security master av removalSolved/Closed

Question

Hello, 


I have been trying for two days to get rid of this virus, i have done loads both in safe mode and normal mode and managed to get rid of thousands , i kid you not, of viruses , worms , trojans and items related to this dam security master av,  all were removed , i am now round the bend as it is not in add remove program list , i cannot find it anywhere but it is in the windows security centre running the firewall and antivirus, i cannot download avg as it only gets halfway and tells me to uninstall this program , i cant , so i cant get avg, also i have run the removal tool found through google , didnt work, went through all the steps on two different websites to remove this and nothing has worked , 
now when i run malwarebytes, spybot SD etc , it comes up clean, but security master av is lurking on here somewhere , how can i find it and get rid , before i kill myself

Ambucias · Answer

Hello,

Very interesting problem you have there!

To fix the problem, I must have a Hyjacthis log.

http://free.antivirus.com/hijackthis/

Please download, install and request a scan and save a log.  Copy the log and post it here.

Regards

rubyg · Answer

thanks for trying to help i did this before on  advice of another website and was told to look for a certain entry whch i could not find in the list. hope you can see what the problem is :-
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:58:01, on 08/09/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Computer Updater\ComputerUp-daterService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\keyhook.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Computer Updater\ComputerUp-dater.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\sistray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.co.uk/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=53EEB45F21EA47F2B95DF58497B5E6B6
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=53EEB45F21EA47F2B95DF58497B5E6B6
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = a5cb934b8ee74
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Computer Updater] "C:\Program Files\Computer Updater\ComputerUp-dater.Exe" /boot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - (no file)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe (file missing)
O23 - Service: ComputerUpdater Service - SafeApp Software, LLC - C:\Program Files\Computer Updater\ComputerUp-daterService.exe

Ambucias · Answer

Hello Ruby

Yes there are other Web sites but there is Kioskea, the reference in IT forum

1. Please run another Hyjacthis scan but do not request a log.

2. Once the scan is finish, please check the following items:

R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O2 - BHO: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe (file missing)

3. Click fix checked and close Hyjackthis


Download, install and run Malwarebyte which you can find on this site: 

https://ccm.net/downloads/security-and-maintenance/4621-malwarebytes-anti-malware/ es-anti-malware 

Ensure you make an update.

Please request a FULL system scan, which may take from 20 minutes to hours.  Do not interfere no matter how long in takes.  The creators of Malwarebyte recommend that while the tool is running that you go do something else, such as watching a rerun of Gone with the Wind or read Tolstoy's War and Peace.

If Malwarebyte restarts your system, launch it again to finish the Full scan. 

When the scan is completed, delete all items found.

Once your computer is clean and working normally just to be on the safe side 
*Turn off system restore and wait 30 seconds, 
*Turn it back on and create a new restore point. 

This way it gets rid of anything bad that might have gotten saved in a restore point and you have a clean restore point to use in the near future if needed. 
Do not turn it off until your computer is clean and working normally because you might need to use it if something goes wrong during the clean-up process. 
It is better to go back to an infected restore point if something goes wrong then to not be able to undo changes that were damaging.

Please let me know the results.

rubyg · Answer

Thanks, i have done as you said with the hyjackthis , i already had malwarebytes so i have updated and now running full scan, will let you know what happens

rubyg · Answer

ok i am now going to kill myself idid the malwarebytes scan after fixing the stuff in hyjackthis then after the scan which didnt pick up anything :-
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4570

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

08/09/2010 13:15:29
mbam-log-2010-09-08 (13-15-29).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 133774
Time elapsed: 12 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

I then switched of system restore waited about 30 seconds and turned it back on then i started the avg for the umpteenth time and again it stopped and said;-some potentially incompatible software is currentlyinstalled to continuethe installation please remove the following application:- security master av . and sure enough it is still running as the firewall and antivirus in windows security centre in control panel maybe he should just chuck this and get a new laptop i am ready to throw it out the window. thanks for your help any more suggestions?

Ambucias · Answer

Hello,

Please, wait for my permission before killing yourself, I do not want to have you on my conscience for the rest of my life, do it only if you get my okay.

I am pretty sure now that we are dealing with a rogue trojan horse;

Please follow the following procedure carefully and to the letter. 

You have a rogue virus Trojan Horse which is self protective, thus it will prevent any antivirus from fonctionning. 

You must kill the evil processes which the virus is presently running amd preventing you from running any antivirus. If you don't it will keep reproducing the files for ever. 

To kill the processes: 

1. Download to your desktop and run Rogue Kill: 

https://download.bleepingcomputer.com/grinler/rkill.com 

2. You should now see a window that shows all of your desktop icons, including the rkill.com program. 

3. Double-click on the rkill.com in order to automatically attempt to stop any processes associated with the Rogue programs. Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next step. 

If you get a message that rkill is an infection, do not be concerned. This message is just a fake warning given by the Horse when it terminates programs that may potentially remove it. If you run into these infections warnings that close Rkill, a trick is to leave the warning on the screen and then run Rkill again. By not closing the warning, this typically will allow you to bypass the malware trying to protect itself so that rkill can terminate the processes . So, please try running Rkill until malware is no longer running. 

As a matter of a fact, if you get messages, it is a sign that the virus is agonizing with excrutiating pain, so you can just grin while it is suffering!:)))

Please, DO NOT REBOOT your computer or the processes will come back to haunt you! 

Then full scan again with Malwarebyte

After you are done, remember do not through yourself into the river or anything like that

rubyg · Answer

bac 
k again i followed the instructions rkill run without problems only takes seconds  i have used this yesterday and it gave same result i did not get any mesages or anything trying to stop me from running it:-
This log file is located at C:\rkill.log. 
Please post this only if requested to by the person helping you. 
Otherwise you can close this log when you wish. 
Ran as User on 08/09/2010 at 14:05:08. 


Services Stopped:


Processes terminated by Rkill or while it was running: 


C:\Documents and Settings\User\Desktop\rkill.com


Rkill completed on 08/09/2010  at 14:05:11. 

then i ran malwarebytes again ( i did not reboot or anything):-

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4570

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

08/09/2010 14:20:25
mbam-log-2010-09-08 (14-20-25).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 133823
Time elapsed: 12 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

rubyg · Answer

yes an yes i am not getting all the problems that were present when he gave me this laptop to hopefully fix it was redirecting web pages kept putting findgala website address in and getting pop ups etc but since i have used malwarebytes  superantispyware hyjackthis cc cleaner amongst others ( i have flung everything at it ) i am only having problems getting it to let go in windows security centre, i found a few websites directing you to kill processes in task manager and find certain files etc and delete them, i tired that but found i did not have the processes and following the paths for the files  i could not see any that matched what i was looking for back to square one do you think. barbequed laptop might be in order !

Ambucias · Answer

BBQ laptops taste awful, like cabonised plastic, it would be like killing yourself and I said not to do that.

I have two more solutions:

1. Run another Hyjackthis scan and delete the items that have reappeared, then...

READ CAREFULLY IF NOT, LIGHT-UP THE BBQ

Remedy one:

I shall prescribe to you a very powerfull antidote that is able to kill and send any virus to the glue factory. It is of very last resort and should not be abused of, as matter of a fact, once you have used it, I suggest you delete it from your system. 

To keep your system safe, you must follow the instructions hereunder to the letter: 

1. Download Combofix to your desktop. 

http://www.combofix.org/download.php 

2.Close all open Windows including this one. 

Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix. 

3. Double click on the ComboFix icon. 

Windows is issuing this prompt because ComboFix does not have a digital signature. This is perfectly normal and safe and you can click on the Run button to continue. 

4. Accept the disclaimer and the recovery 

5.You should now press the Yes button to continue. If at any time during the Recovery Console installation you receive a message stating that it failed to install, please allow ComboFix to continue with the scan of your computer. 

ComboFix will disconnect your computer from the Internet, so do not be surprised or concerned if you receive any warnings stating that you are no longer on the Internet. When ComboFix has finished it will automatically restore your Internet connection. 

While the program is scanning your computer, it will change your clock format, so do not be concerned when you see this happen. When ComboFix is finished it will restore your clock settings to their previous settings. 

If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt. 

During the process, please do not mouse click nor must you tap on the keyboard.  Let the tool run.

Once you are done, report to me on how your system is behaving. 

Good luck 

Ambucias

rubyg · Answer

ok i will give that a go, need to wait till this one is finished mind you

rubyg · Answer

you said to disable any antivirus and firewall , that might be a problem as i cannot sop the security master av that is what is running the firewall and antivirus just now and i have found no way to stop it, windows security centre reports i have two firewalls running as i had put the windows own one on but i cant see how to stop the other one or the antivirus

Ambucias · Answer

Hello Ruby, can you smell the plastic BBQing?

Sorry I did not reply immediatly for I had to log off, we all have a personal life.

You may feel that I am repeating thing but I have added a few things which will help.

I am sure of myselft for this solution also appears on other Websites such as the reputable Malware Bleeping Computer:

2.It is possible that the infection you are trying to remove will not allow you to download files on the infected computer. If this is the case, then you will need to download the files requested in this guide on another computer and then transfer them to the infected computer. You can transfer the files via a CD/DVD, external drive, or USB flash drive.


3.Before we can do anything we must first end the processes that belong to Security Master AV so that it does not interfere with the cleaning procedure. To do this, download the following file to your desktop.

rkill.com Download Link


4.Once it is downloaded, double-click on the rkill.com in order to automatically attempt to stop any processes associated with Security Master AV and other Rogue programs. Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next step. If you get a message that rkill is an infection, do not be concerned. This message is just a fake warning given by Security Master AV when it terminates programs that may potentially remove it. If you run into these infections warnings that close Rkill, a trick is to leave the warning on the screen and then run Rkill again. By not closing the warning, this typically will allow you to bypass the malware trying to protect itself so that rkill can terminate Security Master AV . So, please try running Rkill until the malware is no longer running. You will then be able to proceed with the rest of the guide. If you continue having problems running rkill.com, you can download iExplore.exe or eXplorer.exe, which are renamed copies of rkill.com, and try them instead.

Do not reboot your computer after running rkill as the malware programs will start again. 


5.Now you should download Malwarebytes' Anti-Malware, or MBAM, from the following location and save it to your desktop:

Malwarebytes' Anti-Malware Download Link (Download page will open in a new window)

6.Once downloaded, close all programs and Windows on your computer, including this one.

7.Double-click on the icon on your desktop named mbam-setup.exe. This will start the installation of MBAM onto your computer.

8.When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure you leave both the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware checked. Then click on the Finish button. If MalwareBytes' prompts you to reboot, please do not do so.

9.MBAM will now automatically start and you will see a message stating that you should update the program before performing a scan. As MBAM will automatically update itself after the install, you can press the OK button to close that box and you will now be at the main program as shown below.

10.On the Scanner tab, make sure the the Perform full scan option is selected and then click on the Scan button to start scanning your computer for Security Master AV related files.

11.MBAM will now start scanning your computer for malware. This process can take quite a while, so we suggest you go and do something else and periodically check on the status of the scan. When MBAM is scanning it will look like the image below.

12.When the scan is finished a message box will appear as shown in the image below. 

You should click on the OK button to close the message box and continue with the Security Master AV removal process.


13.You will now be back at the main Scanner screen. At this point you should click on the Show Results button.


14.A screen displaying all the malware that the program found will be shown as seen in the image below. Please note that the infections found may be different than what is shown in the image.

You should now click on the Remove Selected button to remove all the listed malware. MBAM will now delete all of the files and registry keys and add them to the programs quarantine. When removing the files, MBAM may require a reboot in order to remove some of them. If it displays a message stating that it needs to reboot, please allow it to do so. Once your computer has rebooted, and you are logged in, please continue with the rest of the steps.


15.When MBAM has finished removing the malware, it will open the scan log and display it in Notepad. Review the log as desired, and then close the Notepad window.


16.You can now exit the MBAM program.


17.As this infection also changes your Windows HOSTS file, we want to replace this file with the default version for your operating system. Please note that if you or your company has added custom entries to your HOSTS file then you will need to add them again after restoring the default HOSTS file. In order to protect itself, Security Master AV changes the permissions of the HOSTS file so you can't edit or delete it. To fix these permissions please download the following batch file and save it to your desktop:

Hostsperm.bat Download Link 
When the file has finished downloading, double-click on the hostsperm.bat file that is now on your desktop. If Windows asks if you if you are sure you want to run it, please allow it to run. Once it starts you will see a small black window that opens and then quickly goes away. This is normal and is nothing to be worried about. You should now be able to access your HOSTS file.


18.We now need to delete the C:\Windows\System32\Drivers\etc\HOSTS file. Once it is deleted, download the following HOSTS file that corresponds to your version of Windows and save it in the C:\Windows\System32\Drivers\etc folder. If the contents of the HOSTS file opens in your browser when you click on a link below then right-click on the appropriate link and select Save Target As..., if in Internet Explorer, or Save Link As.., if in Firefox, to download the file.

Windows XP HOSTS File Download Link
Windows Vista HOSTS File Download Link
Windows 2003 Server HOSTS File Download Link
Windows 2008 Server HOSTS File Download Link 
Windows 7 HOSTS File Download Link 
Your Windows HOSTS file should now be back to the default one from when Windows was first installed.

19.Now reboot your computer.

rubyg · Answer

I have been on the bleepingcomputer.com website and followed these instructions before i came on here , nothing changed , i am still left with security master av on the computer although all the pop ups and rediections have stopped , it is still in control of the firewall and antivirus and no way of switching it of 

 i have also been on the 2-virus.com and followed the list of task manager files , dll files to disable and registry files to remove , I DO NOT HAVE ANY , the task manager is not showing any of these files when i tried disabling the dll files it told me they were not found, and the registry does not have one single file that is in the list, i think the first run of malwarebytes removed all the files and registry stuff that was related to security master av but i still have the actual program/virus whatever it is on the computer and i cant get any other antivirus because of it
thank you for your help

Ambucias · Answer

Hello,

I reaxamined your HJT log, I can't see your antivirus programme.  Can you remind me what it is.
Which firewall are you using, Win or other?

Ambucias · Answer

You know what Ruby, I know understand why you wanted to BBQ your machine, but I would much prefer BBQ, live, the guy who concocted this virus.

Thank you for the reminder for there are so many threads to read, one may get a little lost.

I do hope that we will not be required to do a Windows repair for it may mean data lost.

1. I would like you to go to c:\ at the root, try to spot stand alone unsual files (not in a folder), often numeric and tell me what they are if any.

2. Please download, install and run this totally free but efficient registry cleaner.

https://www.eusing.com/free_registry_cleaner/registry_cleaner.htm

Before you delete the registry entries and there could be a ton, you may be able to spot the virus in local machine.

Gervarod · Answer

hello have you tried to disconnect your laptop from the internet before loading these programs that you put on a CD or a usb drive as you should know the rouge virus may be download and updating files for your computer to be harder to remove these files what are you using XP Vista or Windows7? but on thing is make sure you have another computer near you like one of your friends or parents. 

hope you have not BBQ your laptop or killed your self. as i and Ambucias can help you.

Cheers, Gervarod

rubyg · Answer

I tried to do a system recovery and found that the option which is supposed to be in START- PROGS-SYSTEM RECOVERY , is not there, also should be able to access it via F10 on start up but it did not come up, it is an Advent 7086 with xp OEM so the xp is preloaded and he did not get xp cd with it, i was just going to wipe the lot ,, he agreed to me doing that, but now i cant even do that at least he would have a fresh pc, i am going to download all the anti virus , malwarebytes etc  on my pc and put them on cd to transfer to his laptop see if that makes any difference, when i click on windows security centre and expand the firewall it says at least one of the firewalls on your computer iscurrently ON, and goes on to say two firewalls runnign  at the same time can conflict with each other, the only one i can turn of is the windows one !when i expand the antivirus  this is what it says , security master av reports that it is up to date and virus scanning is on, where the heck is it running from , thats what i need to find out, i have checked and double checked , for processes relating to this in task manager and they are never there, how is it running without the processes showing up !

rubyg · Answer

ok i deleted all the progs i downloaded on here and downloaded them on my pc and put them on cd and transfered back on here malwarebytes still comes up clean hyjackthis log :- 
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 09:14:04, on 10/09/2010
Platform: Windows XP SP3 (WinNT 5.01.2600) 
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\keyhook.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\sistray.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.co.uk/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=53EEB45F21EA47F2B95DF58497B5E6B6
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=53EEB45F21EA47F2B95DF58497B5E6B6
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = a5cb934b8ee74
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - (no file)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

Ambucias · Answer

Please run another HJT scan and remove:

O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - (no file)

I suggested to you to run the registry cleaner and to look in to your C for suspicious files.  Did you?

Can you put a name on the other firewall?

You said that your XP was preinstalled, mine was too, yet one must never purchase a computer without the disc.

Do you have any precious data which you have not backed-up?

rubyg · Answer

I will run the hyjackthis again and do as you said, have not run the registry 
cleaner but i will do, and i have searched through the C drive but everything there
looks like it belongs, i will have another look,
the other firewall is windows own
 his xp was preinstalled , usually with OEM pc's you need to make your own backup dvd's right away, laptops usually have a seperate partition with the recovery media , but you can usually still make recovery dvd, he did not do this,
 i am back at work just now so it will be difficult to get much done ,
 thank you for your patience, and no , he does not have very much on it , lots of 3gp mobile videos and a few pictures but nothing he cant replace, t

rubyg · Answer

Hi again,i have deleted that entry in hyjackthis, i have also run th registry cleaner and deleted what it found, i could not see anything that looked like it was related to security master av, anyway it is still there after deleting them
Also i have went into C :\document and settings\administrator\application data, there were 3 folders in ther , adobe, microsot and macromedia, the microsoft one contains two folders , one called protect which has only this inside S-1-5-21-484763869-6820033 and one called credentials S-1-5-21-484763869-6820033, both as you can see have same numbers, you will know better what they are , ok ive discovered they are in the user folder too so maybe they are genuine

rubyg · Answer

The firewalls running are windows own firewall and the security manager av , that one i cant switch off, but i can switch off the windows one

click on credentials folder and it is another folder with this long number, hold mouse over it says folder is empty and right click - properties says , file folder gives the address where it is, size  0 bytes, size on disc 0 bytes contains no files no folders ,  in the other folder protect open that and it is another folder with same number right click properties and it says , file folder gives right address where it is , size 412bytes(412bytes) size n disc 8.00kb (8.192 bytes) contains 2 files , 0 folders, i thought that was odd as when i open that folder i cant see 2 files , it doesn't have anything in it 

when i open C the first things inside are documents and settings folder- program files, windows , and rkill txt document is the only item on its own, program files folder does not have anything out of a folder all the folders there i know what they are, the windows folder could be anything in there , there is so much i wouldnt know what was out of place

rubyg · Answer

hello and thanks  i clicked on the link but it is not working in internet explorer it says the webpage cannot be found i also tired on my pc with google chrome and i just got a blank page .sorry i was dying to try it too!

Ambucias · Answer

Hello Ruby,

Why would you want to turn off the Windows Firewall?

Have you tried now to install your antivirus?  Just a though that now that you cleaned the registry you may be able to.

We are going to get through this wont we?  I think that we are close to a final solution.  Hang in there!

rubyg · Answer

Got it that time i am sure i have done this before i searched google before i came on this site and one of the things that came up was security master av removal tool which i downloaded i recognised the icon when i downloaded it again just now but i did it again anyway just in case . I took a screenshot of control panel to let you see it is still there but  i cant find a way to paste it in here.  i am thinking it is not going to go. he will have to buy new laptop and be more careful. thanks for trying to help

Ambucias · Answer

Hold on Ruby!

You must be rich to go out and buy a new laptop.  If you do, sent me the one you have and I will get it working.

You told me that the virus was gone, but the Master AV firewall was there and that you could not install AVg.  Those are miner problems.

Ambucias · Answer

Ruby, Ruby, Ruby,

Are you patient?  What Kioskea would not do to salvage a cool guy's laptop.  From what I gather from your accent, you must be one of Her Majesty's Elizabeth The Second beloved subjects, so nothing can be spared.

I will expedite a personal message to my virus/security mentor at Kioskea's General Headquarters. (Yes I can do that for I have connexions)  His member name is gene-hackman.  He may not respond to you directly for he is from France.

Can you wait or to you want to BBQ the laptop and throw yourself in the Thames River?

rubyg · Answer

Well i am from Scotland actually, and i will try and wait, as it is not my computer i will ask the guy who it belongs to to wait, i would love to fix it , it is seriously annoying me that this is running and i cant find out where it is hiding

gen-hackman · Answer

hello   

i think it's a good thing to deinstall Spybot search and destroy   

it'not so good as a few years   

 OFF YOUR ANTIVIRUS  AND IF YOUR PRESENT Firewall !!!!! (because it is wrongly detected as infected)   

? Download here:  List_Kill'em   

 and saves it on your desktop    

  if you have XP => double click   
if you have Vista or Windows 7 => right click "execute as ...."   

on the shortcut on your desktop to start installation   

Let checked:   

? Run List_Kill'em   

Once completed, click "Finish" and the program will run only   

He will begin download and install the updates, then give you the menu   

selected the option  Search    

? leave work tool   

 there may be a dialog box opens, in this case click on "ok" or "Agree" 

the appearance of the white window is a bit long, it's normal, it's an additional search for hidden files, the program is not blocked.   

? Post the content of the report that opens to 100% of the screen to scan  "COMPLETED"    

? ? ? DO NOT POST ON THE FORUM    

To send me click on this link: http://www.cijoint.fr/   

? Click on Browse and look for the file C: \ List'em. Txt   

? Click Open.   

? Click on "Click here to submit the file".   

A link to this form:   

Http://www.cijoint.fr/cjlink.php?file=265368/cijSKAP5fU.txt   

is added to the page.   

?  Copy this link  in your answer.   

? Do the same more.txt located on your desktop   

if the link doesn't works , we'll try another temporary link 

¤¤¤¤¤¤?G3?-?@¢??@?(TM)©®?¤¤¤¤¤&#164

gen-hackman · Answer

it could be cool if only the person who took this topic at the beginning , could continue , and like this , to go on the same way

Thanks

rubyg · Answer

Thanks , i have been through this lot before, i DONT have ANY of those processes, nor do i have any of the DLL files , i have been through the registry CAREFULLY and there were no registry values corresponding to the ones in the list, i also do not have any of the folders described in C:Documentsandsettings\ All users\application data, nothing with numbers like that , 
 what i have found last night though was this on My Anti Spyware site, seems a lot of folk have went through what i have and are left with same as me, security master av still in control of firewall and antivirus in windows security center, i found these instructions :-  Click Start, Run.
Type wbemtest and press Enter.
Windows Management Instrumentation Tester opens.
Click Connect... button.
Type root\SecurityCenter and press Enter.
Click to Query button.
Type SELECT * FROM AntiVirusProduct and click on Apply button.
If there is more than one result, it means there is more than one Antivirus program installed. Double click on each result to view the properties for that Antivirus product.
Identify the product(s) installed and DELETE any records that associated with Security Master AV.

I followed these and deleted the line:- displayName CIM_STRING Security Master AV then closed that and went and did the same for the firewall after doing SELECT * FROM firewallproduct, found same entry for security master av and deleted the line, closed out of the  Windows Management Instrumentation Tester and lo and behold the thing is STILL there

gen-hackman · Answer

ok ambucias called me to help you 

please do that :

https://ccm.net/forum/affich-464249-security-master-av-removal?page=2#42

Ambucias · Answer

Hello, Ruby,

You must follow Gen-Hackman's advice, he the top notch virus expert in all of Kioskea's forums in all languages and he has been for many years. Nothing resists him, that's why I called on him.

I would now respectfully request Jack4all and Gervarod to withdraw from this thread and let gen-hackman take over.  Thank yu guys.

P.S. Gen-Hackman is French so when he writes "execute" it means run.

You are in good hands now.

rubyg · Answer

thank you i followed gene hackmans request downloaded the list_kill'em thing let it scan and have the results in notepad saved but i got stuck trying to send them i clicked on the first link to send the file but could not find the "click here to submit the file " link so i am stuck  i have the scan but dont know how to send it !
 
also you said to switch off my antivirus and firewall but i cannot switch it off  . i have uninstalled spybot SD

rubyg · Answer

Ok , i went back on to the first link and posted the list'em txt file, this time i am sure i clicked on the correct link after i submitted the file, it is the second link in gene hackmans post , i found this on the page, i then did the same with the more file he wanted, which i missed first time as i did not realise it was there, i am struggling a wee bit with the trying to follow what he says but i AM grateful for the help, i just hope i have done it right this time

gen-hackman · Answer

hello

not done right !! ^^ it doesn't matter

copy what contains the txt files here (for more.txt , you'll have to cut it into 3 pieces or 4 cause it's very long)

perhaps you'll have to cut List'em.txt into 2 pieces

rubyg · Answer

sorry i thought i had done it right
log file:- 
¤¤¤¤¤¤¤¤¤¤ List'em by g3n-h@ckm@n 2.1.0.5 ¤¤¤¤¤¤¤¤¤¤

User : User (Administrators) 
Update on 12/09/2010 by g3n-h@ckm@n ::::: 16.00
Start at: 21:39:41 | 12/09/2010

Intel(R) Celeron(R) M processor         1.40GHz
Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : Security Master AV  [ Enabled | Updated ]
FW : Security Master AV[ Enabled ]

C:\ -> Local Fixed Disk | 37.25 Go (32.41 Go free) | NTFS
D:\ -> CD-ROM Disc
 
Boot: Normal 

¤¤¤¤¤¤ Processes ------- Memory(Ko) ------- Priority ------ Command ------- Signer


C:\WINDOWS\System32\smss.exe ---- 288 Ko ---- Normal ---- \SystemRoot\System32\smss.exe ---- 
C:\WINDOWS\system32\csrss.exe ---- 3140 Ko ---- Normal ---- C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 ---- 
C:\WINDOWS\system32\winlogon.exe ---- 2388 Ko ---- High ---- winlogon.exe ---- 
C:\WINDOWS\system32\services.exe ---- 2704 Ko ---- Normal ---- C:\WINDOWS\system32\services.exe ---- 
C:\WINDOWS\system32\lsass.exe ---- 1812 Ko ---- Normal ---- C:\WINDOWS\system32\lsass.exe ---- 
C:\WINDOWS\system32\svchost.exe ---- 3144 Ko ---- Normal ---- C:\WINDOWS\system32\svchost -k DcomLaunch ---- 
C:\WINDOWS\system32\svchost.exe ---- 2692 Ko ---- Normal ---- C:\WINDOWS\system32\svchost -k rpcss ---- 
C:\WINDOWS\System32\svchost.exe ---- 18364 Ko ---- Normal ---- C:\WINDOWS\System32\svchost.exe -k netsvcs ---- 
C:\WINDOWS\system32\svchost.exe ---- 2588 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k NetworkService ---- 
C:\WINDOWS\system32\svchost.exe ---- 4556 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k LocalService ---- 
C:\WINDOWS\Explorer.EXE ---- 15676 Ko ---- Normal ---- C:\WINDOWS\Explorer.EXE ---- 
C:\WINDOWS\system32\spoolsv.exe ---- 2880 Ko ---- Normal ---- C:\WINDOWS\system32\spoolsv.exe ---- 
C:\WINDOWS\system32\svchost.exe ---- 2744 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k LocalService ---- 
C:\WINDOWS\system32\svchost.exe ---- 2220 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k imgsvc ---- 
C:\WINDOWS\system32\wuauclt.exe ---- 4860 Ko ---- Normal ---- "C:\WINDOWS\system32\wuauclt.exe" /RunStoreAsComServer Local\[3a4]SUSDSd631f55fce4fdd4d83862af4f84345d6 ---- Microsoft Windows Component Publisher
C:\WINDOWS\AGRSMMSG.exe ---- 1628 Ko ---- Normal ---- "C:\WINDOWS\AGRSMMSG.exe"  ---- 
C:\WINDOWS\system32\keyhook.exe ---- 2472 Ko ---- Normal ---- "C:\WINDOWS\system32\keyhook.exe"  ---- 
C:\Program Files\Messenger\msmsgs.exe ---- 1468 Ko ---- Normal ---- "C:\Program Files\Messenger\msmsgs.exe" /background ---- 
C:\WINDOWS\system32\sistray.exe ---- 2404 Ko ---- Normal ---- "C:\WINDOWS\system32\sistray.exe"  ---- 
C:\WINDOWS\System32\alg.exe ---- 2596 Ko ---- Normal ---- C:\WINDOWS\System32\alg.exe ---- 
C:\WINDOWS\System32\svchost.exe ---- 2400 Ko ---- Normal ---- C:\WINDOWS\System32\svchost.exe -k HTTPFilter ---- 
C:\Program Files\Internet Explorer\iexplore.exe ---- 3028 Ko ---- Normal ---- "C:\Program Files\Internet Explorer\iexplore.exe"  ---- Microsoft Corporation
C:\WINDOWS\system32\cmd.exe ---- 2784 Ko ---- Normal ---- C:\WINDOWS\system32\cmd.exe  /K List'em.bat ---- 
C:\WINDOWS\system32\wbem\wmiprvse.exe ---- 6784 Ko ---- Normal ---- C:\WINDOWS\system32\wbem\wmiprvse.exe ---- 
C:\Program Files\List_Kill'em\pv.exe ---- 2672 Ko ---- Normal ---- pv -o"%f ---- %m Ko ---- %p ---- %l ---- %s" ---- 


¤¤¤¤¤¤¤¤¤¤ Keys "Run" ¤¤¤¤¤¤¤¤¤¤

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
MSMSGS	=         	"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
AGRSMMSG	=         	AGRSMMSG.exe 
SiS Windows KeyHook	=         	C:\WINDOWS\system32\keyhook.exe 
 
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

¤¤¤¤¤¤¤¤¤¤ Other System Keys ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] 
dontdisplaylastusername	=      	0 (0x0) 
legalnoticecaption	=         	 
legalnoticetext	=         	 
shutdownwithoutlogon	=      	1 (0x1) 
undockwithoutlogon	=      	1 (0x1) 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
NoDriveTypeAutoRun	=      	145 (0x91) 
NoRun	=      	0 (0x0) 
NoFind	=      	0 (0x0) 
NoLogOff	=      	0 (0x0) 
NoSetFolders	=      	0 (0x0) 
DisallowRun	=      	0 (0x0) 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
HonorAutoRunSetting	=      	1 (0x1) 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS	=         	

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 
 AutoRestartShell	=      	1 (0x1) 
 DefaultDomainName	=         	USER-5EE492C982 
 DefaultUserName	=         	User 
 LegalNoticeCaption	=         	 
 LegalNoticeText	=         	 
 PowerdownAfterShutdown	=         	0 
 ReportBootOk	=         	1 
 Shell	=         	Explorer.exe 
 ShutdownWithoutLogon	=         	0 
 System	=         	 
 Userinit	=         	C:\WINDOWS\system32\userinit.exe, 
 VmApplet	=         	rundll32 shell32,Control_RunDLL "sysdm.cpl" 
 SfcQuota	=      	-1 (0xffffffff) 
 allocatecdroms	=         	0 
 allocatedasd	=         	0 
 allocatefloppies	=         	0 
 cachedlogonscount	=         	10 
 forceunlocklogon	=      	0 (0x0) 
 passwordexpirywarning	=      	14 (0xe) 
 scremoveoption	=         	0 
 AllowMultipleTSSessions	=      	1 (0x1) 
 UIHost	=  	logonui.exe 
 LogonType	=      	1 (0x1) 
 Background	=         	0 0 0 
 DebugServerCommand	=         	no 
 SFCDisable	=      	0 (0x0) 
 WinStationsDisabled	=         	0 
 HibernationPreviouslyEnabled	=      	1 (0x1) 
 ShowLogonOptions	=      	0 (0x0) 
 AltDefaultUserName	=         	User 
 AltDefaultDomainName	=         	USER-5EE492C982 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972}	=         	 
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}	=         	 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\Network Diagnostic\xpnetdiag.exe	=         	%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
%windir%\system32\sessmgr.exe	=         	%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Documents and Settings\All Users\Application Data\b96b196\SMb96b_302.exe	=         	C:\Documents and Settings\All Users\Application Data\b96b196\SMb96b_302.exe:*:Disabled:Security Master AV

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\Network Diagnostic\xpnetdiag.exe	=         	%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
%windir%\system32\sessmgr.exe	=         	%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019

¤¤¤¤¤¤¤¤¤¤ ActivX | COM ¤¤¤¤¤¤¤¤¤¤


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]

¤¤¤¤¤¤¤¤¤¤ BHO ¤¤¤¤¤¤¤¤¤¤


¤¤¤¤¤¤¤¤¤¤ DNS ¤¤¤¤¤¤¤¤¤¤

HKLM\SYSTEM\CCS\Services\Tcpip\..\{60A12CB4-6B62-48C9-983F-51747FD3AD92}: DhcpNameServer=192.168.1.254 
HKLM\SYSTEM\CS2\Services\Tcpip\..\{60A12CB4-6B62-48C9-983F-51747FD3AD92}: DhcpNameServer=192.168.1.254 
HKLM\SYSTEM\CS3\Services\Tcpip\..\{60A12CB4-6B62-48C9-983F-51747FD3AD92}: DhcpNameServer=192.168.1.254 
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254 
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254 
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254 


¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	=         	https://www.msn.com/fr-fr/?ocid=iehp
Default_Search_URL	=         	https://www.bing.com/?toHttps=1&redig=53EEB45F21EA47F2B95DF58497B5E6B6
Default_Page_URL	=         	https://www.msn.com/fr-fr/?ocid=iehp
Search Page	=         	https://www.bing.com/?toHttps=1&redig=53EEB45F21EA47F2B95DF58497B5E6B6

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	=         	https://www.google.co.uk/?gws_rd=ssl
Search Page	=         	http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

¤¤¤¤¤ Proxy Internet Explorer

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
ProxyEnable	=      	0 (0x0)


¤¤¤¤¤¤¤¤¤¤ Proxy Firefox ¤¤¤¤¤¤¤¤¤¤
 

¤¤¤¤¤¤¤¤¤¤ TaskCache ¤¤¤¤¤¤¤¤¤¤


¤¤¤¤¤¤¤¤¤¤ IFEO ¤¤¤¤¤¤¤¤¤¤


¤¤¤¤¤¤¤¤¤¤ File Protection ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection] 

¤¤¤¤¤¤¤¤¤¤ Safemode ¤¤¤¤¤¤¤¤¤¤

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!  
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!  
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!  
 
¤¤¤¤¤¤¤¤¤¤ Atapi.sys ¤¤¤¤¤¤¤¤¤¤

C:\WINDOWS\system32\drivers\atapi.sys : 
[MD5.9f3a2f5aa6875c72bf062c712cfa2674]
[SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]
 
¤¤¤¤¤ Reference 

Win 2000_SP2   : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4   : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b     : a64013e98426e1877cb653685c5c0009
Win XP_SP1_32b : 95b858761a00e1d4f81f79a0da019aca
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b      : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b  : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b  : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b  : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b  : 338c86357871c167a96ab976519bf59e
Windows 7_64b  : 02062C0B390B7729EDC9E69C680A6F3C
 
¤¤¤¤¤¤¤¤¤¤ Drive ¤¤¤¤¤¤¤¤¤¤

Windows Disk Defragmenter
Copyright (c) 2001 Microsoft Corp. and Executive Software International, Inc.

Analysis Report                   	 
    37.25 GB Total,  32.41 GB (86%) Free,  14% Fragmented (28% file fragmentation)

You should defragment this volume. 	 

¤¤¤¤¤¤¤¤¤¤ Mountpoints2 ¤¤¤¤¤¤¤¤¤¤
 
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\e\shell\autorun  
@	=         	Auto&Play  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\e\shell\autorun\command  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\e\shell\autorun\command  
@	=         	E:\AutoRun.exe  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{141be38c-1d4f-11de-aca1-0016ec0068d5}\shell\autorun  
@	=         	Auto&Play  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{141be38c-1d4f-11de-aca1-0016ec0068d5}\shell\autorun\command  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{141be38c-1d4f-11de-aca1-0016ec0068d5}\shell\autorun\command  
@	=         	E:\AutoRun.exe  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{141be38e-1d4f-11de-aca1-0016ec0068d5}\shell\autorun  
@	=         	Auto&Play  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{141be38e-1d4f-11de-aca1-0016ec0068d5}\shell\autorun\command  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{141be38e-1d4f-11de-aca1-0016ec0068d5}\shell\autorun\command  
@	=         	E:\AutoRun.exe  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{141be38f-1d4f-11de-aca1-0016ec0068d5}\shell\autorun  
@	=         	Auto&Play  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{141be38f-1d4f-11de-aca1-0016ec0068d5}\shell\autorun\command  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{141be38f-1d4f-11de-aca1-0016ec0068d5}\shell\autorun\command  
@	=         	E:\AutoRun.exe  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{33f8aa68-1265-11de-ac94-0016ec0068d5}\shell\autorun  
@	=         	Auto&Play  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{33f8aa68-1265-11de-ac94-0016ec0068d5}\shell\autorun\command  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{33f8aa68-1265-11de-ac94-0016ec0068d5}\shell\autorun\command  
@	=         	E:\AutoRun.exe  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{523723ba-3a74-11de-acd5-0016ec0068d5}\shell\autorun  
@	=         	Auto&Play  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{523723ba-3a74-11de-acd5-0016ec0068d5}\shell\autorun\command  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{523723ba-3a74-11de-acd5-0016ec0068d5}\shell\autorun\command  
@	=         	E:\AutoRun.exe  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{911416aa-10c2-11de-ac8c-0016ec0068d5}\shell\autorun  
@	=         	Auto&Play  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{911416aa-10c2-11de-ac8c-0016ec0068d5}\shell\autorun\command  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{911416aa-10c2-11de-ac8c-0016ec0068d5}\shell\autorun\command  
@	=         	E:\AutoRun.exe  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{911416ac-10c2-11de-ac8c-0016ec0068d5}\shell\autorun  
@	=         	Auto&Play  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{911416ac-10c2-11de-ac8c-0016ec0068d5}\shell\autorun\command  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{911416ac-10c2-11de-ac8c-0016ec0068d5}\shell\autorun\command  
@	=         	E:\AutoRun.exe  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{92fe82e4-1163-11de-ac90-0016ec0068d5}\shell\autorun  
@	=         	Auto&Play  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{92fe82e4-1163-11de-ac90-0016ec0068d5}\shell\autorun\command  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{92fe82e4-1163-11de-ac90-0016ec0068d5}\shell\autorun\command  
@	=         	E:\AutoRun.exe  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{92fe82e5-1163-11de-ac90-0016ec0068d5}\shell\autorun  
@	=         	Auto&Play  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{92fe82e5-1163-11de-ac90-0016ec0068d5}\shell\autorun\command  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{92fe82e5-1163-11de-ac90-0016ec0068d5}\shell\autorun\command  
@	=         	E:\setup_vmc_lite.exe /checkApplicationPresence  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9d9112a2-34f3-11de-accc-0016ec0068d5}\shell\autorun  
@	=         	Auto&Play  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9d9112a2-34f3-11de-accc-0016ec0068d5}\shell\autorun\command  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9d9112a2-34f3-11de-accc-0016ec0068d5}\shell\autorun\command  
@	=         	E:\AutoRun.exe  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af2ef061-7e86-11de-ad05-0016ec0068d5}\shell\autorun  
@	=         	Auto&Play  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af2ef061-7e86-11de-ad05-0016ec0068d5}\shell\autorun\command  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af2ef061-7e86-11de-ad05-0016ec0068d5}\shell\autorun\command  
@	=         	E:\VersionControl.exe  
 
¤¤¤¤¤¤¤¤¤¤ Rogues Infections ¤¤¤¤¤¤¤¤¤¤
 

¤¤¤¤¤¤¤¤¤¤ Files/folders ¤¤¤¤¤¤¤¤¤¤

Present !! : C:\WINDOWS\SET3.tmp  
Present !! : C:\WINDOWS\SET4.tmp  
Present !! : C:\WINDOWS\SET8.tmp  
Present !! : C:\WINDOWS\Temp\~DF8F3E.tmp  
Present !! : C:\WINDOWS\Temp\~DFC35F.tmp  
Present !! : C:\WINDOWS\Temp\~DFD7A0.tmp  
Present !! : C:\WINDOWS\Temp\~DFDE84.tmp  
Present !! : C:\WINDOWS\Temp\~DFDF8E.tmp  
Present !! : C:\WINDOWS\Temp\~DFDFCC.tmp  
Present !! : C:\WINDOWS\Temp\~DFE23E.tmp  
Present !! : C:\WINDOWS\Temp\~DFE240.tmp  
Present !! : C:\WINDOWS\Temp\~DFE2D1.tmp  
Present !! : C:\WINDOWS\Temp\~DFE4DA.tmp  
Present !! : C:\WINDOWS\Temp\~DFE625.tmp  
Present !! : C:\WINDOWS\Temp\~DFE6B8.tmp  
Present !! : C:\WINDOWS\Temp\~DFE83A.tmp  
Present !! : C:\WINDOWS\Temp\~DFE83C.tmp  
Present !! : C:\WINDOWS\Temp\~DFE846.tmp  
Present !! : C:\WINDOWS\Temp\~DFEB9C.tmp  
Present !! : C:\WINDOWS\Temp\~DFEBA2.tmp  
Present !! : C:\WINDOWS\Temp\~DFECD4.tmp  
Present !! : C:\WINDOWS\Temp\~DFF5B1.tmp  
Present !! : C:\Documents and Settings\User\LOCAL Settings\Temp\SSUPDATE.EXE  
Present !! : C:\Documents and Settings\User\LOCAL Settings\Temp\SysConfig.dat  
 
¤¤¤¤¤¤¤¤¤¤ Keys : 

Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {0E5CBF21-D15F-11D0-8301-00AA005B4383}  
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : DisallowRun  
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoFind  
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoLogoff  
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoRun  
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoSetFolders  

FEATURE_BROWSER_EMULATION | svchost : 
====================================
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-12 21:53:31
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 
kernel: MBR read successfully
user & kernel MBR OK 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] 
FirstRunDisabled	=      	1 (0x1) 
AntiVirusDisableNotify	=      	0 (0x0) 
FirewallDisableNotify	=      	0 (0x0) 
UpdatesDisableNotify	=      	0 (0x0) 
AntiVirusOverride	=      	0 (0x0) 
FirewallOverride	=      	0 (0x0) 
AntiSpywareOverride	=      	0 (0x0) 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 21:54:04.84

rubyg · Answer

more file:-

¤¤¤¤¤¤¤¤¤¤ More informations ¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤ DLLs ¤¤¤¤¤¤¤¤¤¤

------------------------------------------------------------------------------ 
explorer.exe pid: 1408 
Command line: C:\WINDOWS\Explorer.EXE 
Base        Size      Version	        Path 
0x01000000  0xff000   6.00.2900.5512  C:\WINDOWS\Explorer.EXE 
0x7c900000  0xb2000   5.01.2600.5755  C:\WINDOWS\system32
tdll.dll 
0x7c800000  0xf6000   5.01.2600.5781  C:\WINDOWS\system32\kernel32.dll 
0x77dd0000  0x9b000   5.01.2600.5755  C:\WINDOWS\system32\ADVAPI32.dll 
0x77e70000  0x92000   5.01.2600.5795  C:\WINDOWS\system32\RPCRT4.dll 
0x77fe0000  0x11000   5.01.2600.5834  C:\WINDOWS\system32\Secur32.dll 
0x75f80000  0xfd000   6.00.2900.6003  C:\WINDOWS\system32\BROWSEUI.dll 
0x77f10000  0x49000   5.01.2600.5698  C:\WINDOWS\system32\GDI32.dll 
0x7e410000  0x91000   5.01.2600.5512  C:\WINDOWS\system32\USER32.dll 
0x77c10000  0x58000   7.00.2600.5512  C:\WINDOWS\system32\msvcrt.dll 
0x774e0000  0x13d000  5.01.2600.5512  C:\WINDOWS\system32\ole32.dll 
0x77f60000  0x76000   6.00.2900.5912  C:\WINDOWS\system32\SHLWAPI.dll 
0x77120000  0x8b000   5.01.2600.5512  C:\WINDOWS\system32\OLEAUT32.dll 
0x7e290000  0x173000  6.00.2900.6003  C:\WINDOWS\system32\SHDOCVW.dll 
0x77a80000  0x95000   5.131.2600.5512  C:\WINDOWS\system32\CRYPT32.dll 
0x77b20000  0x12000   5.01.2600.5875  C:\WINDOWS\system32\MSASN1.dll 
0x754d0000  0x80000   5.131.2600.5512  C:\WINDOWS\system32\CRYPTUI.dll 
0x5b860000  0x55000   5.01.2600.5694  C:\WINDOWS\system32\NETAPI32.dll 
0x77c00000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\VERSION.dll 
0x3d930000  0xe6000   8.00.6001.18939  C:\WINDOWS\system32\WININET.dll 
0x00400000  0x9000    6.00.5441.0000  C:\WINDOWS\system32\Normaliz.dll 
0x78130000  0x133000  8.00.6001.18939  C:\WINDOWS\system32\urlmon.dll 
0x3dfd0000  0x1e8000  8.00.6001.18939  C:\WINDOWS\system32\iertutil.dll 
0x76c30000  0x2e000   5.131.2600.5922  C:\WINDOWS\system32\WINTRUST.dll 
0x76c90000  0x28000   5.01.2600.5512  C:\WINDOWS\system32\IMAGEHLP.dll 
0x76f60000  0x2c000   5.01.2600.5512  C:\WINDOWS\system32\WLDAP32.dll 
0x7c9c0000  0x817000  6.00.2900.6018  C:\WINDOWS\system32\SHELL32.dll 
0x5ad70000  0x38000   6.00.2900.5512  C:\WINDOWS\system32\UxTheme.dll 
0x5cb70000  0x26000   5.01.2600.5512  C:\WINDOWS\system32\ShimEng.dll 
0x6f880000  0x1ca000  5.01.2600.5512  C:\WINDOWS\AppPatch\AcGenral.DLL 
0x76b40000  0x2d000   5.01.2600.5512  C:\WINDOWS\system32\WINMM.dll 
0x77be0000  0x15000   5.01.2600.5512  C:\WINDOWS\system32\MSACM32.dll 
0x769c0000  0xb4000   5.01.2600.5512  C:\WINDOWS\system32\USERENV.dll 
0x76390000  0x1d000   5.01.2600.5512  C:\WINDOWS\system32\IMM32.DLL 
0x773d0000  0x103000  6.00.2900.5512  C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll 
0x5d090000  0x9a000   5.82.2900.5512  C:\WINDOWS\system32\comctl32.dll 
0x755c0000  0x2e000   5.01.2600.5512  C:\WINDOWS\system32\msctfime.ime 
0x77b40000  0x22000   5.01.2600.5512  C:\WINDOWS\system32\appHelp.dll 
0x76fd0000  0x7f000   2001.12.4414.0700  C:\WINDOWS\system32\CLBCATQ.DLL 
0x77050000  0xc5000   2001.12.4414.0700  C:\WINDOWS\system32\COMRes.dll 
0x77a20000  0x54000   5.01.2600.5512  C:\WINDOWS\System32\cscui.dll 
0x76600000  0x1d000   5.01.2600.5512  C:\WINDOWS\System32\CSCDLL.dll 
0x5ba60000  0x71000   6.00.2900.5512  C:\WINDOWS\system32	hemeui.dll 
0x76380000  0x5000    5.01.2600.5512  C:\WINDOWS\system32\MSIMG32.dll 
0x00d00000  0x2c5000  5.01.2600.5512  C:\WINDOWS\system32\xpsp2res.dll 
0x71d40000  0x1b000   6.00.2900.5512  C:\WINDOWS\system32\actxprxy.dll 
0x71bf0000  0x13000   5.01.2600.5512  C:\WINDOWS\system32\SAMLIB.dll 
0x77920000  0xf3000   5.01.2600.5512  C:\WINDOWS\system32\SETUPAPI.dll 
0x76980000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\LINKINFO.dll 
0x76990000  0x25000   5.01.2600.5512  C:\WINDOWS\system32
tshrui.dll 
0x76b20000  0x11000   3.05.2284.0002  C:\WINDOWS\system32\ATL.DLL 
0x3e1c0000  0xa94000  8.00.6001.18939  C:\WINDOWS\system32\ieframe.dll 
0x7d1e0000  0x2bc000  3.01.4001.5512  C:\WINDOWS\system32\msi.dll 
0x76400000  0x1a5000  5.01.2600.5512  C:\WINDOWS\system32\NETSHELL.dll 
0x76c00000  0x2e000   5.01.2600.5512  C:\WINDOWS\system32\credui.dll 
0x478c0000  0xa000    5.01.2600.5512  C:\WINDOWS\system32\dot3api.dll 
0x76e80000  0xe000    5.01.2600.5512  C:\WINDOWS\system32tutils.dll 
0x736d0000  0x6000    5.01.2600.5512  C:\WINDOWS\system32\dot3dlg.dll 
0x5dca0000  0x28000   5.01.2600.5512  C:\WINDOWS\system32\OneX.DLL 
0x76f50000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\WTSAPI32.dll 
0x76360000  0x10000   5.01.2600.5512  C:\WINDOWS\system32\WINSTA.dll 
0x745b0000  0x22000   5.01.2600.5512  C:\WINDOWS\system32\eappcfg.dll 
0x76080000  0x65000   6.02.3104.0000  C:\WINDOWS\system32\MSVCP60.dll 
0x5dcd0000  0xe000    5.01.2600.5512  C:\WINDOWS\system32\eappprxy.dll 
0x76d60000  0x19000   5.01.2600.5512  C:\WINDOWS\system32\iphlpapi.dll 
0x71ab0000  0x17000   5.01.2600.5512  C:\WINDOWS\system32\WS2_32.dll 
0x71aa0000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\WS2HELP.dll 
0x68000000  0x36000   5.01.2600.5507  C:\WINDOWS\system32saenh.dll 
0x00c90000  0x3d000   8.00.6001.18702  C:\WINDOWS\system32\webcheck.dll 
0x75cf0000  0x91000   6.00.2900.5512  C:\WINDOWS\system32\MLANG.dll 
0x76280000  0x21000   5.01.2600.5512  C:\WINDOWS\system32\stobject.dll 
0x74af0000  0xa000    6.00.2900.5512  C:\WINDOWS\system32\BatMeter.dll 
0x74ad0000  0x8000    6.00.2900.5512  C:\WINDOWS\system32\POWRPROF.dll 
0x73030000  0x10000   5.01.2600.5512  C:\WINDOWS\system32\WZCSAPI.DLL 
0x5df10000  0x60000   5.01.2600.5512  C:\WINDOWS\system32\wzcdlg.dll 
0x4d4f0000  0x59000   5.01.2600.5868  C:\WINDOWS\system32\WINHTTP.dll 
0x027a0000  0x2f000   5.01.2600.5512  C:\WINDOWS\system32\xpsp1res.dll 
0x71600000  0x12000   6.00.2900.5512  C:\WINDOWS\system32\browselc.dll 
0x6c1b0000  0x4d000   5.01.2600.5512  C:\WINDOWS\system32\DUSER.dll 
0x71b20000  0x12000   5.01.2600.5512  C:\WINDOWS\system32\MPR.dll 
0x75f60000  0x7000    5.01.2600.5512  C:\WINDOWS\System32\drprov.dll 
0x71c10000  0xe000    5.01.2600.5512  C:\WINDOWS\System32
tlanman.dll 
0x71cd0000  0x17000   5.01.2600.5512  C:\WINDOWS\System32\NETUI0.dll 
0x71c90000  0x40000   5.01.2600.5512  C:\WINDOWS\System32\NETUI1.dll 
0x71c80000  0x7000    5.01.2600.5512  C:\WINDOWS\System32\NETRAP.dll 
0x75f70000  0xa000    5.01.2600.5512  C:\WINDOWS\System32\davclnt.dll 
0x7e720000  0xb0000   5.01.2600.5512  C:\WINDOWS\system32\SXS.DLL 

------------------------------------------------------------------------------
iexplore.exe pid: 872
Command line: "C:\Program Files\Internet Explorer\iexplore.exe" 
Base        Size      Version	        Path
0x00400000  0x9c000   8.00.6001.18702  C:\Program Files\Internet Explorer\iexplore.exe
0x7c900000  0xb2000   5.01.2600.5755  C:\WINDOWS\system32
tdll.dll
0x7c800000  0xf6000   5.01.2600.5781  C:\WINDOWS\system32\kernel32.dll
0x77dd0000  0x9b000   5.01.2600.5755  C:\WINDOWS\system32\ADVAPI32.dll
0x77e70000  0x92000   5.01.2600.5795  C:\WINDOWS\system32\RPCRT4.dll
0x77fe0000  0x11000   5.01.2600.5834  C:\WINDOWS\system32\Secur32.dll
0x7e410000  0x91000   5.01.2600.5512  C:\WINDOWS\system32\USER32.dll
0x77f10000  0x49000   5.01.2600.5698  C:\WINDOWS\system32\GDI32.dll
0x77c10000  0x58000   7.00.2600.5512  C:\WINDOWS\system32\msvcrt.dll
0x77f60000  0x76000   6.00.2900.5912  C:\WINDOWS\system32\SHLWAPI.dll
0x7c9c0000  0x817000  6.00.2900.6018  C:\WINDOWS\system32\SHELL32.dll
0x774e0000  0x13d000  5.01.2600.5512  C:\WINDOWS\system32\ole32.dll
0x3dfd0000  0x1e8000  8.00.6001.18939  C:\WINDOWS\system32\iertutil.dll
0x78130000  0x133000  8.00.6001.18939  C:\WINDOWS\system32\urlmon.dll
0x77120000  0x8b000   5.01.2600.5512  C:\WINDOWS\system32\OLEAUT32.dll
0x5cb70000  0x26000   5.01.2600.5512  C:\WINDOWS\system32\ShimEng.dll
0x71590000  0x79000   5.01.2600.5906  C:\WINDOWS\AppPatch\AcLayers.DLL
0x769c0000  0xb4000   5.01.2600.5512  C:\WINDOWS\system32\USERENV.dll
0x73000000  0x26000   5.01.2600.5512  C:\WINDOWS\system32\WINSPOOL.DRV
0x76390000  0x1d000   5.01.2600.5512  C:\WINDOWS\system32\IMM32.DLL
0x773d0000  0x103000  6.00.2900.5512  C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x5d090000  0x9a000   5.82.2900.5512  C:\WINDOWS\system32\comctl32.dll
0x3e1c0000  0xa94000  8.00.6001.18939  C:\WINDOWS\system32\IEFRAME.dll
0x3d930000  0xe6000   8.00.6001.18939  C:\WINDOWS\system32\WININET.dll
0x009b0000  0x9000    6.00.5441.0000  C:\WINDOWS\system32\Normaliz.dll
0x71ab0000  0x17000   5.01.2600.5512  C:\WINDOWS\system32\ws2_32.dll
0x71aa0000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\WS2HELP.dll
0x763b0000  0x49000   6.00.2900.5512  C:\WINDOWS\system32\comdlg32.dll
0x451f0000  0x6000    8.00.6001.18939  C:\Program Files\Internet Explorer\xpshims.dll
0x5ad70000  0x38000   6.00.2900.5512  C:\WINDOWS\system32\uxtheme.dll
0x00db0000  0x2c5000  5.01.2600.5512  C:\WINDOWS\system32\xpsp2res.dll
0x76ee0000  0x3c000   5.01.2600.5512  C:\WINDOWS\system32\RASAPI32.dll
0x76e90000  0x12000   5.01.2600.5512  C:\WINDOWS\system32asman.dll
0x5b860000  0x55000   5.01.2600.5694  C:\WINDOWS\system32\NETAPI32.dll
0x76eb0000  0x2f000   5.01.2600.5512  C:\WINDOWS\system32\TAPI32.dll
0x76e80000  0xe000    5.01.2600.5512  C:\WINDOWS\system32tutils.dll
0x76b40000  0x2d000   5.01.2600.5512  C:\WINDOWS\system32\WINMM.dll
0x77c70000  0x25000   5.01.2600.5876  C:\WINDOWS\system32\msv1_0.dll
0x76790000  0xc000    5.01.2600.5512  C:\WINDOWS\system32\cryptdll.dll
0x76d60000  0x19000   5.01.2600.5512  C:\WINDOWS\system32\iphlpapi.dll
0x722b0000  0x5000    5.01.2600.5512  C:\WINDOWS\system32\sensapi.dll
0x77b40000  0x22000   5.01.2600.5512  C:\WINDOWS\system32\apphelp.dll
0x755c0000  0x2e000   5.01.2600.5512  C:\WINDOWS\system32\msctfime.ime
0x01a10000  0x2a000   8.00.6001.18702  C:\WINDOWS\system32\IEUI.dll
0x76380000  0x5000    5.01.2600.5512  C:\WINDOWS\system32\MSIMG32.dll
0x76fd0000  0x7f000   2001.12.4414.0700  C:\WINDOWS\system32\CLBCATQ.DLL
0x77050000  0xc5000   2001.12.4414.0700  C:\WINDOWS\system32\COMRes.dll
0x77c00000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\VERSION.dll
0x746f0000  0x2a000   5.01.2600.5512  C:\WINDOWS\system32\msimtf.dll
0x74720000  0x4c000   5.01.2600.5512  C:\WINDOWS\system32\MSCTF.dll
0x77a20000  0x54000   5.01.2600.5512  C:\WINDOWS\System32\cscui.dll
0x76600000  0x1d000   5.01.2600.5512  C:\WINDOWS\System32\CSCDLL.dll
0x77920000  0xf3000   5.01.2600.5512  C:\WINDOWS\system32\SETUPAPI.dll
0x74c80000  0x2c000   4.02.5406.0000  C:\WINDOWS\system32\oleacc.dll
0x76080000  0x65000   6.02.3104.0000  C:\WINDOWS\system32\MSVCP60.dll
0x47060000  0x21000   1.00.1018.0000  C:\WINDOWS\system32\xmllite.dll
0x439b0000  0x40000   8.00.6001.18939  C:\Program Files\Internet Explorer\ieproxy.dll
0x435a0000  0x95000   8.00.6001.18939  C:\WINDOWS\system32\msfeeds.dll
0x75cf0000  0x91000   6.00.2900.5512  C:\WINDOWS\system32\MLANG.dll
0x71a50000  0x3f000   5.01.2600.5625  C:\WINDOWS\system32\mswsock.dll
0x662b0000  0x58000   5.01.2600.5512  C:\WINDOWS\system32\hnetcfg.dll
0x71a90000  0x8000    5.01.2600.5512  C:\WINDOWS\System32\wshtcpip.dll
0x76fc0000  0x6000    5.01.2600.5512  C:\WINDOWS\system32asadhlp.dll
0x76f20000  0x27000   5.01.2600.5625  C:\WINDOWS\system32\DNSAPI.dll
0x76fb0000  0x8000    5.01.2600.5512  C:\WINDOWS\System32\winrnr.dll
0x76f60000  0x2c000   5.01.2600.5512  C:\WINDOWS\system32\WLDAP32.dll
0x7e720000  0xb0000   5.01.2600.5512  C:\WINDOWS\system32\SXS.DLL
0x71d40000  0x1b000   6.00.2900.5512  C:\WINDOWS\system32\actxprxy.dll
0x76d40000  0x18000   5.01.2600.5512  C:\WINDOWS\system32\MPRAPI.dll
0x77cc0000  0x32000   5.01.2600.5512  C:\WINDOWS\system32\ACTIVEDS.dll
0x76e10000  0x25000   5.01.2600.5512  C:\WINDOWS\system32\adsldpc.dll
0x76b20000  0x11000   3.05.2284.0002  C:\WINDOWS\system32\ATL.DLL
0x71bf0000  0x13000   5.01.2600.5512  C:\WINDOWS\system32\SAMLIB.dll
0x74d90000  0x6b000   1.420.2600.5512  C:\WINDOWS\system32\USP10.dll
0x3cea0000  0x5b0000  8.00.6001.18939  C:\WINDOWS\system32\mshtml.dll
0x033a0000  0x29000   3.10.0349.0000  C:\WINDOWS\system32\msls31.dll
0x76bf0000  0xb000    5.01.2600.5512  C:\WINDOWS\system32\PSAPI.DLL
0x72ea0000  0x6f000   8.00.6001.18669  C:\WINDOWS\system32\ieapfltr.dll
0x77a80000  0x95000   5.131.2600.5512  C:\WINDOWS\system32\CRYPT32.dll
0x77b20000  0x12000   5.01.2600.5875  C:\WINDOWS\system32\MSASN1.dll
0x3d7a0000  0xb4000   5.08.6001.22960  C:\WINDOWS\system32\jscript.dll
0x42070000  0x2f000   8.00.6001.18939  C:\WINDOWS\system32\iepeers.dll
0x35c50000  0x39000   8.00.6001.18702  C:\WINDOWS\system32\Dxtrans.dll
0x6d430000  0xa000    5.03.2600.5512  C:\WINDOWS\system32\ddrawex.dll
0x73760000  0x4b000   5.03.2600.5512  C:\WINDOWS\system32\DDRAW.dll
0x73bc0000  0x6000    5.01.2600.5512  C:\WINDOWS\system32\DCIMAN32.dll
0x35cb0000  0x57000   8.00.6001.18702  C:\WINDOWS\system32\Dxtmsft.dll
0x74980000  0x123000  8.100.1052.0000  C:\WINDOWS\system32\msxml3.dll
0x1b000000  0xc000    8.00.6001.18702  C:\WINDOWS\system32\ImgUtil.dll
0x1b060000  0xe000    8.00.6001.18702  C:\WINDOWS\system32\pngfilt.dll
0x68000000  0x36000   5.01.2600.5507  C:\WINDOWS\system32saenh.dll
0x10000000  0x488000  10.00.0022.0087  C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx
0x73b30000  0x15000   5.01.2600.5627  C:\WINDOWS\system32\mscms.dll
0x76c30000  0x2e000   5.131.2600.5922  C:\WINDOWS\system32\wintrust.dll
0x76c90000  0x28000   5.01.2600.5512  C:\WINDOWS\system32\IMAGEHLP.dll
0x767f0000  0x28000   5.01.2600.6006  C:\WINDOWS\system32\schannel.dll
0x68100000  0x26000   5.01.2600.5507  C:\WINDOWS\system32\dssenh.dll
0x75e60000  0x13000   5.131.2600.5512  C:\WINDOWS\system32\cryptnet.dll
0x4d4f0000  0x59000   5.01.2600.5868  C:\WINDOWS\system32\WINHTTP.dll
0x76990000  0x25000   5.01.2600.5512  C:\WINDOWS\system32
tshrui.dll
0x76980000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\LINKINFO.dll
 
No matching processes were found.
 
No matching processes were found.

No matching processes were found.

No matching processes were found.

------------------------------------------------------------------------------
csrss.exe pid: 480
Command line: C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
Base        Size      Version	        Path
0x4a680000  0x5000                    \??\C:\WINDOWS\system32\csrss.exe
0x7c900000  0xb2000   5.01.2600.5755  C:\WINDOWS\system32
tdll.dll
0x75b40000  0xb000    5.01.2600.5915  C:\WINDOWS\system32\CSRSRV.dll
0x75b50000  0x10000   5.01.2600.5512  C:\WINDOWS\system32\basesrv.dll
0x75b60000  0x4b000   5.01.2600.5512  C:\WINDOWS\system32\winsrv.dll
0x77f10000  0x49000   5.01.2600.5698  C:\WINDOWS\system32\GDI32.dll
0x7c800000  0xf6000   5.01.2600.5781  C:\WINDOWS\system32\KERNEL32.dll
0x7e410000  0x91000   5.01.2600.5512  C:\WINDOWS\system32\USER32.dll
0x7e720000  0xb0000   5.01.2600.5512  C:\WINDOWS\system32\sxs.dll
0x77dd0000  0x9b000   5.01.2600.5755  C:\WINDOWS\system32\ADVAPI32.dll
0x77e70000  0x92000   5.01.2600.5795  C:\WINDOWS\system32\RPCRT4.dll
0x77fe0000  0x11000   5.01.2600.5834  C:\WINDOWS\system32\Secur32.dll
 
------------------------------------------------------------------------------
smss.exe pid: 392
Command line: \SystemRoot\System32\smss.exe
Base        Size      Version	        Path
0x48580000  0xf000                    \SystemRoot\System32\smss.exe
0x7c900000  0xb2000   5.01.2600.5755  C:\WINDOWS\system32
tdll.dll

------------------------------------------------------------------------------
winlogon.exe pid: 508
Command line: winlogon.exe
Base        Size      Version	        Path
0x01000000  0x81000                   \??\C:\WINDOWS\system32\winlogon.exe
0x7c900000  0xb2000   5.01.2600.5755  C:\WINDOWS\system32
tdll.dll
0x7c800000  0xf6000   5.01.2600.5781  C:\WINDOWS\system32\kernel32.dll
0x77dd0000  0x9b000   5.01.2600.5755  C:\WINDOWS\system32\ADVAPI32.dll
0x77e70000  0x92000   5.01.2600.5795  C:\WINDOWS\system32\RPCRT4.dll
0x77fe0000  0x11000   5.01.2600.5834  C:\WINDOWS\system32\Secur32.dll
0x776c0000  0x12000   5.01.2600.5512  C:\WINDOWS\system32\AUTHZ.dll
0x77c10000  0x58000   7.00.2600.5512  C:\WINDOWS\system32\msvcrt.dll
0x77a80000  0x95000   5.131.2600.5512  C:\WINDOWS\system32\CRYPT32.dll
0x77b20000  0x12000   5.01.2600.5875  C:\WINDOWS\system32\MSASN1.dll
0x7e410000  0x91000   5.01.2600.5512  C:\WINDOWS\system32\USER32.dll
0x77f10000  0x49000   5.01.2600.5698  C:\WINDOWS\system32\GDI32.dll
0x75940000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\NDdeApi.dll
0x75930000  0xa000    5.01.2600.5512  C:\WINDOWS\system32\PROFMAP.dll
0x5b860000  0x55000   5.01.2600.5694  C:\WINDOWS\system32\NETAPI32.dll
0x769c0000  0xb4000   5.01.2600.5512  C:\WINDOWS\system32\USERENV.dll
0x76bf0000  0xb000    5.01.2600.5512  C:\WINDOWS\system32\PSAPI.DLL
0x76bc0000  0xf000    5.01.2600.5512  C:\WINDOWS\system32\REGAPI.dll
0x77920000  0xf3000   5.01.2600.5512  C:\WINDOWS\system32\SETUPAPI.dll
0x77c00000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\VERSION.dll
0x76360000  0x10000   5.01.2600.5512  C:\WINDOWS\system32\WINSTA.dll
0x76c30000  0x2e000   5.131.2600.5922  C:\WINDOWS\system32\WINTRUST.dll
0x76c90000  0x28000   5.01.2600.5512  C:\WINDOWS\system32\IMAGEHLP.dll
0x71ab0000  0x17000   5.01.2600.5512  C:\WINDOWS\system32\WS2_32.dll
0x71aa0000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\WS2HELP.dll
0x76390000  0x1d000   5.01.2600.5512  C:\WINDOWS\system32\IMM32.DLL
0x75970000  0xf8000   5.01.2600.5512  C:\WINDOWS\system32\MSGINA.dll
0x5d090000  0x9a000   5.82.2900.5512  C:\WINDOWS\system32\COMCTL32.dll
0x74320000  0x3d000   3.525.1132.0000  C:\WINDOWS\system32\ODBC32.dll
0x763b0000  0x49000   6.00.2900.5512  C:\WINDOWS\system32\comdlg32.dll
0x7c9c0000  0x817000  6.00.2900.6018  C:\WINDOWS\system32\SHELL32.dll
0x77f60000  0x76000   6.00.2900.5912  C:\WINDOWS\system32\SHLWAPI.dll
0x773d0000  0x103000  6.00.2900.5512  C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x00930000  0x17000   3.525.1132.0000  C:\WINDOWS\system32\odbcint.dll
0x776e0000  0x23000   6.00.2900.5512  C:\WINDOWS\system32\SHSVCS.dll
0x76bb0000  0x5000    5.01.2600.5512  C:\WINDOWS\system32\sfc.dll
0x76c60000  0x2a000   5.01.2600.5512  C:\WINDOWS\system32\sfc_os.dll
0x774e0000  0x13d000  5.01.2600.5512  C:\WINDOWS\system32\ole32.dll
0x77b40000  0x22000   5.01.2600.5512  C:\WINDOWS\system32\Apphelp.dll
0x755c0000  0x2e000   5.01.2600.5512  C:\WINDOWS\system32\msctfime.ime
0x723d0000  0x1c000   5.01.2600.5512  C:\WINDOWS\system32\WINSCARD.DLL
0x76f50000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\WTSAPI32.dll
0x7e720000  0xb0000   5.01.2600.5512  C:\WINDOWS\system32\sxs.dll
0x5ad70000  0x38000   6.00.2900.5512  C:\WINDOWS\system32\uxtheme.dll
0x76b40000  0x2d000   5.01.2600.5512  C:\WINDOWS\system32\WINMM.dll
0x76600000  0x1d000   5.01.2600.5512  C:\WINDOWS\system32\cscdll.dll
0x47020000  0x8000    5.01.2600.5512  C:\WINDOWS\System32\dimsntfy.dll
0x75950000  0x1a000   5.01.2600.5512  C:\WINDOWS\system32\WlNotify.dll
0x71b20000  0x12000   5.01.2600.5512  C:\WINDOWS\system32\MPR.dll
0x73000000  0x26000   5.01.2600.5512  C:\WINDOWS\system32\WINSPOOL.DRV
0x68000000  0x36000   5.01.2600.5507  C:\WINDOWS\system32saenh.dll
0x71bf0000  0x13000   5.01.2600.5512  C:\WINDOWS\system32\SAMLIB.dll
0x77c70000  0x25000   5.01.2600.5876  C:\WINDOWS\system32\msv1_0.dll
0x76790000  0xc000    5.01.2600.5512  C:\WINDOWS\system32\cryptdll.dll
0x76d60000  0x19000   5.01.2600.5512  C:\WINDOWS\system32\iphlpapi.dll
0x77a20000  0x54000   5.01.2600.5512  C:\WINDOWS\system32\cscui.dll
0x76d40000  0x18000   5.01.2600.5512  C:\WINDOWS\system32\MPRAPI.dll
0x77cc0000  0x32000   5.01.2600.5512  C:\WINDOWS\system32\ACTIVEDS.dll
0x76e10000  0x25000   5.01.2600.5512  C:\WINDOWS\system32\adsldpc.dll
0x76f60000  0x2c000   5.01.2600.5512  C:\WINDOWS\system32\WLDAP32.dll
0x76b20000  0x11000   3.05.2284.0002  C:\WINDOWS\system32\ATL.DLL
0x77120000  0x8b000   5.01.2600.5512  C:\WINDOWS\system32\OLEAUT32.dll
0x76e80000  0xe000    5.01.2600.5512  C:\WINDOWS\system32tutils.dll
0x014f0000  0x2c5000  5.01.2600.5512  C:\WINDOWS\system32\xpsp2res.dll
0x77690000  0x21000   5.01.2600.5512  C:\WINDOWS\system32\NTMARTA.DLL
0x77050000  0xc5000   2001.12.4414.0700  C:\WINDOWS\system32\COMRes.dll
0x76fd0000  0x7f000   2001.12.4414.0700  C:\WINDOWS\system32\CLBCATQ.DLL

------------------------------------------------------------------------------
svchost.exe pid: 828
Command line: C:\WINDOWS\system32\svchost -k DcomLaunch
Base        Size      Version	        Path
0x01000000  0x6000    5.01.2600.5512  C:\WINDOWS\system32\svchost.exe
0x7c900000  0xb2000   5.01.2600.5755  C:\WINDOWS\system32
tdll.dll
0x7c800000  0xf6000   5.01.2600.5781  C:\WINDOWS\system32\kernel32.dll
0x77dd0000  0x9b000   5.01.2600.5755  C:\WINDOWS\system32\ADVAPI32.dll
0x77e70000  0x92000   5.01.2600.5795  C:\WINDOWS\system32\RPCRT4.dll
0x77fe0000  0x11000   5.01.2600.5834  C:\WINDOWS\system32\Secur32.dll
0x5cb70000  0x26000   5.01.2600.5512  C:\WINDOWS\system32\ShimEng.dll
0x6f880000  0x1ca000  5.01.2600.5512  C:\WINDOWS\AppPatch\AcGenral.DLL
0x7e410000  0x91000   5.01.2600.5512  C:\WINDOWS\system32\USER32.dll
0x77f10000  0x49000   5.01.2600.5698  C:\WINDOWS\system32\GDI32.dll
0x76b40000  0x2d000   5.01.2600.5512  C:\WINDOWS\system32\WINMM.dll
0x774e0000  0x13d000  5.01.2600.5512  C:\WINDOWS\system32\ole32.dll
0x77c10000  0x58000   7.00.2600.5512  C:\WINDOWS\system32\msvcrt.dll
0x77120000  0x8b000   5.01.2600.5512  C:\WINDOWS\system32\OLEAUT32.dll
0x77be0000  0x15000   5.01.2600.5512  C:\WINDOWS\system32\MSACM32.dll
0x77c00000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\VERSION.dll
0x7c9c0000  0x817000  6.00.2900.6018  C:\WINDOWS\system32\SHELL32.dll
0x77f60000  0x76000   6.00.2900.5912  C:\WINDOWS\system32\SHLWAPI.dll
0x769c0000  0xb4000   5.01.2600.5512  C:\WINDOWS\system32\USERENV.dll
0x5ad70000  0x38000   6.00.2900.5512  C:\WINDOWS\system32\UxTheme.dll
0x76390000  0x1d000   5.01.2600.5512  C:\WINDOWS\system32\IMM32.DLL
0x773d0000  0x103000  6.00.2900.5512  C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x5d090000  0x9a000   5.82.2900.5512  C:\WINDOWS\system32\comctl32.dll
0x77690000  0x21000   5.01.2600.5512  C:\WINDOWS\system32\NTMARTA.DLL
0x71bf0000  0x13000   5.01.2600.5512  C:\WINDOWS\system32\SAMLIB.dll
0x76f60000  0x2c000   5.01.2600.5512  C:\WINDOWS\system32\WLDAP32.dll
0x76a80000  0x64000   5.01.2600.5755  c:\windows\system32pcss.dll
0x71ab0000  0x17000   5.01.2600.5512  c:\windows\system32\WS2_32.dll
0x71aa0000  0x8000    5.01.2600.5512  c:\windows\system32\WS2HELP.dll
0x00670000  0x2c5000  5.01.2600.5512  C:\WINDOWS\system32\xpsp2res.dll
0x760f0000  0x53000   5.01.2600.5512  c:\windows\system32	ermsrv.dll
0x74f70000  0x6000    5.01.2600.5512  c:\windows\system32\ICAAPI.dll
0x77920000  0xf3000   5.01.2600.5512  c:\windows\system32\SETUPAPI.dll
0x76c30000  0x2e000   5.131.2600.5922  c:\windows\system32\WINTRUST.dll
0x77a80000  0x95000   5.131.2600.5512  c:\windows\system32\CRYPT32.dll
0x77b20000  0x12000   5.01.2600.5875  c:\windows\system32\MSASN1.dll
0x76c90000  0x28000   5.01.2600.5512  C:\WINDOWS\system32\IMAGEHLP.dll
0x776c0000  0x12000   5.01.2600.5512  c:\windows\system32\AUTHZ.dll
0x75110000  0x1f000   5.01.2600.5512  c:\windows\system32\mstlsapi.dll
0x77cc0000  0x32000   5.01.2600.5512  c:\windows\system32\ACTIVEDS.dll
0x76e10000  0x25000   5.01.2600.5512  c:\windows\system32\adsldpc.dll
0x5b860000  0x55000   5.01.2600.5694  c:\windows\system32\NETAPI32.dll
0x76b20000  0x11000   3.05.2284.0002  c:\windows\system32\ATL.DLL
0x76bc0000  0xf000    5.01.2600.5512  C:\WINDOWS\system32\REGAPI.dll
0x68000000  0x36000   5.01.2600.5507  C:\WINDOWS\system32saenh.dll
0x76fd0000  0x7f000   2001.12.4414.0700  C:\WINDOWS\system32\CLBCATQ.DLL
0x77050000  0xc5000   2001.12.4414.0700  C:\WINDOWS\system32\COMRes.dll
0x77b40000  0x22000   5.01.2600.5512  C:\WINDOWS\system32\Apphelp.dll
------------------------------------------------------------------------------
svchost.exe pid: 892
Command line: C:\WINDOWS\system32\svchost -k rpcss
Base        Size      Version	        Path
0x01000000  0x6000    5.01.2600.5512  C:\WINDOWS\system32\svchost.exe
0x7c900000  0xb2000   5.01.2600.5755  C:\WINDOWS\system32
tdll.dll
0x7c800000  0xf6000   5.01.2600.5781  C:\WINDOWS\system32\kernel32.dll
0x77dd0000  0x9b000   5.01.2600.5755  C:\WINDOWS\system32\ADVAPI32.dll
0x77e70000  0x92000   5.01.2600.5795  C:\WINDOWS\system32\RPCRT4.dll
0x77fe0000  0x11000   5.01.2600.5834  C:\WINDOWS\system32\Secur32.dll
0x5cb70000  0x26000   5.01.2600.5512  C:\WINDOWS\system32\ShimEng.dll
0x6f880000  0x1ca000  5.01.2600.5512  C:\WINDOWS\AppPatch\AcGenral.DLL
0x7e410000  0x91000   5.01.2600.5512  C:\WINDOWS\system32\USER32.dll
0x77f10000  0x49000   5.01.2600.5698  C:\WINDOWS\system32\GDI32.dll
0x76b40000  0x2d000   5.01.2600.5512  C:\WINDOWS\system32\WINMM.dll
0x774e0000  0x13d000  5.01.2600.5512  C:\WINDOWS\system32\ole32.dll
0x77c10000  0x58000   7.00.2600.5512  C:\WINDOWS\system32\msvcrt.dll
0x77120000  0x8b000   5.01.2600.5512  C:\WINDOWS\system32\OLEAUT32.dll
0x77be0000  0x15000   5.01.2600.5512  C:\WINDOWS\system32\MSACM32.dll
0x77c00000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\VERSION.dll
0x7c9c0000  0x817000  6.00.2900.6018  C:\WINDOWS\system32\SHELL32.dll
0x77f60000  0x76000   6.00.2900.5912  C:\WINDOWS\system32\SHLWAPI.dll
0x769c0000  0xb4000   5.01.2600.5512  C:\WINDOWS\system32\USERENV.dll
0x5ad70000  0x38000   6.00.2900.5512  C:\WINDOWS\system32\UxTheme.dll
0x76390000  0x1d000   5.01.2600.5512  C:\WINDOWS\system32\IMM32.DLL
0x773d0000  0x103000  6.00.2900.5512  C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x5d090000  0x9a000   5.82.2900.5512  C:\WINDOWS\system32\comctl32.dll
0x76a80000  0x64000   5.01.2600.5755  c:\windows\system32pcss.dll
0x71ab0000  0x17000   5.01.2600.5512  c:\windows\system32\WS2_32.dll
0x71aa0000  0x8000    5.01.2600.5512  c:\windows\system32\WS2HELP.dll
0x00670000  0x2c5000  5.01.2600.5512  C:\WINDOWS\system32\xpsp2res.dll
0x68000000  0x36000   5.01.2600.5507  C:\WINDOWS\system32saenh.dll
0x71a50000  0x3f000   5.01.2600.5625  C:\WINDOWS\system32\mswsock.dll
0x662b0000  0x58000   5.01.2600.5512  C:\WINDOWS\system32\hnetcfg.dll
0x71a90000  0x8000    5.01.2600.5512  C:\WINDOWS\System32\wshtcpip.dll
0x76f20000  0x27000   5.01.2600.5625  C:\WINDOWS\system32\DNSAPI.dll
0x76d60000  0x19000   5.01.2600.5512  C:\WINDOWS\system32\iphlpapi.dll
0x76fb0000  0x8000    5.01.2600.5512  C:\WINDOWS\System32\winrnr.dll
0x76f60000  0x2c000   5.01.2600.5512  C:\WINDOWS\system32\WLDAP32.dll
0x76fc0000  0x6000    5.01.2600.5512  C:\WINDOWS\system32asadhlp.dll
0x76fd0000  0x7f000   2001.12.4414.0700  C:\WINDOWS\system32\CLBCATQ.DLL
0x77050000  0xc5000   2001.12.4414.0700  C:\WINDOWS\system32\COMRes.dll
------------------------------------------------------------------------------
svchost.exe pid: 932
Command line: C:\WINDOWS\System32\svchost.exe -k netsvcs
Base        Size      Version	        Path
0x01000000  0x6000    5.01.2600.5512  C:\WINDOWS\System32\svchost.exe
0x7c900000  0xb2000   5.01.2600.5755  C:\WINDOWS\system32
tdll.dll
0x7c800000  0xf6000   5.01.2600.5781  C:\WINDOWS\system32\kernel32.dll
0x77dd0000  0x9b000   5.01.2600.5755  C:\WINDOWS\system32\ADVAPI32.dll
0x77e70000  0x92000   5.01.2600.5795  C:\WINDOWS\system32\RPCRT4.dll
0x77fe0000  0x11000   5.01.2600.5834  C:\WINDOWS\system32\Secur32.dll
0x5cb70000  0x26000   5.01.2600.5512  C:\WINDOWS\System32\ShimEng.dll
0x6f880000  0x1ca000  5.01.2600.5512  C:\WINDOWS\AppPatch\AcGenral.DLL
0x7e410000  0x91000   5.01.2600.5512  C:\WINDOWS\system32\USER32.dll
0x77f10000  0x49000   5.01.2600.5698  C:\WINDOWS\system32\GDI32.dll
0x76b40000  0x2d000   5.01.2600.5512  C:\WINDOWS\System32\WINMM.dll
0x774e0000  0x13d000  5.01.2600.5512  C:\WINDOWS\system32\ole32.dll
0x77c10000  0x58000   7.00.2600.5512  C:\WINDOWS\system32\msvcrt.dll
0x77120000  0x8b000   5.01.2600.5512  C:\WINDOWS\system32\OLEAUT32.dll
0x77be0000  0x15000   5.01.2600.5512  C:\WINDOWS\System32\MSACM32.dll
0x77c00000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\VERSION.dll
0x7c9c0000  0x817000  6.00.2900.6018  C:\WINDOWS\system32\SHELL32.dll
0x77f60000  0x76000   6.00.2900.5912  C:\WINDOWS\system32\SHLWAPI.dll
0x769c0000  0xb4000   5.01.2600.5512  C:\WINDOWS\system32\USERENV.dll
0x5ad70000  0x38000   6.00.2900.5512  C:\WINDOWS\System32\UxTheme.dll
0x76390000  0x1d000   5.01.2600.5512  C:\WINDOWS\system32\IMM32.DLL
0x773d0000  0x103000  6.00.2900.5512  C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x5d090000  0x9a000   5.82.2900.5512  C:\WINDOWS\system32\comctl32.dll
0x77690000  0x21000   5.01.2600.5512  C:\WINDOWS\System32\NTMARTA.DLL
0x71bf0000  0x13000   5.01.2600.5512  C:\WINDOWS\System32\SAMLIB.dll
0x76f60000  0x2c000   5.01.2600.5512  C:\WINDOWS\system32\WLDAP32.dll
0x00630000  0x2c5000  5.01.2600.5512  C:\WINDOWS\System32\xpsp2res.dll
0x776e0000  0x23000   6.00.2900.5512  c:\windows\system32\shsvcs.dll
0x76360000  0x10000   5.01.2600.5512  C:\WINDOWS\System32\WINSTA.dll
0x5b860000  0x55000   5.01.2600.5694  C:\WINDOWS\System32\NETAPI32.dll
0x7d4b0000  0x22000   5.01.2600.5512  c:\windows\system32\dhcpcsvc.dll
0x76f20000  0x27000   5.01.2600.5625  c:\windows\system32\DNSAPI.dll
0x71ab0000  0x17000   5.01.2600.5512  c:\windows\system32\WS2_32.dll
0x71aa0000  0x8000    5.01.2600.5512  c:\windows\system32\WS2HELP.dll
0x76d60000  0x19000   5.01.2600.5512  c:\windows\system32\iphlpapi.dll
0x68000000  0x36000   5.01.2600.5507  C:\WINDOWS\System32saenh.dll
0x7db10000  0x8c000   5.01.2600.5512  c:\windows\system32\wzcsvc.dll
0x76e80000  0xe000    5.01.2600.5512  c:\windows\system32tutils.dll
0x76d30000  0x4000    5.01.2600.5512  c:\windows\system32\WMI.dll
0x77a80000  0x95000   5.131.2600.5512  c:\windows\system32\CRYPT32.dll
0x77b20000  0x12000   5.01.2600.5875  c:\windows\system32\MSASN1.dll
0x72810000  0xb000    5.01.2600.5512  c:\windows\system32\EapolQec.dll
0x76b20000  0x11000   3.05.2284.0002  c:\windows\system32\ATL.DLL
0x726c0000  0x16000   5.01.2600.5512  c:\windows\system32\QUtil.dll
0x76080000  0x65000   6.02.3104.0000  c:\windows\system32\MSVCP60.dll
0x478c0000  0xa000    5.01.2600.5512  c:\windows\system32\dot3api.dll
0x76f50000  0x8000    5.01.2600.5512  c:\windows\system32\WTSAPI32.dll
0x606b0000  0x10d000  5.01.2600.5512  c:\windows\system32\ESENT.dll
0x76fd0000  0x7f000   2001.12.4414.0700  C:\WINDOWS\System32\CLBCATQ.DLL
0x77050000  0xc5000   2001.12.4414.0700  C:\WINDOWS\System32\COMRes.dll
0x76b70000  0x27000   5.01.2600.5886  C:\WINDOWS\System32astls.dll
0x754d0000  0x80000   5.131.2600.5512  C:\WINDOWS\System32\CRYPTUI.dll
0x3d930000  0xe6000   8.00.6001.18939  C:\WINDOWS\system32\WININET.dll
0x01450000  0x9000    6.00.5441.0000  C:\WINDOWS\system32\Normaliz.dll
0x78130000  0x133000  8.00.6001.18939  C:\WINDOWS\system32\urlmon.dll
0x3dfd0000  0x1e8000  8.00.6001.18939  C:\WINDOWS\system32\iertutil.dll
0x76c30000  0x2e000   5.131.2600.5922  C:\WINDOWS\System32\WINTRUST.dll
0x76c90000  0x28000   5.01.2600.5512  C:\WINDOWS\system32\IMAGEHLP.dll
0x76d40000  0x18000   5.01.2600.5512  C:\WINDOWS\System32\MPRAPI.dll
0x77cc0000  0x32000   5.01.2600.5512  C:\WINDOWS\System32\ACTIVEDS.dll
0x76e10000  0x25000   5.01.2600.5512  C:\WINDOWS\System32\adsldpc.dll
0x77920000  0xf3000   5.01.2600.5512  C:\WINDOWS\System32\SETUPAPI.dll
0x76ee0000  0x3c000   5.01.2600.5512  C:\WINDOWS\System32\RASAPI32.dll
0x76e90000  0x12000   5.01.2600.5512  C:\WINDOWS\System32asman.dll
0x76eb0000  0x2f000   5.01.2600.5512  C:\WINDOWS\System32\TAPI32.dll
0x767f0000  0x28000   5.01.2600.6006  C:\WINDOWS\System32\SCHANNEL.dll
0x723d0000  0x1c000   5.01.2600.5512  C:\WINDOWS\System32\WinSCard.dll
0x76bf0000  0xb000    5.01.2600.5512  C:\WINDOWS\System32\PSAPI.DLL
0x76bd0000  0x16000   5.01.2600.5886  C:\WINDOWS\System32aschap.dll
0x77c70000  0x25000   5.01.2600.5876  C:\WINDOWS\system32\msv1_0.dll
0x76790000  0xc000    5.01.2600.5512  C:\WINDOWS\System32\cryptdll.dll
0x77300000  0x33000   5.01.2600.5512  c:\windows\system32\schedsvc.dll
0x767a0000  0x13000   5.01.2600.5512  c:\windows\system32\NTDSAPI.dll
0x74f50000  0x5000    6.00.2900.5512  C:\WINDOWS\System32\MSIDLE.DLL
0x708b0000  0xd000    5.01.2600.5512  c:\windows\system32\audiosrv.dll
0x76e40000  0x23000   5.01.2600.5826  c:\windows\system32\wkssvc.dll
0x76ce0000  0x12000   5.01.2600.5512  c:\windows\system32\cryptsvc.dll
0x77b90000  0x32000   5.01.2600.5512  c:\windows\system32\certcli.dll
0x74f80000  0x9000    5.01.2600.5512  c:\windows\system32\ersvc.dll
0x77710000  0x44000   2001.12.4414.0706  c:\windows\system32\es.dll
0x74f40000  0xc000    5.01.2600.5512  c:\windows\pchealth\helpctr\binaries\pchsvc.dll
0x75090000  0x1a000   5.01.2600.5512  c:\windows\system32\srvsvc.dll
0x77d00000  0x33000   5.01.2600.5512  c:\windows\system32
etman.dll
0x76400000  0x1a5000  5.01.2600.5512  c:\windows\system32
etshell.dll
0x76c00000  0x2e000   5.01.2600.5512  c:\windows\system32\credui.dll
0x736d0000  0x6000    5.01.2600.5512  c:\windows\system32\dot3dlg.dll
0x5dca0000  0x28000   5.01.2600.5512  c:\windows\system32\OneX.DLL
0x745b0000  0x22000   5.01.2600.5512  c:\windows\system32\eappcfg.dll
0x5dcd0000  0xe000    5.01.2600.5512  c:\windows\system32\eappprxy.dll
0x73030000  0x10000   5.01.2600.5512  c:\windows\system32\WZCSAPI.DLL
0x73d20000  0x8000    5.01.2600.5512  c:\windows\system32\seclogon.dll
0x662b0000  0x58000   5.01.2600.5512  C:\WINDOWS\System32\HNETCFG.DLL
0x751a0000  0x2e000   5.01.2600.5512  c:\windows\system32\srsvc.dll
0x74ad0000  0x8000    6.00.2900.5512  c:\windows\system32\POWRPROF.dll
0x75070000  0x19000   5.01.2600.5512  c:\windows\system32	rkwks.dll
0x767c0000  0x2c000   5.01.2600.5512  c:\windows\system32\w32time.dll
0x71a50000  0x3f000   5.01.2600.5625  C:\WINDOWS\system32\mswsock.dll
0x71a90000  0x8000    5.01.2600.5512  C:\WINDOWS\System32\wshtcpip.dll
0x59490000  0x28000   5.01.2600.5512  c:\windows\system32\wbem\wmisvc.dll
0x753e0000  0x6d000   5.01.2600.5512  C:\WINDOWS\system32\VSSAPI.DLL
0x50000000  0x5000    5.04.3790.5512  c:\windows\system32\wuauserv.dll
0x50040000  0x1d9000  7.04.7600.0226  C:\WINDOWS\system32\wuaueng.dll
0x73000000  0x26000   5.01.2600.5512  C:\WINDOWS\System32\WINSPOOL.DRV
0x4d4f0000  0x59000   5.01.2600.5868  C:\WINDOWS\System32\WINHTTP.dll
0x75150000  0x13000   5.01.2600.5512  C:\WINDOWS\System32\Cabinet.dll
0x600a0000  0xb000    5.01.2600.5512  C:\WINDOWS\System32\mspatcha.dll
0x76da0000  0x16000   5.01.2600.5512  c:\windows\system32\browser.dll
0x722d0000  0xd000    5.01.2600.5512  c:\windows\system32\sens.dll
0x4c0a0000  0x17000   5.01.2600.5512  c:\windows\system32\wscsvc.dll
0x7d1e0000  0x2bc000  3.01.4001.5512  c:\windows\system32\msi.dll
0x75290000  0x37000   5.01.2600.5512  C:\WINDOWS\system32\wbem\wbemcomn.dll
0x762c0000  0x85000   5.01.2600.5512  C:\WINDOWS\System32\Wbem\wbemcore.dll
0x75310000  0x3f000   5.01.2600.5512  C:\WINDOWS\System32\Wbem\esscli.dll
0x75690000  0x76000   5.01.2600.5755  C:\WINDOWS\System32\Wbem\FastProx.dll
0x74ed0000  0xe000    5.01.2600.5512  C:\WINDOWS\system32\wbem\wbemsvc.dll
0x75020000  0x1b000   5.01.2600.5512  C:\WINDOWS\system32\wbem\wmiutils.dll
0x75200000  0x2f000   5.01.2600.5512  C:\WINDOWS\system32\wbemepdrvfs.dll
0x3f1e0000  0x72000   5.01.2600.5755  C:\WINDOWS\system32\wbem\wmiprvsd.dll
0x5f770000  0xc000    5.01.2600.5512  C:\WINDOWS\system32\NCObjAPI.DLL
0x75390000  0x46000   5.01.2600.5512  C:\WINDOWS\system32\wbem\wbemess.dll
0x76bb0000  0x5000    5.01.2600.5512  C:\WINDOWS\System32\sfc.dll
0x76c60000  0x2a000   5.01.2600.5512  C:\WINDOWS\System32\sfc_os.dll
0x77b40000  0x22000   5.01.2600.5512  C:\WINDOWS\system32\Apphelp.dll
0x7e720000  0xb0000   5.01.2600.5512  C:\WINDOWS\System32\SXS.DLL
0x76620000  0x13c000  2001.12.4414.0702  C:\WINDOWS\system32\comsvcs.dll
0x75130000  0x14000   2001.12.4414.0700  C:\WINDOWS\system32\colbact.DLL
0x750f0000  0x13000   2001.12.4414.0706  C:\WINDOWS\system32\MTXCLU.DLL
0x71ad0000  0x9000    5.01.2600.5512  C:\WINDOWS\system32\WSOCK32.dll
0x76d10000  0x12000   5.01.2600.5512  C:\WINDOWS\System32\CLUSAPI.DLL
0x750b0000  0x12000   5.01.2600.5512  C:\WINDOWS\System32\RESUTILS.DLL
0x5f740000  0xe000    5.01.2600.5512  C:\WINDOWS\system32\wbem
cprov.dll
0x66460000  0x55000   5.01.2600.5512  c:\windows\system32\ipnathlp.dll
0x776c0000  0x12000   5.01.2600.5512  c:\windows\system32\AUTHZ.dll
0x76de0000  0x24000   5.01.2600.5512  C:\WINDOWS\system32\upnp.dll
0x74f00000  0xc000    5.01.2600.5512  C:\WINDOWS\system32\SSDPAPI.dll
0x755f0000  0x9a000   5.01.2600.5512  C:\WINDOWS\system32
etcfgx.dll
0x7df30000  0x32000   5.01.2600.5512  C:\WINDOWS\System32asmans.dll
0x74370000  0xb000    5.01.2600.5512  C:\WINDOWS\System32\WINIPSEC.DLL
0x733e0000  0x40000   5.01.2600.5512  c:\windows\system32	apisrv.dll
0x75880000  0x11000   5.01.2600.5512  C:\WINDOWS\System32astapi.dll
0x57cc0000  0x36000   5.01.2600.5512  C:\WINDOWS\System32\unimdm.tsp
0x72000000  0x7000    5.01.2600.5512  C:\WINDOWS\System32\uniplat.dll
0x76fc0000  0x6000    5.01.2600.5512  C:\WINDOWS\System32asadhlp.dll
0x5b070000  0x14000   5.01.2600.5512  C:\WINDOWS\System32\unimdmat.dll
0x61650000  0x28000   5.01.2600.5512  C:\WINDOWS\system32\modemui.dll
0x57d40000  0xb000    5.01.2600.5512  C:\WINDOWS\System32\kmddsp.tsp
0x57d20000  0x10000   5.01.2600.5512  C:\WINDOWS\System32
dptsp.tsp
0x57d50000  0x8000    5.01.2600.5512  C:\WINDOWS\System32\ipconf.tsp
0x57d70000  0x46000   5.01.2600.5512  C:\WINDOWS\System32\h323.tsp
0x57d60000  0xa000    5.01.2600.5512  C:\WINDOWS\System32\hidphone.tsp
0x688f0000  0x9000    5.01.2600.5512  C:\WINDOWS\System32\HID.DLL
0x72240000  0x37000   5.01.2600.5512  C:\WINDOWS\System32asppp.dll
0x724b0000  0x6000    5.01.2600.5512  C:\WINDOWS\System32
tlsapi.dll
0x71cf0000  0x4c000   5.01.2600.5834  C:\WINDOWS\system32\kerberos.dll
0x72ae0000  0x13000   5.01.2600.5512  C:\WINDOWS\System32\RASQEC.DLL
0x768d0000  0xa4000   5.01.2600.5512  C:\WINDOWS\System32\RASDLG.dll
0x74980000  0x123000  8.100.1052.0000  C:\WINDOWS\system32\msxml3.dll
0x75cf0000  0x91000   6.00.2900.5512  C:\WINDOWS\system32\mlang.dll
0x4cb90000  0x10000   5.01.2600.5512  C:\WINDOWS\System32\xmlprovi.dll
------------------------------------------------------------------------------
svchost.exe pid: 984
Command line: C:\WINDOWS\system32\svchost.exe -k NetworkService
Base        Size      Version	        Path
0x01000000  0x6000    5.01.2600.5512  C:\WINDOWS\system32\svchost.exe
0x7c900000  0xb2000   5.01.2600.5755  C:\WINDOWS\system32
tdll.dll
0x7c800000  0xf6000   5.01.2600.5781  C:\WINDOWS\system32\kernel32.dll
0x77dd0000  0x9b000   5.01.2600.5755  C:\WINDOWS\system32\ADVAPI32.dll
0x77e70000  0x92000   5.01.2600.5795  C:\WINDOWS\system32\RPCRT4.dll
0x77fe0000  0x11000   5.01.2600.5834  C:\WINDOWS\system32\Secur32.dll
0x5cb70000  0x26000   5.01.2600.5512  C:\WINDOWS\system32\ShimEng.dll
0x6f880000  0x1ca000  5.01.2600.5512  C:\WINDOWS\AppPatch\AcGenral.DLL
0x7e410000  0x91000   5.01.2600.5512  C:\WINDOWS\system32\USER32.dll
0x77f10000  0x49000   5.01.2600.5698  C:\WINDOWS\system32\GDI32.dll
0x76b40000  0x2d000   5.01.2600.5512  C:\WINDOWS\system32\WINMM.dll
0x774e0000  0x13d000  5.01.2600.5512  C:\WINDOWS\system32\ole32.dll
0x77c10000  0x58000   7.00.2600.5512  C:\WINDOWS\system32\msvcrt.dll
0x77120000  0x8b000   5.01.2600.5512  C:\WINDOWS\system32\OLEAUT32.dll
0x77be0000  0x15000   5.01.2600.5512  C:\WINDOWS\system32\MSACM32.dll
0x77c00000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\VERSION.dll
0x7c9c0000  0x817000  6.00.2900.6018  C:\WINDOWS\system32\SHELL32.dll
0x77f60000  0x76000   6.00.2900.5912  C:\WINDOWS\system32\SHLWAPI.dll
0x769c0000  0xb4000   5.01.2600.5512  C:\WINDOWS\system32\USERENV.dll
0x5ad70000  0x38000   6.00.2900.5512  C:\WINDOWS\system32\UxTheme.dll
0x76390000  0x1d000   5.01.2600.5512  C:\WINDOWS\system32\IMM32.DLL
0x773d0000  0x103000  6.00.2900.5512  C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x5d090000  0x9a000   5.82.2900.5512  C:\WINDOWS\system32\comctl32.dll
0x76770000  0xd000    5.01.2600.5512  c:\windows\system32\dnsrslvr.dll
0x76f20000  0x27000   5.01.2600.5625  c:\windows\system32\DNSAPI.dll
0x71ab0000  0x17000   5.01.2600.5512  c:\windows\system32\WS2_32.dll
0x71aa0000  0x8000    5.01.2600.5512  c:\windows\system32\WS2HELP.dll
0x76d60000  0x19000   5.01.2600.5512  c:\windows\system32\iphlpapi.dll
0x68000000  0x36000   5.01.2600.5507  C:\WINDOWS\system32saenh.dll
0x71a50000  0x3f000   5.01.2600.5625  C:\WINDOWS\system32\mswsock.dll
0x662b0000  0x58000   5.01.2600.5512  C:\WINDOWS\system32\hnetcfg.dll
0x71a90000  0x8000    5.01.2600.5512  C:\WINDOWS\System32\wshtcpip.dll
------------------------------------------------------------------------------
svchost.exe pid: 1028
Command line: C:\WINDOWS\system32\svchost.exe -k LocalService
Base        Size      Version	        Path
0x01000000  0x6000    5.01.2600.5512  C:\WINDOWS\system32\svchost.exe
0x7c900000  0xb2000   5.01.2600.5755  C:\WINDOWS\system32
tdll.dll
0x7c800000  0xf6000   5.01.2600.5781  C:\WINDOWS\system32\kernel32.dll
0x77dd0000  0x9b000   5.01.2600.5755  C:\WINDOWS\system32\ADVAPI32.dll
0x77e70000  0x92000   5.01.2600.5795  C:\WINDOWS\system32\RPCRT4.dll
0x77fe0000  0x11000   5.01.2600.5834  C:\WINDOWS\system32\Secur32.dll
0x5cb70000  0x26000   5.01.2600.5512  C:\WINDOWS\system32\ShimEng.dll
0x6f880000  0x1ca000  5.01.2600.5512  C:\WINDOWS\AppPatch\AcGenral.DLL
0x7e410000  0x91000   5.01.2600.5512  C:\WINDOWS\system32\USER32.dll
0x77f10000  0x49000   5.01.2600.5698  C:\WINDOWS\system32\GDI32.dll
0x76b40000  0x2d000   5.01.2600.5512  C:\WINDOWS\system32\WINMM.dll
0x774e0000  0x13d000  5.01.2600.5512  C:\WINDOWS\system32\ole32.dll
0x77c10000  0x58000   7.00.2600.5512  C:\WINDOWS\system32\msvcrt.dll
0x77120000  0x8b000   5.01.2600.5512  C:\WINDOWS\system32\OLEAUT32.dll
0x77be0000  0x15000   5.01.2600.5512  C:\WINDOWS\system32\MSACM32.dll
0x77c00000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\VERSION.dll
0x7c9c0000  0x817000  6.00.2900.6018  C:\WINDOWS\system32\SHELL32.dll
0x77f60000  0x76000   6.00.2900.5912  C:\WINDOWS\system32\SHLWAPI.dll
0x769c0000  0xb4000   5.01.2600.5512  C:\WINDOWS\system32\USERENV.dll
0x5ad70000  0x38000   6.00.2900.5512  C:\WINDOWS\system32\UxTheme.dll
0x76390000  0x1d000   5.01.2600.5512  C:\WINDOWS\system32\IMM32.DLL
0x773d0000  0x103000  6.00.2900.5512  C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x5d090000  0x9a000   5.82.2900.5512  C:\WINDOWS\system32\comctl32.dll
0x77690000  0x21000   5.01.2600.5512  C:\WINDOWS\system32\NTMARTA.DLL
0x71bf0000  0x13000   5.01.2600.5512  C:\WINDOWS\system32\SAMLIB.dll
0x76f60000  0x2c000   5.01.2600.5512  C:\WINDOWS\system32\WLDAP32.dll
0x00630000  0x2c5000  5.01.2600.5512  C:\WINDOWS\system32\xpsp2res.dll
0x74c40000  0x6000    5.01.2600.5512  c:\windows\system32\lmhsvc.dll
0x76d60000  0x19000   5.01.2600.5512  c:\windows\system32\iphlpapi.dll
0x71ab0000  0x17000   5.01.2600.5512  c:\windows\system32\WS2_32.dll
0x71aa0000  0x8000    5.01.2600.5512  c:\windows\system32\WS2HELP.dll
0x765e0000  0x14000   5.01.2600.5512  c:\windows\system32\ssdpsrv.dll
0x662b0000  0x58000   5.01.2600.5512  C:\WINDOWS\system32\hnetcfg.dll
0x76fd0000  0x7f000   2001.12.4414.0700  C:\WINDOWS\system32\CLBCATQ.DLL
0x77050000  0xc5000   2001.12.4414.0700  C:\WINDOWS\system32\COMRes.dll
0x71a50000  0x3f000   5.01.2600.5625  C:\WINDOWS\system32\mswsock.dll
0x71a90000  0x8000    5.01.2600.5512  C:\WINDOWS\System32\wshtcpip.dll
0x68000000  0x36000   5.01.2600.5507  C:\WINDOWS\system32saenh.dll
0x67570000  0xa000    5.01.2600.5891  C:\WINDOWS\system32\httpapi.dll
0x4d4f0000  0x59000   5.01.2600.5868  C:\WINDOWS\system32\WINHTTP.dll
------------------------------------------------------------------------------
svchost.exe pid: 1560
Command line: C:\WINDOWS\system32\svchost.exe -k LocalService
Base        Size      Version	        Path
0x01000000  0x6000    5.01.2600.5512  C:\WINDOWS\system32\svchost.exe
0x7c900000  0xb2000   5.01.2600.5755  C:\WINDOWS\system32
tdll.dll
0x7c800000  0xf6000   5.01.2600.5781  C:\WINDOWS\system32\kernel32.dll
0x77dd0000  0x9b000   5.01.2600.5755  C:\WINDOWS\system32\ADVAPI32.dll
0x77e70000  0x92000   5.01.2600.5795  C:\WINDOWS\system32\RPCRT4.dll
0x77fe0000  0x11000   5.01.2600.5834  C:\WINDOWS\system32\Secur32.dll
0x5cb70000  0x26000   5.01.2600.5512  C:\WINDOWS\system32\ShimEng.dll
0x6f880000  0x1ca000  5.01.2600.5512  C:\WINDOWS\AppPatch\AcGenral.DLL
0x7e410000  0x91000   5.01.2600.5512  C:\WINDOWS\system32\USER32.dll
0x77f10000  0x49000   5.01.2600.5698  C:\WINDOWS\system32\GDI32.dll
0x76b40000  0x2d000   5.01.2600.5512  C:\WINDOWS\system32\WINMM.dll
0x774e0000  0x13d000  5.01.2600.5512  C:\WINDOWS\system32\ole32.dll
0x77c10000  0x58000   7.00.2600.5512  C:\WINDOWS\system32\msvcrt.dll
0x77120000  0x8b000   5.01.2600.5512  C:\WINDOWS\system32\OLEAUT32.dll
0x77be0000  0x15000   5.01.2600.5512  C:\WINDOWS\system32\MSACM32.dll
0x77c00000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\VERSION.dll
0x7c9c0000  0x817000  6.00.2900.6018  C:\WINDOWS\system32\SHELL32.dll
0x77f60000  0x76000   6.00.2900.5912  C:\WINDOWS\system32\SHLWAPI.dll
0x769c0000  0xb4000   5.01.2600.5512  C:\WINDOWS\system32\USERENV.dll
0x5ad70000  0x38000   6.00.2900.5512  C:\WINDOWS\system32\UxTheme.dll
0x76390000  0x1d000   5.01.2600.5512  C:\WINDOWS\system32\IMM32.DLL
0x773d0000  0x103000  6.00.2900.5512  C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x5d090000  0x9a000   5.82.2900.5512  C:\WINDOWS\system32\comctl32.dll
0x77690000  0x21000   5.01.2600.5512  C:\WINDOWS\system32\NTMARTA.DLL
0x71bf0000  0x13000   5.01.2600.5512  C:\WINDOWS\system32\SAMLIB.dll
0x76f60000  0x2c000   5.01.2600.5512  C:\WINDOWS\system32\WLDAP32.dll
0x00630000  0x2c5000  5.01.2600.5512  C:\WINDOWS\system32\xpsp2res.dll
0x5a6e0000  0x15000   5.01.2600.5512  c:\windows\system32\webclnt.dll
0x3d930000  0xe6000   8.00.6001.18939  C:\WINDOWS\system32\WININET.dll
0x00940000  0x9000    6.00.5441.0000  C:\WINDOWS\system32\Normaliz.dll
0x78130000  0x133000  8.00.6001.18939  C:\WINDOWS\system32\urlmon.dll
0x3dfd0000  0x1e8000  8.00.6001.18939  C:\WINDOWS\system32\iertutil.dll
0x71ab0000  0x17000   5.01.2600.5512  c:\windows\system32\WS2_32.dll
0x71aa0000  0x8000    5.01.2600.5512  c:\windows\system32\WS2HELP.dll
------------------------------------------------------------------------------
svchost.exe pid: 1696
Command line: C:\WINDOWS\system32\svchost.exe -k imgsvc
Base        Size      Version	        Path
0x01000000  0x6000    5.01.2600.5512  C:\WINDOWS\system32\svchost.exe
0x7c900000  0xb2000   5.01.2600.5755  C:\WINDOWS\system32
tdll.dll
0x7c800000  0xf6000   5.01.2600.5781  C:\WINDOWS\system32\kernel32.dll
0x77dd0000  0x9b000   5.01.2600.5755  C:\WINDOWS\system32\ADVAPI32.dll
0x77e70000  0x92000   5.01.2600.5795  C:\WINDOWS\system32\RPCRT4.dll
0x77fe0000  0x11000   5.01.2600.5834  C:\WINDOWS\system32\Secur32.dll
0x5cb70000  0x26000   5.01.2600.5512  C:\WINDOWS\system32\ShimEng.dll
0x6f880000  0x1ca000  5.01.2600.5512  C:\WINDOWS\AppPatch\AcGenral.DLL
0x7e410000  0x91000   5.01.2600.5512  C:\WINDOWS\system32\USER32.dll
0x77f10000  0x49000   5.01.2600.5698  C:\WINDOWS\system32\GDI32.dll
0x76b40000  0x2d000   5.01.2600.5512  C:\WINDOWS\system32\WINMM.dll
0x774e0000  0x13d000  5.01.2600.5512  C:\WINDOWS\system32\ole32.dll
0x77c10000  0x58000   7.00.2600.5512  C:\WINDOWS\system32\msvcrt.dll
0x77120000  0x8b000   5.01.2600.5512  C:\WINDOWS\system32\OLEAUT32.dll
0x77be0000  0x15000   5.01.2600.5512  C:\WINDOWS\system32\MSACM32.dll
0x77c00000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\VERSION.dll
0x7c9c0000  0x817000  6.00.2900.6018  C:\WINDOWS\system32\SHELL32.dll
0x77f60000  0x76000   6.00.2900.5912  C:\WINDOWS\system32\SHLWAPI.dll
0x769c0000  0xb4000   5.01.2600.5512  C:\WINDOWS\system32\USERENV.dll
0x5ad70000  0x38000   6.00.2900.5512  C:\WINDOWS\system32\UxTheme.dll
0x76390000  0x1d000   5.01.2600.5512  C:\WINDOWS\system32\IMM32.DLL
0x773d0000  0x103000  6.00.2900.5512  C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x5d090000  0x9a000   5.82.2900.5512  C:\WINDOWS\system32\comctl32.dll
0x75aa0000  0x55000   5.01.2600.5512  c:\windows\system32\wiaservc.dll
0x74ae0000  0x7000    5.01.2600.5512  c:\windows\system32\CFGMGR32.dll
0x77920000  0xf3000   5.01.2600.5512  c:\windows\system32\setupapi.DLL
0x73b30000  0x15000   5.01.2600.5627  c:\windows\system32\mscms.dll
0x73000000  0x26000   5.01.2600.5512  c:\windows\system32\WINSPOOL.DRV
0x76360000  0x10000   5.01.2600.5512  c:\windows\system32\WINSTA.dll
0x5b860000  0x55000   5.01.2600.5694  c:\windows\system32\NETAPI32.dll
0x00680000  0x2c5000  5.01.2600.5512  C:\WINDOWS\system32\xpsp2res.dll
0x76fd0000  0x7f000   2001.12.4414.0700  C:\WINDOWS\system32\CLBCATQ.DLL
0x77050000  0xc5000   2001.12.4414.0700  C:\WINDOWS\system32\COMRes.dll
0x76c30000  0x2e000   5.131.2600.5922  C:\WINDOWS\system32\WINTRUST.dll
0x77a80000  0x95000   5.131.2600.5512  C:\WINDOWS\system32\CRYPT32.dll
0x77b20000  0x12000   5.01.2600.5875  C:\WINDOWS\system32\MSASN1.dll
0x76c90000  0x28000   5.01.2600.5512  C:\WINDOWS\system32\IMAGEHLP.dll
0x71d40000  0x1b000   6.00.2900.5512  C:\WINDOWS\system32\actxprxy.dll
------------------------------------------------------------------------------
svchost.exe pid: 1736
Command line: C:\WINDOWS\System32\svchost.exe -k HTTPFilter
Base        Size      Version	        Path
0x01000000  0x6000    5.01.2600.5512  C:\WINDOWS\System32\svchost.exe
0x7c900000  0xb2000   5.01.2600.5755  C:\WINDOWS\system32
tdll.dll
0x7c800000  0xf6000   5.01.2600.5781  C:\WINDOWS\system32\kernel32.dll
0x77dd0000  0x9b000   5.01.2600.5755  C:\WINDOWS\system32\ADVAPI32.dll
0x77e70000  0x92000   5.01.2600.5795  C:\WINDOWS\system32\RPCRT4.dll
0x77fe0000  0x11000   5.01.2600.5834  C:\WINDOWS\system32\Secur32.dll
0x5cb70000  0x26000   5.01.2600.5512  C:\WINDOWS\System32\ShimEng.dll
0x6f880000  0x1ca000  5.01.2600.5512  C:\WINDOWS\AppPatch\AcGenral.DLL
0x7e410000  0x91000   5.01.2600.5512  C:\WINDOWS\system32\USER32.dll
0x77f10000  0x49000   5.01.2600.5698  C:\WINDOWS\system32\GDI32.dll
0x76b40000  0x2d000   5.01.2600.5512  C:\WINDOWS\System32\WINMM.dll
0x774e0000  0x13d000  5.01.2600.5512  C:\WINDOWS\system32\ole32.dll
0x77c10000  0x58000   7.00.2600.5512  C:\WINDOWS\system32\msvcrt.dll
0x77120000  0x8b000   5.01.2600.5512  C:\WINDOWS\system32\OLEAUT32.dll
0x77be0000  0x15000   5.01.2600.5512  C:\WINDOWS\System32\MSACM32.dll
0x77c00000  0x8000    5.01.2600.5512  C:\WINDOWS\system32\VERSION.dll
0x7c9c0000  0x817000  6.00.2900.6018  C:\WINDOWS\system32\SHELL32.dll
0x77f60000  0x76000   6.00.2900.5912  C:\WINDOWS\system32\SHLWAPI.dll
0x769c0000  0xb4000   5.01.2600.5512  C:\WINDOWS\system32\USERENV.dll
0x5ad70000  0x38000   6.00.2900.5512  C:\WINDOWS\System32\UxTheme.dll
0x76390000  0x1d000   5.01.2600.5512  C:\WINDOWS\system32\IMM32.DLL
0x773d0000  0x103000  6.00.2900.5512  C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x5d090000  0x9a000   5.82.2900.5512  C:\WINDOWS\system32\comctl32.dll
0x77690000  0x21000   5.01.2600.5512  C:\WINDOWS\System32\NTMARTA.DLL
0x71bf0000  0x13000   5.01.2600.5512  C:\WINDOWS\System32\SAMLIB.dll
0x76f60000  0x2c000   5.01.2600.5512  C:\WINDOWS\system32\WLDAP32.dll
0x00630000  0x2c5000  5.01.2600.5512  C:\WINDOWS\System32\xpsp2res.dll
0x5aa90000  0x7000    6.00.2600.5512  c:\windows\system32\w3ssl.dll
0x6f290000  0x16000   6.00.2600.5891  C:\WINDOWS\System32\strmfilt.dll
0x77a80000  0x95000   5.131.2600.5512  C:\WINDOWS\System32\CRYPT32.dll
0x77b20000  0x12000   5.01.2600.5875  C:\WINDOWS\System32\MSASN1.dll
0x67570000  0xa000    5.01.2600.5891  C:\WINDOWS\System32\HTTPAPI.dll
0x71ab0000  0x17000   5.01.2600.5512  C:\WINDOWS\System32\WS2_32.dll
0x71aa0000  0x8000    5.01.2600.5512  C:\WINDOWS\System32\WS2HELP.dll

No matching processes were found.

¤¤¤¤¤¤¤¤¤¤¤ Ports ¤¤¤¤¤¤¤¤¤¤

Pid   Process            Port  Proto Path                          
648                  ->  1027  TCP                                 
892                  ->  135   TCP                                 
1028                 ->  2869  TCP                                 
4     System         ->  139   TCP                                 
0     System         ->  2869  TCP                                 
4     System         ->  445   TCP                                 
648                  ->  123   UDP                                 
892                  ->  445   UDP                                 
1028                 ->  4500  UDP                                 
4     System         ->  1067  UDP                                 
0     System         ->  123   UDP                                 
0     System         ->  137   UDP                                 
0     System         ->  138   UDP                                 
0     System         ->  1900  UDP                                 
4     System         ->  500   UDP                                 

¤¤¤¤¤¤¤¤¤¤ Boot Execute ¤¤¤¤¤¤¤¤¤¤


HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute
   autocheck autochk *
     autocheck autochk *
     Auto Check Utility
     Microsoft Corporation
     5.01.2600.5512
     c:\windows\system32\autochk.exe
     23043c91a0f9dfb4b9e9f87b680863b4 (MD5)
     2d339527dc985be5ad163be8263e8e18892e8de5 (SHA-1)
     318a6f6db4a1ede7d3758e324350ea852449abd2a7bb77004fbc403cf9ffb08b (SHA-256)

¤¤¤¤¤¤¤¤¤¤ LSA | Security Providers ¤¤¤¤¤¤¤¤¤¤


HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders
   msapsspc.dll
     msapsspc.dll
     DPA Client for 32 bit platforms
     Microsoft Corporation
     6.00.0000.7755
     c:\windows\system32\msapsspc.dll
     f24b12786d60a17008319e3f2aee7799 (MD5)
     6ae0e3be35e8101001344cc216761c8a05ed4058 (SHA-1)
     bf916f65d770c61612678171cc184a0bf259992cec0bf607d26834ce2a234fb3 (SHA-256)
   schannel.dll
     schannel.dll
     TLS / SSL Security Provider
     Microsoft Corporation
     5.01.2600.6006
     c:\windows\system32\schannel.dll
     30ace70b3c0242f0d1ac3b4fa708710f (MD5)
     eeffe7ca576150637a240c658f89bd526d51e894 (SHA-1)
     252cd590ee9168635c21ac78718868abd5036731ebe9aa210c2055ca6f7c7be7 (SHA-256)
   digest.dll
     digest.dll
     Digest SSPI Authentication Package
     Microsoft Corporation
     6.00.2900.5512
     c:\windows\system32\digest.dll
     3d76dd0cbc536e0f8c45d23ed230beb2 (MD5)
     57c470b423ac9d8db9ad8e3a28c45cf8f86f329e (SHA-1)
     f74f94525ab7ce1e269452c9e1dd08411a668cfdd94f069c90fc2ee33cb35a12 (SHA-256)
   msnsspc.dll
     msnsspc.dll
     MSN Internet Access
     Microsoft Corporation
     6.01.1825.0000
     c:\windows\system32\msnsspc.dll
     a4388df80e52695ae92ee5f3f61f1619 (MD5)
     0f40373b80077964654f1cc826106fdd2ede0e58 (SHA-1)
     a4b7c6e10b92b5022ca6e8fd9094098614fd63178ea86a7b035eb89b373bf033 (SHA-256)

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages
   msv1_0
     msv1_0
     Microsoft Authentication Package v1.0
     Microsoft Corporation
     5.01.2600.5876
     c:\windows\system32\msv1_0.dll
     517561a1113b04e51d936cd018de1c1f (MD5)
     fb79958937f4574ea217321d1a869c02edbd9ebe (SHA-1)
     a5f572c3557705f28f7a465970f0432f55b616efd208ba0cbdffbf7a41f07c04 (SHA-256)

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages
   scecli
     scecli
     Windows Security Configuration Editor Client Engine
     Microsoft Corporation
     5.01.2600.5512
     c:\windows\system32\scecli.dll
     a86bb5e61bf3e39b62ab4c7e7085a084 (MD5)
     3a3535122da168a549d2007123e9ae06146f2002 (SHA-1)
     b88446e007153bb58c5ae867ac3fb4c46618bbaa5a152687201e0e81f881465a (SHA-256)

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages
   kerberos
     kerberos
     Kerberos Security Package
     Microsoft Corporation
     5.01.2600.5834
     c:\windows\system32\kerberos.dll
     99ea6ac9b3fee42e0438a3a24720ee3f (MD5)
     c92bc7c31cfbcc5376ea655d4fad5054e214535d (SHA-1)
     ef29e2cd4b24521ed103cfe68e5414ce411acd0e1139d316225ee52e80c40e5c (SHA-256)
   msv1_0
     msv1_0
     Microsoft Authentication Package v1.0
     Microsoft Corporation
     5.01.2600.5876
     c:\windows\system32\msv1_0.dll
     517561a1113b04e51d936cd018de1c1f (MD5)
     fb79958937f4574ea217321d1a869c02edbd9ebe (SHA-1)
     a5f572c3557705f28f7a465970f0432f55b616efd208ba0cbdffbf7a41f07c04 (SHA-256)
   schannel
     schannel
     TLS / SSL Security Provider
     Microsoft Corporation
     5.01.2600.6006
     c:\windows\system32\schannel.dll
     30ace70b3c0242f0d1ac3b4fa708710f (MD5)
     eeffe7ca576150637a240c658f89bd526d51e894 (SHA-1)
     252cd590ee9168635c21ac78718868abd5036731ebe9aa210c2055ca6f7c7be7 (SHA-256)
   wdigest
     wdigest
     Microsoft Digest Access
     Microsoft Corporation
     5.01.2600.5834
     c:\windows\system32\wdigest.dll
     3aaf9b35939ff9e58ccd18d41655c2fc (MD5)
     7c117e3a5d78d0deebb0be67d80ac8c9a25f6915 (SHA-1)
     af7358ab0a507d77569a8d38d2392c224bfbefd1264c069bbc6c677bc20c6b8b (SHA-256)

¤¤¤¤¤¤¤¤¤¤ Scheduled tasks ¤¤¤¤¤¤¤¤¤¤


¤¤¤¤¤¤¤¤¤¤ Programs ¤¤¤¤¤¤¤¤¤¤

Adobe Flash Player 10 ActiveX 10.0.22.87
Adobe Flash Player 10 Plugin 10.0.12.36
Agere Systems AC'97 Modem v2136D
C-Media WDM Audio Driver
CCleaner 2.35
Hazard Perception 2005/6
HiJackThis 1.0.0
Hotfix for Windows XP (KB952287) 1
Hotfix for Windows XP (KB976002-v5) 5
Hotfix for Windows XP (KB981793) 1
Huawei modem
List_Kill'em
MSN
Malwarebytes' Anti-Malware
Microsoft Visual C++ 2005 Redistributable 8.0.59193
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 9.0.30729
QuickTime
Security Update for Windows Internet Explorer 8 (KB2183461) 1
Security Update for Windows Internet Explorer 8 (KB971961) 1
Security Update for Windows Internet Explorer 8 (KB981332) 1
Security Update for Windows Internet Explorer 8 (KB982381) 1
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB2079403) 1
Security Update for Windows XP (KB2115168) 1
Security Update for Windows XP (KB2160329) 1
Security Update for Windows XP (KB2183461) 1
Security Update for Windows XP (KB2229593)

gen-hackman · Answer

ok

 if you have XP => double click
if you have Vista or Windows 7 => right click "execute as ...."

? Recovery List_Kill'em, with the shortcut on your desktop.

but this time:

? select the option Clean  

let the tool work.

end of the scan window closes, and you have a report called Kill'em. txt file on your desktop,

? paste the contents into your reply

after that :

* Download here: UsbFix on your desktop



/! Temporarily disable and only time to use UsbFix, the real-time protection in your antivirus and antispyware thy, which can affect strongly the process of finding and cleaning tool.

 if you have XP => double click
if you have Vista or Windows 7 => right click "execute as ...."

UsbFix icon located on your desktop.
On the page, click the button:

 "Supress" 

/! Branch your external data sources to your PC (USB keys, external hard drive, etc. ...) that may have been infected without opening

- Then click on OK
- Let the tool work.
- Post the report appears at the end.
The report is on C: \ UsbFix.txt



 Note: "process.exe", a component of the tool is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky Anti-Virus) as a RiskTool.
          It is not a virus, but a utility to terminate processes.
          Put into the wrong hands, this utility could adopt security software (antivirus, firewall ...) where the alert issued by the virus.

rubyg · Answer

I am running the kill'em tool - clean as you asked, but i do not know what you mean by  Branch your external data sources to your PC (USB keys, external hard drive, etc. ...) that may have been infected without opening 
 , sorry but i am not sure what you mean by that

rubyg · Answer

kill'em txt:-

¤¤¤¤¤¤¤¤¤¤ Kill'em by g3n-h@ckm@n 2.1.0.5 ¤¤¤¤¤¤¤¤¤¤ 
 
User : User (Administrators) 
Update on 12/09/2010 by g3n-h@ckm@n ::::: 16.00
Start at: 21:56:28 | 13/09/2010

Intel(R) Celeron(R) M processor         1.40GHz
Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : Security Master AV  [ Enabled | Updated ]
FW : Security Master AV[ Enabled ]

C:\ -> Local Fixed Disk | 37.25 Go (32.72 Go free) | NTFS
D:\ -> CD-ROM Disc
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes ------- Memory(Ko)

C:\WINDOWS\System32\smss.exe ----400 Ko
C:\WINDOWS\system32\csrss.exe ----3464 Ko
C:\WINDOWS\system32\winlogon.exe ----3100 Ko
C:\WINDOWS\system32\services.exe ----3376 Ko
C:\WINDOWS\system32\lsass.exe ----1664 Ko
C:\WINDOWS\system32\svchost.exe ----4784 Ko
C:\WINDOWS\system32\svchost.exe ----4248 Ko
C:\WINDOWS\System32\svchost.exe ----24364 Ko
C:\WINDOWS\system32\svchost.exe ----3452 Ko
C:\WINDOWS\system32\svchost.exe ----6188 Ko
C:\WINDOWS\Explorer.EXE ----18988 Ko
C:\WINDOWS\system32\spoolsv.exe ----4580 Ko
C:\WINDOWS\system32\svchost.exe ----3700 Ko
C:\WINDOWS\system32\svchost.exe ----4132 Ko
C:\WINDOWS\AGRSMMSG.exe ----2448 Ko
C:\WINDOWS\system32\keyhook.exe ----4288 Ko
C:\Program Files\Messenger\msmsgs.exe ----1856 Ko
C:\WINDOWS\system32\sistray.exe ----4244 Ko
C:\WINDOWS\System32\alg.exe ----3540 Ko
C:\WINDOWS\System32\svchost.exe ----3384 Ko
C:\WINDOWS\system32\cmd.exe ----2928 Ko
C:\WINDOWS\system32\wbem\wmiprvse.exe ----6676 Ko
C:\Program Files\List_Kill'em\ERUNT.EXE ----3264 Ko
C:\Program Files\List_Kill'em\pv.exe ----2232 Ko
 
¤¤¤¤¤¤¤¤¤¤ Files/folders : 

Quarantined & Deleted !! : C:\WINDOWS\SET3.tmp 
Quarantined & Deleted !! : C:\WINDOWS\SET4.tmp 
Quarantined & Deleted !! : C:\WINDOWS\SET8.tmp 
 
Quarantined & Deleted !! : C:\Documents and Settings\User\LOCAL Settings\Temp\SSUPDATE.EXE 
 
¤¤¤¤¤¤¤¤¤¤ Hosts ¤¤¤¤¤¤¤¤¤¤

127.0.0.1       localhost   

¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤

Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {0E5CBF21-D15F-11D0-8301-00AA005B4383}  
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : DisallowRun  
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoFind  
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoLogoff  
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoRun  
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoSetFolders  

¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	=         	https://www.msn.com/fr-fr/?ocid=iehp
Local Page	=         	C:\WINDOWS\system32\blank.htm
Default_Search_URL	=         	https://www.bing.com/?toHttps=1&redig=53EEB45F21EA47F2B95DF58497B5E6B6
Default_Page_URL	=         	https://www.msn.com/fr-fr/?ocid=iehp
Search Page	=         	https://www.bing.com/?toHttps=1&redig=53EEB45F21EA47F2B95DF58497B5E6B6

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	=         	https://www.google.com/?gws_rd=ssl
Local Page	=         	C:\WINDOWS\system32\blank.htm
Search Page	=         	http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

¤¤¤¤¤¤¤¤¤¤ Security Center ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] 
FirstRunDisabled	=      	1 () 
AntiVirusDisableNotify	=      	0 (0x0) 
FirewallDisableNotify	=      	0 (0x0) 
UpdatesDisableNotify	=      	0 (0x0) 
AntiVirusOverride	=      	0 (0x0) 
FirewallOverride	=      	0 (0x0) 
AntiSpywareOverride	=      	0 (0x0) 
 
¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤

 Ndisuio : Start = 3   
 EapHost : Start = 2   
 Ip6Fw : Start = 2   
 SharedAccess : Start = 2   
 wuauserv : Start = 2   
 wscsvc : Start = 2   

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Disk Cleaned
anti-ver blaster : OK 
Prefetch cleaned 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ 

FEATURE_BROWSER_EMULATION | svchost : 
====================================
 

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 
kernel: MBR read successfully
user & kernel MBR OK 
 
 
 
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

rubyg · Answer

ok thanks i have run the usbfix here is the log:-

############################## | UsbFix 7.024 | [Deletion]

User: User (Administrator) # USER-5EE492C982 [ ]
Updated 09/09/10 by El Desaparecido / C_XX
Started at 06:43:13 | 14/09/2010
Website: http://www.teamxscript.org
Contact: FindyKill.Contact@gmail.com

CPU: Intel(R) Celeron(R) M processor 1.40GHz
Microsoft Windows XP Home Edition (5.1.2600 32-Bit) # Service Pack 3
Internet Explorer 8.0.6001.18702

Windows Firewall: Enabled
Antivirus: Security Master AV  [Enabled | Updated]
Firewall: Security Master AV  [Enabled]
RAM -> 223 Mb 
C:\ (%systemdrive%) -> Fixed drive # 37 Gb (33 Mb free - 88%) [] # NTFS
D:\ -> CD-ROM

################## | Files # Infected Folders |


################## | Registry |


################## | Mountpoints2 |

Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\E
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{141be38c-1d4f-11de-aca1-0016ec0068d5}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{141be38e-1d4f-11de-aca1-0016ec0068d5}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{33f8aa68-1265-11de-ac94-0016ec0068d5}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{523723ba-3a74-11de-acd5-0016ec0068d5}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{911416aa-10c2-11de-ac8c-0016ec0068d5}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{92fe82e4-1163-11de-ac90-0016ec0068d5}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{9d9112a2-34f3-11de-accc-0016ec0068d5}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{af2ef061-7e86-11de-ad05-0016ec0068d5}

################## | Listing |

[13/09/2010 - 22:09:58 | A | 4] 	C:\AUTOEXEC.BAT
[12/09/2010 - 21:26:46 | SH | 211] 	C:\boot.ini
[14/03/2009 - 18:29:35 | A | 0] 	C:\CONFIG.SYS
[09/09/2010 - 07:07:45 | D ] 	C:\Documents and Settings
[07/09/2010 - 08:55:57 | D ] 	C:\go
[14/03/2009 - 18:29:35 | RASH | 0] 	C:\IO.SYS
[13/09/2010 - 21:56:31 | D ] 	C:\Kill'em
[12/09/2010 - 21:54:32 | A | 24688] 	C:\List'em.txt
[14/03/2009 - 18:29:35 | RASH | 0] 	C:\MSDOS.SYS
[14/04/2008 - 13:00:00 | RASH | 47564] 	C:\NTDETECT.COM
[14/04/2008 - 13:00:00 | RASH | 250048] 	C:
tldr
[14/09/2010 - 06:39:50 | ASH | 352321536] 	C:\pagefile.sys
[12/09/2010 - 21:39:13 | RD ] 	C:\Program Files
[14/09/2010 - 06:43:53 | SHD ] 	C:\RECYCLER
[08/09/2010 - 14:05:11 | A | 390] 	C:kill.log
[10/09/2010 - 08:15:57 | SHD ] 	C:\System Volume Information
[14/09/2010 - 06:43:53 | D ] 	C:\UsbFix
[14/09/2010 - 06:43:54 | A | 733] 	C:\UsbFix.txt
[13/09/2010 - 22:09:43 | D ] 	C:\WINDOWS

################## | Vaccin |

C:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)

################## | E.O.F |

i notice it still says security master av enabled at the top of this report !

gen-hackman · Answer

ok hello i 'm coming back now ^^  

Download here:  OTL   

 saves the on your desktop.  

if you have XP = double click  
if you have Vista or Windows 7 => right click "run as ....  

OTL.exe about to launch.  

? Tick the 2 boxes and Purity Lop  

? Please check the box in front  all users   

? Rule on file age  60 days  

? in the left half,  put everything on "all"  

 does not change this:  

"File created" and "Changed files"   

? Click on  Analysis .  

At the end of the scan, Notepad will open with the report (OTL.txt).  

This file is on your desktop (usually C: \ Documents and Settings \ session name \ OTL.txt)  

? ?DO NOT POST ON THE FORUM      

To send me click on this link: http://www.cijoint.fr/  

? Click on Browse and look for the above file.  

? Click Open.  

? Click on "Click here to submit the file".  

just at the button at the end of loading the file, a link of this form appear:  

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt  

? Copy this link in your answer.  

? ? You will do the same thing with the "Extra.txt" which logically will also be on your desktop.

rubyg · Answer

Hello, the problem is solved !
 last night i was browsing some forums while you were away just because i had nothing else to do,  and someone suggested i run combofix and post the log into the forum , (not this one), just to see if they could spot anything, but it turns out as soon as i started combofix, the windows security centre icon popped up to say the firewall was switched off and there was no antivirus installed , i knew then it was fixed as  up until then the security master av had full control of both, i let combo fix run and it even fixed the windows recovery console which had disappeared . i did not even need to post the log, i dont know how it did it but the laptop is free of security master av now, thank you all so much for your help you have been brilliant  and so patient.

gen-hackman · Answer

ok perhaps but you are still infected , combofix doesn't delete all of the infection but i see you prefer use some tools without knowing what they really do , then i think so you can do your desinfection alone

i didn't say to you to make combofix

your machine could be out of order with combofix and also , what would you do with a machine out of order ??

goodbye

Security master av removal

45 responses

Similar discussions

Subscribe To Our Newsletter!