----a-w C:\WINDOWS\system32\ipv6.exe
+ 2002-08-29 12:00:00 60,928 ----a-w C:\WINDOWS\system32\ipv6.exe
- 2006-08-16 12:14:23 54,272 ----a-w C:\WINDOWS\system32\ipv6mon.dll
+ 2002-08-29 12:00:00 134,144 ----a-w C:\WINDOWS\system32\ipv6mon.dll
- 2005-05-27 01:59:52 143,872 ----a-w C:\WINDOWS\system32\itircl.dll
+ 2002-08-29 12:00:00 143,872 ----a-w C:\WINDOWS\system32\itircl.dll
- 2005-05-27 01:59:52 128,000 ----a-w C:\WINDOWS\system32\itss.dll
+ 2002-08-29 12:00:00 122,368 ----a-w C:\WINDOWS\system32\itss.dll
- 2006-05-26 19:19:50 163,840 ----a-w C:\WINDOWS\system32\JGDW400.DLL
+ 2002-08-29 12:00:00 144,896 ----a-w C:\WINDOWS\system32\jgdw400.dll
- 2006-04-06 13:15:48 27,648 ----a-w C:\WINDOWS\system32\JGPL400.DLL
+ 2002-08-29 12:00:00 42,496 ----a-w C:\WINDOWS\system32\jgpl400.dll
- 2006-05-18 05:58:56 458,752 ----a-w C:\WINDOWS\system32\jscript.dll
+ 2002-08-29 12:00:00 593,948 ----a-w C:\WINDOWS\system32\jscript.dll
- 2006-04-28 07:58:48 12,288 ----a-w C:\WINDOWS\system32\JSPROXY.DLL
+ 2002-08-29 12:00:00 12,288 ----a-w C:\WINDOWS\system32\jsproxy.dll
- 2006-07-05 10:46:36 928,768 ----a-w C:\WINDOWS\system32\kernel32.dll
+ 2002-08-29 12:00:00 930,304 ----a-w C:\WINDOWS\system32\kernel32.dll
- 2005-09-01 01:49:29 16,384 ----a-w C:\WINDOWS\system32\linkinfo.dll
+ 2002-08-29 12:00:00 15,360 ----a-w C:\WINDOWS\system32\linkinfo.dll
- 2004-03-30 01:48:36 36,864 ----a-w C:\WINDOWS\system32\mf3216.dll
+ 2002-08-29 12:00:00 35,328 ----a-w C:\WINDOWS\system32\mf3216.dll
- 2005-03-23 18:12:48 130,048 ----a-w C:\WINDOWS\system32\mqad.dll
+ 2002-08-29 12:00:00 130,048 ----a-w C:\WINDOWS\system32\mqad.dll
- 2005-03-23 18:12:48 44,032 ----a-w C:\WINDOWS\system32\mqdscli.dll
+ 2002-08-29 12:00:00 44,032 ----a-w C:\WINDOWS\system32\mqdscli.dll
- 2005-03-23 18:12:48 14,848 ----a-w C:\WINDOWS\system32\mqise.dll
+ 2002-08-29 12:00:00 14,848 ----a-w C:\WINDOWS\system32\mqise.dll
- 2005-03-23 18:12:48 608,768 ----a-w C:\WINDOWS\system32\mqqm.dll
+ 2002-08-29 12:00:00 613,888 ----a-w C:\WINDOWS\system32\mqqm.dll
- 2005-03-23 18:12:48 165,888 ----a-w C:\WINDOWS\system32\mqrt.dll
+ 2002-08-29 12:00:00 164,864 ----a-w C:\WINDOWS\system32\mqrt.dll
- 2005-03-23 18:12:48 88,576 ----a-w C:\WINDOWS\system32\mqsec.dll
+ 2002-08-29 12:00:00 89,088 ----a-w C:\WINDOWS\system32\mqsec.dll
- 2005-03-23 18:12:48 44,544 ----a-w C:\WINDOWS\system32\mqupgrd.dll
+ 2002-08-29 12:00:00 44,544 ----a-w C:\WINDOWS\system32\mqupgrd.dll
- 2005-03-23 18:12:48 467,456 ----a-w C:\WINDOWS\system32\mqutil.dll
+ 2002-08-29 12:00:00 469,504 ----a-w C:\WINDOWS\system32\mqutil.dll
+ 2008-06-25 14:35:28 24,576 ----a-w C:\WINDOWS\system32\mrsingd.dll
+ 2008-06-25 14:35:28 10,752 ----a-w C:\WINDOWS\system32\mrsingdk.exe
- 2005-06-29 01:54:58 68,608 ----a-w C:\WINDOWS\system32\mscms.dll
+ 2002-08-29 12:00:00 68,096 ----a-w C:\WINDOWS\system32\mscms.dll
- 2006-03-01 19:44:39 368,640 ----a-w C:\WINDOWS\system32\msdtcprx.dll
+ 2002-08-29 12:00:00 359,936 ----a-w C:\WINDOWS\system32\msdtcprx.dll
- 2006-03-01 19:44:39 974,336 ----a-w C:\WINDOWS\system32\msdtctm.dll
+ 2002-08-29 12:00:00 869,376 ----a-w C:\WINDOWS\system32\msdtctm.dll
- 2006-03-01 19:44:39 150,528 ----a-w C:\WINDOWS\system32\msdtcuiu.dll
+ 2002-08-29 12:00:00 151,040 ----a-w C:\WINDOWS\system32\msdtcuiu.dll
- 2006-06-30 07:28:26 2,703,872 ----a-w C:\WINDOWS\system32\MSHTML.DLL
+ 2002-08-29 12:00:00 2,833,920 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2005-05-04 11:45:32 2,890,240 ----a-w C:\WINDOWS\system32\msi.dll
+ 2002-08-29 12:00:00 2,086,400 ----a-w C:\WINDOWS\system32\msi.dll
- 2006-02-27 10:29:32 44,032 ----a-w C:\WINDOWS\system32\MSIDENT.DLL
+ 2002-08-29 12:00:00 44,032 ----a-w C:\WINDOWS\system32\msident.dll
- 2005-08-05 17:23:27 230,400 ----a-w C:\WINDOWS\system32\msieftp.dll
+ 2002-08-29 12:00:00 229,888 ----a-w C:\WINDOWS\system32\msieftp.dll
- 2005-03-21 12:00:22 78,848 ----a-w C:\WINDOWS\system32\msiexec.exe
+ 2002-08-29 12:00:00 64,512 ----a-w C:\WINDOWS\system32\msiexec.exe
- 2005-03-21 12:00:22 271,360 ----a-w C:\WINDOWS\system32\msihnd.dll
+ 2002-08-29 12:00:00 305,664 ----a-w C:\WINDOWS\system32\msihnd.dll
- 2005-03-21 12:00:22 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll
+ 2002-08-29 12:00:00 847,872 ----a-w C:\WINDOWS\system32\msimsg.dll
- 2005-03-21 12:00:22 15,360 ----a-w C:\WINDOWS\system32\msisip.dll
+ 2002-08-29 12:00:00 39,936 ----a-w C:\WINDOWS\system32\msisip.dll
- 2006-02-27 10:31:40 229,376 ----a-w C:\WINDOWS\system32\MSOEACCT.DLL
+ 2002-08-29 12:00:00 228,864 ----a-w C:\WINDOWS\system32\msoeacct.dll
- 2006-02-27 10:31:36 91,136 ----a-w C:\WINDOWS\system32\MSOERT2.DLL
+ 2002-08-29 12:00:00 81,408 ----a-w C:\WINDOWS\system32\msoert2.dll
- 2005-02-24 09:54:42 132,096 ----a-w C:\WINDOWS\system32\MSRATING.DLL
+ 2002-08-29 12:00:00 132,096 ----a-w C:\WINDOWS\system32\msrating.dll
- 2006-03-03 13:13:30 498,176 ----a-w C:\WINDOWS\system32\MSTIME.DLL
+ 2002-08-29 12:00:00 496,128 ----a-w C:\WINDOWS\system32\mstime.dll
- 2006-03-01 19:44:39 64,512 ----a-w C:\WINDOWS\system32\mtxclu.dll
+ 2002-08-29 12:00:00 61,440 ----a-w C:\WINDOWS\system32\mtxclu.dll
- 2006-03-01 19:44:39 83,456 ----a-w C:\WINDOWS\system32\mtxoci.dll
+ 2002-08-29 12:00:00 83,968 ----a-w C:\WINDOWS\system32\mtxoci.dll
- 2005-08-22 18:36:34 154,624 ----a-w C:\WINDOWS\system32\netman.dll
+ 2002-08-29 12:00:00 154,112 ----a-w C:\WINDOWS\system32\netman.dll
- 2006-08-16 09:27:50 83,456 ----a-w C:\WINDOWS\system32\netsh.exe
+ 2002-08-29 12:00:00 82,944 ----a-w C:\WINDOWS\system32\netsh.exe
- 2005-03-02 00:36:42 1,955,840 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
+ 2002-08-29 12:00:00 1,947,904 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
- 2005-03-02 01:33:36 2,040,832 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
+ 2002-08-29 12:00:00 2,042,240 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
- 2005-08-11 15:21:02 57,856 ----a-w C:\WINDOWS\system32\nwwks.dll
+ 2002-08-29 12:00:00 57,344 ----a-w C:\WINDOWS\system32\nwwks.dll
- 2006-05-14 09:13:41 257,536 ----a-w C:\WINDOWS\system32\oakley.dll
+ 2002-08-29 12:00:00 328,704 ----a-w C:\WINDOWS\system32\oakley.dll
- 2005-07-26 04:31:13 1,190,400 ----a-w C:\WINDOWS\system32\ole32.dll
+ 2002-08-29 12:00:00 1,169,920 ----a-w C:\WINDOWS\system32\ole32.dll
- 2005-07-26 04:31:13 68,608 ----a-w C:\WINDOWS\system32\olecli32.dll
+ 2002-08-29 12:00:00 68,608 ----a-w C:\WINDOWS\system32\olecli32.dll
- 2005-07-26 04:31:13 35,328 ----a-w C:\WINDOWS\system32\olecnv32.dll
+ 2002-08-29 12:00:00 34,304 ----a-w C:\WINDOWS\system32\olecnv32.dll
+ 2008-06-25 10:00:38 229,376 ---ha-w C:\WINDOWS\system32\pedadt.dll
- 2002-08-29 12:00:00 27,648 ----a-w C:\WINDOWS\system32\pidgen.dll
+ 2003-03-31 01:00:00 28,160 ----a-w C:\WINDOWS\system32\pidgen.dll
- 2005-04-27 07:53:06 34,816 ----a-w C:\WINDOWS\system32\PNGFILT.DLL
+ 2002-08-29 12:00:00 34,304 ----a-w C:\WINDOWS\system32\pngfilt.dll
- 2006-05-14 09:13:41 98,304 ----a-w C:\WINDOWS\system32\polstore.dll
+ 2002-08-29 12:00:00 87,552 ----a-w C:\WINDOWS\system32\polstore.dll
+ 2008-06-25 10:04:08 28,672 ----a-w C:\WINDOWS\system32\qflxs.dll
- 2004-07-01 22:08:18 361,984 ----a-w C:\WINDOWS\system32\qmgr.dll
+ 2002-08-29 12:00:00 221,696 ----a-w C:\WINDOWS\system32\qmgr.dll
- 2004-07-01 22:08:18 17,408 ----a-w C:\WINDOWS\system32\qmgrprxy.dll
+ 2002-08-29 12:00:00 17,408 ----a-w C:\WINDOWS\system32\qmgrprxy.dll
- 2005-08-30 04:02:45 1,158,656 ----a-w C:\WINDOWS\system32\quartz.dll
+ 2002-08-29 12:00:00 1,142,784 ----a-w C:\WINDOWS\system32\quartz.dll
- 2006-06-26 17:47:50 6,144 ----a-w C:\WINDOWS\system32\rasadhlp.dll
+ 2002-08-29 12:00:00 6,144 ----a-w C:\WINDOWS\system32\rasadhlp.dll
- 2006-06-22 10:59:17 169,984 ----a-w C:\WINDOWS\system32\rasmans.dll
+ 2002-08-29 12:00:00 158,720 ----a-w C:\WINDOWS\system32\rasmans.dll
- 2004-03-06 02:16:11 535,552 ----a-w C:\WINDOWS\system32\rpcrt4.dll
+ 2002-08-29 12:00:00 530,432 ----a-w C:\WINDOWS\system32\rpcrt4.dll
- 2005-07-26 04:31:13 276,992 ----a-w C:\WINDOWS\system32\rpcss.dll
+ 2002-08-29 12:00:00 260,608 ----a-w C:\WINDOWS\system32\rpcss.dll
- 2006-09-04 06:23:53 1,351,680 ----a-w C:\WINDOWS\system32\SHDOCVW.DLL
+ 2006-05-26 12:40:58 1,339,904 ----a-w C:\WINDOWS\system32\shdocvw.dll
- 2006-07-13 13:46:56 8,353,280 ----a-w C:\WINDOWS\system32\shell32.dll
+ 2002-08-29 12:00:00 8,336,384 ----a-w C:\WINDOWS\system32\shell32.dll
- 2005-09-01 01:49:30 409,088 ----a-w C:\WINDOWS\system32\SHLWAPI.DLL
+ 2002-08-29 12:00:00 401,920 ----a-w C:\WINDOWS\system32\shlwapi.dll
- 2005-06-10 23:55:46 53,248 ----a-w C:\WINDOWS\system32\spoolsv.exe
+ 2002-08-29 12:00:00 51,200 ----a-w C:\WINDOWS\system32\spoolsv.exe
- 2005-10-27 19:06:37 226,816 ----a-w C:\WINDOWS\system32\srrstr.dll
+ 2002-08-29 12:00:00 226,304 ----a-w C:\WINDOWS\system32\srrstr.dll
- 2004-12-07 19:34:37 79,872 ----a-w C:\WINDOWS\system32\srvsvc.dll
+ 2002-08-29 12:00:00 87,040 ----a-w C:\WINDOWS\system32\srvsvc.dll
- 2004-08-20 22:01:15 700,928 ----a-w C:\WINDOWS\system32\sxs.dll
+ 2002-08-29 12:00:00 674,816 ----a-w C:\WINDOWS\system32\sxs.dll
- 2005-10-17 21:29:54 111,616 ----a-w C:\WINDOWS\system32\t2embed.dll
+ 2002-08-29 12:00:00 198,656 ----a-w C:\WINDOWS\system32\t2embed.dll
- 2005-05-11 00:09:48 72,192 ----a-w C:\WINDOWS\system32\telnet.exe
+ 2002-08-29 12:00:00 71,168 ----a-w C:\WINDOWS\system32\telnet.exe
- 2005-07-26 04:31:13 97,280 ----a-w C:\WINDOWS\system32\txflog.dll
+ 2002-08-29 12:00:00 90,624 ----a-w C:\WINDOWS\system32\txflog.dll
- 2005-08-23 03:51:10 111,104 ----a-w C:\WINDOWS\system32\umpnpmgr.dll
+ 2002-08-29 12:00:00 107,008 ----a-w C:\WINDOWS\system32\umpnpmgr.dll
- 2006-08-30 17:42:56 461,824 ----a-w C:\WINDOWS\system32\URLMON.DLL
+ 2002-08-29 12:00:00 455,680 ----a-w C:\WINDOWS\system32\urlmon.dll
- 2005-03-02 18:20:03 561,152 ----a-w C:\WINDOWS\system32\user32.dll
+ 2002-08-29 12:00:00 560,128 ----a-w C:\WINDOWS\system32\user32.dll
+ 2008-06-25 20:47:40 28,672 ----a-w C:\WINDOWS\system32\weblso.dll
- 2005-10-04 01:38:18 1,799,552 ----a-w C:\WINDOWS\system32\win32k.sys
+ 2002-08-29 12:00:00 1,813,632 ----a-w C:\WINDOWS\system32\win32k.sys
- 2005-06-11 02:41:12 102,400 ----a-w C:\WINDOWS\system32\win32spl.dll
+ 2002-08-29 12:00:00 99,328 ----a-w C:\WINDOWS\system32\win32spl.dll
- 2004-07-01 22:08:18 331,776 ----a-w C:\WINDOWS\system32\winhttp.dll
+ 2002-08-29 12:00:00 310,272 ----a-w C:\WINDOWS\system32\winhttp.dll
- 2006-06-23 08:33:58 575,488 ----a-w C:\WINDOWS\system32\WININET.DLL
+ 2002-08-29 12:00:00 599,040 ----a-w C:\WINDOWS\system32\wininet.dll
- 2006-05-14 09:13:41 29,184 ----a-w C:\WINDOWS\system32\winipsec.dll
+ 2002-08-29 12:00:00 25,600 ----a-w C:\WINDOWS\system32\winipsec.dll
- 2005-09-01 01:49:31 278,016 ----a-w C:\WINDOWS\system32\winsrv.dll
+ 2002-08-29 12:00:00 276,480 ----a-w C:\WINDOWS\system32\winsrv.dll
+ 2008-06-25 20:47:59 24,576 ----a-w C:\WINDOWS\system32\womsoy.dll
- 2006-08-16 12:14:23 70,656 ----a-w C:\WINDOWS\system32\ws2_32.dll
+ 2002-08-29 12:00:00 75,264 ----a-w C:\WINDOWS\system32\ws2_32.dll
- 2006-08-16 12:14:23 13,312 ----a-w C:\WINDOWS\system32\wship6.dll
+ 2002-08-29 12:00:00 13,312 ----a-w C:\WINDOWS\system32\wship6.dll
- 2006-03-01 19:44:39 11,776 ----a-w C:\WINDOWS\system32\xolehlp.dll
+ 2002-08-29 12:00:00 9,728 ----a-w C:\WINDOWS\system32\xolehlp.dll
- 2006-08-16 09:42:14 159,232 ----a-w C:\WINDOWS\system32\xpob2res.dll
+ 2004-06-30 23:59:25 158,720 ----a-w C:\WINDOWS\system32\xpob2res.dll
- 2006-08-25 09:14:17 595,968 ----a-w C:\WINDOWS\system32\xpsp2res.dll
+ 2006-03-22 01:28:49 594,944 ----a-w C:\WINDOWS\system32\xpsp2res.dll
+ 2008-06-25 20:47:20 24,576 ----a-w C:\WINDOWS\system32\yitalle.dll
+ 2008-06-25 20:47:19 10,240 ----a-w C:\WINDOWS\system32\yitallek.exe
- 2008-06-23 19:34:00 218,624 ---ha-w C:\WINDOWS\system32\zgrjdx.dll
+ 2008-06-25 10:00:13 218,624 ---ha-w C:\WINDOWS\system32\zgrjdx.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4A908760-8000-4000-A000-9000322145A4}]
08/08/2004 12:59 PM 536072 ---hs---- C:\WINDOWS\System32\akjsdkaq.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60A345CD-ABCD-EFAB-CDEF-ABCD01020306}]
08/08/2004 11:47 PM 536072 ---hs---- C:\WINDOWS\System32\pqzfajke.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{87FD640A-158F-48AC-FD14-1597F14A9778}]
08/08/2004 11:47 PM 534024 ---hs---- C:\WINDOWS\System32\mndshsrv.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [08/30/2007 05:43 PM 4670704]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{4A908760-8000-4000-A000-9000322145A4}"= C:\WINDOWS\System32\akjsdkaq.dll [08/08/2004 12:59 PM 536072]
"{45AADFAA-DD36-42AB-83AD-0521BBF58C24}"= C:\WINDOWS\System32\zgrjdx.dll [06/25/2008 01:00 PM 218624]
"{60A345CD-ABCD-EFAB-CDEF-ABCD01020306}"= C:\WINDOWS\System32\pqzfajke.dll [08/08/2004 11:47 PM 536072]
"{5E907A48-400E-4EA8-9792-FFAE052D59E9}"= C:\WINDOWS\System32\pedadt.dll [06/25/2008 01:00 PM 229376]
"{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38}"= C:\WINDOWS\System32\wyrsdj.dll [ ]
"{A9895933-6636-4281-BC58-EE6DE2AF96E3}"= C:\WINDOWS\System32\ddserh.dll [ ]
"{87FD640A-158F-48AC-FD14-1597F14A9778}"= C:\WINDOWS\System32\mndshsrv.dll [08/08/2004 11:47 PM 534024]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
antiwpa.dll 07/22/2006 11:49 PM 5376 C:\WINDOWS\system32\antiwpa.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys [07/18/2007 02:22 PM]
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [08/09/2007 01:04 PM]
R2 NwSapAgent;SAP Agent;C:\WINDOWS\System32\svchost.exe [08/29/2002 03:00 PM]
S3 eth8023;eth8023;C:\WINDOWS\System32\drivers\eth8023.sys []
S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [06/06/2008 11:45 PM]
S3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\System32\DRIVERS\loop.sys [08/17/2001 01:53 PM]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://go.3roos.com/XP68JmxSgb7
Rootkit scan 2008-06-26 05:41:56
Windows 5.1.2600 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\WgaTray.exe
.
**************************************************************************
.
Completion time: 06/26/2008 5:44:08 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-26 02:44:06
ComboFix2.txt 2008-06-24 09:05:09
ComboFix3.txt 2008-06-24 08:20:49
ComboFix4.txt 2008-06-23 20:54:16
ComboFix5.txt 2008-06-20 18:59:09
Pre-Run: 9,233,084,416 bytes free
Post-Run: 9,244,033,024 bytes free
810 --- E O F --- 2008-06-16 16:58:27