trojan.win32.autorun.aco

Hi,

The anti virus Kaspersky detects trojan.win32.autorun.aco in my external hard disk but fails to delete it. I suppose the trojan has also infected the computer hard disk, since I always connect my external harddisk to work.
The virus cannot be seen even if the hidden files are shown.

It seems to be quite a serious virus and I don't know how to delete it..
Thanks

Hi,
please read THIS post, and post your HijackThis log file in this topic.

Wait for instructions given only by DragonMaster Jay, Origin or Belahzur

Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• Under the Custom Scan box paste this in
  
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\system32\*.exe /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\System32\config\*.sav
  %SYSTEMDRIVE%\*.*
  %PROGRAMFILES%\*.
  netsvcs
  msconfig
  safebootminimal
  safebootnetwork
  activex
  drivers32
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  nvstor32.sys
  ahcix86s.sys
  nvrd32.sys
  symmpi.sys
  adp3132.sys
  mv61xx.sys
  /md5stop
  CREATERESTOREPOINT
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  
  
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time
    
  
  

The following is the hijack file of the computer without the infected device. I avoid to connect it.. Should I do another hijack scan with it?



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:15:52 PM, on 3/23/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
C:\Program Files\TeamViewer\Version4\TeamViewer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Suvidha\Desktop\ipmsg.exe
D:\Grand Rapport PANI\winlogon.scr

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.in/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Fusion|Ace Enterprises-Internet Explorer
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\CleanVirus.vbs
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [USB Antivirus] C:\Program Files\USB Disk Security\USBGuard.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Suvidha\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Software Informer] "C:\Program Files\Software Informer\softinfo.exe" -autorun
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{C4B483F9-2F7A-4C9A-97DD-4A8AF197B222}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe

--
End of file - 5333 bytes

OTL logfile created on: 3/23/2010 3:25:52 PM - Run 1
OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\Suvidha\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

447.00 Mb Total Physical Memory | 212.00 Mb Available Physical Memory | 47.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19.53 Gb Total Space | 12.02 Gb Free Space | 61.55% Space Free | Partition Type: NTFS
Drive D: | 29.29 Gb Total Space | 22.06 Gb Free Space | 75.29% Space Free | Partition Type: NTFS
Drive E: | 25.69 Gb Total Space | 24.46 Gb Free Space | 95.20% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PANI1
Current User Name: Suvidha
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/03/23 15:23:15 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Suvidha\Desktop\OTL.exe
PRC - [2010/03/04 12:21:46 | 000,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/05/06 15:04:10 | 004,557,608 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version4\TeamViewer.exe
PRC - [2009/05/06 14:41:20 | 000,185,640 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
PRC - [2007/09/10 15:12:44 | 000,069,632 | ---- | M] (Software 2000 Limited) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\HP1006MC.EXE
PRC - [2007/01/17 01:35:41 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/06/21 03:12:44 | 000,577,536 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2005/11/01 01:45:12 | 000,163,840 | R--- | M] (S3 Graphics Co., Ltd.) -- C:\WINDOWS\system32\VTTrayp.exe
PRC - [2005/03/08 01:03:28 | 000,053,248 | R--- | M] (S3 Graphics, Inc.) -- C:\WINDOWS\system32\VTTimer.exe
PRC - [2004/09/08 01:19:06 | 000,159,744 | ---- | M] (H.Shirouzu) -- C:\Documents and Settings\Suvidha\Desktop\ipmsg.exe


========== Modules (SafeList) ==========

MOD - [2010/03/23 15:23:15 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Suvidha\Desktop\OTL.exe
MOD - [2007/01/17 01:37:25 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
MOD - [2007/01/17 01:37:23 | 000,248,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\xpsp3res.dll
MOD - [2004/08/04 05:26:38 | 002,897,920 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\xpsp2res.dll


========== Win32 Services (SafeList) ==========

SRV - [2009/07/03 15:56:14 | 000,303,376 | ---- | M] (Kaspersky Lab) [Auto | Running] -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe -- (AVP)
SRV - [2009/05/06 14:41:20 | 000,185,640 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe -- (TeamViewer4)
SRV - [2005/10/06 18:12:30 | 000,855,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Media Connect 2\wmccds.exe -- (WMConnectCDS)


========== Driver Services (SafeList) ==========

DRV - [2009/12/29 15:50:50 | 000,296,976 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF)
DRV - [2009/06/15 14:01:00 | 000,128,016 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\kl1.sys -- (kl1)
DRV - [2009/05/16 20:59:44 | 000,019,472 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klmouflt.sys -- (klmouflt)
DRV - [2009/05/13 17:46:52 | 000,031,760 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klim5.sys -- (klim5)
DRV - [2008/12/15 20:41:32 | 000,033,808 | ---- | M] (Kaspersky Lab) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\klbg.sys -- (klbg)
DRV - [2006/06/27 15:12:14 | 003,972,672 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.in/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:9.0.0.463


FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/03/13 10:57:16 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/03/04 12:22:00 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt [2009/12/29 15:52:06 | 000,000,000 | ---D | M]

[2009/07/23 13:47:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Suvidha\Application Data\Mozilla\Extensions
[2010/03/22 15:37:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Suvidha\Application Data\Mozilla\Firefox\Profiles\sjj36trr.default\extensions
[2009/10/03 15:52:05 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\Suvidha\Application Data\Mozilla\Firefox\Profiles\sjj36trr.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/03/22 12:50:24 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/12/29 15:52:55 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru

O1 HOSTS File: ([2001/08/23 17:30:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [USB Antivirus] C:\Program Files\USB Disk Security\USBGuard.exe (Zbshareware Lab)
O4 - HKLM..\Run: [VTTimer] C:\WINDOWS\System32\VTTimer.exe (S3 Graphics, Inc.)
O4 - HKLM..\Run: [VTTrayp] C:\WINDOWS\System32\VTTrayp.exe (S3 Graphics Co., Ltd.)
O4 - HKCU..\Run: [fsm] File not found
O4 - HKCU..\Run: [Software Informer] C:\Program Files\Software Informer\softinfo.exe (Informer Technologies, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 159
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\mzvkbd3.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\kloehk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: TaskMan - (C:\Documents and Settings\Suvidha\csrss.exe) - C:\Documents and Settings\Suvidha\csrss.exe (LMOiJlpDF)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/18 05:45:19 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{11a3255f-74f6-11de-966e-93a54eeb7b8f}\Shell\AutoRun\command - "" = G:\storage\sys.exe -- File not found
O33 - MountPoints2\{11a3255f-74f6-11de-966e-93a54eeb7b8f}\Shell\opEN\coMmand - "" = G:\storage\sys.exe -- File not found
O33 - MountPoints2\{1332ec6c-35db-11de-a7f0-0019219df179}\Shell - "" = AutoRun
O33 - MountPoints2\{1332ec6c-35db-11de-a7f0-0019219df179}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1332ec6c-35db-11de-a7f0-0019219df179}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -- File not found
O33 - MountPoints2\{15c511c9-ccea-11de-b679-0019219df179}\Shell\autoplay\cOmManD - "" = halk.exe
O33 - MountPoints2\{15c511c9-ccea-11de-b679-0019219df179}\Shell\AutoRun\command - "" = halk.exe
O33 - MountPoints2\{15c511c9-ccea-11de-b679-0019219df179}\Shell\exploRe\commanD - "" = halk.exe
O33 - MountPoints2\{15c511c9-ccea-11de-b679-0019219df179}\Shell\oPeN\COmmaNd - "" = halk.exe
O33 - MountPoints2\{2193c583-7295-11de-b324-0019219df179}\Shell\Auto\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{2193c583-7295-11de-b324-0019219df179}\Shell\AutoRun\command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{2193c583-7295-11de-b324-0019219df179}\Shell\Explore\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{2193c583-7295-11de-b324-0019219df179}\Shell\Find\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{2193c583-7295-11de-b324-0019219df179}\Shell\Format...\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{2193c583-7295-11de-b324-0019219df179}\Shell\open\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{2bbe5184-0af5-11df-bdbe-0019219df179}\Shell\AutoRun\command - "" = folder.tmpdat/tmpdat.exe
O33 - MountPoints2\{2bbe5184-0af5-11df-bdbe-0019219df179}\Shell\explore\command - "" = folder.tmpdat/tmpdat.exe
O33 - MountPoints2\{2bbe5184-0af5-11df-bdbe-0019219df179}\Shell\open\command - "" = folder.tmpdat/tmpdat.exe
O33 - MountPoints2\{31957ab6-31b9-11de-a7e7-0019219df179}\Shell\Auto\Command - "" = G:\
O33 - MountPoints2\{31957ab6-31b9-11de-a7e7-0019219df179}\Shell\AutoRun\command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{31957ab6-31b9-11de-a7e7-0019219df179}\Shell\Explore\Command - "" = G:\
O33 - MountPoints2\{31957ab6-31b9-11de-a7e7-0019219df179}\Shell\Find\Command - "" = G:\
O33 - MountPoints2\{31957ab6-31b9-11de-a7e7-0019219df179}\Shell\Format...\Command - "" = G:\
O33 - MountPoints2\{31957ab6-31b9-11de-a7e7-0019219df179}\Shell\open\Command - "" = G:\
O33 - MountPoints2\{3d55f1f4-69bf-11de-ba7d-0019219df179}\Shell\AutoRun\command - "" = G:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\RemovableDrive.exe -- File not found
O33 - MountPoints2\{3d55f1f4-69bf-11de-ba7d-0019219df179}\Shell\open\command - "" = G:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\RemovableDrive.exe -- File not found
O33 - MountPoints2\{5ec01464-4e3c-11de-b191-0019219df179}\Shell\Auto\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{5ec01464-4e3c-11de-b191-0019219df179}\Shell\AutoRun\command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{5ec01464-4e3c-11de-b191-0019219df179}\Shell\Explore\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{5ec01464-4e3c-11de-b191-0019219df179}\Shell\Find\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{5ec01464-4e3c-11de-b191-0019219df179}\Shell\Format...\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{5ec01464-4e3c-11de-b191-0019219df179}\Shell\open\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{6cb44409-aa9f-11de-9705-0019219df179}\Shell\AutoRun\command - "" = AppDataDB\AppData.exe
O33 - MountPoints2\{6cb44409-aa9f-11de-9705-0019219df179}\Shell\explore\command - "" = AppDataDB\AppData.exe
O33 - MountPoints2\{6cb44409-aa9f-11de-9705-0019219df179}\Shell\open\command - "" = AppDataDB\AppData.exe
O33 - MountPoints2\{6cb44409-aa9f-11de-9705-0019219df179}\Shell\search\command - "" = AppDataDB\AppData.exe
O33 - MountPoints2\{75e09a0d-2c54-11de-a7de-0019219df179}\Shell\Auto\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09a0d-2c54-11de-a7de-0019219df179}\Shell\AutoRun\command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09a0d-2c54-11de-a7de-0019219df179}\Shell\Explore\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09a0d-2c54-11de-a7de-0019219df179}\Shell\Find\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09a0d-2c54-11de-a7de-0019219df179}\Shell\Format...\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09a0d-2c54-11de-a7de-0019219df179}\Shell\open\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09c43-2c54-11de-a7de-0019219df179}\Shell\Auto\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09c43-2c54-11de-a7de-0019219df179}\Shell\AutoRun\command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09c43-2c54-11de-a7de-0019219df179}\Shell\Explore\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09c43-2c54-11de-a7de-0019219df179}\Shell\Find\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09c43-2c54-11de-a7de-0019219df179}\Shell\Format...\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{75e09c43-2c54-11de-a7de-0019219df179}\Shell\open\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{8765ac1e-3a03-11de-a7f6-0019219df179}\Shell\Auto\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{8765ac1e-3a03-11de-a7f6-0019219df179}\Shell\AutoRun\command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{8765ac1e-3a03-11de-a7f6-0019219df179}\Shell\Explore\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{8765ac1e-3a03-11de-a7f6-0019219df179}\Shell\Find\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{8765ac1e-3a03-11de-a7f6-0019219df179}\Shell\Format...\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{8765ac1e-3a03-11de-a7f6-0019219df179}\Shell\open\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{8fb30607-cdb3-11de-89e6-0019219df179}\Shell\Auto\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{8fb30607-cdb3-11de-89e6-0019219df179}\Shell\AutoRun\command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{8fb30607-cdb3-11de-89e6-0019219df179}\Shell\Explore\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{8fb30607-cdb3-11de-89e6-0019219df179}\Shell\Find\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{8fb30607-cdb3-11de-89e6-0019219df179}\Shell\Format...\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{8fb30607-cdb3-11de-89e6-0019219df179}\Shell\open\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{98da220a-6c63-11de-b5d0-0019219df179}\Shell\Auto\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{98da220a-6c63-11de-b5d0-0019219df179}\Shell\AutoRun\command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{98da220a-6c63-11de-b5d0-0019219df179}\Shell\Explore\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{98da220a-6c63-11de-b5d0-0019219df179}\Shell\Find\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{98da220a-6c63-11de-b5d0-0019219df179}\Shell\Format...\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{98da220a-6c63-11de-b5d0-0019219df179}\Shell\open\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{a1422c24-3a5d-11de-9194-0019219df179}\Shell\Auto\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a1422c24-3a5d-11de-9194-0019219df179}\Shell\AutoRun\command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a1422c24-3a5d-11de-9194-0019219df179}\Shell\Explore\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a1422c24-3a5d-11de-9194-0019219df179}\Shell\Find\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a1422c24-3a5d-11de-9194-0019219df179}\Shell\Format...\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a1422c24-3a5d-11de-9194-0019219df179}\Shell\open\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a780a767-2c1d-11de-a7db-0019219df179}\Shell\Auto\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a780a767-2c1d-11de-a7db-0019219df179}\Shell\AutoRun\command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a780a767-2c1d-11de-a7db-0019219df179}\Shell\Explore\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{a780a767-2c1d-11de-a7db-0019219df179}\Shell\Find\Command - "" = G:\
O33 - MountPoints2\{a780a767-2c1d-11de-a7db-0019219df179}\Shell\Format...\Command - "" = G:\
O33 - MountPoints2\{a780a767-2c1d-11de-a7db-0019219df179}\Shell\open\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{b139d777-3ba9-11de-9196-0019219df179}\Shell\Auto\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{b139d777-3ba9-11de-9196-0019219df179}\Shell\AutoRun\command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{b139d777-3ba9-11de-9196-0019219df179}\Shell\Explore\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{b139d777-3ba9-11de-9196-0019219df179}\Shell\Find\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{b139d777-3ba9-11de-9196-0019219df179}\Shell\Format...\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{b139d777-3ba9-11de-9196-0019219df179}\Shell\open\Command - "" = wscript.exe CleanVirus.vbs
O33 - MountPoints2\{c1aaaa28-b61d-11de-a45b-0019219df179}\Shell\AutoRun\command - "" = ctu8r.exe
O33 - MountPoints2\{c1aaaa28-b61d-11de-a45b-0019219df179}\Shell\open\Command - "" = ctu8r.exe
O33 - MountPoints2\{f9696c83-a43a-11de-b3c3-0019219df179}\Shell\Auto\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{f9696c83-a43a-11de-b3c3-0019219df179}\Shell\AutoRun\command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{f9696c83-a43a-11de-b3c3-0019219df179}\Shell\Explore\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{f9696c83-a43a-11de-b3c3-0019219df179}\Shell\Find\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{f9696c83-a43a-11de-b3c3-0019219df179}\Shell\Format...\Command - "" = wscript.exe FAantivirus.vbs
O33 - MountPoints2\{f9696c83-a43a-11de-b3c3-0019219df179}\Shell\open\Command - "" = wscript.exe FAantivirus.vbs
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2009/04/18 05:44:34 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found


SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4b218e3e-bc98-4770-93d3-2731b9329278} - %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (64461162690904064)

========== Files/Folders - Created Within 30 Days ==========

[2010/03/23 15:22:54 | 000,555,520 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Suvidha\Desktop\OTL.exe
[2010/03/15 15:51:16 | 000,000,000 | ---D | C] -- C:\Program Files\Marvell
[2010/03/15 15:48:16 | 000,147,456 | RHS- | C] (LMOiJlpDF) -- C:\Documents and Settings\Suvidha\csrss.exe
[2010/03/15 13:37:15 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2010/03/15 13:37:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\OPTIONS
[2010/03/15 13:37:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Suvidha\Application Data\InstallShield
[2010/03/11 14:20:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Suvidha\Desktop\New Folder
[2009/09/10 19:58:04 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2009/05/14 22:33:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\TeamViewer
[2009/04/18 05:49:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/04/18 05:49:34 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/04/18 05:49:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/03/23 15:23:15 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Suvidha\Desktop\OTL.exe
[2010/03/23 15:08:18 | 000,218,112 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\Force Field (FF) Analysis.xls
[2010/03/23 15:07:39 | 000,031,232 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\FF.doc
[2010/03/23 14:54:00 | 000,000,986 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-602609370-725345543-1003UA.job
[2010/03/23 12:58:39 | 000,212,480 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\PANI_ Presentation.ppt_AIF.ppt
[2010/03/23 10:54:00 | 000,000,934 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-602609370-725345543-1003Core.job
[2010/03/23 10:16:36 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/03/23 10:16:28 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/03/22 18:57:08 | 005,242,880 | -H-- | M] () -- C:\Documents and Settings\Suvidha\NTUSER.DAT
[2010/03/22 18:56:57 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\Suvidha\ntuser.ini
[2010/03/22 12:05:46 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/03/20 18:48:18 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\New Microsoft Word Document (2).doc
[2010/03/20 14:58:58 | 000,071,680 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\Presentation1.ppt
[2010/03/20 12:36:28 | 000,020,480 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\20march
[2010/03/18 14:59:32 | 000,039,936 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\LWF samminer (1).doc
[2010/03/18 14:29:39 | 000,010,752 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\New Microsoft Word Document.doc
[2010/03/17 14:10:16 | 004,552,450 | ---- | M] () -- C:\Documents and Settings\Suvidha\Desktop\SCDP House hold Survey format.rar
[2010/03/14 15:32:54 | 000,072,192 | ---- | M] () -- C:\Documents and Settings\Suvidha\My Documents\Presentation1.ppt
[2010/03/12 12:53:12 | 000,147,456 | RHS- | M] (LMOiJlpDF) -- C:\Documents and Settings\Suvidha\csrss.exe
[2010/03/12 11:49:15 | 000,036,352 | ---- | M] () -- C:\Documents and Settings\Suvidha\My Documents\Attendens Sheet..doc
[2010/03/08 11:04:11 | 000,022,016 | ---- | M] () -- C:\Documents and Settings\Suvidha\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/04 11:02:54 | 000,000,376 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[2010/02/24 14:09:16 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Suvidha\My Documents\SUMMER TRAINING CERTIFICATE.doc
[2010/02/23 15:24:19 | 000,026,112 | ---- | M] () -- C:\Documents and Settings\Suvidha\My Documents\Loan Details as on 22nd Feb.xls
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/03/23 14:54:02 | 000,031,232 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\FF.doc
[2010/03/23 13:18:45 | 000,218,112 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\Force Field (FF) Analysis.xls
[2010/03/22 17:15:08 | 000,212,480 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\PANI_ Presentation.ppt_AIF.ppt
[2010/03/20 18:27:17 | 000,020,992 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\New Microsoft Word Document (2).doc
[2010/03/20 12:57:38 | 000,071,680 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\Presentation1.ppt
[2010/03/20 12:25:39 | 000,020,480 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\20march
[2010/03/18 14:29:39 | 000,010,752 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\New Microsoft Word Document.doc
[2010/03/17 14:24:54 | 000,039,936 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\LWF samminer (1).doc
[2010/03/17 14:12:32 | 004,552,450 | ---- | C] () -- C:\Documents and Settings\Suvidha\Desktop\SCDP House hold Survey format.rar
[2010/03/14 11:50:50 | 000,072,192 | ---- | C] () -- C:\Documents and Settings\Suvidha\My Documents\Presentation1.ppt
[2010/03/12 11:42:47 | 000,036,352 | ---- | C] () -- C:\Documents and Settings\Suvidha\My Documents\Attendens Sheet..doc
[2010/02/24 14:02:28 | 000,020,992 | ---- | C] () -- C:\Documents and Settings\Suvidha\My Documents\SUMMER TRAINING CERTIFICATE.doc
[2010/02/23 15:24:19 | 000,026,112 | ---- | C] () -- C:\Documents and Settings\Suvidha\My Documents\Loan Details as on 22nd Feb.xls
[2009/11/14 17:03:03 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth2.dll
[2009/11/14 17:03:03 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth1.dll
[2009/11/14 17:03:03 | 000,000,100 | ---- | C] () -- C:\WINDOWS\System32\prsgrc.dll
[2009/11/14 16:47:16 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2009/11/14 16:47:16 | 000,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2009/10/03 15:53:29 | 000,001,024 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\pdfdoc2.dll
[2009/10/03 15:50:26 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfmonnt.dll
[2009/10/03 15:50:23 | 000,000,164 | ---- | C] () -- C:\WINDOWS\System32\psconv.ini
[2009/07/21 17:56:38 | 000,012,288 | ---- | C] () -- C:\WINDOWS\impborl.dll
[2009/07/04 09:13:26 | 000,022,016 | ---- | C] () -- C:\Documents and Settings\Suvidha\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/25 00:10:57 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/04/18 18:16:36 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/04/18 17:53:20 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\HPPLVS.dll
[2009/04/18 17:50:52 | 000,143,360 | R--- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2004/08/04 05:26:44 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== Custom Scans ==========


< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2007/02/17 03:36:48 | 001,386,496 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\msvbvm60.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\*.exe /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2009/04/18 11:02:03 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2009/04/18 11:02:03 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2009/04/18 11:02:03 | 000,892,928 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %SYSTEMDRIVE%\*.* >
[2009/04/18 05:45:19 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009/04/18 05:39:22 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2009/04/18 05:45:19 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2009/04/18 05:45:19 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/04/18 05:45:19 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/04 03:08:34 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2004/08/04 03:29:34 | 000,250,032 | RHS- | M] () -- C:\ntldr
[2010/03/23 10:16:23 | 704,643,072 | -HS- | M] () -- C:\pagefile.sys

< %PROGRAMFILES%\*. >
[2009/04/18 18:58:36 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2009/04/18 19:00:38 | 000,000,000 | ---D | M] -- C:\Program Files\Ahead
[2009/04/18 17:55:13 | 000,000,000 | -H-D | M] -- C:\Program Files\Avago-HP
[2009/11/14 16:47:42 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2009/04/18 05:41:29 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
[2009/04/18 19:01:45 | 000,000,000 | ---D | M] -- C:\Program Files\CyberLink
[2009/05/05 23:50:59 | 000,000,000 | ---D | M] -- C:\Program Files\Free PDF to Word Doc Converter
[2009/09/30 13:30:24 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2010/03/08 15:05:08 | 000,000,000 | ---D | M] -- C:\Program Files\HMIS
[2010/03/15 15:49:28 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2009/10/15 17:18:32 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2009/10/02 08:47:56 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2009/12/29 15:51:19 | 000,000,000 | ---D | M] -- C:\Program Files\Kaspersky Lab
[2009/10/15 17:25:53 | 000,000,000 | ---D | M] -- C:\Program Files\Lipikaar
[2010/03/15 15:51:16 | 000,000,000 | ---D | M] -- C:\Program Files\Marvell
[2009/04/18 05:41:03 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
[2009/04/18 18:14:32 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft ActiveSync
[2009/04/18 05:45:43 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2009/04/18 18:13:48 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2009/04/18 18:14:47 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft.NET
[2009/04/18 05:42:29 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/03/23 12:59:12 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2010/03/14 16:18:53 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
[2009/04/18 05:40:59 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
[2009/04/18 05:42:42 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2009/04/18 05:43:23 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services
[2009/04/18 05:42:38 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
[2009/10/03 15:50:25 | 000,000,000 | ---D | M] -- C:\Program Files\PDF-Convert
[2009/10/03 15:50:19 | 000,000,000 | ---D | M] -- C:\Program Files\psconvert
[2010/03/15 13:56:18 | 000,000,000 | ---D | M] -- C:\Program Files\Realtek
[2009/07/21 17:56:02 | 000,000,000 | ---D | M] -- C:\Program Files\ResumeMaker
[2009/07/25 12:02:22 | 000,000,000 | R--D | M] -- C:\Program Files\Skype
[2009/11/14 13:59:01 | 000,000,000 | ---D | M] -- C:\Program Files\Software Informer
[2009/05/14 04:08:11 | 000,000,000 | ---D | M] -- C:\Program Files\TeamViewer
[2009/04/18 17:48:31 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2009/05/01 04:37:58 | 000,000,000 | ---D | M] -- C:\Program Files\USB Disk Security
[2009/07/21 17:15:41 | 000,000,000 | ---D | M] -- C:\Program Files\VideoLAN
[2009/04/18 05:41:09 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Connect 2
[2009/04/18 05:45:18 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2009/04/18 05:40:52 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2009/04/18 05:43:27 | 000,000,000 | -H-D | M] -- C:\Program Files\WindowsUpdate
[2010/01/26 15:16:40 | 000,000,000 | ---D | M] -- C:\Program Files\WinRAR
[2009/04/18 05:45:43 | 000,000,000 | ---D | M] -- C:\Program Files\xerox


< MD5 for: ATAPI.SYS >
[2004/08/04 03:29:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2004/08/04 05:26:44 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2004/08/04 05:26:44 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2004/08/04 05:26:46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2004/08/04 05:26:46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 05:26:46 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\system32\dllcache\scecli.dll
[2004/08/04 05:26:46 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\system32\scecli.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >

OTL Extras logfile created on: 3/23/2010 3:25:52 PM - Run 1
OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\Suvidha\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

447.00 Mb Total Physical Memory | 212.00 Mb Available Physical Memory | 47.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19.53 Gb Total Space | 12.02 Gb Free Space | 61.55% Space Free | Partition Type: NTFS
Drive D: | 29.29 Gb Total Space | 22.06 Gb Free Space | 75.29% Space Free | Partition Type: NTFS
Drive E: | 25.69 Gb Total Space | 24.46 Gb Free Space | 95.20% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PANI1
Current User Name: Suvidha
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\spool\drivers\w32x86\3\HP1006MC.EXE" = C:\WINDOWS\system32\spool\drivers\w32x86\3\HP1006MC.EXE:*:Enabled:SMLMProxy Module - HP1006MC.EXE -- (Software 2000 Limited)
"C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\English\setup.exe" = C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\English\setup.exe:*:Enabled:Kaspersky Internet Security 7.0 Setup -- (Kaspersky Lab)
"C:\Documents and Settings\Suvidha\Desktop\ipmsg.exe" = C:\Documents and Settings\Suvidha\Desktop\ipmsg.exe:*:Enabled:IPMsg English -- (H.Shirouzu)
"C:\Program Files\SPSSInc\Statistics17\SPSSWinWrapIDE.exe" = C:\Program Files\SPSSInc\Statistics17\SPSSWinWrapIDE.exe:*:Disabled:SPSS Basic script Editor -- File not found
"C:\Program Files\SPSSInc\Statistics17\statistics.exe" = C:\Program Files\SPSSInc\Statistics17\statistics.exe:*:Disabled:Statistics17:exe -- File not found
"C:\Program Files\SPSSInc\Statistics17\statistics.com" = C:\Program Files\SPSSInc\Statistics17\statistics.com:*:Disabled:Statistics17:com -- File not found


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 16
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7CCEBC24-62DB-4280-A8EC-BFA49F167920}" = Software Update for Web Folders
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0
"{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}" = REALTEK GbE & FE Ethernet PCI NIC Driver
"{AE236CDD-6312-4B9B-BD08-A99738D22480}" = Lipikaar
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype 4.1
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"Free PS Convert driver_is1" = Free PS Convert driver 8.15
"HijackThis" = HijackThis 2.0.2
"InstallWIX_{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Mozilla Firefox (3.5.8)" = Mozilla Firefox (3.5.8)
"MSNINST" = MSN
"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition
"Picasa 3" = Picasa 3
"ResumeMaker" = ResumeMaker
"Software Informer_is1" = Software Informer 1.0 BETA
"ST6UNST #1" = HMIS
"TeamViewer 4" = TeamViewer 4
"USB Disk Security_is1" = USB Disk Security 5.0.0.80
"VLC media player" = VLC media player 0.9.8a
"WinRAR archiver" = WinRAR archiver
"Word to PDF Converter_is1" = Word to PDF Converter 3.00

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2/8/2010 10:33:25 AM | Computer Name = PANI-SUVIDHA | Source = Google Update | ID = 20
Description =

Error - 2/10/2010 2:32:16 AM | Computer Name = PANI-SUVIDHA | Source = Google Update | ID = 20
Description =

Error - 2/10/2010 3:35:14 AM | Computer Name = PANI-SUVIDHA | Source = Google Update | ID = 20
Description =

Error - 2/10/2010 4:35:14 AM | Computer Name = PANI-SUVIDHA | Source = Google Update | ID = 20
Description =

Error - 2/10/2010 5:35:14 AM | Computer Name = PANI-SUVIDHA | Source = Google Update | ID = 20
Description =

Error - 2/11/2010 1:35:14 AM | Computer Name = PANI-SUVIDHA | Source = Google Update | ID = 20
Description =

Error - 2/11/2010 2:35:15 AM | Computer Name = PANI-SUVIDHA | Source = Google Update | ID = 20
Description =

Error - 2/11/2010 3:32:15 AM | Computer Name = PANI-SUVIDHA | Source = Google Update | ID = 20
Description =

Error - 2/11/2010 3:39:00 AM | Computer Name = PANI-SUVIDHA | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.1.3642, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 2/11/2010 4:13:41 AM | Computer Name = PANI-SUVIDHA | Source = Application Hang | ID = 1002
Description = Hanging application rundll32.exe, version 5.1.2600.2180, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 3/19/2010 4:15:25 AM | Computer Name = PANI1 | Source = SideBySide | ID = 16842810
Description = Syntax error in manifest or policy file "C:\Program Files\Software
Informer\softinfo.exe" on line 0.

Error - 3/19/2010 4:15:25 AM | Computer Name = PANI1 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\Software Informer\softinfo.exe.
Reference
error message: The operation completed successfully. .

Error - 3/19/2010 4:49:41 AM | Computer Name = PANI1 | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
PRAKASH that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{C4B483F9-2F7A-4C9A-9. The master browser is stopping or an election
is being forced.

Error - 3/19/2010 6:21:42 AM | Computer Name = PANI1 | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
PRAKASH that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{C4B483F9-2F7A-4C9A-9. The master browser is stopping or an election
is being forced.

Error - 3/19/2010 7:46:27 AM | Computer Name = PANI1 | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
PRAKASH that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{C4B483F9-2F7A-4C9A-9. The master browser is stopping or an election
is being forced.

Error - 3/22/2010 7:40:56 AM | Computer Name = PANI1 | Source = SideBySide | ID = 16842810
Description = Syntax error in manifest or policy file "C:\Program Files\Software
Informer\softinfo.exe" on line 0.

Error - 3/22/2010 7:40:56 AM | Computer Name = PANI1 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\Software Informer\softinfo.exe.
Reference
error message: The operation completed successfully. .

Error - 3/23/2010 1:41:25 AM | Computer Name = PANI1 | Source = SideBySide | ID = 16842810
Description = Syntax error in manifest or policy file "C:\Program Files\Software
Informer\softinfo.exe" on line 0.

Error - 3/23/2010 1:41:25 AM | Computer Name = PANI1 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\Software Informer\softinfo.exe.
Reference
error message: The operation completed successfully. .

Error - 3/23/2010 2:57:44 AM | Computer Name = PANI1 | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
PRAKASH that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{C4B483F9-2F7A-4C9A-9. The master browser is stopping or an election
is being forced.


< End of report >

Please download the newest version of Adobe Acrobat Reader from Adobe.com

Before installing: it is important to remove older versions of Acrobat Reader since it does not do so automatically and old versions still leave you vulnerable.
Go to the Control Panel and enter Add or Remove Programs.
Search in the list for all previous installed versions of Adobe Acrobat Reader. Uninstall/Remove each of them.

Once old versions are gone, please install the newest version.

==

Please download the newest version of Java from Java.com.

Before installing: it is important to remove older versions of Java since it does not do so automatically and old versions still leave you vulnerable.
Go to the Control Panel and enter Add or Remove Programs.
Search in the list for all previous installed versions of Java. (J2SE Runtime Environment). Please uninstall/remove each of them.

Once old versions are gone, please install the newest version.

===========

Do you know what these programs are:
Lipikaar
HMIS

===============

Please run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following:
  

  Code:

  :otl
O4 - HKCU..\Run: [fsm] File not found

:files
C:\Documents and Settings\Suvidha\csrss.exe
  
  
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done.

==================

We need to do some diagnostics.

1. Please download Profiles by noahdfear.

• Save it to your desktop.
• Double-click profiles.exe and post its log when you reply

2. Download Win32kDiag by ad13 and save it to your Desktop.

• Double-click Win32kDiag.exe to run Win32kDiag and let it finish.
  
• When it states "Finished! Press any key to exit...", press any key on your keyboard to close the program.
  
• Double-click on the Win32kDiag.txt file that is located on your Desktop and post the entire contents of that log as a reply to this topic.

3. In your next reply, please post the following logs for my review:

• Profiles log (1)
  
• Win32kDiag log (2)

Thanks!

Hi,
Lipikaar is a software for hindi writing.
As for HMIS, I don't know, but this pc is being used by several people, so I may not be aware of it.

I have installed new adobe and Java, but now firefox is not recognized any longer (it was also in a process of renewing but the pc blocked and had to be shut down..(Well, I know this is another thing, my focus remains on the virus elimination)

As for the 'Run fix' OTL, this is the message:

Error: Unable to interpret in the current context!
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\fsm deleted successfully.
========== FILES ==========
File\Folder C:\Documents and Settings\Suvidha\csrss.exe not found.

OTL by OldTimer - Version 3.1.37.3 log created on 03272010_110858


The following is the Profiles log (1):


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
DefaultUserProfile REG_SZ Default User
AllUsersProfile REG_SZ All Users

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
ProfileImagePath REG_EXPAND_SZ %systemroot%\system32\config\systemprofile

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\LocalService

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\NetworkService

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-2052111302-602609370-725345543-1003
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\Suvidha

SystemRoot REG_SZ C:\WINDOWS



And here comes the Win32kDiag log (2) :
(Still, I am doing all the scans without connecting the infected hard disk: should I connect it in order to detect the virus?)

Running from: C:\Documents and Settings\Suvidha\My Documents\Downloads\Win32kDiag.exe

Log file at : C:\Documents and Settings\Suvidha\Desktop\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...





Finished!



...
Thank you..

Yes. We will need to disinfect everything here.

Please visit this webpage for a tutorial on downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

See the area: Using ComboFix, and when done, post the log back here.

Hi,
Sorry for the delay;
Combofix has just finished, I have run it with my infected devices connected to the computer.
After its completion, I scanned again the devices and Kaspersky detected new malwares!

One is HEUR:Trojan.Win32.Generic, which can not be deleted, and the second one in worm.win32.AutoIt.bg, which has been supposedly put into quarantine.

Another problem is that even if I finally manage to desinfect this computer, other devices which may have been infected earlier will infect it again: shall I, then, run Combofix also on the 2nd computer of the office with the remaining infected pen drives?

Thank you..

Here is the log:


ComboFix 10-03-29.04 - Suvidha 04/03/2010 14:08:15.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.447.240 [GMT 5.5:30]
Running from: c:\documents and settings\Suvidha\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((( Files Created from 2010-03-03 to 2010-04-03 )))))))))))))))))))))))))))))))
.

2010-03-27 08:02 . 2010-03-27 08:02 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee
2010-03-24 09:26 . 2010-03-24 09:26 -------- d-----w- c:\program files\Common Files\Java
2010-03-24 09:24 . 2010-03-24 09:24 348160 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-29b474b9-n\msvcr71.dll
2010-03-24 09:24 . 2010-03-24 09:24 503808 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-29b474b9-n\msvcp71.dll
2010-03-24 09:24 . 2010-03-24 09:24 499712 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-29b474b9-n\jmc.dll
2010-03-24 09:24 . 2010-03-24 09:24 61440 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7304003f-n\decora-sse.dll
2010-03-24 09:24 . 2010-03-24 09:24 12800 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7304003f-n\decora-d3d.dll
2010-03-24 09:23 . 2010-03-24 09:23 -------- d-----w- c:\program files\Java
2010-03-24 09:13 . 2010-03-24 09:13 924448 ----a-w- c:\program files\jre-6u18-windows-i586-iftw-rv.exe
2010-03-24 08:20 . 2010-03-24 08:20 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Adobe
2010-03-24 08:18 . 2010-03-24 08:19 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-24 08:17 . 2010-03-24 08:17 -------- d-----w- c:\program files\Adobe Reader 9 Installer
2010-03-24 08:00 . 2010-02-01 01:45 38784 ----a-w- c:\documents and settings\Suvidha\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-03-24 08:00 . 2010-02-01 01:45 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-03-24 07:59 . 2010-03-24 07:59 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-24 07:41 . 2010-03-24 07:41 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2010-03-24 07:41 . 2010-03-24 07:41 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-03-24 07:41 . 2010-03-27 08:01 -------- d-----w- c:\program files\McAfee Security Scan
2010-03-24 07:39 . 2010-03-24 08:20 -------- d-----w- c:\documents and settings\Suvidha\Local Settings\Application Data\nos
2010-03-24 07:39 . 2010-03-24 07:39 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-03-24 07:38 . 2010-03-24 08:55 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-03-15 10:21 . 2010-03-15 10:21 -------- d-----w- c:\program files\Marvell
2010-03-15 08:07 . 2010-03-15 08:26 -------- d-----w- c:\program files\Realtek
2010-03-15 08:07 . 2010-03-15 08:07 -------- d-----w- c:\windows\OPTIONS
2010-03-15 08:07 . 2010-03-15 08:07 -------- d-----w- c:\documents and settings\Suvidha\Application Data\InstallShield

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-03 08:47 . 2009-11-14 08:29 -------- d-----w- c:\documents and settings\Suvidha\Application Data\Software Informer
2010-04-03 08:46 . 2009-12-29 10:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-04-03 07:44 . 2010-02-05 11:44 -------- d-----w- c:\program files\HMIS
2010-04-01 07:22 . 2009-05-01 12:16 110592 ----a-w- c:\documents and settings\Suvidha\Application Data\U3\temp\cleanup.exe
2010-04-01 07:22 . 2009-05-01 12:14 -------- d-----w- c:\documents and settings\Suvidha\Application Data\U3
2010-03-24 09:23 . 2009-10-02 03:18 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-03-15 10:20 . 2009-04-18 13:31 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-15 10:19 . 2009-04-18 13:31 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-05 11:43 . 2010-02-05 11:39 286720 ------w- c:\windows\Setup1.exe
2010-02-05 11:43 . 2010-01-05 09:50 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-12-29 10:24 . 2009-12-29 10:24 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Suvidha\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-07-23 133104]
"Software Informer"="c:\program files\Software Informer\softinfo.exe" [2009-11-07 1978437]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-06-20 577536]
"VTTimer"="VTTimer.exe" [2005-03-07 53248]
"VTTrayp"="VTtrayp.exe" [2005-10-31 163840]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"USB Antivirus"="c:\program files\USB Disk Security\USBGuard.exe" [2009-04-30 798720]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-07-03 303376]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\HP1006MC.EXE"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\English\\setup.exe"=
"c:\\Documents and Settings\\Suvidha\\Desktop\\ipmsg.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [12/15/2008 8:41 PM 33808]
R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [5/6/2009 2:41 PM 185640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [5/13/2009 5:46 PM 31760]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [5/16/2009 8:59 PM 19472]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 6:19 PM 227232]
.
Contents of the 'Scheduled Tasks' folder

2010-04-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-602609370-725345543-1003Core.job
- c:\documents and settings\Suvidha\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-23 08:22]

2010-04-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-602609370-725345543-1003UA.job
- c:\documents and settings\Suvidha\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-23 08:22]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.in/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {C4B483F9-2F7A-4C9A-97DD-4A8AF197B222} = 208.67.222.222,208.67.220.220
FF - ProfilePath - c:\documents and settings\Suvidha\Application Data\Mozilla\Firefox\Profiles\sjj36trr.default\
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHANS REMOVED - - - -

AddRemove-HijackThis - d:\grand rapport pani\HijackThis.exe
AddRemove-Picasa 3 - c:\program files\Google\Picasa3\Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-03 14:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3648)
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\TeamViewer\Version4\TeamViewer.exe
c:\windows\system32\wscntfy.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\VTTimer.exe
c:\windows\system32\VTtrayp.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
.
**************************************************************************
.
Completion time: 2010-04-03 14:20:05 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-03 08:50

Pre-Run: 12,057,899,008 bytes free
Post-Run: 12,532,711,424 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - C5BA3EDD9252F0B9F9FDF88AC91A10FA

No. Plug in all of them, if possible.

Then, re-run ComboFix and post a log.

Ok, I'll do it as soon as the computer is available.

The problem is that the 2nd computer of the office shall be infected as well (from the pen drives), but it has no access to the internet.. This is why I was asking if i shall combofix it as well..
thanks.

Start a new thread for that machine.

Hi, this is the new combofix's log.
I'm sorry I am not sure to get what you mean by 'start a new thread': should I post a new topic, or make a scan, or something.. for the other machine?

After the run of Combofix, kaspersky still found HEUR:Trojan.Win2.Generic on my harddisk and said it could not be deleted nor quarantined; but the 2nd scan didn't find it.
Thank you..



ComboFix 10-03-29.04 - Suvidha 04/07/2010 14:30:18.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.447.225 [GMT 5.5:30]
Running from: c:\documents and settings\Suvidha\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((( Files Created from 2010-03-07 to 2010-04-07 )))))))))))))))))))))))))))))))
.

2010-04-07 05:52 . 2010-04-07 05:52 -------- d-----w- c:\windows\system32\KB905474
2010-04-07 05:47 . 2010-04-07 05:47 -------- d-----w- c:\windows\ServicePackFiles
2010-04-07 05:46 . 2010-04-07 05:46 -------- d-----w- c:\program files\MSXML 6.0
2010-04-07 05:45 . 2008-07-09 07:38 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2010-04-06 19:31 . 2010-04-06 19:31 -------- d-----w- c:\program files\MSXML 4.0
2010-04-06 19:30 . 2010-04-07 05:59 -------- d--h--w- c:\windows\$hf_mig$
2010-04-06 17:28 . 2010-04-06 17:37 -------- d-----w- c:\windows\system32\CatRoot_bak
2010-04-06 17:08 . 2009-11-27 17:04 17920 -c----w- c:\windows\system32\dllcache\msyuv.dll
2010-04-06 16:49 . 2009-11-27 16:37 8704 -c----w- c:\windows\system32\dllcache\tsbyuv.dll
2010-04-06 16:49 . 2009-11-27 16:37 48128 -c----w- c:\windows\system32\dllcache\iyuv_32.dll
2010-04-06 16:36 . 2009-06-09 14:53 290816 -c----w- c:\windows\system32\dllcache\rhttpaa.dll
2010-04-06 16:36 . 2009-06-09 14:53 53248 -c----w- c:\windows\system32\dllcache\tsgqec.dll
2010-04-06 16:36 . 2009-06-09 14:53 136192 -c----w- c:\windows\system32\dllcache\aaclient.dll
2010-04-06 16:35 . 2009-12-08 18:11 2142720 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-04-06 16:35 . 2009-12-08 18:14 2185984 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-04-06 16:35 . 2009-12-08 17:35 2020864 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-04-06 16:35 . 2009-12-08 17:35 2063104 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-04-06 16:29 . 2009-12-04 13:37 456832 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-04-06 16:16 . 2008-06-13 13:10 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-04-06 16:16 . 2008-06-13 13:10 272128 ------w- c:\windows\system32\drivers\bthport.sys
2010-04-06 15:33 . 2009-08-06 13:53 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-03-27 08:02 . 2010-03-27 08:02 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee
2010-03-24 09:26 . 2010-03-24 09:26 -------- d-----w- c:\program files\Common Files\Java
2010-03-24 09:24 . 2010-03-24 09:24 348160 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-29b474b9-n\msvcr71.dll
2010-03-24 09:24 . 2010-03-24 09:24 503808 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-29b474b9-n\msvcp71.dll
2010-03-24 09:24 . 2010-03-24 09:24 499712 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-29b474b9-n\jmc.dll
2010-03-24 09:24 . 2010-03-24 09:24 61440 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7304003f-n\decora-sse.dll
2010-03-24 09:24 . 2010-03-24 09:24 12800 ----a-w- c:\documents and settings\Suvidha\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7304003f-n\decora-d3d.dll
2010-03-24 09:23 . 2010-03-24 09:23 -------- d-----w- c:\program files\Java
2010-03-24 09:13 . 2010-03-24 09:13 924448 ----a-w- c:\program files\jre-6u18-windows-i586-iftw-rv.exe
2010-03-24 08:20 . 2010-03-24 08:20 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Adobe
2010-03-24 08:18 . 2010-03-24 08:19 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-24 08:17 . 2010-03-24 08:17 -------- d-----w- c:\program files\Adobe Reader 9 Installer
2010-03-24 08:00 . 2010-02-01 01:45 38784 ----a-w- c:\documents and settings\Suvidha\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-03-24 08:00 . 2010-02-01 01:45 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-03-24 07:59 . 2010-03-24 07:59 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-24 07:41 . 2010-03-24 07:41 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2010-03-24 07:41 . 2010-03-24 07:41 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-03-24 07:41 . 2010-03-27 08:01 -------- d-----w- c:\program files\McAfee Security Scan
2010-03-24 07:39 . 2010-03-24 08:20 -------- d-----w- c:\documents and settings\Suvidha\Local Settings\Application Data\nos
2010-03-24 07:39 . 2010-03-24 07:39 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-03-24 07:38 . 2010-03-24 08:55 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-03-15 10:21 . 2010-03-15 10:21 -------- d-----w- c:\program files\Marvell
2010-03-15 08:07 . 2010-03-15 08:26 -------- d-----w- c:\program files\Realtek
2010-03-15 08:07 . 2010-03-15 08:07 -------- d-----w- c:\windows\OPTIONS
2010-03-15 08:07 . 2010-03-15 08:07 -------- d-----w- c:\documents and settings\Suvidha\Application Data\InstallShield

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-07 07:37 . 2010-02-05 11:44 -------- d-----w- c:\program files\HMIS
2010-04-07 06:05 . 2009-12-29 10:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-04-03 08:47 . 2009-11-14 08:29 -------- d-----w- c:\documents and settings\Suvidha\Application Data\Software Informer
2010-04-01 07:22 . 2009-05-01 12:16 110592 ----a-w- c:\documents and settings\Suvidha\Application Data\U3\temp\cleanup.exe
2010-04-01 07:22 . 2009-05-01 12:14 -------- d-----w- c:\documents and settings\Suvidha\Application Data\U3
2010-03-24 09:23 . 2009-10-02 03:18 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-03-15 10:20 . 2009-04-18 13:31 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-15 10:19 . 2009-04-18 13:31 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-26 06:05 . 2007-01-16 20:07 668672 ----a-w- c:\windows\system32\wininet.dll
2010-02-26 06:05 . 2004-08-03 23:56 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-02-05 11:43 . 2010-02-05 11:39 286720 ------w- c:\windows\Setup1.exe
2010-02-05 11:43 . 2010-01-05 09:50 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-12-29 10:24 . 2009-12-29 10:24 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat
.

((((((((((((((((((((((((((((( SnapShot@2010-04-03_08.46.52 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-11 14:11 . 2009-07-11 14:11 97280 c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.dll
+ 2009-06-28 18:12 . 2009-06-28 18:12 91656 c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll
+ 2010-04-05 12:31 . 2010-04-05 12:31 16384 c:\windows\Temp\Perflib_Perfdata_304.dat
+ 2007-01-16 20:07 . 2009-08-06 13:54 44768 c:\windows\system32\wups2.dll
+ 2009-04-18 00:12 . 2009-08-06 13:54 35552 c:\windows\system32\wups.dll
+ 2009-04-18 00:12 . 2009-08-06 13:54 53472 c:\windows\system32\wuauclt.exe
+ 2007-01-16 20:07 . 2009-06-25 08:17 59392 c:\windows\system32\wdigest.dll
+ 2010-04-06 16:16 . 2010-01-23 08:11 46080 c:\windows\system32\tzchange.exe
+ 2007-01-16 20:07 . 2009-06-09 14:53 53248 c:\windows\system32\tsgqec.dll
+ 2004-08-03 23:56 . 2009-06-12 11:49 80896 c:\windows\system32\tlntsess.exe
+ 2005-05-10 23:51 . 2009-06-12 11:49 76288 c:\windows\system32\telnet.exe
+ 2010-04-06 19:30 . 2009-05-26 11:40 17272 c:\windows\system32\spmsg.dll
+ 2010-04-06 15:32 . 2009-08-06 13:54 44768 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.4.7600.226\wups2.dll
+ 2010-04-06 15:32 . 2009-08-06 13:54 35552 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.4.7600.226\wups.dll
+ 2004-08-03 23:56 . 2009-06-25 08:17 56320 c:\windows\system32\secur32.dll
+ 2001-08-23 12:00 . 2009-02-06 09:54 35328 c:\windows\system32\sc.exe
+ 2004-08-03 23:56 . 2009-10-12 13:54 69632 c:\windows\system32\raschap.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 69632 c:\windows\system32\raschap.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 39424 c:\windows\system32\pngfilt.dll
+ 2007-01-16 20:06 . 2010-02-26 06:05 39424 c:\windows\system32\pngfilt.dll
- 2001-08-23 12:00 . 2010-02-17 07:20 59440 c:\windows\system32\perfc009.dat
+ 2001-08-23 12:00 . 2010-04-07 06:08 59440 c:\windows\system32\perfc009.dat
+ 2009-04-18 00:10 . 2008-06-12 13:47 91648 c:\windows\system32\mtxoci.dll
- 2009-04-18 00:10 . 2007-01-16 20:06 91648 c:\windows\system32\mtxoci.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 66560 c:\windows\system32\mtxclu.dll
+ 2007-01-16 20:06 . 2008-06-12 13:47 66560 c:\windows\system32\mtxclu.dll
+ 2004-08-04 00:56 . 2009-11-27 17:04 17920 c:\windows\system32\msyuv.dll
+ 2001-08-23 12:00 . 2009-11-27 16:37 28672 c:\windows\system32\msvidc32.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 11264 c:\windows\system32\msrle32.dll
+ 2004-08-03 23:56 . 2009-11-27 16:37 11264 c:\windows\system32\msrle32.dll
- 2009-04-18 00:10 . 2007-01-16 20:06 58880 c:\windows\system32\msdtclog.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 58880 c:\windows\system32\msdtclog.dll
+ 2007-01-16 20:06 . 2008-06-24 16:28 74240 c:\windows\system32\mscms.dll
+ 2004-08-03 23:56 . 2009-09-04 20:45 58880 c:\windows\system32\msasn1.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 48640 c:\windows\system32\mqupgrd.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 48640 c:\windows\system32\mqupgrd.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 95744 c:\windows\system32\mqsec.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 95744 c:\windows\system32\mqsec.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 16896 c:\windows\system32\mqise.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 16896 c:\windows\system32\mqise.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 47104 c:\windows\system32\mqdscli.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 47104 c:\windows\system32\mqdscli.dll
+ 2004-08-03 23:56 . 2009-06-22 11:49 19968 c:\windows\system32\mqbkup.exe
- 2004-08-03 23:56 . 2004-08-03 23:56 19968 c:\windows\system32\mqbkup.exe
+ 2007-01-16 20:07 . 2008-06-10 21:17 96768 c:\windows\system32\logagent.exe
- 2007-01-16 20:07 . 2007-01-16 20:07 96768 c:\windows\system32\logagent.exe
+ 2007-01-16 20:05 . 2010-02-26 06:05 16384 c:\windows\system32\jsproxy.dll
+ 2004-08-04 00:56 . 2009-11-27 16:37 48128 c:\windows\system32\iyuv_32.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 96256 c:\windows\system32\inseng.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 96256 c:\windows\system32\inseng.dll
+ 2007-01-16 20:05 . 2009-10-15 16:56 81920 c:\windows\system32\fontsub.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 55808 c:\windows\system32\extmgr.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 55808 c:\windows\system32\extmgr.dll
+ 2004-08-03 21:58 . 2009-06-22 11:48 91776 c:\windows\system32\drivers\mqac.sys
+ 2004-08-03 21:59 . 2009-06-22 11:35 92544 c:\windows\system32\drivers\ksecdd.sys
+ 2009-04-18 00:12 . 2009-08-06 13:54 35552 c:\windows\system32\dllcache\wups.dll
+ 2009-04-18 00:12 . 2009-08-06 13:54 53472 c:\windows\system32\dllcache\wuauclt.exe
+ 2007-01-16 20:07 . 2009-06-25 08:17 59392 c:\windows\system32\dllcache\wdigest.dll
+ 2004-08-03 23:56 . 2009-06-12 11:49 80896 c:\windows\system32\dllcache\tlntsess.exe
+ 2005-05-10 23:51 . 2009-06-12 11:49 76288 c:\windows\system32\dllcache\telnet.exe
+ 2004-08-03 23:56 . 2009-06-25 08:17 56320 c:\windows\system32\dllcache\secur32.dll
+ 2001-08-23 12:00 . 2009-02-06 09:54 35328 c:\windows\system32\dllcache\sc.exe
+ 2004-08-03 23:56 . 2009-10-12 13:54 69632 c:\windows\system32\dllcache\raschap.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 69632 c:\windows\system32\dllcache\raschap.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 39424 c:\windows\system32\dllcache\pngfilt.dll
+ 2007-01-16 20:06 . 2010-02-26 06:05 39424 c:\windows\system32\dllcache\pngfilt.dll
- 2009-04-18 00:10 . 2007-01-16 20:06 91648 c:\windows\system32\dllcache\mtxoci.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 91648 c:\windows\system32\dllcache\mtxoci.dll
+ 2007-01-16 20:06 . 2008-06-12 13:47 66560 c:\windows\system32\dllcache\mtxclu.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 66560 c:\windows\system32\dllcache\mtxclu.dll
+ 2001-08-23 12:00 . 2009-11-27 16:37 28672 c:\windows\system32\dllcache\msvidc32.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 11264 c:\windows\system32\dllcache\msrle32.dll
+ 2004-08-03 23:56 . 2009-11-27 16:37 11264 c:\windows\system32\dllcache\msrle32.dll
- 2009-04-18 00:10 . 2007-01-16 20:06 58880 c:\windows\system32\dllcache\msdtclog.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 58880 c:\windows\system32\dllcache\msdtclog.dll
+ 2007-01-16 20:06 . 2008-06-24 16:28 74240 c:\windows\system32\dllcache\mscms.dll
+ 2004-08-03 23:56 . 2009-09-04 20:45 58880 c:\windows\system32\dllcache\msasn1.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 48640 c:\windows\system32\dllcache\mqupgrd.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 48640 c:\windows\system32\dllcache\mqupgrd.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 95744 c:\windows\system32\dllcache\mqsec.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 95744 c:\windows\system32\dllcache\mqsec.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 16896 c:\windows\system32\dllcache\mqise.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 16896 c:\windows\system32\dllcache\mqise.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 47104 c:\windows\system32\dllcache\mqdscli.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 47104 c:\windows\system32\dllcache\mqdscli.dll
+ 2004-08-03 23:56 . 2009-06-22 11:49 19968 c:\windows\system32\dllcache\mqbkup.exe
- 2004-08-03 23:56 . 2004-08-03 23:56 19968 c:\windows\system32\dllcache\mqbkup.exe
+ 2004-08-03 21:58 . 2009-06-22 11:48 91776 c:\windows\system32\dllcache\mqac.sys
+ 2007-01-16 20:07 . 2008-06-10 21:17 96768 c:\windows\system32\dllcache\logagent.exe
- 2007-01-16 20:07 . 2007-01-16 20:07 96768 c:\windows\system32\dllcache\logagent.exe
+ 2004-08-03 21:59 . 2009-06-22 11:35 92544 c:\windows\system32\dllcache\ksecdd.sys
+ 2007-01-16 20:05 . 2010-02-26 06:05 16384 c:\windows\system32\dllcache\jsproxy.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 96256 c:\windows\system32\dllcache\inseng.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 96256 c:\windows\system32\dllcache\inseng.dll
+ 2004-08-03 23:56 . 2010-02-26 06:05 81920 c:\windows\system32\dllcache\ieencode.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 81920 c:\windows\system32\dllcache\ieencode.dll
- 2009-04-18 00:12 . 2007-01-16 20:05 18432 c:\windows\system32\dllcache\iedw.exe
+ 2009-04-18 00:12 . 2010-02-25 11:17 18432 c:\windows\system32\dllcache\iedw.exe
+ 2007-01-16 20:05 . 2009-10-15 16:56 81920 c:\windows\system32\dllcache\fontsub.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 55808 c:\windows\system32\dllcache\extmgr.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 55808 c:\windows\system32\dllcache\extmgr.dll
+ 2004-08-03 23:56 . 2009-12-14 07:35 33280 c:\windows\system32\dllcache\csrsrv.dll
+ 2007-01-16 20:05 . 2009-08-06 13:54 96480 c:\windows\system32\dllcache\cdm.dll
+ 2004-08-03 23:56 . 2009-11-27 16:37 84992 c:\windows\system32\dllcache\avifil32.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 84992 c:\windows\system32\dllcache\avifil32.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 58880 c:\windows\system32\dllcache\atl.dll
+ 2004-08-03 23:56 . 2009-07-17 18:55 58880 c:\windows\system32\dllcache\atl.dll
+ 2004-08-03 23:56 . 2009-12-14 07:35 33280 c:\windows\system32\csrsrv.dll
+ 2009-04-18 00:19 . 2010-04-05 05:06 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-04-18 00:19 . 2010-03-23 05:02 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-04-18 00:19 . 2010-04-05 05:06 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-04-18 00:19 . 2010-03-23 05:02 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-04-05 05:06 . 2010-04-05 05:06 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-04-18 00:19 . 2010-03-23 05:02 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2007-01-16 20:05 . 2009-08-06 13:54 96480 c:\windows\system32\cdm.dll
+ 2004-08-03 23:56 . 2009-11-27 16:37 84992 c:\windows\system32\avifil32.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 84992 c:\windows\system32\avifil32.dll
+ 2004-08-03 23:56 . 2009-07-17 18:55 58880 c:\windows\system32\atl.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 58880 c:\windows\system32\atl.dll
+ 2010-04-06 19:31 . 2010-04-06 19:31 32768 c:\windows\Installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}\icon.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 23040 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 23040 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 61440 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 61440 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 27136 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 27136 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 11264 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 11264 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 86016 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 86016 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 12288 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 12288 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2010-04-06 17:08 . 2009-11-27 17:04 17920 c:\windows\Driver Cache\i386\msyuv.dll
+ 2010-04-06 16:49 . 2009-11-27 16:37 48128 c:\windows\Driver Cache\i386\iyuv_32.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 39424 c:\windows\AppPatch\acadproc.dll
+ 2007-01-16 20:05 . 2009-03-25 05:54 39424 c:\windows\AppPatch\acadproc.dll
+ 2001-08-17 22:36 . 2009-11-27 16:37 8704 c:\windows\system32\tsbyuv.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 4608 c:\windows\system32\mqsvc.exe
+ 2004-08-03 23:56 . 2009-06-22 11:49 4608 c:\windows\system32\mqsvc.exe
+ 2004-08-03 23:56 . 2009-06-22 11:49 4608 c:\windows\system32\dllcache\mqsvc.exe
- 2004-08-03 23:56 . 2004-08-03 23:56 4608 c:\windows\system32\dllcache\mqsvc.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 4096 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 4096 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2010-04-06 16:49 . 2009-11-27 16:37 8704 c:\windows\Driver Cache\i386\tsbyuv.dll
+ 2007-01-16 20:07 . 2010-02-25 11:01 352768 c:\windows\system32\xpsp3res.dll
+ 2009-04-18 00:12 . 2009-08-06 13:54 209632 c:\windows\system32\wuweb.dll
+ 2009-04-18 00:12 . 2009-08-06 13:54 327896 c:\windows\system32\wucltui.dll
+ 2009-04-18 00:12 . 2009-08-06 13:53 575704 c:\windows\system32\wuapi.dll
+ 2007-01-16 20:08 . 2009-04-09 19:31 413544 c:\windows\system32\wmspdmod.dll
+ 2007-01-16 20:08 . 2009-07-13 04:38 286720 c:\windows\system32\wmpdxm.dll
- 2007-01-16 20:08 . 2007-01-16 20:08 988672 c:\windows\system32\wmnetmgr.dll
+ 2007-01-16 20:08 . 2008-06-10 21:28 988672 c:\windows\system32\WMNetmgr.dll
+ 2007-01-16 20:07 . 2007-10-27 12:09 228864 c:\windows\system32\wmasf.dll
+ 2007-01-16 20:07 . 2009-06-10 06:26 134144 c:\windows\system32\wkssvc.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 351232 c:\windows\system32\winhttp.dll
+ 2004-08-03 23:56 . 2008-12-16 12:47 351232 c:\windows\system32\winhttp.dll
+ 2009-04-18 00:10 . 2009-02-06 09:41 227840 c:\windows\system32\wbem\wmiprvse.exe
+ 2009-04-18 00:10 . 2009-02-10 13:01 453120 c:\windows\system32\wbem\wmiprvsd.dll
+ 2009-04-18 00:10 . 2009-02-09 10:01 473088 c:\windows\system32\wbem\fastprox.dll
+ 2007-01-16 20:07 . 2007-12-18 14:40 417792 c:\windows\system32\vbscript.dll
+ 2007-01-16 20:07 . 2010-02-26 06:05 628224 c:\windows\system32\urlmon.dll
+ 2007-01-16 20:07 . 2009-10-15 16:56 119808 c:\windows\system32\t2embed.dll
+ 2007-01-16 20:07 . 2009-08-26 08:16 247326 c:\windows\system32\strmdll.dll
+ 2007-01-16 20:07 . 2010-02-26 06:05 474112 c:\windows\system32\shlwapi.dll
- 2007-01-16 20:07 . 2007-01-16 20:07 474112 c:\windows\system32\shlwapi.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 169472 c:\windows\system32\Setup\msmqocm.dll
+ 2004-08-03 23:56 . 2009-02-06 10:22 110592 c:\windows\system32\services.exe
+ 2004-08-03 23:56 . 2009-06-25 08:17 168448 c:\windows\system32\schannel.dll
+ 2007-01-16 20:06 . 2009-02-09 10:01 401408 c:\windows\system32\rpcss.dll
+ 2007-01-16 20:06 . 2009-04-15 15:26 583168 c:\windows\system32\rpcrt4.dll
+ 2007-01-16 20:06 . 2009-06-09 14:53 290816 c:\windows\system32\rhttpaa.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 112128 c:\windows\system32\rastls.dll
+ 2004-08-03 23:56 . 2009-10-12 13:54 112128 c:\windows\system32\rastls.dll
- 2001-08-23 12:00 . 2010-02-17 07:20 395200 c:\windows\system32\perfh009.dat
+ 2001-08-23 12:00 . 2010-04-07 06:08 395200 c:\windows\system32\perfh009.dat
+ 2004-08-03 23:56 . 2009-03-06 14:00 284160 c:\windows\system32\pdh.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 270336 c:\windows\system32\oakley.dll
+ 2007-01-16 20:06 . 2009-10-13 10:45 270336 c:\windows\system32\oakley.dll
+ 2004-08-03 23:56 . 2009-02-09 10:01 715264 c:\windows\system32\ntdll.dll
+ 2004-08-03 23:56 . 2009-02-06 18:46 408064 c:\windows\system32\netlogon.dll
+ 2007-01-16 20:06 . 2008-10-15 16:53 339456 c:\windows\system32\netapi32.dll
+ 2007-01-16 20:06 . 2009-08-06 13:53 215920 c:\windows\system32\muweb.dll
+ 2004-08-03 23:56 . 2008-06-20 17:36 245248 c:\windows\system32\mswsock.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 245248 c:\windows\system32\mswsock.dll
+ 2004-08-03 23:56 . 2009-08-05 09:11 204800 c:\windows\system32\mswebdvd.dll
+ 2004-08-03 23:56 . 2009-09-11 14:03 136192 c:\windows\system32\msv1_0.dll
+ 2009-04-18 00:10 . 2009-06-09 09:12 677888 c:\windows\system32\mstsc.exe
- 2007-01-16 20:06 . 2007-01-16 20:06 532480 c:\windows\system32\mstime.dll
+ 2007-01-16 20:06 . 2010-02-26 06:05 532480 c:\windows\system32\mstime.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 146432 c:\windows\system32\msrating.dll
+ 2007-01-16 20:06 . 2010-02-26 06:05 146432 c:\windows\system32\msrating.dll
- 2009-04-18 00:10 . 2004-08-03 23:56 343040 c:\windows\system32\mspaint.exe
+ 2009-04-18 00:10 . 2009-12-16 12:58 343040 c:\windows\system32\mspaint.exe
+ 2007-01-16 20:06 . 2010-02-26 06:05 449024 c:\windows\system32\mshtmled.dll
- 2009-04-18 00:10 . 2007-01-16 20:06 161792 c:\windows\system32\msdtcuiu.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 161792 c:\windows\system32\msdtcuiu.dll
- 2009-04-18 00:10 . 2007-01-16 20:06 956928 c:\windows\system32\msdtctm.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 956928 c:\windows\system32\msdtctm.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 428032 c:\windows\system32\msdtcprx.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 471552 c:\windows\system32\mqutil.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 471552 c:\windows\system32\mqutil.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 186880 c:\windows\system32\mqtrig.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 186880 c:\windows\system32\mqtrig.dll
+ 2004-08-03 23:56 . 2009-06-22 11:49 117248 c:\windows\system32\mqtgsvc.exe
- 2004-08-03 23:56 . 2004-08-03 23:56 117248 c:\windows\system32\mqtgsvc.exe
+ 2004-08-03 23:56 . 2009-06-25 18:36 517120 c:\windows\system32\mqsnap.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 123392 c:\windows\system32\mqrtdep.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 123392 c:\windows\system32\mqrtdep.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 177152 c:\windows\system32\mqrt.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 177152 c:\windows\system32\mqrt.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 661504 c:\windows\system32\mqqm.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 225280 c:\windows\system32\mqoa.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 225280 c:\windows\system32\mqoa.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 138240 c:\windows\system32\mqad.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 138240 c:\windows\system32\mqad.dll
+ 2007-01-16 20:05 . 2009-06-25 08:17 729600 c:\windows\system32\lsasrv.dll
+ 2004-08-03 23:56 . 2009-05-07 15:44 344064 c:\windows\system32\localspl.dll
+ 2007-01-16 20:05 . 2009-03-21 13:54 989184 c:\windows\system32\kernel32.dll
+ 2007-01-16 20:05 . 2009-06-25 08:17 301568 c:\windows\system32\kerberos.dll
+ 2010-04-07 05:52 . 2009-03-10 16:48 453512 c:\windows\system32\KB905474\wgasetup.exe
+ 2007-01-16 20:05 . 2009-08-21 09:46 450560 c:\windows\system32\jscript.dll
+ 2009-04-18 00:12 . 2008-04-11 18:39 683520 c:\windows\system32\inetcomm.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 251904 c:\windows\system32\iepeers.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 251904 c:\windows\system32\iepeers.dll
+ 2007-01-16 20:05 . 2008-10-23 12:51 284160 c:\windows\system32\gdi32.dll
- 2009-04-18 05:32 . 2009-11-16 05:26 263024 c:\windows\system32\FNTCACHE.DAT
+ 2009-04-18 05:32 . 2010-04-07 05:34 263024 c:\windows\system32\FNTCACHE.DAT
+ 2007-01-16 20:05 . 2008-07-07 20:06 253952 c:\windows\system32\es.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 205312 c:\windows\system32\dxtrans.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 205312 c:\windows\system32\dxtrans.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 357888 c:\windows\system32\dxtmsft.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 357888 c:\windows\system32\dxtmsft.dll
+ 2007-01-16 20:07 . 2008-06-20 09:32 225920 c:\windows\system32\drivers\tcpip6.sys
+ 2007-01-16 20:07 . 2008-06-20 10:44 360960 c:\windows\system32\drivers\tcpip.sys
+ 2007-01-16 20:07 . 2009-12-31 15:06 352640 c:\windows\system32\drivers\srv.sys
+ 2007-01-16 20:06 . 2008-05-08 12:14 203008 c:\windows\system32\drivers\rmcast.sys
+ 2007-01-16 20:06 . 2009-12-04 13:37 456832 c:\windows\system32\drivers\mrxsmb.sys
+ 2004-08-03 22:14 . 2008-08-14 09:48 138368 c:\windows\system32\drivers\afd.sys
+ 2007-01-16 20:05 . 2008-06-20 17:36 147968 c:\windows\system32\dnsapi.dll
+ 2009-04-18 00:12 . 2009-08-06 13:54 209632 c:\windows\system32\dllcache\wuweb.dll
+ 2009-04-18 00:12 . 2009-08-06 13:54 327896 c:\windows\system32\dllcache\wucltui.dll
+ 2009-04-18 00:12 . 2009-08-06 13:53 575704 c:\windows\system32\dllcache\wuapi.dll
+ 2009-04-18 00:10 . 2008-04-21 10:02 215552 c:\windows\system32\dllcache\wordpad.exe
+ 2007-01-16 20:08 . 2009-04-09 19:31 413544 c:\windows\system32\dllcache\wmspdmod.dll
+ 2007-01-16 20:08 . 2009-07-13 04:38 286720 c:\windows\system32\dllcache\wmpdxm.dll
+ 2007-01-16 20:08 . 2008-06-10 21:28 988672 c:\windows\system32\dllcache\WMNetmgr.dll
- 2007-01-16 20:08 . 2007-01-16 20:08 988672 c:\windows\system32\dllcache\wmnetmgr.dll
+ 2009-04-18 00:10 . 2009-02-06 09:41 227840 c:\windows\system32\dllcache\wmiprvse.exe
+ 2009-04-18 00:10 . 2009-02-10 13:01 453120 c:\windows\system32\dllcache\wmiprvsd.dll
+ 2007-01-16 20:07 . 2007-10-27 12:09 228864 c:\windows\system32\dllcache\wmasf.dll
+ 2007-01-16 20:07 . 2009-06-10 06:26 134144 c:\windows\system32\dllcache\wkssvc.dll
+ 2007-01-16 20:07 . 2010-02-26 06:05 668672 c:\windows\system32\dllcache\wininet.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 351232 c:\windows\system32\dllcache\winhttp.dll
+ 2004-08-03 23:56 . 2008-12-16 12:47 351232 c:\windows\system32\dllcache\winhttp.dll
+ 2007-01-16 20:07 . 2007-12-18 14:40 417792 c:\windows\system32\dllcache\vbscript.dll
+ 2007-01-16 20:07 . 2010-02-26 06:05 628224 c:\windows\system32\dllcache\urlmon.dll
+ 2009-04-18 00:12 . 2009-06-21 22:04 153088 c:\windows\system32\dllcache\triedit.dll
- 2009-04-18 00:12 . 2004-08-03 23:56 153088 c:\windows\system32\dllcache\triedit.dll
+ 2007-01-16 20:07 . 2008-06-20 09:32 225920 c:\windows\system32\dllcache\tcpip6.sys
+ 2007-01-16 20:07 . 2008-06-20 10:44 360960 c:\windows\system32\dllcache\tcpip.sys
+ 2007-01-16 20:07 . 2009-10-15 16:56 119808 c:\windows\system32\dllcache\t2embed.dll
+ 2007-01-16 20:07 . 2009-08-26 08:16 247326 c:\windows\system32\dllcache\strmdll.dll
+ 2007-01-16 20:07 . 2009-12-31 15:06 352640 c:\windows\system32\dllcache\srv.sys
- 2007-01-16 20:07 . 2007-01-16 20:07 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2007-01-16 20:07 . 2010-02-26 06:05 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2004-08-03 23:56 . 2009-02-06 10:22 110592 c:\windows\system32\dllcache\services.exe
+ 2004-08-03 23:56 . 2009-06-25 08:17 168448 c:\windows\system32\dllcache\schannel.dll
+ 2007-01-16 20:06 . 2009-02-09 10:01 401408 c:\windows\system32\dllcache\rpcss.dll
+ 2007-01-16 20:06 . 2009-04-15 15:26 583168 c:\windows\system32\dllcache\rpcrt4.dll
+ 2007-01-16 20:06 . 2008-05-08 12:14 203008 c:\windows\system32\dllcache\rmcast.sys
+ 2004-08-03 23:56 . 2009-10-12 13:54 112128 c:\windows\system32\dllcache\rastls.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 112128 c:\windows\system32\dllcache\rastls.dll
+ 2004-08-03 23:56 . 2009-03-06 14:00 284160 c:\windows\system32\dllcache\pdh.dll
+ 2007-01-16 20:06 . 2009-10-13 10:45 270336 c:\windows\system32\dllcache\oakley.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 270336 c:\windows\system32\dllcache\oakley.dll
+ 2004-08-03 23:56 . 2009-02-09 10:01 715264 c:\windows\system32\dllcache\ntdll.dll
+ 2004-08-03 23:56 . 2009-02-06 18:46 408064 c:\windows\system32\dllcache\netlogon.dll
+ 2007-01-16 20:06 . 2008-10-15 16:53 339456 c:\windows\system32\dllcache\netapi32.dll
+ 2004-08-03 23:56 . 2008-06-20 17:36 245248 c:\windows\system32\dllcache\mswsock.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 245248 c:\windows\system32\dllcache\mswsock.dll
+ 2004-08-03 23:56 . 2009-08-05 09:11 204800 c:\windows\system32\dllcache\mswebdvd.dll
+ 2004-08-03 23:56 . 2009-09-11 14:03 136192 c:\windows\system32\dllcache\msv1_0.dll
+ 2009-04-18 00:10 . 2009-06-09 09:12 677888 c:\windows\system32\dllcache\mstsc.exe
+ 2007-01-16 20:06 . 2010-02-26 06:05 532480 c:\windows\system32\dllcache\mstime.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 532480 c:\windows\system32\dllcache\mstime.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 146432 c:\windows\system32\dllcache\msrating.dll
+ 2007-01-16 20:06 . 2010-02-26 06:05 146432 c:\windows\system32\dllcache\msrating.dll
- 2009-04-18 00:10 . 2004-08-03 23:56 343040 c:\windows\system32\dllcache\mspaint.exe
+ 2009-04-18 00:10 . 2009-12-16 12:58 343040 c:\windows\system32\dllcache\mspaint.exe
+ 2004-08-03 23:56 . 2009-06-25 18:36 169472 c:\windows\system32\dllcache\msmqocm.dll
+ 2007-01-16 20:06 . 2010-02-26 06:05 449024 c:\windows\system32\dllcache\mshtmled.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 161792 c:\windows\system32\dllcache\msdtcuiu.dll
- 2009-04-18 00:10 . 2007-01-16 20:06 161792 c:\windows\system32\dllcache\msdtcuiu.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 956928 c:\windows\system32\dllcache\msdtctm.dll
- 2009-04-18 00:10 . 2007-01-16 20:06 956928 c:\windows\system32\dllcache\msdtctm.dll
+ 2009-04-18 00:10 . 2008-06-12 13:47 428032 c:\windows\system32\dllcache\msdtcprx.dll
- 2009-04-18 00:12 . 2004-08-03 23:56 331776 c:\windows\system32\dllcache\msadce.dll
+ 2009-04-18 00:12 . 2008-05-01 14:30 331776 c:\windows\system32\dllcache\msadce.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 471552 c:\windows\system32\dllcache\mqutil.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 471552 c:\windows\system32\dllcache\mqutil.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 186880 c:\windows\system32\dllcache\mqtrig.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 186880 c:\windows\system32\dllcache\mqtrig.dll
+ 2004-08-03 23:56 . 2009-06-22 11:49 117248 c:\windows\system32\dllcache\mqtgsvc.exe
- 2004-08-03 23:56 . 2004-08-03 23:56 117248 c:\windows\system32\dllcache\mqtgsvc.exe
+ 2004-08-03 23:56 . 2009-06-25 18:36 517120 c:\windows\system32\dllcache\mqsnap.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 123392 c:\windows\system32\dllcache\mqrtdep.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 123392 c:\windows\system32\dllcache\mqrtdep.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 177152 c:\windows\system32\dllcache\mqrt.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 177152 c:\windows\system32\dllcache\mqrt.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 661504 c:\windows\system32\dllcache\mqqm.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 225280 c:\windows\system32\dllcache\mqoa.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 225280 c:\windows\system32\dllcache\mqoa.dll
+ 2004-08-03 23:56 . 2009-06-25 18:36 138240 c:\windows\system32\dllcache\mqad.dll
- 2004-08-03 23:56 . 2004-08-03 23:56 138240 c:\windows\system32\dllcache\mqad.dll
+ 2007-01-16 20:05 . 2009-06-25 08:17 729600 c:\windows\system32\dllcache\lsasrv.dll
+ 2004-08-03 23:56 . 2009-05-07 15:44 344064 c:\windows\system32\dllcache\localspl.dll
+ 2007-01-16 20:05 . 2009-03-21 13:54 989184 c:\windows\system32\dllcache\kernel32.dll
+ 2007-01-16 20:05 . 2009-06-25 08:17 301568 c:\windows\system32\dllcache\kerberos.dll
+ 2007-01-16 20:05 . 2009-08-21 09:46 450560 c:\windows\system32\dllcache\jscript.dll
+ 2009-04-18 00:12 . 2008-04-11 18:39 683520 c:\windows\system32\dllcache\inetcomm.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 251904 c:\windows\system32\dllcache\iepeers.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 251904 c:\windows\system32\dllcache\iepeers.dll
+ 2007-01-16 20:05 . 2008-10-23 12:51 284160 c:\windows\system32\dllcache\gdi32.dll
+ 2009-04-18 00:10 . 2009-02-09 10:01 473088 c:\windows\system32\dllcache\fastprox.dll
+ 2007-01-16 20:05 . 2008-07-07 20:06 253952 c:\windows\system32\dllcache\es.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 205312 c:\windows\system32\dllcache\dxtrans.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 205312 c:\windows\system32\dllcache\dxtrans.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 357888 c:\windows\system32\dllcache\dxtmsft.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 357888 c:\windows\system32\dllcache\dxtmsft.dll
+ 2007-01-16 20:05 . 2008-06-20 17:36 147968 c:\windows\system32\dllcache\dnsapi.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 151040 c:\windows\system32\dllcache\cdfview.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 151040 c:\windows\system32\dllcache\cdfview.dll
+ 2004-08-03 22:14 . 2008-08-14 09:48 138368 c:\windows\system32\dllcache\afd.sys
+ 2004-08-03 23:56 . 2009-02-09 10:01 617984 c:\windows\system32\dllcache\advapi32.dll
+ 2007-01-16 20:05 . 2009-11-21 16:24 470528 c:\windows\system32\dllcache\aclayers.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 151040 c:\windows\system32\cdfview.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 151040 c:\windows\system32\cdfview.dll
+ 2004-08-03 23:56 . 2009-02-09 10:01 617984 c:\windows\system32\advapi32.dll
+ 2007-01-16 20:05 . 2009-06-09 14:53 136192 c:\windows\system32\aaclient.dll
+ 2010-04-06 19:31 . 2010-04-06 19:31 429568 c:\windows\Installer\ddd6d3.msi
+ 2010-04-06 19:31 . 2010-04-06 19:31 248832 c:\windows\Installer\ddd6cb.msi
+ 2010-04-07 05:57 . 2010-04-07 05:57 969728 c:\windows\Installer\b257c.msi
+ 2009-04-18 12:46 . 2010-04-07 05:58 409600 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 409600 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 286720 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 286720 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 249856 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 249856 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 794624 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 794624 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 135168 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 135168 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2009-04-18 12:46 . 2010-04-07 05:58 593920 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
- 2009-04-18 12:46 . 2010-03-04 05:32 593920 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2003-07-08 06:18 . 2003-07-08 06:18 115288 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.5614\OUTLFLTR.DLL
+ 2010-04-06 16:29 . 2009-12-04 13:37 456832 c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2010-04-06 16:16 . 2008-06-13 13:10 272128 c:\windows\Driver Cache\i386\bthport.sys
+ 2007-01-16 20:05 . 2009-11-21 16:24 470528 c:\windows\AppPatch\aclayers.dll
+ 2010-04-06 16:44 . 2009-08-13 13:55 1748992 c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll
+ 2009-07-20 18:33 . 2009-07-20 18:33 1348432 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5\msxml4.dll
+ 2009-04-18 00:12 . 2009-08-06 13:53 1929952 c:\windows\system32\wuaueng.dll
- 2007-01-16 20:08 . 2007-01-16 20:08 2330624 c:\windows\system32\wmvcore.dll
+ 2007-01-16 20:08 . 2009-06-08 16:54 2330624 c:\windows\system32\WMVCore.dll
+ 2007-01-16 20:08 . 2009-07-13 04:38 5537792 c:\windows\system32\wmp.dll
+ 2007-01-16 20:07 . 2009-08-14 11:22 1859328 c:\windows\system32\win32k.sys
+ 2007-01-16 20:07 . 2008-07-03 13:03 8460800 c:\windows\system32\shell32.dll
+ 2007-01-16 20:06 . 2010-03-10 04:57 1509888 c:\windows\system32\shdocvw.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 1435648 c:\windows\system32\query.dll
+ 2007-01-16 20:06 . 2009-07-17 16:10 1435648 c:\windows\system32\query.dll
+ 2007-01-16 20:06 . 2009-11-27 17:04 1291776 c:\windows\system32\quartz.dll
+ 2007-01-16 20:06 . 2009-12-08 18:11 2142720 c:\windows\system32\ntoskrnl.exe
+ 2006-10-30 12:27 . 2009-12-08 17:35 2020864 c:\windows\system32\ntkrnlpa.exe
+ 2009-08-19 11:37 . 2009-08-19 11:37 1415000 c:\windows\system32\msxml6.dll
+ 2009-07-20 18:35 . 2009-07-20 18:35 1348432 c:\windows\system32\msxml4.dll
+ 2007-01-16 20:06 . 2009-07-31 04:36 1172480 c:\windows\system32\msxml3.dll
+ 2009-04-18 00:10 . 2009-06-09 14:53 2067968 c:\windows\system32\mstscax.dll
+ 2007-01-16 20:06 . 2010-02-26 19:35 3073024 c:\windows\system32\mshtml.dll
+ 2010-04-07 05:52 . 2009-03-10 16:56 1403264 c:\windows\system32\KB905474\wganotifypackageinner.exe
+ 2009-04-18 00:12 . 2009-08-06 13:53 1929952 c:\windows\system32\dllcache\wuaueng.dll
+ 2007-01-16 20:08 . 2009-06-08 16:54 2330624 c:\windows\system32\dllcache\WMVCore.dll
- 2007-01-16 20:08 . 2007-01-16 20:08 2330624 c:\windows\system32\dllcache\wmvcore.dll
+ 2007-01-16 20:08 . 2009-07-13 04:38 5537792 c:\windows\system32\dllcache\wmp.dll
+ 2007-01-16 20:07 . 2009-08-14 11:22 1859328 c:\windows\system32\dllcache\win32k.sys
+ 2007-01-16 20:07 . 2008-07-03 13:03 8460800 c:\windows\system32\dllcache\shell32.dll
+ 2007-01-16 20:06 . 2010-03-10 04:57 1509888 c:\windows\system32\dllcache\shdocvw.dll
- 2007-01-16 20:06 . 2007-01-16 20:06 1435648 c:\windows\system32\dllcache\query.dll
+ 2007-01-16 20:06 . 2009-07-17 16:10 1435648 c:\windows\system32\dllcache\query.dll
+ 2007-01-16 20:06 . 2009-11-27 17:04 1291776 c:\windows\system32\dllcache\quartz.dll
+ 2007-01-16 20:06 . 2009-07-31 04:36 1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2009-04-18 00:10 . 2009-06-09 14:53 2067968 c:\windows\system32\dllcache\mstscax.dll
+ 2009-04-18 00:12 . 2009-07-10 13:36 1315328 c:\windows\system32\dllcache\msoe.dll
+ 2007-01-16 20:06 . 2010-02-26 19:35 3073024 c:\windows\system32\dllcache\mshtml.dll
+ 2009-04-18 00:12 . 2009-10-23 14:27 3555328 c:\windows\system32\dllcache\moviemk.exe
- 2009-04-18 00:12 . 2004-08-03 23:56 3555328 c:\windows\system32\dllcache\moviemk.exe
+ 2007-01-16 20:05 . 2010-02-26 06:05 1054208 c:\windows\system32\dllcache\danim.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 1054208 c:\windows\system32\dllcache\danim.dll
+ 2007-01-16 20:05 . 2010-03-10 04:57 1024000 c:\windows\system32\dllcache\browseui.dll
- 2007-01-16 20:05 . 2007-01-16 20:05 1054208 c:\windows\system32\danim.dll
+ 2007-01-16 20:05 . 2010-02-26 06:05 1054208 c:\windows\system32\danim.dll
+ 2007-01-16 20:05 . 2010-03-10 04:57 1024000 c:\windows\system32\browseui.dll
+ 2008-09-30 15:37 . 2008-09-30 15:37 6042112 c:\windows\Installer\ddd6d4.msi
+ 2005-10-26 09:29 . 2005-10-26 09:29 2883072 c:\windows\Installer\b2597.msp
+ 2010-02-04 12:41 . 2010-02-04 12:41 5526528 c:\windows\Installer\b2573.msp
+ 2003-07-07 08:06 . 2003-07-07 08:06 2058343 c:\windows\Installer\$PatchCache$\Managed\9040110900063D11C8EF10054038389C\11.0.5614\OUTLFLTR.DAT
+ 2010-04-06 16:35 . 2009-12-08 18:14 2185984 c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2010-04-06 16:35 . 2009-12-08 17:35 2020864 c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2010-04-06 16:35 . 2009-12-08 17:35 2063104 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2010-04-06 16:35 . 2009-12-08 18:11 2142720 c:\windows\Driver Cache\i386\ntkrnlmp.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Suvidha\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-07-23 133104]
"Software Informer"="c:\program files\Software Informer\softinfo.exe" [2009-11-07 1978437]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-06-20 577536]
"VTTimer"="VTTimer.exe" [2005-03-07 53248]
"VTTrayp"="VTtrayp.exe" [2005-10-31 163840]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"USB Antivirus"="c:\program files\USB Disk Security\USBGuard.exe" [2009-04-30 798720]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-07-03 303376]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\HP1006MC.EXE"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\English\\setup.exe"=
"c:\\Documents and Settings\\Suvidha\\Desktop\\ipmsg.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [12/15/2008 8:41 PM 33808]
R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [5/6/2009 2:41 PM 185640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [5/13/2009 5:46 PM 31760]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [5/16/2009 8:59 PM 19472]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 6:19 PM 227232]
.
Contents of the 'Scheduled Tasks' folder

2010-04-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-602609370-725345543-1003Core.job
- c:\documents and settings\Suvidha\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-23 08:22]

2010-04-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-602609370-725345543-1003UA.job
- c:\documents and settings\Suvidha\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-23 08:22]

2010-04-07 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-04-07 16:48]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.in/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {C4B483F9-2F7A-4C9A-97DD-4A8AF197B222} = 208.67.222.222,208.67.220.220
FF - ProfilePath - c:\documents and settings\Suvidha\Application Data\Mozilla\Firefox\Profiles\sjj36trr.default\
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-07 14:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(4020)
c:\windows\system32\msi.dll
.
Completion time: 2010-04-07 14:34:16
ComboFix-quarantined-files.txt 2010-04-07 09:04
ComboFix2.txt 2010-04-03 08:50

Pre-Run: 10,696,679,424 bytes free
Post-Run: 10,665,766,912 bytes free

- - End Of File - - 380C7FAE057625049BDA083B223D5D8F

Yes, start a new thread for the other machine.

Please do a scan with Kaspersky Online Scanner

Click on the Accept button and install any components it needs.

• The program will install and then begin downloading the latest definition files.
  
• After the files have been downloaded on the left side of the page in the Scan section select My Computer.
  
• This will start the program and scan your system.
  
• The scan will take a while, so be patient and let it run.
  
• Once the scan is complete, click on View scan report
  
• Now, click on the Save Report as button.
  
• Save the file to your desktop.
  
• Copy and paste that information in your next post.