Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Wixawin And Cellordo Popups, Vundo Trojen?


  • This topic is locked This topic is locked
1 reply to this topic

#1 ladybadone

ladybadone

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:31 PM

Posted 19 July 2008 - 12:39 PM

Edited to add content from misplaced topic for context. ~ OB

Yesterday I started getting these popups from cellorado and wixawin and poker adds. They open my IE at random. I have done a virus scan with norton and nothing. I have also scanned with spybot, spydoctor, Ad-Aware, Vundo fix and a few others and none of them can find it.

End of added content. ~ OB

Ok here are my new logs. As posted I started getting these popups yesterday with IE. I have tryed a number of diff spyware programs to get rid of them but nothing can find it. However I do know I have it. From all that I have read I supposed this has something to do with it
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
Thanks
-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
60: 2008-07-19 17:29:13 UTC - RP632 - Deckard's System Scanner Restore Point
59: 2008-07-19 15:28:43 UTC - RP631 - Removed Pando.
58: 2008-07-19 15:22:58 UTC - RP630 - Removed Java™ SE Runtime Environment 6
57: 2008-07-19 15:21:54 UTC - RP629 - Removed J2SE Runtime Environment 5.0 Update 5
56: 2008-07-19 11:15:55 UTC - RP628 - Installed Ad-Aware


-- First Restore Point --
1: 2008-05-11 10:20:20 UTC - RP573 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as The new baby.exe) ----------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:32:04 PM, on 7/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Personal Firewall\NISUM.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Norton Personal Firewall\ccPxySvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
D:\LCDMon.exe
D:\downloads\CorelPhoto\CorelIOMonitor.exe
C:\WINDOWS\System32\svchost.exe
D:\Applets\LCDPop3\LCDPOP3.exe
D:\Applets\LCDMedia.exe
D:\Applets\LCDClock.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\31284RL0.exe
D:\downloads\dss.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\The new baby.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/ig?hl=en
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 63.149.98.251:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Launch LGDCore] D:\LGDCore.exe /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "D:\LCDMon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "D:\iTunesHelper.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel PhotoDownloader.exe" -startup
O4 - HKLM\..\Run: [Corel File Shell Monitor] D:\downloads\CorelPhoto\CorelIOMonitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [igndlm.exe] D:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Reader\reader_sl.exe
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\downloads\ICQ\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\downloads\ICQ\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\downloads\ICQ\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\downloads\ICQ\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstall...205BW/index.htm
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} (PogoWebLauncher Control) - http://www.pogo.com/cdl/launcher/PogoWebLa...erInstaller.CAB
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\ccPxySvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton Personal Firewall Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\NISUM.EXE
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 10190 bytes

-- File Associations -----------------------------------------------------------

.js - JSFile - DefaultIcon - D:\Program Files\Dreamweaver MX 2004\Dreamweaver.exe,2
.js - JSFile - shell\open\command - "D:\Program Files\Dreamweaver MX 2004\Dreamweaver.exe" "%1"


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus® ASPI Shell>

S3 cpuz - d:\downloads\system\cpu-z-122\cpuz.sys <Not Verified; Windows ® 2000 DDK provider; Windows ® 2000 DDK driver>
S3 ENTECH - c:\windows\system32\drivers\entech.sys <Not Verified; EnTech Taiwan; PowerStrip>
S3 GMSIPCI - f:\install\gmsipci.sys (file missing)
S3 RivaTuner32 - d:\program files\rivatuner v2.0 rc 15.8\rivatuner32.sys


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Bonjour Service (##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##) - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Computer, Inc.; Bonjour>
R2 ForceWare Intelligent Application Manager (IAM) - c:\program files\nvidia corporation\networkaccessmanager\bin\nsvcappflt.exe <Not Verified; ; app_filter Module>
R2 ForcewareWebInterface (Forceware Web Interface) - "c:\program files\nvidia corporation\networkaccessmanager\apache group\apache2\bin\apache.exe" -k runservice <Not Verified; Apache Software Foundation; Apache HTTP Server>
R2 nSvcIp (ForceWare IP service) - c:\program files\nvidia corporation\networkaccessmanager\bin\nsvcip.exe <Not Verified; NVIDIA; NVIDIA nSvcIp>
R2 nSvcLog (ForceWare user log service) - c:\program files\nvidia corporation\networkaccessmanager\bin\nsvclog.exe <Not Verified; NVIDIA; NVIDIA nSvcLog>

S3 FLEXnet Licensing Service - "c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2008-07-19 19:00:10 350 --a------ C:\WINDOWS\Tasks\At44.job
2008-07-19 19:00:10 350 --a------ C:\WINDOWS\Tasks\At20.job
2008-07-19 18:00:11 350 --a------ C:\WINDOWS\Tasks\At43.job
2008-07-19 18:00:11 350 --a------ C:\WINDOWS\Tasks\At19.job
2008-07-19 17:00:10 350 --a------ C:\WINDOWS\Tasks\At42.job
2008-07-19 17:00:00 350 --a------ C:\WINDOWS\Tasks\At18.job
2008-07-19 13:00:10 350 --a------ C:\WINDOWS\Tasks\At38.job
2008-07-19 13:00:10 350 --a------ C:\WINDOWS\Tasks\At14.job
2008-07-19 12:05:55 350 --a------ C:\WINDOWS\Tasks\At37.job
2008-07-19 12:00:11 350 --a------ C:\WINDOWS\Tasks\At13.job
2008-07-19 11:00:10 350 --a------ C:\WINDOWS\Tasks\At36.job
2008-07-19 11:00:01 350 --a------ C:\WINDOWS\Tasks\At12.job
2008-07-19 10:19:22 350 --a------ C:\WINDOWS\Tasks\At35.job
2008-07-19 10:00:04 350 --a------ C:\WINDOWS\Tasks\At11.job
2008-07-19 09:06:26 350 --a------ C:\WINDOWS\Tasks\At34.job
2008-07-19 09:00:01 350 --a------ C:\WINDOWS\Tasks\At10.job
2008-07-18 21:00:10 350 --a------ C:\WINDOWS\Tasks\At46.job
2008-07-18 21:00:01 350 --a------ C:\WINDOWS\Tasks\At22.job
2008-07-18 20:00:10 350 --a------ C:\WINDOWS\Tasks\At45.job
2008-07-18 20:00:01 350 --a------ C:\WINDOWS\Tasks\At21.job
2008-07-18 16:00:10 350 --a------ C:\WINDOWS\Tasks\At41.job
2008-07-18 16:00:01 350 --a------ C:\WINDOWS\Tasks\At17.job
2008-07-18 15:00:12 350 --a------ C:\WINDOWS\Tasks\At40.job
2008-07-18 15:00:02 350 --a------ C:\WINDOWS\Tasks\At16.job
2008-07-18 14:00:12 350 --a------ C:\WINDOWS\Tasks\At39.job
2008-07-18 14:00:03 350 --a------ C:\WINDOWS\Tasks\At15.job
2008-07-17 09:56:55 350 --a------ C:\WINDOWS\Tasks\At48.job
2008-07-17 09:56:55 350 --a------ C:\WINDOWS\Tasks\At47.job
2008-07-17 09:56:55 350 --a------ C:\WINDOWS\Tasks\At33.job
2008-07-17 09:56:55 350 --a------ C:\WINDOWS\Tasks\At32.job
2008-07-17 09:56:55 350 --a------ C:\WINDOWS\Tasks\At31.job
2008-07-17 09:56:55 350 --a------ C:\WINDOWS\Tasks\At30.job
2008-07-17 09:56:55 350 --a------ C:\WINDOWS\Tasks\At29.job
2008-07-17 09:56:55 350 --a------ C:\WINDOWS\Tasks\At28.job
2008-07-17 09:56:55 350 --a------ C:\WINDOWS\Tasks\At27.job
2008-07-17 09:56:55 350 --a------ C:\WINDOWS\Tasks\At26.job
2008-07-17 09:56:55 350 --a------ C:\WINDOWS\Tasks\At25.job
2008-07-17 09:46:06 350 --a------ C:\WINDOWS\Tasks\At9.job
2008-07-17 09:46:06 350 --a------ C:\WINDOWS\Tasks\At8.job
2008-07-17 09:46:06 350 --a------ C:\WINDOWS\Tasks\At7.job
2008-07-17 09:46:06 350 --a------ C:\WINDOWS\Tasks\At6.job
2008-07-17 09:46:06 350 --a------ C:\WINDOWS\Tasks\At5.job
2008-07-17 09:46:06 350 --a------ C:\WINDOWS\Tasks\At4.job
2008-07-17 09:46:06 350 --a------ C:\WINDOWS\Tasks\At3.job
2008-07-17 09:46:06 350 --a------ C:\WINDOWS\Tasks\At24.job
2008-07-17 09:46:06 350 --a------ C:\WINDOWS\Tasks\At23.job
2008-07-17 09:46:04 350 --a------ C:\WINDOWS\Tasks\At2.job
2008-07-17 09:46:04 350 --a------ C:\WINDOWS\Tasks\At1.job
2008-07-07 10:18:01 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


-- Files created between 2008-06-19 and 2008-07-19 -----------------------------

2008-07-19 18:46:41 0 d-------- C:\Program Files\Trend Micro
2008-07-19 13:15:56 0 d-------- C:\Program Files\Lavasoft
2008-07-19 13:15:56 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-19 13:05:32 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-19 12:47:37 0 d-------- C:\VundoFix Backups
2008-07-19 11:24:58 0 d-------- C:\Program Files\Enigma Software Group
2008-07-17 18:03:44 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Macromedia
2008-07-17 17:04:46 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Adobe
2008-07-17 17:04:12 0 dr------- C:\Documents and Settings\NetworkService\My Documents
2008-07-17 17:04:07 0 d-------- C:\Documents and Settings\NetworkService\Application Data\ICQ Toolbar
2008-07-17 17:04:06 0 dr------- C:\Documents and Settings\NetworkService\Favorites
2008-07-17 09:56:53 35842 --a------ C:\WINDOWS\system32\8f4Uh458.exe
2008-07-17 09:46:02 35842 --a------ C:\WINDOWS\system32\31284RL0.exe


-- Find3M Report ---------------------------------------------------------------

2008-07-19 17:23:02 0 d-------- C:\Program Files\Java
2008-07-19 16:54:41 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-07-19 16:54:37 0 d-------- C:\Program Files\Symantec AntiVirus
2008-07-19 16:54:21 0 d-------- C:\Program Files\Common Files
2008-07-19 13:15:34 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-18 18:03:14 0 d-------- C:\Program Files\ICQToolbar
2008-07-18 17:20:04 4184 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2008-07-17 11:45:59 0 d-------- C:\Documents and Settings\The new baby\Application Data\Azureus
2008-06-25 09:05:01 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-06-24 11:08:01 0 d-------- C:\Documents and Settings\The new baby\Application Data\OpenOffice.org2
2008-05-29 23:11:32 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-05-29 11:11:20 0 d-------- C:\Program Files\IncrediMail <INCRED~1>
2008-04-24 12:52:15 44544 -----n--- C:\WINDOWS\AWuninstall.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
10/04/2007 10:06 PM 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [10/04/2007 10:06 PM 1135968]

[-HKEY_CLASSES_ROOT\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [12/01/2004 09:54 AM C:\WINDOWS\SOUNDMAN.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [10/22/2006 01:22 PM]
"nwiz"="nwiz.exe" [10/22/2006 01:22 PM C:\WINDOWS\system32\nwiz.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [06/02/2005 09:21 AM]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [08/20/2005 02:36 PM]
"ccRegVfy"="C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" [09/21/2002 02:43 AM]
"nTrayFw"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" [04/29/2005 06:22 PM]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 11:50 AM]
"Adobe Photo Downloader"="D:\Program Files\3.0\Apps\apdproxy.exe" [06/07/2005 12:46 AM]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [06/23/2005 07:27 PM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [10/25/2006 07:58 PM]
"NvMediaCenter"="NvMCTray.dll" [10/22/2006 01:22 PM C:\WINDOWS\system32\nvmctray.dll]
"@"="" []
"Launch LGDCore"="D:\LGDCore.exe" [03/06/2006 05:31 PM]
"Launch LCDMon"="D:\LCDMon.exe" [03/06/2006 05:14 PM]
"iTunesHelper"="D:\iTunesHelper.exe" []
"Corel Photo Downloader"="C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel PhotoDownloader.exe" []
"Corel File Shell Monitor"="D:\downloads\CorelPhoto\CorelIOMonitor.exe" [10/30/2007 07:52 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [06/10/2008 04:27 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igndlm.exe"="D:\Program Files\Download Manager\DLM.exe" [03/05/2007 01:57 PM]

C:\Documents and Settings\The new baby\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [9/1/2005 9:17:21 PM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - D:\Program Files\Reader\reader_sl.exe [9/23/2005 11:05:26 PM]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{27771334-8bac-11db-9eb2-0013d312283d}]
AutoRun\command- G:\julkort.avi

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{72b6b506-11b0-11da-9b4c-806d6172696f}]
AutoRun\command- F:\Setup.exe

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: AMD Athlon™ 64 Processor 3500+
Percentage of Memory in Use: 26%
Physical Memory (total/avail): 2047.48 MiB / 1499.33 MiB
Pagefile Memory (total/avail): 3430.44 MiB / 3036.75 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1919.65 MiB

C: is Fixed (NTFS) - 29.29 GiB total, 13.21 GiB free.
D: is Fixed (NTFS) - 97.65 GiB total, 30.72 GiB free.
E: is Fixed (NTFS) - 62.96 GiB total, 24.02 GiB free.
F: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - Maxtor 6L200M0 - 189.92 GiB - 3 partitions
\PARTITION0 (bootable) - Installable File System - 29.29 GiB - C:
\PARTITION1 - Extended w/Extended Int 13 - 160.62 GiB - D: - E:



-- Security Center -------------------------------------------------------------

AUOptions is set to notify before download.
Windows Internal Firewall is enabled.

FirstRunDisabled is set.
FirewallDisableNotify is set.

FW: NVIDIA Firewall v1.0 (NVIDIA Corporation) Disabled
FW: Norton Personal Firewall v2003 (Symantec Corporation) Disabled
AV: Symantec AntiVirus Corporate Edition v10.0.1.1000 (Symantec Corporation)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"="C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe:*:Enabled:Apache HTTP Server"
"D:\\downloads\\ICQ\\ICQLite\\ICQLite.exe"="D:\\downloads\\ICQ\\ICQLite\\ICQLite.exe:*:Enabled:ICQ Lite"
"D:\\Phone\\Skype.exe"="D:\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\World of Warcraft\\WoW-1.12.0.5595-to-1.12.1.5875-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.12.0.5595-to-1.12.1.5875-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Documents and Settings\\The new baby\\Desktop\\WoW-2.0.0.5991-enGB-Installer-downloader.exe"="C:\\Documents and Settings\\The new baby\\Desktop\\WoW-2.0.0.5991-enGB-Installer-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\\web\\WS_FTP\\WS_FTP95.exe"="D:\\web\\WS_FTP\\WS_FTP95.exe:*:Enabled:WS_FTP 95"
"D:\\Program Files\\Azureus\\Azureus.exe"="D:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"
"D:\\Burning Crusade Closed Beta\\WoW-2.0.0.5991-to-2.0.0.6022-enGB-downloader.exe"="D:\\Burning Crusade Closed Beta\\WoW-2.0.0.5991-to-2.0.0.6022-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\\Burning Crusade Closed Beta\\WoW-2.0.0.6022-to-2.0.0.6046-enGB-downloader.exe"="D:\\Burning Crusade Closed Beta\\WoW-2.0.0.6022-to-2.0.0.6046-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\\Burning Crusade Closed Beta\\WoW-2.0.0-enGB-downloader.exe"="D:\\Burning Crusade Closed Beta\\WoW-2.0.0-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\\Burning Crusade Closed Beta\\WoW-2.0.0.6052-to-2.0.1.6082-enGB-downloader.exe"="D:\\Burning Crusade Closed Beta\\WoW-2.0.0.6052-to-2.0.1.6082-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\\Burning Crusade Closed Beta\\WoW-2.0.1.6082-to-2.0.2.6108-enGB-downloader.exe"="D:\\Burning Crusade Closed Beta\\WoW-2.0.1.6082-to-2.0.2.6108-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\\Burning Crusade Closed Beta\\WoW-2.0.2.6108-to-2.0.2.6144-enGB-downloader.exe"="D:\\Burning Crusade Closed Beta\\WoW-2.0.2.6108-to-2.0.2.6144-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"="C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"D:\\Burning Crusade Closed Beta\\WoW-2.0.2.6144-to-2.0.2.6178-enGB-downloader.exe"="D:\\Burning Crusade Closed Beta\\WoW-2.0.2.6144-to-2.0.2.6178-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enGB-patch-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enGB-patch-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\\Burning Crusade Closed Beta\\WoW-2.0.2.6178-to-2.0.3.6213-enGB-downloader.exe"="D:\\Burning Crusade Closed Beta\\WoW-2.0.2.6178-to-2.0.3.6213-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\\Burning Crusade Closed Beta\\WoW-2.0.3.6213-to-2.0.3.6244-enGB-downloader.exe"="D:\\Burning Crusade Closed Beta\\WoW-2.0.3.6213-to-2.0.3.6244-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\\iTunes.exe"="D:\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\World of Warcraft\\WoW-2.0.3-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.3-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\\Burning Crusade Closed Beta\\WoW-2.0.3.6282-to-2.0.3.6299-enGB-downloader.exe"="D:\\Burning Crusade Closed Beta\\WoW-2.0.3.6282-to-2.0.3.6299-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.5.6320-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.5.6320-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-2.0.5.6320-to-2.0.6.6337-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.5.6320-to-2.0.6.6337-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-2.0.6.6337-to-2.0.7.6383-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.6.6337-to-2.0.7.6383-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-2.0.7.6383-to-2.0.8.6403-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.7.6383-to-2.0.8.6403-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-2.0.8.6403-to-2.0.10.6448-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.8.6403-to-2.0.10.6448-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-2.0.10.6448-to-2.0.12.6546-enGB-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.10.6448-to-2.0.12.6546-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\\Program Files\\Poser.exe"="D:\\Program Files\\Poser.exe:*:Enabled:Poser executable file"
"\\\\THOMAS\\D\\World of Warcraft\\Repair.exe"="\\\\THOMAS\\D\\World of Warcraft\\Repair.exe:*:Enabled:Repair.exe"
"E:\\The Lord of the Rings Online\\lotroclient.exe"="E:\\The Lord of the Rings Online\\lotroclient.exe:*:Enabled:lotroclient.exe"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Documents and Settings\\The new baby\\Desktop\\CabalTemp\\ESTdnheadless.exe"="C:\\Documents and Settings\\The new baby\\Desktop\\CabalTemp\\ESTdnheadless.exe:*:Enabled:EST! download engine"
"D:\\Ultima Online 2D\\client.exe"="D:\\Ultima Online 2D\\client.exe:*:Enabled:Ultima Online Client"
"D:\\downloads\\uomapper\\uoam.exe"="D:\\downloads\\uomapper\\uoam.exe:*:Enabled:Ultima Online's premier mapping tool."
"D:\\KingdomReborn\\UOKR.exe"="D:\\KingdomReborn\\UOKR.exe:*:Enabled:UOKR"
"D:\\downloads\\ICQ\\ICQ.exe"="D:\\downloads\\ICQ\\ICQ.exe:*:Enabled:ICQ6"
"D:\\downloads\\mirc\\mirc.exe"="D:\\downloads\\mirc\\mirc.exe:*:Enabled:mIRC"
"C:\\Program Files\\IncrediMail\\bin\\ImApp.exe"="C:\\Program Files\\IncrediMail\\bin\\ImApp.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"="C:\\Program Files\\IncrediMail\\bin\\IncMail.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"="C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe:*:Enabled:IncrediMail"
"D:\\downloads\\pando\\pando.exe"="D:\\downloads\\pando\\pando.exe:*:Enabled:Pando Application"
"D:\\downloads\\ICQ\\ICQ6\\ICQ.exe"="D:\\downloads\\ICQ\\ICQ6\\ICQ.exe:*:Enabled:ICQ6"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"E:\\The Lord of the Rings Online (2)\\lotroclient.exe"="E:\\The Lord of the Rings Online (2)\\lotroclient.exe:*:Enabled:lotroclient"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\The new baby\Application Data
CLASSPATH=.;C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=GENA
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\The new baby
LOGONSERVER=\\GENA
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Common Files\Adobe\AGL;C:\Program Files\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 47 Stepping 0, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=2f00
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\THENEW~1\LOCALS~1\Temp
TMP=C:\DOCUME~1\THENEW~1\LOCALS~1\Temp
USERDOMAIN=GENA
USERNAME=The new baby
USERPROFILE=C:\Documents and Settings\The new baby
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

The new baby (admin)
Guest (new local, guest)


-- Add/Remove Programs ---------------------------------------------------------

--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
3D Shadow by Lokas Software --> C:\WINDOWS\AWuninstall.exe Software\Lokas Ltd\3D Shadow
3DMark05 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2DF7B278-D3B6-40A4-B25C-0E7149F439EA}\Setup.exe" -l0x9
Ad-Aware --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Anchor Service CS3 --> MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3 --> MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge 1.0 --> MsiExec.exe /I{B74D4E10-1033-0000-0000-000000000001}
Adobe Bridge CS3 --> MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting --> MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0 --> MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps --> MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color - Photoshop Specific --> MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings --> MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}
Adobe Color EU Extra Settings --> MsiExec.exe /I{51846830-E7B2-4218-8968-B77F0FF475B8}
Adobe Color JA Extra Settings --> MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Recommended Settings --> MsiExec.exe /I{95655ED4-7CA5-46DF-907F-7144877A32E5}
Adobe Common File Installer --> MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5B39}
Adobe Default Language CS3 --> MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3 --> MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe Download Manager 2.0 (endast avinstallation) --> "C:\Program Files\Common Files\Adobe\ESD\uninst.exe"
Adobe ExtendScript Toolkit 2 --> MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}
Adobe Flash Player 9 ActiveX --> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Fonts All --> MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Center 1.0 --> MsiExec.exe /I{E9787678-1033-0000-8E67-000000000001}
Adobe Help Viewer CS3 --> MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe Linguistics CS3 --> MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe PDF Library Files --> MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS2 --> msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D}
Adobe Photoshop CS3 --> C:\Program Files\Common Files\Adobe\Installers\719d6f144d0c086a0dfa7ff76bb9ac1\Setup.exe
Adobe Photoshop CS3 --> MsiExec.exe /I{3D7E3EC9-46CF-4359-9289-39CE01DFB82F}
Adobe Premiere Pro --> RunDll32 "C:\Program Files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll",LaunchSetup "C:\Program Files\InstallShield Installation Information\{084709F7-38C5-4609-B55F-2417939315EB}\setup.exe"
Adobe Reader 7.0.5 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70500000002}
Adobe Setup --> MsiExec.exe /I{FF11004C-F42A-4A31-9BCF-7F5C8FDBE53C}
Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Adobe Stock Photos 1.0 --> MsiExec.exe /I{786C5747-1033-0000-B58E-000000000001}
Adobe Stock Photos CS3 --> MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe Type Support --> MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3 --> MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client --> MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe WinSoft Linguistics Plugin --> MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP Panels CS3 --> MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
Adobe® Photoshop® Album Starter Edition 3.0 --> MsiExec.exe /I{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}
Ahead Nero Burning ROM --> D:\downloads\nero\uninstall\UNNERO.exe /UNINSTALL
Alien Skin Eye Candy 5 Impact --> D:\JASCSO~1\PAINTS~1\PlugIns\ALIENS~2\EYECAN~3\Unwise32.exe D:\JASCSO~1\PAINTS~1\PlugIns\ALIENS~2\EYECAN~3\INSTALL.LOG
Alien Skin Eye Candy 5 Nature --> D:\JASCSO~1\PAINTS~1\PlugIns\ALIENS~2\EYECAN~1\Unwise32.exe D:\JASCSO~1\PAINTS~1\PlugIns\ALIENS~2\EYECAN~1\INSTALL.LOG
Alien Skin Eye Candy 5 Textures --> D:\JASCSO~1\PAINTS~1\PlugIns\ALIENS~2\EYECAN~2\Unwise32.exe D:\JASCSO~1\PAINTS~1\PlugIns\ALIENS~2\EYECAN~2\INSTALL.LOG
Alien Skin Xenofex 2 --> D:\JASCSO~1\PAINTS~1\PlugIns\ALIENS~1\Unwise32.exe D:\JASCSO~1\PAINTS~1\PlugIns\ALIENS~1\INSTALL.LOG
Apple Software Update --> MsiExec.exe /I{A50C25D7-62E9-4511-AD70-8E2DA5E79B7D}
Azureus --> D:\Program Files\Azureus\Uninstall.exe
Bryce 5.5a --> C:\WINDOWS\unvise32.exe d:\program files\Bryce Uninstall.log
Corel Paint Shop Pro Photo X2 --> MsiExec.exe /X{64E72FB1-2343-4977-B4A8-262CD53D0BD3}
DAZ|Studio BETA 0.9.20.9 --> C:\WINDOWS\unvise32.exe d:\program files\DAZ Studio Uninstall.log
eMusic - 50 Free MP3 offer --> "D:\downloads\winamp\eMusic\Uninst-eMusic-promotion.exe"
Eye Candy 3 --> D:\JASCSO~1\PAINTS~1\PlugIns\UNWISE.EXE D:\JASCSO~1\PAINTS~1\PlugIns\INSTALL.LOG
Eye Candy 4000 --> D:\JASCSO~1\PAINTS~1\PlugIns\EYECAN~1\UNWISE.EXE D:\JASCSO~1\PAINTS~1\PlugIns\EYECAN~1\INSTALL.LOG
Filters Unlimited 1.0 --> D:\Jasc Software Inc\Paint Shop Pro 9\PlugIns\Setup\Setup.exe /u
Fraps (remove only) --> "D:\Fraps\uninstall.exe"
GSpot Codec Information Appliance --> D:\Program Files\GSpot\Uninstall.exe
Guild Wars --> "E:\Guild Wars\Gw.exe" -uninstall
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
ICQ6 --> "C:\Program Files\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly
IGN Download Manager 2.3.2 --> D:\Program Files\Download Manager\uninst.exe
IncrediMail Xe --> C:\Program Files\IncrediMail\bin\ImSetup.exe /remove /addon:IncrediMail /log:IncMail.log
iTunes --> MsiExec.exe /I{446DBFFA-4088-48E3-8932-74316BA4CAE4}
J2SE Runtime Environment 5.0 Update 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
Jasc Animation Shop 3 --> MsiExec.exe /I{7C4196CA-CA41-4F34-9C08-7724E7705D52}
Java™ 6 Update 7 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
LiveReg (Symantec Corporation) --> C:\Program Files\Common Files\Symantec Shared\LiveReg\VCSetup.exe /REMOVE
LiveUpdate 3.0 (Symantec Corporation) --> "C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
Logitech G-series Keyboard Software --> MsiExec.exe /X{5A080213-5AEC-4BF2-BB32-796EB0E421EC}
Macromedia Dreamweaver MX 2004 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{05BB2EC5-6BEF-4DDC-9E75-BEE7B161157A}\Setup.exe" -l0x9 mmUninstall
Macromedia Extension Manager --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A5BA14E0-7384-11D4-BAE7-00409631A2C8}\setup.exe" -l0x9 mmUninstall
mIRC --> "D:\downloads\mirc\mirc.exe" -uninstall
Mozilla Firefox (2.0.0.16) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Norton Personal Firewall --> MsiExec.exe /I{15BFECE8-A100-4861-B92B-1EFF76683C23}
Norton WMI Update --> MsiExec.exe /X{1526D87C-A955-4FAB-BF18-697BA457E352}
NVIDIA Drivers --> C:\WINDOWS\system32\nvudisp.exe UninstallGUI
NVIDIA ForceWare Network Access Manager --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{1F6423DE-7959-4178-80E0-023C7EAA5347} /l1033
Opcion Font Viewer --> MsiExec.exe /X{B86688D9-0F85-458B-AFB1-5B3B4C8CE541}
OpenOffice.org 2.2 --> MsiExec.exe /I{3CCBC9FF-7F35-4220-B66D-B60E2E7AB4E2}
PDF Settings --> MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
Poser 6 --> C:\WINDOWS\unvise32.exe d:\program files\uninstal.log
QuickTime --> MsiExec.exe /I{50D8FFDD-90CD-4859-841F-AA1961C7767A}
Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
RivaTuner v2.0 RC 15.8 --> "D:\Program Files\RivaTuner v2.0 RC 15.8\uninstall.exe"
Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Skype 1.3 --> "D:\Phone\unins000.exe"
Spybot - Search & Destroy 1.4 --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Supportassistent Portal --> "C:\Program Files\Telia\Supportassistent\unins000.exe"
Symantec AntiVirus --> MsiExec.exe /I{3248E093-5288-4CA9-B3AB-11A675FEA1F9}
The Lord of the Rings Online™: Shadows of Angmar™ v07.12.30.70 --> "E:\The Lord of the Rings Online\unins000.exe"
Ulead ArtTexture.Plugin 1.0 --> C:\WINDOWS\IsUninst.exe -f"d:\Program Files\ulead\At10f.isu"
Ulead FantasyWarp.Plugin 1.0 --> C:\WINDOWS\IsUninst.exe -fc:\plugins\filters\Fw10f.isu
Ultima Online 2D --> C:\WINDOWS\UOUninst.exe
UO Auto-Map --> D:\downloads\uomapper\uoam.exe -uninstall
UO Rudder --> C:\WINDOWS\st6unst.exe -n "D:\ST6UNST.LOG"
UOAssist --> D:\UOAssist\UOAssist.exe /Uninstall
Ventrilo Client --> MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Viewpoint Media Player --> C:\Program Files\Viewpoint\Viewpoint Media Player\mtsAxInstaller.exe /u
Winamp --> "D:\downloads\winamp\UninstWA.exe"
Winamp Toolbar --> "C:\Program Files\Winamp Toolbar\uninstall.exe"
Windows Live installer --> MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Messenger --> MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Live Sign-in Assistant --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
WinFast® Display Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F69FD33C-8815-46BF-9134-A643DE68F3C0}\setup.exe" -l0x9 -removeonly
WinISO 5.3 --> "D:\Program Files\WinISO\unins000.exe"
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
WinZip --> "D:\downloads\WinZip\WINZIP32.EXE" /uninstall
Xara3D6 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B3783869-5D14-4838-A042-910DF816D070}\setup.exe" -l0x9


-- Application Event Log -------------------------------------------------------

Event Record #/Type56717 / Error
Event Submitted/Written: 07/19/2008 01:13:35 PM
Event ID/Source: 0 / pctsSvc.exe
Event Description:
The service process could not connect to the service controller

Event Record #/Type56704 / Success
Event Submitted/Written: 07/19/2008 01:08:25 PM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type56627 / Success
Event Submitted/Written: 07/18/2008 07:32:29 PM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type56604 / Success
Event Submitted/Written: 07/18/2008 01:01:08 PM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type56597 / Warning
Event Submitted/Written: 07/18/2008 08:13:22 AM
Event ID/Source: 6 / Symantec AntiVirus
Event Description:
Could not scan 1 files inside E:\pandostuff\Hancock ( NEW SOURCE) TS XVID - STG\HANGER.part54.rar due to extraction errors encountered by the Decomposer Engines.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type65150 / Error
Event Submitted/Written: 07/19/2008 07:30:32 PM
Event ID/Source: 10016 / DCOM
Event Description:
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{BC866CF2-5486-41F7-B46B-9AA49CF3EBB1}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19). This security permission can be modified using the Component Services administrative tool.

Event Record #/Type65149 / Error
Event Submitted/Written: 07/19/2008 07:30:32 PM
Event ID/Source: 10016 / DCOM
Event Description:
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{BC866CF2-5486-41F7-B46B-9AA49CF3EBB1}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19). This security permission can be modified using the Component Services administrative tool.

Event Record #/Type65145 / Error
Event Submitted/Written: 07/19/2008 07:11:02 PM
Event ID/Source: 10016 / DCOM
Event Description:
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{BC866CF2-5486-41F7-B46B-9AA49CF3EBB1}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19). This security permission can be modified using the Component Services administrative tool.

Event Record #/Type65144 / Error
Event Submitted/Written: 07/19/2008 07:11:01 PM
Event ID/Source: 10016 / DCOM
Event Description:
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{BC866CF2-5486-41F7-B46B-9AA49CF3EBB1}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19). This security permission can be modified using the Component Services administrative tool.

Event Record #/Type65143 / Error
Event Submitted/Written: 07/19/2008 06:51:31 PM
Event ID/Source: 10016 / DCOM
Event Description:
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{BC866CF2-5486-41F7-B46B-9AA49CF3EBB1}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19). This security permission can be modified using the Component Services administrative tool.



-- End of Deckard's System Scanner: finished at 2008-07-19 19:32:29 ------------

Edited by Orange Blossom, 19 July 2008 - 11:09 PM.


BC AdBot (Login to Remove)

 


#2 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:04:31 AM

Posted 21 July 2008 - 04:35 PM

Hello, my name is fenzodahl512 and welcome to BC.. Please do the following...


Please uninstall Viewpoint Media Player from your computer..




Please download the OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator")
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    [kill explorer]
    C:\WINDOWS\system32\31284RL0.exe
    C:\WINDOWS\Tasks\At??.job
    C:\WINDOWS\system32\8f4Uh458.exe
    C:\Program Files\Viewpoint
    HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{27771334-8bac-11db-9eb2-0013d312283d}
    HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{72b6b506-11b0-11da-9b4c-806d6172696f}
    EmptyTemp
    purity
    [start explorer]
  • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
  • Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.



----------------------------------


Please download Malwarebytes' Anti-Malware from HERE or HERE

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.




Please post the following logs in your next reply...

1. OTMoveIt2
2. Malwarebytes
3. A fresh DSS log
4. Tell me about your computer condition..


Regards
fenzodahl512

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users