 Virus has disabled internet connection, Cant get internet connection to work |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Forum Guidelines
Read this topic before posting a log. DO NOT post a ComboFix log unless requested to. Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log. When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc. Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  |
 Nov 6 2008, 09:45 PM
Post
#1
|
|
|
New Member  Group: Members Posts: 14 Joined: 6-November 08 Member No.: 253,729  |
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:58:18 PM, on 11/6/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20900) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Admin\Application Data\Microsoft\Windows\lsass.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe C:\Documents and Settings\Admin\Application Data\NI.GSCNS\IUpd721.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\RocketDock\RocketDock.exe C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Southwest Airlines\Ding\Ding.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe C:\Documents and Settings\Admin\Application Data\U3\000018604571C94D\LaunchPad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.yahoo.com/search?p= R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [EasyTuneVPro] C:\Program Files\Gigabyte\ET5Pro\ETcall.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min O4 - HKLM\..\Run: [IUpd721] C:\Documents and Settings\Admin\Application Data\NI.GSCNS\IUpd721.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [prunnet] "C:\WINDOWS\system32\prun.exe" O4 - HKLM\..\Policies\Explorer\Run: [Lsass Service] C:\Documents and Settings\Admin\Application Data\Microsoft\Windows\lsass.exe O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user') O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Global Startup: Shortcut to RocketDock.lnk = ? O4 - Global Startup: Shortcut to sidebar.lnk = ? O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Highlight - C:\WINDOWS\WEB\highlight.htm O8 - Extra context menu item: &Links List - C:\WINDOWS\WEB\urllist.htm O8 - Extra context menu item: &Web Search - C:\WINDOWS\WEB\selsearch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: I&mages List - C:\WINDOWS\Web\imglist.htm O8 - Extra context menu item: Open Frame in &New Window - C:\WINDOWS\WEB\frm2new.htm O8 - Extra context menu item: Zoom &In - C:\WINDOWS\WEB\zoomin.htm O8 - Extra context menu item: Zoom O&ut - C:\WINDOWS\WEB\zoomout.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} (VatCtrl Class) - http://24.227.115.174:81/VatDec.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1200033534781 O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab2.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1200033530000 O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.12) - http://www.yougamers.com/systeminfo/MSC3.cab O16 - DPF: {E87A4CD6-BA5F-4552-BC4F-8EC240A2755C} (WebRecClient Control) - http://65.34.29.194/webrec.cab O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100 O16 - DPF: {FE92D9C3-4A69-4EC7-8651-1DC8531D0075} (TSBnwCam Control) - http://74.143.22.250/user/TSBnwCam.CAB O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL O20 - Winlogon Notify: c0075A69 - C:\WINDOWS\SYSTEM32\c0075A69.mat O20 - Winlogon Notify: sys32 - sys32.dll (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Avira AntiVir Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe O23 - Service: Avira AntiVir Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe O23 - Service: Avira AntiVir Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Avira AntiVir Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business XII\Win32\RpcDataSrv.exe O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business XII\RpcSandraSrv.exe O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe -- End of file - 15167 bytes |
 |
 
|
|
Nov 7 2008, 09:20 AM
Post
#2
|
|
|
Malware Expert Group: HJT Team Posts: 13,563 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
Hello!
 My name is Sam and I will be helping you. I will do my best to communicate clearly to you so that we can resolve your issues as quickly as possible. In order to see what's going on with your computer I will ask for you to post various logs from the tools that we will use to fix your computer. Please communicate freely with me about how your computer is reacting and behaving as we work through this process. I assume that you have access to the Internet through another computer since you are able to make this post. You will need to download the tools we need and move them over to the infected computer using a USB drive or disc. Please download ComboFix from one of these locations: Link 1 Link 2 Link 3 * IMPORTANT !!! Save ComboFix.exe to your Desktop
 Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. --------------------  If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Nov 7 2008, 04:43 PM
Post
#3
|
|
|
New Member Group: Members Posts: 14 Joined: 6-November 08 Member No.: 253,729 |
The following is the ComboFix.txt log with the anitvirus disabled
Start Time= Fri 11/07/2008 16:38:56.35 QuickScan did not find any signs of infected files (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2008-11-06 20:58:04 ( .D... ) "C:\Program Files\Trend Micro" 2008-11-02 18:50:50 ( .D... ) "C:\Program Files\DAEMON Tools Toolbar" 2008-11-02 18:50:40 ( .D... ) "C:\Program Files\DAEMON Tools Lite" 2008-11-02 18:47:24 ( .D... ) "C:\Documents and Settings\Admin\Application Data\DAEMON Tools" 2008-11-02 12:08:02 ( .D... ) "C:\Documents and Settings\Admin\Application Data\NewsLeecher" 2008-11-02 12:07:42 ( .D... ) "C:\Program Files\NewsLeecher" 2008-11-01 08:58:36 111928 ( A.... ) "C:\WINDOWS\system32\PnkBstrB.exe" 2008-10-16 17:14:44 ( .D... ) "C:\Program Files\Conduit" 2008-10-15 11:34:24 337408 ( A.... ) "C:\WINDOWS\system32\netapi32.dll" 2008-10-11 16:45:02 ( .D... ) "C:\Program Files\America's Army Deploy Client" 2008-10-07 14:19:40 16721856 ( A.... ) "C:\WINDOWS\system32\MRT.exe" 2008-10-03 12:26:50 6068224 ( A.... ) "C:\WINDOWS\system32\ieframe.dll" 2008-09-28 19:11:20 6909 ( A.... ) "C:\Documents and Settings\Admin\Application Data\PrimoPDFSet.xml" 2008-09-28 19:02:16 ( .D... ) "C:\Program Files\activePDF" 2008-09-27 15:46:48 ( .D... ) "C:\Program Files\xerox" 2008-09-27 15:46:48 ( .D... ) "C:\Program Files\microsoft frontpage" 2008-09-27 15:32:38 ( .D... ) "C:\Documents and Settings\Admin\Application Data\Avira" 2008-09-27 15:19:54 ( .D... ) "C:\Program Files\Avira" 2008-09-27 14:14:36 ( .D... ) "C:\Documents and Settings\Admin\Application Data\HouseCall 6.6" 2008-09-15 07:12:56 1846400 ( A.... ) "C:\WINDOWS\system32\win32k.sys" 2008-09-13 18:28:12 ( .D... ) "C:\Documents and Settings\Admin\Application Data\Move Networks" 2008-08-26 04:08:46 1162752 ( A.... ) "C:\WINDOWS\system32\urlmon.dll" 2008-08-26 04:08:46 827904 ( A.... ) "C:\WINDOWS\system32\wininet.dll" 2008-08-26 04:08:46 233472 ( A.... ) "C:\WINDOWS\system32\webcheck.dll" 2008-08-26 04:08:44 3594752 ( A.... ) "C:\WINDOWS\system32\mshtml.dll" 2008-08-26 04:08:44 671232 ( A.... ) "C:\WINDOWS\system32\mstime.dll" 2008-08-26 04:08:44 477696 ( A.... ) "C:\WINDOWS\system32\mshtmled.dll" 2008-08-26 04:08:44 193024 ( A.... ) "C:\WINDOWS\system32\msrating.dll" 2008-08-26 04:08:44 105984 ( A.... ) "C:\WINDOWS\system32\url.dll" 2008-08-26 04:08:44 102912 ( A.... ) "C:\WINDOWS\system32\occache.dll" 2008-08-26 04:08:44 44544 ( A.... ) "C:\WINDOWS\system32\pngfilt.dll" 2008-08-26 04:08:40 459264 ( A.... ) "C:\WINDOWS\system32\msfeeds.dll" 2008-08-26 04:08:40 267776 ( A.... ) "C:\WINDOWS\system32\iertutil.dll" 2008-08-26 04:08:40 52224 ( A.... ) "C:\WINDOWS\system32\msfeedsbs.dll" 2008-08-26 04:08:40 44544 ( A.... ) "C:\WINDOWS\system32\iernonce.dll" 2008-08-26 04:08:40 27648 ( A.... ) "C:\WINDOWS\system32\jsproxy.dll" 2008-08-26 04:08:38 388608 ( A.... ) "C:\WINDOWS\system32\iedkcs32.dll" 2008-08-26 04:08:36 380928 ( A.... ) "C:\WINDOWS\system32\ieapfltr.dll" 2008-08-26 04:08:36 347136 ( A.... ) "C:\WINDOWS\system32\dxtmsft.dll" 2008-08-26 04:08:36 230400 ( A.... ) "C:\WINDOWS\system32\ieaksie.dll" 2008-08-26 04:08:36 214528 ( A.... ) "C:\WINDOWS\system32\dxtrans.dll" 2008-08-26 04:08:36 153088 ( A.... ) "C:\WINDOWS\system32\ieakeng.dll" 2008-08-26 04:08:36 132608 ( A.... ) "C:\WINDOWS\system32\extmgr.dll" 2008-08-26 04:08:36 124928 ( A.... ) "C:\WINDOWS\system32\advpack.dll" 2008-08-26 04:08:36 63488 ( A.... ) "C:\WINDOWS\system32\icardie.dll" 2008-08-25 03:43:22 70656 ( A.... ) "C:\WINDOWS\system32\ie4uinit.exe" 2008-08-25 03:43:22 13824 ( A.... ) "C:\WINDOWS\system32\ieudinit.exe" 2008-08-23 00:54:50 161792 ( A.... ) "C:\WINDOWS\system32\ieakui.dll" 2008-08-14 05:09:26 2145280 ( A.... ) "C:\WINDOWS\system32\ntoskrnl.exe" 2008-08-14 04:33:16 2023936 ( A.... ) "C:\WINDOWS\system32\ntkrnlpa.exe" 2007-10-10 00:23:12 212480 ( A.... ) "C:\Program Files\pmp_ipod.dll" ((((((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "RTHDCPL"="RTHDCPL.EXE" "Alcmtr"="ALCMTR.EXE" "EasyTuneVPro"="C:\\Program Files\\Gigabyte\\ET5Pro\\ETcall.exe" "ISUSPM Startup"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\isuspm.exe -startup" "ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "LogonStudio"="\"C:\\Program Files\\WinCustomize\\LogonStudio\\logonstudio.exe\" /RANDOM" "Adobe Reader Speed Launcher"="\"C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe\"" "GrooveMonitor"="\"C:\\Program Files\\Microsoft Office\\Office12\\GrooveMonitor.exe\"" "BootSkin Startup Jobs"="\"C:\\Program Files\\Stardock\\WinCustomize\\BootSkin\\BootSkin.exe\" /StartupJobs" "CTHelper"="CTHELPER.EXE" "CTxfiHlp"="CTXFIHLP.EXE" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_07\\bin\\jusched.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "CTSysVol"="C:\\Program Files\\Creative\\SBAudigy2\\Surround Mixer\\CTSysVol.exe /r" "SBDrvDet"="C:\\Program Files\\Creative\\SB Drive Det\\SBDrvDet.exe /r" "UpdReg"="C:\\WINDOWS\\UpdReg.EXE" "NBKeyScan"="\"C:\\Program Files\\Nero\\Nero8\\Nero BackItUp\\NBKeyScan.exe\"" "NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe" "avgnt"="\"C:\\Program Files\\Avira\\AntiVir PersonalEdition Premium\\avgnt.exe\" /min" "IUpd721"="C:\\Documents and Settings\\Admin\\Application Data\\NI.GSCNS\\IUpd721.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run] "Lsass Service"="C:\\Documents and Settings\\Admin\\Application Data\\Microsoft\\Windows\\lsass.exe" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Sidebar"="C:\\Program Files\\Windows Sidebar\\sidebar.exe /autoRun" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "NVIDIA nTune"="\"C:\\Program Files\\NVIDIA Corporation\\nTune\\nTuneCmd.exe\" clear" "RocketDock"="\"C:\\Program Files\\RocketDock\\RocketDock.exe\"" "SetDefaultMIDI"="MIDIDef.exe" "EasyLinkAdvisor"="\"C:\\Program Files\\Linksys EasyLink Advisor\\LinksysAgent.exe\" /startup" "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Nero\\Lib\\NMIndexStoreSvr.exe\" ASO-616B5711-6DAE-4795-A05F-39A1E5104020" "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe\"" "LightScribe Control Panel"="C:\\Program Files\\Common Files\\LightScribe\\LightScribeControlPanel.exe -hidden" "SUPERAntiSpyware"="C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe" "DAEMON Tools Lite"="\"C:\\Program Files\\DAEMON Tools Lite\\daemon.exe\" -autorun" [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "nltide_3"=hex(2):72,75,6e,64,6c,6c,33,32,20,61,64,76,70,61,63,6b,2e,64,6c,6c,\ 2c,4c,61,75,6e,63,68,49,4e,46,53,65,63,74,69,6f,6e,45,78,20,6e,4c,69,74,65,\ 2e,69,6e,66,2c,43,2c,2c,34,2c,4e,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce] "nltide_3"=hex(2):72,75,6e,64,6c,6c,33,32,20,61,64,76,70,61,63,6b,2e,64,6c,6c,\ 2c,4c,61,75,6e,63,68,49,4e,46,53,65,63,74,69,6f,6e,45,78,20,6e,4c,69,74,65,\ 2e,69,6e,66,2c,43,2c,2c,34,2c,4e,00 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="Groove GFS Stub Execution Hook" "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Admin^Start Menu^Programs^Startup^Styler.lnk] "path"="C:\\Documents and Settings\\Admin\\Start Menu\\Programs\\Startup\\Styler.lnk" "backup"="C:\\WINDOWS\\pss\\Styler.lnkStartup" "location"="Startup" "command"="C:\\Documents and Settings\\Admin\\Application Data\\Microsoft\\Installer\\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\\_585b207a.exe " "item"="Styler" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Comrade.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Comrade" "hkey"="HKCU" "command"="C:\\Program Files\\GameSpy\\Comrade\\Comrade.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MsnMsgr" "hkey"="HKCU" "command"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Window Blinds] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="wbload" "hkey"="HKCU" "inimapping"="0" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\1-Click Maintenance.job C:\WINDOWS\tasks\Uniblue SpyEraser Nag.job C:\WINDOWS\tasks\Uniblue SpyEraser.job Completion time: Fri 11/07/2008 16:40:05.57 ComboFix ver 06.06.17 - This logfile is located at C:\ComboFix.txt |
|
|
|
|
Nov 7 2008, 06:57 PM
Post
#4
|
|
|
Malware Expert Group: HJT Team Posts: 13,563 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
Please download SmitfraudFix (by S!Ri) to your Desktop.
Double-click SmitfraudFix.exe Select option #5 - Search and clean DNS Hijack by typing 5 and press "Enter"; a text file will appear. Please copy/paste the content of that report into your next reply. **If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (usually C:), and launch from there. -------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Nov 7 2008, 07:03 PM
Post
#5
|
|
|
New Member Group: Members Posts: 14 Joined: 6-November 08 Member No.: 253,729 |
Here is the log.
SmitFraudFix v2.373 Scan done at 19:01:00.31, Fri 11/07/2008 Run from C:\Documents and Settings\Admin\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» DNS Before Fix »»»»»»»»»»»»»»»»»»»»»»»» DNS After Fix |
|
|
|
|
Nov 7 2008, 07:15 PM
Post
#6
|
|
|
Malware Expert Group: HJT Team Posts: 13,563 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:\SDFix) Please then reboot your computer in Safe Mode by doing the following :
-------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Nov 7 2008, 08:30 PM
Post
#7
|
|
|
New Member Group: Members Posts: 14 Joined: 6-November 08 Member No.: 253,729 |
Is it normal for SDfix to run for 45 mins after reboot?
Says: "Finishing malware check" "Please be patient as this part may take several minutes" it has been saying this for 45 mins now |
|
|
|
|
Nov 7 2008, 08:42 PM
Post
#8
|
|
|
New Member Group: Members Posts: 14 Joined: 6-November 08 Member No.: 253,729 |
now it keeps saying every minute or so
"unable to open the file C:\windows\temp\SDfix_Filecheck\Damn_NFO_Viewer_V2.exe" |
|
|
|
|
Nov 8 2008, 03:01 AM
Post
#9
|
|
|
New Member Group: Members Posts: 14 Joined: 6-November 08 Member No.: 253,729 |
Ok, after a couple of attempts i got it to work properly.
Also on a side note, i tried testing the internet connection by using USB cable from broadban modem to the computer to make sure it didnt have any thing to do with the ethernet card. But i was still not able to get a connection. Here is the SDfik log: SDFix: Version 1.240 Run by Admin on Fri 11/07/2008 at 22:38 Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Restoring Default Security Values Restoring Default Hosts File Rebooting Checking Files : No Trojan Files Found Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-08 00:31:22 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:57,7e,ca,8e,91,58,c3,6e,ca,e7,30,3d,74,04,d5,0c,a9,71,a3,db,55,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,a9,85,ae,d7,a7,e8,d0,a6,01,e7,a4,1e,17,38,82,75,9f,.. "khjeh"=hex:52,55,2e,69,91,f7,97,c8,94,ab,50,fb,d8,a3,06,16,c6,91,11,64,1b,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:72,29,5c,27,1a,a5,04,0c,0b,44,18,3a,c4,bb,4c,f9,76,c3,c0,9a,f0,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:57,7e,ca,8e,91,58,c3,6e,ca,e7,30,3d,74,04,d5,0c,a9,71,a3,db,55,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,a9,85,ae,d7,a7,e8,d0,a6,01,e7,a4,1e,17,38,82,75,9f,.. "khjeh"=hex:52,55,2e,69,91,f7,97,c8,94,ab,50,fb,d8,a3,06,16,c6,91,11,64,1b,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:72,29,5c,27,1a,a5,04,0c,0b,44,18,3a,c4,bb,4c,f9,76,c3,c0,9a,f0,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:Flashget" "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"="C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe:*:Enabled:Crysis_32" "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"="C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32" "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\Program Files\\SiSoftware\\SiSoftware Sandra Professional Business XII\\Win32\\RpcDataSrv.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Professional Business XII\\Win32\\RpcDataSrv.exe:*:Enabled:SiSoftware Database Agent Service" "C:\\Program Files\\SiSoftware\\SiSoftware Sandra Professional Business XII\\RpcSandraSrv.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Professional Business XII\\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "C:\\Program Files\\America's Army\\System\\ArmyOps.exe"="C:\\Program Files\\America's Army\\System\\ArmyOps.exe:*:Enabled:ArmyOps" "C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test" "C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Run a DLL as an App" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\America's Army Deploy Client\\AADeployClient.exe"="C:\\Program Files\\America's Army Deploy Client\\AADeployClient.exe:*:Enabled:AADeployClient" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" Remaining Files : Files with Hidden Attributes : Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe" Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" Sat 26 Jan 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Thu 6 Nov 2008 20,992 ..SH. --- "C:\Documents and Settings\Admin\Application Data\Microsoft\Windows\sys32.dll" Mon 12 Feb 2007 3,096,576 A..H. --- "C:\Documents and Settings\Admin\Application Data\U3\temp\Launchpad Removal.exe" Mon 21 Jan 2008 8 A..H. --- "C:\Documents and Settings\Admin\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp" Mon 21 Jan 2008 8 A..H. --- "C:\Documents and Settings\Admin\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp" Mon 21 Jan 2008 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp" Mon 21 Jan 2008 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch2\lock.tmp" Finished! |
|
|
|
|
Nov 8 2008, 09:05 AM
Post
#10
|
|
|
Malware Expert Group: HJT Team Posts: 13,563 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
Copy and paste ALL the following text in the Quote box below into Notepad.
Click on File(in the menu at the top)>Save as../Save as Type: 'All Files' /File name: CFScript to your desktop. CODE File:: C:\Documents and Settings\Admin\Application Data\Microsoft\Windows\sys32.dll Prior to running Combofix.exe you should disable your antivirus program and disconnect from the internet. Now drag then drop the CFScript file onto ComboFix.exe as seen in the image below.  This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply. ================== Now we need a more detailed log from another tool.
Check your connection to see if it's restored. -------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Nov 8 2008, 10:11 AM
Post
#11
|
|
|
New Member Group: Members Posts: 14 Joined: 6-November 08 Member No.: 253,729 |
Ok, still no connection. And all im doing is directly unpluging my Cat5 cable from this laptop and plugging it in to the PC.
Here are the logs. Combo Fix Start Time= Sat 11/08/2008 10:01:55.48 QuickScan did not find any signs of infected files (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2008-11-07 21:09:06 ( .D... ) "C:\Documents and Settings\Admin\Application Data\Malwarebytes" 2008-11-07 21:09:00 ( .D... ) "C:\Program Files\Malwarebytes' Anti-Malware" 2008-11-07 19:23:36 360064 ( A.... ) "C:\WINDOWS\system32\tcpip.sys" 2008-11-07 19:23:36 360064 ( A.... ) "C:\WINDOWS\system32\tcpip.sys" 2008-11-07 17:53:30 ( .D... ) "C:\Program Files\Registry Mechanic" 2008-11-07 17:41:48 ( .D... ) "C:\Program Files\Lavasoft" 2008-11-06 20:58:04 ( .D... ) "C:\Program Files\Trend Micro" 2008-11-02 18:50:50 ( .D... ) "C:\Program Files\DAEMON Tools Toolbar" 2008-11-02 18:50:40 ( .D... ) "C:\Program Files\DAEMON Tools Lite" 2008-11-02 18:47:24 ( .D... ) "C:\Documents and Settings\Admin\Application Data\DAEMON Tools" 2008-11-02 12:08:02 ( .D... ) "C:\Documents and Settings\Admin\Application Data\NewsLeecher" 2008-11-02 12:07:42 ( .D... ) "C:\Program Files\NewsLeecher" 2008-11-01 08:58:36 111928 ( A.... ) "C:\WINDOWS\system32\PnkBstrB.exe" 2008-10-16 17:14:44 ( .D... ) "C:\Program Files\Conduit" 2008-10-15 11:34:24 337408 ( A.... ) "C:\WINDOWS\system32\netapi32.dll" 2008-10-11 16:45:02 ( .D... ) "C:\Program Files\America's Army Deploy Client" 2008-10-10 07:58:08 82944 ( A.... ) "C:\WINDOWS\system32\o4Patch.exe" 2008-10-10 07:58:08 82944 ( A.... ) "C:\WINDOWS\system32\IEDFix.C.exe" 2008-10-07 14:19:40 16721856 ( A.... ) "C:\WINDOWS\system32\MRT.exe" 2008-10-03 12:26:50 6068224 ( A.... ) "C:\WINDOWS\system32\ieframe.dll" 2008-10-01 14:51:40 87552 ( A.... ) "C:\WINDOWS\system32\VACFix.exe" 2008-09-28 19:11:20 6909 ( A.... ) "C:\Documents and Settings\Admin\Application Data\PrimoPDFSet.xml" 2008-09-28 19:02:16 ( .D... ) "C:\Program Files\activePDF" 2008-09-27 15:46:48 ( .D... ) "C:\Program Files\xerox" 2008-09-27 15:46:48 ( .D... ) "C:\Program Files\microsoft frontpage" 2008-09-27 15:32:38 ( .D... ) "C:\Documents and Settings\Admin\Application Data\Avira" 2008-09-27 15:19:54 ( .D... ) "C:\Program Files\Avira" 2008-09-27 14:14:36 ( .D... ) "C:\Documents and Settings\Admin\Application Data\HouseCall 6.6" 2008-09-15 07:12:56 1846400 ( A.... ) "C:\WINDOWS\system32\win32k.sys" 2008-09-13 18:28:12 ( .D... ) "C:\Documents and Settings\Admin\Application Data\Move Networks" 2008-08-26 04:08:46 1162752 ( A.... ) "C:\WINDOWS\system32\urlmon.dll" 2008-08-26 04:08:46 827904 ( A.... ) "C:\WINDOWS\system32\wininet.dll" 2008-08-26 04:08:46 233472 ( A.... ) "C:\WINDOWS\system32\webcheck.dll" 2008-08-26 04:08:44 3594752 ( A.... ) "C:\WINDOWS\system32\mshtml.dll" 2008-08-26 04:08:44 671232 ( A.... ) "C:\WINDOWS\system32\mstime.dll" 2008-08-26 04:08:44 477696 ( A.... ) "C:\WINDOWS\system32\mshtmled.dll" 2008-08-26 04:08:44 193024 ( A.... ) "C:\WINDOWS\system32\msrating.dll" 2008-08-26 04:08:44 105984 ( A.... ) "C:\WINDOWS\system32\url.dll" 2008-08-26 04:08:44 102912 ( A.... ) "C:\WINDOWS\system32\occache.dll" 2008-08-26 04:08:44 44544 ( A.... ) "C:\WINDOWS\system32\pngfilt.dll" 2008-08-26 04:08:40 459264 ( A.... ) "C:\WINDOWS\system32\msfeeds.dll" 2008-08-26 04:08:40 267776 ( A.... ) "C:\WINDOWS\system32\iertutil.dll" 2008-08-26 04:08:40 52224 ( A.... ) "C:\WINDOWS\system32\msfeedsbs.dll" 2008-08-26 04:08:40 44544 ( A.... ) "C:\WINDOWS\system32\iernonce.dll" 2008-08-26 04:08:40 27648 ( A.... ) "C:\WINDOWS\system32\jsproxy.dll" 2008-08-26 04:08:38 388608 ( A.... ) "C:\WINDOWS\system32\iedkcs32.dll" 2008-08-26 04:08:36 380928 ( A.... ) "C:\WINDOWS\system32\ieapfltr.dll" 2008-08-26 04:08:36 347136 ( A.... ) "C:\WINDOWS\system32\dxtmsft.dll" 2008-08-26 04:08:36 230400 ( A.... ) "C:\WINDOWS\system32\ieaksie.dll" 2008-08-26 04:08:36 214528 ( A.... ) "C:\WINDOWS\system32\dxtrans.dll" 2008-08-26 04:08:36 153088 ( A.... ) "C:\WINDOWS\system32\ieakeng.dll" 2008-08-26 04:08:36 132608 ( A.... ) "C:\WINDOWS\system32\extmgr.dll" 2008-08-26 04:08:36 124928 ( A.... ) "C:\WINDOWS\system32\advpack.dll" 2008-08-26 04:08:36 63488 ( A.... ) "C:\WINDOWS\system32\icardie.dll" 2008-08-25 03:43:22 70656 ( A.... ) "C:\WINDOWS\system32\ie4uinit.exe" 2008-08-25 03:43:22 13824 ( A.... ) "C:\WINDOWS\system32\ieudinit.exe" 2008-08-23 00:54:50 161792 ( A.... ) "C:\WINDOWS\system32\ieakui.dll" 2008-08-18 11:19:04 82432 ( A.... ) "C:\WINDOWS\system32\404Fix.exe" 2008-08-14 05:09:26 2145280 ( A.... ) "C:\WINDOWS\system32\ntoskrnl.exe" 2008-08-14 04:33:16 2023936 ( A.... ) "C:\WINDOWS\system32\ntkrnlpa.exe" 2007-10-10 00:23:12 212480 ( A.... ) "C:\Program Files\pmp_ipod.dll" ((((((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "RTHDCPL"="RTHDCPL.EXE" "Alcmtr"="ALCMTR.EXE" "EasyTuneVPro"="C:\\Program Files\\Gigabyte\\ET5Pro\\ETcall.exe" "ISUSPM Startup"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\isuspm.exe -startup" "ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "LogonStudio"="\"C:\\Program Files\\WinCustomize\\LogonStudio\\logonstudio.exe\" /RANDOM" "Adobe Reader Speed Launcher"="\"C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe\"" "GrooveMonitor"="\"C:\\Program Files\\Microsoft Office\\Office12\\GrooveMonitor.exe\"" "BootSkin Startup Jobs"="\"C:\\Program Files\\Stardock\\WinCustomize\\BootSkin\\BootSkin.exe\" /StartupJobs" "CTHelper"="CTHELPER.EXE" "CTxfiHlp"="CTXFIHLP.EXE" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_07\\bin\\jusched.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "CTSysVol"="C:\\Program Files\\Creative\\SBAudigy2\\Surround Mixer\\CTSysVol.exe /r" "SBDrvDet"="C:\\Program Files\\Creative\\SB Drive Det\\SBDrvDet.exe /r" "UpdReg"="C:\\WINDOWS\\UpdReg.EXE" "NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe" "avgnt"="\"C:\\Program Files\\Avira\\AntiVir PersonalEdition Premium\\avgnt.exe\" /min" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" @="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Sidebar"="C:\\Program Files\\Windows Sidebar\\sidebar.exe /autoRun" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "NVIDIA nTune"="\"C:\\Program Files\\NVIDIA Corporation\\nTune\\nTuneCmd.exe\" clear" "RocketDock"="\"C:\\Program Files\\RocketDock\\RocketDock.exe\"" "SetDefaultMIDI"="MIDIDef.exe" "EasyLinkAdvisor"="\"C:\\Program Files\\Linksys EasyLink Advisor\\LinksysAgent.exe\" /startup" "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe\"" [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "nltide_3"=hex(2):72,75,6e,64,6c,6c,33,32,20,61,64,76,70,61,63,6b,2e,64,6c,6c,\ 2c,4c,61,75,6e,63,68,49,4e,46,53,65,63,74,69,6f,6e,45,78,20,6e,4c,69,74,65,\ 2e,69,6e,66,2c,43,2c,2c,34,2c,4e,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce] "nltide_3"=hex(2):72,75,6e,64,6c,6c,33,32,20,61,64,76,70,61,63,6b,2e,64,6c,6c,\ 2c,4c,61,75,6e,63,68,49,4e,46,53,65,63,74,69,6f,6e,45,78,20,6e,4c,69,74,65,\ 2e,69,6e,66,2c,43,2c,2c,34,2c,4e,00 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="Groove GFS Stub Execution Hook" "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Admin^Start Menu^Programs^Startup^Styler.lnk] "backup"="C:\\WINDOWS\\pss\\Styler.lnkStartup" "location"="Startup" "command"="C:\\Documents and Settings\\Admin\\Application Data\\Microsoft\\Installer\\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\\_585b207a.exe " "item"="Styler" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Comrade.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Comrade" "hkey"="HKCU" "command"="C:\\Program Files\\GameSpy\\Comrade\\Comrade.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MsnMsgr" "hkey"="HKCU" "command"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Window Blinds] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="wbload" "hkey"="HKCU" "inimapping"="0" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\1-Click Maintenance.job C:\WINDOWS\tasks\Uniblue SpyEraser Nag.job C:\WINDOWS\tasks\Uniblue SpyEraser.job Completion time: Sat 11/08/2008 10:02:23.56 ComboFix ver 06.06.17 - This logfile is located at C:\ComboFix.txt Here it the OTViewItOTViewIt logfile created on: 11/8/2008 10:04:24 AM - Run OTViewIt by OldTimer - Version 1.0.20.0 Folder = C:\Documents and Settings\Admin\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.11) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.45 Gb Available Physical Memory | 72.59% Memory free 3.85 Gb Paging File | 3.40 Gb Available in Paging File | 88.33% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092; %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 465.75 Gb Total Space | 366.66 Gb Free Space | 78.73% Space Free | Partition Type: NTFS D: Drive not present or media not loaded Drive E: | 4.24 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS F: Drive not present or media not loaded Drive G: | 5.46 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Drive H: | 3.81 Gb Total Space | 2.50 Gb Free Space | 65.63% Space Free | Partition Type: FAT32 I: Drive not present or media not loaded Computer Name: MATTH Current User Name: Admin Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Whitelist: On File Age = 30 Days ========== Processes ========== [2008/09/10 13:01:28 | 00,611,664 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008/10/23 15:20:44 | 00,068,865 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe [2008/10/23 15:20:42 | 00,151,297 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe [2008/01/15 05:40:04 | 00,110,592 | ---- | M] (Apple, Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008/09/27 15:22:47 | 00,041,217 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe [2007/07/24 18:17:08 | 00,229,376 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe [1999/12/12 20:01:00 | 00,044,032 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\CTSVCCDA.EXE [2007/07/25 14:50:26 | 00,079,136 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006/10/26 16:40:34 | 00,335,872 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [2007/09/04 22:25:44 | 00,131,072 | ---- | M] (NVIDIA) -- C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe [2007/12/05 04:41:00 | 00,155,716 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe [2008/01/12 03:03:08 | 00,066,872 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe [2000/06/26 07:44:20 | 00,053,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\MsPMSPSv.exe [2008/09/27 15:22:47 | 00,258,305 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Premium\avwebgrd.exe [2008/04/13 19:12:41 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe [2007/09/19 05:14:58 | 16,844,800 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.exe [2005/02/17 10:15:20 | 00,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2008/04/13 19:12:33 | 00,033,280 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\rundll32.exe [2007/08/24 06:00:48 | 00,033,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008/06/10 03:27:04 | 00,144,784 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2003/09/17 10:43:36 | 00,057,344 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe [2008/09/27 15:22:47 | 00,266,497 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe [2007/12/03 01:58:02 | 01,230,848 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Sidebar\sidebar.exe [2007/09/02 16:58:52 | 00,495,616 | ---- | M] () -- C:\Program Files\RocketDock\RocketDock.exe [2007/06/27 18:03:40 | 00,152,872 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007/12/03 01:58:02 | 01,230,848 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Sidebar\sidebar.exe [2007/06/27 18:04:00 | 00,279,848 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007/06/27 18:04:00 | 01,213,736 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe [2007/02/09 16:47:20 | 04,603,904 | ---- | M] () -- C:\Documents and Settings\Admin\Application Data\U3\000018604571C94D\LaunchPad.exe [2008/11/08 10:00:32 | 00,422,400 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Admin\Desktop\OTViewIt.exe ========== (O23) Win32 Services ========== [2008/09/10 13:01:28 | 00,611,664 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe -- (aawservice [Auto | Running]) [2008/09/27 15:22:47 | 00,164,097 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe -- (AntiVirMailService [Auto | Stopped]) [2008/10/23 15:20:44 | 00,068,865 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe -- (AntiVirScheduler [Auto | Running]) [2008/10/23 15:20:42 | 00,151,297 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe -- (AntiVirService [Auto | Running]) [2008/09/27 15:22:47 | 00,258,305 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Premium\avwebgrd.exe -- (antivirwebservice [Auto | Running]) [2008/01/15 05:40:04 | 00,110,592 | ---- | M] (Apple, Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device [Auto | Running]) [2007/10/24 00:47:22 | 00,033,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped]) [2008/04/01 20:41:49 | 00,085,096 | ---- | M] (Autodesk) -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe -- (Autodesk Licensing Service [On_Demand | Stopped]) [2008/09/27 15:22:47 | 00,041,217 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe -- (AVEService [Auto | Running]) [2007/07/24 18:17:08 | 00,229,376 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service [Auto | Running]) [2007/10/24 00:47:40 | 00,070,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) [1999/12/12 20:01:00 | 00,044,032 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\CTSVCCDA.EXE -- (Creative Service for CDROM Access [Auto | Running]) [2006/10/20 20:21:24 | 00,036,864 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped]) [2006/10/30 02:33:58 | 00,741,376 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped]) [2007/07/25 14:50:26 | 00,079,136 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService [Auto | Running]) [2006/10/26 16:40:34 | 00,335,872 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe -- (MDM [Auto | Running]) [2007/08/24 05:59:20 | 00,068,464 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service [On_Demand | Stopped]) [2006/10/30 02:34:02 | 00,122,880 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped]) [2007/06/27 18:04:00 | 00,279,848 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService [On_Demand | Running]) [2007/09/04 22:25:44 | 00,131,072 | ---- | M] (NVIDIA) -- C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe -- (nTuneService [Auto | Running]) [2007/12/05 04:41:00 | 00,155,716 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc [Auto | Running]) [2007/08/24 02:19:12 | 00,443,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv [On_Demand | Stopped]) [2006/10/26 17:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped]) [2008/01/12 03:03:08 | 00,066,872 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA [Auto | Running]) [2007/08/15 20:05:16 | 00,184,504 | ---- | M] (SiSoftware) -- C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business XII\Win32\RpcDataSrv.exe -- (SandraDataSrv [On_Demand | Stopped]) [2007/08/15 20:05:14 | 01,441,968 | ---- | M] (SiSoftware) -- C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business XII\RpcSandraSrv.exe -- (SandraTheSrv [On_Demand | Stopped]) [2008/01/11 00:15:40 | 00,306,432 | ---- | M] (TuneUp Software GmbH) -- C:\WINDOWS\system32\TuneUpDefragService.exe -- (TuneUp.Defrag [On_Demand | Stopped]) [2007/01/19 15:54:14 | 00,097,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\usnsvc.exe -- (usnjsvc [On_Demand | Stopped]) [2000/06/26 07:44:20 | 00,053,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\MsPMSPSv.exe -- (WMDM PMSP Service [Auto | Running]) [2006/10/19 00:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped]) ========== Driver Services ========== [2008/04/29 10:20:00 | 00,015,648 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\system32\drivers\NSDriver.sys -- (Ad-Watch Connect Filter [On_Demand | Stopped]) [2007/02/27 14:25:01 | 00,011,840 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgio.sys -- (avgio [System | Running]) [2008/09/27 15:22:47 | 00,052,032 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgntflt.sys -- (avgntflt [On_Demand | Running]) [2008/09/27 15:22:47 | 00,075,072 | ---- | M] (Avira GmbH) -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb [System | Running]) [2008/01/13 03:02:50 | 00,163,712 | ---- | M] () -- C:\WINDOWS\system32\drivers\vidstub.sys -- (BootScreen [Boot | Stopped]) File not found -- -- (catchme [On_Demand | Running]) [2004/04/06 03:24:54 | 00,646,128 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\drivers\ctac32k.sys -- (ctac32k [On_Demand | Running]) [2004/04/28 22:01:00 | 00,374,000 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\drivers\ctaud2k.sys -- (ctaud2k [On_Demand | Running]) [2004/03/15 04:25:06 | 00,337,056 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\drivers\ctdvda2k.sys -- (ctdvda2k [On_Demand | Stopped]) [2004/03/15 21:36:54 | 00,006,096 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\drivers\ctprxy2k.sys -- (ctprxy2k [On_Demand | Running]) [2004/03/15 21:37:12 | 00,130,384 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k [On_Demand | Running]) [2007/03/22 12:57:14 | 00,028,672 | --S- | M] (Gteko Ltd.) -- C:\WINDOWS\system32\drivers\elagopro.sys -- (elagopro [Auto | Running]) [2007/03/22 12:57:14 | 00,005,376 | --S- | M] (Gteko Ltd.) -- C:\WINDOWS\system32\drivers\elaunidr.sys -- (elaunidr [Auto | Running]) [2004/03/15 21:37:26 | 00,147,088 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\drivers\emupia2k.sys -- (emupia [On_Demand | Running]) [2007/09/07 13:55:04 | 00,027,672 | ---- | M] (EnTech Taiwan) -- C:\WINDOWS\system32\drivers\Entech.sys -- (ENTECH [On_Demand | Stopped]) [2007/10/11 14:10:52 | 00,030,008 | ---- | M] (Windows ® 2000 DDK provider) -- C:\WINDOWS\system32\drivers\ET5Drv.sys -- (ET5Drv [On_Demand | Running]) [2008/01/11 01:02:01 | 00,016,376 | ---- | M] (Windows ® 2000 DDK provider) -- C:\WINDOWS\gdrv.sys -- (gdrv [On_Demand | Stopped]) [2004/06/15 20:47:10 | 00,952,144 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\drivers\ha10kx2k.sys -- (ha10kx2k [On_Demand | Running]) [2004/05/03 00:48:56 | 00,150,160 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\drivers\haP16v2k.sys -- (hap16v2k [On_Demand | Stopped]) [2004/05/03 00:49:54 | 00,147,696 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\drivers\haP17v2k.sys -- (hap17v2k [On_Demand | Running]) [2008/04/13 11:36:05 | 00,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus [On_Demand | Running]) [2007/09/19 04:16:32 | 04,617,728 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running]) [2007/11/03 14:21:02 | 00,068,096 | ---- | M] (EZB Systems, Inc.) -- C:\Program Files\UltraISO\drivers\ISODrive.sys -- (ISODrive [System | Running]) [2007/09/29 00:30:52 | 00,065,024 | R--- | M] (JMicron Technology Corp.) -- C:\WINDOWS\system32\drivers\jraid.sys -- (JRAID [Boot | Running]) [2007/12/05 04:41:00 | 07,435,392 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv [On_Demand | Running]) [2007/09/04 22:26:32 | 00,029,696 | ---- | M] (NVidia Corp.) -- C:\WINDOWS\nvoclock.sys -- (NVR0Dev [On_Demand | Running]) [2004/03/15 21:36:44 | 00,178,736 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv [On_Demand | Running]) [2004/08/03 15:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink [On_Demand | Running]) [2008/01/04 16:58:46 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running]) [2007/12/28 08:31:55 | 00,062,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\rspndr.sys -- (rspndr [Auto | Running]) [2007/12/05 16:45:30 | 00,104,064 | ---- | M] (Realtek Semiconductor Corporation ) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp [On_Demand | Running]) [2008/09/26 15:28:44 | 00,008,944 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV [System | Running]) [2006/02/16 15:51:08 | 00,004,096 | R--- | M] (SuperAdBlocker, Inc.) -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM [On_Demand | Stopped]) [2008/09/26 15:28:44 | 00,055,024 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL [System | Running]) [2007/11/13 05:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv [Auto | Running]) [2001/08/17 16:56:16 | 00,007,552 | ---- | M] (Sony Corporation) -- C:\WINDOWS\system32\drivers\SONYPVU1.SYS -- (SONYPVU1 [On_Demand | Stopped]) [2008/11/02 18:47:27 | 00,717,296 | ---- | M] () -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd [Boot | Running]) [2007/03/01 09:34:22 | 00,028,352 | ---- | M] (Avira GmbH) -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv [System | Running]) [2007/12/24 16:37:00 | 00,138,384 | ---- | M] (Trend Micro Inc.) -- C:\WINDOWS\system32\drivers\tmcomm.sys -- (tmcomm [Auto | Running]) [2008/04/13 13:56:01 | 00,012,288 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\tunmp.sys -- (tunmp [On_Demand | Stopped]) [2008/04/13 13:56:49 | 00,012,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\usb8023.sys -- (USB_RNDIS [On_Demand | Stopped]) [2004/08/03 15:00:00 | 00,012,032 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\ws2ifsl.sys -- (WS2IFSL [System | Running]) [2008/11/08 02:12:45 | 00,024,944 | ---- | M] () -- C:\WINDOWS\system32\drivers\GVTDrv.sys -- (GVTDrv [Unknown | Stopped]) ========== (R ) Internet Explorer ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main] "Default_Page_URL"=http://go.microsoft.com/fwlink/?LinkId=69157 "Default_Search_URL"=http://go.microsoft.com/fwlink/?LinkId=54896 "Default_Secondary_Page_URL"= "Extensions Off Page"=about:NoAdd-ons "Local Page"=%SystemRoot%\system32\blank.htm "Search Page"=http://go.microsoft.com/fwlink/?LinkId=54896 "Security Risk Page"=about:SecurityRisk "Start Page"=http://go.microsoft.com/fwlink/?LinkId=69157 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main] "First Home Page"=http://go.microsoft.com/fwlink/?LinkId=54843 "Local Page"=C:\WINDOWS\system32\blank.htm "Search Page"=http://go.microsoft.com/fwlink/?LinkId=54896 "Start Page"=http://www.google.com/ [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL\AV] ""=http://www.altavista.com/sites/search/web?q=%s [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL\FM] ""=http://www.filemirrors.com/search.src?file=%s [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL\GGL] ""=http://www.google.com/search?q=%s [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL\MSKB] ""=http://support.microsoft.com/?kbid=%s [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL\MSN] ""=http://search.msn.com/results.asp?q=%s [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" (HKLM) -- C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings] "ProxyEnable" = 0 "ProxyOverride" = *.local [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main] "AlwaysUseDefaultPrinter"=yes "Start Page"=http://www.yahoo.com/ [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchURL\AV] ""=http://www.altavista.com/sites/search/web?q=%s [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchURL\FM] ""=http://www.filemirrors.com/search.src?file=%s [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchURL\GGL] ""=http://www.google.com/search?q=%s [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchURL\MSKB] ""=http://support.microsoft.com/?kbid=%s [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchURL\MSN] ""=http://search.msn.com/results.asp?q=%s [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings] "ProxyEnable" = 0 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main] "AlwaysUseDefaultPrinter"=yes "Start Page"=http://www.yahoo.com/ [HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchURL\AV] ""=http://www.altavista.com/sites/search/web?q=%s [HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchURL\FM] ""=http://www.filemirrors.com/search.src?file=%s [HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchURL\GGL] ""=http://www.google.com/search?q=%s [HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchURL\MSKB] ""=http://support.microsoft.com/?kbid=%s [HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchURL\MSN] ""=http://search.msn.com/results.asp?q=%s [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings] "ProxyEnable" = 0 [HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main] "AlwaysUseDefaultPrinter"=yes "Start Page"=http://www.yahoo.com/ [HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\SearchURL\AV] ""=http://www.altavista.com/sites/search/web?q=%s [HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\SearchURL\FM] ""=http://www.filemirrors.com/search.src?file=%s [HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\SearchURL\GGL] ""=http://www.google.com/search?q=%s [HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\SearchURL\MSKB] ""=http://support.microsoft.com/?kbid=%s [HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\SearchURL\MSN] ""=http://search.msn.com/results.asp?q=%s [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings] "ProxyEnable" = 0 [HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main] "AlwaysUseDefaultPrinter"=yes "Start Page"=http://www.yahoo.com/ [HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\SearchURL\AV] ""=http://www.altavista.com/sites/search/web?q=%s [HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\SearchURL\FM] ""=http://www.filemirrors.com/search.src?file=%s [HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\SearchURL\GGL] ""=http://www.google.com/search?q=%s [HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\SearchURL\MSKB] ""=http://support.microsoft.com/?kbid=%s [HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\SearchURL\MSN] ""=http://search.msn.com/results.asp?q=%s [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings] "ProxyEnable" = 0 [HKEY_USERS\S-1-5-21-1220945662-413027322-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main] "First Home Page"=http://go.microsoft.com/fwlink/?LinkId=54843 "Local Page"=C:\WINDOWS\system32\blank.htm "Search Page"=http://go.microsoft.com/fwlink/?LinkId=54896 "Start Page"=http://www.google.com/ [HKEY_USERS\S-1-5-21-1220945662-413027322-839522115-1003\Software\Microsoft\Internet Explorer\SearchURL\AV] ""=http://www.altavista.com/sites/search/web?q=%s [HKEY_USERS\S-1-5-21-1220945662-413027322-839522115-1003\Software\Microsoft\Internet Explorer\SearchURL\FM] ""=http://www.filemirrors.com/search.src?file=%s [HKEY_USERS\S-1-5-21-1220945662-413027322-839522115-1003\Software\Microsoft\Internet Explorer\SearchURL\GGL] ""=http://www.google.com/search?q=%s [HKEY_USERS\S-1-5-21-1220945662-413027322-839522115-1003\Software\Microsoft\Internet Explorer\SearchURL\MSKB] ""=http://support.microsoft.com/?kbid=%s [HKEY_USERS\S-1-5-21-1220945662-413027322-839522115-1003\Software\Microsoft\Internet Explorer\SearchURL\MSN] ""=http://search.msn.com/results.asp?q=%s [HKEY_USERS\S-1-5-21-1220945662-413027322-839522115-1003\Software\Microsoft\Internet Explorer\URLSearchHooks] "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" (HKLM) -- C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) [HKEY_USERS\S-1-5-21-1220945662-413027322-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings] "ProxyEnable" = 0 "ProxyOverride" = *.local ========== (O1) Hosts File ========== HOSTS File = (686 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts First 25 entries... 127.0.0.1 localhost ========== (O2) BHO's ========== [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (HKLM) -- C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} (HKLM) -- C:\Program Files\FlashGet\jccatch.dll (www.flashget.com) {53707962-6F74-2D53-2644-206D7942484F} (HKLM) -- C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) {72853161-30C5-4D22-B7F9-0BBC1D38A37E} (HKLM) -- C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (HKLM) -- C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.) {F156768E-81EF-470C-9057-481BA8380DBA} (HKLM) -- C:\Program Files\FlashGet\getflash.dll (www.flashget.com) ========== (O3) Toolbars ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar] "{32099AAC-C132-4136-9E9A-4E364A424E17}" (HKLM) -- C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar] "{D2F8F919-690B-4EA2-9FA7-A203D1E04F75}" (HKLM) -- C:\Program Files\Styler\TB\StylerTB.dll (StyleFantasist) [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser] "{1392B8D2-5C05-419F-A8F6-B9F15A596612}" (HKLM) -- Reg Error: Key does not exist or could not be opened. File not found [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{32099AAC-C132-4136-9E9A-4E364A424E17}" (HKLM) -- C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () [HKEY_USERS\S-1-5-21-1220945662-413027322-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser] "{1392B8D2-5C05-419F-A8F6-B9F15A596612}" (HKLM) -- Reg Error: Key does not exist or could not be opened. File not found [HKEY_USERS\S-1-5-21-1220945662-413027322-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{32099AAC-C132-4136-9E9A-4E364A424E17}" (HKLM) -- C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () ========== (O4) Run Keys ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated) "Alcmtr"=ALCMTR.EXE (Realtek Semiconductor Corp.) "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min (Avira GmbH) "BootSkin Startup Jobs"="C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs () "CTHelper"=CTHELPER.EXE (Creative Technology Ltd) "CTSysVol"=C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe /r (Creative Technology Ltd) "CTxfiHlp"=CTXFIHLP.EXE (Creative Technology Ltd) "EasyTuneVPro"=C:\Program Files\Gigabyte\ET5Pro\ETcall.exe () "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" (Microsoft Corporation) "ISUSPM Startup"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup (InstallShield Software Corporation) "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start (InstallShield Software Corporation) "LogonStudio"="C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM (Stardock and Luca Saggese) "NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) "NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation) "NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation) "nwiz"=nwiz.exe /install () "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Inc.) "RTHDCPL"=RTHDCPL.EXE (Realtek Semiconductor Corp.) "SBDrvDet"=C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r (Creative Technology Ltd) "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" (Sun Microsystems, Inc.) "UpdReg"=C:\WINDOWS\UpdReg.EXE (Creative Technology Ltd.) [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" (Nero AG) "EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup (Linksys, a Division of Cisco Systems, Inc.) "NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear (NVIDIA) "RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" () "SetDefaultMIDI"=MIDIDef.exe (Creative Technology Ltd) "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (Microsoft Corporation) [HKEY_USERS\S-1-5-21-1220945662-413027322-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" (Nero AG) "EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup (Linksys, a Division of Cisco Systems, Inc.) "NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear (NVIDIA) "RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" () "SetDefaultMIDI"=MIDIDef.exe (Creative Technology Ltd) "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (Microsoft Corporation) ========== (O4) RunOnce Keys ========== [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (Microsoft Corporation) [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (Microsoft Corporation) [HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (Microsoft Corporation) [HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (Microsoft Corporation) ========== (O4) Startup Folders ========== [2006/06/22 13:15:48 | 00,462,848 | ---- | M] (Southwest Airlines) -- C:\Documents and Settings\Admin\Start Menu\Programs\Startup\DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe File not found -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Shortcut to RocketDock.lnk = File not found -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Shortcut to sidebar.lnk = ========== (O6 & O7) Current Version Policies ========== [HKEY_LOCAL_MACHINE\Software\policies\microsoft\internet explorer\Infodelivery\Restrictions] "NoSplash"=0 "NoJITSetup"=1 "NoWebJITSetup"=1 [HKEY_CURRENT_USER\Software\policies\microsoft\internet explorer] "Windows Update Menu Text"=Microsoft Update [HKEY_USERS\.DEFAULT\Software\policies\microsoft\internet explorer] "Windows Update Menu Text"=Microsoft Update [HKEY_USERS\S-1-5-18\Software\policies\microsoft\internet explorer] "Windows Update Menu Text"=Microsoft Update [HKEY_USERS\S-1-5-19\Software\policies\microsoft\internet explorer] "Windows Update Menu Text"=Microsoft Update [HKEY_USERS\S-1-5-20\Software\policies\microsoft\internet explorer] "Windows Update Menu Text"=Microsoft Update [HKEY_USERS\S-1-5-21-1220945662-413027322-839522115-1003\Software\policies\microsoft\internet explorer] "Windows Update Menu Text"=Microsoft Update [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] "NoDriveTypeAutoRun"=145 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] "NoDriveTypeAutoRun"=145 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] "NoDriveTypeAutoRun"=145 [HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] "NoDriveTypeAutoRun"=145 [HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] "NoDriveTypeAutoRun"=145 [HKEY_USERS\S-1-5-21-1220945662-413027322-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] "NoDriveTypeAutoRun"=145 ========== (O8) IE Context Menu Extensions ========== [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\MenuExt\] &Highlight: C:\WINDOWS\Web\highlight.htm [1997/09/24 12:22:34 | 00,000,277 | ---- | M] () &Links List: C:\WINDOWS\Web\urllist.htm [1997/09/25 19:53:34 | 00,001,892 | ---- | M] () &Web Search: C:\WINDOWS\Web\selsearch.htm [1997/09/17 19:03:06 | 00,000,394 | ---- | M] () I&mages List: C:\WINDOWS\Web\imglist.htm File not found Open Frame in &New Window: C:\WINDOWS\Web\frm2new.htm [1997/09/17 15:42:40 | 00,000,072 | ---- | M] () Zoom &In: C:\WINDOWS\Web\zoomin.htm [1997/09/18 14:12:14 | 00,000,452 | ---- | M] () Zoom O&ut: C:\WINDOWS\Web\zoomout.htm [1997/09/18 14:12:50 | 00,000,452 | ---- | M] () [HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\MenuExt\] &Highlight: C:\WINDOWS\Web\highlight.htm [1997/09/24 12:22:34 | 00,000,277 | ---- | M] () &Links List: C:\WINDOWS\Web\urllist.htm [1997/09/25 19:53:34 | 00,001,892 | ---- | M] () &Web Search: C:\WINDOWS\Web\selsearch.htm [1997/09/17 19:03:06 | 00,000,394 | ---- | M] () I&mages List: C:\WINDOWS\Web\imglist.htm File not found Open Frame in &New Window: C:\WINDOWS\Web\frm2new.htm [1997/09/17 15:42:40 | 00,000,072 | ---- | M] () Zoom &In: C:\WINDOWS\Web\zoomin.htm [1997/09/18 14:12:14 | 00,000,452 | ---- | M] () Zoom O&ut: C:\WINDOWS\Web\zoomout.htm [1997/09/18 14:12:50 | 00,000,452 | ---- | M] () [HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\MenuExt\] &Highlight: C:\WINDOWS\Web\highlight.htm [1997/09/24 12:22:34 | 00,000,277 | ---- | M] () &Links List: C:\WINDOWS\Web\urllist.htm [1997/09/25 19:53:34 | 00,001,892 | ---- | M] () &Web Search: C:\WINDOWS\Web\selsearch.htm [1997/09/17 19:03:06 | 00,000,394 | ---- | M] () I&mages List: C:\WINDOWS\Web\imglist.htm File not found Open Frame in &New Window: C:\WINDOWS\Web\frm2new.htm [1997/09/17 15:42:40 | 00,000,072 | ---- | M] () Zoom &In: C:\WINDOWS\Web\zoomin.htm [1997/09/18 14:12:14 | 00,000,452 | ---- | M] () Zoom O&ut: C:\WINDOWS\Web\zoomout.htm [1997/09/18 14:12:50 | 00,000,452 | ---- | M] () [HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\MenuExt\] &Highlight: C:\WINDOWS\Web\highlight.htm [1997/09/24 12:22:34 | 00,000,277 | ---- | M] () &Links List: C:\WINDOWS\Web\urllist.htm [1997/09/25 19:53:34 | 00,001,892 | ---- | M] () &Web Search: C:\WINDOWS\Web\selsearch.htm [1997/09/17 19:03:06 | 00,000,394 | ---- | M] () I&mages List: C:\WINDOWS\Web\imglist.htm File not found Open Frame in &New Window: C:\WINDOWS\Web\frm2new.htm [1997/09/17 15:42:40 | 00,000,072 | ---- | M] () Zoom &In: C:\WINDOWS\Web\zoomin.htm [1997/09/18 14:12:14 | 00,000,452 | ---- | M] () Zoom O&ut: C:\WINDOWS\Web\zoomout.htm [1997/09/18 14:12:50 | 00,000,452 | ---- | M] () [HKEY_USERS\S-1-5-21-1220945662-413027322-839522115-1003\Software\Microsoft\Internet Explorer\MenuExt\] &Highlight: Reg Error: Key does not exist or could not be opened. File not found &Links List: Reg Error: Key does not exist or could not be opened. File not found &Web Search: Reg Error: Key does not exist or could not be opened. File not found I&mages List: Reg Error: Key does not exist or could not be opened. File not found Open Frame in &New Window: Reg Error: Key does not exist or could not be opened. File not found Zoom &In: Reg Error: Key does not exist or could not be opened. File not found Zoom O&ut: Reg Error: Key does not exist or could not be opened. File not found ========== (O9) IE Extensions ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\] {08B0E5C0-4FCB-11CF-AAA5-00401C608501}: Menu: Sun Java Console -- %ProgramFiles%\Java\jre1.6.0_07\bin\npjpi160_07.dll [2008/06/10 03:27:02 | 00,132,496 | ---- | M] (Sun Microsystems, Inc.) {2670000A-7350-4f3c-8081-5663EE0C6C49}: Button: Send to OneNote -- %ProgramFiles%\Microsoft Office\Office12\ONBttnIE.dll [2007/12/13 01:20:58 | 00,606,288 | ---- | M] (Microsoft Corporation) {2670000A-7350-4f3c-8081-5663EE0C6C49}: Menu: S&end to OneNote -- %ProgramFiles%\Microsoft Office\Office12\ONBttnIE.dll [2007/12/13 01:20:58 | 00,606,288 | ---- | M] (Microsoft Corporation) {92780B25-18CC-41C8-B9BE-3C9C571A8263}: Button: Research -- %ProgramFiles%\Microsoft Office\Office12\REFIEBAR.DLL [2006/10/26 23:12:22 | 00,040,424 | ---- | M] (Microsoft Corporation) {D6E814A0-E0C5-11d4-8D29-0050BA6940E3}: Button: FlashGet -- %ProgramFiles%\FlashGet\flashget.exe [2007/09/25 03:10:50 | 02,007,088 | ---- | M] (FlashGet.com) {D6E814A0-E0C5-11d4-8D29-0050BA6940E3}: Menu: FlashGet -- %ProgramFiles%\FlashGet\flashget.exe [2007/09/25 03:10:50 | 02,007,088 | ---- | M] (FlashGet.com) {DFB852A3-47F8-48C4-A200-58CAB36FD2A2}: Menu: Spybot - Search & Destroy Configuration -- %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [2008/01/28 10:43:28 | 01,554,256 | ---- | M] (Safer Networking Limited) {e2e2dd38-d088-4134-82b7-f2ba38496583}: Menu: @xpsp3res.dll,-20001 -- %SystemRoot%\Network Diagnostic\xpnetdiag.exe [2008/04/13 13:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation) {FB5F1910-F110-11d2-BB9E-00C04F795683}: Button: Messenger -- %ProgramFiles%\Messenger\msmsgs.exe [2008/04/13 19:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation) {FB5F1910-F110-11d2-BB9E-00C04F795683}: Menu: Windows Messenger -- %ProgramFiles%\Messenger\msmsgs.exe [2008/04/13 19:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation) ========== (O12) Internet Explorer Plugins ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\] PluginsPage: "" = http://activex.microsoft.com/controls/find...=%s&mime=%s PluginsPageFriendlyName: "" = Microsoft ActiveX Gallery ========== (O13) Default Prefixes ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix] ""=http:// ========== (O16) DPF ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\] {210D0CBC-8B17-48D1-B294-1A338DD2EB3A}: http://24.227.115.174:81/VatDec.cab -- VatCtrl Class {6414512B-B978-451D-A0D8-FCFDF33E833C}: http://www.update.microsoft.com/microsoftu...b?1200033534781 -- WUWebControl Class {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE}: http://www.nvidia.com/content/DriverDownlo.../sysreqlab2.cab -- System Requirements Lab Class {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}: http://www.update.microsoft.com/microsoftu...b?1200033530000 -- MUWebControl Class {8AD9C840-044E-11D1-B3E9-00805F499D93}: http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab -- Java Plug-in 1.6.0_07 {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}: http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab -- Reg Error: Key does not exist or could not be opened. {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}: http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab -- Java Plug-in 1.6.0_03 {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}: http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab -- Java Plug-in 1.6.0_05 {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}: http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab -- Java Plug-in 1.6.0_07 {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}: http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab -- Java Plug-in 1.6.0_07 {D1E7CBDA-E60E-4970-A01C-37301EF7BF98}: http://www.yougamers.com/systeminfo/MSC3.cab -- Measurement Services Client v.3.12 {E87A4CD6-BA5F-4552-BC4F-8EC240A2755C}: http://65.34.29.194/webrec.cab -- WebRecClient Control {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9}: https://secure.logmein.com/activex/ractrl.cab?lmi=100 -- Performance Viewer Activex Control {FE92D9C3-4A69-4EC7-8651-1DC8531D0075}: http://74.143.22.250/user/TSBnwCam.CAB -- TSBnwCam Control ========== (O17) DNS Name Servers ========== {0C5D5F6A-127F-4777-B654-D4DB11F75A6D} (Servers: | Description: 1394 Net Adapter) {0CCD0952-FA5C-4271-854E-444F8F588089} (Servers: | Description: Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC) {661EDF81-A4F3-45FE-8D30-2D6451EB453C} (Servers: | Description: ARRIS TOUCHSTONE DEVICE) {B9648D8D-455A-451D-8158-A1639C9217A5} (Servers: | Description: 1394 Net Adapter) ========== (O20) Winlogon Notify Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\] !SASWinLogon: "DllName" = C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL -- C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com) sys32: "DllName" = sys32.dll -- File not found ========== Shell Execute Hooks ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}" (HKLM) -- C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" (HKLM) -- C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) ========== Safeboot Options ========== "AlternateShell"=cmd.exe ========== CDRom AutoRun Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom] "AutoRun" = 1 ========== Autorun Files on Drives ========== AUTOEXEC.BAT [] [2008/01/11 00:14:54 | 00,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT -- [ NTFS ] AUTORUN.INF [[AutoRun] | OPEN=Autorun.exe | ICON=BLACKXP.ico | ] [2008/01/02 18:01:29 | 00,000,047 | R--- | M] () -- E:\AUTORUN.INF -- [ CDFS ] AutoPlay [] [2008/01/02 17:20:31 | 00,000,000 | R--D | M] -- E:\AutoPlay -- [ CDFS ] Autorun.exe [MZ | ] [2008/01/02 18:01:29 | 02,633,728 | R--- | M] () -- E:\Autorun.exe -- [ CDFS ] autorun.inf [[AutoRun] | open=LaunchU3.exe -a | icon=LaunchU3.exe,0 | | [Definitions] | Launchpad=LaunchPad.exe | Vtype=2 | | [CopyFiles] | FileNumber=1 | File1=LaunchPad.zip | | [Update] | URL=http://u3.sandisk.com/download/lp_installer.asp?custom=1.4.0.4&brand=cruzer | | | [Comment] | brand=cruzer | ] [2007/02/12 14:53:42 | 00,000,277 | R--- | M] () -- G:\autorun.inf -- [ CDFS ] ========== MountPoints2 ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4690a72d-db4b-11dc-9d21-001a4d5b0950}\Shell] ""=AutoRun [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4690a72d-db4b-11dc-9d21-001a4d5b0950}\Shell\AutoRun] ""=Auto&Play [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4690a72d-db4b-11dc-9d21-001a4d5b0950}\Shell\AutoRun\command] ""=G:\LaunchU3.exe -- [2007/02/12 20:33:37 | 01,110,016 | R--- | M] () [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\Shell] ""=AutoRun [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\Shell\AutoRun] ""=Auto&Play [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\Shell\AutoRun\command] ""=E:\Autorun.exe -- [2008/01/02 18:01:29 | 02,633,728 | R--- | M] () [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\Shell] ""=AutoRun [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\Shell\AutoRun] ""=Auto&Play [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\Shell\AutoRun\command] ""=G:\LaunchU3.exe -- [2007/02/12 20:33:37 | 01,110,016 | R--- | M] () ========== Files/Folders - Created Within 30 Days ========== [6 C:\WINDOWS\*.tmp files] [2008/11/08 10:03:40 | 00,422,400 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Admin\Desktop\OTViewIt.exe [2008/11/07 21:09:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Application Data\Malwarebytes [2008/11/07 21:09:02 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2008/11/07 21:09:02 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2008/11/07 21:09:00 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2008/11/07 21:08:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2008/11/07 21:08:58 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2008/11/07 21:08:46 | 02,372,472 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Admin\Desktop\mbam-setup.exe [2008/11/07 19:35:15 | 00,578,560 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\user32.dll [2008/11/07 19:33:15 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERUNT [2008/11/07 19:29:44 | 00,000,000 | ---D | C] -- C:\SDFix [2008/11/07 19:29:42 | 01,529,241 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\SDFix.exe [2008/11/07 19:24:05 | 00,360,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\tcpip.sys [2008/11/07 19:00:44 | 00,289,144 | ---- | C] (S!Ri) -- C:\WINDOWS\System32\VCCLSID.exe [2008/11/07 19:00:44 | 00,288,417 | ---- | C] (S!Ri) -- C:\WINDOWS\System32\SrchSTS.exe [2008/11/07 19:00:44 | 00,135,168 | ---- | C] (SteelWerX) -- C:\WINDOWS\System32\swreg.exe [2008/11/07 19:00:44 | 00,087,552 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\VACFix.exe [2008/11/07 19:00:44 | 00,082,944 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\o4Patch.exe [2008/11/07 19:00:44 | 00,082,944 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\IEDFix.exe [2008/11/07 19:00:44 | 00,082,944 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\IEDFix.C.exe [2008/11/07 19:00:44 | 00,082,432 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\404Fix.exe [2008/11/07 19:00:44 | 00,079,360 | ---- | C] (SteelWerX) -- C:\WINDOWS\System32\swxcacls.exe [2008/11/07 19:00:44 | 00,053,248 | ---- | C] (http://www.beyondlogic.org) -- C:\WINDOWS\System32\Process.exe [2008/11/07 19:00:44 | 00,051,200 | ---- | C] () -- C:\WINDOWS\System32\dumphive.exe [2008/11/07 19:00:44 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\swsc.exe [2008/11/07 19:00:44 | 00,025,600 | ---- | C] () -- C:\WINDOWS\System32\WS2Fix.exe [2008/11/07 19:00:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Desktop\SmitfraudFix [2008/11/07 19:00:36 | 01,579,537 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\SmitfraudFix.exe [2008/11/07 17:53:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP @Alternate Data Stream - 144 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1 [2008/11/07 17:53:32 | 00,000,738 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Registry Mechanic.lnk [2008/11/07 17:53:31 | 00,024,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\STKIT432.DLL [2008/11/07 17:53:30 | 00,000,000 | ---D | C] -- C:\Program Files\Registry Mechanic [2008/11/07 17:53:12 | 07,513,456 | ---- | C] (PC Tools ) -- C:\Documents and Settings\Admin\Desktop\rminstall.exe [2008/11/07 17:41:48 | 00,000,793 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk [2008/11/07 17:41:46 | 00,000,000 | ---D | C] -- C:\Program Files\Lavasoft [2008/11/06 23:59:57 | 00,005,878 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\WinsockxpFix.exe [2008/11/06 20:58:02 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\HijackThis.lnk [2008/11/06 20:58:02 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro [2008/11/06 20:57:38 | 00,297,582 | ---- | C] ( ) -- C:\Documents and Settings\Admin\Desktop\combofix.exe [2008/11/06 20:57:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Desktop\New Folder [2008/11/06 20:24:08 | 19,369,155 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\ivdf_fusebundle_nt_en.zip [2008/11/06 20:20:56 | 00,000,000 | ---D | C] -- C:\WINDOWS\CSC [2008/11/06 19:37:04 | 00,000,512 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\HBEDV.KEY [2008/11/06 17:38:22 | 00,000,000 | ---D | C] -- C:\Temp [2008/11/02 18:50:49 | 00,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Toolbar [2008/11/02 18:50:39 | 00,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite [2008/11/02 18:47:27 | 00,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2008/11/02 18:47:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Application Data\DAEMON Tools [2008/11/02 12:08:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Application Data\NewsLeecher [2008/11/02 12:07:42 | 00,000,660 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\NewsLeecher.lnk [2008/11/02 12:07:40 | 00,000,000 | ---D | C] -- C:\Program Files\NewsLeecher [2008/11/02 12:04:22 | 03,760,771 | ---- | C] ( ) -- C:\Documents and Settings\Admin\Desktop\nl_setup.exe [2008/10/24 00:09:32 | 00,337,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\netapi32.dll [2008/10/16 17:15:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Admin\My Documents\My Recordings [2008/10/16 17:15:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Local Settings\Application Data\Conduit [2008/10/16 17:14:42 | 00,000,000 | ---D | C] -- C:\Program Files\Conduit [2008/10/15 12:52:26 | 00,333,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\srv.sys [2008/10/15 12:52:23 | 01,846,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\win32k.sys [2008/10/15 12:52:22 | 02,189,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntoskrnl.exe [2008/10/15 12:52:22 | 02,145,280 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlmp.exe [2008/10/15 12:52:21 | 02,066,048 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlpa.exe [2008/10/15 12:52:21 | 02,023,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrpamp.exe [2008/10/11 16:45:05 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\America's Army Deploy Client [2008/10/11 16:45:01 | 00,002,383 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\America's Army Deploy Client™.lnk [2008/10/11 16:45:00 | 00,000,000 | ---D | C] -- C:\Program Files\America's Army Deploy Client ========== Files - Modified Within 30 Days ========== [3 C:\WINDOWS\System32\*.tmp files] [6 C:\WINDOWS\*.tmp files] [2008/11/08 10:00:32 | 00,422,400 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Admin\Desktop\OTViewIt.exe [2008/11/08 02:12:45 | 00,024,944 | ---- | M] () -- C:\WINDOWS\System32\drivers\GVTDrv.sys [2008/11/08 02:12:35 | 00,000,024 | ---- | M] () -- C:\WINDOWS\LogonStudio.ini [2008/11/07 22:44:53 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2008/11/07 22:44:29 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2008/11/07 22:44:23 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2008/11/07 22:39:03 | 00,000,686 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\HOSTS [2008/11/07 22:33:15 | 00,030,624 | ---- | M] () -- C:\WINDOWS\System32\BMXStateBkp-{00000005-00000000-00000000-00001102-00000008-10011102}.rfx [2008/11/07 22:33:15 | 00,030,624 | ---- | M] () -- C:\WINDOWS\System32\BMXState-{00000005-00000000-00000000-00001102-00000008-10011102}.rfx [2008/11/07 22:33:15 | 00,029,772 | ---- | M] () -- C:\WINDOWS\System32\BMXCtrlState-{00000005-00000000-00000000-00001102-00000008-10011102}.rfx [2008/11/07 22:33:15 | 00,029,772 | ---- | M] () -- C:\WINDOWS\System32\BMXBkpCtrlState-{00000005-00000000-00000000-00001102-00000008-10011102}.rfx [2008/11/07 22:33:15 | 00,002,796 | ---- | M] () -- C:\WINDOWS\System32\DVCState-{00000005-00000000-00000000-00001102-00000008-10011102}.rfx [2008/11/07 22:33:15 | 00,001,080 | ---- | M] () -- C:\WINDOWS\System32\settingsbkup.sfm [2008/11/07 22:33:15 | 00,001,080 | ---- | M] () -- C:\WINDOWS\System32\settings.sfm [2008/11/07 21:09:02 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2008/11/07 21:02:22 | 02,372,472 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Admin\Desktop\mbam-setup.exe [2008/11/07 19:35:15 | 00,578,560 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\user32.dll [2008/11/07 19:29:10 | 01,529,241 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\SDFix.exe [2008/11/07 19:23:36 | 00,360,064 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\tcpip.sys [2008/11/07 19:00:08 | 01,579,537 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\SmitfraudFix.exe [2008/11/07 18:35:39 | 00,526,710 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2008/11/07 18:35:39 | 00,444,528 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2008/11/07 18:35:39 | 00,072,152 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2008/11/07 17:53:32 | 00,000,738 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Registry Mechanic.lnk [2008/11/07 17:41:48 | 00,000,793 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk [2008/11/07 17:30:14 | 07,513,456 | ---- | M] (PC Tools ) -- C:\Documents and Settings\Admin\Desktop\rminstall.exe [2008/11/07 17:15:00 | 00,000,378 | ---- | M] () -- C:\WINDOWS\tasks\1-Click Maintenance.job [2008/11/06 23:15:14 | 00,005,878 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\WinsockxpFix.exe [2008/11/06 22:09:39 | 00,000,264 | ---- | M] () -- C:\WINDOWS\tasks\Uniblue SpyEraser Nag.job [2008/11/06 20:58:02 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\HijackThis.lnk [2008/11/06 20:55:56 | 00,297,582 | ---- | M] ( ) -- C:\Documents and Settings\Admin\Desktop\combofix.exe [2008/11/06 19:45:12 | 19,369,155 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\ivdf_fusebundle_nt_en.zip [2008/11/06 19:28:12 | 00,000,512 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\HBEDV.KEY [2008/11/05 19:37:56 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2008/11/05 19:37:55 | 00,019,968 | ---- | M] () -- C:\Documents and Settings\Admin\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008/11/02 18:47:27 | 00,717,296 | ---- | M] () -- C:\WINDOWS\System32\drivers\sptd.sys [2008/11/02 12:07:42 | 00,000,660 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\NewsLeecher.lnk [2008/11/02 12:04:38 | 03,760,771 | ---- | M] ( ) -- C:\Documents and Settings\Admin\Desktop\nl_setup.exe [2008/11/01 08:58:41 | 00,139,144 | ---- | M] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2008/11/01 08:58:34 | 00,111,928 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.exe [2008/10/22 16:10:38 | 00,038,496 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2008/10/22 16:10:22 | 00,015,504 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2008/10/19 18:13:18 | 00,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn [2008/10/16 02:09:56 | 00,372,080 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2008/10/16 02:03:13 | 00,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2008/10/15 11:34:24 | 00,337,408 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\netapi32.dll [2008/10/15 11:34:24 | 00,337,408 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\netapi32.dll [2008/10/11 17:19:42 | 00,002,383 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\America's Army Deploy Client™.lnk [2008/10/10 07:58:08 | 00,082,944 | ---- | M] (S!Ri.URZ) -- C:\WINDOWS\System32\o4Patch.exe [2008/10/10 07:58:08 | 00,082,944 | ---- | M] (S!Ri.URZ) -- C:\WINDOWS\System32\IEDFix.C.exe < End of report > And the Extras log OTViewIt Extras logfile created on: 11/8/2008 10:04:24 AM - Run OTViewIt by OldTimer - Version 1.0.20.0 Folder = C:\Documents and Settings\Admin\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.11) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.45 Gb Available Physical Memory | 72.59% Memory free 3.85 Gb Paging File | 3.40 Gb Available in Paging File | 88.33% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092; %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 465.75 Gb Total Space | 366.66 Gb Free Space | 78.73% Space Free | Partition Type: NTFS D: Drive not present or media not loaded Drive E: | 4.24 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS F: Drive not present or media not loaded Drive G: | 5.46 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Drive H: | 3.81 Gb Total Space | 2.50 Gb Free Space | 65.63% Space Free | Partition Type: FAT32 I: Drive not present or media not loaded Computer Name: MATTH Current User Name: Admin Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Whitelist: On File Age = 30 Days ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled"=1 "AntiVirusDisableNotify"=0 "FirewallDisableNotify"=0 "UpdatesDisableNotify"=0 "AntiVirusOverride"=0 "FirewallOverride"=0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile "EnableFirewall"=1 "DoNotAllowExceptions"=0 "DisableNotifications"=0 "DisableUnicastResponsesToMulticastBroadcast"=0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\IcmpSettings] ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [2008/04/13 13:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation) -- %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 [2008/04/13 19:12:34 | 00,141,312 | ---- | M] (Microsoft Corporation) -- %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 [2007/01/19 15:54:56 | 05,674,352 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 [2007/01/04 19:10:02 | 00,297,752 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] [2008/04/13 13:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation) -- %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 [2008/04/13 19:12:34 | 00,141,312 | ---- | M] (Microsoft Corporation) -- %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 [2007/09/25 03:10:50 | 02,007,088 | ---- | M] (FlashGet.com) -- C:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget [2007/12/18 01:29:26 | 04,699,360 | ---- | M] (Crytek GmbH) -- C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:*:Enabled:Crysis_32 [2007/12/18 01:29:28 | 00,017,120 | ---- | M] (Crytek GmbH) -- C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32 [2008/01/12 03:03:08 | 00,066,872 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA [2008/11/01 08:58:34 | 00,111,928 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB [2007/01/19 15:54:56 | 05,674,352 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 [2007/01/04 19:10:02 | 00,297,752 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) [2007/08/15 20:05:16 | 00,184,504 | ---- | M] (SiSoftware) -- C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business XII\Win32\RpcDataSrv.exe:*:Enabled:SiSoftware Database Agent Service [2007/08/15 20:05:14 | 01,441,968 | ---- | M] (SiSoftware) -- C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business XII\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service [2008/05/21 03:37:24 | 12,844,576 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook [2007/08/28 23:23:36 | 00,340,856 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove [2008/05/21 04:54:40 | 01,022,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote [2008/10/01 16:21:23 | 00,131,072 | ---- | M] () -- C:\Program Files\America's Army\System\ArmyOps.exe:*:Enabled:ArmyOps [2008/04/13 19:12:18 | 00,083,456 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test [2008/04/13 19:12:33 | 00,033,280 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\rundll32.exe:*:Enabled:Run a DLL as an App [2007/07/24 18:17:08 | 00,229,376 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour [2008/09/27 13:48:59 | 00,307,712 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox [2008/09/18 13:50:21 | 00,147,456 | ---- | M] (Lime Wire, LLC) -- C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire [2008/10/10 20:47:28 | 00,839,680 | ---- | M] (US Army) -- C:\Program Files\America's Army Deploy Client\AADeployClient.exe:*:Enabled:AADeployClient ========== (O10) Winsock2 Catalogs ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\] NameSpace_Catalog5\Catalog_Entries\000000000004 [NWLink IPX/SPX/NetBIOS Compatible Transport Protocol] -- C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation) ========== HKEY_LOCAL_MACHINE Protocol Defaults ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults - Default Protocols about -- 4 = Restricted sites (Not a Default Protocol) ========== HKEY_USERS Protocol Defaults ========== [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults - Default Protocols about -- 4 = Restricted sites (Not a Default Protocol) ========== HKEY_USERS Protocol Defaults ========== [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults - Default Protocols about -- 4 = Restricted sites (Not a Default Protocol) ========== HKEY_USERS Protocol Defaults ========== [HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults - Default Protocols about -- 4 = Restricted sites (Not a Default Protocol) ========== HKEY_USERS Protocol Defaults ========== [HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults - Default Protocols about -- 4 = Restricted sites (Not a Default Protocol) ========== (O18) Protocol Handlers ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\] [2007/08/24 06:01:46 | 00,224,128 | ---- | M] (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (grooveLocalGWS:{88FED34C-F0CA-4636-A375-3CB6248B04CD} (HKLM) [Local Groove Web Services Protocol]) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\] [2007/01/19 15:53:24 | 00,063,344 | ---- | M] (Microsoft Corporation) C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (livecall:{828030A1-22C1-4009-854F-8E305202313F} (HKLM) [Reg Error: Value does not exist or could not be read.]) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\] msdaipp: [HKLM - No CLSID value] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\] - Protocol Handlers [2007/08/28 22:55:14 | 01,014,128 | ---- | M] (Microsoft Corporation) C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL msdaipp\0x00000001:{E1D2BF42-A96B-11d1-9C6B-0000F875AC61} (HKLM) [HKLM - MSDAMON.BINDER] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\] - Protocol Handlers [2007/08/28 22:55:14 | 01,014,128 | ---- | M] (Microsoft Corporation) C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL msdaipp\oledb:{E1D2BF40-A96B-11d1-9C6B-0000F875AC61} (HKLM) [HKLM - MSDAIPP.BINDER] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\] [2006/10/26 16:45:02 | 00,873,216 | ---- | M] (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (ms-help:{314111c7-a502-11d2-bbca-00c04f8ec294} (HKLM) [HxProtocol Class]) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\] [2007/01/19 15:53:24 | 00,063,344 | ---- | M] (Microsoft Corporation) C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (msnim:{828030A1-22C1-4009-854F-8E305202313F} (HKLM) [Reg Error: Value does not exist or could not be read.]) ========== (O18) Protocol Filters ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\] - Protocol Filters [2006/10/27 00:41:48 | 00,044,344 | ---- | M] (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL text/xml:{807563E5-5146-11D5-A672-00B0D022E945} (HKLM) [Microsoft Office InfoPath XML Mime Filter] ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{000E79B7-E725-4F01-870A-C12942B7F8E4}"=Crysis® "{15095BF3-A3D7-4DDF-B193-3A496881E003}"=Microsoft .NET Framework 3.0 "{18D10072035C4515918F7E37EAFAACFC}"=AutoUpdate "{1A6A6531-08FC-47AD-BAC4-C41497E71033}"=Nero 7 Essentials "{29CBFC23-05A7-4286-93B8-BABE29BC1033}"=Nero 7 Essentials "{3248F0A8-6813-11D6-A77B-00B0D0160030}"=Java™ 6 Update 3 "{3248F0A8-6813-11D6-A77B-00B0D0160050}"=Java™ 6 Update 5 "{3248F0A8-6813-11D6-A77B-00B0D0160070}"=Java™ 6 Update 7 "{3921A67A-5AB1-4E48-9444-C71814CF3027}"=VCRedistSetup "{3E719879-9914-4C56-843E-96D0C3FCC3FB}"=Safari "{3EE1008C-11A1-4F4F-8DB7-27573924DE78}"=DMIView B06.1227.01 "{3F262ADC-5AD2-48E5-A586-44315E04A9E2}"=Microsoft Picture It! Library 10 "{42756145-9997-4D28-809B-8756BFD00106}"=Microsoft Photo Premium 10 "{4676DB43-A5E5-40AD-ACBB-5D80AFD2AFC4}"=Opera 9.24 "{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}"=Bonjour "{491DD792-AD81-429C-9EB4-86DD3D22E333}"=Windows Communication Foundation "{5545EEE1-FA36-4F76-B6BE-5696E7F4E2D6}"=VBA (2627.01) "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}"=neroxml "{56F3E1FF-54FE-4384-A153-6CCABA097814}"=Creative MediaSource "{571700F0-DB9D-4B3A-B03D-35A14BB5939F}"=Windows Live Messenger "{5783F2D7-7001-0409-0002-0060B0CE6BBA}"=AutoCAD 2009 - English "{5888428E-699C-4E71-BF71-94EE06B497DA}"=TuneUp Utilities 2008 "{5F4C776F-8CBD-4C4F-892F-B568ABDD70C8}"=GameSpy Comrade "{656D5B05-0409-41EE-BBEE-D9C4D6388972}"=America's Army "{6D6204C8-6B1D-4FBA-ADA9-CB6DFF9BF80D}"=America's Army Deploy Client "{6EC874C2-F950-4B7E-A5B7-B1066D6B74AA}"=QuickTime "{723A71DF-141B-48D7-AB57-6116C54E4C4B}"=Open XML Editor 1.4 "{7299052b-02a4-4627-81f2-1818da5d550d}"=Microsoft Visual C++ 2005 Redistributable "{789289CA-F73A-4A16-A331-54D498CE069F}"=Ventrilo Client "{7AFF8B71-5E11-4C71-96BC-B46DBA28D424}"=DameWare NT Utilities "{7B63B2922B174135AFC0E1377DD81EC2}"=DivX Codec "{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}"=NVIDIA nTune "{7CCEBC24-62DB-4280-A8EC-BFA49F167920}"=Software Update for Web Folders "{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}"=Windows Workflow Foundation "{7F3AD00A-1819-4B15-BB7D-08B3586336D7}"=3DMark06 "{84031A18-BA9A-4156-A74F-E05B52DDFCE2}"=DING! "{8ADFC4160D694100B5B8A22DE9DCABD9}"=DivX Player "{90120000-0010-0409-0000-0000000FF1CE}"=Microsoft Software Update for Web Folders (English) 12 "{90120000-0015-0409-0000-0000000FF1CE}"=Microsoft Office Access MUI (English) 2007 "{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}"=2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-0016-0409-0000-0000000FF1CE}"=Microsoft Office Excel MUI (English) 2007 "{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}"=2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-0018-0409-0000-0000000FF1CE}"=Microsoft Office PowerPoint MUI (English) 2007 "{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}"=2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-0019-0409-0000-0000000FF1CE}"=Microsoft Office Publisher MUI (English) 2007 "{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}"=2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-001A-0409-0000-0000000FF1CE}"=Microsoft Office Outlook MUI (English) 2007 "{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}"=2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-001B-0409-0000-0000000FF1CE}"=Microsoft Office Word MUI (English) 2007 "{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}"=2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-001F-0409-0000-0000000FF1CE}"=Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{3EC77D26-799B-4CD8-914F-C1565E796173}"=2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-001F-040C-0000-0000000FF1CE}"=Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{430971B1-C31E-45DA-81E0-72C095BAB72C}"=2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-001F-0C0A-0000-0000000FF1CE}"=Microsoft Office Proof (Spanish) 2007 "{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{F7A31780-33C4-4E39-951A-5EC9B91D7BF1}"=2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-002C-0409-0000-0000000FF1CE}"=Microsoft Office Proofing (English) 2007 "{90120000-0030-0000-0000-0000000FF1CE}"=Microsoft Office Enterprise 2007 "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{471159EB-BECC-453C-B6F2-FE4FAB29B3F3}"= "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}"=2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-0044-0409-0000-0000000FF1CE}"=Microsoft Office InfoPath MUI (English) 2007 "{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}"=2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-006E-0409-0000-0000000FF1CE}"=Microsoft Office Shared MUI (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{FAD8A83E-9BAC-4179-9268-A35948034D85}"=2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-008A-0409-0000-0000000FF1CE}"=Microsoft Office 2007 Recent Documents Gadget "{90120000-00A1-0409-0000-0000000FF1CE}"=Microsoft Office OneNote MUI (English) 2007 "{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}"=2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-00BA-0409-0000-0000000FF1CE}"=Microsoft Office Groove MUI (English) 2007 "{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}"=2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-0114-0409-0000-0000000FF1CE}"=Microsoft Office Groove Setup Metadata MUI (English) 2007 "{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}"=2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-0115-0409-0000-0000000FF1CE}"=Microsoft Office Shared Setup Metadata MUI (English) 2007 "{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{FAD8A83E-9BAC-4179-9268-A35948034D85}"=2007 Microsoft Office Suite Service Pack 1 (SP1) "{90120000-0117-0409-0000-0000000FF1CE}"=Microsoft Office Access Setup Metadata MUI (English) 2007 "{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}"=2007 Microsoft Office Suite Service Pack 1 (SP1) "{9C6105B4-2A33-4ADB-89A0-F423D562F3B9}"=ETC B07.1024.01 "{9F7FC79B-3059-4264-9450-39EB368E3225}"=Microsoft Digital Image Library 9 - Blocker "{A1247040-A008-11D5-ABFC-00A0C9E45319}"=URLGameStarter "{A1960A82-DB70-474D-A86B-FA74466103C6}"=Drivers Install For Linksys Easylink Advisor "{A49F249F-0C91-497F-86DF-B2585E8E76B7}"=Microsoft Visual C++ 2005 Redistributable "{AC76BA86-7AD7-1033-7B44-A81000000003}"=Adobe Reader 8.1.0 "{B13A7C41581B411290FBC0395694E2A9}"=DivX Converter "{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}"=@BIOS "{B395BC1D-CC06-425E-9049-4CD985EFF004}"=LightScribe 1.8.15.1 "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1"=Spybot - Search & Destroy "{B508B3F1-A24A-32C0-B310-85786919EF28}"=Microsoft .NET Framework 2.0 Service Pack 1 "{B7050CBDB2504B34BC2A9CA0A692CC29}"=DivX Web Player "{BAF78226-3200-4DB4-BE33-4D922A799840}"=Windows Presentation Foundation "{BB05D173-9681-4812-A7FA-BD4042A3DA00}"=Alky for Applications (Windows XP) "{C3113E55-7BCB-4de3-8EBF-60E6CE6B2096}_is1"=SiSoftware Sandra Professional Business XII "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}"=Microsoft .NET Framework 1.1 "{CC4914EF-6618-4949-A1CF-BD4917A00221}"=SYSTEM_INFO B07.0927.01 "{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}"=SUPERAntiSpyware Free Edition "{CECB9B3D-E681-4458-85F8-8D182941AF1D}"=Sound Blaster Audigy 2 "{D050D7362D214723AD585B541FFB6C11}"=DivX Content Uploader "{D642E38E-0D24-486C-9A2D-E316DD696F4B}"=Microsoft XML Parser "{D8AB8F0C-CEEB-4A29-8EF5-219B064813F4}"=Apple Mobile Device Support "{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}"=Ad-Aware "{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}"=Styler "{EF2B9282-6C9E-4BA9-AE11-4F192CAD07CA}"=SolarWinds LANsurveyor "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}"=Realtek High Definition Audio Driver "Adobe Flash Player ActiveX"=Adobe Flash Player ActiveX "Adobe Flash Player Plugin"=Adobe Flash Player Plugin "Adobe Shockwave Player"=Adobe Shockwave Player "AntiVir PersonalEdition Premium"=Avira AntiVir Premium "AudioConSole"=Creative Audio Console "AutoCAD 2009 - English"=AutoCAD 2009 - English "BootSkin"=BootSkin "DAEMON Tools Toolbar"=DAEMON Tools Toolbar "Driver Genius Professional Edition 2007_is1"=Driver Genius Professional Edition 2007 "EasyLinkAdvisor"=Linksys EasyLink Advisor 1.6 (0033) "EasyTune5Pro"=EasyTune5Pro "ENTERPRISE"=Microsoft Office Enterprise 2007 "EphPod"=EphPod "EVEREST Ultimate Edition_is1"=EVEREST Ultimate Edition v4.20 "FlashGet"=FlashGet 1.9.6.1073 "HijackThis"=HijackThis 2.0.2 "InstallShield_{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}"=NVIDIA nTune "KLiteCodecPack_is1"=K-Lite Mega Codec Pack 3.6.2 "LimeWire"=LimeWire 4.18.8 "LogonStudio"=LogonStudio "Malwarebytes' Anti-Malware_is1"=Malwarebytes' Anti-Malware "Measurement Services Client"=Futuremark Measurement Services Client "Microsoft .NET Framework 1.1 (1033)"=Microsoft .NET Framework 1.1 "Microsoft .NET Framework 3.0"=Microsoft .NET Framework 3.0 "Mozilla Firefox (3.0.3)"=Mozilla Firefox (3.0.3) "NewsLeecher_is1"=NewsLeecher v3.9 Final "Nsauditor_is1"=Nsauditor 1.6.8 "NVIDIA Drivers"=NVIDIA Drivers "PictureItPrem_v10"=Microsoft Photo Premium 10 "PrimoPDF4.1.0.9"=PrimoPDF "prunnet"=Advertisement Service "PunkBusterSvc"=PunkBuster Services "Registry Mechanic_is1"=Registry Mechanic 8.0 "Spybot - Search & Destroy_is1"=Spybot - Search & Destroy 1.5.2.20 "SysInfo"=Creative System Information "SystemRequirementsLab"=System Requirements Lab "Trend Micro HouseCall 6.6"=HouseCall 6.6 "UltraISO_is1"=UltraISO Premium V8.66 "VistaGames"=Windows Vista Games All In One "VLC media player"=VideoLAN VLC media player 0.8.6d "WIC"=Windows Imaging Component "Winamp"=Winamp "Windows Sidebar"=Windows Sidebar "Windows XP Service Pack"=Windows XP Service Pack 3 "WinRAR archiver"=WinRAR archiver "XpsEPSC"=XML Paper Specification Shared Components Pack 1.0 ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "uTorrent"=µTorrent ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "uTorrent"=µTorrent ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "uTorrent"=µTorrent ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "uTorrent"=µTorrent ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 9/27/2008 3:54:30 PM | Computer Name = MATTH | Source = VSS | ID = 8193 Description = Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80040206. Error - 9/27/2008 3:54:30 PM | Computer Name = MATTH | Source = VSS | ID = 5013 Description = Volume Shadow Copy Service error: Shadow Copy writer Microsoft Writer (Bootable State) called routine CVssWriterShim::Subscribe which failed with status 0x8000ffff (converted to 0x800423f4). Error - 9/27/2008 3:55:33 PM | Computer Name = MATTH | Source = EventSystem | ID = 4609 Description = The COM+ Event System detected a bad return code during its internal processing. HRESULT was 80070005 from line 44 of d:\comxp_sp2\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this erro Error - 9/27/2008 3:56:58 PM | Computer Name = MATTH | Source = Application Error | ID = 1000 Description = Faulting application ctxfispi.exe, version 1.0.21.1180, faulting module ctxfispi.exe, version 1.0.21.1180, fault address 0x00017129. Error - 9/27/2008 4:17:38 PM | Computer Name = MATTH | Source = Application Error | ID = 1000 Description = Faulting application ctxfispi.exe, version 1.0.21.1180, faulting module ctxfispi.exe, version 1.0.21.1180, fault address 0x00017129. Error - 9/27/2008 4:22:55 PM | Computer Name = MATTH | Source = Avira AntiVir | ID = 4117 Description = Error - 9/27/2008 4:25:36 PM | Computer Name = MATTH | Source = Application Error | ID = 1000 Description = Faulting application ctxfispi.exe, version 1.0.21.1180, faulting module ctxfispi.exe, version 1.0.21.1180, fault address 0x00017129. Error - 9/27/2008 4:25:49 PM | Computer Name = MATTH | Source = Avira AntiVir | ID = 4117 Description = Error - 9/27/2008 4:26:52 PM | Computer Name = MATTH | Source = Avira AntiVir | ID = 4117 Description = Error - 9/27/2008 4:27:22 PM | Computer Name = MATTH | Source = Application Hang | ID = 1002 Description = Hanging application avcenter.exe, version 8.0.70.8, hang module hungapp, version 0.0.0.0, hang address 0x00000000. [ System Events ] Error - 11/7/2008 11:36:50 PM | Computer Name = MATTH | Source = Service Control Manager | ID = 7001 Description = The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: %%31 Error - 11/7/2008 11:36:50 PM | Computer Name = MATTH | Source = Service Control Manager | ID = 7001 Description = The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: %%31 Error - 11/7/2008 11:36:50 PM | Computer Name = MATTH | Source = Service Control Manager | ID = 7026 Description = The following boot-start or system-start driver(s) failed to load: AFD avgio avipbb Fips intelppm IPSec MRxSmb NetBIOS NetBT ohci1394 RasAcd Rdbss SASDIFSV SASKUTIL ssmdrv Tcpip WS2IFSL Error - 11/8/2008 3:13:14 AM | Computer Name = MATTH | Source = DCOM | ID = 10010 Description = The server {DA230D45-221A-4537-ABAB-75B0DE5FEBA6} did not register with DCOM within the required timeout. Error - 11/8/2008 4:03:33 AM | Computer Name = MATTH | Source = W32Time | ID = 39452689 Description = Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) Error - 11/8/2008 4:03:33 AM | Computer Name = MATTH | Source = W32Time | ID = 39452701 Description = The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time. Error - 11/8/2008 4:03:33 AM | Computer Name = MATTH | Source = W32Time | ID = 39452689 Description = Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) Error - 11/8/2008 4:03:33 AM | Computer Name = MATTH | Source = W32Time | ID = 39452701 Description = The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 15 minutes. NtpClient has no source of accurate time. Error - 11/8/2008 4:03:36 AM | Computer Name = MATTH | Source = W32Time | ID = 39452689 Description = Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) Error - 11/8/2008 4:03:36 AM | Computer Name = MATTH | Source = W32Time | ID = 39452701 Description = The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 15 minutes. NtpClient has no source of accurate time. < End of report > |
|
|
|
|
Nov 8 2008, 11:28 AM
Post
#12
|
|
|
New Member Group: Members Posts: 14 Joined: 6-November 08 Member No.: 253,729 |
Here is some more info for you, not sure if it is of much help but i thought i would post it. I ran the network diagnostic tool in windows. The first log is from the first test, had a winsock error and it rebotted attempting to fix it. The there is the second log after the reboot, but with a different error this time. Any thoughts?
First log: Last diagnostic run time: 11/08/08 11:14:21 WinSock Diagnostic WinSock status info \Device\NetBT_Tcpip_{661EDF81-A4F3-45FE-8D30-2D6451EB453C} protocol is not found in Winsock catalog. error Not all base service provider entries could be found in the winsock catalog. A reset is needed. action Automated repair: Reset WinSock catalog action Successfully executed: netsh winsock reset catalog info System restart required Network Adapter Diagnostic Network location detection info Using home Internet connection Network adapter identification info Network connection: Name=Local Area Connection, Device=Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC, MediaType=LAN, SubMediaType=LAN info Network connection: Name=1394 Connection 2, Device=1394 Net Adapter #2, MediaType=LAN, SubMediaType=1394 info Ethernet connection selected Network adapter status info Network connection status: Connected HTTP, HTTPS, FTP Diagnostic HTTP, HTTPS, FTP connectivity warn HTTP: Error 12007 connecting to www.microsoft.com: The server name or address could not be resolved warn HTTPS: Error 12007 connecting to www.microsoft.com: The server name or address could not be resolved warn FTP (Passive): Error 12007 connecting to ftp.microsoft.com: The server name or address could not be resolved warn HTTP: Error 12007 connecting to www.hotmail.com: The server name or address could not be resolved warn HTTPS: Error 12007 connecting to www.passport.net: The server name or address could not be resolved warn FTP (Active): Error 12007 connecting to ftp.microsoft.com: The server name or address could not be resolved error Could not make an HTTP connection. error Could not make an HTTPS connection. error Could not make an FTP connection. Second log: Last diagnostic run time: 11/08/08 11:19:37 WinSock Diagnostic WinSock status: info Error attmpting to validate the Winsock base providers: 2 error Not all base service provider entries could be found in the winsock catalog. A reset is needed. info Redirecting user to support call Network Adapter Diagnostic: Network location detection info Using home Internet connection Network adapter identification info Network connection: Name=Local Area Connection, Device=Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC, MediaType=LAN, SubMediaType=LAN info Network connection: Name=1394 Connection 2, Device=1394 Net Adapter #2, MediaType=LAN, SubMediaType=1394 info Ethernet connection selected Network adapter status info Network connection status: Connected HTTP, HTTPS, FTP Diagnostic HTTP, HTTPS, FTP connectivity warn HTTP: Error 12007 connecting to www.microsoft.com: The server name or address could not be resolved warn HTTPS: Error 12007 connecting to www.microsoft.com: The server name or address could not be resolved warn FTP (Passive): Error 12007 connecting to ftp.microsoft.com: The server name or address could not be resolved warn HTTP: Error 12007 connecting to www.hotmail.com: The server name or address could not be resolved warn HTTPS: Error 12007 connecting to www.passport.net: The server name or address could not be resolved warn FTP (Active): Error 12007 connecting to ftp.microsoft.com: The server name or address could not be resolved error Could not make an HTTP connection. error Could not make an HTTPS connection. error Could not make an FTP connection. This post has been edited by mcheck14: Nov 8 2008, 11:31 AM |
|
|
|
|
Nov 8 2008, 01:50 PM
Post
#13
|
|
|
New Member Group: Members Posts: 14 Joined: 6-November 08 Member No.: 253,729 |
I just reinstaled the TCP/IP protocol and it looks like that might have fixed the winsock error. But still no connection.
Here is the log after the reinstallation: Last diagnostic run time: 11/08/08 13:42:22 IP Configuration Diagnostic Invalid IP address info Zero (0.0.0.0) IP address detected action Automated repair: Renew IP address action Releasing the current IP address... action Successfully released the current IP address action Renewing the IP address... error Error renewing the IP address: The semaphore timeout period has expired. info AutoNet address detected: 169.254.66.124 action Automated repair: Reset network connection action Disabling the network adapter action Enabling the network adapter info Network adapter successfully enabled info AutoNet address detected: 169.254.66.124 action Manual repair: Reboot modem info AutoNet address detected: 169.254.66.124 action Automated repair: Renew IP address action Releasing the current IP address... action Successfully released the current IP address action Renewing the IP address... error Error renewing the IP address: The semaphore timeout period has expired. info AutoNet address detected: 169.254.66.124 info Redirecting user to support call Wireless Diagnostic Wireless - Service disabled Wireless - User SSID Wireless - First time setup Wireless - Radio off Wireless - Out of range Wireless - Hardware issue Wireless - Novice user Wireless - Ad-hoc network Wireless - Less preferred Wireless - 802.1x enabled Wireless - Configuration mismatch Wireless - Low SNR WinSock Diagnostic WinSock status info All base service provider entries are present in the Winsock catalog. info The Winsock Service provider chains are valid. info Provider entry MSAFD Tcpip [TCP/IP] passed the loopback communication test. info Provider entry MSAFD Tcpip [UDP/IP] passed the loopback communication test. info Connectivity is valid for all Winsock service providers. Network Adapter Diagnostic Network location detection info Using home Internet connection Network adapter identification info Network connection: Name=Local Area Connection, Device=Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC, MediaType=LAN, SubMediaType=LAN info Network connection: Name=1394 Connection 2, Device=1394 Net Adapter #2, MediaType=LAN, SubMediaType=1394 info Ethernet connection selected Network adapter status info Network connection status: Connected HTTP, HTTPS, FTP Diagnostic HTTP, HTTPS, FTP connectivity warn HTTP: Error 12007 connecting to www.microsoft.com: The server name or address could not be resolved warn HTTPS: Error 12007 connecting to www.microsoft.com: The server name or address could not be resolved warn FTP (Passive): Error 12007 connecting to ftp.microsoft.com: The server name or address could not be resolved warn HTTP: Error 12007 connecting to www.hotmail.com: The server name or address could not be resolved warn HTTPS: Error 12007 connecting to www.passport.net: The server name or address could not be resolved warn FTP (Active): Error 12007 connecting to ftp.microsoft.com: The server name or address could not be resolved error Could not make an HTTP connection. error Could not make an HTTPS connection. error Could not make an FTP connection. |
|
|
|
|
Nov 8 2008, 05:42 PM
Post
#14
|
|
|
Malware Expert Group: HJT Team Posts: 13,563 Joined: 23-December 04 From: Pickerington, Ohio Member No.: 7,762 |
Please post a new hijackthis log.
-------------------- If I have helped you in any way, please consider a donation to help me continue the fight against malware.Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it! ======================================================== |
|
|
|
|
Nov 8 2008, 06:00 PM
Post
#15
|
|
|
New Member Group: Members Posts: 14 Joined: 6-November 08 Member No.: 253,729 |
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:58:59, on 11/8/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20900) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\RocketDock\RocketDock.exe C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Southwest Airlines\Ding\Ding.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Documents and Settings\Admin\Application Data\U3\000018604571C94D\LaunchPad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [EasyTuneVPro] C:\Program Files\Gigabyte\ET5Pro\ETcall.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user') O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Global Startup: Shortcut to RocketDock.lnk = ? O4 - Global Startup: Shortcut to sidebar.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} (VatCtrl Class) - http://24.227.115.174:81/VatDec.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1200033534781 O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab2.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1200033530000 O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.12) - http://www.yougamers.com/systeminfo/MSC3.cab O16 - DPF: {E87A4CD6-BA5F-4552-BC4F-8EC240A2755C} (WebRecClient Control) - http://65.34.29.194/webrec.cab O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100 O16 - DPF: {FE92D9C3-4A69-4EC7-8651-1DC8531D0075} (TSBnwCam Control) - http://74.143.22.250/user/TSBnwCam.CAB O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL O20 - Winlogon Notify: sys32 - sys32.dll (file missing) O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Avira AntiVir Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe O23 - Service: Avira AntiVir Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe O23 - Service: Avira AntiVir Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Avira AntiVir Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business XII\Win32\RpcDataSrv.exe O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business XII\RpcSandraSrv.exe O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe -- End of file - 12671 bytes |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 4th July 2009 - 05:55 AM |
© 2003-2009 All Rights Reserved Bleeping Computer LLC.