Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Virus kacsde, j3ewro,uret463


  • This topic is locked This topic is locked
13 replies to this topic

#1 rvreeland

rvreeland

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:05:30 PM

Posted 18 February 2009 - 11:35 PM

How do I remove these items and are there other viruses that I am missing.


DDS (Ver_09-02-01.01) - NTFSx86
Run by Administrator at 22:25:13.97 on Wed 02/18/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_05
Microsoft Windows XP Professional 5.1.2600.3.1252.298.1033.18.510.59 [GMT -6:00]

FW: ZoneAlarm Pro Firewall *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Internet\spyware\dds.scr

============== Pseudo HJT Report ===============

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [jvsoft] c:\windows\system32\j3ewro.exe
uRun: [anhtaaa] c:\windows\system32\kacsde.exe
uRun: [dorfgwe] c:\windows\system32\uret463.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_05\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 2.4\program\quickstart.exe
StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\pictur~1.lnk - c:\program files\sony\sony picture utility\pmbcore\SPUVolumeWatcher.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: link.com\myapps
DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - hxxps://kace.link.com/CitrixSessionInit/ICAWEB/icaweb.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1212304187984
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\ci8a7xe9.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
FF - plugin: c:\program files\mozilla firefox\plugins\npicaN.dll

============= SERVICES / DRIVERS ===============

R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2008-6-1 353680]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]

=============== Created Last 30 ================

2009-02-18 08:00 105,673 ---shr-- C:\om.cmd
2009-02-17 21:47 <DIR> --d----- c:\program files\Trend Micro
2009-02-17 21:03 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-02-17 21:03 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-02-17 20:54 106,915 ---shr-- C:\8oupido.bat
2009-02-17 20:53 129,536 ---shr-- c:\windows\system32\lhgjyit1.dll
2009-02-14 21:35 21,504 ac------ c:\windows\system32\dllcache\hidserv.dll
2009-02-14 21:35 21,504 a------- c:\windows\system32\hidserv.dll
2009-02-14 10:28 105,728 ---shr-- C:\dgf.exe
2009-02-14 10:28 105,673 ---shr-- c:\windows\system32\uret463.exe
2009-02-14 10:26 108,007 ---shr-- c:\windows\system32\kacsde.exe
2009-02-11 22:36 118 a------- c:\windows\system32\MRT.INI
2009-02-11 22:03 81,408 ---shr-- c:\windows\system32\godert1.dll
2009-02-10 19:58 104,456 ---shr-- C:\6o0.bat
2009-02-10 19:58 129,536 ---shr-- c:\windows\system32\lhgjyit0.dll
2009-02-10 19:56 113,564 ---shr-- C:\yfmqo.cmd
2009-02-10 19:56 62 ---shr-- C:\autorun.inf
2009-02-10 19:56 161,792 ---shr-- c:\windows\system32\jwedsfdo0.dll
2009-02-10 19:56 113,564 ---shr-- c:\windows\system32\j3ewro.exe
2009-01-25 16:59 <DIR> --d----- C:\Home_movies
2009-01-25 16:55 81,768 a------- c:\windows\system32\xinput1_3.dll
2009-01-25 16:55 261,480 a------- c:\windows\system32\xactengine2_7.dll
2009-01-25 16:55 1,123,696 a------- c:\windows\system32\D3DCompiler_33.dll
2009-01-25 16:55 443,752 a------- c:\windows\system32\d3dx10_33.dll
2009-01-25 16:52 2,560 a------- c:\windows\system32\drivers\cdralw2k.sys
2009-01-25 16:52 2,432 a------- c:\windows\system32\drivers\cdr4_xp.sys
2009-01-25 16:52 118,520 a------- c:\windows\system32\PxInsI64.exe
2009-01-25 16:52 115,960 a------- c:\windows\system32\PxCpyI64.exe
2009-01-25 00:17 5,376 ac------ c:\windows\system32\dllcache\mspclock.sys
2009-01-25 00:17 <DIR> --d----- c:\program files\Analog Devices

==================== Find3M ====================

2009-02-17 20:52 4,212 a---h--- c:\windows\system32\zllictbl.dat
2009-01-07 21:04 45,056 a------- c:\windows\system32\WNASPI32.DLL
2009-01-07 21:04 16,512 a------- c:\windows\system32\drivers\ASPI32.SYS
2008-12-20 17:15 826,368 a------- c:\windows\system32\wininet.dll
2008-12-18 13:38 719,872 a------- c:\windows\system32\devil.dll
2008-12-18 13:38 1,060,864 a------- c:\windows\system32\mfc71.dll
2008-12-18 13:38 351,744 a------- c:\windows\system32\avisynth.dll
2008-12-18 13:38 626,688 a------- c:\windows\system32\msvcr80.dll
2008-12-18 13:38 548,864 a------- c:\windows\system32\msvcp80.dll
2008-12-18 13:38 479,232 a------- c:\windows\system32\msvcm80.dll
2008-12-18 13:38 81,920 a------- c:\windows\system32\dpl100.dll
2008-12-18 13:38 740,442 a------- c:\windows\system32\DivX.dll
2008-12-18 13:38 569,344 a------- c:\windows\system32\AudioSettingsMCE.dll
2008-12-18 13:38 524,288 a------- c:\windows\system32\DivXsm.exe
2008-12-18 13:38 487,424 a------- c:\windows\system32\msvcp70.dll
2008-12-18 13:37 3,596,288 a------- c:\windows\system32\qt-dx331.dll
2008-12-18 13:37 217,088 a------- c:\windows\system32\yv12vfw.dll
2008-11-29 23:19 87,747 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-10-20 17:32 113,564 ---shr-- c:\windows\system32\j3ewro.exe

============= FINISH: 22:26:07.89 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:07:30 AM

Posted 19 February 2009 - 04:25 AM

Please download Malwarebytes' Anti-Malware from HERE or HERE

Note: If you already have Malwarebytes' Anti-Malware, just run and update it.. Then do a "Perform Full Scan"

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.




NEXT


Please download RSIT by random/random and save it to your Desktop.
  • Double click on RSIT.exe to run RSIT
  • Before you click "Continue", make sure you change the List files/folders created or modified in the last 3 months
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt and info.txt in your next reply.



NEXT


Please download GMER and unzip it to your Desktop. <<mirror>>
  • Open the program and click on the Rootkit tab.
  • Make sure all the boxes on the right of the screen are checked, EXCEPT for ‘Show All’.
  • Click on Scan.
  • When the scan has run click Copy and paste the results into a Notepad >> save it and attach in this thread.
IMPORTANT: Do NOT run any program while you are doing these scans as it may interfere with the output results



Post me these logs in your next reply.. Post each log in separate post..

1. Malwarebytes'
2. RSIT log.txt
3. RSIT info.txt
4. Attach GMER result..

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#3 rvreeland

rvreeland
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:05:30 PM

Posted 20 February 2009 - 12:04 AM

I ran the requested software and have the logs.

Malwarebytes' Anti-Malware 1.34
Database version: 1780
Windows 5.1.2600 Service Pack 3

2/19/2009 10:43:10 PM
mbam-log-2009-02-19 (22-43-09).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 109816
Time elapsed: 30 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 3
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jvsoft (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\anhtaaa (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dorfgwe (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\jwedsfdo0.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\j3ewro.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\8oupido.bat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kacsde.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\uret463.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\yfmqo.cmd (Trojan.Agent) -> Quarantined and deleted successfully.

#4 rvreeland

rvreeland
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:05:30 PM

Posted 20 February 2009 - 12:06 AM

RSIT log.txt

Logfile of random's system information tool 1.05 (written by random/random)
Run by Administrator at 2009-02-19 22:49:36
Microsoft Windows XP Professional Service Pack 3
System drive C: has 12 GB (22%) free of 54 GB
Total RAM: 510 MB (27% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:49:48 PM, on 2/19/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Internet\spyware\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://kace.link.com/CitrixSessionInit/ICAWEB/icaweb.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1212304187984
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5107 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll [2008-02-22 509328]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ehTray"=C:\WINDOWS\ehome\ehtray.exe [2005-08-05 64512]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2005-04-05 94208]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2005-04-05 77824]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2005-04-05 114688]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe [2008-02-22 144784]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"ZoneAlarm Client"=C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe [2008-10-09 981904]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2004-10-14 1404928]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-01-26 2144088]

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup
OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-04-05 131072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\WINDOWS\system32\ZoneLabs\vsmon.exe"="C:\WINDOWS\system32\ZoneLabs\vsmon.exe:*:Enabled:TrueVector Service"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Sony\Media Manager for PSP\MediaManager.exe"="C:\Program Files\Sony\Media Manager for PSP\MediaManager.exe:*:Enabled:Media Manager for PSP 3.0"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{10350d1c-8edf-11dd-9170-001676abf16a}]
shell\AutoRun\command - F:\dgf.exe
shell\open\command - F:\dgf.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{62adfabd-aa26-11dd-91a3-001676abf16a}]
shell\AutoRun\command - F:\dgf.exe
shell\open\command - F:\dgf.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{872f7741-2f10-11dd-bbfd-806d6172696f}]
shell\AutoRun\command - C:\om.cmd
shell\open\command - C:\om.cmd


======List of files/folders created in the last 3 months======

2009-02-19 22:49:36 ----D---- C:\rsit
2009-02-19 22:47:27 ----RSH---- C:\WINDOWS\system32\kacsde.exe
2009-02-19 22:46:48 ----RSH---- C:\WINDOWS\system32\uret463.exe
2009-02-19 22:09:57 ----D---- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2009-02-19 22:09:50 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-02-19 22:09:50 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-02-19 22:06:22 ----RSH---- C:\WINDOWS\system32\godert0.dll
2009-02-18 08:00:01 ----RSH---- C:\om.cmd
2009-02-17 21:47:17 ----D---- C:\Program Files\Trend Micro
2009-02-17 21:03:52 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-02-17 21:03:52 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-17 20:53:53 ----RSH---- C:\WINDOWS\system32\lhgjyit1.dll
2009-02-14 21:35:35 ----A---- C:\WINDOWS\system32\hidserv.dll
2009-02-14 10:28:27 ----RSH---- C:\dgf.exe
2009-02-11 22:36:40 ----A---- C:\WINDOWS\system32\MRT.INI
2009-02-11 22:35:17 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$
2009-02-11 22:03:42 ----RSH---- C:\WINDOWS\system32\godert1.dll
2009-02-10 19:58:36 ----RSH---- C:\6o0.bat
2009-02-10 19:58:10 ----N---- C:\WINDOWS\system32\lhgjyit0.dll
2009-01-25 16:59:09 ----D---- C:\Home_movies
2009-01-25 16:58:28 ----D---- C:\Documents and Settings\Administrator\Application Data\Sony Corporation
2009-01-25 16:55:16 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2009-01-25 16:55:11 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2009-01-25 16:55:05 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2009-01-25 16:55:05 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2009-01-25 16:54:58 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2009-01-25 16:54:57 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2009-01-25 16:54:57 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2009-01-25 16:54:56 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2009-01-25 16:54:56 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2009-01-25 16:54:56 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
2009-01-25 16:54:56 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2009-01-25 16:54:55 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2009-01-25 16:54:55 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2009-01-25 16:54:55 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2009-01-25 16:54:55 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2009-01-25 16:54:54 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2009-01-25 16:54:44 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2009-01-25 16:54:44 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2009-01-25 16:54:44 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2009-01-25 16:54:44 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2009-01-25 16:54:43 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2009-01-25 16:54:43 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2009-01-25 16:54:43 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2009-01-25 16:54:43 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2009-01-25 16:54:42 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2009-01-25 16:54:41 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2009-01-25 16:52:04 ----A---- C:\WINDOWS\system32\vxblock.dll
2009-01-25 16:52:03 ----A---- C:\WINDOWS\system32\PxInsI64.exe
2009-01-25 16:52:03 ----A---- C:\WINDOWS\system32\PxInsA64.exe
2009-01-25 16:52:03 ----A---- C:\WINDOWS\system32\pxhpinst.exe
2009-01-25 16:52:03 ----A---- C:\WINDOWS\system32\PxCpyI64.exe
2009-01-25 16:52:03 ----A---- C:\WINDOWS\system32\PxCpyA64.exe
2009-01-25 16:51:14 ----D---- C:\Documents and Settings\Administrator\Application Data\InstallShield
2009-01-25 00:17:43 ----A---- C:\WINDOWS\system32\ksuser.dll
2009-01-25 00:17:37 ----D---- C:\WINDOWS\VirtualEar
2009-01-25 00:17:37 ----A---- C:\WINDOWS\system32\Audio3d.dll
2009-01-25 00:17:36 ----D---- C:\Program Files\Analog Devices
2009-01-25 00:17:36 ----A---- C:\WINDOWS\system32\virtear.dll
2009-01-25 00:17:36 ----A---- C:\WINDOWS\system32\DSndUp.exe
2009-01-25 00:17:36 ----A---- C:\WINDOWS\system32\CleanUp.exe
2009-01-25 00:17:19 ----A---- C:\WINDOWS\system32\PostProc.dll
2009-01-25 00:17:19 ----A---- C:\WINDOWS\system32\Edcrypt.dll
2009-01-14 06:12:05 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2008-12-24 23:31:53 ----D---- C:\Documents and Settings\Administrator\Application Data\dvdcss
2008-12-24 23:31:20 ----A---- C:\WINDOWS\system32\WNASPI32.DLL
2008-12-24 23:31:13 ----A---- C:\temp.txt
2008-12-24 23:31:03 ----D---- C:\Program Files\4Media
2008-12-24 23:22:50 ----D---- C:\Documents and Settings\Administrator\Application Data\AVS4YOU
2008-12-24 23:21:40 ----D---- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2008-12-24 23:16:46 ----D---- C:\Program Files\Common Files\AVSMedia
2008-12-24 23:16:15 ----A---- C:\WINDOWS\system32\mfc70.dll
2008-12-24 23:16:14 ----D---- C:\Program Files\AVS4YOU
2008-12-24 23:16:14 ----A---- C:\WINDOWS\system32\msxml3a.dll
2008-12-24 23:16:14 ----A---- C:\WINDOWS\system32\GdiPlus.dll
2008-12-24 23:00:54 ----A---- C:\WINDOWS\system32\yv12vfw.dll
2008-12-24 23:00:53 ----A---- C:\WINDOWS\system32\qt-dx331.dll
2008-12-24 23:00:53 ----A---- C:\WINDOWS\system32\dpl100.dll
2008-12-24 23:00:53 ----A---- C:\WINDOWS\system32\DivXsm.exe
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\msvcr80.dll
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\msvcp80.dll
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\msvcp70.dll
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\msvcm80.dll
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\DivX.dll
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\AudioSettingsMCE.dll
2008-12-24 20:53:39 ----D---- C:\Program Files\Common Files\Common Share
2008-12-24 20:53:39 ----A---- C:\WINDOWS\system32\devil.dll
2008-12-24 20:53:39 ----A---- C:\WINDOWS\system32\avisynth.dll
2008-12-24 20:53:37 ----D---- C:\Program Files\OJOsoft
2008-12-24 20:53:37 ----A---- C:\WINDOWS\system32\mfc71.dll
2008-12-23 23:46:48 ----N---- C:\WINDOWS\system32\spmsg.dll
2008-12-23 23:46:45 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2008-12-23 17:59:23 ----D---- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-12-23 09:05:17 ----D---- C:\Documents and Settings\All Users\Application Data\Sony
2008-12-23 09:05:17 ----D---- C:\Documents and Settings\Administrator\Application Data\Sony
2008-12-23 08:37:54 ----D---- C:\Program Files\Common Files\Sony Shared
2008-12-22 23:46:36 ----D---- C:\Program Files\Common Files\Apple
2008-12-22 23:46:32 ----D---- C:\Program Files\QuickTime
2008-12-22 23:46:29 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-12-22 23:37:48 ----D---- C:\Program Files\Apple Software Update
2008-12-22 23:37:48 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2008-12-22 23:29:43 ----D---- C:\Program Files\Sony
2008-12-22 23:29:43 ----D---- C:\Documents and Settings\All Users\Application Data\Sony Corporation
2008-12-22 23:15:30 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2008-12-22 23:14:24 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2008-12-22 19:01:47 ----D---- C:\Documents and Settings\Administrator\Application Data\Sony Setup
2008-12-22 19:01:33 ----D---- C:\Program Files\Sony Setup
2008-12-22 10:15:08 ----D---- C:\psp
2008-12-11 21:05:20 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2008-12-11 21:03:40 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2008-12-11 21:03:35 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2008-12-11 21:03:24 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2008-12-01 10:13:08 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2008-12-01 10:12:58 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2008-11-29 23:25:42 ----D---- C:\WINDOWS\Prefetch
2008-11-29 23:23:35 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-11-29 23:23:27 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2008-11-29 23:23:19 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-11-29 23:23:09 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2008-11-29 23:23:00 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-11-29 23:22:50 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2008-11-29 23:22:42 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-11-29 23:22:32 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-11-29 23:22:24 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-11-29 23:22:14 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2008-11-29 23:22:06 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2008-11-29 23:21:58 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-11-29 23:21:50 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
2008-11-29 23:21:39 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2008-11-29 23:21:31 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-11-29 23:21:23 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2008-11-29 23:21:14 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2008-11-29 23:21:05 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-11-29 23:15:48 ----D---- C:\WINDOWS\system32\scripting
2008-11-29 23:15:47 ----D---- C:\WINDOWS\l2schemas
2008-11-29 23:15:46 ----D---- C:\WINDOWS\system32\en
2008-11-29 23:15:46 ----D---- C:\WINDOWS\system32\bits
2008-11-29 23:13:08 ----D---- C:\WINDOWS\ServicePackFiles
2008-11-29 23:10:58 ----D---- C:\WINDOWS\network diagnostic
2008-11-29 23:08:58 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-11-29 23:05:23 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$

======List of files/folders modified in the last 3 months======

2009-02-19 22:49:21 ----D---- C:\WINDOWS\system32\drivers
2009-02-19 22:49:12 ----D---- C:\WINDOWS\Internet Logs
2009-02-19 22:48:04 ----D---- C:\WINDOWS\system32
2009-02-19 22:46:48 ----D---- C:\Program Files\Mozilla Firefox
2009-02-19 22:45:58 ----D---- C:\WINDOWS\Temp
2009-02-19 22:45:55 ----D---- C:\WINDOWS
2009-02-19 22:45:55 ----D---- C:\Documents and Settings\Administrator\Application Data\OpenOffice.org2
2009-02-19 22:45:41 ----D---- C:\WINDOWS\Registration
2009-02-19 22:44:26 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-02-19 22:09:50 ----RD---- C:\Program Files
2009-02-17 21:00:32 ----D---- C:\Internet
2009-02-16 08:41:42 ----D---- C:\WINDOWS\system32\CatRoot2
2009-02-14 22:17:42 ----A---- C:\WINDOWS\system.ini
2009-02-14 21:55:17 ----D---- C:\DELL
2009-02-14 21:41:00 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-02-14 21:40:50 ----D---- C:\WINDOWS\Help
2009-02-14 21:40:44 ----RSD---- C:\WINDOWS\Fonts
2009-02-14 21:35:19 ----HD---- C:\WINDOWS\inf
2009-02-11 22:35:16 ----HD---- C:\WINDOWS\$hf_mig$
2009-02-11 22:35:14 ----A---- C:\WINDOWS\imsins.BAK
2009-02-11 22:35:03 ----D---- C:\Program Files\Internet Explorer
2009-02-03 17:21:12 ----A---- C:\WINDOWS\system32\MRT.exe
2009-01-25 16:55:19 ----HD---- C:\Program Files\InstallShield Installation Information
2009-01-25 16:54:54 ----RSD---- C:\WINDOWS\assembly
2009-01-25 16:54:46 ----D---- C:\WINDOWS\Microsoft.NET
2009-01-25 16:54:21 ----D---- C:\WINDOWS\system32\DirectX
2009-01-25 00:17:48 ----D---- C:\WINDOWS\system
2009-01-25 00:17:21 ----D---- C:\Program Files\Common Files\InstallShield
2009-01-16 21:35:14 ----A---- C:\WINDOWS\system32\mshtml.dll
2008-12-24 23:16:46 ----D---- C:\Program Files\Common Files
2008-12-23 23:47:26 ----D---- C:\WINDOWS\system32\CatRoot
2008-12-23 08:38:50 ----SHD---- C:\WINDOWS\Installer
2008-12-23 08:37:43 ----D---- C:\WINDOWS\WinSxS
2008-12-22 23:37:53 ----SD---- C:\WINDOWS\Tasks
2008-12-22 23:29:53 ----SD---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-12-22 23:15:42 ----D---- C:\Program Files\Windows Media Player
2008-12-22 23:14:39 ----D---- C:\WINDOWS\system32\LogFiles
2008-12-22 23:10:32 ----D---- C:\Program Files\Common Files\Microsoft Shared
2008-12-22 23:10:07 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-12-20 17:15:41 ----A---- C:\WINDOWS\system32\wininet.dll
2008-12-20 17:15:40 ----A---- C:\WINDOWS\system32\webcheck.dll
2008-12-20 17:15:40 ----A---- C:\WINDOWS\system32\urlmon.dll
2008-12-20 17:15:39 ----A---- C:\WINDOWS\system32\url.dll
2008-12-20 17:15:38 ----N---- C:\WINDOWS\system32\pngfilt.dll
2008-12-20 17:15:38 ----N---- C:\WINDOWS\system32\occache.dll
2008-12-20 17:15:32 ----N---- C:\WINDOWS\system32\mstime.dll
2008-12-20 17:15:31 ----N---- C:\WINDOWS\system32\msrating.dll
2008-12-20 17:15:30 ----N---- C:\WINDOWS\system32\mshtmled.dll
2008-12-20 17:15:24 ----A---- C:\WINDOWS\system32\msfeedsbs.dll
2008-12-20 17:15:23 ----N---- C:\WINDOWS\system32\jsproxy.dll
2008-12-20 17:15:23 ----A---- C:\WINDOWS\system32\msfeeds.dll
2008-12-20 17:15:22 ----A---- C:\WINDOWS\system32\iertutil.dll
2008-12-20 17:15:21 ----N---- C:\WINDOWS\system32\iernonce.dll
2008-12-20 17:15:21 ----A---- C:\WINDOWS\system32\ieframe.dll
2008-12-20 17:15:16 ----N---- C:\WINDOWS\system32\iedkcs32.dll
2008-12-20 17:15:15 ----A---- C:\WINDOWS\system32\ieapfltr.dll
2008-12-20 17:15:14 ----N---- C:\WINDOWS\system32\ieaksie.dll
2008-12-20 17:15:14 ----N---- C:\WINDOWS\system32\ieakeng.dll
2008-12-20 17:15:13 ----N---- C:\WINDOWS\system32\extmgr.dll
2008-12-20 17:15:13 ----N---- C:\WINDOWS\system32\dxtrans.dll
2008-12-20 17:15:13 ----A---- C:\WINDOWS\system32\icardie.dll
2008-12-20 17:15:12 ----N---- C:\WINDOWS\system32\dxtmsft.dll
2008-12-20 17:15:11 ----A---- C:\WINDOWS\system32\advpack.dll
2008-12-19 03:10:15 ----N---- C:\WINDOWS\system32\ie4uinit.exe
2008-12-19 03:10:15 ----A---- C:\WINDOWS\system32\ieudinit.exe
2008-12-18 23:23:56 ----N---- C:\WINDOWS\system32\ieakui.dll
2008-12-18 07:20:21 ----D---- C:\WINDOWS\ie7updates
2008-12-13 22:43:11 ----D---- C:\WINDOWS\pchealth
2008-11-29 23:26:17 ----A---- C:\WINDOWS\OEWABLog.txt
2008-11-29 23:25:24 ----A---- C:\WINDOWS\setuplog.txt
2008-11-29 23:24:50 ----D---- C:\WINDOWS\system32\wbem
2008-11-29 23:24:50 ----D---- C:\WINDOWS\system32\Setup
2008-11-29 23:24:50 ----D---- C:\WINDOWS\AppPatch
2008-11-29 23:24:50 ----D---- C:\Program Files\Messenger
2008-11-29 23:24:21 ----D---- C:\WINDOWS\security
2008-11-29 23:16:05 ----D---- C:\WINDOWS\system32\inetsrv
2008-11-29 23:16:04 ----D---- C:\WINDOWS\ime
2008-11-29 23:15:49 ----D---- C:\WINDOWS\system32\usmt
2008-11-29 23:15:49 ----D---- C:\WINDOWS\system32\en-US
2008-11-29 23:15:46 ----D---- C:\WINDOWS\PeerNet
2008-11-29 23:15:46 ----D---- C:\Program Files\Movie Maker
2008-11-29 23:12:58 ----D---- C:\WINDOWS\system32\Restore
2008-11-29 23:12:58 ----D---- C:\WINDOWS\system32\npp
2008-11-29 23:12:57 ----D---- C:\WINDOWS\mui
2008-11-29 23:12:56 ----D---- C:\WINDOWS\msagent
2008-11-29 23:12:54 ----D---- C:\WINDOWS\srchasst
2008-11-29 23:12:54 ----D---- C:\Program Files\NetMeeting
2008-11-29 23:12:52 ----D---- C:\WINDOWS\system32\Com
2008-11-29 23:12:50 ----D---- C:\Program Files\Windows NT
2008-11-29 23:12:50 ----D---- C:\Program Files\Outlook Express
2008-11-29 23:12:47 ----D---- C:\Program Files\Common Files\System
2008-11-29 23:12:27 ----D---- C:\WINDOWS\system32\oobe
2008-11-29 21:28:58 ----D---- C:\WINDOWS\ehome
2008-11-29 14:46:01 ----D---- C:\WINDOWS\system32\ZoneLabs

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 OMCI;OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632]
R1 vsdatant;vsdatant; C:\WINDOWS\System32\vsdatant.sys [2008-10-09 353680]
R2 Aspi32;Aspi32; C:\WINDOWS\System32\drivers\aspi32.sys [2009-01-07 16512]
R3 E100B;Intel® PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2004-02-10 154112]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-04-05 830684]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-10 12160]
R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2004-09-17 732928]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2005-03-22 260224]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 MHNDRV;MHN driver; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2005-10-11 237568]
R2 ehSched;Media Center Scheduler Service; C:\WINDOWS\eHome\ehSched.exe [2005-08-05 102912]
R2 McrdSvc;Media Center Extender Service; C:\WINDOWS\ehome\mcrdsvc.exe [2005-08-05 99328]
R2 vsmon;TrueVector Internet Monitor; C:\WINDOWS\system32\ZoneLabs\vsmon.exe [2008-10-09 2405776]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]

-----------------EOF-----------------

#5 rvreeland

rvreeland
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:05:30 PM

Posted 20 February 2009 - 12:08 AM

RSIT info.txt

info.txt logfile of random's system information tool 1.05 2009-02-19 22:49:52

======Uninstall list======

-->C:\Program Files\InstallShield Installation Information\{36C41D70-56F5-4E2B-81DA-6BEB7502D7A1}\setup.exe -runfromtemp -l0x0009 -removeonly
-->C:\Program Files\InstallShield Installation Information\{B2C4A8C4-AA20-425D-9FEE-C78039238C81}\setup.exe -runfromtemp -l0x0009 -removeonly
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
4Media DVD to PS3 Converter 5-->C:\Program Files\4Media\DVD to PS3 Converter 5\Uninstall.exe
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Citrix Presentation Server Web Client for Win32-->RunDll32 ADVPACK.DLL,LaunchINFSection C:\WINDOWS\INF\icaweb.inf,DefaultUninstall
Citrix XenApp Web Plugin-->MsiExec.exe /X{EBFEEB3F-3E3B-4725-A4E0-376144CE4F76}
Dell ResourceCD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D78653C3-A8FF-415F-92E6-D774E634FF2D}\setup.exe"
ESPNMotion-->C:\PROGRA~1\ESPNMO~1\UNWISE.EXE /u C:\PROGRA~1\ESPNMO~1\INSTALL.LOG
GemMaster Mystic-->"C:\Program Files\GemMaster\uninstallgemmaster.exe"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 10 (KB903157)-->"C:\WINDOWS\$NtUninstallKB903157$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Intel® Extreme Graphics 2 Driver-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2572
Intel® PRO Network Adapters and Drivers-->Prounstl.exe
Java™ 6 Update 4-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160040}
Java™ 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mozilla Firefox (3.0.5)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
OJOsoft MP4 Converter-->"C:\Program Files\OJOsoft\OJOsoft MP4 Converter\unins000.exe"
OpenOffice.org 2.4-->MsiExec.exe /I{F87A8E11-02A4-4875-A3A5-5961081B0E4E}
Otto-->"C:\Program Files\EnglishOtto\uninstallotto.exe"
PlayStation®Network Downloader-->MsiExec.exe /X{BC4CA8FA-41D2-4B81-8680-E9B7573D6500}
PlayStation®Store-->MsiExec.exe /X{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}
QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
Security Update for Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Sonic Encoders-->MsiExec.exe /I{9941F0AA-B903-4AF4-A055-83A9815CC011}
Sony Media Manager for PSP 3.0-->MsiExec.exe /X{21C6344A-918B-4D35-ADB6-7614F97B78EA}
Sony Picture Utility-->C:\Program Files\InstallShield Installation Information\{D5068583-D569-468B-9755-5FBF5848F46F}\setup.exe -runfromtemp -l0x0009 uninstall -removeonly
SoundMAX-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\SETUP.exe" -l0x9 -removeonly
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Update for Windows Media Player 10 (KB913800)-->"C:\WINDOWS\$NtUninstallKB913800$\spuninst\spuninst.exe"
Update for Windows Media Player 10 (KB926251)-->"C:\WINDOWS\$NtUninstallKB926251$\spuninst\spuninst.exe"
Update for Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Update Rollup 2 for Windows XP Media Center Edition 2005-->C:\WINDOWS\$NtUninstallKB900325$\spuninst\spuninst.exe
VC 9.0 Runtime-->MsiExec.exe /I{A040AC77-C1AA-4CC9-8931-9F648AF178F6}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows XP Media Center Edition 2005 KB908250-->"C:\WINDOWS\$NtUninstallKB908250$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
ZoneAlarm Pro-->C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

FW: ZoneAlarm Pro Firewall

System event log

Computer Name: CFN
Event Code: 7036
Message: The Terminal Services service entered the running state.

Record Number: 5912
Source Name: Service Control Manager
Time Written: 20081212223942.000000-360
Event Type: information
User:

Computer Name: CFN
Event Code: 6005
Message: The Event log service was started.

Record Number: 5911
Source Name: EventLog
Time Written: 20081212223913.000000-360
Event Type: information
User:

Computer Name: CFN
Event Code: 6009
Message: Microsoft ® Windows ® 5.01. 2600 Service Pack 3 Uniprocessor Free.

Record Number: 5910
Source Name: EventLog
Time Written: 20081212223913.000000-360
Event Type: information
User:

Computer Name: CFN
Event Code: 6006
Message: The Event log service was stopped.

Record Number: 5909
Source Name: EventLog
Time Written: 20081212090454.000000-360
Event Type: information
User:

Computer Name: CFN
Event Code: 59
Message: Generate Activation Context failed for C:\PROGRA~1\Citrix\ICACLI~1\MFC80.DLL.
Reference error message: The operation completed successfully.
.

Record Number: 5908
Source Name: SideBySide
Time Written: 20081212090342.000000-360
Event Type: error
User:

Application event log

Computer Name: CFN
Event Code: 1000
Message: Performance counters for the MSDTC (MSDTC) service were loaded successfully.
The Record Data contains the new index values assigned
to this service.

Record Number: 5
Source Name: LoadPerf
Time Written: 20080531133119.000000-300
Event Type: information
User:

Computer Name: CFN
Event Code: 1000
Message: Performance counters for the TermService (Terminal Services) service were loaded successfully.
The Record Data contains the new index values assigned
to this service.

Record Number: 4
Source Name: LoadPerf
Time Written: 20080531133115.000000-300
Event Type: information
User:

Computer Name: CFN
Event Code: 1000
Message: Performance counters for the RemoteAccess (Routing and Remote Access) service were loaded successfully.
The Record Data contains the new index values assigned
to this service.

Record Number: 3
Source Name: LoadPerf
Time Written: 20080531132831.000000-300
Event Type: information
User:

Computer Name: CFN
Event Code: 1000
Message: Performance counters for the PSched (PSched) service were loaded successfully.
The Record Data contains the new index values assigned
to this service.

Record Number: 2
Source Name: LoadPerf
Time Written: 20080531132806.000000-300
Event Type: information
User:

Computer Name: CFN
Event Code: 1000
Message: Performance counters for the RSVP (QoS RSVP) service were loaded successfully.
The Record Data contains the new index values assigned
to this service.

Record Number: 1
Source Name: LoadPerf
Time Written: 20080531132805.000000-300
Event Type: information
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0409
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"tvdumpflags"=8
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip

-----------------EOF-----------------

#6 rvreeland

rvreeland
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:05:30 PM

Posted 20 February 2009 - 12:10 AM

The Gmer.log

Thanks for any help you can provide.

R

Attached Files

  • Attached File  gmer.log   11.78KB   1 downloads


#7 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:07:30 AM

Posted 20 February 2009 - 06:40 AM

IMPORTANT!! Uninstall these programs first (if present..) so that they won't interfere with our fixes..

1. Ask Toolbar
2. Lavasoft Ad-Aware
3. Spybot - Search & Destroy
4. Viewpoint (all of them..)




Please download JavaRa to your desktop and unzip it to its own folder. <<MIRROR>>
  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.
Then, please download and install the latest Java from HERE




NEXT


Please download the OTMoveIt3 by OldTimer
  • Save it to your Desktop.
  • Please double-click OTMoveIt3.exe to run it. (Vista users, please right click on OTMoveit3.exe and select "Run as an Administrator")
  • Let the Unregister Dll's and Ocx's remain ticked and Zip Files After Moves remain unticked..
  • Copy the codebox contents and paste it to the "Paste List of Files/Folders to Move" window (under the light Yellow bar)

    :processes
    explorer.exe
    
    :services
    
    :files
    F:\dgf.exe
    C:\om.cmd
    C:\WINDOWS\system32\kacsde.exe
    C:\WINDOWS\system32\uret463.exe
    C:\WINDOWS\system32\godert0.dll
    C:\WINDOWS\system32\lhgjyit1.dll
    C:\dgf.exe
    C:\6o0.bat
    C:\WINDOWS\system32\lhgjyit0.dll
    C:\WINDOWS\system32\godert1.dll
    D:\dgf.exe
    D:\6o0.bat
    D:\om.cmd
    E:\dgf.exe
    E:\6o0.bat
    E:\om.cmd
    F:\dgf.exe
    F:\6o0.bat
    F:\om.cmd
    
    :reg
    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{10350d1c-8edf-11dd-9170-001676abf16a}]
    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{62adfabd-aa26-11dd-91a3-001676abf16a}]
    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{872f7741-2f10-11dd-bbfd-806d6172696f}]
    
    :commands
    [purity]
    [emptytemp]
    [start explorer]
    [reboot]
  • Click the red Moveit! button.
  • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
  • Close OTMoveIt3
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.



Run RSIT again... Post these logs in your next reply..

1. OTMoveIt3
2. RSIT log.txt

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#8 rvreeland

rvreeland
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:05:30 PM

Posted 20 February 2009 - 07:51 AM

The OTMoveIt log

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== FILES ==========
File/Folder F:\dgf.exe not found.
C:\om.cmd moved successfully.
C:\WINDOWS\system32\kacsde.exe moved successfully.
C:\WINDOWS\system32\uret463.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\godert0.dll
C:\WINDOWS\system32\godert0.dll NOT unregistered.
C:\WINDOWS\system32\godert0.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\lhgjyit1.dll
C:\WINDOWS\system32\lhgjyit1.dll NOT unregistered.
C:\WINDOWS\system32\lhgjyit1.dll moved successfully.
C:\dgf.exe moved successfully.
C:\6o0.bat moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\lhgjyit0.dll
C:\WINDOWS\system32\lhgjyit0.dll NOT unregistered.
C:\WINDOWS\system32\lhgjyit0.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\godert1.dll
C:\WINDOWS\system32\godert1.dll NOT unregistered.
C:\WINDOWS\system32\godert1.dll moved successfully.
D:\dgf.exe moved successfully.
D:\6o0.bat moved successfully.
D:\om.cmd moved successfully.
File/Folder E:\dgf.exe not found.
File/Folder E:\6o0.bat not found.
File/Folder E:\om.cmd not found.
File/Folder F:\dgf.exe not found.
File/Folder F:\6o0.bat not found.
File/Folder F:\om.cmd not found.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{10350d1c-8edf-11dd-9170-001676abf16a}\\ deleted successfully.
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{62adfabd-aa26-11dd-91a3-001676abf16a}\\ deleted successfully.
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{872f7741-2f10-11dd-bbfd-806d6172696f}\\ deleted successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\etilqs_423eu3ey7vsP3B1KNhno scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFED3A.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_3d0.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\ZLT02660.TMP scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ci8a7xe9.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ci8a7xe9.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ci8a7xe9.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ci8a7xe9.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ci8a7xe9.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ci8a7xe9.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02202009_064126

Files moved on Reboot...
File C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\etilqs_423eu3ey7vsP3B1KNhno not found!
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFED3A.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\Perflib_Perfdata_3d0.dat not found!
File C:\WINDOWS\temp\ZLT02660.TMP not found!
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ci8a7xe9.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ci8a7xe9.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ci8a7xe9.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ci8a7xe9.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ci8a7xe9.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ci8a7xe9.default\XUL.mfl moved successfully.


The new RSIT log

Logfile of random's system information tool 1.05 (written by random/random)
Run by Administrator at 2009-02-20 06:46:46
Microsoft Windows XP Professional Service Pack 3
System drive C: has 12 GB (22%) free of 54 GB
Total RAM: 510 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:46:58 AM, on 2/20/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\WINDOWS\system32\wuauclt.exe
C:\Internet\spyware\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://kace.link.com/CitrixSessionInit/ICAWEB/icaweb.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1212304187984
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 4707 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java™ Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-02-20 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-02-20 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-02-20 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ehTray"=C:\WINDOWS\ehome\ehtray.exe [2005-08-05 64512]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2005-04-05 94208]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2005-04-05 77824]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2005-04-05 114688]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-02-20 136600]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"ZoneAlarm Client"=C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe [2008-10-09 981904]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2004-10-14 1404928]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup
OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-04-05 131072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\WINDOWS\system32\ZoneLabs\vsmon.exe"="C:\WINDOWS\system32\ZoneLabs\vsmon.exe:*:Enabled:TrueVector Service"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Sony\Media Manager for PSP\MediaManager.exe"="C:\Program Files\Sony\Media Manager for PSP\MediaManager.exe:*:Enabled:Media Manager for PSP 3.0"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{872f7741-2f10-11dd-bbfd-806d6172696f}]
shell\AutoRun\command - om.cmd
shell\open\command - om.cmd


======List of files/folders created in the last 3 months======

2009-02-20 06:41:26 ----D---- C:\_OTMoveIt
2009-02-20 06:33:24 ----A---- C:\WINDOWS\system32\javaws.exe
2009-02-20 06:33:24 ----A---- C:\WINDOWS\system32\javaw.exe
2009-02-20 06:33:24 ----A---- C:\WINDOWS\system32\java.exe
2009-02-20 06:33:24 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-02-19 22:50:57 ----A---- C:\WINDOWS\gmer.ini
2009-02-19 22:50:55 ----RA---- C:\WINDOWS\gmer.exe
2009-02-19 22:50:55 ----A---- C:\WINDOWS\gmer_uninstall.cmd
2009-02-19 22:50:55 ----A---- C:\WINDOWS\gmer.dll
2009-02-19 22:49:36 ----D---- C:\rsit
2009-02-19 22:09:57 ----D---- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2009-02-19 22:09:50 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-02-19 22:09:50 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-02-17 21:47:17 ----D---- C:\Program Files\Trend Micro
2009-02-17 21:03:52 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-02-17 21:03:52 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-14 21:35:35 ----A---- C:\WINDOWS\system32\hidserv.dll
2009-02-11 22:36:40 ----A---- C:\WINDOWS\system32\MRT.INI
2009-02-11 22:35:17 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$
2009-01-25 16:59:09 ----D---- C:\Home_movies
2009-01-25 16:58:28 ----D---- C:\Documents and Settings\Administrator\Application Data\Sony Corporation
2009-01-25 16:55:16 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2009-01-25 16:55:11 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2009-01-25 16:55:05 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2009-01-25 16:55:05 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2009-01-25 16:54:58 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2009-01-25 16:54:57 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2009-01-25 16:54:57 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2009-01-25 16:54:56 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2009-01-25 16:54:56 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2009-01-25 16:54:56 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
2009-01-25 16:54:56 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2009-01-25 16:54:55 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2009-01-25 16:54:55 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2009-01-25 16:54:55 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2009-01-25 16:54:55 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2009-01-25 16:54:54 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2009-01-25 16:54:44 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2009-01-25 16:54:44 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2009-01-25 16:54:44 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2009-01-25 16:54:44 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2009-01-25 16:54:43 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2009-01-25 16:54:43 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2009-01-25 16:54:43 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2009-01-25 16:54:43 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2009-01-25 16:54:42 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2009-01-25 16:54:41 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2009-01-25 16:52:04 ----A---- C:\WINDOWS\system32\vxblock.dll
2009-01-25 16:52:03 ----A---- C:\WINDOWS\system32\PxInsI64.exe
2009-01-25 16:52:03 ----A---- C:\WINDOWS\system32\PxInsA64.exe
2009-01-25 16:52:03 ----A---- C:\WINDOWS\system32\pxhpinst.exe
2009-01-25 16:52:03 ----A---- C:\WINDOWS\system32\PxCpyI64.exe
2009-01-25 16:52:03 ----A---- C:\WINDOWS\system32\PxCpyA64.exe
2009-01-25 16:51:14 ----D---- C:\Documents and Settings\Administrator\Application Data\InstallShield
2009-01-25 00:17:43 ----A---- C:\WINDOWS\system32\ksuser.dll
2009-01-25 00:17:37 ----D---- C:\WINDOWS\VirtualEar
2009-01-25 00:17:37 ----A---- C:\WINDOWS\system32\Audio3d.dll
2009-01-25 00:17:36 ----D---- C:\Program Files\Analog Devices
2009-01-25 00:17:36 ----A---- C:\WINDOWS\system32\virtear.dll
2009-01-25 00:17:36 ----A---- C:\WINDOWS\system32\DSndUp.exe
2009-01-25 00:17:36 ----A---- C:\WINDOWS\system32\CleanUp.exe
2009-01-25 00:17:19 ----A---- C:\WINDOWS\system32\PostProc.dll
2009-01-25 00:17:19 ----A---- C:\WINDOWS\system32\Edcrypt.dll
2009-01-14 06:12:05 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2008-12-24 23:31:53 ----D---- C:\Documents and Settings\Administrator\Application Data\dvdcss
2008-12-24 23:31:20 ----A---- C:\WINDOWS\system32\WNASPI32.DLL
2008-12-24 23:31:13 ----A---- C:\temp.txt
2008-12-24 23:31:03 ----D---- C:\Program Files\4Media
2008-12-24 23:22:50 ----D---- C:\Documents and Settings\Administrator\Application Data\AVS4YOU
2008-12-24 23:21:40 ----D---- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2008-12-24 23:16:46 ----D---- C:\Program Files\Common Files\AVSMedia
2008-12-24 23:16:15 ----A---- C:\WINDOWS\system32\mfc70.dll
2008-12-24 23:16:14 ----D---- C:\Program Files\AVS4YOU
2008-12-24 23:16:14 ----A---- C:\WINDOWS\system32\msxml3a.dll
2008-12-24 23:16:14 ----A---- C:\WINDOWS\system32\GdiPlus.dll
2008-12-24 23:00:54 ----A---- C:\WINDOWS\system32\yv12vfw.dll
2008-12-24 23:00:53 ----A---- C:\WINDOWS\system32\qt-dx331.dll
2008-12-24 23:00:53 ----A---- C:\WINDOWS\system32\dpl100.dll
2008-12-24 23:00:53 ----A---- C:\WINDOWS\system32\DivXsm.exe
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\msvcr80.dll
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\msvcp80.dll
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\msvcp70.dll
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\msvcm80.dll
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\DivX.dll
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\AudioSettingsMCE.dll
2008-12-24 20:53:39 ----D---- C:\Program Files\Common Files\Common Share
2008-12-24 20:53:39 ----A---- C:\WINDOWS\system32\devil.dll
2008-12-24 20:53:39 ----A---- C:\WINDOWS\system32\avisynth.dll
2008-12-24 20:53:37 ----D---- C:\Program Files\OJOsoft
2008-12-24 20:53:37 ----A---- C:\WINDOWS\system32\mfc71.dll
2008-12-23 23:46:48 ----N---- C:\WINDOWS\system32\spmsg.dll
2008-12-23 23:46:45 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2008-12-23 17:59:23 ----D---- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-12-23 09:05:17 ----D---- C:\Documents and Settings\All Users\Application Data\Sony
2008-12-23 09:05:17 ----D---- C:\Documents and Settings\Administrator\Application Data\Sony
2008-12-23 08:37:54 ----D---- C:\Program Files\Common Files\Sony Shared
2008-12-22 23:46:36 ----D---- C:\Program Files\Common Files\Apple
2008-12-22 23:46:32 ----D---- C:\Program Files\QuickTime
2008-12-22 23:46:29 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-12-22 23:37:48 ----D---- C:\Program Files\Apple Software Update
2008-12-22 23:37:48 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2008-12-22 23:29:43 ----D---- C:\Program Files\Sony
2008-12-22 23:29:43 ----D---- C:\Documents and Settings\All Users\Application Data\Sony Corporation
2008-12-22 23:15:30 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2008-12-22 23:14:24 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2008-12-22 19:01:47 ----D---- C:\Documents and Settings\Administrator\Application Data\Sony Setup
2008-12-22 19:01:33 ----D---- C:\Program Files\Sony Setup
2008-12-22 10:15:08 ----D---- C:\psp
2008-12-11 21:05:20 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2008-12-11 21:03:40 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2008-12-11 21:03:35 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2008-12-11 21:03:24 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2008-12-01 10:13:08 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2008-12-01 10:12:58 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2008-11-29 23:25:42 ----D---- C:\WINDOWS\Prefetch
2008-11-29 23:23:35 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-11-29 23:23:27 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2008-11-29 23:23:19 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-11-29 23:23:09 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2008-11-29 23:23:00 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-11-29 23:22:50 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2008-11-29 23:22:42 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-11-29 23:22:32 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-11-29 23:22:24 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-11-29 23:22:14 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2008-11-29 23:22:06 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2008-11-29 23:21:58 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-11-29 23:21:50 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
2008-11-29 23:21:39 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2008-11-29 23:21:31 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-11-29 23:21:23 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2008-11-29 23:21:14 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2008-11-29 23:21:05 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-11-29 23:15:48 ----D---- C:\WINDOWS\system32\scripting
2008-11-29 23:15:47 ----D---- C:\WINDOWS\l2schemas
2008-11-29 23:15:46 ----D---- C:\WINDOWS\system32\en
2008-11-29 23:15:46 ----D---- C:\WINDOWS\system32\bits
2008-11-29 23:13:08 ----D---- C:\WINDOWS\ServicePackFiles
2008-11-29 23:10:58 ----D---- C:\WINDOWS\network diagnostic
2008-11-29 23:08:58 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-11-29 23:05:23 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$

======List of files/folders modified in the last 3 months======

2009-02-20 06:45:40 ----D---- C:\WINDOWS\Internet Logs
2009-02-20 06:44:29 ----D---- C:\WINDOWS\Temp
2009-02-20 06:44:29 ----D---- C:\Documents and Settings\Administrator\Application Data\OpenOffice.org2
2009-02-20 06:44:17 ----D---- C:\WINDOWS
2009-02-20 06:43:52 ----D---- C:\WINDOWS\Registration
2009-02-20 06:42:42 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-02-20 06:41:31 ----D---- C:\WINDOWS\system32
2009-02-20 06:33:32 ----SHD---- C:\WINDOWS\Installer
2009-02-20 06:33:01 ----D---- C:\Program Files\Java
2009-02-20 06:25:27 ----D---- C:\Program Files\Mozilla Firefox
2009-02-19 23:01:55 ----D---- C:\WINDOWS\system32\drivers
2009-02-19 22:09:50 ----RD---- C:\Program Files
2009-02-17 21:00:32 ----D---- C:\Internet
2009-02-16 08:41:42 ----D---- C:\WINDOWS\system32\CatRoot2
2009-02-14 22:17:42 ----A---- C:\WINDOWS\system.ini
2009-02-14 21:55:17 ----D---- C:\DELL
2009-02-14 21:41:00 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-02-14 21:40:50 ----D---- C:\WINDOWS\Help
2009-02-14 21:40:44 ----RSD---- C:\WINDOWS\Fonts
2009-02-14 21:35:19 ----HD---- C:\WINDOWS\inf
2009-02-11 22:35:16 ----HD---- C:\WINDOWS\$hf_mig$
2009-02-11 22:35:14 ----A---- C:\WINDOWS\imsins.BAK
2009-02-11 22:35:03 ----D---- C:\Program Files\Internet Explorer
2009-02-03 17:21:12 ----A---- C:\WINDOWS\system32\MRT.exe
2009-01-25 16:55:19 ----HD---- C:\Program Files\InstallShield Installation Information
2009-01-25 16:54:54 ----RSD---- C:\WINDOWS\assembly
2009-01-25 16:54:46 ----D---- C:\WINDOWS\Microsoft.NET
2009-01-25 16:54:21 ----D---- C:\WINDOWS\system32\DirectX
2009-01-25 00:17:48 ----D---- C:\WINDOWS\system
2009-01-25 00:17:21 ----D---- C:\Program Files\Common Files\InstallShield
2009-01-16 21:35:14 ----A---- C:\WINDOWS\system32\mshtml.dll
2008-12-24 23:16:46 ----D---- C:\Program Files\Common Files
2008-12-23 23:47:26 ----D---- C:\WINDOWS\system32\CatRoot
2008-12-23 08:37:43 ----D---- C:\WINDOWS\WinSxS
2008-12-22 23:37:53 ----SD---- C:\WINDOWS\Tasks
2008-12-22 23:29:53 ----SD---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-12-22 23:15:42 ----D---- C:\Program Files\Windows Media Player
2008-12-22 23:14:39 ----D---- C:\WINDOWS\system32\LogFiles
2008-12-22 23:10:32 ----D---- C:\Program Files\Common Files\Microsoft Shared
2008-12-22 23:10:07 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-12-20 17:15:41 ----A---- C:\WINDOWS\system32\wininet.dll
2008-12-20 17:15:40 ----A---- C:\WINDOWS\system32\webcheck.dll
2008-12-20 17:15:40 ----A---- C:\WINDOWS\system32\urlmon.dll
2008-12-20 17:15:39 ----A---- C:\WINDOWS\system32\url.dll
2008-12-20 17:15:38 ----N---- C:\WINDOWS\system32\pngfilt.dll
2008-12-20 17:15:38 ----N---- C:\WINDOWS\system32\occache.dll
2008-12-20 17:15:32 ----N---- C:\WINDOWS\system32\mstime.dll
2008-12-20 17:15:31 ----N---- C:\WINDOWS\system32\msrating.dll
2008-12-20 17:15:30 ----N---- C:\WINDOWS\system32\mshtmled.dll
2008-12-20 17:15:24 ----A---- C:\WINDOWS\system32\msfeedsbs.dll
2008-12-20 17:15:23 ----N---- C:\WINDOWS\system32\jsproxy.dll
2008-12-20 17:15:23 ----A---- C:\WINDOWS\system32\msfeeds.dll
2008-12-20 17:15:22 ----A---- C:\WINDOWS\system32\iertutil.dll
2008-12-20 17:15:21 ----N---- C:\WINDOWS\system32\iernonce.dll
2008-12-20 17:15:21 ----A---- C:\WINDOWS\system32\ieframe.dll
2008-12-20 17:15:16 ----N---- C:\WINDOWS\system32\iedkcs32.dll
2008-12-20 17:15:15 ----A---- C:\WINDOWS\system32\ieapfltr.dll
2008-12-20 17:15:14 ----N---- C:\WINDOWS\system32\ieaksie.dll
2008-12-20 17:15:14 ----N---- C:\WINDOWS\system32\ieakeng.dll
2008-12-20 17:15:13 ----N---- C:\WINDOWS\system32\extmgr.dll
2008-12-20 17:15:13 ----N---- C:\WINDOWS\system32\dxtrans.dll
2008-12-20 17:15:13 ----A---- C:\WINDOWS\system32\icardie.dll
2008-12-20 17:15:12 ----N---- C:\WINDOWS\system32\dxtmsft.dll
2008-12-20 17:15:11 ----A---- C:\WINDOWS\system32\advpack.dll
2008-12-19 03:10:15 ----N---- C:\WINDOWS\system32\ie4uinit.exe
2008-12-19 03:10:15 ----A---- C:\WINDOWS\system32\ieudinit.exe
2008-12-18 23:23:56 ----N---- C:\WINDOWS\system32\ieakui.dll
2008-12-18 07:20:21 ----D---- C:\WINDOWS\ie7updates
2008-12-13 22:43:11 ----D---- C:\WINDOWS\pchealth
2008-11-29 23:26:17 ----A---- C:\WINDOWS\OEWABLog.txt
2008-11-29 23:25:24 ----A---- C:\WINDOWS\setuplog.txt
2008-11-29 23:24:50 ----D---- C:\WINDOWS\system32\wbem
2008-11-29 23:24:50 ----D---- C:\WINDOWS\system32\Setup
2008-11-29 23:24:50 ----D---- C:\WINDOWS\AppPatch
2008-11-29 23:24:50 ----D---- C:\Program Files\Messenger
2008-11-29 23:24:21 ----D---- C:\WINDOWS\security
2008-11-29 23:16:05 ----D---- C:\WINDOWS\system32\inetsrv
2008-11-29 23:16:04 ----D---- C:\WINDOWS\ime
2008-11-29 23:15:49 ----D---- C:\WINDOWS\system32\usmt
2008-11-29 23:15:49 ----D---- C:\WINDOWS\system32\en-US
2008-11-29 23:15:46 ----D---- C:\WINDOWS\PeerNet
2008-11-29 23:15:46 ----D---- C:\Program Files\Movie Maker
2008-11-29 23:12:58 ----D---- C:\WINDOWS\system32\Restore
2008-11-29 23:12:58 ----D---- C:\WINDOWS\system32\npp
2008-11-29 23:12:57 ----D---- C:\WINDOWS\mui
2008-11-29 23:12:56 ----D---- C:\WINDOWS\msagent
2008-11-29 23:12:54 ----D---- C:\WINDOWS\srchasst
2008-11-29 23:12:54 ----D---- C:\Program Files\NetMeeting
2008-11-29 23:12:52 ----D---- C:\WINDOWS\system32\Com
2008-11-29 23:12:50 ----D---- C:\Program Files\Windows NT
2008-11-29 23:12:50 ----D---- C:\Program Files\Outlook Express
2008-11-29 23:12:47 ----D---- C:\Program Files\Common Files\System
2008-11-29 23:12:27 ----D---- C:\WINDOWS\system32\oobe
2008-11-29 21:28:58 ----D---- C:\WINDOWS\ehome
2008-11-29 14:46:01 ----D---- C:\WINDOWS\system32\ZoneLabs

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 OMCI;OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632]
R1 vsdatant;vsdatant; C:\WINDOWS\System32\vsdatant.sys [2008-10-09 353680]
R2 Aspi32;Aspi32; C:\WINDOWS\System32\drivers\aspi32.sys [2009-01-07 16512]
R3 E100B;Intel® PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2004-02-10 154112]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-04-05 830684]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-10 12160]
R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2004-09-17 732928]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2005-03-22 260224]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 gmer;gmer; C:\WINDOWS\System32\DRIVERS\gmer.sys [2009-02-19 85969]
S3 MHNDRV;MHN driver; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2005-10-11 237568]
R2 ehSched;Media Center Scheduler Service; C:\WINDOWS\eHome\ehSched.exe [2005-08-05 102912]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-02-20 152984]
R2 McrdSvc;Media Center Extender Service; C:\WINDOWS\ehome\mcrdsvc.exe [2005-08-05 99328]
R2 vsmon;TrueVector Internet Monitor; C:\WINDOWS\system32\ZoneLabs\vsmon.exe [2008-10-09 2405776]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]

-----------------EOF-----------------

#9 rvreeland

rvreeland
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:05:30 PM

Posted 20 February 2009 - 07:53 AM

The RSIT log - In the previous post I listed both together.

Logfile of random's system information tool 1.05 (written by random/random)
Run by Administrator at 2009-02-20 06:46:46
Microsoft Windows XP Professional Service Pack 3
System drive C: has 12 GB (22%) free of 54 GB
Total RAM: 510 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:46:58 AM, on 2/20/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\WINDOWS\system32\wuauclt.exe
C:\Internet\spyware\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://kace.link.com/CitrixSessionInit/ICAWEB/icaweb.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1212304187984
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 4707 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java™ Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-02-20 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-02-20 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-02-20 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ehTray"=C:\WINDOWS\ehome\ehtray.exe [2005-08-05 64512]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2005-04-05 94208]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2005-04-05 77824]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2005-04-05 114688]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-02-20 136600]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"ZoneAlarm Client"=C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe [2008-10-09 981904]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2004-10-14 1404928]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup
OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-04-05 131072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\WINDOWS\system32\ZoneLabs\vsmon.exe"="C:\WINDOWS\system32\ZoneLabs\vsmon.exe:*:Enabled:TrueVector Service"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Sony\Media Manager for PSP\MediaManager.exe"="C:\Program Files\Sony\Media Manager for PSP\MediaManager.exe:*:Enabled:Media Manager for PSP 3.0"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{872f7741-2f10-11dd-bbfd-806d6172696f}]
shell\AutoRun\command - om.cmd
shell\open\command - om.cmd


======List of files/folders created in the last 3 months======

2009-02-20 06:41:26 ----D---- C:\_OTMoveIt
2009-02-20 06:33:24 ----A---- C:\WINDOWS\system32\javaws.exe
2009-02-20 06:33:24 ----A---- C:\WINDOWS\system32\javaw.exe
2009-02-20 06:33:24 ----A---- C:\WINDOWS\system32\java.exe
2009-02-20 06:33:24 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-02-19 22:50:57 ----A---- C:\WINDOWS\gmer.ini
2009-02-19 22:50:55 ----RA---- C:\WINDOWS\gmer.exe
2009-02-19 22:50:55 ----A---- C:\WINDOWS\gmer_uninstall.cmd
2009-02-19 22:50:55 ----A---- C:\WINDOWS\gmer.dll
2009-02-19 22:49:36 ----D---- C:\rsit
2009-02-19 22:09:57 ----D---- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2009-02-19 22:09:50 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-02-19 22:09:50 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-02-17 21:47:17 ----D---- C:\Program Files\Trend Micro
2009-02-17 21:03:52 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-02-17 21:03:52 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-14 21:35:35 ----A---- C:\WINDOWS\system32\hidserv.dll
2009-02-11 22:36:40 ----A---- C:\WINDOWS\system32\MRT.INI
2009-02-11 22:35:17 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$
2009-01-25 16:59:09 ----D---- C:\Home_movies
2009-01-25 16:58:28 ----D---- C:\Documents and Settings\Administrator\Application Data\Sony Corporation
2009-01-25 16:55:16 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2009-01-25 16:55:11 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2009-01-25 16:55:05 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2009-01-25 16:55:05 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2009-01-25 16:54:58 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2009-01-25 16:54:57 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2009-01-25 16:54:57 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2009-01-25 16:54:56 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2009-01-25 16:54:56 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2009-01-25 16:54:56 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
2009-01-25 16:54:56 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2009-01-25 16:54:55 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2009-01-25 16:54:55 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2009-01-25 16:54:55 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2009-01-25 16:54:55 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2009-01-25 16:54:54 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2009-01-25 16:54:44 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2009-01-25 16:54:44 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2009-01-25 16:54:44 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2009-01-25 16:54:44 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2009-01-25 16:54:43 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2009-01-25 16:54:43 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2009-01-25 16:54:43 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2009-01-25 16:54:43 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2009-01-25 16:54:42 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2009-01-25 16:54:41 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2009-01-25 16:52:04 ----A---- C:\WINDOWS\system32\vxblock.dll
2009-01-25 16:52:03 ----A---- C:\WINDOWS\system32\PxInsI64.exe
2009-01-25 16:52:03 ----A---- C:\WINDOWS\system32\PxInsA64.exe
2009-01-25 16:52:03 ----A---- C:\WINDOWS\system32\pxhpinst.exe
2009-01-25 16:52:03 ----A---- C:\WINDOWS\system32\PxCpyI64.exe
2009-01-25 16:52:03 ----A---- C:\WINDOWS\system32\PxCpyA64.exe
2009-01-25 16:51:14 ----D---- C:\Documents and Settings\Administrator\Application Data\InstallShield
2009-01-25 00:17:43 ----A---- C:\WINDOWS\system32\ksuser.dll
2009-01-25 00:17:37 ----D---- C:\WINDOWS\VirtualEar
2009-01-25 00:17:37 ----A---- C:\WINDOWS\system32\Audio3d.dll
2009-01-25 00:17:36 ----D---- C:\Program Files\Analog Devices
2009-01-25 00:17:36 ----A---- C:\WINDOWS\system32\virtear.dll
2009-01-25 00:17:36 ----A---- C:\WINDOWS\system32\DSndUp.exe
2009-01-25 00:17:36 ----A---- C:\WINDOWS\system32\CleanUp.exe
2009-01-25 00:17:19 ----A---- C:\WINDOWS\system32\PostProc.dll
2009-01-25 00:17:19 ----A---- C:\WINDOWS\system32\Edcrypt.dll
2009-01-14 06:12:05 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2008-12-24 23:31:53 ----D---- C:\Documents and Settings\Administrator\Application Data\dvdcss
2008-12-24 23:31:20 ----A---- C:\WINDOWS\system32\WNASPI32.DLL
2008-12-24 23:31:13 ----A---- C:\temp.txt
2008-12-24 23:31:03 ----D---- C:\Program Files\4Media
2008-12-24 23:22:50 ----D---- C:\Documents and Settings\Administrator\Application Data\AVS4YOU
2008-12-24 23:21:40 ----D---- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2008-12-24 23:16:46 ----D---- C:\Program Files\Common Files\AVSMedia
2008-12-24 23:16:15 ----A---- C:\WINDOWS\system32\mfc70.dll
2008-12-24 23:16:14 ----D---- C:\Program Files\AVS4YOU
2008-12-24 23:16:14 ----A---- C:\WINDOWS\system32\msxml3a.dll
2008-12-24 23:16:14 ----A---- C:\WINDOWS\system32\GdiPlus.dll
2008-12-24 23:00:54 ----A---- C:\WINDOWS\system32\yv12vfw.dll
2008-12-24 23:00:53 ----A---- C:\WINDOWS\system32\qt-dx331.dll
2008-12-24 23:00:53 ----A---- C:\WINDOWS\system32\dpl100.dll
2008-12-24 23:00:53 ----A---- C:\WINDOWS\system32\DivXsm.exe
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\msvcr80.dll
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\msvcp80.dll
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\msvcp70.dll
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\msvcm80.dll
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\DivX.dll
2008-12-24 23:00:52 ----A---- C:\WINDOWS\system32\AudioSettingsMCE.dll
2008-12-24 20:53:39 ----D---- C:\Program Files\Common Files\Common Share
2008-12-24 20:53:39 ----A---- C:\WINDOWS\system32\devil.dll
2008-12-24 20:53:39 ----A---- C:\WINDOWS\system32\avisynth.dll
2008-12-24 20:53:37 ----D---- C:\Program Files\OJOsoft
2008-12-24 20:53:37 ----A---- C:\WINDOWS\system32\mfc71.dll
2008-12-23 23:46:48 ----N---- C:\WINDOWS\system32\spmsg.dll
2008-12-23 23:46:45 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2008-12-23 17:59:23 ----D---- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-12-23 09:05:17 ----D---- C:\Documents and Settings\All Users\Application Data\Sony
2008-12-23 09:05:17 ----D---- C:\Documents and Settings\Administrator\Application Data\Sony
2008-12-23 08:37:54 ----D---- C:\Program Files\Common Files\Sony Shared
2008-12-22 23:46:36 ----D---- C:\Program Files\Common Files\Apple
2008-12-22 23:46:32 ----D---- C:\Program Files\QuickTime
2008-12-22 23:46:29 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-12-22 23:37:48 ----D---- C:\Program Files\Apple Software Update
2008-12-22 23:37:48 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2008-12-22 23:29:43 ----D---- C:\Program Files\Sony
2008-12-22 23:29:43 ----D---- C:\Documents and Settings\All Users\Application Data\Sony Corporation
2008-12-22 23:15:30 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2008-12-22 23:14:24 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2008-12-22 19:01:47 ----D---- C:\Documents and Settings\Administrator\Application Data\Sony Setup
2008-12-22 19:01:33 ----D---- C:\Program Files\Sony Setup
2008-12-22 10:15:08 ----D---- C:\psp
2008-12-11 21:05:20 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2008-12-11 21:03:40 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2008-12-11 21:03:35 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2008-12-11 21:03:24 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2008-12-01 10:13:08 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2008-12-01 10:12:58 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2008-11-29 23:25:42 ----D---- C:\WINDOWS\Prefetch
2008-11-29 23:23:35 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-11-29 23:23:27 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2008-11-29 23:23:19 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-11-29 23:23:09 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2008-11-29 23:23:00 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-11-29 23:22:50 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2008-11-29 23:22:42 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-11-29 23:22:32 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-11-29 23:22:24 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-11-29 23:22:14 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2008-11-29 23:22:06 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2008-11-29 23:21:58 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-11-29 23:21:50 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
2008-11-29 23:21:39 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2008-11-29 23:21:31 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-11-29 23:21:23 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2008-11-29 23:21:14 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2008-11-29 23:21:05 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-11-29 23:15:48 ----D---- C:\WINDOWS\system32\scripting
2008-11-29 23:15:47 ----D---- C:\WINDOWS\l2schemas
2008-11-29 23:15:46 ----D---- C:\WINDOWS\system32\en
2008-11-29 23:15:46 ----D---- C:\WINDOWS\system32\bits
2008-11-29 23:13:08 ----D---- C:\WINDOWS\ServicePackFiles
2008-11-29 23:10:58 ----D---- C:\WINDOWS\network diagnostic
2008-11-29 23:08:58 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-11-29 23:05:23 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$

======List of files/folders modified in the last 3 months======

2009-02-20 06:45:40 ----D---- C:\WINDOWS\Internet Logs
2009-02-20 06:44:29 ----D---- C:\WINDOWS\Temp
2009-02-20 06:44:29 ----D---- C:\Documents and Settings\Administrator\Application Data\OpenOffice.org2
2009-02-20 06:44:17 ----D---- C:\WINDOWS
2009-02-20 06:43:52 ----D---- C:\WINDOWS\Registration
2009-02-20 06:42:42 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-02-20 06:41:31 ----D---- C:\WINDOWS\system32
2009-02-20 06:33:32 ----SHD---- C:\WINDOWS\Installer
2009-02-20 06:33:01 ----D---- C:\Program Files\Java
2009-02-20 06:25:27 ----D---- C:\Program Files\Mozilla Firefox
2009-02-19 23:01:55 ----D---- C:\WINDOWS\system32\drivers
2009-02-19 22:09:50 ----RD---- C:\Program Files
2009-02-17 21:00:32 ----D---- C:\Internet
2009-02-16 08:41:42 ----D---- C:\WINDOWS\system32\CatRoot2
2009-02-14 22:17:42 ----A---- C:\WINDOWS\system.ini
2009-02-14 21:55:17 ----D---- C:\DELL
2009-02-14 21:41:00 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-02-14 21:40:50 ----D---- C:\WINDOWS\Help
2009-02-14 21:40:44 ----RSD---- C:\WINDOWS\Fonts
2009-02-14 21:35:19 ----HD---- C:\WINDOWS\inf
2009-02-11 22:35:16 ----HD---- C:\WINDOWS\$hf_mig$
2009-02-11 22:35:14 ----A---- C:\WINDOWS\imsins.BAK
2009-02-11 22:35:03 ----D---- C:\Program Files\Internet Explorer
2009-02-03 17:21:12 ----A---- C:\WINDOWS\system32\MRT.exe
2009-01-25 16:55:19 ----HD---- C:\Program Files\InstallShield Installation Information
2009-01-25 16:54:54 ----RSD---- C:\WINDOWS\assembly
2009-01-25 16:54:46 ----D---- C:\WINDOWS\Microsoft.NET
2009-01-25 16:54:21 ----D---- C:\WINDOWS\system32\DirectX
2009-01-25 00:17:48 ----D---- C:\WINDOWS\system
2009-01-25 00:17:21 ----D---- C:\Program Files\Common Files\InstallShield
2009-01-16 21:35:14 ----A---- C:\WINDOWS\system32\mshtml.dll
2008-12-24 23:16:46 ----D---- C:\Program Files\Common Files
2008-12-23 23:47:26 ----D---- C:\WINDOWS\system32\CatRoot
2008-12-23 08:37:43 ----D---- C:\WINDOWS\WinSxS
2008-12-22 23:37:53 ----SD---- C:\WINDOWS\Tasks
2008-12-22 23:29:53 ----SD---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-12-22 23:15:42 ----D---- C:\Program Files\Windows Media Player
2008-12-22 23:14:39 ----D---- C:\WINDOWS\system32\LogFiles
2008-12-22 23:10:32 ----D---- C:\Program Files\Common Files\Microsoft Shared
2008-12-22 23:10:07 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-12-20 17:15:41 ----A---- C:\WINDOWS\system32\wininet.dll
2008-12-20 17:15:40 ----A---- C:\WINDOWS\system32\webcheck.dll
2008-12-20 17:15:40 ----A---- C:\WINDOWS\system32\urlmon.dll
2008-12-20 17:15:39 ----A---- C:\WINDOWS\system32\url.dll
2008-12-20 17:15:38 ----N---- C:\WINDOWS\system32\pngfilt.dll
2008-12-20 17:15:38 ----N---- C:\WINDOWS\system32\occache.dll
2008-12-20 17:15:32 ----N---- C:\WINDOWS\system32\mstime.dll
2008-12-20 17:15:31 ----N---- C:\WINDOWS\system32\msrating.dll
2008-12-20 17:15:30 ----N---- C:\WINDOWS\system32\mshtmled.dll
2008-12-20 17:15:24 ----A---- C:\WINDOWS\system32\msfeedsbs.dll
2008-12-20 17:15:23 ----N---- C:\WINDOWS\system32\jsproxy.dll
2008-12-20 17:15:23 ----A---- C:\WINDOWS\system32\msfeeds.dll
2008-12-20 17:15:22 ----A---- C:\WINDOWS\system32\iertutil.dll
2008-12-20 17:15:21 ----N---- C:\WINDOWS\system32\iernonce.dll
2008-12-20 17:15:21 ----A---- C:\WINDOWS\system32\ieframe.dll
2008-12-20 17:15:16 ----N---- C:\WINDOWS\system32\iedkcs32.dll
2008-12-20 17:15:15 ----A---- C:\WINDOWS\system32\ieapfltr.dll
2008-12-20 17:15:14 ----N---- C:\WINDOWS\system32\ieaksie.dll
2008-12-20 17:15:14 ----N---- C:\WINDOWS\system32\ieakeng.dll
2008-12-20 17:15:13 ----N---- C:\WINDOWS\system32\extmgr.dll
2008-12-20 17:15:13 ----N---- C:\WINDOWS\system32\dxtrans.dll
2008-12-20 17:15:13 ----A---- C:\WINDOWS\system32\icardie.dll
2008-12-20 17:15:12 ----N---- C:\WINDOWS\system32\dxtmsft.dll
2008-12-20 17:15:11 ----A---- C:\WINDOWS\system32\advpack.dll
2008-12-19 03:10:15 ----N---- C:\WINDOWS\system32\ie4uinit.exe
2008-12-19 03:10:15 ----A---- C:\WINDOWS\system32\ieudinit.exe
2008-12-18 23:23:56 ----N---- C:\WINDOWS\system32\ieakui.dll
2008-12-18 07:20:21 ----D---- C:\WINDOWS\ie7updates
2008-12-13 22:43:11 ----D---- C:\WINDOWS\pchealth
2008-11-29 23:26:17 ----A---- C:\WINDOWS\OEWABLog.txt
2008-11-29 23:25:24 ----A---- C:\WINDOWS\setuplog.txt
2008-11-29 23:24:50 ----D---- C:\WINDOWS\system32\wbem
2008-11-29 23:24:50 ----D---- C:\WINDOWS\system32\Setup
2008-11-29 23:24:50 ----D---- C:\WINDOWS\AppPatch
2008-11-29 23:24:50 ----D---- C:\Program Files\Messenger
2008-11-29 23:24:21 ----D---- C:\WINDOWS\security
2008-11-29 23:16:05 ----D---- C:\WINDOWS\system32\inetsrv
2008-11-29 23:16:04 ----D---- C:\WINDOWS\ime
2008-11-29 23:15:49 ----D---- C:\WINDOWS\system32\usmt
2008-11-29 23:15:49 ----D---- C:\WINDOWS\system32\en-US
2008-11-29 23:15:46 ----D---- C:\WINDOWS\PeerNet
2008-11-29 23:15:46 ----D---- C:\Program Files\Movie Maker
2008-11-29 23:12:58 ----D---- C:\WINDOWS\system32\Restore
2008-11-29 23:12:58 ----D---- C:\WINDOWS\system32\npp
2008-11-29 23:12:57 ----D---- C:\WINDOWS\mui
2008-11-29 23:12:56 ----D---- C:\WINDOWS\msagent
2008-11-29 23:12:54 ----D---- C:\WINDOWS\srchasst
2008-11-29 23:12:54 ----D---- C:\Program Files\NetMeeting
2008-11-29 23:12:52 ----D---- C:\WINDOWS\system32\Com
2008-11-29 23:12:50 ----D---- C:\Program Files\Windows NT
2008-11-29 23:12:50 ----D---- C:\Program Files\Outlook Express
2008-11-29 23:12:47 ----D---- C:\Program Files\Common Files\System
2008-11-29 23:12:27 ----D---- C:\WINDOWS\system32\oobe
2008-11-29 21:28:58 ----D---- C:\WINDOWS\ehome
2008-11-29 14:46:01 ----D---- C:\WINDOWS\system32\ZoneLabs

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 OMCI;OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632]
R1 vsdatant;vsdatant; C:\WINDOWS\System32\vsdatant.sys [2008-10-09 353680]
R2 Aspi32;Aspi32; C:\WINDOWS\System32\drivers\aspi32.sys [2009-01-07 16512]
R3 E100B;Intel® PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2004-02-10 154112]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-04-05 830684]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-10 12160]
R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2004-09-17 732928]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2005-03-22 260224]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 gmer;gmer; C:\WINDOWS\System32\DRIVERS\gmer.sys [2009-02-19 85969]
S3 MHNDRV;MHN driver; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2005-10-11 237568]
R2 ehSched;Media Center Scheduler Service; C:\WINDOWS\eHome\ehSched.exe [2005-08-05 102912]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-02-20 152984]
R2 McrdSvc;Media Center Extender Service; C:\WINDOWS\ehome\mcrdsvc.exe [2005-08-05 99328]
R2 vsmon;TrueVector Internet Monitor; C:\WINDOWS\system32\ZoneLabs\vsmon.exe [2008-10-09 2405776]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]

-----------------EOF-----------------

#10 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:07:30 AM

Posted 20 February 2009 - 02:57 PM

Repeat the OTMoveIt3 step but this time with below script.. Post the log here after that..

:reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{872f7741-2f10-11dd-bbfd-806d6172696f}]




Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan.
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the ActiveX control to install
  • Click Start
  • Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  • Click Scan
    Wait for the scan to finish
  • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic

Post these logs in your next reply..

1. OTMoveIt3
2. ESET Online Scanner
3. How's the computer now? :thumbup2:

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#11 rvreeland

rvreeland
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:05:30 PM

Posted 21 February 2009 - 12:55 AM

Ran the ESET scanner first by mistake and then the OTMoveIT3. My mistake. I am posting the ESET log before the OTMoveIT3 process then the OTMOVEIT3 log and finally a second ESET scanner log.

# version=4
# OnlineScanner.ocx=1.0.0.635
# OnlineScannerDLLA.dll=1, 0, 0, 79
# OnlineScannerDLLW.dll=1, 0, 0, 78
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3874 (20090220)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.066 (20070917)
# EOSSerial=ef3e0e8388ab70418bdb28b8c65fc317
# end=finished
# remove_checked=true
# unwanted_checked=true
# utc_time=2009-02-20 09:24:08
# local_time=2009-02-20 03:24:08 (-0600, Central Standard Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 3
# scanned=271771
# found=10
# scan_time=1966
C:\autorun.inf Win32/PSW.OnLineGames.NMY trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\_OTMoveIt\MovedFiles\02202009_064126\6o0.bat Win32/PSW.OnLineGames.NMY trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\_OTMoveIt\MovedFiles\02202009_064126\dgf.exe Win32/PSW.OnLineGames.NMY trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\_OTMoveIt\MovedFiles\02202009_064126\om.cmd Win32/PSW.OnLineGames.NMY trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\_OTMoveIt\MovedFiles\02202009_064126\WINDOWS\system32\godert1.dll Win32/PSW.OnLineGames.NMP trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\_OTMoveIt\MovedFiles\02202009_064126\WINDOWS\system32\lhgjyit0.dll Win32/PSW.OnLineGames.ODJ trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\_OTMoveIt\MovedFiles\02202009_064126\WINDOWS\system32\lhgjyit1.dll Win32/PSW.OnLineGames.ODJ trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\_OTMoveIt\MovedFiles\02202009_064126\WINDOWS\system32\uret463.exe Win32/PSW.OnLineGames.NMY trojan (unable to clean - deleted) 00000000000000000000000000000000
D:\8oupido.bat Win32/PSW.OnLineGames.NMY trojan (unable to clean - deleted) 00000000000000000000000000000000
D:\autorun.inf Win32/PSW.OnLineGames.NMY trojan (unable to clean - deleted) 00000000000000000000000000000000


OTMoveIT3 log

========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{872f7741-2f10-11dd-bbfd-806d6172696f}\\ deleted successfully.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02202009_234808

#12 rvreeland

rvreeland
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:05:30 PM

Posted 21 February 2009 - 01:37 AM

Final ESET log. The machine seems to be clean at this point. I appreciate your help. Is there anything else to scan for?



# version=4
# OnlineScanner.ocx=1.0.0.635
# OnlineScannerDLLA.dll=1, 0, 0, 79
# OnlineScannerDLLW.dll=1, 0, 0, 78
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3875 (20090220)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.066 (20070917)
# EOSSerial=ef3e0e8388ab70418bdb28b8c65fc317
# end=finished
# remove_checked=true
# unwanted_checked=true
# utc_time=2009-02-21 06:31:36
# local_time=2009-02-21 12:31:36 (-0600, Central Standard Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 3
# scanned=271730
# found=0
# scan_time=1964

#13 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:07:30 AM

Posted 21 February 2009 - 09:45 AM

Looks good to me.. Lets do some cleanup...


Please download OTCleanIt and save it to Desktop.
  • Make sure you have internet connection..
  • Double-click OTCleanIt.exe
  • Click the CleanUp! button.
  • Select Yes when the "Begin cleanup Process?" prompt appears.
  • If you are prompted to Reboot during the cleanup, select Yes


Please read these excellent articles by miekiemoes :
Help! My computer is slow!
How to prevent Malware



Read these links about safe internet surfing..

http://www.pcpitstop.com/spycheck/safesurfing.asp
http://bluefive.pair.com/practice_safe_surfing.htm



Please reply to this thread once more and tell us about the computer behaviour before we can close this thread :thumbup2:



Have a safe and happy computing day!


Regards
fenzodahl512

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#14 rvreeland

rvreeland
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:05:30 PM

Posted 21 February 2009 - 12:01 PM

Excellent work !

Thanks for your help every thing looks in good shape. Feel free to close my topic.

Regards,

rvreeland




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users