 Can't Remove Vitrumonde |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Forum Guidelines
Read this topic before posting a log. DO NOT post a ComboFix log unless requested to. Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log. When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc. Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  |
 Jul 4 2008, 12:21 PM
Post
#1
|
|
|
New Member  Group: Members Posts: 5 Joined: 4-July 08 Member No.: 220,440  |
Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\System32\WLTRAY.EXE C:\Windows\sttray.exe C:\Program Files\Dell\MediaDirect\PCMService.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Symantec AntiVirus\VPTray.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Adobe\Acrobat 7.0\Distillr\acrotray.exe C:\Program Files\Lexmark 6500 Series\lxdfamon.exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\Windows\System32\rundll32.exe C:\Program Files\DNA\btdna.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Windows\system32\rundll32.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\SearchFilterHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.update.microsoft.com/windowsupd...t.aspx?ln=en-us R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com/"); (C:\Documents and Settings\MARK\Application Data\Mozilla\Profiles\default\hbmazr6t.slt\prefs.js) N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\MARK\Application Data\Mozilla\Profiles\default\hbmazr6t.slt\prefs.js) O1 - Hosts: ::1 localhost O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [lxdfmon.exe] "C:\Program Files\Lexmark 6500 Series\lxdfmon.exe" O4 - HKLM\..\Run: [lxdfamon] "C:\Program Files\Lexmark 6500 Series\lxdfamon.exe" O4 - HKLM\..\Run: [Lexmark 6500 Series Fax Server] "C:\Program Files\Lexmark 6500 Series\fm3032.exe" /s O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\efcCUNeF.dll,#1 O4 - HKLM\..\Run: [BMaf780db2] Rundll32.exe "C:\Windows\system32\nbbhgsab.dll",s O4 - HKLM\..\Run: [ac4b3e2e] rundll32.exe "C:\Windows\system32\gmycciiy.dll",b O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: QuickSet.lnk = ? O4 - Global Startup: VPN Client.lnk = ? O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O13 - Gopher Prefix: O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: lxdfCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdfserv.exe O23 - Service: lxdf_device - - C:\Windows\system32\lxdfcoms.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe |
 |
 
|
|
Jul 5 2008, 11:23 AM
Post
#2
|
|
|
Malware Expert Group: HJT Team Posts: 9,576 Joined: 23-December 04 Member No.: 7,762 |
Hi and welcome to Bleeping Computer! My name is Sam and I will be helping you.
 Please download Deckard's System Scanner (DSS) and save to your Desktop. alternate download site DSS will do the following:
-- If you get a warning from your anti-virus while DSS is scanning, please allow DSS to continue as the scan is not harmful. --------------------  If I have helped you in any way, please consider a donation to help me continue the fight against malware.[ Start Here ] [ Adaware 2008 ] [ Spybot ] [ AVG Antivirus ] [ Superantispyware ] [ MalwareBytes ] [ Spyware Blaster ] [ Windows Update ] [ How to install Windows XP Recovery Console ] |
|
|
|
|
Jul 5 2008, 01:31 PM
Post
#3
|
|
|
New Member Group: Members Posts: 5 Joined: 4-July 08 Member No.: 220,440 |
Sam - Thanks a lot for your response. Here are the main.txt and extra.txt files:
Deckard's System Scanner v20071014.68 Run by Mark on 2008-07-05 14:02:29 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- Last 4 Restore Point(s) -- 4: 2008-07-05 00:31:06 UTC - RP259 - Scheduled Checkpoint 3: 2008-07-03 18:49:25 UTC - RP258 - Installed Ad-Aware 2: 2008-07-03 18:45:44 UTC - RP257 - Removed Ad-Aware 2007 1: 2008-07-03 15:52:46 UTC - RP256 - Last known good configuration Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Mark.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:20:24 PM, on 7/5/2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16681) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\System32\WLTRAY.EXE C:\Windows\sttray.exe C:\Program Files\Dell\MediaDirect\PCMService.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Symantec AntiVirus\VPTray.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Adobe\Acrobat 7.0\Distillr\acrotray.exe C:\Program Files\Lexmark 6500 Series\lxdfmon.exe C:\Program Files\Lexmark 6500 Series\lxdfamon.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\Program Files\DNA\btdna.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Users\Mark\Desktop\dss.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\system32\rundll32.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Mark.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.update.microsoft.com/windowsupd...t.aspx?ln=en-us R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com/"); (C:\Documents and Settings\MARK\Application Data\Mozilla\Profiles\default\hbmazr6t.slt\prefs.js) N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\MARK\Application Data\Mozilla\Profiles\default\hbmazr6t.slt\prefs.js) O1 - Hosts: ::1 localhost O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll O2 - BHO: {a1410b23-7d48-e85a-2724-01540e7db081} - {180bd7e0-4510-4272-a58e-84d732b0141a} - C:\Windows\system32\hfvahv.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {6DEA0A0F-D9D0-4CFE-AEF5-B70CB245C8A2} - C:\Windows\system32\mlJYqpqr.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {893A20CA-8217-4718-94B8-D1C70B10978B} - (no file) O2 - BHO: (no name) - {9389D357-6E28-413E-8CB1-C9637AF91099} - C:\Windows\system32\fccaXPiG.dll (file missing) O2 - BHO: (no name) - {A4F56CE4-E382-44BF-8564-F7D3EBDA0B8B} - C:\Windows\system32\jkkLFyxw.dll (file missing) O2 - BHO: (no name) - {AD4D5572-EE4F-4101-B36B-226681CEE0C6} - C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FVGD6P5F\3077ahntdksr[1].dll O2 - BHO: (no name) - {D62A2513-0A8B-44F8-8479-3AFFAFC5FF82} - C:\Windows\system32\jKARHYro.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [lxdfmon.exe] "C:\Program Files\Lexmark 6500 Series\lxdfmon.exe" O4 - HKLM\..\Run: [lxdfamon] "C:\Program Files\Lexmark 6500 Series\lxdfamon.exe" O4 - HKLM\..\Run: [Lexmark 6500 Series Fax Server] "C:\Program Files\Lexmark 6500 Series\fm3032.exe" /s O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\jKARHYro.dll,#1 O4 - HKLM\..\Run: [BMaf780db2] Rundll32.exe "C:\Windows\system32\nbbhgsab.dll",s O4 - HKLM\..\Run: [ac4b3e2e] rundll32.exe "C:\Windows\system32\fhscnchf.dll",b O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: QuickSet.lnk = ? O4 - Global Startup: VPN Client.lnk = ? O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O13 - Gopher Prefix: O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: lxdfCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdfserv.exe O23 - Service: lxdf_device - - C:\Windows\system32\lxdfcoms.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 11524 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys <Not Verified; PowerISO Computing, Inc.; scdemu> R3 mcdbus (Driver for MagicISO SCSI Host Controller) - c:\windows\system32\drivers\mcdbus.sys <Not Verified; MagicISO, Inc.; MagicISO SCSI Host Controller> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 sprtsvc_dellsupportcenter (SupportSoft Sprocket Service (dellsupportcenter)) - c:\program files\dell support center\bin\sprtsvc.exe /service /p dellsupportcenter R2 STacSV (SigmaTel Audio Service) - c:\program files\sigmatel\c-major audio\wdm\stacsv.exe <Not Verified; SigmaTel, Inc.; C-Major Audio> S3 stllssvr - "c:\program files\common files\surething shared\stllssvr.exe" <Not Verified; MicroVision Development, Inc.; SureThing CD Labeler> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Cisco Systems VPN Adapter Device ID: ROOT\NET\0000 Manufacturer: Cisco Systems Name: Cisco Systems VPN Adapter PNP Device ID: ROOT\NET\0000 Service: CVirtA -- Files created between 2008-06-05 and 2008-07-05 ----------------------------- 2008-07-05 14:18:19 78336 --a------ C:\Windows\system32\fhscnchf.dll 2008-07-05 14:15:18 653861 --ahs---- C:\Windows\system32\FgQpAJlm.ini2 2008-07-05 14:15:14 318976 --a------ C:\Windows\system32\mlJApQgF.dll 2008-07-05 14:02:57 25088 --a------ C:\Windows\system32\jKARHYro.dll 2008-07-05 13:47:21 103424 --a------ C:\Windows\system32\hfvahv.dll 2008-07-05 13:47:19 103424 --a------ C:\Windows\system32\nerrxonq.dll 2008-07-05 13:14:20 78336 -----n--- C:\Windows\system32\cpfnwquf.dll 2008-07-04 13:12:16 103424 --a------ C:\Windows\system32\gvynrb.dll 2008-07-04 13:12:14 103424 --a------ C:\Windows\system32\krlqaoyj.dll 2008-07-04 13:09:18 0 d-------- C:\Program Files\Enigma Software Group 2008-07-04 12:26:43 103424 --a------ C:\Windows\system32\vrdopq.dll 2008-07-04 12:26:41 103424 --a------ C:\Windows\system32\pxqtfxuy.dll 2008-07-04 12:23:14 78848 --a------ C:\Windows\system32\jtudrijm.dll 2008-07-04 12:22:26 0 d-------- C:\Program Files\Trend Micro 2008-07-04 12:20:13 656059 --ahs---- C:\Windows\system32\rqpqYJlm.ini2 2008-07-04 12:20:07 319488 -----n--- C:\Windows\system32\mlJYqpqr.dll 2008-07-04 12:01:56 103424 --a------ C:\Windows\system32\wntrde.dll 2008-07-04 12:01:55 103424 --a------ C:\Windows\system32\cbktxtpa.dll 2008-07-04 11:55:55 78848 -----n--- C:\Windows\system32\gmycciiy.dll 2008-07-03 21:20:46 0 d-------- C:\VundoFix Backups 2008-07-03 14:50:10 0 d-------- C:\Program Files\Lavasoft 2008-07-03 11:50:13 656224 --ahs---- C:\Windows\system32\GiPXaccf.ini2 2008-07-02 21:54:16 639137 --ahs---- C:\Windows\system32\ihhgQqru.ini2 2008-07-02 21:47:12 0 -rahs---- C:\MSDOS.SYS 2008-07-02 21:47:12 0 -rahs---- C:\IO.SYS 2008-07-01 15:20:02 81408 -----n--- C:\Windows\system32\onmxpimw.dll 2008-07-01 15:19:44 345 --ahs---- C:\Windows\system32\ggfgQXbc.ini2 2008-07-01 14:05:56 81408 -----n--- C:\Windows\system32\uatlqcos.dll 2008-07-01 13:57:16 656294 --ahs---- C:\Windows\system32\wxyFLkkj.ini2 2008-07-01 13:52:21 0 d-------- C:\Program Files\Windows Doctor 2008-07-01 07:23:00 0 d-------- C:\Program Files\MozBackup 2008-06-12 20:22:53 0 d-------- C:\Program Files\QuickTime 2008-06-12 20:22:48 0 d-------- C:\Users\All Users\Apple Computer -- Find3M Report --------------------------------------------------------------- 2008-07-05 14:12:02 0 d-------- C:\Users\Mark\AppData\Roaming\DNA 2008-07-04 19:29:04 0 d-------- C:\Program Files\SPSSEVAL 2008-07-04 19:29:03 73 --a------ C:\Windows\system32\ssprs.dll 2008-07-04 19:28:53 205 --a------ C:\Windows\system32\lsprst7.dll 2008-07-03 14:47:44 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-07-01 13:51:11 0 d-------- C:\Users\Mark\AppData\Roaming\BitTorrent 2008-06-30 14:30:58 0 d-------- C:\Users\Mark\AppData\Roaming\LimeWire 2008-06-30 14:23:22 0 d-------- C:\Program Files\LimeWire 2008-06-17 14:14:19 0 d-------- C:\Users\Mark\AppData\Roaming\Mozilla 2008-06-12 03:15:37 0 d-------- C:\Program Files\Windows Mail 2008-06-07 19:35:54 0 d-------- C:\Program Files\DivX 2008-05-30 19:22:48 802816 --a------ C:\Windows\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?> 2008-05-30 19:22:48 823296 --a------ C:\Windows\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®> 2008-05-30 19:22:48 823296 --a------ C:\Windows\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®> 2008-05-30 19:22:46 815104 --a------ C:\Windows\system32\divx_xx0a.dll <Not Verified; DivX, Inc.; DivX®> 2008-05-30 19:22:46 683520 --a------ C:\Windows\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®> 2008-05-24 16:32:32 0 d-------- C:\Users\Mark\AppData\Roaming\6500 Series 2008-05-24 16:28:33 0 d-------- C:\Program Files\Google 2008-05-22 18:22:18 3596288 --a------ C:\Windows\system32\qt-dx331.dll 2008-05-22 18:19:46 196608 --a------ C:\Windows\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100> 2008-05-22 18:19:46 81920 --a------ C:\Windows\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100> 2008-05-22 18:18:54 12288 --a------ C:\Windows\system32\DivXWMPExtType.dll 2008-05-16 10:53:00 0 d-------- C:\Users\Mark\AppData\Roaming\U3 2008-05-13 19:48:25 0 d-------- C:\Program Files\Common Files\Real 2008-05-08 12:55:50 0 d-------- C:\Program Files\Common Files\Adobe 2008-05-05 09:09:43 0 d-------- C:\Program Files\Opera -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{180bd7e0-4510-4272-a58e-84d732b0141a}] 07/05/2008 01:47 PM 103424 --a------ C:\Windows\system32\hfvahv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6DEA0A0F-D9D0-4CFE-AEF5-B70CB245C8A2}] 07/04/2008 12:20 PM 319488 --------- C:\Windows\system32\mlJYqpqr.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{893A20CA-8217-4718-94B8-D1C70B10978B}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9389D357-6E28-413E-8CB1-C9637AF91099}] C:\Windows\system32\fccaXPiG.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A4F56CE4-E382-44BF-8564-F7D3EBDA0B8B}] C:\Windows\system32\jkkLFyxw.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AD4D5572-EE4F-4101-B36B-226681CEE0C6}] 07/03/2008 01:09 PM 88576 --a------ C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FVGD6P5F\3077ahntdksr[1].dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D62A2513-0A8B-44F8-8479-3AFFAFC5FF82}] 07/01/2008 01:52 PM 25088 --a------ C:\Windows\system32\jKARHYro.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [10/09/2007 02:43 AM] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [11/17/2006 07:52 PM] "Broadcom Wireless Manager UI"="C:\Windows\system32\WLTRAY.exe" [11/27/2006 06:56 PM] "SigmatelSysTrayApp"="sttray.exe" [02/08/2007 01:11 AM C:\Windows\sttray.exe] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [07/11/2006 06:12 PM] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [10/03/2006 12:37 PM] "PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [05/02/2007 06:16 PM] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [12/07/2006 08:25 PM] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [08/05/2007 05:29 PM] "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [08/06/2007 08:05 PM] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [10/09/2007 07:57 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 05:25 AM] "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [12/14/2004 03:12 AM] "@"="" [] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 10:16 PM] "lxdfmon.exe"="C:\Program Files\Lexmark 6500 Series\lxdfmon.exe" [06/11/2007 09:53 PM] "lxdfamon"="C:\Program Files\Lexmark 6500 Series\lxdfamon.exe" [06/01/2007 04:06 PM] "Lexmark 6500 Series Fax Server"="C:\Program Files\Lexmark 6500 Series\fm3032.exe" [06/11/2007 09:56 PM] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [10/09/2007 07:56 PM] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [05/27/2008 10:50 AM] "MSServer"="C:\Windows\system32\jKARHYro.dll" [07/01/2008 01:52 PM] "BMaf780db2"="C:\Windows\system32\nbbhgsab.dll" [] "ac4b3e2e"="C:\Windows\system32\fhscnchf.dll" [07/05/2008 02:18 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [10/09/2007 07:56 PM] "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [05/08/2008 05:31 PM] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Acrobat Speed Launcher.lnk - C:\Windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2/5/2008 1:05:08 PM] Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [10/16/2007 10:03:15 AM] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [10/8/2007 7:15:35 PM] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2/17/1999 4:05:56 PM] QuickSet.lnk - C:\Windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [10/8/2007 7:11:36 PM] VPN Client.lnk - C:\Windows\Installer\{14FCFE7C-AB86-428A-9D2E-BFB6F5A7AA6E}\Icon3E5562ED7.ico [2/5/2008 2:58:08 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"=2 (0x2) "EnableLUA"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{D62A2513-0A8B-44F8-8479-3AFFAFC5FF82}"= C:\Windows\system32\jKARHYro.dll [07/01/2008 01:52 PM 25088] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\Windows\system32\mlJYqpqr [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] @="IEEE 1394 Bus host controllers" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] @="SBP2 IEEE 1394 Devices" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] @="SecurityDevices" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] AutoRun\command- G:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8124c717-384f-11dd-89da-0019b979bb0d}] AutoRun\command- H:\2y8la.exe explore\Command- H:\2y8la.exe open\Command- H:\2y8la.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e4866c3d-7b67-11dc-8d2e-0019b979bb0d}] AutoRun\command- H:\LaunchU3.exe -a [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] C:\Windows\system32\unregmp2.exe /ShowWMP [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI -- Hosts ----------------------------------------------------------------------- 127.0.0.1 007guard.com 127.0.0.1 www.007guard.com 127.0.0.1 008i.com 127.0.0.1 008k.com 127.0.0.1 www.008k.com 127.0.0.1 00hq.com 127.0.0.1 www.00hq.com 127.0.0.1 010402.com 127.0.0.1 032439.com 127.0.0.1 www.032439.com 8020 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2008-07-05 14:24:55 ------------ Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft® Windows Vista™ Home Premium (build 6000) Architecture: X86; Language: English CPU 0: Intel® Core™ Duo CPU T2350 @ 1.86GHz Percentage of Memory in Use: 39% Physical Memory (total/avail): 2045.82 MiB / 1244.59 MiB Pagefile Memory (total/avail): 4309.45 MiB / 3369.43 MiB Virtual Memory (total/avail): 2047.88 MiB / 1916.62 MiB C: is Fixed (NTFS) - 136.99 GiB total, 64.81 GiB free. D: is Fixed (NTFS) - 10 GiB total, 5.87 GiB free. E: is CDROM (No Media) F: is CDROM (No Media) G: is CDROM (No Media) \\.\PHYSICALDRIVE0 - ST9160821AS ATA Device - 149.05 GiB - 4 partitions \PARTITION0 - Unknown - 62.72 MiB \PARTITION1 - Installable File System - 10 GiB - D: \PARTITION2 (bootable) - Installable File System - 136.99 GiB - C: \PARTITION3 - Extended w/Extended Int 13 - 2048 MiB -- Security Center ------------------------------------------------------------- AUOptions is set to notify before install. Windows Internal Firewall is enabled. AV: Symantec AntiVirus v10.2.0.322 (Symantec Corporation) AS: Spybot - Search and Destroy v1.0.0.5 (Safer Networking Ltd.) Disabled AS: Symantec AntiVirus v10.2.0.322 (Symantec Corporation) AS: Windows Defender v1.1.1505.0 (Microsoft Corporation) Disabled [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent" -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\ProgramData APPDATA=C:\Users\Mark\AppData\Roaming ARCGISHOME=C:\Program Files\ArcGIS\ CLASSPATH=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=MARK-PC ComSpec=C:\Windows\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Users\Mark LOCALAPPDATA=C:\Users\Mark\AppData\Local LOGONSERVER=\\MARK-PC NUMBER_OF_PROCESSORS=2 OS=Windows_NT Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\;"C:\Program Files\Mplus\";C:\Program Files\QuickTime\QTSystem\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 14 Stepping 12, GenuineIntel PROCESSOR_LEVEL=6 PROCESSOR_REVISION=0e0c ProgramData=C:\ProgramData ProgramFiles=C:\Program Files PROMPT=$P$G PUBLIC=C:\Users\Public PYTHONPATH=C:\Program Files\ArcGIS\bin QTJAVA=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip RoxioCentral=C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\ SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\Windows TEMP=C:\Users\Mark\AppData\Local\Temp TMP=C:\Users\Mark\AppData\Local\Temp USERDOMAIN=Mark-PC USERNAME=Mark USERPROFILE=C:\Users\Mark windir=C:\Windows -- User Profiles --------------------------------------------------------------- Mark (admin) -- Add/Remove Programs --------------------------------------------------------- --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 --> C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER ABBYY FineReader 6.0 Sprint --> MsiExec.exe /X{ACF60000-22B9-4CE9-98D6-2CCF359BAC07} Ad-Aware --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF} Adobe Acrobat 7.0 Professional --> msiexec /I {AC76BA86-1033-0000-7760-000000000002} Adobe Flash Player 9 ActiveX --> C:\Windows\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete Adobe Flash Player Plugin --> C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe Adobe InDesign 1.5 --> C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\InDesign 1.5\Uninst.isu" -c"C:\Program Files\Adobe\InDesign 1.5\Uninst.dll" Adobe Photoshop 7.0 --> C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\Photoshop 7.0\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 7.0\Uninst.dll" Adobe Reader 8.1.2 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003} Adobe Shockwave Player 11 --> C:\Windows\system32\adobe\SHOCKW~1\UNWISE.EXE C:\Windows\system32\Adobe\SHOCKW~1\Install.log AOL Install --> MsiExec.exe /I{2357B8BC-88C9-4A72-818C-050CC4EB0778} Apple Software Update --> MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F} ArcGIS Desktop --> MsiExec.exe /I{1F34839E-4826-4B64-B1B3-42E5AE8DEC5A} ATI Catalyst Control Center Ex --> MsiExec.exe /I{493BAF04-DA99-9257-B343-E17BB5E687A3} BitTorrent --> "C:\Program Files\BitTorrent\BitTorrent.exe" /UNINSTALL Canon Camera Window DC_DV 6 for ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.2.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowDVC6\Uninst.ini" Canon Camera Window MC 6 for ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.2.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowMC\Uninst.ini" Canon G.726 WMP-Decoder --> "C:\Program Files\Common Files\Canon\UIW\1.2.0.0\Uninst.exe" "C:\Program Files\Canon\G726Decoder\G726DecUnInstall.ini" Canon MovieEdit Task for ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.2.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX\Program\MVWUninst.ini" Canon RAW Image Task for ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.2.0.0\Uninst.exe" "C:\Program Files\Canon\RAW Image Task\Uninst.ini" Canon RemoteCapture Task for ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.2.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\RemoteCaptureTask DC\Uninst.ini" Canon Utilities EOS Utility --> "C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\EOS Utility\Uninst.ini" Canon Utilities PhotoStitch --> "C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\PhotoStitch\Uninst.ini" Canon Utilities ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.2.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX\Program\Uninst.ini" Cisco Systems VPN Client 5.0.01.0600 --> MsiExec.exe /X{14FCFE7C-AB86-428A-9D2E-BFB6F5A7AA6E} Conexant HDA D110 MDC V.92 Modem --> C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3\HXFSETUP.EXE -U -IDellHDAz.inf Cool CD Ripper V1.28 --> "C:\Program Files\Cool CD Ripper\unins000.exe" Dell Support Center --> MsiExec.exe /X{E3BFEE55-39E2-4BE0-B966-89FE583822C1} Dell System Customization Wizard --> MsiExec.exe /I{13BA7B44-B712-4DEE-A7B8-1DD564F37AE5} Dell Wireless WLAN Card --> "C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Program Files\Dell\Dell Wireless WLAN Card" Digital Line Detect --> C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonly DivX Codec --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC DivX Converter --> C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER DivX Player --> C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER DivX Web Player --> C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN DNA --> "C:\Program Files\DNA\btdna.exe" /UNINSTALL EarthLink Setup Files --> MsiExec.exe /X{5E68BB65-4059-4FE5-AAC4-0CD1D79BBDE2} EndNote 9 Demonstration Edition --> MsiExec.exe /I{5E9E6F30-8C1A-11D9-8BDE-F66BAD1E3F3A} FLV Player --> "C:\Windows\FLV Player\uninstall.exe" "/U:C:\Program Files\FLV Player\Uninstall\uninstall.xml" FLV Player 2.0, build 24 --> C:\Program Files\FLV Player\uninst.exe Games, Music, & Photos Launcher --> MsiExec.exe /I{3E25E350-949F-4DB7-8288-2A60E018B4C1} Google Earth --> MsiExec.exe /I{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90} HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall Internet Service Offers Launcher --> MsiExec.exe /I{CCFF1E13-77A2-4032-8B12-7566982A27DF} ISI ResearchSoft - Export Helper --> C:\PROGRA~1\COMMON~1\Risxtd\_UNINST.EXE Java™ 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030} Java™ 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050} Java™ SE Runtime Environment 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000} Lexmark 6500 Series --> C:\Program Files\Lexmark 6500 Series\Install\x86\Uninst.exe Lexmark Toolbar --> regsvr32.exe /s /u "C:\Program Files\Lexmark Toolbar\toolband.dll" LimeWire 4.18.3 --> "C:\Program Files\LimeWire\uninstall.exe" LiveUpdate 3.2 (Symantec Corporation) --> "C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U Macromedia Flash Player 8 --> MsiExec.exe /X{6815FCDD-401D-481E-BA88-31B4754C2B46} Magic ISO Maker v5.4 (build 0251) --> C:\PROGRA~1\MagicISO\UNWISE.EXE C:\PROGRA~1\MagicISO\INSTALL.LOG MagicDisc 2.5.79 --> C:\PROGRA~1\MAGICD~1\UNWISE.EXE C:\PROGRA~1\MAGICD~1\INSTALL.LOG MediaDirect --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}\Setup.exe" -l0x9 -cluninstall Microsoft Office 2000 Professional --> MsiExec.exe /I{00010409-78E1-11D2-B60F-006097C998E7} Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE} Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE} Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE} Microsoft Office Proofing (English) 2007 --> MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE} Microsoft Office Shared MUI (English) 2007 --> MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE} Microsoft Office Shared Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE} Microsoft Office Visio MUI (English) 2007 --> MsiExec.exe /X{90120000-0054-0409-0000-0000000FF1CE} Microsoft Office Visio Professional 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall VISPRO /dll OSETUP.DLL Microsoft Office Visio Professional 2007 --> MsiExec.exe /X{90120000-0051-0000-0000-0000000FF1CE} Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7} Microsoft Word Supplemental Macros --> MsiExec.exe /I{3B8E4062-F294-11D2-A432-00C04F756128} Modem Diagnostic Tool --> MsiExec.exe /I{F63A3748-B93D-4360-9AD4-B064481A5C7B} Mozilla Firefox (3.0) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe Mozilla Thunderbird (2.0.0.14) --> C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe Mplus Version 5 Base Program (32-bit) --> MsiExec.exe /I{5A15DDB7-B3D7-4F46-8C01-543EAB67CF43} MSXML 4.0 SP2 (KB936181) --> MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF} MSXML 4.0 SP2 (KB941833) --> MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF} Netscape (7.2) --> C:\Windows\NSUninst.exe /ua "7.2 (en)" Netscape Navigator (9.0.0.6) --> C:\Program Files\Netscape\Navigator 9\uninstall\helper.exe NetWaiting --> C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonly NetZeroInstallers --> MsiExec.exe /X{352310C3-E46B-42D3-8F32-54721FDD72D9} OutlookAddinSetup --> MsiExec.exe /I{9BDEF074-020E-458D-ADC5-8FF68E0C9B56} Photodex Presenter --> C:\Program Files\Photodex Presenter\uninst.exe PowerISO --> "C:\Program Files\PowerISO\uninstall.exe" Product Documentation Launcher --> MsiExec.exe /I{89CEAE14-DD0F-448E-9554-15781EC9DB24} Python 2.4.1 --> C:\Python24\\Python24\UNWISE.EXE C:\Python24\\Python24\INSTALL.LOG QuickSet --> MsiExec.exe /I{7F0C4457-8E64-491B-8D7B-991504365D1E} QuickTime --> MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175} RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 Roxio Creator Audio --> MsiExec.exe /I{83FFCFC7-88C6-41c6-8752-958A45325C82} Roxio Creator BDAV Plugin --> MsiExec.exe /I{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC} Roxio Creator Copy --> MsiExec.exe /I{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048} Roxio Creator Data --> MsiExec.exe /I{0D397393-9B50-4c52-84D5-77E344289F87} Roxio Creator DE --> MsiExec.exe /I{C8B0680B-CDAE-4809-9F91-387B6DE00F7C} Roxio Creator Tools --> MsiExec.exe /I{0394CDC8-FABD-4ed8-B104-03393876DFDF} Roxio Express Labeler --> MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA} Roxio MyDVD DE --> MsiExec.exe /I{D639085F-4B6E-4105-9F37-A0DBB023E2FB} Roxio Update Manager --> MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E} SigmaTel Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}\setup.exe" -l0x9 -remove -removeonly Sonic Activation Module --> MsiExec.exe /I{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0} SopCast 3.0.1 --> C:\Program Files\SopCast\uninst.exe SPSS 13.0 for Windows --> MsiExec.exe /X{381CC72A-6BC3-430a-A847-A7BCEB63A8A1} Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe" Spybot - Search & Destroy 1.5.2.20 --> "C:\Windows\unins000.exe" SpyHunter --> "C:\Program Files\Enigma Software Group\SpyHunter\Uninstall.exe" "C:\Program Files\Enigma Software Group\SpyHunter\install.log" -u Symantec AntiVirus --> MsiExec.exe /I{7C9E6E52-EB11-44DB-A761-82D5D873A8D9} Synaptics Pointing Device Driver --> rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall URL Assistant --> regsvr32 /u /s "C:\Program Files\BAE\BAE.dll" User's Guides --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}\setup.exe" Winamp (remove only) --> "C:\Program Files\Winamp\UninstWA.exe" Windows Doctor 1.5 --> "C:\Program Files\Windows Doctor\1.5\unins000.exe" Windows Media Player Firefox Plugin --> MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4} WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe Xvid 1.1.3 final uninstall --> "C:\Program Files\Xvid\unins000.exe" -- Application Event Log ------------------------------------------------------- Event Record #/Type241009 / Warning Event Submitted/Written: 07/05/2008 02:03:45 PM Event ID/Source: 22 / Symantec AntiVirus Event Description: Symantec AntiVirus Auto-Protect failed to load. Event Record #/Type241007 / Error Event Submitted/Written: 07/05/2008 02:02:57 PM Event ID/Source: 5007 / WerSvc Event Description: The target file for the Windows Feedback Platform (a DLL file containing the list of problems on this computer that require additional data collection for diagnosis) could not be parsed. The error code was 8014FFF9. Event Record #/Type240996 / Success Event Submitted/Written: 07/05/2008 02:01:21 PM Event ID/Source: 5617 / WinMgmt Event Description: Event Record #/Type240995 / Success Event Submitted/Written: 07/05/2008 02:01:16 PM Event ID/Source: 5615 / WinMgmt Event Description: Event Record #/Type240989 / Success Event Submitted/Written: 07/05/2008 02:00:23 PM Event ID/Source: 902 / Software Licensing Service Event Description: The Software Licensing service has started. -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type40200 / Warning Event Submitted/Written: 07/05/2008 02:18:58 PM Event ID/Source: 4 / Client Side Rendering Spooler Event Description: The print spooler failed to reopen an existing printer connection because it could not read the configuration information from the registry key S-1-5-18\Printers\Connections. The print spooler could not open the registry key. This can occur if the registry key is corrupt or missing, or if the registry recently became unavailable. Event Record #/Type40199 / Warning Event Submitted/Written: 07/05/2008 02:18:58 PM Event ID/Source: 4 / Client Side Rendering Spooler Event Description: The print spooler failed to reopen an existing printer connection because it could not read the configuration information from the registry key S-1-5-18\Printers\Connections. The print spooler could not open the registry key. This can occur if the registry key is corrupt or missing, or if the registry recently became unavailable. Event Record #/Type40198 / Warning Event Submitted/Written: 07/05/2008 02:18:58 PM Event ID/Source: 4 / Client Side Rendering Spooler Event Description: The print spooler failed to reopen an existing printer connection because it could not read the configuration information from the registry key S-1-5-18\Printers\Connections. The print spooler could not open the registry key. This can occur if the registry key is corrupt or missing, or if the registry recently became unavailable. Event Record #/Type40197 / Warning Event Submitted/Written: 07/05/2008 02:18:58 PM Event ID/Source: 4 / Client Side Rendering Spooler Event Description: The print spooler failed to reopen an existing printer connection because it could not read the configuration information from the registry key S-1-5-18\Printers\Connections. The print spooler could not open the registry key. This can occur if the registry key is corrupt or missing, or if the registry recently became unavailable. Event Record #/Type40196 / Warning Event Submitted/Written: 07/05/2008 02:18:57 PM Event ID/Source: 4 / Client Side Rendering Spooler Event Description: The print spooler failed to reopen an existing printer connection because it could not read the configuration information from the registry key S-1-5-18\Printers\Connections. The print spooler could not open the registry key. This can occur if the registry key is corrupt or missing, or if the registry recently became unavailable. -- End of Deckard's System Scanner: finished at 2008-07-05 14:24:55 ------------ |
|
|
|
|
Jul 5 2008, 05:53 PM
Post
#4
|
|
|
Malware Expert Group: HJT Team Posts: 9,576 Joined: 23-December 04 Member No.: 7,762 |
This will take a couple steps, but we'll get you fixed up.
Run Hijackthis again, click scan, and Put a checkmark next to each of the lines listed below. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button. R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = O2 - BHO: {a1410b23-7d48-e85a-2724-01540e7db081} - {180bd7e0-4510-4272-a58e-84d732b0141a} - C:\Windows\system32\hfvahv.dll O2 - BHO: (no name) - {6DEA0A0F-D9D0-4CFE-AEF5-B70CB245C8A2} - C:\Windows\system32\mlJYqpqr.dll O2 - BHO: (no name) - {893A20CA-8217-4718-94B8-D1C70B10978B} - (no file) O2 - BHO: (no name) - {9389D357-6E28-413E-8CB1-C9637AF91099} - C:\Windows\system32\fccaXPiG.dll (file missing) O2 - BHO: (no name) - {A4F56CE4-E382-44BF-8564-F7D3EBDA0B8B} - C:\Windows\system32\jkkLFyxw.dll (file missing) O2 - BHO: (no name) - {AD4D5572-EE4F-4101-B36B-226681CEE0C6} - C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FVGD6P5F\3077ahntdksr[1].dll O2 - BHO: (no name) - {D62A2513-0A8B-44F8-8479-3AFFAFC5FF82} - C:\Windows\system32\jKARHYro.dll O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\jKARHYro.dll,#1 O4 - HKLM\..\Run: [BMaf780db2] Rundll32.exe "C:\Windows\system32\nbbhgsab.dll",s O4 - HKLM\..\Run: [ac4b3e2e] rundll32.exe "C:\Windows\system32\fhscnchf.dll",b ================= Download Flash_Disinfector.exe by sUBs and save it to your desktop.
================= Please download ComboFix and save it to your desktop. Prior to running Combofix.exe you should disable your antivirus program and disconnect from the internet. Double click combofix.exe and follow the prompts. When it's done running it will produce a log for you. Please post that log in your next reply. Important Note - Do not mouseclick combofix's window whilst it's running. That may cause it to stall. -------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.[ Start Here ] [ Adaware 2008 ] [ Spybot ] [ AVG Antivirus ] [ Superantispyware ] [ MalwareBytes ] [ Spyware Blaster ] [ Windows Update ] [ How to install Windows XP Recovery Console ] |
|
|
|
|
Jul 5 2008, 08:24 PM
Post
#5
|
|
|
New Member Group: Members Posts: 5 Joined: 4-July 08 Member No.: 220,440 |
OK. Here's my ComboFix log. Thanks again. ComboFix 08-07-04.6 - Mark 2008-07-05 19:24:34.1 - NTFSx86 Running from: C:\Users\Mark\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Windows\system32\cbktxtpa.dll C:\Windows\system32\dDSmKaWO.dll C:\Windows\system32\doohhlrm.ini C:\Windows\System32\FgQpAJlm.ini C:\Windows\System32\FgQpAJlm.ini2 C:\Windows\System32\fhcncshf.ini C:\Windows\system32\fhscnchf.dll C:\Windows\system32\fuqwnfpc.ini C:\Windows\System32\ggfgQXbc.ini C:\Windows\System32\ggfgQXbc.ini2 C:\Windows\system32\GiPXaccf.ini C:\Windows\System32\GiPXaccf.ini2 C:\Windows\system32\gmycciiy.dll C:\Windows\system32\gvynrb.dll C:\Windows\System32\ihhgQqru.ini C:\Windows\System32\ihhgQqru.ini2 C:\Windows\system32\jtudrijm.dll C:\Windows\system32\krlqaoyj.dll C:\Windows\system32\lsprst7.dll C:\Windows\System32\mjirdutj.ini C:\Windows\system32\mlJApQgF.dll C:\Windows\system32\mlJYqpqr.dll C:\Windows\system32\nerrxonq.dll C:\Windows\system32\onmxpimw.dll C:\Windows\System32\OWaKmSDd.ini C:\Windows\System32\OWaKmSDd.ini2 C:\Windows\system32\pxecymro.ini C:\Windows\system32\pxqtfxuy.dll C:\Windows\system32\qoMcbayW.dll C:\Windows\System32\rqpqYJlm.ini C:\Windows\System32\rqpqYJlm.ini2 C:\Windows\System32\socqltau.ini C:\Windows\system32\ssprs.dll C:\Windows\system32\uatlqcos.dll C:\Windows\system32\vrdopq.dll C:\Windows\system32\wcnshwuv.ini C:\Windows\system32\wmipxmno.ini C:\Windows\system32\wntrde.dll C:\Windows\System32\wxyFLkkj.ini C:\Windows\System32\wxyFLkkj.ini2 C:\Windows\System32\yiiccymg.ini . ((((((((((((((((((((((((( Files Created from 2008-06-06 to 2008-07-06 ))))))))))))))))))))))))))))))) . No new files created in this timespan . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-05 23:34 --------- d-----w C:\Users\Mark\AppData\Roaming\DNA 2008-07-04 23:29 --------- d-----w C:\Program Files\SPSSEVAL 2008-07-04 17:09 --------- d-----w C:\Program Files\Enigma Software Group 2008-07-04 16:22 --------- d-----w C:\Program Files\Trend Micro 2008-07-03 18:50 --------- d-----w C:\ProgramData\Lavasoft 2008-07-03 18:50 --------- d-----w C:\Program Files\Lavasoft 2008-07-03 18:47 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-07-01 17:52 --------- d-----w C:\Program Files\Windows Doctor 2008-07-01 17:51 --------- d-----w C:\Users\Mark\AppData\Roaming\BitTorrent 2008-07-01 11:23 --------- d-----w C:\Program Files\MozBackup 2008-06-30 18:30 --------- d-----w C:\Users\Mark\AppData\Roaming\LimeWire 2008-06-30 18:23 --------- d-----w C:\Program Files\LimeWire 2008-06-18 11:41 --------- d-----w C:\ProgramData\Lx_cats 2008-06-13 00:23 --------- d-----w C:\Program Files\QuickTime 2008-06-13 00:22 --------- d-----w C:\ProgramData\Apple Computer 2008-06-12 07:15 --------- d-----w C:\Program Files\Windows Mail 2008-06-07 23:35 --------- d-----w C:\Program Files\DivX 2008-05-24 20:32 --------- d-----w C:\Users\Mark\AppData\Roaming\6500 Series 2008-05-24 20:28 --------- d-----w C:\Program Files\Google 2008-05-16 14:53 --------- d-----w C:\Users\Mark\AppData\Roaming\U3 2008-05-13 23:48 --------- d-----w C:\Program Files\Common Files\Real 2008-05-10 01:21 113,664 ----a-w C:\Windows\system32\drivers\rmcast.sys 2008-05-08 16:55 --------- d-----w C:\Program Files\Common Files\Adobe 2008-04-25 04:23 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll 2007-10-15 22:48 174 --sha-w C:\Program Files\desktop.ini 2007-10-15 22:14 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2007-10-15 22:14 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2007-10-15 22:14 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 19:56 202544] "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-05-08 17:31 289088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-17 19:52 815104] "Broadcom Wireless Manager UI"="C:\Windows\system32\WLTRAY.exe" [2006-11-27 18:56 1540096] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-07-11 18:12 90112] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 12:37 81920] "PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2007-05-02 18:16 184320] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-12-07 20:25 107112] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2007-08-05 17:29 135568] "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-06 20:05 200704] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-09 19:57 16384] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784] "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 03:12 483328] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "lxdfmon.exe"="C:\Program Files\Lexmark 6500 Series\lxdfmon.exe" [2007-06-11 21:53 455600] "lxdfamon"="C:\Program Files\Lexmark 6500 Series\lxdfamon.exe" [2007-06-01 16:06 20480] "Lexmark 6500 Series Fax Server"="C:\Program Files\Lexmark 6500 Series\fm3032.exe" [2007-06-11 21:56 308144] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 19:56 202544] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696] "SigmatelSysTrayApp"="sttray.exe" [2007-02-08 01:11 303104 C:\Windows\sttray.exe] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Acrobat Speed Launcher.lnk - C:\Windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2008-02-05 13:05:08 25214] Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-10-16 10:03:15 113664] Digital Line Detect.lnk - C:\Program File |