Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Helpless


  • This topic is locked This topic is locked
12 replies to this topic

#1 jabbb

jabbb

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:01:07 PM

Posted 25 May 2008 - 09:10 AM

Hello I'm new here, this is series on bad events. Starting from, I wanted to buy mp3 player for my girlfried for her birthday, so I went to buy this creative zen. There was also iPod but I decided to go with something different (BIG MISTAKE!). This mp3 player got all kinds of features but for instance to watch movies you need to have a program that can convert the form of videos for the format that creative zen uses...and of course this program you need to buy! (what a rip-off!). So desperately I tried to find a one that's free...I got this somethingsomething.exe file and when I clicked it..BANG!!...lovely freecrackkeygen pages does it again, nothing actually happened but when I opened my windows explorer this message showed up "Your systems is infected with dangerous windows! Note: Strongly recommend to install antispyware program to clean your system and avoid total crash of your computer!". The file it offers is ieav.exe if I remember correctly, but I've read that this particular program exaggerates the infectious files and the be able to cure all the files you need to buy full version of this program or something.
Anyways I've already ran all these programs. AVG virus program, which is my default virus program and it didnt find anything. Ad-aware and it didn't find anything either. Then I downloaded Malwarebytes' Anti-Malware and it actually did find two infectous files or registers and I thought everythings cool now.
But after I still got the same messages, so I installed and ran SmitfraudFix, but it didn't find anything.
So no lastly I downloaded DSS and I it gave me this kind of log of the main.txt:
Deckard's System Scanner v20071014.68
Run by boom on 2008-05-25 16:29:03
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- Last 5 Restore Point(s) --
6: 2008-05-25 12:44:26 UTC - RP291 - Scheduled Checkpoint
5: 2008-05-24 16:02:34 UTC - RP290 - Scheduled Checkpoint
4: 2008-05-23 17:51:08 UTC - RP289 - Scheduled Checkpoint
3: 2008-05-22 23:28:48 UTC - RP288 - Windows Update
2: 2008-05-22 21:00:01 UTC - RP287 - Scheduled Checkpoint


-- First Restore Point --
1: 2008-05-22 07:05:26 UTC - RP286 - Scheduled Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-05-25 16:31:24
Platform: Windows Vista (6.00.6000)
MSIE: Internet Explorer (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\Windows\System32\dwm.exe
C:\Windows\explorer.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Windows\BisonCam\BisonHK.exe
C:\Windows\System32\taskeng.exe
C:\Windows\BisonCam\BsMnt.exe
C:\Program Files\System Control Manager\MGSysCtrl.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\wbem\unsecapp.exe
C:\Users\boom\AppData\Desktop\dss.exe
C:\Windows\System32\conime.exe
C:\Windows\System32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: IE - {616D534C-3CA8-43AB-B439-618F850F1D2B} - C:\Windows\apdogy.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BisonHK] C:\Windows\BisonCam\BisonHK.exe
O4 - HKLM\..\Run: [BsMnt] C:\Windows\BisonCam\BsMnt.exe
O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [IaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\RunOnce: [x64setup] cmd.exe /c "If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG ADD HKCU\Software\GNU\ffdshow\default /v isSubtitles /t REG_DWORD /d 1 /f&&REG ADD HKCU\Software\GNU\ffdshow_audio /v ac3 /t REG_DWORD /d 15 /f&&regsvr32.exe /s "%programfiles%\VistaCodecPack\filters\MatroskaSplitter.ax""
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: avgwlntf - C:\Windows\system32\avgwlntf.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\System32\agrsmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgemc.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: SCM Driver Daemon (NishService) - Unknown owner - C:\Program Files\System Control Manager\edd.exe
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Oz128 Driver\o2flash.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\System32\PnkBstrA.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe


--
End of file - 7497 bytes

-- File Associations -----------------------------------------------------------

.reg - regfile - shell\open\command - regedit.exe "%1" %*
.scr - scrfile - shell\open\command - "%1" %*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R3 MGHwCtrl - \??\c:\windows\system32\drivers\mghwctrl.sys


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 NishService (SCM Driver Daemon) - c:\program files\system control manager\edd.exe
R2 o2flash (O2Micro Flash Memory Card Service) - "c:\program files\o2micro oz128 driver\o2flash.exe" <Not Verified; O2Micro International; O2 MS1/MP1 Service>
R2 RegSrvc (Intel® PROSet/Wireless Registry Service) - c:\program files\intel\wireless\bin\regsrvc.exe <Not Verified; Intel Corporation; Intel® PROSet/Wireless Registry Service>
R2 RichVideo (Cyberlink RichVideo Service(CRVS)) - "c:\program files\cyberlink\shared files\richvideo.exe" <Not Verified; ; RichVideo Module>

S3 WLSetupSvc (Windows Live Setup Service) - "c:\program files\windows live\installer\wlsetupsvc.exe" <Not Verified; Microsoft Corporation; Windows Live installer>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft Tun Miniport Adapter
Device ID: ROOT\*TUNMP\0000
Manufacturer: Microsoft
Name: Teredo Tunneling Pseudo-Interface
PNP Device ID: ROOT\*TUNMP\0000
Service: tunmp


-- Scheduled Tasks -------------------------------------------------------------

2008-05-25 12:04:24 416 --ah----- C:\Windows\Tasks\User_Feed_Synchronization-{E8795380-E0C5-4525-97E6-B8A13E26870E}.job


-- Files created between 2008-04-25 and 2008-05-25 -----------------------------

2008-05-25 16:07:25 3200 --a------ C:\Windows\system32\tmp.reg
2008-05-25 14:32:36 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-25 12:53:21 254464 --a------ C:\Windows\apdogy.dll
2008-05-25 12:53:19 52 --a------ C:\smp.bat
2008-05-25 12:19:47 0 d-------- C:\Program Files\zenin convertori
2008-05-15 22:31:42 53248 -----n--- C:\Windows\Ctregrun.exe <Not Verified; Creative Technology Ltd; Creative Product Registration>
2008-05-15 22:30:06 0 d-------- C:\Program Files\Creative
2008-05-15 22:30:00 0 d-------- C:\Program Files\Common Files\Creative
2008-05-15 22:29:58 0 d--h----- C:\Program Files\Creative Installation Information
2008-05-02 23:38:01 0 d-------- C:\Windows\pss


-- Find3M Report ---------------------------------------------------------------

2008-05-25 16:18:18 12978 --a------ C:\Users\boom\AppData\Roaming\nvModes.001
2008-05-25 16:07:26 35 --a------ C:\Users\boom\AppData\Roaming\SetValue.bat
2008-05-25 16:07:26 691 --a------ C:\Users\boom\AppData\Roaming\GetValue.vbs
2008-05-25 16:05:26 12 --a------ C:\Windows\bthservsdp.dat
2008-05-25 14:32:41 0 d-------- C:\Users\boom\AppData\Roaming\Malwarebytes
2008-05-25 14:30:33 0 d-------- C:\Users\boom\AppData\Roaming\Download Manager
2008-05-25 13:52:57 0 d-------- C:\Users\boom\AppData\Roaming\Azureus
2008-05-25 12:55:34 0 d-------- C:\Users\boom\AppData\Roaming\AVG7
2008-05-25 11:59:43 12978 --a------ C:\Users\boom\AppData\Roaming\nvModes.dat
2008-05-17 01:22:56 0 d-------- C:\Program Files\Opera
2008-05-16 07:42:02 0 d-------- C:\Users\boom\AppData\Roaming\Creative
2008-05-15 22:31:44 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-05-15 22:30:00 0 d-------- C:\Program Files\Common Files
2008-05-14 06:30:01 0 d-------- C:\Program Files\Windows Mail
2008-05-12 22:15:21 0 d-------- C:\Program Files\Common Files\Steam
2008-05-10 02:08:04 0 d-------- C:\Users\boom\AppData\Roaming\mIRC
2008-05-10 02:07:27 0 d-------- C:\Program Files\mIRC
2008-05-03 18:19:08 0 d-------- C:\Program Files\Realtek
2008-04-17 12:57:07 0 d-------- C:\Program Files\Azureus
2008-04-04 15:49:01 0 d-------- C:\Users\boom\AppData\Roaming\Google
2008-04-04 15:46:23 0 d-------- C:\Program Files\Google


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{616D534C-3CA8-43AB-B439-618F850F1D2B}]
25.05.2008 12:53 254464 --a------ C:\Windows\apdogy.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [15.06.2007 00:43]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [28.04.2007 14:05]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [28.04.2007 14:05]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [28.04.2007 14:05]
"BisonHK"="C:\Windows\BisonCam\BisonHK.exe" [16.03.2007 02:37]
"BsMnt"="C:\Windows\BisonCam\BsMnt.exe" [16.03.2007 02:34]
"MGSysCtrl"="C:\Program Files\System Control Manager\MGSysCtrl.exe" [29.05.2007 05:39]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [15.04.2008 20:44]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [12.02.2007 15:37]
"IaNvSrv"="C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [13.03.2007 18:49]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [21.09.2007 04:10 C:\Windows\KHALMNPR.Exe]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [09.01.2008 19:10]
"WindowsWelcomeCenter"="oobefldr.dll,ShowWelcomeCenter" []
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [02.11.2006 15:36]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"x64setup"=cmd.exe /c "If EXIST "%programfiles%\VistaCodecPack\icons\icons64.dll" REG ADD HKCU\Software\GNU\ffdshow\default /v isSubtitles /t REG_DWORD /d 1 /f&&REG ADD HKCU\Software\GNU\ffdshow_audio /v ac3 /t REG_DWORD /d 15 /f&&regsvr32.exe /s "%programfiles%\VistaCodecPack\filters\MatroskaSplitter.ax""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=2 (0x2)
"EnableLUA"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 29.12.2007 00:17 9216 C:\Windows\System32\avgwlntf.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=C:\Windows\pss\Logitech SetPoint.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTCheck]
D:\jutut\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe]
"C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
"C:\Program Files\DAEMON Tools Lite\daemon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"d:\jutut\qtime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"d:\pelit\steam\steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
"C:\Program Files\Winamp\winampa.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
C:\Program Files\Windows Media Player\WMPNSCFG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum
bthsvcs BthServ


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
AutoRun\command- E:\CDSetup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0a913df3-b596-11dc-882d-0019dbead2cc}]
AutoRun\command- G:\setup\rsrc\Autorun.exe
dinstall\command- G:\Directx\dxsetup.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI



-- End of Deckard's System Scanner: finished at 2008-05-25 16:33:50 ------------

And the extra.exe:
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft® Windows Vista™ Home Premium (build 6000)
Architecture: X86; Language: English

CPU 0: Intel® Core™2 Duo CPU T7100 @ 1.80GHz
Percentage of Memory in Use: 34%
Physical Memory (total/avail): 2046.69 MiB / 1337.01 MiB
Pagefile Memory (total/avail): 4309.41 MiB / 3274.07 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1920.18 MiB

C: is Fixed (NTFS) - 34.18 GiB total, 14.42 GiB free.
D: is Fixed (NTFS) - 109.01 GiB total, 9.01 GiB free.
E: is CDROM (No Media)
G: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - WDC WD1600BEVS-22RST0 - 149.05 GiB - 3 partitions
\PARTITION0 - Unknown - 5.85 GiB
\PARTITION1 (bootable) - Installable File System - 34.18 GiB - C:
\PARTITION2 - Installable File System - 109.01 GiB - D:

\\.\PHYSICALDRIVE1 - IMD-0 - 512.86 MiB - 1 partition
\PARTITION0 - Unknown - 512.6 MiB



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is disabled.

FW: Norton Internet Security v2007 (Symantec Corporation) Disabled
AV: AVG 7.5.524 v7.5.524 (Grisoft)
AV: avast! antivirus 4.7.1098 [VPS 071229-0] v4.7.1098 (ALWIL Software)
AV: Norton Internet Security v2007 (Symantec Corporation) Outdated
AS: Windows Defender v1.1.1505.0 (Microsoft Corporation)
AS: Norton Internet Security v2007 (Symantec Corporation) Outdated

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\boom\AppData\Roaming
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=BOOM-PC
ComSpec=C:\Windows\system32\cmd.exe
configsetroot=C:\Windows\ConfigSetRoot
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\boom
LOCALAPPDATA=C:\Users\boom\AppData\Local
LOGONSERVER=\\BOOM-PC
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 13, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f0d
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PUBLIC=C:\Users\Public
SAN_DIR=C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\boom\AppData\Local\Temp
TMP=C:\Users\boom\AppData\Local\Temp
USERDOMAIN=boom-PC
USERNAME=boom
USERPROFILE=C:\Users\boom
windir=C:\Windows


-- User Profiles ---------------------------------------------------------------

boom (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> "C:\Program Files\Creative Installation Information\CD_RIPPER_UNICODE_2\Setup.exe" /remove /l0x0010
--> "C:\Program Files\Creative Installation Information\CREATIVE_SYNC_MANAGER_U\Setup.exe" /remove /l0x0010
--> "C:\Program Files\Creative Installation Information\CREATIVE_VIDEO_CONVERTER\Setup.exe" /remove /l0x0010
--> "C:\Program Files\Creative Installation Information\ZEN_MTP_MEDIA_EXPLORER\Setup.exe" /remove /l0x0010
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x10
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
Activation Assistant for the 2007 Microsoft Office suites --> "C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Flash Player ActiveX --> C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.2 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Adobe Shockwave Player --> C:\Windows\System32\Macromed\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Macromed\SHOCKW~1\Install.log
AdVantage (Powering DAEMON Tools) --> "C:\Program Files\AdVantage\AdVUninst.exe" /r DAEM /d "AdVantage (Powering DAEMON Tools)" /m "AdVantage is safe advertising software that supports DAEMON Tools.\nAdVantage is certified by TRUSTe as a Trusted Download.\n\nAre you sure you want to uninstall AdVantage support for DAEMON Tools?"
Agere Systems HDA Modem --> agrsmdel
AVG 7.5 --> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL
Azureus Vuze --> C:\Program Files\Azureus\uninstall.exe
Battlefield 2™ --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}\setup.exe" -l0x9 -removeonly
Before You Know It 3.5 Lite --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{31B7D5CA-20F8-45F9-8495-446CB38A8972}\setup.exe" -l0x9
BisonCam --> C:\Program Files\InstallShield Installation Information\{4A57592C-FF92-4083-97A9-92783BD5AFB4}\setup.exe -runfromtemp -l0x0009 -removeonly
BS.Player FREE powered by AdVantage --> "C:\Program Files\Webteh\BSplayer\uninstall.exe"
Call of Duty --> D:\pelit\cod\Uninstall\Unwise.exe /u D:\pelit\cod\Uninstall\Install.log
Call of Duty - United Offensive --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{A662E280-64A8-4CF5-8407-13D0808602B3}
CDDRV_Installer --> MsiExec.exe /I{0C826C5B-B131-423A-A229-C71B3CACCD6A}
Counter-Strike: Source --> MsiExec.exe /I{9580813D-94B1-4C28-9426-A441E2BB29A5}
Creative System Information --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x10 /remove
Creative ZEN --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D24DDB61-8868-46CF-BC36-BECC1674F0C1}\SETUP.EXE" -l0x10 /remove
Daniusoft Video to Creative Zen Converter(Build 1.3.30) --> "C:\Program Files\zenin convertori\Video to Creative Zen Converter\unins000.exe"
Day of Defeat: Source --> "D:\pelit\Steam\steam.exe" steam://uninstall/300
DVD Solution --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.exe" -uninstall
Fraps --> "C:\Fraps\uninstall.exe"
Google Earth --> MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
Intel® PROSet/Wireless -ohjelmisto --> C:\Windows\Installer\iProInst.exe
Intel® Turbo Memory ja Intel Matrix Storage Manager --> C:\Windows\system32\imsmudlg.exe -uninstall
KhalInstallWrapper --> MsiExec.exe /I{3101CB58-3482-4D21-AF1A-7057FC935355}
Logitech SetPoint --> C:\Program Files\InstallShield Installation Information\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}\setup.exe -runfromtemp -l0x000b -removeonly
Malwarebytes' Anti-Malware --> "C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
mCore --> MsiExec.exe /I{F5D7FAB5-A1FD-4DD3-983E-4155B09D7102}
mDriver --> MsiExec.exe /I{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}
mHelp --> MsiExec.exe /I{8C6BB412-D3A8-4AAE-A01B-35B681789D68}
Microsoft Office Excel MUI (English) 2007 --> MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Home and Student 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007 --> MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007 --> MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007 --> MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007 --> MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007 --> MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007 --> MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Works --> MsiExec.exe /I{6D52C408-B09A-4520-9B18-475B81D393F1}
mIRC --> C:\Program Files\mIRC\uninstall.exe _?=C:\Program Files\mIRC
mMHouse --> MsiExec.exe /I{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}
mPfMgr --> MsiExec.exe /I{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}
MSXML 4.0 SP2 (KB936181) --> MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833) --> MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
NVIDIA Drivers --> C:\Windows\system32\NVUNINST.EXE UninstallGUI
O2Micro Flash Memory Card Reader Driver Installer(x86) --> MsiExec.exe /X{78764173-3805-4916-B3CE-B433702B8870}
Opera 9.27 --> MsiExec.exe /X{04DB4871-BC1D-44BF-AADB-47326365EB8C}
Organizer ZENcast --> "C:\Program Files\Creative Installation Information\ZENCAST_ORGANIZER\Setup.exe" /remove /l0x0010
Power2Go 5.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\setup.exe" -uninstall
PowerDirector Express --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EDE721EC-870A-11D8-9D75-000129760D75}\setup.exe" -uninstall
PowerProducer --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\setup.exe" -uninstall
QuickTime --> C:\Windows\unvise32qt.exe C:\Windows\system32\QuickTime\Uninstall.log
Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista --> C:\Program Files\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -l0x0009 -removeonly
Realtek High Definition Audio Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0xb -removeonly
Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Excel 2007 (KB946974) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {85E83E2E-AF9B-439B-B4F9-EB9B7EF6A00E}
Security Update for Microsoft Office system 2007 (KB951808) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00}
Security Update for Microsoft Office Word 2007 (KB950113) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
Security Update for Office 2007 (KB947801) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {02B5A17B-01BE-4BA6-95F1-1CBB46EBC76E}
Security Update for Visio 2007 (KB947590) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
SiSoftware Sandra Lite XII.SP1 --> "C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\unins000.exe"
SopCast 2.0.4 --> D:\jutut\SopCast\uninst.exe
Steam™ --> MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
System Control Manager --> C:\Program Files\InstallShield Installation Information\{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}\setup.exe -runfromtemp -l0x0009 -removeonly
Teaching-you Spanish --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CF2DCDAF-7147-406C-8606-8EE173131E3C}\setup.exe" -l0x9
Update for Office 2007 (KB946691) --> msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
VideoLAN VLC media player 0.8.6e --> C:\Program Files\VideoLAN\VLC\uninstall.exe
Winamp --> "C:\Program Files\Winamp\UninstWA.exe"
Windows Driver Package - Atheros Communications Inc. (athr) Net (04/15/2007 7.2.0.204) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst86.exe /u C:\Windows\system32\DRVSTORE\netathr_A3C5CE2F55F7B1C5F3EBD7FA2BD1DF66B97F432E\netathr.inf
Windows Driver Package - Atheros Communications Inc. Net (04/15/2007 7.2.0.204) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst86.exe /u C:\Windows\system32\DRVSTORE\netathrx_75CC24611F68E5A816CFF55FF0CDCBFB55359E7E\netathrx.inf
Windows Driver Package - Bluetooth Dongle Maker Bluetooth (01/01/2007 6.0.6000.16386) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPINST.EXE /u C:\Windows\system32\DRVSTORE\btdongle_705312D9C32BB7F9D9E3F1C7D86796BD308F282B\btdongle.inf
Windows Driver Package - Intel (iaNvStor) SCSIAdapter (03/10/2007 1.0.0.1082) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPINST.EXE /u C:\Windows\system32\DRVSTORE\ianvstor_E1EA503F3B70B7E6FB11B89247F9AB944AA01F53\ianvstor.inf
Windows Driver Package - Intel (NETw2v32) net (03/06/2007 9.1.1.15) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst32.EXE /u C:\Windows\system32\DRVSTORE\netw2_12485469B3B666EE542BF08EFC4D088F0B0A75A4\netw2.inf
Windows Driver Package - Intel (NETw4v32) net (04/30/2007 11.1.1.11) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst32.EXE /u C:\Windows\system32\DRVSTORE\netw4v32_2D5C1C3A07181C86D77C0E7723EF88348DED631A\netw4v32.inf
Windows Driver Package - Intel net (04/30/2007 11.1.1.11) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst32.EXE /u C:\Windows\system32\DRVSTORE\netw4v64_C085F69C6B987145A362CC12BDE2E81905F46EC6\netw4v64.inf
Windows Live installer --> MsiExec.exe /X{5C29C5F5-A9C9-4E89-A606-13E165E7C55F}
Windows Live Messenger --> MsiExec.exe /X{A9174A72-1B46-445B-B3CF-90ED2C63D83B}
Windows Live Sign-in Assistant --> MsiExec.exe /I{0ED47137-C071-46CC-A243-E5E33271E10E}
WinRAR archiver --> C:\Program Files\WinRAR 3.61 Multi\Uninstall.exe
Vista Codec Package --> MsiExec.exe /I{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}


-- Application Event Log -------------------------------------------------------

Event Record #/Type12214 / Error
Event Submitted/Written: 05/25/2008 04:24:44 PM
Event ID/Source: 5007 / WerSvc
Event Description:
The target file for the Windows Feedback Platform (a DLL file containing the list of problems on this computer that require additional data collection for diagnosis) could not be parsed. The error code was 8014FFF9.

Event Record #/Type12208 / Success
Event Submitted/Written: 05/25/2008 04:18:33 PM
Event ID/Source: 5617 / WinMgmt
Event Description:


Event Record #/Type12207 / Success
Event Submitted/Written: 05/25/2008 04:18:32 PM
Event ID/Source: 5615 / WinMgmt
Event Description:


Event Record #/Type12201 / Success
Event Submitted/Written: 05/25/2008 04:18:17 PM
Event ID/Source: 902 / Software Licensing Service
Event Description:
The Software Licensing service has started.

Event Record #/Type12190 / Warning
Event Submitted/Written: 05/25/2008 04:17:12 PM
Event ID/Source: 6000 / Wlclntfy
Event Description:
The winlogon notification subscriber <GPClient> was unavailable to handle a notification event.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type45521 / Warning
Event Submitted/Written: 05/25/2008 04:31:41 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%boom-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %boom-PC27 can't undo changes that you allow.

For more information please see the following:
%boom-PC275

Scan ID: {0723BBC8-D93F-4636-9D21-914C88F116C3}

User: boom-PC\boom

Name: %boom-PC271

ID: %boom-PC272

Severity ID: %boom-PC273

Category ID: %boom-PC274

Path Found: %boom-PC276

Alert Type: %boom-PC278

Detection Type: 1.1.1505.02

Event Record #/Type45520 / Warning
Event Submitted/Written: 05/25/2008 04:31:41 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%boom-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %boom-PC27 can't undo changes that you allow.

For more information please see the following:
%boom-PC275

Scan ID: {0B6F5659-5BEE-4042-95D6-31190E780F60}

User: boom-PC\boom

Name: %boom-PC271

ID: %boom-PC272

Severity ID: %boom-PC273

Category ID: %boom-PC274

Path Found: %boom-PC276

Alert Type: %boom-PC278

Detection Type: 1.1.1505.02

Event Record #/Type45519 / Warning
Event Submitted/Written: 05/25/2008 04:31:41 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%boom-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %boom-PC27 can't undo changes that you allow.

For more information please see the following:
%boom-PC275

Scan ID: {C15807DD-6765-4297-8E53-AA987F15CC8E}

User: boom-PC\boom

Name: %boom-PC271

ID: %boom-PC272

Severity ID: %boom-PC273

Category ID: %boom-PC274

Path Found: %boom-PC276

Alert Type: %boom-PC278

Detection Type: 1.1.1505.02

Event Record #/Type45518 / Warning
Event Submitted/Written: 05/25/2008 04:31:41 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%boom-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %boom-PC27 can't undo changes that you allow.

For more information please see the following:
%boom-PC275

Scan ID: {D90F6964-FEBF-49EE-8FC2-971C602A2B0C}

User: boom-PC\boom

Name: %boom-PC271

ID: %boom-PC272

Severity ID: %boom-PC273

Category ID: %boom-PC274

Path Found: %boom-PC276

Alert Type: %boom-PC278

Detection Type: 1.1.1505.02

Event Record #/Type45517 / Warning
Event Submitted/Written: 05/25/2008 04:31:41 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%boom-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %boom-PC27 can't undo changes that you allow.

For more information please see the following:
%boom-PC275

Scan ID: {BE4CB2D3-358F-4594-AB42-A5D9A88C4AE6}

User: boom-PC\boom

Name: %boom-PC271

ID: %boom-PC272

Severity ID: %boom-PC273

Category ID: %boom-PC274

Path Found: %boom-PC276

Alert Type: %boom-PC278

Detection Type: 1.1.1505.02



-- End of Deckard's System Scanner: finished at 2008-05-25 16:33:50 ------------

Sorry about the background story...but please help me...the whole incident makes me hate the damn creative zen mp3player.

Thanks in advance

Jabbb

BC AdBot (Login to Remove)

 


#2 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:01:07 PM

Posted 25 May 2008 - 01:10 PM

Hi,

First of all, uninstall the following programs via software > add/remove programs because they are not recommended and display advertisements:

AdVantage (Powering DAEMON Tools)
BS.Player FREE powered by AdVantage


Then reboot.

After reboot,

* Download Trend Micro Hijack This™
Doubleclick the HJTInstall.exe to start it.
By default it will install HijackThis in the Program Files\Trendmicro folder and create a desktop shortcut.
HijackThis will open after install. Close it again, because you need to re-run it as administrator since you are using Vista.

So RIGHTCLICK HijackThis.exe present in the Program Files\Trendmicro folder and choose to run as administrator

Press the Scan button below.

Place a check against the following:

O2 - BHO: IE - {616D534C-3CA8-43AB-B439-618F850F1D2B} - C:\Windows\apdogy.dll

* Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!

Reboot.

After reboot, navigate to and delete the following files if still present:

C:\Windows\apdogy.dll
C:\smp.bat

Let me know if that solved your issue.

Edited by miekiemoes, 25 May 2008 - 01:11 PM.

AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 jabbb

jabbb
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:01:07 PM

Posted 25 May 2008 - 02:26 PM

I'll try them now...just some additional information...I scanned "critical files" and "my computer" with kaspersky...and in "my computer" it found 3 viruses and 5 infected objects...but I would have to install their trial program to be able to get rid of these files.
And other information daemon tools when I tried to delete it, it said that it has been removed already and offered me only to remove it from the list...and after the program still exists in my folders.

Anyway...now I'm gonna try all that what you told me to do.

Thank you so much already, to be so kind and helping me.

#4 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:01:07 PM

Posted 25 May 2008 - 02:37 PM

Hi,

And other information daemon tools when I tried to delete it, it said that it has been removed already and offered me only to remove it from the list...and after the program still exists in my folders.

Yes, let it remove it from the list.

Then also look if the following folders still exist and delete them:

C:\Program Files\AdVantage
C:\Program Files\Webteh

I scanned "critical files" and "my computer" with kaspersky...and in "my computer" it found 3 viruses and 5 infected objects...but I would have to install their trial program to be able to get rid of these files.

I assume you mean the Online scanner?
After performing above steps, please rerun the scan again and post the log from Kaspersky in your next reply.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#5 jabbb

jabbb
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:01:07 PM

Posted 25 May 2008 - 02:50 PM

YEEEEESSSSSSSSSSSSSSSSSSSSS!!!!! I think its gone, it didnt say anything anymore when I opened windows explorer or anyother program. THANK YOU THANK YOU THANK YOU!!!! I don't know how did you figured it out that it was those files causing the problem but I am at your feet kissing them.

So the viruses and infected files which the kaspersky found were false, to try to make me download and purchase their program?

Anyway thanks a million I hope everything works now.

#6 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:01:07 PM

Posted 25 May 2008 - 02:56 PM

So the viruses and infected files which the kaspersky found were false, to try to make me download and purchase their program?

Did you use the Kaspersky online scan? In that case, they weren't false. The online scan doesn't delete the files, it only lists them. :thumbsup:

In anyway, good to hear that it solved your problem.

Glad I could help. :)

Please read my Prevention page with lots of info and tips how to prevent this in the future.
And if you want to improve speed/system performance after malware removal, take a look here.
Extra note: Make sure your programs are up to date - because older versions may contain Security Leaks. To find out what programs need to be updated, please run the Secunia Software Inspector Scan.

Happy Surfing again!
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#7 jabbb

jabbb
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:01:07 PM

Posted 25 May 2008 - 03:42 PM

hmm...my avg cannot find any viruses or infected files...yea maybe there is a difference between the programs, but is there anyway I could get rid off these viruses without buying the kaspersky?

I dont think my computer has got any slower, at least I hope so =).

Anyway THANK YOU again...you've been more than kind.

#8 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:01:07 PM

Posted 25 May 2008 - 03:45 PM

yea maybe there is a difference between the programs, but is there anyway I could get rid off these viruses without buying the kaspersky?

Kaspersky is a littlebit better in detection than AVG, so that explains it.
Yes, you can get rid of whatever Kaspersky finds as infected - no need to buy Kaspersky for that, you can delete the files manually (as you have done before).
So just rescan with Kaspersky and click to save the log, so I can have a look and tell you what to delete :thumbsup:
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#9 jabbb

jabbb
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:01:07 PM

Posted 25 May 2008 - 06:10 PM

Allright this is what I got:


hmm...hope I managed to attach it right...

Attached Files



#10 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:01:07 PM

Posted 26 May 2008 - 12:53 AM

Hi,

Nothing really to worry about...

The first one:

C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped

This is a false positive. Kaspersky always flags Mirc.exe as unwanted, this since malware may install Mirc as well. In your case, you may ignore this since I assume you installed Mirc.

The other ones:

C:\Program Files\Trend Micro\HijackThis\backups\backup-20080525-223556-924.dll Infected: Trojan-Downloader.Win32.Peregar.nb skipped <== this is the one you fixed in HijackThis previously. As you see, HijackThis creates a backup of what you fixed. To delete it, just delete the C:\Program Files\Trend Micro\HijackThis\backups folder

C:\Users\boom\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Users\boom\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\SmitfraudFix.exe/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Users\boom\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\SmitfraudFix.exe RAR: infected - 1 skipped


The Reboot.exe is a part of Smitfraudfix you have been using previously. Reboot.exe is a commandline tool to reboot your computer. Some scanners flag this as unwanted since malware may use it as well. Anyway, since you don't need Smitfraudfix anymore, there's no need to keep it, so delete C:\Users\boom\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\SmitfraudFix.exe

C:\Users\boom\AppData\Roaming\Opera\Opera\profile\cache4\opr05G4Q.exe Infected: Trojan.Win32.Pakes.cyi skipped

This is a leftover in your Opera Cache. You can delete the file manually: C:\Users\boom\AppData\Roaming\Opera\Opera\profile\cache4\opr05G4Q.exe or you can just use the Clear Cache option in Opera which will delete this file as well. :thumbsup:

Let me know afterwards if that solved your issue. :)

Edited by miekiemoes, 26 May 2008 - 12:54 AM.

AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#11 jabbb

jabbb
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:01:07 PM

Posted 26 May 2008 - 06:44 AM

So in other words, if they're not harmful I can also leave them in computer? Smitfaudfix.exe might be useful in the future, mirc I might need, the Hijackthis backup folder I deleted. Opera I'm still searching from where I can deleted it.

All in all I think everythings alright now and I can only thank you. Thank you so much once again. You're been so kind for nothing, I really appreciate you put your time to help me. Thank you. If you need something that I can help you with, let me know.

Thanks

Jabbb

#12 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:01:07 PM

Posted 26 May 2008 - 06:50 AM

Hi,

As for Smitfraudfix, it's better to delete it, because it's useless if you want to use it in the future. This because it's updated everyday. So if you want to use Smitfraudfix again, you should redownload it, so you have the latest version.

For your Opera...
Read here how to clean your cache in Opera:
http://www.verio.com/support/documents/vie...cfm?doc_id=3698

And you're most welcome :thumbsup:
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#13 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:01:07 PM

Posted 28 May 2008 - 10:48 AM

Since this issue appears resolved ... this Topic is closed.
If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users