Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Fraud.AntivirusXP


  • This topic is locked This topic is locked
20 replies to this topic

#1 -JHiZ-

-JHiZ-

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:11:44 PM

Posted 25 January 2009 - 05:19 PM

I have the AntivirusXP trojan and I have no idea how to get rid of it. Attempted to remove with with Spyboy Seek & Destroy and remove with BitDefender. Also attempted to do a system restore but that didnt work. This is my first time posting so I hope I posted right! Let me know if I am missing anything... Thanks so much for the help!




DDS (Ver_09-01-19.01) - NTFSx86
Run by J. Hiz at 13:47:05.90 on Sun 01/25/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1377 [GMT -8:00]

AV: Bitdefender Antivirus *On-access scanning enabled* (Updated)
FW: Bitdefender Firewall *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\ITE\Smart Guardian\ITESmart.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\program files\steam\steam.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\PerSono\perstray.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe -kbdx
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\J. Hiz\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.igoogle.com/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: BitDefender Toolbar: {381ffde8-2394-4f90-b10d-fc6124a40f8c} - c:\program files\bitdefender\bitdefender 2008\IEToolbar.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Steam] "c:\program files\steam\steam.exe" -silent
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [NVMixerTray] "c:\program files\nvidia corporation\nvmixer\NVMixerTray.exe"
mRun: [BitDefender Antiphishing Helper] "c:\program files\bitdefender\bitdefender 2008\IEShow.exe"
mRun: [BDAgent] "c:\program files\bitdefender\bitdefender 2008\bdagent.exe"
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [SmartGuardian] c:\program files\ite\smart guardian\ITESmart.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mExplorerRun: [Lsass Service] c:\documents and settings\j. hiz\application data\microsoft\windows\lsass.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\perstray.lnk - c:\program files\persono\perstray.exe
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: c:\windows\temp\ntdll64.dll
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
AppInit_DLLs: mss.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Notification Packages = scecli scecli scecli

============= SERVICES / DRIVERS ===============

R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [2007-11-12 86792]
R3 iteio;iteio;c:\windows\system32\drivers\ITEIO.SYS [2008-1-19 3680]
R4 uacFlt;Plantronics USB Audio Adapter EQ Filter Driver;c:\windows\system32\drivers\uacflt.sys [2008-1-20 21276]
S3 ALSysIO;ALSysIO;\??\c:\docume~1\j92c0~1.hiz\locals~1\temp\alsysio.sys --> c:\docume~1\j92c0~1.hiz\locals~1\temp\ALSysIO.sys [?]

=============== Created Last 30 ================

2009-01-25 13:31 <DIR> --d----- c:\program files\Trend Micro
2009-01-24 12:40 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-01-24 12:40 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-01-22 21:10 43,008 a------- c:\windows\Ugivamikumipo.dll
2009-01-22 21:10 43,008 a------- c:\windows\system32\chert9-303359.exe
2009-01-22 20:56 1,347 a------- c:\windows\system32\ahtn.htm
2009-01-22 20:56 4,785 a------- c:\windows\system32\warning.gif
2009-01-22 20:56 491 a------- c:\windows\system32\win32hlp.cnf
2009-01-22 20:56 125,440 ac------ c:\windows\system32\dllcache\userinit.exe
2009-01-22 20:56 125,440 a------- c:\windows\system32\ntdll64.exe
2009-01-22 20:56 1 a------- c:\windows\system32\test.ttt
2009-01-22 20:55 25,088 a------- c:\windows\system32\frmwrk32.exe
2009-01-22 20:55 25,088 a------- c:\windows\system32\303359.exe
2009-01-22 20:43 25,600 a--sh--- c:\windows\system32\mss.dll
2009-01-22 20:40 <DIR> --d----- c:\program files\LimeWire
2009-01-22 20:38 37,888 a------- C:\lhmclnpc.exe

==================== Find3M ====================

2009-01-25 13:47 81,984 a------- c:\windows\system32\bdod.bin
2009-01-22 20:56 125,440 a------- c:\windows\system32\userinit.exe
2008-12-25 09:18 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-12-18 17:37 410,984 a------- c:\windows\system32\deploytk.dll
2008-12-12 11:18 87,336 a------- c:\windows\system32\dns-sd.exe
2008-12-12 11:11 61,440 a------- c:\windows\system32\dnssd.dll
2008-12-11 02:57 333,952 a------- c:\windows\system32\drivers\srv.sys

============= FINISH: 13:47:20.20 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:12:44 PM

Posted 01 February 2009 - 09:45 AM

Please download Malwarebytes' Anti-Malware from HERE or HERE

Note: If you already have Malwarebytes' Anti-Malware, just run and update it.. Then do a "Perform Full Scan"

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.




NEXT


Please download RSIT by random/random and save it to your Desktop.
  • Double click on RSIT.exe to run RSIT
  • Before you click "Continue", make sure you change the List files/folders created or modified in the last 3 months
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt and info.txt in your next reply.



NEXT


Please download GMER and unzip it to your Desktop.
  • Open the program and click on the Rootkit tab.
  • Make sure all the boxes on the right of the screen are checked, EXCEPT for ‘Show All’.
  • Click on Scan.
  • When the scan has run click Copy and paste the results into a Notepad >> save it and attach in this thread.


Post me these logs in your next reply.. Post each log in separate post..

1. Malwarebytes'
2. RSIT log.txt
3. RSIT info.txt
4. Attach GMER result..

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#3 -JHiZ-

-JHiZ-
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:11:44 PM

Posted 03 February 2009 - 03:22 AM

Sorry for the delay. Please see below


Malwarebytes' Anti-Malware 1.33
Database version: 1718
Windows 5.1.2600 Service Pack 3

2/3/2009 12:20:01 AM
mbam-log-2009-02-03 (00-20-01).txt

Scan type: Full Scan (C:\|D:\|E:\|)
Objects scanned: 135384
Time elapsed: 28 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 7
Registry Keys Infected: 13
Registry Values Infected: 2
Registry Data Items Infected: 5
Folders Infected: 0
Files Infected: 38

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\wcjaef.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ziwodd.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\alpphx.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\jwlmdt.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\mlJDSkLE.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\mss.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\Temp\ntdll64.dll (Trojan.FakeAlert) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mljdskle (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3a00ac8a-bb1d-4235-a798-7f93451dac93} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3a00ac8a-bb1d-4235-a798-7f93451dac93} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9ebe5464-ac09-436e-972a-643bebaee8e1} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ebe5464-ac09-436e-972a-643bebaee8e1} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b1c2bfe6-2a3d-4b8f-be2b-857036437262} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{26afe49d-8533-4909-ada6-93bcd282e7ca} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Lsass Service (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\mlJDSkLE.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\wcjaef.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ziwodd.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\alpphx.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\jwlmdt.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ntdll64.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mss.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tuvUMgfc.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jkkIayyX.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\opnkIAqr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ddCVLfFX.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rqRjjHAS.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pmnmljIy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\awtuuTll.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\byXPhhgF.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\efcaxxXQ.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\efcCvSmN.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\efcdcbxW.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hgGwvwVM.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iifecYPf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iifGWpOG.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mljigfCr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xxyXNeFw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xxyyWPJA.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yayawwXQ.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yayvuUNf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ljjKeBrp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fccbCuRI.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fccCUnLd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\khfCTJCr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\khfDvvWQ.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\khfeBqPh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\khfFutsT.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vtUmkHAR.dll (Trojan.vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vtUnlJde.dll (Trojan.vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\warning.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ahtn.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\ntdll64.dll (Trojan.FakeAlert) -> Delete on reboot.

#4 -JHiZ-

-JHiZ-
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:11:44 PM

Posted 03 February 2009 - 03:34 AM

Logfile of random's system information tool 1.05 (written by random/random)
Run by J. Hiz at 2009-02-03 00:31:44
Microsoft Windows XP Professional Service Pack 3
System drive C: has 19 GB (53%) free of 35 GB
Total RAM: 2046 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:31:46 AM, on 2/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\program files\steam\steam.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\PerSono\perstray.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\J. Hiz\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\J. Hiz.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.igoogle.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SmartGuardian] C:\Program Files\ITE\Smart Guardian\ITESmart.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Perstray.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O20 - AppInit_DLLs: mss.dll wcjaef.dll ziwodd.dll alpphx.dll jwlmdt.dll flpwot.dll qgkaiz.dll cdqtwb.dll wvmgpu.dll duvzxv.dll xfskzn.dll zsdphg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

--
End of file - 7719 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-07-07 1562448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java™ Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-18 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-18 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-18 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{381FFDE8-2394-4f90-B10D-FC6124A40F8C} - BitDefender Toolbar - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll [2008-03-04 86016]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NVMixerTray"=C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe [2004-12-20 131072]
"BitDefender Antiphishing Helper"=C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe [2007-10-09 61440]
"BDAgent"=C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe [2008-12-03 368640]
"Kernel and Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2008-02-29 76304]
"SmartGuardian"=C:\Program Files\ITE\Smart Guardian\ITESmart.exe [2003-09-30 180224]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-12-05 8523776]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-12-05 81920]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-11-04 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"Steam"=c:\program files\steam\steam.exe [2008-12-04 1410296]
"MsnMsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
"BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2008-12-22 342848]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-07-07 2156368]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe
Perstray.lnk - C:\Program Files\PerSono\perstray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="mss.dll wcjaef.dll ziwodd.dll alpphx.dll jwlmdt.dll flpwot.dll qgkaiz.dll cdqtwb.dll wvmgpu.dll duvzxv.dll xfskzn.dll zsdphg.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [2008-05-02 72208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2008-09-05 241704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=
scecli
scecli
scecli

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoSetActiveDesktop"=
"NoActiveDesktopChanges"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe"="C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe"="C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

======List of files/folders created in the last 3 months======

2009-02-03 00:31:44 ----D---- C:\rsit
2009-02-02 23:07:44 ----D---- C:\Documents and Settings\J. Hiz\Application Data\Malwarebytes
2009-02-02 23:07:38 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-02-02 23:07:37 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-02-02 22:39:25 ----A---- C:\WINDOWS\system32\zsdphg.dll
2009-02-02 21:39:09 ----A---- C:\WINDOWS\system32\vdqvsu.dll
2009-02-02 20:38:24 ----A---- C:\WINDOWS\system32\dxgppn.dll
2009-02-02 19:38:09 ----A---- C:\WINDOWS\system32\xfskzn.dll
2009-02-01 11:59:25 ----A---- C:\WINDOWS\system32\duvzxv.dll
2009-02-01 10:58:40 ----A---- C:\WINDOWS\system32\wvmgpu.dll
2009-02-01 09:57:51 ----A---- C:\WINDOWS\system32\zvmugg.dll
2009-02-01 08:57:36 ----A---- C:\WINDOWS\system32\nfefbt.dll
2009-02-01 07:56:51 ----A---- C:\WINDOWS\system32\tfqpjs.dll
2009-02-01 06:56:03 ----A---- C:\WINDOWS\system32\iwddoz.dll
2009-02-01 05:55:18 ----A---- C:\WINDOWS\system32\grhalt.dll
2009-02-01 04:54:31 ----A---- C:\WINDOWS\system32\jckpht.dll
2009-02-01 03:53:44 ----A---- C:\WINDOWS\system32\jhwite.dll
2009-02-01 02:52:59 ----A---- C:\WINDOWS\system32\eadars.dll
2009-02-01 01:52:41 ----N---- C:\WINDOWS\system32\lnwflz.dll
2009-01-31 13:43:57 ----N---- C:\WINDOWS\system32\cdqtwb.dll
2009-01-31 12:43:11 ----N---- C:\WINDOWS\system32\qgkaiz.dll
2009-01-31 11:07:01 ----N---- C:\WINDOWS\system32\flpwot.dll
2009-01-25 13:31:59 ----D---- C:\Program Files\Trend Micro
2009-01-24 12:40:22 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-01-24 12:40:22 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-14 03:01:20 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2008-12-26 03:00:36 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2008-12-26 03:00:27 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2008-12-25 09:23:23 ----D---- C:\WINDOWS\Prefetch
2008-12-25 09:21:23 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-12-25 09:21:16 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2008-12-25 09:21:08 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-12-25 09:21:00 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2008-12-25 09:20:53 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-12-25 09:20:46 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2008-12-25 09:20:37 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2008-12-25 09:20:30 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2008-12-25 09:20:22 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-12-25 09:20:14 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-12-25 09:20:07 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-12-25 09:20:00 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2008-12-25 09:19:53 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2008-12-25 09:19:45 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-12-25 09:19:38 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
2008-12-25 09:19:30 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2008-12-25 09:19:24 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-12-25 09:19:17 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2008-12-25 09:19:08 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2008-12-25 09:19:02 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-12-25 09:15:19 ----D---- C:\WINDOWS\ServicePackFiles
2008-12-25 09:11:16 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2008-12-21 10:38:17 ----A---- C:\WINDOWS\system32\xpsp2res.dll
2008-12-21 10:38:16 ----A---- C:\WINDOWS\system32\qmgr.dll
2008-12-21 10:37:59 ----N---- C:\WINDOWS\system32\services.exe
2008-12-21 10:37:59 ----N---- C:\WINDOWS\system32\advapi32.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\wkssvc.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\win32spl.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\userinit.exe
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\untfs.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\ulib.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\tcpmonui.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\syssetup.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\srvsvc.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\smss.exe
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\setupapi.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\sessmgr.exe
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\schannel.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\scardsvr.exe
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\savedump.exe
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\samsrv.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\samlib.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\rshx32.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\rastapi.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\rasman.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\rasdlg.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\rasauto.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\rasapi32.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\printui.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\perfctrs.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\olecnv32.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\oleaut32.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\nwprovau.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\ntvdm.exe
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\ntprint.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\ntlsapi.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\ntdll.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\nslookup.exe
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\msv1_0.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\msgsvc.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\mgmtapi.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\lsasrv.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\locator.exe
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\localspl.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\lmhsvc.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\kernel32.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\init32.exe
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\imagehlp.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\ftp.exe
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\format.com
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\dhcpcsvc.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\csrsrv.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\comdlg32.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\comctl32.dll
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\cmd.exe
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\cacls.exe
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\autoconv.exe
2008-12-21 10:37:59 ----A---- C:\WINDOWS\system32\autochk.exe
2008-12-21 10:37:56 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2008-12-21 10:37:56 ----A---- C:\WINDOWS\system32\ntkrnlpa.exe
2008-12-21 10:37:56 ----A---- C:\WINDOWS\system32\HAL.DLL
2008-12-18 17:38:02 ----A---- C:\WINDOWS\system32\deploytk.dll
2008-12-18 17:34:16 ----D---- C:\Program Files\iPod
2008-12-18 17:34:14 ----D---- C:\Program Files\iTunes
2008-12-18 17:34:14 ----D---- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-18 17:31:35 ----D---- C:\Program Files\Bonjour
2008-12-18 17:30:12 ----D---- C:\Program Files\QuickTime
2008-12-13 16:20:43 ----D---- C:\WINDOWS\system32\appmgmt
2008-12-13 13:46:45 ----D---- C:\WINDOWS\system32\scripting
2008-12-13 13:46:44 ----D---- C:\WINDOWS\system32\en
2008-12-13 13:46:44 ----D---- C:\WINDOWS\system32\bits
2008-12-13 13:46:44 ----D---- C:\WINDOWS\l2schemas
2008-12-13 13:42:13 ----N---- C:\WINDOWS\system32\_004786_.tmp.dll
2008-12-13 13:42:12 ----N---- C:\WINDOWS\system32\_004787_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004784_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004779_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004778_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004777_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004776_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004775_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004772_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004771_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004770_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004767_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004764_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004762_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004761_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004757_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004756_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004753_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004749_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004747_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004746_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004744_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004738_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004731_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004729_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004726_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004723_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004707_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004700_.tmp.dll
2008-12-13 13:41:55 ----N---- C:\WINDOWS\system32\_004699_.tmp.dll
2008-12-13 12:32:54 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2008-12-13 12:32:49 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2008-12-13 12:29:56 ----HDC---- C:\WINDOWS\$NtUninstallKB954600_0$
2008-12-13 12:29:47 ----HDC---- C:\WINDOWS\$NtUninstallKB956802_0$
2008-12-12 11:18:16 ----A---- C:\WINDOWS\system32\dns-sd.exe
2008-12-12 11:11:46 ----A---- C:\WINDOWS\system32\dnssd.dll
2008-12-04 03:04:10 ----HDC---- C:\WINDOWS\$NtUninstallKB956803_0$
2008-12-04 03:04:04 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$
2008-12-04 03:03:57 ----HDC---- C:\WINDOWS\$NtUninstallKB957095_0$
2008-12-04 03:02:51 ----HDC---- C:\WINDOWS\$NtUninstallKB954211_0$
2008-12-04 03:01:56 ----HDC---- C:\WINDOWS\$NtUninstallKB956841_0$
2008-12-04 03:01:33 ----HDC---- C:\WINDOWS\$NtUninstallKB957097_0$
2008-12-04 03:01:02 ----HDC---- C:\WINDOWS\$NtUninstallKB938464_0$
2008-12-04 03:00:55 ----HDC---- C:\WINDOWS\$NtUninstallKB958644_0$
2008-12-04 03:00:48 ----HDC---- C:\WINDOWS\$NtUninstallKB955069_0$
2008-12-04 03:00:30 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2008-12-03 20:27:27 ----D---- C:\Documents and Settings\J. Hiz\Application Data\Mozilla
2008-12-03 20:26:08 ----D---- C:\Program Files\Common Files\Remote Control Software Common
2008-12-03 20:25:52 ----D---- C:\Program Files\Common Files\Remote Control USB Driver
2008-11-30 12:35:57 ----D---- C:\WINDOWS\system32\NtmsData
2008-11-30 12:23:03 ----D---- C:\Program Files\ComcastUI

======List of files/folders modified in the last 3 months======

2009-02-03 00:29:41 ----D---- C:\WINDOWS\Temp
2009-02-03 00:29:41 ----D---- C:\WINDOWS\system32
2009-02-03 00:24:48 ----D---- C:\Program Files\Steam
2009-02-03 00:24:47 ----D---- C:\Program Files\DNA
2009-02-03 00:24:47 ----D---- C:\Documents and Settings\J. Hiz\Application Data\DNA
2009-02-03 00:24:22 ----RD---- C:\Program Files
2009-02-03 00:24:22 ----D---- C:\WINDOWS\system32\drivers
2009-02-03 00:23:35 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-02-03 00:23:11 ----A---- C:\WINDOWS\bdagent.INI
2009-02-02 20:02:02 ----D---- C:\WINDOWS\system32\CatRoot2
2009-02-01 02:16:49 ----D---- C:\WINDOWS
2009-01-25 13:25:10 ----SH---- C:\boot.ini
2009-01-25 13:25:10 ----N---- C:\WINDOWS\win.ini
2009-01-25 13:25:10 ----N---- C:\WINDOWS\system.ini
2009-01-24 15:16:07 ----D---- C:\Documents and Settings\J. Hiz\Application Data\U3
2009-01-24 13:53:18 ----A---- C:\WINDOWS\ntbtlog.txt
2009-01-22 20:56:26 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-01-22 20:05:10 ----D---- C:\Documents and Settings\J. Hiz\Application Data\BitTorrent
2009-01-17 17:45:35 ----HD---- C:\WINDOWS\inf
2009-01-14 03:01:40 ----SHD---- C:\WINDOWS\Installer
2009-01-14 03:01:05 ----HD---- C:\WINDOWS\$hf_mig$
2009-01-09 17:35:28 ----A---- C:\WINDOWS\system32\MRT.exe
2008-12-26 03:00:42 ----A---- C:\WINDOWS\imsins.BAK
2008-12-25 10:43:28 ----D---- C:\Program Files\Common Files\Adobe
2008-12-25 10:43:25 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2008-12-25 10:43:20 ----D---- C:\Program Files\Adobe
2008-12-25 09:24:59 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-12-25 09:23:44 ----A---- C:\WINDOWS\OEWABLog.txt
2008-12-25 09:23:26 ----A---- C:\WINDOWS\setuplog.txt
2008-12-25 09:23:04 ----D---- C:\WINDOWS\system32\wbem
2008-12-25 09:23:04 ----D---- C:\WINDOWS\system32\Setup
2008-12-25 09:23:04 ----D---- C:\WINDOWS\AppPatch
2008-12-25 09:23:03 ----RSD---- C:\WINDOWS\Fonts
2008-12-25 09:21:53 ----D---- C:\WINDOWS\system32\CatRoot
2008-12-25 09:19:10 ----D---- C:\Program Files\Messenger
2008-12-25 09:18:53 ----D---- C:\WINDOWS\security
2008-12-25 09:16:51 ----D---- C:\WINDOWS\WinSxS
2008-12-25 09:16:42 ----D---- C:\WINDOWS\system32\inetsrv
2008-12-25 09:16:42 ----D---- C:\WINDOWS\network diagnostic
2008-12-25 09:16:42 ----D---- C:\WINDOWS\ime
2008-12-25 09:16:42 ----D---- C:\WINDOWS\Help
2008-12-25 09:16:35 ----D---- C:\WINDOWS\system32\usmt
2008-12-25 09:16:35 ----D---- C:\WINDOWS\system32\en-US
2008-12-25 09:16:34 ----D---- C:\WINDOWS\PeerNet
2008-12-25 09:16:34 ----D---- C:\Program Files\Movie Maker
2008-12-25 09:15:12 ----D---- C:\WINDOWS\system32\Restore
2008-12-25 09:15:12 ----D---- C:\WINDOWS\system32\npp
2008-12-25 09:15:12 ----D---- C:\WINDOWS\mui
2008-12-25 09:15:11 ----D---- C:\WINDOWS\msagent
2008-12-25 09:15:10 ----D---- C:\WINDOWS\srchasst
2008-12-25 09:15:09 ----D---- C:\Program Files\NetMeeting
2008-12-25 09:15:08 ----D---- C:\WINDOWS\system32\Com
2008-12-25 09:15:07 ----D---- C:\Program Files\Windows Media Player
2008-12-25 09:15:06 ----D---- C:\Program Files\Windows NT
2008-12-25 09:15:06 ----D---- C:\Program Files\Outlook Express
2008-12-25 09:15:04 ----D---- C:\Program Files\Common Files\System
2008-12-25 09:14:52 ----D---- C:\WINDOWS\system32\oobe
2008-12-25 09:14:51 ----D---- C:\WINDOWS\system
2008-12-25 09:12:43 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-12-25 09:10:06 ----D---- C:\WINDOWS\ehome
2008-12-24 09:27:28 ----D---- C:\Program Files\mIRC
2008-12-21 10:47:18 ----SD---- C:\WINDOWS\Tasks
2008-12-18 17:37:52 ----A---- C:\WINDOWS\system32\javaws.exe
2008-12-18 17:37:52 ----A---- C:\WINDOWS\system32\javaw.exe
2008-12-18 17:37:52 ----A---- C:\WINDOWS\system32\java.exe
2008-12-18 17:37:50 ----D---- C:\Program Files\Java
2008-12-18 17:34:31 ----DC---- C:\WINDOWS\system32\DRVSTORE
2008-12-18 17:34:16 ----D---- C:\Program Files\Common Files\Apple
2008-12-17 17:02:00 ----D---- C:\WINDOWS\ie7updates
2008-12-13 16:20:43 ----D---- C:\Program Files\Common Files
2008-12-13 12:32:13 ----D---- C:\Program Files\Internet Explorer
2008-12-12 22:40:02 ----A---- C:\WINDOWS\system32\mshtml.dll
2008-12-03 20:26:00 ----D---- C:\Program Files\Logitech
2008-12-03 20:25:58 ----HD---- C:\Program Files\InstallShield Installation Information

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 bdftdif;bdftdif; \??\C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys []
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-23 12032]
R2 irda;IrDA Protocol; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192]
R2 uacFlt;Plantronics USB Audio Adapter EQ Filter Driver; C:\WINDOWS\system32\DRIVERS\uacflt.sys [2002-05-03 21276]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service; C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2008-07-02 86792]
R3 bdfsfltr;bdfsfltr; C:\WINDOWS\system32\drivers\bdfsfltr.sys [2008-01-07 196368]
R3 BDSelfPr;BDSelfPr; \??\C:\Program Files\BitDefender\BitDefender 2008\bdselfpr.sys []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 irsir;Microsoft Serial Infrared Driver; C:\WINDOWS\system32\DRIVERS\irsir.sys [2001-08-17 18688]
R3 iteio;iteio; \??\C:\WINDOWS\system32\drivers\iteio.sys []
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2008-02-29 35344]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2008-02-29 36880]
R3 LUsbFilt;Logitech SetPoint KMDF USB Filter; C:\WINDOWS\System32\Drivers\LUsbFilt.Sys [2008-02-29 28944]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2008-02-09 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-12-05 7435392]
R3 nvax;Service for NVIDIA® nForce™ Audio Enumerator; C:\WINDOWS\system32\drivers\nvax.sys [2005-07-26 53376]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-04-14 34176]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-04-14 13056]
R3 nvnforce;Service for NVIDIA® nForce™ Audio; C:\WINDOWS\system32\drivers\nvapu.sys [2005-07-26 415360]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 ALSysIO;ALSysIO; \??\C:\DOCUME~1\J92C0~1.HIZ\LOCALS~1\Temp\ALSysIO.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2008-02-29 20240]
S3 Profos;Profos; \??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\profos.sys []
S3 Trufos;Trufos; \??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\trufos.sys []
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-11-07 32000]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 Irmon;Infrared Monitor; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-12-18 152984]
R2 LIVESRV;BitDefender Desktop Update Service; C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe [2008-12-03 1179648]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-12-05 155716]
R2 VSSERV;BitDefender Virus Shield; C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe [2008-12-03 1261568]
R2 XCOMM;BitDefender Communicator; C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe [2007-11-27 86016]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872]
R3 scan;BitDefender Threat Scanner; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe [2008-05-02 121360]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]

-----------------EOF-----------------

#5 -JHiZ-

-JHiZ-
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:11:44 PM

Posted 03 February 2009 - 03:34 AM

info.txt logfile of random's system information tool 1.05 2009-02-03 00:31:48

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
3DMark03-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FF35F637-72B9-43BE-A281-06EB2854393A}\Setup.exe" -l0x9
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.3-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81300000003}
Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"
BitDefender Total Security 2008-->MsiExec.exe /I{C33A19F0-A3D8-45B4-B067-251D2DBABB1A}
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
CDDRV_Installer-->MsiExec.exe /I{0C826C5B-B131-423A-A229-C71B3CACCD6A}
Counter-Strike: Source-->"C:\Program Files\Steam\steam.exe" steam://uninstall/240
Counter-Strike-->"C:\Program Files\Steam\steam.exe" steam://uninstall/10
DH Driver Cleaner Professional Edition-->C:\Program Files\Driver Cleaner Pro\Uninstall.exe
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
iTunes-->MsiExec.exe /I{318AB667-3230-41B5-A617-CB3BF748D371}
Java™ 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java™ 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java™ 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
KhalInstallWrapper-->MsiExec.exe /I{3101CB58-3482-4D21-AF1A-7057FC935355}
Logitech Harmony Remote Software 7-->C:\Program Files\InstallShield Installation Information\{5C6F884D-680C-448B-B4C9-22296EE1B206}\setup.exe -runfromtemp -l0x0009 -removeonly
Logitech SetPoint-->C:\Program Files\InstallShield Installation Information\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}\setup.exe -runfromtemp -l0x0009 -removeonly
MadOnion.com/3DMark2001 SE-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{91B323B5-A79C-4D23-BD6D-046C565F9BCF}\Setup.exe" -l0x9 uninstall -uninst
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
mIRC-->C:\Program Files\mIRC\uninstall.exe _?=C:\Program Files\mIRC
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
NvMixer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D7A6C517-11F2-419F-B5BB-27772B939698}\Setup.exe" -uninstall
PerSono-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D63F2860-678D-11D4-B355-0010A4F75374}\setup.exe"
Quicken 2006-->MsiExec.exe /X{2818095F-FB6C-42C8-827E-0A406CC9AFF5}
QuickTime-->MsiExec.exe /I{F958CA02-BB40-4007-894B-258729456EE4}
Remote Control USB Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8471021C-F529-43DE-84DF-3612E10F58C4}\setup.exe" -l0x9 -removeonly
Replay Media Catcher-->C:\PROGRA~1\REPLAY~1\UNWISE.EXE C:\PROGRA~1\REPLAY~1\INSTALL.LOG
Security Update for Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Smart Guardian-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\ITE\Smart Guardian\Uninst.isu"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Ventrilo Client-->MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Videora iPod Converter 3.07-->C:\Program Files\Red Kawa\Video Converter 3\uninstaller.exe
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Live installer-->MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Messenger-->MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Live Sign-in Assistant-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
WinSCP 4.1.6-->"C:\Program Files\WinSCP\unins000.exe"
XviD Video Codec 1.1.2-01022007-->C:\Program Files\XviD\uninst.exe

======Security center information======

AV: Bitdefender Antivirus
FW: Bitdefender Firewall

System event log

Computer Name: JHIZ
Event Code: 7035
Message: The Profos service was successfully sent a start control.

Record Number: 7896
Source Name: Service Control Manager
Time Written: 20080831030001.000000-420
Event Type: information
User: JHIZ\J. Hiz

Computer Name: JHIZ
Event Code: 7001
Message: The Universal Plug and Play Device Host service depends on the SSDP Discovery Service service which failed to start because of the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.


Record Number: 7895
Source Name: Service Control Manager
Time Written: 20080830183553.000000-420
Event Type: error
User:

Computer Name: JHIZ
Event Code: 10005
Message: DCOM got error "%1068" attempting to start the service upnphost with arguments ""
in order to run the server:
{204810B9-73B2-11D4-BF42-00B0D0118B56}

Record Number: 7894
Source Name: DCOM
Time Written: 20080830183553.000000-420
Event Type: error
User: JHIZ\J. Hiz

Computer Name: JHIZ
Event Code: 7001
Message: The Universal Plug and Play Device Host service depends on the SSDP Discovery Service service which failed to start because of the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.


Record Number: 7893
Source Name: Service Control Manager
Time Written: 20080830183247.000000-420
Event Type: error
User:

Computer Name: JHIZ
Event Code: 10005
Message: DCOM got error "%1068" attempting to start the service upnphost with arguments ""
in order to run the server:
{204810B9-73B2-11D4-BF42-00B0D0118B56}

Record Number: 7892
Source Name: DCOM
Time Written: 20080830183246.000000-420
Event Type: error
User: JHIZ\J. Hiz

Application event log

Computer Name: JHIZ
Event Code: 101
Message: MsnMsgr (632) The database engine stopped.

Record Number: 4332
Source Name: ESENT
Time Written: 20080820105711.000000-420
Event Type: information
User:

Computer Name: JHIZ
Event Code: 103
Message: MsnMsgr (632) \\.\C:\Documents and Settings\J. Hiz\Local Settings\Application Data\Microsoft\Messenger\j.gardenhire@hotmail.com\SharingMetadata\Working\database_36F0_FAD6_F0FA_9AF7\dfsr.db: The database engine stopped the instance (0).

Record Number: 4331
Source Name: ESENT
Time Written: 20080820105711.000000-420
Event Type: information
User:

Computer Name: JHIZ
Event Code: 302
Message: MsnMsgr (632) \\.\C:\Documents and Settings\J. Hiz\Local Settings\Application Data\Microsoft\Messenger\j.gardenhire@hotmail.com\SharingMetadata\Working\database_36F0_FAD6_F0FA_9AF7\dfsr.db: The database engine has successfully completed recovery steps.

Record Number: 4330
Source Name: ESENT
Time Written: 20080820105539.000000-420
Event Type: information
User:

Computer Name: JHIZ
Event Code: 301
Message: MsnMsgr (632) \\.\C:\Documents and Settings\J. Hiz\Local Settings\Application Data\Microsoft\Messenger\j.gardenhire@hotmail.com\SharingMetadata\Working\database_36F0_FAD6_F0FA_9AF7\dfsr.db: The database engine has begun replaying logfile \\.\C:\Documents and Settings\J. Hiz\Local Settings\Application Data\Microsoft\Messenger\j.gardenhire@hotmail.com\SharingMetadata\Working\database_36F0_FAD6_F0FA_9AF7\fsr.log.

Record Number: 4329
Source Name: ESENT
Time Written: 20080820105538.000000-420
Event Type: information
User:

Computer Name: JHIZ
Event Code: 301
Message: MsnMsgr (632) \\.\C:\Documents and Settings\J. Hiz\Local Settings\Application Data\Microsoft\Messenger\j.gardenhire@hotmail.com\SharingMetadata\Working\database_36F0_FAD6_F0FA_9AF7\dfsr.db: The database engine has begun replaying logfile \\.\C:\Documents and Settings\J. Hiz\Local Settings\Application Data\Microsoft\Messenger\j.gardenhire@hotmail.com\SharingMetadata\Working\database_36F0_FAD6_F0FA_9AF7\fsr00726.log.

Record Number: 4328
Source Name: ESENT
Time Written: 20080820105538.000000-420
Event Type: information
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 39 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=2701
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip

-----------------EOF-----------------

#6 -JHiZ-

-JHiZ-
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:11:44 PM

Posted 03 February 2009 - 03:39 AM

last but not least... see attached. Thanks so much in advance!

Attached Files



#7 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:12:44 PM

Posted 03 February 2009 - 04:22 AM

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix.. Please visit HERE if you don't know how.. Please re-enable them back after performing all steps given..

Please download ComboFix by sUBs from HERE or HERE or HERE and save it to your Desktop.

During the download, rename Combofix to Combo-Fix as follows:

Posted Image

Posted Image


It is important you rename Combofix during the download, but not after.

**NOTE: If you are using Firefox, make sure that your download settings are as follows:
  • Tools->Options->Main tab
  • Set to "Always ask me where to Save the files".

After that, double-click and run Combo-Fix. Let it finish its job and post the log here

If ComboFix asked you to install Recovery Console, please do so.. It will be your best interest..

Note: DON'T do anything with your computer while ComboFix is running.. Let ComboFix finishes its job..

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#8 -JHiZ-

-JHiZ-
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:11:44 PM

Posted 03 February 2009 - 09:59 PM

ComboFix 09-02-02.04 - J. Hiz 2009-02-03 18:51:36.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1689 [GMT -8:00]
Running from: c:\documents and settings\J. Hiz\Desktop\Combo-Fix.exe
AV: Bitdefender Antivirus *On-access scanning disabled* (Updated)
FW: Bitdefender Firewall *disabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\_004690_.tmp.dll
c:\windows\system32\_004691_.tmp.dll
c:\windows\system32\_004693_.tmp.dll
c:\windows\system32\_004699_.tmp.dll
c:\windows\system32\_004700_.tmp.dll
c:\windows\system32\_004701_.tmp.dll
c:\windows\system32\_004702_.tmp.dll
c:\windows\system32\_004703_.tmp.dll
c:\windows\system32\_004705_.tmp.dll
c:\windows\system32\_004706_.tmp.dll
c:\windows\system32\_004707_.tmp.dll
c:\windows\system32\_004709_.tmp.dll
c:\windows\system32\_004710_.tmp.dll
c:\windows\system32\_004712_.tmp.dll
c:\windows\system32\_004713_.tmp.dll
c:\windows\system32\_004714_.tmp.dll
c:\windows\system32\_004716_.tmp.dll
c:\windows\system32\_004719_.tmp.dll
c:\windows\system32\_004720_.tmp.dll
c:\windows\system32\_004723_.tmp.dll
c:\windows\system32\_004724_.tmp.dll
c:\windows\system32\_004725_.tmp.dll
c:\windows\system32\_004726_.tmp.dll
c:\windows\system32\_004727_.tmp.dll
c:\windows\system32\_004729_.tmp.dll
c:\windows\system32\_004730_.tmp.dll
c:\windows\system32\_004731_.tmp.dll
c:\windows\system32\_004733_.tmp.dll
c:\windows\system32\_004734_.tmp.dll
c:\windows\system32\_004735_.tmp.dll
c:\windows\system32\_004736_.tmp.dll
c:\windows\system32\_004738_.tmp.dll
c:\windows\system32\_004739_.tmp.dll
c:\windows\system32\_004740_.tmp.dll
c:\windows\system32\_004741_.tmp.dll
c:\windows\system32\_004742_.tmp.dll
c:\windows\system32\_004743_.tmp.dll
c:\windows\system32\_004744_.tmp.dll
c:\windows\system32\_004746_.tmp.dll
c:\windows\system32\_004747_.tmp.dll
c:\windows\system32\_004748_.tmp.dll
c:\windows\system32\_004749_.tmp.dll
c:\windows\system32\_004750_.tmp.dll
c:\windows\system32\_004751_.tmp.dll
c:\windows\system32\_004753_.tmp.dll
c:\windows\system32\_004756_.tmp.dll
c:\windows\system32\_004757_.tmp.dll
c:\windows\system32\_004761_.tmp.dll
c:\windows\system32\_004762_.tmp.dll
c:\windows\system32\_004764_.tmp.dll
c:\windows\system32\_004767_.tmp.dll
c:\windows\system32\_004770_.tmp.dll
c:\windows\system32\_004771_.tmp.dll
c:\windows\system32\_004772_.tmp.dll
c:\windows\system32\_004775_.tmp.dll
c:\windows\system32\_004776_.tmp.dll
c:\windows\system32\_004777_.tmp.dll
c:\windows\system32\_004778_.tmp.dll
c:\windows\system32\_004779_.tmp.dll
c:\windows\system32\_004784_.tmp.dll
c:\windows\system32\_004786_.tmp.dll
c:\windows\system32\_004787_.tmp.dll
c:\windows\system32\cdqtwb.dll
c:\windows\system32\drivers\seneka.sys
c:\windows\system32\drivers\senekabomyxwgk.sys
c:\windows\system32\duvzxv.dll
c:\windows\system32\dxgppn.dll
c:\windows\system32\eadars.dll
c:\windows\system32\flpwot.dll
c:\windows\system32\grhalt.dll
c:\windows\system32\iwddoz.dll
c:\windows\system32\jckpht.dll
c:\windows\system32\jhwite.dll
c:\windows\system32\lnwflz.dll
c:\windows\system32\nfefbt.dll
c:\windows\system32\qgkaiz.dll
c:\windows\system32\senekacpaxboyn.dat
c:\windows\system32\senekahylksewq.dll
c:\windows\system32\senekatmovnrvk.dll
c:\windows\system32\senekayxwqrjld.dat
c:\windows\system32\test.ttt
c:\windows\system32\tfqpjs.dll
c:\windows\system32\vdqvsu.dll
c:\windows\system32\win32hlp.cnf
c:\windows\system32\wvmgpu.dll
c:\windows\system32\xfskzn.dll
c:\windows\system32\zsdphg.dll
c:\windows\system32\zvmugg.dll

----- BITS: Possible infected sites -----

hxxp://updateserver.info
Infected copy of c:\windows\system32\userinit.exe was found and disinfected
Restored copy from - c:\windows\$NtServicePackUninstall$\userinit.exe


.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_SENEKA


((((((((((((((((((((((((( Files Created from 2009-01-04 to 2009-02-04 )))))))))))))))))))))))))))))))
.

2009-02-03 00:35 . 2009-02-03 00:35 250 --a------ c:\windows\gmer.ini
2009-02-03 00:31 . 2009-02-03 00:31 <DIR> d-------- C:\rsit
2009-02-02 23:07 . 2009-02-02 23:07 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-02 23:07 . 2009-02-02 23:07 <DIR> d-------- c:\documents and settings\J. Hiz\Application Data\Malwarebytes
2009-02-02 23:07 . 2009-02-02 23:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-02 23:07 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-02 23:07 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-25 13:31 . 2009-01-25 13:31 <DIR> d-------- c:\program files\Trend Micro
2009-01-24 12:40 . 2009-01-24 12:40 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-01-24 12:40 . 2009-01-24 13:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-04 02:55 --------- d-----w c:\program files\Steam
2009-02-04 02:55 --------- d-----w c:\program files\DNA
2009-02-04 02:55 --------- d-----w c:\documents and settings\J. Hiz\Application Data\DNA
2009-01-24 23:16 --------- d-----w c:\documents and settings\J. Hiz\Application Data\U3
2009-01-23 04:05 --------- d-----w c:\documents and settings\J. Hiz\Application Data\BitTorrent
2008-12-25 18:43 --------- d-----w c:\program files\Common Files\Adobe
2008-12-24 17:27 --------- d-----w c:\program files\mIRC
2008-12-19 01:37 --------- d-----w c:\program files\Java
2008-12-19 01:34 --------- d-----w c:\program files\iTunes
2008-12-19 01:34 --------- d-----w c:\program files\iPod
2008-12-19 01:34 --------- d-----w c:\program files\Common Files\Apple
2008-12-19 01:34 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-19 01:31 --------- d-----w c:\program files\Bonjour
2008-12-19 01:30 --------- d-----w c:\program files\QuickTime
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-04 04:26 --------- d-----w c:\program files\Logitech
2008-12-04 04:26 --------- d-----w c:\program files\Common Files\Remote Control Software Common
2008-12-04 04:25 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-04 04:25 --------- d-----w c:\program files\Common Files\Remote Control USB Driver
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"Steam"="c:\program files\steam\steam.exe" [2008-12-04 1410296]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-12-22 342848]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 131072]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 61440]
"BDAgent"="c:\program files\BitDefender\BitDefender 2008\bdagent.exe" [2008-12-03 368640]
"SmartGuardian"="c:\program files\ITE\Smart Guardian\ITESmart.exe" [2003-09-30 180224]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\windows\KHALMNPR.Exe]
"nwiz"="nwiz.exe" [2007-12-05 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-07-28 805392]
Perstray.lnk - c:\program files\PerSono\perstray.exe [2008-01-20 32768]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 01:42 72208 c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R2 uacFlt;Plantronics USB Audio Adapter EQ Filter Driver;c:\windows\system32\drivers\uacflt.sys [2008-01-20 21276]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [2007-11-12 86792]
R3 iteio;iteio;c:\windows\system32\drivers\ITEIO.SYS [2008-01-19 3680]
S3 ALSysIO;ALSysIO;\??\c:\docume~1\J92C0~1.HIZ\LOCALS~1\Temp\ALSysIO.sys --> c:\docume~1\J92C0~1.HIZ\LOCALS~1\Temp\ALSysIO.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
Contents of the 'Scheduled Tasks' folder

2009-01-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.igoogle.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-03 18:55:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1048)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
c:\program files\BitDefender\BitDefender 2008\vsserv.exe
c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Windows Live\Messenger\usnsvc.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-02-03 18:58:11 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-04 02:57:41

Pre-Run: 19,558,993,920 bytes free
Post-Run: 19,708,313,600 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(1)partition(1)\WINDOWS
[operating systems]
d:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

251 --- E O F --- 2009-01-14 11:01:40

#9 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:12:44 PM

Posted 03 February 2009 - 10:41 PM

Please show hidden files and folders

Find and delete this folder manually.. c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}



Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan.
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the ActiveX control to install
  • Click Start
  • Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  • Click Scan
    Wait for the scan to finish
  • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic

How's the computer now? :thumbup2:

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#10 -JHiZ-

-JHiZ-
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:11:44 PM

Posted 03 February 2009 - 11:17 PM

Windows keeps blocking the install because it cant verify the publisher... any ideas how to get past this?

#11 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:12:44 PM

Posted 04 February 2009 - 12:18 AM

You aren't the first one.. I got a few person who experiences the same thing.. Not sure why.. Lets do an alternative...

Lets run F-Secure online scan for Viruses, Spyware and RootKits:
  • Scroll to the bottom of the page and click the Start scanning button. A window will pop up.
  • Allow the Active X control to be installed on your computer, then click the Accept button
  • Click Full System Scan and allow the components to download and the scan to complete.
  • If malware is found, check Submit samples to F-Secure then select Automatic cleaning
  • When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
  • Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post
If Automatic cleaning with Submit samples hangs, click Cancel, then New Scan
  • When the cleaning option is presented, Uncheck Submit samples to F-Secure
  • Click Automatic cleaning
  • When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
  • Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post
Notes:
  • This scan will only work with Internet Explorer
  • You must have administrator rights to run this scan
  • This scan can take several hours, so please be patient

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#12 -JHiZ-

-JHiZ-
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:11:44 PM

Posted 04 February 2009 - 10:17 AM

Scanning Report
Tuesday, February 03, 2009 22:08:45 - 07:16:26
Computer name: JHIZ
Scanning type: Scan system for malware, rootkits
Target: C:\ D:\ E:\


--------------------------------------------------------------------------------

Result: 11 malware found
Client-IRC.Win32.mIRC (spyware)
System
TrackingCookie.2o7 (spyware)
System
TrackingCookie.Adbrite (spyware)
System
TrackingCookie.Advertising (spyware)
System
TrackingCookie.Atdmt (spyware)
System
TrackingCookie.Atwola (spyware)
System
TrackingCookie.Doubleclick (spyware)
System
TrackingCookie.Mediaplex (spyware)
System
TrackingCookie.Questionmarket (spyware)
System
TrackingCookie.Revsci (spyware)
System
TrackingCookie.Yieldmanager (spyware)
System

--------------------------------------------------------------------------------

Statistics
Scanned:
Files: 24031
System: 5421
Not scanned: 6
Actions:
Disinfected: 0
Renamed: 0
Deleted: 0
None: 11
Submitted: 0
Files not scanned:
C:\WINDOWS\TEMP\TMP00001389\TMP00000000
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
C:\WINDOWS\SYSTEM32\CONFIG\SAM
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM

--------------------------------------------------------------------------------

Options
Scanning engines:
F-Secure USS: 3.0.0
F-Secure Hydra: 3.6.8511, 2009-02-04
F-Secure AVP: 7.0.171, 2009-02-04
F-Secure Pegasus: 1.20.0, 1969-11-31
F-Secure Blacklight: 0.0.0
Scanning options:
Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX ANI AVB BAT CMD JOB LSP MAP MHT MIF PHP POT SWF WMF NWS TAR
Use Advanced heuristics

#13 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:12:44 PM

Posted 04 February 2009 - 10:29 PM

Looks good to me.. Lets do some cleanup...


Please download OTCleanIt and save it to Desktop.
  • Make sure you have internet connection..
  • Double-click OTCleanIt.exe
  • Click the CleanUp! button.
  • Select Yes when the "Begin cleanup Process?" prompt appears.
  • If you are prompted to Reboot during the cleanup, select Yes



Please read these excellent articles by miekiemoes :
Help! My computer is slow!
How to prevent Malware

Please reply to this thread once more and tell us about the computer behaviour before we can close this thread :thumbup2:



Have a safe and happy computing day!


Regards
fenzodahl512

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#14 -JHiZ-

-JHiZ-
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:11:44 PM

Posted 05 February 2009 - 10:15 AM

thanks so much! things seem to be working great! one question... Bitdefender is still finding infected files. is this normal? Also, what do I do with all the quarentine files that Bitdefender is holding from previous scans?

#15 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:12:44 PM

Posted 05 February 2009 - 10:20 AM

Bitdefender is still finding infected files. is this normal? Also, what do I do with all the quarentine files that Bitdefender is holding from previous scans?


Tell me what Bit Defender find?.. Give me the fullpath of it or better, its log if available...

About the quarantine files, delete all of them..

waiting for your news :thumbup2:

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users